For starters, Uber could have just not disabled the existing failsafe mechanisms that the car had. Then, if we start with the expectation that a human in the l

For starters, Uber could have just not disabled the existing failsafe mechanisms that the car had. Then, if we start with the expectation that a human in the loop is necessary for live testing, we could have two. It reduces the impact of independent failures. It also adds some social pressure to avoid negligence. It also provides overlapping coverage, as a lifeguard in this thread has pointed out. Humans are fallible. Accept that, and design systems to be safe despite individual errors. Driving a car is not the same aa monitoring a self driving car. There will be differences in attentiveness. Stop equating them.