FSOE Qualifying Test cheat sheet

IEC 61508 is the generic functional safety standard; it defines SIL 1-4, the safety lifecycle, hardware fault tolerance, safe failure fraction, and PFH/PFDavg concepts.

IEC 61784-3 defines functional safety fieldbus profiles; IEC 61784-3-12 is CPF 12, the profile for Safety over EtherCAT (FSoE).

IEC 62061 is the machinery sector standard using SIL 1-3; it is derived from IEC 61508 and applies to safety-related control systems.

ISO 13849-1 is the machinery sector standard using Performance Levels PL a-e; it uses category, MTTFd, DCavg, and CCF.

IEC 62061 and ISO 13849-1 are alternative routes for machinery; a given safety function should be designed to one method, not mixed arbitrarily.

Approximate mapping: PL e corresponds to SIL 3, PL d to SIL 2, and PL c to SIL 1; the mapping is not an exact equivalence.

FSoE communication can support SIL 3 per IEC 61508 and PL e per ISO 13849-1 when the devices, architecture, and integration are suitably qualified.

The black channel principle from IEC 61784-3 places all safety measures in the safety layer; the underlying fieldbus is assumed to be non-safe.

IEC 61784-3 specifies residual error probability requirements; FSoE meets them using CRC, sequence monitoring, timeouts, watchdog, and connection ID checks.

Black channel: FSoE treats EtherCAT as an unsecured transport; all safety-related error detection is implemented in the FSoE layer, so EtherCAT itself need not be safety-certified.

FSoE master: typically resides in the safety controller or safety PLC; it initiates and controls the FSoE state machine, sends commands and safe outputs, and monitors slave responses.

FSoE slave: resides in the field device such as a drive, I/O module, or sensor; it responds to master commands, validates CRC, connection ID, and watchdog, and drives safe outputs.

Safety stack placement: the FSoE slave stack sits above the EtherCAT slave stack and below the safety application; it handles FSoE frames, state machine, CRC, watchdog, and safe data mapping.

On the master side, the FSoE master stack is part of the safety runtime and exchanges safe process data with the safety application.

FSoE frames are embedded in EtherCAT process data for cyclic safe exchange; the EtherCAT mailbox carries non-safety diagnostics and parameters such as CoE objects.

Safe data container: the FSoE payload carries mapped safe inputs and outputs; EtherCAT transports it but does not interpret the safety content.

FSoE master and slave both run the FSoE state machine; the master sends the Data command cyclically, and the slave returns safe input data in its response.

A device safety stack may be certified as a unit for SIL 3 capability; integration must still verify its placement, interfaces, and configuration consistency.

FSoE frame layout: 6-byte header = Command (2 bytes) + CRC_0 (2 bytes) + Connection ID (2 bytes); then safe data of configured length; then CRC_1 (2 bytes).

Command field: 2 bytes; the lower byte carries the command code (0x01 Reset, 0x02 Session, 0x03 Connection, 0x04 Parameter, 0x05 Data, 0x06 FailSafe); the upper byte is reserved.

CRC_0 is a 16-bit CRC protecting the header, including the command and connection ID; CRC_1 is a 16-bit CRC protecting the safe data field.

Connection ID: a 16-bit identifier carried in every FSoE frame; the slave compares it with its configured value and rejects a mismatch as an error.

Safe data container: the data field that carries the mapped safe inputs and outputs; its length is fixed by configuration and must match at master and slave.

FSoE address: a 16-bit address identifying the FSoE slave or connection; it is used by the master to route frames and must be unique on the network.

Data coding: safe data is bit- or byte-mapped without implicit scaling; the mapping must be identical in master and slave configuration.

Frame check order at the receiver: command validity, CRC_0, connection ID, CRC_1, data length, sequence, and watchdog.

Changing the safe data length or mapping changes the connection configuration and requires matching updates at both ends.

FSoE states: Reset, Session, Connection, Parameter, Data, and FailSafe.

Reset: communication is not established; the slave holds outputs in the safe state; the master sends Reset to start or restart the connection.

Session: master and slave establish a session and check addressing; no cyclic safe data is exchanged yet.

Connection: the master sends the Connection command with the connection ID; the slave validates it and acknowledges, establishing the connection.

Parameter: safety parameters such as watchdog time, data length, and mapping are exchanged and validated before data exchange.

Data: cyclic exchange of safe process data; the master sends outputs, the slave returns inputs, and sequence and watchdog are monitored.

FailSafe: entered on communication error, watchdog timeout, or a FailSafe command; the slave sets outputs to safe values and requires a Reset to exit.

State transitions are controlled by master commands; the slave transitions only on a valid command with correct CRC and connection ID.

Normal phase order is Session -> Connection -> Parameter -> Data; any error can force FailSafe, and recovery requires Reset.

Sequence monitoring: FSoE data frames carry an incrementing counter; the receiver checks the expected increment and detects lost, duplicated, or out-of-order frames.

Watchdog: the slave restarts a timer on each valid FSoE frame; if no valid frame arrives within the configured watchdog time, the slave enters FailSafe.

Timeouts: the master also monitors slave responses; a missing or late response within the configured timeout triggers a fail-safe reaction.

Addressing checks: the FSoE address and connection ID ensure a frame belongs to the correct connection; wrong address or ID is rejected.

Data integrity: CRC_0 detects header corruption and CRC_1 detects safe data corruption; a CRC failure causes the frame to be discarded and an error to be counted.

Length check: the receiver verifies that the safe data length matches the configured length; a mismatch is treated as an error.

Command check: the receiver verifies that the command is valid for the current state; an invalid command leads to an error or FailSafe.

IEC 61784-3 residual error measures combine CRC, sequence monitoring, timeouts, watchdog, and connection ID checks to achieve the required residual error probability.

FSoE slaves maintain error counters for CRC, sequence, watchdog, and connection errors to support diagnostics and fault tracing.

FSoE address: a 16-bit unique address per FSoE slave; it is configured in master and slave, and a mismatch prevents connection establishment.

Watchdog time: configured in milliseconds; it must exceed the EtherCAT cycle time plus jitter; too short causes spurious fail-safe, too long increases reaction time.

Connection ID: a 16-bit value configured for the connection; master and slave must match, and it is checked on every frame.

Slave-to-slave communication: one FSoE slave consumes safe data directly from another slave using the source FSoE address and connection ID; the master configures it but may not be in the data path.

Mapping of safe inputs and outputs: safe data container bits or bytes are assigned to device I/O; the mapping must be identical in master and slave configuration.

Data length: the configured length of the safe data container is fixed per connection and must match at both ends.

Fail-safe values: the safe state for each output, such as 0 or de-energized, is defined per output and applied on communication loss.

FSoE master configuration includes the slave list, FSoE addresses, watchdog times, connection IDs, and safe I/O mapping, stored in the safety controller.

The Parameter phase exchanges and validates safety parameters such as watchdog time, data length, and mapping before the Data phase begins.

FSoE slave diagnostics report error codes for watchdog, CRC, sequence, connection ID, command, and parameter errors; these are read via EtherCAT CoE or process data.

Fault tracing order: check FSoE address and connection ID mismatch first, then watchdog time versus cycle time, then CRC errors from EMI or wiring, then sequence errors from frame loss.

EtherCAT diagnostics: use topology, link status, working counter, and CoE error objects to isolate network faults that affect FSoE.

FSoE error counters track CRC errors, sequence errors, watchdog errors, and connection errors; counters are cleared only after the fault is resolved.

ETG conformance testing for FSoE verifies the state machine, frame handling, CRC, watchdog, error reactions, and fail-safe behavior against the FSoE specification.

Fault injection testing introduces CRC errors, dropped frames, delayed frames, and wrong connection IDs to confirm the slave reacts safely within the watchdog time.

Network conformance: verify that EtherCAT cycle time, jitter, and topology support the configured FSoE watchdog time and that FSoE frames fit the process data.

If all FSoE slaves fail simultaneously, suspect the master or network; if one slave fails, suspect that slave's configuration, wiring, or device fault.

Conformance documentation should record test cases, error injection results, configuration records, and the conformance certificate.

Risk assessment inputs: required SIL or PL, safety function response time, safe state definition, proof test interval, architecture (HFT), and common cause requirements.

SIL/PL verification: calculate PFH or PFDavg for the complete safety function including FSoE communication; use device safety data such as PFH, MTTFd, and DC.

FSoE contribution: treat FSoE as part of the safety function; use its residual error rate and watchdog time in the response time and integrity calculations.

Response time: worst case = sensor delay + FSoE cycle(s) + watchdog time + actuator delay; this must be less than the process safety time.

Proof tests: periodic tests detect dangerous undetected failures; for FSoE include communication fault injection and device proof tests per the safety manual.

Validation: functionally test each safety function, including FSoE fault injection for CRC, timeout, and connection ID errors, to confirm the specified safe reaction.

Documentation: safety requirements specification, configuration records, verification and validation report, proof test records, and the device safety manual.

Modification rule: any change to FSoE address, mapping, watchdog time, or firmware requires impact analysis and re-verification.

Integration checks: confirm FSoE stack certification, correct stack placement, mapping consistency, and that non-safe EtherCAT faults cannot defeat the safety measures.