In a safety-critical system you probably don't want to use interrupts as they are by definition unpredictable. Generally better to use polling and decide how important a specific input is. This was, I believe, one of the issues with Three Mile Island.