The error handling for safety performance level e according to EN ISO 13849 requires that a single
error shall not result in a loss of function. An E-STOP button is therefore equipped with two normally
closed contacts, so that when there is a fault in one contact, the redundant second contact can initiate the
standstill. As implemented in the safe slave, this means that the code sequence is divided into two groups
of 8 × 2 bits each and each contact affects one respective group. If only one of the contacts opens upon
actuation, 2 bits are at zero while the remaining 2 bits of the code sequence are further transmitted. The
receiver recognizes this and, in the case of the E-STOP function, generates an error message in addition
to the standstill.
Not every deviation from the expected code sequence is caused by a defective slave or sensor.
Contacts have mechanical tolerances or bounce. Both when actuating and when unlocking, transition states can arise.
The receiver therefore always considers multiple slave responses when determining the state of the sensor.
Table 6.19 and Figure 6.43 show the states of a sensor in the process image and the associated state transitions.
These states form the process image and represent the respective current state of a slave or sensor.
Only an on-state represents the information E-STOP not actuated. A change between two of the first four states shown always involves the transition state, since at least eight slave responses are necessary in order to determine the state of the contacts