Thanks @
metric_taper .
The Nanodac is the thing that's mounted in the door; the thyristor pack on the DIN rail mount is an EPACK. Both come from Eurotherm, so they're well suited to talking to one another over the modbus TCP link. All that link does at the moment is write a set-point to the EPACK Thyristor pack and read the current back (for display).
I also don't trust relays, and don't trust thyristors or solid-state relays either! At least with the contactor (which is just a big relay really) it isn't switching as often as the thyristors are so there's a reasonable chance the contacts won't have welded. I do like having the physical switch in line with the heater coils as a belt-and-braces thing though. At least that means I can guarantee that the coils are electrical isolated even if something goes wrong with the contactor. For an overheat event to happen, there needs to have been at least two failures: something going wrong with the thyristor pack and something going wrong with either the over-temperature detection or the contactor. I'm sure that wouldn't be enough redundancy for an aeroplane application, but hopefully it's good enough for a heat treatment oven!