A field device for measuring a filling level, a pressure or a density of a medium in a container includes data memory with two memory areas that are separated from one another. First data for safety-critical program modules is stored in the first memory area. Second data for safety-uncritical program modules is stored in the second memory area. The two memory areas are separated from one another. All access to these memory areas is controlled by a memory management unit.