Another Option
Another option, that I use, is to design the ATO system with as small of a FW vessel as possible. I use a small (<10 gallon) container with a mechanical Kent Float Valve as my fresh water holding vessel. When the level of the holding vessel gets low, the RODI unit switches on via the RODI pressure solenoid and float valve in the holding vessel. From there, I have a Reef Filler pump connected to an electronic float switch in my sump. When the sump level drops, the Reef Filler pumps FW from the FW holding vessel to the sump.
If the electronic float switch in the sump failed (shorted) then I could possibly get all 10 gallons of fresh water pumped into my sump. But 10 gallons is a small fraction of my total system volume (500 gallons) and won't significantly lower the salinity. The other thing is that the Reef Filler is a peristalic pump so there is less of a chance of the pump "burning out" from running dry. Even though the FW holding tank will continue to be refilled, it will be a slow process since the flow from the RODI is very slow. Hopefully, this gives me enough time to figure out something is wrong with the ATO. I always ask tank sitters to check the float in the sump and also to inspect the water level to providfe further safety margin when I am away from the tank for long periods of time.
One more thing is that I have had failures in the electronic level switch in my sump, but they have always been open cuircuit failures which causes the ATO to stop adding water. I found that SW or humidity was getting into the level switch relay/controller so I now place it in a plastic bag with an elastic to keep it dry. No problems for the last 3-4 years.