A safety controller may execute both standard and safety programs using shared architecture in which two processors symmetrically execute the safety program and check each other for errors, and one processor only executes the standard program to minimize undetected symmetrical corruption of the safety programs.