The system whose only job is to say no. Omron's NX-SF safety runs as an independent layer on the same backplane — its own logic, its own safe I/O, its own network (FSoE). Trip an E-stop and watch it act.
An E-stop doesn't ask the standard program nicely — it drives a dedicated chain: safe input → NX-SF logic → safe output that cuts motor power. Press the mushroom. Note the standard PLC keeps running; only the safe outputs drop.
🧩 Same hardware, separate brain. NX-SF safety units sit in the same NX rack as standard I/O, but run their own certified safety program. A bug in your machine code can't disable the safety function.
🌐 FSoE (Safety-over-EtherCAT) carries safe data on the same EtherCAT cable as everything else — with its own checks, so a network glitch trips to the safe state instead of being missed.
🤝 Coexistence. Standard and safe code share variables in a controlled, one-way way: safety can tell standard "I tripped", but standard can never override safety.
📏 SIL / PL rate how much you can trust a safety function. The lifecycle — risk assessment → design → validate → maintain — is how you earn that rating.
A bug freezes your standard machine program in an infinite loop. Can the E-stop still cut motor power?