When I built my hot tub controller 20 years ago or so, I used the Atmel 89C2051, however what I did basically put it in series with the original controller and set the original controller a few degrees higher so that if anything failed in my controller, the other one would still limit the system to just a few degrees higher (mine never did fail though - written in assembly since I didn't have a C compiler for that chip). That addressed the safety issues and the GFCI breaker (required by code in the US and probably most other places) handles any electrical leakage.