[dvdkhlng]

> If one sensor failure is 10E-5, two simultaneous should be 10E-10.

That only holds if errors are statistically independent. See also Common Mode Failure [1].

[1] https://en.wikipedia.org/wiki/Common_cause_and_special_cause...