Thermal runaway protection
Industrial controllers use "Loop Break Detection" for this purpose. The control strategy is fairly simple:


If the controller output goes to 100% then start the loop break detection timer. 
If the temperature does not start to move in the expected direction - upwards in your case - for a preset time - e.g., 60 s - then alarm and disconnect power.


The loop control could break for several reasons:


Sensor hanging in the air instead of in the load.
Reverse connection of thermocouple (driving reading the wrong direction).
Open circuit of relay or SSR or heater element.
Short circuit of relay or SSR leading to continuous full power application.


To protect against the last item a second relay or master relay is de-energised to independently remove power from the circuit.