It's usually driven by system safety analysis criteria. E.g., if a timer failure is categorized as "catastrophic" it may be required to have X amount of redundancy. The amount of redundancy defined by 'X' may be driven by customer (i.e. NASA) requirements.