What safety device, designed to stop a train if the locomotive engineer becomes incapacitated, requires continuous physical pressure or periodic verification?