Relay output from MCU with enhanced safety level
I would never assume any such thing in a safety critical application, and in fact would probably be getting rather more serious about my stuck relay detection as well (You want to be able to detect if any relay is not in the expected position, not just that BOTH have failed). 

Further, I would be very nervous about a situation where a micro pin in a steady state could cause a dangerous condition, far better to use a charge pump to drive the mosfet gate so that to engage a relay the processor must keep a pin (or better, two) toggling at a few kHz (And do the toggling from within the main loop), this means that a failed program will probably cause the relays to drop out.  

One further thought, remember that testing a non trivial program for "If A and B and not C then D within 100ms" is straight forward, what is much harder is proving that D ONLY occurs if A and B and not C.... The state space for that is MUCH larger. 

I hope your software development process (And requirements process) is suitably robust for this sort of safety critical work.

Editing to add a charge pump example...







simulate this circuit &ndash; Schematic created using CircuitLab

In reality I would probably use a dual diode in a SOT23 or such and the cap values will need tuning to taste, but it gives the basic idea.

The resistor discharges C2 making the relay turn off shortly after the pulsing goes away on the micro pin.