A system includes a first fail-safe chassis (FSC) receives module health signals from a plurality of modules and generates a first chassis health signal. The chassis health signal includes first and second portions. A plurality of modules receives the chassis health signal. The FSC determines whether one or more of the module heals signals indicates an associated module is unhealthy by comparing the module health signals and a predetermined health value. The FSC selectively de-asserts the first chassis health signal based on the comparison. A second FSC operates similarly. A safety relay box determines the health of the system in accordance with the first and second chassis health signals.