How would you design a fault-tolerant control system for industrial machinery that must safely handle sensor failures and emergency stops?