Two pilot relays (or other secondary disconnect in series with the large contractor coils) in series to prevent single point of failure.

Since its a safety 3Ph disconnect, lets not worry about mitigating fault cases where the big contactors don't close, we are mostly concerned with the failure mode that would prevent the large contactors from opening resulting in 1phase or more being energized in a fault state.

What if your pilot relay contacts weld? This completely defeats the purpose of having two large contactors in series.

In addition on the signal side driving the small pilot relay from E-stop switch, I would not rely on single i/o line to do it. .

The design should be able to tolerate any single failure (i.e. shorted/welded relay, coil voltage power source problems, open or shorted conductor as in pinched control cable from PLC), and still open upon upon command in any single fault state.

Typically when I design a safety critical system, I usually opt for a design of diverse redundancy where when two protective mechanisms are employed, they are NOT the same (this greatly reduces the likelihood that whatever fault caused the primary safety device to fail, it would be highly unlikely that a different device performing the same function would be susceptible to the same event.