The control software should not be physically able to command the hardware to enter an invalid state. You can do that by only exposing the 3 valid modes to the

The control software should not be physically able to command the hardware to enter an invalid state. You can do that by only exposing the 3 valid modes to the software or only enabling power to the emitter if every piece of hardware is in the correct place when the software request arrives. You also have a hardware lock on the power - this can be as simple as a hardware timer (a RC circuit siffices) which limits how long the emitter can be on within in a given window to be safe. Never trust the software. If you must trust some software, create a minimal set you CAN trust which isolates the rest of the software from the hardware. You are correct, the discussion about how to exercise this bug (fast UI, blah blah) is interesting to hear but totally irrelevant to the lesson (don't trust software).