Just to add to the above, make your high & High High level signals true when not covered or actuated, or active when not covered, the reason is if power or signal is lost the PLC will see this and assume a high level has been reached.
There is a difference between N/O & N/C, therefore use a sensor that when not covered or detected but powered gives a signal to the controlling system, this way a broken wire or loss of power to the sensor will be seen as a high level (signal lost).
Also, for extra safety, do a check on the low & high sensors so if an illogical combination appears it also shuts the system down. for example, if the High or High High sensor is indicating level and the low is not then there is a problem.