This is an excellent illustration of how software failsafes are unacceptable in internet connected pieces of hardware interacting with human beings. At a minimum you want all your interlocks to connect to a logic board with an FPGA that can not be upgraded remotely (to avoid someone overriding the FPGA programming using an updated bitstream).