DB

Good ideas.

Along the lines of your train brakes concept, I'd take it
one step further -- assure that it is truly "fail safe."

Did you happen to catch the 60 Minutes show a few
weeks back? Apparently, the drilling crew tried to pull
up the drill string while the anular ring in the back-flow
preventer was "locked", effectively destroying the
anular ring (bits of rubber were seen to come out of
the drill string) -- or at least something along those lines
happened. My understanding is that this event is what
damaged the back-flow preventer.

Lesson: make it impossible to do that.

Spoo