Hello,
What is the difference between these two configuration sets,
The difference is in the table you shared from SAF user manual.
Diagnostic configuration contains every single BIST available on the platform. It is designed for the "garage" use case.
So in runtime you are using only BIST_SAFETYBOOT_CFG, but if you have serious failure you can run in the garage the full test to check the integrity of the chip.
and how do we choose them in a production environment?
You will simply define in the code which test you want to execute. But for calling diagnostic, you will need to implement some function which you will call in garage to execute diagnostic test. This is not part of the SAF.
For production we recommend to use SAFETYBOOT.


Best regards,
Peter