I85PREP
⌘ K
FSOE Qualifying Test study materials
FSOE Qualifying Test study resources

FSOE Qualifying Test practice questions

One question at a time. Build your FSOE Qualifying Test understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

For a low-demand safety function, which PFDavg range corresponds to SIL 3 in IEC 61508?

  1. 10^-2 to 10^-1
  2. 10^-5 to 10^-4
  3. 10^-3 to 10^-2
  4. 10^-4 to 10^-3 Correct answer.

Explanation

IEC 61508-1 defines SIL 3 for a low-demand safety function as an average probability of failure on demand from 10^-4 up to but not including 10^-3. SIL 4 covers 10^-5 to 10^-4, while SIL 2 covers 10^-3 to 10^-2. The range expresses the risk reduction that the safety function must provide.

Question 2Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

A machine builder uses a safety fieldbus profile based on IEC 61784-3 over a standard Ethernet physical layer. What does the black channel concept require?

  1. Safety data must travel only in time slots reserved by the safety PLC.
  2. Every Ethernet switch on the path must be certified to SIL 3 before safety data is exchanged.
  3. A redundant physical network is mandatory for all SIL 2 and SIL 3 safety functions.
  4. Safety measures reside in the endpoints; the network itself need not be safety-certified. Correct answer.

Explanation

IEC 61784-3 treats the underlying network as a black channel: the safety measures are placed in the communicating safety devices rather than relying on the network to be safety-related. The profile defines measures such as CRC, sequence numbers, and timeouts to detect corruption, loss, and delay of safety data.

Question 3Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

Which statement best captures the standards context for machinery safety functions when comparing IEC 62061 and ISO 13849-1?

  1. ISO 13849-1 applies only to process industry; IEC 62061 applies only to machinery.
  2. Both cover machinery safety-related control systems; IEC 62061 uses SIL, ISO 13849-1 uses PL. Correct answer.
  3. IEC 62061 covers electrical hazards only; ISO 13849-1 covers mechanical hazards only.
  4. The two standards are mutually exclusive, so a machine must use one for all functions.

Explanation

IEC 62061 and ISO 13849-1 both address safety-related control systems for machinery. IEC 62061 uses Safety Integrity Levels, while ISO 13849-1 uses Performance Levels; the choice is not a simple process-versus-machinery split.

Question 4Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

A Type B safety-related subsystem has HFT = 1 and SFF = 65%. Using IEC 61508-2 architectural constraints, what maximum SIL can be claimed for the subsystem?

  1. SIL 3 Correct answer.
  2. SIL 1
  3. SIL 4
  4. SIL 2

Explanation

For a Type B subsystem with SFF between 60% and 90%, IEC 61508-2 permits SIL 3 only when HFT is at least 1. SIL 4 would need a higher SFF or additional fault tolerance. The architectural table caps the claim independently of the calculated PFDavg.

Question 5Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

For a low-demand safety function, an undetected dangerous failure has a proof test interval of one year. If the interval is doubled and all else remains unchanged, what happens to that failure mode's contribution to PFDavg?

  1. It increases by a factor of four.
  2. It remains unchanged because proof testing does not affect PFDavg.
  3. It approximately doubles. Correct answer.
  4. It approximately halves.

Explanation

For an undetected dangerous failure tested only by proof test, PFDavg is approximately λ_DU × T/2. Doubling the proof test interval T therefore roughly doubles that failure mode's contribution. The effect assumes the failure rate and proof test coverage remain unchanged.

Question 6Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

In IEC 61508, what does systematic capability primarily address for a safety-related element?

  1. The SIL its development process supports against systematic faults. Correct answer.
  2. The diagnostic coverage achieved by the element's self-tests.
  3. The proof test coverage achieved by maintenance procedures.
  4. The random hardware failure rate measured by an FMEDA.

Explanation

Systematic capability expresses the confidence that an element's design and development process prevents or controls systematic faults up to a stated SIL. It is assessed separately from random hardware failure rates and from diagnostic coverage.

Question 7Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

In IEC 62061, a subsystem is assigned a SIL claim limit (SIL CL). What does this limit represent?

  1. The SIL achieved after the subsystem is integrated into the complete machine.
  2. The SIL that applies only when the subsystem is used in high-demand mode.
  3. The subsystem's maximum claimable SIL from architecture and systematic capability. Correct answer.
  4. The SIL required by the risk assessment for the machine function.

Explanation

IEC 62061 uses SIL claim limit to state the highest SIL a subsystem can contribute to a safety function. It is bounded by the subsystem's architecture and its systematic capability, not by the risk assessment of the complete machine.

Question 8Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

Within the IEC 61508 safety lifecycle, what is the main output of the overall safety requirements phase?

  1. The hardware FMEDA and diagnostic coverage calculation.
  2. The verified safety-related software code.
  3. The proof test procedure for each final element.
  4. The specification of safety functions and their required SILs. Correct answer.

Explanation

The overall safety requirements phase produces the specification of safety functions and their required SILs. It follows hazard and risk assessment and provides the basis for allocating requirements to subsystems and designing the safety-related system.

Question 9Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

A machine safety function is designed as ISO 13849-1 Category 3 with two channels and diagnostic coverage. Which fault behavior is required by the category?

  1. A single fault is detected by the next demand; accumulation of undetected faults must not cause loss of the safety function. Correct answer.
  2. A single fault in either channel must be detected before the next demand, and all single faults must be tolerated without diagnostics.
  3. The safety function must tolerate all single faults without any diagnostic coverage.
  4. A single fault may cause loss of the safety function if the fault is revealed at the next demand.

Explanation

ISO 13849-1 Category 3 requires that a single fault be detected at or before the next demand and that accumulated undetected faults do not cause loss of the safety function. Diagnostic coverage is therefore essential to the category, and the architecture is not simply a redundant pair without diagnostics.

Question 10Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

IEC 61784-3 profiles typically combine several measures to protect safety data on a black channel. Which combination is representative?

  1. Analog current-loop signaling plus a watchdog relay.
  2. Manchester encoding plus a redundant power supply.
  3. Sequence number, timeout, safety CRC. Correct answer.
  4. TCP retransmission plus application-layer encryption.

Explanation

IEC 61784-3 functional safety profiles use measures such as safety CRC, sequence numbers, and timeouts with acknowledgment to detect corruption, loss, repetition, and delay of safety data. These measures operate end-to-end over the black channel and do not rely on the network being safety-certified.

Question 11Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

In IEC 61508-4, which description matches functional safety?

  1. The recovery time of a network after a transient fault
  2. The absence of unacceptable risk from malfunctioning E/E/PE safety-related systems Correct answer.
  3. The process of assigning SIL targets to every instrument in a plant
  4. The ability to keep production output stable during normal operation

Explanation

Functional safety is the part of overall safety relating to hazards caused by malfunctioning of E/E/PE safety-related systems. It depends on the safety functions and the safety integrity achieved, not on production stability, network recovery time, or blanket SIL assignment.

Question 12Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

Which standard is the generic functional safety framework for E/E/PE safety-related systems?

  1. IEC 61508 Correct answer.
  2. IEC 62061
  3. ISO 13849-1
  4. IEC 61784-3

Explanation

IEC 61508 is the umbrella standard for functional safety of E/E/PE safety-related systems across sectors. ISO 13849-1 and IEC 62061 adapt functional safety for machinery, while IEC 61784-3 addresses functional safety fieldbus profiles.

Question 13Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

What is the primary purpose of a proof test in IEC 61508?

  1. To replace the need for hardware fault tolerance in architectural constraints
  2. To reveal undetected dangerous failures and keep the PFDavg assumption valid Correct answer.
  3. To demonstrate that the process can operate at maximum production rate
  4. To increase the diagnostic coverage of every subsystem to 99%

Explanation

A proof test periodically exposes dangerous undetected failures that built-in diagnostics cannot find. The assumed PFDavg for a low-demand safety function depends on the proof-test interval and the effectiveness of the test.

Question 14Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

Which condition is consistent with operation in low-demand mode under IEC 61508-4?

  1. Demand rate ≤ once/year and ≤ twice proof-test rate Correct answer.
  2. Safety function continuously active
  3. Demand rate equals proof-test rate
  4. Demand rate above once per year

Explanation

IEC 61508-4 treats a mode as low demand when the safety function acts on demand and the demand frequency is not greater than once per year and not greater than twice the proof-test frequency. Higher or continuous demand falls under high-demand or continuous mode.

Question 15Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

In IEC 61508, how is safe failure fraction (SFF) defined?

  1. (λS + λDU) / (λS + λDD)
  2. (λS + λDD) / (λS + λDD + λDU) Correct answer.
  3. λDD / (λS + λDU)
  4. λDU / (λS + λDD + λDU)

Explanation

SFF is the fraction of failures that are either safe or dangerous but detected, with total failure rate in the denominator. Dangerous undetected failures are excluded from the numerator because they are not announced by diagnostics.

Question 16Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

In the ISO 13849-1 to IEC 62061 mapping, which Performance Level can correspond to SIL 3?

  1. PL e Correct answer.
  2. PL a
  3. PL c
  4. PL d

Explanation

ISO 13849-1 maps PL e to SIL 3 as the highest performance level, while PL d maps to SIL 2 and lower performance levels map to SIL 1 or no SIL. The mapping supports comparison but does not replace verification of the actual safety function.

Question 17Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

What does diagnostic coverage (DC) quantify in IEC 61508?

  1. The fraction of safe failures that are announced to the operator
  2. The fraction of dangerous failures detected by implemented diagnostic tests Correct answer.
  3. The ratio of dangerous undetected to total failure rate
  4. The number of proof tests performed in one year

Explanation

DC is the ratio of detected dangerous failure rate to total dangerous failure rate. It supports architectural constraint evaluation and PFDavg calculations, and it is not a proof-test count or a safe-failure metric.

Question 18Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

Which ISO 13849-1 category relies on periodic testing by the machine control system to detect faults in a single channel?

  1. Category 1
  2. Category B
  3. Category 2 Correct answer.
  4. Category 4

Explanation

Category 2 uses well-tried safety principles and a periodic test initiated by the machine control system. The test checks the safety function and can place the machine in a safe state if a fault is found.

Question 19Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

In IEC 61508-2 architectural constraints, what does hardware fault tolerance (HFT) represent?

  1. The percentage of dangerous failures detected by built-in diagnostics
  2. The ratio of safe failures to all failures in the subsystem
  3. The time between consecutive proof tests
  4. The tolerated fault count before loss of safety function Correct answer.

Explanation

HFT is the maximum number of faults that can be present without losing the safety function. It is combined with element type and safe failure fraction in the architectural constraint tables to determine achievable SIL.

Question 20Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

In IEC 61784-3, what does the residual error rate of a safety communication system express?

  1. The data rate remaining after the safety layer removes non-safety traffic
  2. The time needed to recover the black channel after a CRC failure
  3. The undetected error rate remaining after safety measures act Correct answer.
  4. The fraction of safety messages duplicated by the sequence-number mechanism

Explanation

IEC 61784-3 safety measures such as CRC, sequence numbers, and timeouts detect corruption, loss, duplication, and delay. The residual error rate is the undetected error rate left after those measures and is used to judge whether the communication system meets its safety integrity requirement.

Question 21Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

IEC 62061 is the machine-sector standard for safety-related control systems. What is the highest SIL it defines?

  1. SIL 1
  2. SIL 4
  3. SIL 2
  4. SIL 3 Correct answer.

Explanation

IEC 62061 defines SIL 1 to SIL 3 for safety-related control systems in machinery, so SIL 3 is the highest level a machine safety function can claim under it. SIL 4 is defined in IEC 61508 but is not provided for by the simplified IEC 62061 method.

Question 22Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

In IEC 61508, which statement expresses the safety integrity of a safety function?

  1. The likelihood that the function performs satisfactorily under stated conditions Correct answer.
  2. The severity of the worst credible hazard that the safety function mitigates
  3. The number of redundant channels used to implement the safety function
  4. The interval between successive proof tests specified for the safety function

Explanation

Safety integrity is defined in IEC 61508-4 as the probability of a safety-related system satisfactorily performing the required safety functions under all stated conditions within a stated period. It is expressed as a target failure measure such as PFDavg or PFH, not as an architectural or testing property.

Question 23Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

IEC 61508-5 discusses principles for setting SIL targets from tolerable risk. Which principle requires risk to be reduced unless the cost of further reduction is grossly disproportionate to the benefit?

  1. Safety integrity level allocation
  2. As low as reasonably practicable (ALARP) Correct answer.
  3. Fail-safe design
  4. Defence in depth

Explanation

The ALARP principle, referenced in IEC 61508-5 within the tolerable risk framework, requires risk to be reduced unless the cost is grossly disproportionate to the benefit obtained. It is used to justify that a chosen SIL target brings risk into the tolerable region.

Question 24Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

During a project, engineers check that the outputs of each lifecycle phase satisfy the inputs defined for that phase; later, after installation and commissioning, they demonstrate in the real plant that the safety-related system meets the overall safety requirements. Which pair of IEC 61508 terms matches these two activities in order?

  1. Verification, followed by validation Correct answer.
  2. Hazard analysis, followed by risk assessment
  3. Validation, followed by verification
  4. Functional safety assessment, followed by functional safety audit

Explanation

Verification confirms that the outputs of a lifecycle phase satisfy the requirements defined for that phase, whereas validation confirms at the end of development, in the operational environment, that the safety-related system meets the overall safety requirements. IEC 61508 therefore applies verification throughout the lifecycle and validation after installation and commissioning.

Question 25Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

An element used in a safety-related system has well-defined failure modes, behaviour under fault conditions that can be fully determined, and sufficient dependable field data. How is it classified in IEC 61508-2?

  1. Type B element
  2. It cannot be classified without knowing the SIL of the function
  3. Type C element
  4. Type A element Correct answer.

Explanation

IEC 61508-2 defines a Type A element as one whose failure modes are well defined, whose behaviour under fault conditions can be fully determined, and for which sufficient dependable field data exist. Elements with less predictable failure behaviour, such as complex programmable devices, fall into Type B.

Question 26Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

A safety function operates in high demand or continuous mode. Which measure expresses its safety integrity in IEC 61508?

  1. Average probability of failure on demand (PFDavg)
  2. Safe failure fraction (SFF)
  3. Average frequency of dangerous failure per hour (PFH) Correct answer.
  4. Mean time to dangerous failure (MTTFd)

Explanation

In high demand or continuous mode the function is demanded so frequently that a probability of failure on demand loses meaning, so integrity is expressed as the average frequency of dangerous failure per hour, PFH. PFDavg is the corresponding measure for low demand mode.

Question 27Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

A machine safety function designed to IEC 62061 comprises three subsystems with PFHd values of 2×10⁻⁷, 3×10⁻⁷ and 4×10⁻⁷ per hour. Assuming independence, how is the PFHd of the complete safety function obtained?

  1. By summing the three subsystem values, giving 9×10⁻⁷ per hour Correct answer.
  2. By averaging the three subsystem values
  3. By taking the highest subsystem PFHd, which is 4×10⁻⁷ per hour
  4. By multiplying the three subsystem values together

Explanation

In IEC 62061 the subsystem PFHd values of a safety function are added, because the subsystems form a series arrangement in which failure of any one causes loss of the function. The resulting PFHd is then compared with the SIL table to establish the SIL of the function.

Question 28Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

In ISO 13849-1, the required performance level PLr for a safety function is read from a risk graph. Which three parameters does that graph use?

  1. Category, MTTFd and diagnostic coverage
  2. SIL claim limit, hardware fault tolerance and safe failure fraction
  3. Demand rate, proof test interval and common cause beta factor
  4. Severity of injury, frequency/duration of exposure, and possibility of avoidance Correct answer.

Explanation

The ISO 13849-1 risk graph uses the severity of injury (S), the frequency and duration of exposure (F), and the possibility of avoiding the hazard (P) to determine the required performance level PLr. Category, MTTFd and diagnostic coverage are then used to check whether the achieved PL of the architecture meets that target.

Question 29Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

When the reliability of a redundant architecture such as 1oo2 is calculated for an IEC 61508 safety function, a beta factor is included. What does the beta factor represent?

  1. The ratio between the proof test interval and the diagnostic test interval
  2. The fraction of dangerous failures detected by automatic diagnostics
  3. The proportion of proof tests that are carried out incorrectly by operators
  4. The fraction of failures that affect both channels at once because of a common cause Correct answer.

Explanation

The beta factor models common cause failures by treating a fraction of the failure rate as affecting all redundant channels simultaneously, for example through shared power supplies, software or environmental stress. Because such failures bypass redundancy, they often dominate the PFDavg of high-integrity architectures.

Question 30Functional safety fundamentals and standards context (IEC 61508, IEC 61784-3, IEC 62061 / ISO 13849 relationship)

Within an IEC 61784-3 functional safety communication profile, each safety message carries a connection identifier, often called an F-address. Which threat is this measure primarily intended to counter?

  1. Loss of messages because the receiving device is temporarily busy
  2. Corruption of individual bits caused by electromagnetic interference
  3. Delay of messages beyond the configured watchdog time
  4. Acceptance of a safety message by the wrong safety function or device Correct answer.

Explanation

The connection identifier lets the receiver confirm that a safety message belongs to the safety function it serves, preventing a valid message from another device or function from being accepted. Bit corruption is handled by the CRC, message loss and repetition by sequence numbers and timeouts, and excessive delay by the watchdog.

Question 31Safety over EtherCAT architecture: black-channel principle, FSoE master/slave roles, safety stack placement in the device

In FSoE, what does the term "black channel" describe?

  1. A diagnostic channel used by the FSoE master to read fault registers from each safety slave
  2. A non-safe transport path whose errors are covered by the FSoE protocol Correct answer.
  3. An encrypted virtual tunnel established between the safety PLC and every FSoE slave
  4. A dedicated redundant cable that carries only safety-related process data between FSoE nodes

Explanation

FSoE applies the black-channel principle: the safety protocol is carried over a standard, non-safety EtherCAT network. The FSoE layer adds its own CRC, sequence numbering, timeouts, and connection identification so that errors in the transport are detected. The transport itself is not assumed to be safe.

Question 32Safety over EtherCAT architecture: black-channel principle, FSoE master/slave roles, safety stack placement in the device

Which node initiates establishment of an FSoE connection and proposes the Connection ID?

  1. The FSoE master, which controls connection setup and parameter negotiation Correct answer.
  2. The standard EtherCAT master, because it owns the EtherCAT frame header
  3. The FSoE slave, which requests a connection when its safe outputs are ready
  4. The safety I/O module, because it detects the first valid output frame

Explanation

The FSoE master is the connection owner. It starts the connection phase, proposes the Connection ID and communication parameters, and monitors the connection. The FSoE slave responds to the request and only then exchanges safe process data.

Question 33Safety over EtherCAT architecture: black-channel principle, FSoE master/slave roles, safety stack placement in the device

In a typical FSoE drive, where does the FSoE slave safety stack run?

  1. In the engineering tool that configures and downloads the drive parameters
  2. On the drive's safety CPU, separate from the standard EtherCAT controller Correct answer.
  3. Inside the standard EtherCAT master software that runs on the control PC
  4. Within the EtherCAT slave controller's standard, non-safety register area

Explanation

In a drive, the FSoE slave safety stack runs on the safety-rated CPU that also hosts the safety application. The standard EtherCAT slave controller only handles communication; it is not the safety stack. This separation keeps the safety functions independent of the standard control path.

Question 34Safety over EtherCAT architecture: black-channel principle, FSoE master/slave roles, safety stack placement in the device

A standard EtherCAT master routes FSoE frames between an FSoE master and an FSoE slave. What is the standard master's correct role?

  1. It forwards the FSoE frames as ordinary payload without interpreting or validating safety content Correct answer.
  2. It recalculates the FSoE CRC after every EtherCAT cycle to keep the safety data valid
  3. It terminates the FSoE connection and regenerates sequence numbers for each slave
  4. It must be safety-certified because it handles safety-related process data

Explanation

The black channel permits a standard EtherCAT master to transport FSoE frames as payload. It does not validate safety content, calculate the FSoE CRC, or manage sequence numbers. Safety checks are performed only in the FSoE master and FSoE slave safety stacks.

Question 35Safety over EtherCAT architecture: black-channel principle, FSoE master/slave roles, safety stack placement in the device

An FSoE slave stops receiving valid FSoE frames and its configured watchdog time expires. What must the slave do?

  1. Switch to the standard EtherCAT process data and keep the outputs energized
  2. Bring its safety outputs to the safe state and signal a communication error Correct answer.
  3. Reset its EtherCAT station address and wait for a new configuration
  4. Continue to use the last received safe output data until the master returns

Explanation

The FSoE watchdog is a safety measure. If no valid FSoE frame arrives within the configured watchdog time, the slave must assume loss of safe communication and bring its outputs to the safe state. It must not continue with stale output data.

Question 36Safety over EtherCAT architecture: black-channel principle, FSoE master/slave roles, safety stack placement in the device

What is the purpose of the sequence number carried in every FSoE data frame?

  1. It sets the watchdog time that applies to the current FSoE connection
  2. It identifies the EtherCAT slave by its configured physical station address
  3. It selects the CRC polynomial that is used for protecting the safety frame
  4. It detects lost, repeated, or reordered frames on the black channel Correct answer.

Explanation

The sequence number is incremented for each FSoE data frame. The receiver checks it so that lost, repeated, or reordered frames on the black channel are detected. A mismatch prevents the frame from being used as valid safety data.

Question 37Safety over EtherCAT architecture: black-channel principle, FSoE master/slave roles, safety stack placement in the device

In the cyclic FSoE process data exchange between an FSoE master and an FSoE slave, which direction applies?

  1. Master sends safe outputs to the slave; slave returns safe inputs Correct answer.
  2. Both nodes send only safe input data and receive outputs from the standard master
  3. The slave sends safe output data to the master, which returns safe input data
  4. The master sends standard process data, which the slave converts into safe data

Explanation

In FSoE, safe output data flows from the FSoE master to the FSoE slave, and safe input data flows back from the slave to the master. Both directions are protected by the FSoE safety protocol, not by standard process data conversion.

Question 38Safety over EtherCAT architecture: black-channel principle, FSoE master/slave roles, safety stack placement in the device

Under the black-channel principle, which part of an FSoE system must be developed and certified to the applicable safety standards?

  1. The FSoE safety stack and the safety application in master and slave Correct answer.
  2. The standard EtherCAT master that forwards the FSoE frames
  3. The engineering PC and the configuration file used to set the FSoE addresses
  4. The Ethernet cables, connectors, and standard EtherCAT slave controllers

Explanation

Under the black-channel principle, standard network components may be used, but the safety functions must be certified. The FSoE safety stack and the safety application in the master and slave therefore fall inside the certification boundary. Cables, connectors, and standard EtherCAT controllers are treated as the black channel.

Question 39Safety over EtherCAT architecture: black-channel principle, FSoE master/slave roles, safety stack placement in the device

During FSoE connection establishment, an FSoE slave receives a Connection request containing a Connection ID and communication parameters. What is the slave's correct behavior?

  1. It forwards the request to the next slave in the EtherCAT line and waits for that slave's approval
  2. It writes the Connection ID into its EtherCAT station address register and then reboots the device
  3. It validates the parameters, accepts or rejects, stores the Connection ID, and filters later frames Correct answer.
  4. It immediately starts exchanging safe process data without checking any of the requested parameters

Explanation

The connection phase is a negotiated handshake. The FSoE slave checks the requested Connection ID and parameters, accepts or rejects the connection, and stores the agreed values. Later data frames are checked against that connection, so a frame from another connection cannot update the slave's safe data.

Question 40Safety over EtherCAT architecture: black-channel principle, FSoE master/slave roles, safety stack placement in the device

A safety PLC contains both a standard EtherCAT master and an FSoE master. How should the FSoE master stack be placed?

  1. It runs only in the engineering tool and sends safety data to the PLC through a separate serial link
  2. It runs inside the standard EtherCAT master and trusts that master's frame checks
  3. It runs in the FSoE slave and is downloaded from the PLC at each startup
  4. It runs in the PLC's safety runtime and does not trust the standard master's checks Correct answer.

Explanation

The FSoE master is a safety function and must run in the PLC's safety runtime, not inside the standard EtherCAT master. It exchanges safe data with the FSoE slaves and applies its own CRC, sequence, and timeout checks. The standard master may transport the frames, but its results are not trusted for safety.

Question 41Safety over EtherCAT architecture: black-channel principle, FSoE master/slave roles, safety stack placement in the device

Which layer detects a corrupted FSoE safety payload after EtherCAT has delivered the frame?

  1. The FSoE layer, using the FSoE frame CRC Correct answer.
  2. The safety application program, by comparing process values
  3. The EtherCAT slave controller, using the EtherCAT frame CRC
  4. The standard EtherCAT master, using its diagnostic counters

Explanation

Under the black-channel principle, EtherCAT is not trusted to protect safety data. The FSoE layer adds its own CRC, sequence monitoring and timeout checks, so a corrupted safety payload is rejected there even if the frame reached the device.

Question 42Safety over EtherCAT architecture: black-channel principle, FSoE master/slave roles, safety stack placement in the device

What is the primary role of an FSoE master during cyclic safety operation?

  1. Route EtherCAT frames between network segments and correct frame errors.
  2. Assign IP addresses to EtherCAT slaves during startup.
  3. Maintain the safety connection and exchange safety data with slaves. Correct answer.
  4. Configure standard EtherCAT PDO mapping for non-safety I/O.

Explanation

The FSoE master owns the safety connections: it sends safety output data, receives safety input data, and monitors each connection. Routing and addressing are handled by the standard EtherCAT stack, not by FSoE.

Question 43Safety over EtherCAT architecture: black-channel principle, FSoE master/slave roles, safety stack placement in the device

What distinguishes an FSoE slave from a standard EtherCAT slave?

  1. It must be configured with an IP address.
  2. It runs a certified safety stack that processes FSoE frames. Correct answer.
  3. It uses a different physical Ethernet connector.
  4. It forwards all frames without examining their contents.

Explanation

An FSoE slave includes a safety protocol stack, certified for the safety function, that validates FSoE frames and drives the device's safe outputs. A standard EtherCAT slave only handles the standard EtherCAT protocol and does not provide a safety function.

Question 44Safety over EtherCAT architecture: black-channel principle, FSoE master/slave roles, safety stack placement in the device

An FSoE slave receives a frame with valid EtherCAT CRC but invalid FSoE CRC. What must its safety stack do?

  1. Discard the frame and treat it as a communication error. Correct answer.
  2. Retain the previous safety data and ignore the error indefinitely.
  3. Forward the frame to the standard EtherCAT master for repair.
  4. Accept the frame because the EtherCAT CRC is valid.

Explanation

The FSoE CRC is the safety layer's integrity check; a frame that fails it is not valid safety data. The slave must not update its safety process data and must count the event as a communication error, eventually entering the safe state if valid frames do not resume.

Question 45Safety over EtherCAT architecture: black-channel principle, FSoE master/slave roles, safety stack placement in the device

Which statement correctly describes how FSoE frames are carried in an EtherCAT system?

  1. FSoE requires a separate physical bus from EtherCAT.
  2. FSoE replaces the EtherCAT frame header with a safety header.
  3. FSoE frames travel inside EtherCAT frames as payload. Correct answer.
  4. FSoE frames are interpreted and corrected by every standard EtherCAT slave.

Explanation

FSoE uses EtherCAT as its transport, so safety frames are carried inside ordinary EtherCAT process data or mailbox frames. Only the FSoE master and FSoE slave safety stacks interpret the embedded safety content.

Question 46Safety over EtherCAT architecture: black-channel principle, FSoE master/slave roles, safety stack placement in the device

If an FSoE master stops receiving valid frames from one FSoE slave, what must the master do for that connection?

  1. Reset the entire EtherCAT network to restart all slaves.
  2. Bring that connection to a safe state within the watchdog. Correct answer.
  3. Switch the slave to standard EtherCAT mailbox communication.
  4. Continue using the last received safety outputs without limit.

Explanation

The FSoE master monitors each safety connection and expects valid frames within the configured watchdog time. If they stop, it must not treat stale data as valid; the affected connection goes to its safe state, independently of other connections.

Question 47Safety over EtherCAT architecture: black-channel principle, FSoE master/slave roles, safety stack placement in the device

Which function belongs to the FSoE safety stack rather than to the standard EtherCAT stack?

  1. Mapping standard process data into EtherCAT PDOs.
  2. Managing the EtherCAT physical layer link.
  3. Routing EtherCAT frames between ports.
  4. Checking sequence numbers and watchdog time. Correct answer.

Explanation

Sequence-number checking and watchdog supervision are safety measures defined by FSoE; they let the safety stack detect lost, repeated, or delayed frames. EtherCAT routing, link management, and standard PDO mapping belong to the standard EtherCAT stack.

Question 48Safety over EtherCAT architecture: black-channel principle, FSoE master/slave roles, safety stack placement in the device

A non-safety EtherCAT coupler is installed between an FSoE master and slave. Why can the safety function still be acceptable?

  1. The coupler is automatically certified when FSoE frames pass through it.
  2. FSoE detects channel errors; the coupler need not be certified. Correct answer.
  3. The safety PLC bypasses the coupler by using mailbox communication.
  4. FSoE encrypts the safety data so the coupler cannot alter it.

Explanation

The black-channel principle allows standard, non-certified transmission components because FSoE itself provides the safety measures: CRC, sequence monitoring, connection identification, and timeout. The coupler may fail or corrupt data, but FSoE must detect that and force the safe state.

Question 49Safety over EtherCAT architecture: black-channel principle, FSoE master/slave roles, safety stack placement in the device

Which fault is detected by FSoE connection monitoring but not by the EtherCAT frame CRC?

  1. A corrupted EtherCAT frame-check sequence.
  2. A bit error inside the EtherCAT frame.
  3. A missing Ethernet link at the physical port.
  4. A valid frame from a different FSoE connection. Correct answer.

Explanation

EtherCAT CRC only verifies that the received EtherCAT frame is intact; it does not know which safety connection the payload belongs to. FSoE checks the connection ID and sequence, so a well-formed frame from another connection is rejected as a safety error.

Question 50Safety over EtherCAT architecture: black-channel principle, FSoE master/slave roles, safety stack placement in the device

How is the FSoE watchdog time for a safety connection determined?

  1. It is set only by the standard EtherCAT master's cycle time.
  2. It is disabled by default until the first safety fault occurs.
  3. It is fixed at 100 ms by the EtherCAT specification.
  4. It is configured and agreed when the connection is set up. Correct answer.

Explanation

The FSoE watchdog is a safety parameter of the connection, not a fixed EtherCAT timing value. It is configured in the engineering tool and confirmed between master and slave during connection establishment, then used to monitor valid frame arrival.