Well, if you ask why only once, then it's a software failure - a system with a serious amount of control authority can fail catastrophically if just one hardwar

Well, if you ask why only once, then it's a software failure - a system with a serious amount of control authority can fail catastrophically if just one hardware sensor fails. Safety critical software like this must account for hardware failures. But there are many many more whys you need to ask before you get the full picture.