thanks for the comments. you're correct, the setup can accommodate only a single failure in the multiple primary-single secondary situation, but our assessment was that you can go pretty far down the proverbial rabbit hole in trying to achieve redundancy, and that this was as you said a reasonable, low-cost solution....