the risk of passengers forcing doors to open might be avoided by requiring that (a) the doors actuator reacts to the software controller exclusively, and (b) the software controller checks the train's speed before responding to any opening request from passengers.