> If it is really, really safety critical

Your suggestions should be fine for hardware failure but I'd be more concerned about software failure: what if a bug in your software makes it unresponsive and stuck in the state with the flow open? Maybe a watchdog or some other system running in parallel checking for a heartbeat or a max amount of time water can be flowing?