Recently where were reports about corrupted database content after the PBX was upgraded. This usually comes from decryption problems with information that is not stored in clear text in the PBX database. This usually comes when trying to move data from one PBX to another on the file system basis, without moving the pbx.xml file as well.
In the next version (59.2+) we will add an extra check during the startup phase that will test if the PIN codes in the PBX make sense or not. If the decryption does not work probably, there is a high probability that those PIN codes are out of the range 0-9.
In this situation the PBX will write a log message at the highest level and exit. It makes sense to do this drastic step, because proceeding would probably mean corrupting the database even more.
There is still a "backdoor" to get the PBX running regardless, in case this was a false alarm. When started with the option --ignore-corrupt, the PBX will operate like before and proceed with the startup process, no matter what is in the database.