As an ex-Oil company employee (some 30 years), I note we always
arranged that any equipment had a fail-to-safe mode default. If a
signal is not received within a defined minimum time, the external
processes must protect themselves and everything they in turn,
control.

The problems suggested by Gary, if truely existing, need engineers to
revise their designs.