It depends on the system's potential failure modes and what's required by your safety standard, not on one engineer's opinion of what's "best".