FSOE Qualifying Test flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

IEC 61508

Generic functional safety standard defining SIL 1-4, the safety lifecycle, hardware fault tolerance, safe failure fraction, and PFH/PFDavg requirements for electrical/electronic/programmable electronic safety-related systems.

IEC 61784-3-12

The IEC profile for Safety over EtherCAT (CPF 12); it specifies FSoE communication services, error detection measures, and residual error requirements for use over a black channel.

IEC 62061 versus ISO 13849-1

Both are machinery safety standards: IEC 62061 uses SIL 1-3, ISO 13849-1 uses PL a-e; they are alternative routes, and a safety function should be designed to one method.

PL e and SIL 3

ISO 13849-1 PL e corresponds approximately to IEC 61508 SIL 3; PL d to SIL 2 and PL c to SIL 1, but the mapping is not an exact equivalence.

Black channel principle

Safety-related data is transported over a non-safe network; all error detection and safety measures are implemented in the FSoE layer, so EtherCAT itself need not be safety-certified.

FSoE master role

The FSoE master, typically in a safety controller, initiates and controls the FSoE state machine, sends command and output data, and monitors slave responses and timeouts.

FSoE slave role

The FSoE slave, located in a field device, responds to master commands, validates CRC, connection ID and watchdog, returns safe inputs, and drives safe outputs.

Safety stack placement

The FSoE slave stack sits above the EtherCAT slave stack and below the safety application; it handles FSoE frames, state machine, CRC, watchdog, and safe data mapping.

FSoE frame header

The 6-byte FSoE header consists of a 2-byte command, a 2-byte CRC_0, and a 2-byte connection ID; it precedes the safe data and CRC_1.

FSoE command field

A 2-byte field whose lower byte carries the command code: 0x01 Reset, 0x02 Session, 0x03 Connection, 0x04 Parameter, 0x05 Data, 0x06 FailSafe; the upper byte is reserved.

CRC_0 and CRC_1

Two 16-bit CRCs in an FSoE frame: CRC_0 protects the header (command and connection ID), and CRC_1 protects the safe data field.

FSoE connection ID

A 16-bit identifier carried in every FSoE frame; the slave compares it with its configured value and rejects frames with a mismatched connection ID.

FSoE Reset state

The initial FSoE state after power-up or error; no safe data is exchanged, outputs are in safe state, and the master must send a Reset command to restart.

FSoE Session state

A state in which master and slave establish a communication session and check addressing before proceeding to the Connection state; no cyclic safe data is exchanged yet.

FSoE Parameter state

A state before Data exchange where safety parameters such as watchdog time, data length, and mapping are exchanged and validated by both master and slave.

FSoE FailSafe state

The state entered on communication error, watchdog timeout, or FailSafe command; the slave sets outputs to safe values and requires a Reset to leave the state.

Sequence monitoring

FSoE data frames carry an incrementing counter; the receiver checks that each frame increments by one, detecting lost, repeated, or out-of-order frames.

FSoE watchdog

A timer in the FSoE slave that is restarted by each valid frame; if it expires before a new valid frame arrives, the slave enters FailSafe.

Addressing check

The receiver verifies the FSoE address and connection ID of each frame; a frame addressed to another connection is rejected and treated as an error.

Residual error measures

IEC 61784-3 combines CRC, sequence monitoring, timeouts, watchdog, and connection ID checks to reduce the residual error probability of the black channel to an acceptable level.

FSoE address

A 16-bit address that identifies an FSoE slave or connection; it must be unique on the network and match between master and slave configuration.

FSoE watchdog time

A configured time in milliseconds; the slave enters FailSafe if no valid FSoE frame arrives within this time; it must exceed cycle time and jitter.

Slave-to-slave communication

An FSoE configuration where one safety slave consumes safe data directly from another slave, using the source FSoE address and connection ID, without the master in the data path.

Safe I/O mapping

The assignment of bits or bytes in the FSoE safe data container to physical safe inputs and outputs; the mapping must be identical in master and slave configuration.

FSoE error counters

Counters maintained by the FSoE slave for CRC errors, sequence errors, watchdog errors, and connection errors; they support fault tracing and diagnostics.

ETG conformance test

A test suite for FSoE devices that verifies the state machine, frame handling, CRC, watchdog, error reactions, and fail-safe behavior against the FSoE specification.

Fault injection testing

A validation method that deliberately introduces CRC errors, dropped frames, delays, or wrong connection IDs to confirm that the FSoE slave reacts safely within the watchdog time.

EtherCAT working counter

A diagnostic value in EtherCAT frames that increments when a slave processes the frame; unexpected values help locate topology or device faults affecting FSoE.

Safety function response time

The worst-case time from a safety input demand to the safe state at the output, including sensor delay, FSoE cycles, watchdog time, and actuator delay.

PFH and PFDavg

Safety integrity metrics: PFH is average frequency of dangerous failures per hour (high demand), PFDavg is average probability of dangerous failure on demand (low demand).

Proof test

A periodic test that detects dangerous undetected failures in a safety function; for FSoE it includes communication fault injection and device tests per the safety manual.

FSoE validation

Functional testing of the complete safety function, including FSoE fault injection for CRC, timeout, and connection ID errors, to confirm the specified safe reaction.