Index: Sources/Objects/ConnectionManager/eip_cm.c
===================================================================
--- Sources/Objects/ConnectionManager/eip_cm.c	(revision 124573)
+++ Sources/Objects/ConnectionManager/eip_cm.c	(working copy)
@@ -699,14 +699,14 @@
 /* This was added for CIP Safety, where we need to be able to forward a FwClose() for a connection that has timed out.
    We hold the connection in state EIP_CM_SAFETY_TIMEOUT, and we only implement this for CL0/1 P2P target connections,
    so that we do not have to deal with multicast producer reuse. This is sufficient for the Safety use case.
+   
+   Note that, since we only do this for point to point, we do not have to care about multicast
+   producers and their reuse, since there is exactly one T2O transport exclusively for this I/O connection.
 */
 static void
 EipCm_PointToPointIOConnectionSetTimeoutState( EIP_CM_RSC_T*        ptRsc,
                                                EIP_IO_CONNECTION_T* ptConnection )
 {
-  /* Note that, since we only do this for point to point, we do not have to care about multicast
-     producers and their reuse, since there is exactly one T2O transport exclusively for this I/O connection.
-  */
   ptConnection->tCommon.eState = EIP_CM_SAFETY_TIMEOUT;
 
   if (ptConnection->uToHandle.hTransport)
@@ -719,6 +719,7 @@
   Eip_IndicateConnectionState(ptRsc->tCommon.hEip, CIP_CONNECTION_TIMEOUT, &ptConnection->tCommon, NULL, NULL);
 
   EipCm_AbortTcpConnIfIdle(ptRsc, &ptConnection->tCommon);
+
 }
 
 
@@ -726,25 +727,44 @@
 EipCm_ConnectionTimeout_msg( PS_JOB_T* ptMsg )
 {
   EIP_CONNECTION_COMMON_T* ptConnection = HIL_CONTAINEROF( ptMsg, EIP_CONNECTION_COMMON_T, tRxTimeoutJob );
+  
   const bool fIsP2pIoConnection = (((ptConnection->tParameter.bTriggerType & EIP_CM_TYPTRIG_TYP_MASK) == EIP_CM_TYPTRIG_TYP_CL0) ||
                                    ((ptConnection->tParameter.bTriggerType & EIP_CM_TYPTRIG_TYP_MASK) == EIP_CM_TYPTRIG_TYP_CL1)) &&
                                    ((ptConnection->tParameter.usTOConnParam & EIP_CM_PARAM_TYPE_MASK) == EIP_CM_PARAM_TYPE_POINT);
 
-  EipEncap_SetExtendedStatusAndSize(&ptConnection->tStatus, CIP_ESR_CONN_TIMED_OUT );
+  switch (ptConnection->eState)
+  {
+    case EIP_CM_WAIT_DATA:
+    case EIP_CM_ACTIVE:
+    
+      EipEncap_SetExtendedStatusAndSize(&ptConnection->tStatus, CIP_ESR_CONN_TIMED_OUT );
+      
+      if ((!ptConnection->ptRsc->fEnableExplicitConnectionTimeoutForPointToPointIoConnections) ||
+          (!fIsP2pIoConnection))
+      {
+        /* close & auto-delete the connection */
+        EipCm_ConnectionClose( ptConnection->ptRsc, ptConnection, true, true );
+        EipCm_DeleteConnection( ptConnection->ptRsc, ptConnection );
+      }
+      else
+      {
+        /* Set the connection into the specific CIP Safety timeout state, do not delete it.
+           The connection will be subsequently deleted on successful FwClose or explicitly through service CIPHIL_CMD_CM_TERMINATE_CONNECTION. */
+        EipCm_PointToPointIOConnectionSetTimeoutState( ptConnection->ptRsc, HIL_CONTAINEROF( ptConnection, EIP_IO_CONNECTION_T, tCommon ));
+      }
+      
+    break;
 
-  if ((!ptConnection->ptRsc->fEnableExplicitConnectionTimeoutForPointToPointIoConnections) ||
-      (!fIsP2pIoConnection))
-  {
-    /* close & auto-delete the connection */
-    EipCm_ConnectionClose( ptConnection->ptRsc, ptConnection, true, true );
-    EipCm_DeleteConnection( ptConnection->ptRsc, ptConnection );
+    case EIP_CM_FREE:
+        /* nop. spurious timeout: connection has been cleaned up by other means (FwClose or ABORT_REQ) */
+    break;
+    
+    case EIP_CM_INIT:
+    case EIP_CM_SAFETY_TIMEOUT:
+    default:
+      assert(0);
+    break;
   }
-  else
-  {
-    /* Set the connection into the specific CIP Safety timeout state, do not delete it.
-       The connection will be subsequently deleted on successful FwClose or explicitly through service CIPHIL_CMD_CM_TERMINATE_CONNECTION. */
-    EipCm_PointToPointIOConnectionSetTimeoutState( ptConnection->ptRsc, HIL_CONTAINEROF( ptConnection, EIP_IO_CONNECTION_T, tCommon ));
-  }
 }
 
 
