It depends on what the potential outcomes are. I've worked on a (medical, not aviation) system where we tried as much as possible to recover from subsystem fai

It depends on what the potential outcomes are. I've worked on a (medical, not aviation) system where we tried as much as possible to recover from subsystem failures or at least gracefully reduce functionality until it was safe to shut everything down. However, there were certain classes of failure where the safest course of action was to shut the entire system down immediately. This was generally the case where continuing to run could have made matters worse, putting patient safety at risk. I suspect that the designers of this system ran into the same problem.