How is replacing a failing system with a unverified system sensible?