> Even with all the simulators and months of rigorous testing, sending up something that can (in the worst case) break the probe has to be terrifying.

I would guess that even that case is partially accounted for by a watchdog that is hardwired into the system.