A method comprising: determining, by processing circuitry of a first network device, a primary path between the first network device and a second network device; determining, by the processing circuitry, a plurality of candidate backup paths between the first network device and the second network device; determining, by the processing circuitry, whether a first candidate backup path of the plurality of candidate backup paths satisfies a first priority criteria; in response to determining that the first candidate backup path satisfies the first priority criteria, selecting the first candidate backup path as a backup path for the primary path; in response to determining that the first candidate backup path does not satisfy the first priority criteria, determining whether a second candidate backup path of the plurality of candidate backup paths satisfies a second priority criteria; in response to determining that the second candidate backup path of the plurality of candidate backup paths satisfies the second priority criteria, selecting the second candidate backup path as the backup path for the primary path instead of the first candidate backup path, wherein the first priority criteria and the second priority criteria are based, at least in part, on corresponding risks of simultaneous failure of the primary path and a candidate backup path of the plurality of backup paths and wherein the second priority criteria comprise a requirement that the primary path and the candidate backup path are arranged such that they both fail when a line card shared by the primary path and the candidate backup path fails; programming one or more packet processors of the first network device with either or both the primary path and the backup path; receiving, by a routing protocol process of the first network device, line card identifiers, IDs, for a plurality of line cards of the first network device; and determining, by the routing protocol process, that the primary path and the candidate backup path share the line card based on determining that a first line card ID for the line card in the primary path matches a second line card ID for the line card in the candidate backup path. determining, by processing circuitry of a first network device, a primary path between the first network device and a second network device; determining, by the processing circuitry, a plurality of candidate backup paths between the first network device and the second network device; determining, by the processing circuitry, whether a first candidate backup path of the plurality of candidate backup paths satisfies a first priority criteria; in response to determining that the first candidate backup path satisfies the first priority criteria, selecting the first candidate backup path as a backup path for the primary path; in response to determining that the first candidate backup path does not satisfy the first priority criteria, determining whether a second candidate backup path of the plurality of candidate backup paths satisfies a second priority criteria; in response to determining that the second candidate backup path of the plurality of candidate backup paths satisfies the second priority criteria, selecting the second candidate backup path as the backup path for the primary path instead of the first candidate backup path, wherein the first priority criteria and the second priority criteria are based, at least in part, on corresponding risks of simultaneous failure of the primary path and a candidate backup path of the plurality of backup paths and wherein the second priority criteria comprise a requirement that the primary path and the candidate backup path are arranged such that they both fail when a line card shared by the primary path and the candidate backup path fails; programming one or more packet processors of the first network device with either or both the primary path and the backup path; receiving, by a routing protocol process of the first network device, line card identifiers, IDs, for a plurality of line cards of the first network device; and determining, by the routing protocol process, that the primary path and the candidate backup path share the line card based on determining that a first line card ID for the line card in the primary path matches a second line card ID for the line card in the candidate backup path.