A method for monitoring safety integrity of a safety function provided by a safety system (10, 20), the safety system comprising at least a first and a second subsystem module, comprising the steps of: - processing data into functionally safe data in the first subsystem module; - determining at least one first safety parameter by the first subsystem module (101, 102, 103, 110) with respect to the data processing performed by the first subsystem module (101, 102, 103, 110) and/or with respect to a data transfer performed by the first subsystem module (101, 102, 103, 110); - transferring the functionally safe data and the first safety parameter from the first subsystem module (101, 102, 103, 110) to the second subsystem module (201, 202, 203, 210); - determining at least one second safety parameter by the second subsystem module (201, 202, 203, 210) with respect to a data processing and/or data transfer performed by the second subsystem module (201, 202, 203, 210); and - transferring at least one third safety parameter to the second subsystem module (201, 202, 203, 210); - verifying the safety integrity of the safety function in the second subsystem module (201, 202, 203, 210) independence of the first, second and third safety parameters; and - triggering a predetermined safety response on the basis of the verification result; wherein the first subsystem module is in the form of an input module of an automation system to which a sensor is connected, wherein a sensor signal is captured by the sensor in the first subsystem module and the captured sensor signal is processed into the functionally safe data, and wherein the third safety parameter specifies a safety-relevant attribute of the sensor, and wherein the third safety parameter is stored in the first subsystem module (101, 102, 103, 110) and is transferred from the first subsystem module (101, 102, 103, 110) to the second subsystem module (201, 202, 203, 210); or the third safety parameter is determined by at least one third subsystem module (301, 302, 303, 300, 310) and is transferred from the third subsystem module to the second subsystem module, wherein the third subsystem module is arranged between the first and second subsystem modules, and wherein the third subsystem module of the safety system receives the first safety parameter and transfers it to the second subsystem module (201, 202, 203, 210). - processing data into functionally safe data in the first subsystem module; - determining at least one first safety parameter by the first subsystem module (101, 102, 103, 110) with respect to the data processing performed by the first subsystem module (101, 102, 103, 110) and/or with respect to a data transfer performed by the first subsystem module (101, 102, 103, 110); - transferring the functionally safe data and the first safety parameter from the first subsystem module (101, 102, 103, 110) to the second subsystem module (201, 202, 203, 210); - determining at least one second safety parameter by the second subsystem module (201, 202, 203, 210) with respect to a data processing and/or data transfer performed by the second subsystem module (201, 202, 203, 210); and - transferring at least one third safety parameter to the second subsystem module (201, 202, 203, 210); - verifying the safety integrity of the safety function in the second subsystem module (201, 202, 203, 210) independence of the first, second and third safety parameters; and - triggering a predetermined safety response on the basis of the verification result; wherein