Which arrangement best achieves safety function independence?

• A. Sharing hardware across safety and non-safety tasks.
• B. Running safety logic on general-purpose OS.
• C. Allowing non-safety processes to modify safety logic during operation.
• D. Separating safety-critical logic from non-safety processes, using independent channels and hardware, and avoiding bridging.

Answer: (D)

Independence for safety functions comes from keeping safety-critical operations isolated so a fault or change in non-safety parts cannot affect them. The arrangement that best achieves this is to separate the safety-critical logic from non-safety processes, use independent channels and hardware for safety, and avoid any bridging between the domains. This setup provides fault containment: if non-safety software or hardware fails or is compromised, the safety functions remain unaffected because they have their own dedicated resources and communication paths. It also supports deterministic behavior and certifiability, since safety-grade components and separate channels can be tested and proven to meet required reliability and timing.

Sharing hardware with non-safety tasks introduces common failure paths and timing interference, making it possible for faults to propagate into safety functions. Running safety logic on a general-purpose operating system brings non-determinism and potential security risks that undermine safety guarantees. Allowing non-safety processes to modify safety logic during operation directly undermines integrity and safety. The separation with independent channels and hardware, with no bridging, keeps safety functions truly autonomous and protected.