It seems concerning that, regardless of the reason, failure of the charge pump output can result in an estop being ignored. I was planning on replicating OP's design with the charge pump output controlling my contactor. Now I'm not so sure. What are your thoughts on this?