tokens: Alternate or redundant safety - critical functions shall be physically and functionally separated or protected in such a way that any event that causes the loss of one path does not result in the loss of alternative or redundant paths .