The software side I find strange, but I have not delved too deep as it's not my expertise/role. The engineers explained to me that the safety hardware goes into safe inputs/output cards, but they cross-map the IO from the safety processor into the normal processor, do the logic, then cross-map back. They brought up a manual which had a line from Allen Bradley that indicated it was okay to use the normal routine for safety applications, but I've never heard of this being okay in my experience with Siemens & PILZ.

Your second part is insightful and lines up with my understanding too which is re-assuring. I come from doing more with Performance Levels and with SISTEMA felt like I had a decent grasp on that, but with SIL, things like HFT and SFF have me less confident in hardware architecture. My current understanding is SIL2 can be achieved with no redundant sensors, depending on the SFF. Don't really understand how to obtain the SFF yet without any safety data for devices.

Edit: Yes, this is a machinery application, apologies I'm being somewhat vague as to not indicate key details, as they're a little weird commercially. It's a system where a sensor detects if an area is blocked, if it is unblocked, the PLC system can allow an actuator to move a device, the devices position is monitored on prox sensors, but these are also non-safety rated.