You would think the therac-25 was enough of an engineering lesson on designing safety-critical systems in software that lack hardware redundancy. Maybe they didn't consider the door handles "safety critical".
Another lesson not learnt from therac-25 (and really most disasters caused by humans) is that safety is a cultural issue, that needs to be taken seriously from top to bottom in the organization.
I don't know about hardware redundancy, but yes for at least "easily verifiable limiters".
What is "hardware" anyway? Does a microcontroller-based integrator or debouncer count? Depending on how you define that, it can become a serious roadblocker. But anyway, I guess that point is moot for a door handle, you can fix it with stuff that is unambiguously hardware.
