No system can avoid failure 100% of the time. It may find itself going too fast with a unexpected loss of some control - brake failure, intentional sabotage, (imperceptible) oil slick, whatever. However, the system still has some control to choose between several terrible and costly outcomes. It must choose its victim. How should it chose?