The execution chain in hardware. The command path runs PLC to drive; the safety system sits on its own rail; the Aux I/O bridges the panel to a zone that otherwise runs itself.
A trip in one zone stops that zone and its hazard, not the whole plant.
A tripped zone doesn't restart on its own. It needs a deliberate, located reset.
The designed behavior on a trip, spelled out ahead of time, not a scramble.