A chip that moves data must also say when it cannot trust the data: a stream engine that swallows an error response and reports success corrupts silently, and silent corruption is the failure no retry can fix. Safety architecture is the wiring that refuses silence: every credible fault detected, reacted to and reported within its deadline. This topic turns a safety goal into that wiring at a conceptual level: what the goal asks of the SoC, the detection-reaction-reporting chain, and the redundancy patterns that back it. It is deliberately independent of any particular standard document; the concepts outlive them. For verification of the resulting behaviour see Functional Safety Verification.

Suggested order: top to bottom. The goal first, because detection choices serve it; then the reporting chain with its latency budget; then the redundancy patterns that feed the chain. The reporting lesson also shows why the fault controller and the CPU interrupt path must not share fate: observing a fault must not depend on the logic the fault broke, which is why the controller has its own output pin as well as an interrupt.