This was my first guess, although I do not have explicitly experience in life-or-death type of control systems. In such systems, does it make sense to have more than two states? Something like "open", "unknown but not open", "unknown but not closed", "unknown", "closed"? (Assuming that you have enough limit switches.)