Securing Redundant Links to Safety Shutdown Systems