What seems to have happened here is that the six nines up-time was calculated/predicted on the basis of no common cause failures, of which it appears this scena

What seems to have happened here is that the six nines up-time was calculated/predicted on the basis of no common cause failures, of which it appears this scenario depicts. Taking into account common cause failures (which are often as a result of root causes by human factors) your six nines can very easily be more like three or four nines. As a functional safety engineer that applies IEC61508/61511 for a living this is a common problem and addressed by diversity in systems, achieving the same goal in redundant systems by different hardware/software means. Airbus and Space Shuttle flight controls do a similar thing with multiple CPUs of different types with software implemented to the same spec by different teams, in some cases different languages. Not saying this is what they should be doing in their case as the mission is not so critical, but if you really want five or six nines this becomes extremely difficult with limited diversity in hardware and software.