Two different ways to be safe
There are two fundamentally different strategies for keeping a robot from hurting someone. The first is inherent safety by design: you make harm physically impossible or unlikely regardless of what the control system does. A fence around a robot cell, a mechanical limit stop that a joint physically cannot pass, a exclusion zone that keeps people out of reach entirely. These measures work even if every line of software on the robot is wrong, because they don't depend on the robot doing anything correctly. They just remove the opportunity for harm.
The second strategy is functional safety: safety that is achieved because the system actively detects a hazardous condition and responds correctly. A robot arm that senses unexpected resistance and stops, a mobile platform that detects a person in its path and slows down, a control loop that notices its own sensor has gone silent and shuts down rather than guessing. This only works if the detection and response logic is actually correct and actually runs when needed, which is a much harder property to guarantee than 'the fence is bolted on.' Most real systems need both approaches, because inherent design alone is often too restrictive for a robot that has to work near or with people, and functional measures alone are too fragile to trust as the only line of defense.