state with one of the following characteristics: a) the system passively assumes a state in which the signal available at the output terminals ensures a safe situation under all circumstances b) the system actively executes a protective action causing it to shut down followed by a restart or a lock out c) the system remains in operation, continuing to satisfy all safety-related functional requirements