Sawsan311,
LI was correct in saying that you are making this more convoluted than necessary.
Firstly, if you think a VFD failure could lead to an overspeed condition, you could not then rely on that same VFD to reliably provide overspeed protection.
Secondly, I know of no failure mechanism that could lead to a VFD allowing greater than 100% output. The failure would need to be in the initial programming (or reprogramming after a power surge necessitated re-entry of key parameters). In such a case, the VFD would not have any role in stopping pump overspeed.
Lastly, LI is again correct in stating that your other process parameters (vibration probes, flow measurement, bearing temp monitoring, etc) that you normally measure can all be used as a proxy for a pump operating at a dangerous condition.
So in summary, there is no need to try to wrangle a specific overspeed protection into a VFD.