Fukushima is what happens. It's when you have a common-cause failure for your backup systems. This gets underestimated in probabilistic risk assessment (something I'm sure the TTC doesn't do). They assume they have 3 backup generators each with a 1 in 1,000 chance of failure, assume they're independent, and then just multiply the probabilities. Oh look, we have a 1 in a billion chance of failure. However, if a common cause failure, design flaw, fire, or say earthquake/tsunami knocks out all 3, the independence assumption is out the window.