A dead man’s switch should be fail-close, and enable operation when functioning, not disable operation upon disfunction. The latter is vulnerable to double failures, the former is not.