One SPU is isolated from the rest of the system. The PPU cannot read or write the memory used by the isolated SPU. This isolated SPU manages PS3 security. To get encryption keys, the isolated SPU must be observed.

(Someone please fill this out?)

The SPU is isolated by its own request. Once isolated, the PPU cannot access the isolated SPU except to reset it.