CRC errors on a filling line with VFD-induced disturbances
On a filling line, 12 FSoE slaves exchange safety data every 2 ms through an EtherCAT segment that also carries three variable-frequency drives. The safety function is a SIL 2 guard-locking function with a 300 ms stop time. The FSoE watchdog is 60 ms. Over one 8-hour shift, the master logs 14 FSoE CRC errors, all within 200 ms of a VFD acceleration. No fail-safe trip occurs because each error is followed by a good frame. The end user asks whether the CRC errors can be ignored, since the safety function still worked and the error counter is low. The FSoE CRC is 16 bit, and the master uses sequence monitoring and a 60 ms watchdog.
1. How should the team judge whether the 14 CRC errors are acceptable?
Read the worked answer
The team should not judge acceptability only from the fact that the line kept running. A CRC error is a detected corruption, so it is not itself a residual error. However, a cluster of detected errors shows that the black channel is being disturbed, and the residual-error claim for the FSoE connection may no longer be valid if the disturbance rate or error pattern was not assumed. Fourteen errors in 8 hours at a 2 ms cycle is about 14 errors in 14.4 million frames, which is a low ratio, but the clustering with VFD acceleration matters more than the average. The team should compare the observed rate with the assumptions used in the FSoE residual-error analysis and with the manufacturer’s limits. If the rate exceeds those assumptions, or if the errors are correlated with a common cause such as poor shielding, the connection should not be accepted as-is.
2. What residual-error measures are relevant here, and what is the role of retries?
Read the worked answer
The relevant measures are the CRC, sequence monitoring, the FSoE watchdog, and the connection addressing check. The CRC detects many random bit errors, but it cannot guarantee detection of every systematic corruption. Sequence monitoring detects lost, repeated, or reordered frames. The watchdog detects a stalled connection and forces the fail-safe reaction. Retries can improve availability, but they are not a safety measure and must not be used to explain away CRC errors. A retry may deliver the same safety data later, but if the delay exceeds the watchdog or the process safety time, the correct result is a safe state. The team should verify that the residual-error calculation includes the black channel, the frame length, the CRC width, and the assumed error model. If the VFD disturbance creates bursts that the CRC and sequence check were not modeled for, the calculation must be revisited.
3. What actions would you recommend before signing off the line?
Read the worked answer
I would treat the CRC errors as an EMC and installation problem first. The team should inspect shielding, grounding, cable routing, and separation between the drive cables and the EtherCAT cable. It should check whether the errors move when a drive is disconnected or when a cable is rerouted. The FSoE error counters should be logged over a longer period, including different production rates, and compared with the residual-error assumptions. The watchdog should be checked against the 300 ms stop time, not lengthened just to hide errors. After corrective work, the team should repeat the disturbance test and confirm that the CRC errors are eliminated or justified. Sign-off should include the error log, the residual-error calculation, and a validation test that injects a communication fault and confirms the fail-safe reaction.