>When an op amp failed, the generator produced full power whenever we asked for any power at all.

Huh, I'd expect sensitive systems like these to have some sort of hardware redundancy/voting system.