> So, technically I don't see any problem. Well the problem _is_ there, so please do see it. The fact that there is a mitigating control does not eliminate th

> So, technically I don't see any problem. Well the problem _is_ there, so please do see it. The fact that there is a mitigating control does not eliminate the problem, it merely dissipates temporarily (since this is a manual control, once the manual intervention ceases, the problem will re-emerge). The default state is never "pedal to the metal". If something should fail - it should "fail-stop", and not "fail-to-full-throttle".