ENSURING FUNCTIONAL SAFETY REQUIREMENT SATISFACTION FOR OUPUT DETERMINATION AND OUTPUT OF SAFETY MESSAGES

An output controller obtains a pair of safety state inputs, and, at each of a first microcontroller and the second microcontroller determines whether the pair of safety state inputs both show an unasserted state. Responsive to determining that the pair of safety state inputs both show an unasserted state, the output controller determining a normal state, and otherwise the output controller determines a safe state. The output controller outputs a binary software command reflecting either a normal state or a safe state, and converts the binary software command to a hardware command that maintains the state of voltage of a circuit where the binary software command reflects a normal state and otherwise switches to a safe state. The controller compares readback output values from the two microcontrollers, and generates an output therefrom.