How to achieve network redundancy with dual Aruba core switches?

This question is inspired by "we take down the network 4 times a year..." post.

Let's say you have two 6300M core switches. How would you configure them to be redundant with no down time but still allow firmware upgrades?

How do you design a network to be full redundant like many of the replies state, but still allow firmware upgrades?