I remember starting to use software to stop a machine when the door was opened. A more experienced engineer stopped that and we added relay hard logic. That was 40 years ago, it's clear as day. Exactly the same issue with the Therac-25.