1) The SafetyConsumer sends a RequestSPDU. At about the same time, a dangerous event occurs at the SafetyProvider, demanding the safety function to trigger.
2) However, in the worst case, the RequestSPDU is processed at the SafetyProvider just before the dangerous event becomes known.
3) Hence, the ResponseSPDU does not yet contain any information about the dangerous event.
4) In the worst case, the ResponseSPDU is processed in the SafetyConsumer just before the SafetyConsumerTimeout expires.
5) Another error (which may have the same root cause as the dangerous event) leads to a loss or unacceptable delay of either the RequestSPDU or the ResponseSPDU.
6) Hence, the SafetyConsumerTimeout expires.
7) In the worst case, the timer expires immediately after it was checked. Hence, it takes another cycle of the SafetyConsumer to detect the error.