Redundancy doesn't work for design errors. You would need two diverse systems that have to agree before applying the brakes. This would also increase the "false negative" rate. It's a balance.