Dual-channel sensing and watchdogs
Once a safety function's required rigor is known, the discipline offers a small set of recurring design patterns for actually achieving it. One of the most common is dual-channel sensing: instead of trusting a single sensor's reading, the system uses two independent sensors, ideally of different types or at least independently wired and powered, and only trusts a safety-critical reading when both agree. If a force sensor and a current-draw estimate both independently indicate the robot arm has hit an obstruction, that agreement is far more trustworthy than either signal alone, because it's very unlikely that two independent, dissimilar failure modes would coincidentally produce the same false reading at the same time.
A second recurring pattern is the watchdog timer: a simple, independent piece of hardware or software whose only job is to notice when the main control loop has stopped responding as expected, and force the system into a safe state if it does. A control loop can hang, crash, or get stuck in a bad state for all sorts of reasons, and the watchdog doesn't need to know why, it just needs to detect that the expected periodic signal has stopped arriving and react. This decouples the safety response from the very system that might have failed, which is essential, because a control loop that has gone wrong cannot be trusted to also correctly recognize and fix its own failure.