It is pretty simple to find documentation about satellite operating modes behaviour when trying to develop satellite onboard software (example of safe mode behaviour on wikipedia, or on researchgate), but implementations are commercial and it is difficult to find reliable information about the implementation details of satellite modes. Most notably, mode switching sequences and error handling are mission-critical details for which open information is very sparse.
No experience of satellites here, but I used to do real-time software development. I believe that the point is to discover "normal" from "abnormal". You would have several different "functions" that monitor parts or the whole system.
One typical solution for monitoring software is one or many watchdog timers. The software is supposed to reset the watchdog timer periodically. If too long time, the watchdog kicks in and forces the system into safe mode. The software will "trap" some hardware errors, maybe with help of a memory management unit (more or less complicated). One type of check might be to have "guard" areas in RAM initiated to known values and periodically checked. This might discover run-away software. ROM content can be checked periodically by background checksums monitoring.
There would be monitoring of different parts of the hardware. Memory will be checked by one or more parity bits. There will be monitoring of voltages, temperature, power usage and so on. Outside of limits might trigger safe mode. Complicated stuff, say a CPU, could be doubled and the two halves run the same software and compare the results. (I believe this was used in the engine F1 controller for the Saturn V).
And of course, when the software finds itself to be "lost in space" it could trigger safe mode. Losing track of position, direction or speed might be triggers. Safe mode might be different in different phases of the flight.