That's exactly what you do. In all systems you should have two switches, and you annunciate on / off / travelling / error to the operator. Often you inherit something that doesn't have that.

In anything that really matters you have a continuous position transmitter instead of switches so your state is more obvious. In safety systems you might have 2 or 3 of those transmitters so you can have a backup or a vote