TL;DR — A second GSU 25 and a G5 do not protect you from the same failures. Dual identical ADAHRS excels at catching a lying sensor but shares hardware, software, CAN bus, and power with itself — one common-mode event takes both. The G5 is dissimilar, self-contained, battery-backed, and uniquely keeps a coupled autopilot when the displays go dark. Run the failure modes one at a time and it isn’t close: the G5 wins. Garmin’s brand-new AXIS quietly agrees — its recommended configurations still pair with a dissimilar standby. Don’t take my word for it: the interactive failure simulator below lets you break components — stack as many as you like — and watch what survives in each architecture.

Somewhere in every G3X panel plan, the same fork appears. You’ve got one GSU 25 feeding your displays, and you know one sensor isn’t enough for serious cross-country IFR flying. The catalog offers an easy answer: add a second GSU 25. Same part, same wiring pattern, automatic reversion, miscompare monitoring. Garmin’s architecture supports it natively, and plenty of builders check that box and move on.

The other path is a G5 — a self-contained standby with its own AHRS, its own air data computer, its own display, and its own battery. Roughly the same money. Very different philosophy.

Both options get called “redundancy,” and that word is doing a lot of unexamined work. A second GSU 25 and a G5 do not protect you from the same failures, and the difference isn’t a matter of taste — it’s a matter of which failures you think are worth defending against. That question has an analytical answer. In an E-AB aircraft, nobody handed me a certified system architecture with the failure analysis already done. As a builder/owner of record for N117ZS, which means “redundancy” isn’t a checkbox — it’s a claim I have to be able to defend.

So this post is that defense: a failure mode analysis of both architectures, walked through one fault at a time. What happens when an ADAHRS dies. When the CAN bus glitches. When the software has a bad day. When the alternator quits at night and the main bus goes with it. And — the part that ultimately decided it for me — what happens to the autopilot in each of those moments.

Garmin just made this question timely, too. AXIS, launched this week, reuses the same sensor architecture — and Garmin’s own recommended configurations still pair it with a dissimilar standby. We’ll come back to what that tells us.

What redundancy actually means

Reliability engineering has precise language for what pilots casually call “backup,” and two of its terms do the heavy lifting here: independence and common-mode failure. Redundancy math gets its power from independence — if each unit fails rarely, both failing together is rare squared. A common-mode failure is what happens when the independence assumption doesn’t hold: a single cause takes out multiple components because they share something. A power source, a data bus, a design, a software load. Correlation quietly destroys the multiplication. Two units that share a critical vulnerability aren’t rare-squared; they’re rare, times one.

Transport-category aviation internalized this decades ago. Flight-critical systems don’t just carry multiple computers — they carry dissimilar ones: different processors, different software teams, precisely so no single design error can reason its way through every channel simultaneously. The redundancy is philosophical: the designers assumed their own design could be the failure.

That’s the standard worth borrowing. The question is never “how many attitude sensors do I have?” It’s “what single event takes all of them away?” Count the shared dependencies and you’ve counted your common modes.

One more distinction: availability and integrity are different goals. Availability means data keeps flowing after a failure; integrity means you can trust it and detect when something’s lying. Dual identical sensors are genuinely strong on integrity — comparing like sources is how you catch a subtle failure. Dissimilar architecture is stronger on availability — surviving the big, correlated events. The two architectures aren’t just different answers; they’re optimizing for different questions.

Architecture A: dual GSU 25

Two GSU 25s, both on the CAN bus, both plumbed to pitot and static, both feeding the displays. The install manual supports it cleanly and the system handles source management automatically. Give this architecture its full due, because it genuinely delivers things the alternative doesn’t.

First, integrity monitoring. With two ADAHRS units online, the G3X continuously cross-compares them and annunciates when they disagree beyond tolerance — the system tells you something is lying before the lie gets dangerous. The most insidious instrument failure isn’t the one that dies with a red X; it’s the one that keeps confidently displaying slightly wrong data, and dual identical sensors are the textbook defense against that failure class. Second, seamless reversion: a failed unit is swapped out automatically, no pilot action, no scan transition, in whatever moment the airplane chose to have the problem. Third, zero new interface — both sources drive the same familiar PFD presentation.

Now the accounting. List what these two units share, because every entry is a common mode. The same hardware design — any latent component-level weakness exists in both. The same software — a bug that produces bad output under some rare condition produces it twice, simultaneously, in agreement, and the comparison goes quiet precisely because both sources are wrong the same way. The same CAN bus — a corrupted network degrades what both units depend on to deliver data anywhere. The same electrical power — neither the GSU 25s nor the GDUs carry internal batteries. A dedicated backup battery, if fitted, can hold the essentials alive — but typical endurance is on the order of thirty minutes (depending on load), not hours, and it’s one more shared element feeding the same similar hardware. Lose everything electrical and both sensors die at the same instant, along with the displays showing them.

That last one deserves emphasis because it’s not exotic. Total electrical failure is arguably the canonical E-AB emergency — builder-fabricated wiring, one alternator, one battery. Against that event, the second GSU 25 contributes precisely nothing. You’ve spent real money to double your protection against the failure mode the system already handled gracefully, while adding zero protection against the one that turns your glass panel into glossy black rectangles.

Dual ADAHRS, then, is an integrity architecture: excellent at catching a sensor that’s wrong, quietly hoping nothing takes out the things both sensors share.

Architecture B: GSU 25 + G5

Keep the single GSU 25 as primary, put a G5 in the panel, and run the same shared-dependency accounting — the list nearly empties. Different hardware design. Different software, developed as a separate product line. Its own air data, teed into pitot and static. Its own display. Its own power once the bus goes: the optional backup battery is rated for up to four hours, and for this architecture it isn’t optional — order it, or the availability argument below collapses. Garmin’s G3X installation manual (190-01115-01, Rev. AZ at this writing) makes the design intent explicit — the G5 features dissimilar hardware and software specifically to eliminate common-mode failures with the primary system.

And here’s the part that surprised me in the manual: the G5 isn’t merely a parallel instrument — it participates. It synchronizes baro and heading with the G3X. If the GSU 25’s data goes invalid, the G3X displays present the G5’s attitude and air data — the standby quietly becomes a reversionary sensor source for your primary displays. And, decisively, with a GMC mode controller in the panel, the G5 can drive the GSA 28 servos with every GDU in the airplane dark. All of the autopilot section below hangs on that sentence.

The costs, stated fairly: you give up automatic cross-comparison — checking G3X against G5 is now your scan’s job, though a gross disagreement between two instruments inches apart is not subtle. You add a second interface to stay current on. And the G5 occupies panel real estate a remote-mounted GSU 25 doesn’t.

Why the G5 specifically

A word about this instrument, because a decade after introduction it remains one of the most quietly remarkable pieces of hardware in GA. At around $1,600 for the experimental version, the G5 costs about what an overhaul of a mechanical attitude indicator runs — for a solid-state instrument with no vacuum system, sunlight-readable glass, and a battery that keeps flying after the airplane’s electrical system has given up. A GSU 25 sits in the same price neighborhood (~$900), and it’s a sensor that’s useless without the system around it. The G5 is the whole system, in a 3⅛-inch hole. It might be the best value-per-safety-dollar in the panel.

Its longevity is its own endorsement: introduced in 2016, still current in 2026, and still Garmin’s named standby pairing for AXIS, the brand-new flagship announced this week. The GI 275 is newer and more capable in absolute terms — synthetic vision, touchscreen, MFD functions — but in the G3X ecosystem it cannot do the one thing that matters most here: per the installation manual, the GI 275 cannot serve as a backup flight director path the way the G5 can. For this specific role, the older, cheaper instrument is the better one. That doesn’t happen often in avionics.

The failure mode matrix

Now we put the architectures side by side and break things, one fault at a time. Each scenario is a single event — no stacked emergencies. This one thing fails; what are you looking at?

One ADAHRS fails outright. Architecture A shines: automatic reversion, a system message, everything keeps working including the autopilot. Full marks — this row is A’s best case, worth conceding plainly. Architecture B: the G3X reverts to displaying the G5’s data on the PFD, and the panel keeps functioning — on standby-grade data. Time to be somewhere with a runway.

Subtle sensor error — wrong but confident. This is what automatic cross-comparison exists for; Architecture A flags the disagreement fast. In B, detection is your cross-check — the monitoring is manual, but the sources are dissimilar: an error mechanism in the GSU 25’s design is unlikely to be replicated in the G5’s, so when they disagree you hold genuinely independent evidence. A detects faster; B arbitrates better. Which leads to A’s dirty secret —

Common software fault. Both GSU 25s run identical firmware. A bug triggered by some rare condition executes identically in both units, and they agree with each other perfectly. The comparison, fed two copies of the same mistake, stays silent. Insidiously red for A — the failure arrives wearing the costume of two healthy agreeing sensors. The G5’s independent software has no reason to share the bug; your panel disagrees loudly, which is exactly what you want.

CAN bus fault. Every GSU 25’s data travels this bus; both sensors can be healthy and both unreachable. The G5 doesn’t need the network for its core job — sensing and display live in the same can. It keeps flying.

Main bus power loss. The canonical E-AB nightmare: alternator quits, battery depletes, or a burning smell makes you shed the bus by choice. Architecture A: both GSU 25s and every GDU die together — the deepest red on the chart. A dedicated backup battery, if fitted, buys the essentials something like thirty minutes. Architecture B: the G5 blinks to battery and gives you up to four hours of attitude, airspeed, and altitude on dissimilar, self-contained hardware — a different class of survival. This single row is worth the price of the instrument.

Display (GDU) failure. Sensors fine, screens dead. In A, your ADAHRS units are healthy and mute. The G5 is its own display. Still flying.

Read the matrix top to bottom and the pattern is unmistakable. Architecture A wins row one and half of row two — the failures the system was designed around. Architecture B wins rows three through six — the failures that share a cause, arrive at the system level, all at once, with no graceful reversion. The second GSU 25 defends beautifully against the smallest failure on the chart. The G5 defends against everything below it.

The autopilot dimension

Everything to this point has been about keeping attitude data in front of you. The second question hiding inside every partial-panel scenario may matter more: who’s flying the airplane while you deal with this? Hand-flying partial panel is a perishable skill that degrades precisely when you need it — night, bumps, single-pilot, while troubleshooting, briefing a diversion, and talking to ATC. A coupled autopilot during a systems emergency is a second crew member who never gets vertigo.

So the discriminating question isn’t just “what data survives?” It’s “what can still fly the airplane?” The G3X ecosystem answers with a ladder of degradation — each rung assuming the one above has failed.

Tier 1 — normal ops. G3X PFD, GSU 25 data, GFC 500 flying, everything coupled through the GTN.

Tier 2 — the G5 flies the airplane. Primary displays dark or ADAHRS data gone, but a G5 and GMC controller in the panel: the G5’s own AHRS drives the GSA 28 servos. Heading, altitude hold, flight director cues on the standby — Garmin’s own product literature goes as far as coupled GPS approaches flown or continued after a primary display loss. Read that again: with every GDU dark, the autopilot still works. In Architecture A, tier 2 does not exist — dual GSU 25s with dead displays have nowhere to send their data and no interface to command the servos.

Tier 3 — the servos’ last stand. The GSA 28s retain a reversionary mode: basic wings-level and altitude hold commanded from the mode controller, without any display participating. A straight-and-level machine, not a navigator — but straight-and-level is exactly the commodity that’s scarce in a partial-panel emergency. It buys time and cognitive bandwidth, the two things that crash airplanes when they run out.

Tier 4 — hands. The rung every tier above exists to keep you off of.

Two boundary conditions on tier 2, because precision matters more than enthusiasm. First, Garmin’s claim is servo drive with power removed from the GDU displays — not the whole airplane. In a total electrical failure the GSA 28s themselves are unpowered: the G5 keeps you upright on its battery, but nothing is driving the servos. The battery scenario keeps your attitude; it does not keep your autopilot. Second, servo commands travel the CAN bus, so a bus-level fault can take the coupled autopilot from either architecture even while the G5 keeps displaying faithfully. Dissimilarity protects the data; it cannot protect a shared actuation path.

One more caution. Reversion behavior lives at the intersection of hardware, software versions, and configuration — and it has shifted across software releases. The only version that matters is the one installed in your airplane, which makes this a capability to demonstrate, not assume: a reversion path you haven’t tested is a hypothesis. On the ground, master on, engine off: fail your displays deliberately and confirm the G5 actually picks up the servos, that modes engage, that trim behaves. In an E-AB, nobody runs that acceptance test unless the repairman does.

What AXIS tells us

Three days before this post, Garmin announced AXIS — a clean-sheet family of flight displays positioned as the successor generation to the G3X Touch, for experimental and certified airframes alike. New processors, a high-speed data bus alongside CAN, integrated IFR GPS/NAV/COM/audio options in a single bezel. A from-scratch rethink of the panel’s centerpiece, from the company with more data on GA glass failures than anyone alive. Which makes AXIS a fascinating witness: given a blank sheet, how did Garmin architect redundancy?

Two answers stand out. First, AXIS deliberately reuses the G3X sensor architecture — same GSU 25, same magnetometer, same LRUs, same panel cutouts. The fork this analysis examines carries forward intact into the next decade of panels. Second, and more telling: every configuration Garmin describes still assumes a dissimilar standby beside the new displays. Their own example panels pair AXIS with a G5 or GI 275, and launch coverage was blunt that a standby flight instrument remains expected regardless of configuration. Sit with that. A brand-new integrated flight display — faster and more self-contained than anything Garmin has shipped to this market — and the redundancy answer is still a small, independent, battery-backed instrument built from different hardware running different software. The company that would profit handsomely from selling you two of everything architected its flagship around dissimilarity.

One gap: AXIS is three days old, and the documentation isn’t deep enough yet to confirm whether the G5’s servo-drive reversion path carries into AXIS installations unchanged, or how the new HSDB bus factors into the failure analysis. Questions worth revisiting when the installation manual reaches public hands — this blog will.

The verdict: the G5 wins

The steelman for the road not taken, one last time: dual GSU 25s give the fastest detection of a lying sensor, the smoothest reversion, and zero added interface. If your mission is hard IFR behind a bulletproof electrical system — dual alternators, dual batteries, essential bus design — the common-mode power argument weakens and the integrity argument gains weight. There are panels where dual ADAHRS is a defensible first choice.

But for most of us flying E-AB airplanes, the analysis lands where the matrix said it would. Even a Rotax iS with its two integrated generators doesn’t change the math: if one fails, the survivor is dedicated to keeping the FADEC and fuel pumps alive — the engine keeps running, and the panel is on its own. From the avionics bus’s perspective, it’s still a single-source electrical system.

The second identical sensor defends against the failure the system already handles most gracefully. The dissimilar standby defends against everything else — the software fault that lies in stereo, the bus that takes healthy sensors hostage, the electrical failure that is the signature E-AB emergency, the dark displays that make perfect data irrelevant. And it does the one thing no second GSU 25 can: it keeps a coupled autopilot under you while you work the problem. If it’s either/or, it isn’t close. And if it doesn’t have to be either/or, dual GSU 25s plus a G5 is the no-compromise answer — cross-comparison integrity on top, dissimilar survivability underneath. The point was never that a second ADAHRS is bad; it’s that a second ADAHRS instead of a dissimilar standby answers the wrong question.

Roci flies the architecture this analysis recommends: one GSU 25, one G5, GFC 500 behind them, and a ground-tested reversion path — because a capability you haven’t demonstrated is still just a hypothesis. When I run the failure scenarios above against my own panel, the rows come up green where it counts. That’s not luck. That’s what it means to be the systems engineer of record.

Want to pressure-test your own panel? The simulator below lets you fail components — stack as many as you like — and watch what survives in each architecture. And yes, you can fail the G5 too; watch what that teaches you about which combinations neither architecture can answer. Break things here, where it’s free.

Two of the same sensor isn’t redundancy. It’s a spare. Know the difference before the night you need to.