Automatic shutdown systems independent of operator intervention: how to ensure that it will work correctly?