Comment by m4x

Yes, this is exactly the kind of approach I'm referring to when I say it's possible (though not trivial to implement), but it still doesn't prevent attacks. Air France 447 crashed with extraordinary loss of life because the pilots responded incorrectly to reported sensor readings. Any scenario where authorised staff are able to affect changes in a control system is vulnerable. The attack vectors just change to suit the target system.