Earlier quoted context omitted.
What's the point of having redundancy if you can't use it to avoid an impact to service? Edit: and to be clear, we're not talking about holding down a resetable circuit breaker to avoid being late, we're talking about the rail network of an entire nation being inoperable for a day.
The point is to still have it when you didn’t know you needed it. That’s the purpose of all redundant safety systems. The redundancy isn’t there to keep the service operating; it’s to keep people from dying. You can never know if the primary safety system is functioning perfectly, so you need other systems to be there to step in when the primary fails unexpectedly . If you detect the primary system has failed, isn’t…
This isn't some consumer appliance where you have to stupid proof every inch of it. These systems are bespoke and their architecture is mostly a matter of business decisions and not at all a matter of the internet peanut gallery trying to figure out how safe they can make it.