Why would this be a dangerous situation? A 240vac potential between the two hot legs is exactly what would be present if a 240vac breaker, wiring and outlet were present. How would having two 120vac circuits be different?
240VAC potential when one is expecting and wiring for 120VAC is a dangerous situation. In this case, where running the kettle on 240VAC isn't an option (Assumption), and it will be running two elements off of separate 120V circuits, I'd keep the circuits completely separate to lessen the possible shock and arc flash hazard. Doing something as simple as tying a couple of hot wires together could result in smoke/fire/shock when plugged in, it might work fine with a certain two outlets, but plug them in elsewhere and "BOOM".
Regarding "Emergency Stops", I've been working on industrial equipment since 1986, including CNC's, material handling, process control equipment, and building utilities. I would consider our brewery's as a process, such as an oven or a plating tank. I cannot recall ever seeing and emergency stop button on a piece of process equipment that didn't have some sort of motion on it (For instance a stand alone oven which is hand loaded versus an oven with a hoist in it.).
I wish I had a copy of the NFPA 79 code to quote, but I dont (They're like $40 for the book). I dont believe our little brewery's, which are pure process control and without motion equipment such as augers or mash rakes, etc, are required to have an emergency stop by NFPA electrical code. If they did, your kitchen refrigerator and oven would have them too. In my opinion, it's just bling.
Emergency stops on equipment with motion are not wired to kill all of the power in a circuit if depressed. They are usually wired to kill only the control power and stop motion. In our case I'd interrupt power to the PID's and relay/contactor coils which will de-energize the SSR's and pumps. Pretty much the same thing as an on/off switch.
On my brewery, I'm running a single element RIMS tube and single pump at 120V. I put this brewery together about ten years ago, although I've upgraded to an Auber PID controller (Because of the SSR output, my old Omoron PID had a relay output). The power cord is connected to line side of a GFCI outlet on the brewery, and the rest of the circuits are connected to the load side of the GFCI - for safety. I guess if I wanted to wire an "Emergency Stop", I'd put in a red mushroom button and a couple of resistors and bleed some current to the ground wire to trip the GFCI.
Now the problem with this on my particular brewery is this - The GFCI will trip, I've tested it using the "Test" button on the front. Unfortunately the contacts inside it are welded shut, so it trips but doesn't interrupt the power (Yes, I need to replace it... I'm upgrading my HLT to electric this winter, I'll do it then with a spa panel). I've replaced two spa panels, one because of nuisance trips and the other because it wouldn't trip. I'd hate to hear about someone getting hurt because they relied on a spa panel to interrupt power. They weren't designed as an emergency power interrupter for a brewery, they were designed to detect ground fault currents and interrupt power on a spa. Most of the time it will work fine, but the consequences are high when it doesn't. Wiring an E-Stop like that wouldn't be up to code in industry.
Please leave the ground fault interrupting duties to the spa panel, and if you must have an E-Stop button, wire one in so that it kills all of the control power to the pumps and PID's.
Again, this is my opinion - and that, along with about $3 bucks will get you a large coffee at Starbucks... I'd be happy to provide a wiring diagram if anyone is curious about this.
