This comes down to manufacturer design defect, it should fail safe, and ionisation flame sensing goes a long way in this being the case, HOWEVER, as bkue van man says in the next thread - -Profiles have a failure mode which brings on both gas valves without the spark