The main sensor is an infrared optic sensor, if this fails there is a float switch that shuts it down and sounds an alarm. If that fails the pump can only run 10 minutes, if that fails and you used good sense your reservoir size is the fourth and final safety by limiting the volume available. Normally in 10 minutes the osmolator would pump only about 3.5gallons. I use the 5002.25 reservoir myself and that limits the worst case disaster to 6.5gallons, That lasts 4-5 days on my 180 and 9-10 days on my 58.