I85PREP
⌘ K
FSOE Qualifying Test study materials
FSOE Qualifying Test study resources

FSOE Qualifying Test: Domain 2: Safety over EtherCAT architecture

FSOE Qualifying Test · Work through your exam, one topic at a time.

All guide sections

Domain 2: Safety over EtherCAT architecture

Domain 2 tests the architecture that makes FSoE safe: the black-channel principle, the split between FSoE master and slave roles, and where the safety stack lives. The exam wants you to separate standard EtherCAT communication from the safety-related FSoE layer.

Core rules

  • Black channel: EtherCAT, cables, switches, and standard firmware are not trusted for safety. The safety measure is end-to-end in the FSoE endpoints, so faults in the channel must be detected by FSoE mechanisms.
  • FSoE master: normally in the safety controller or safety PLC. It establishes connections, assigns connection identifiers, sends safe outputs, receives safe inputs, and monitors the connection.
  • FSoE slave: in the safety I/O, drive, or sensor. It validates incoming frames, applies safe outputs, reports safe inputs, and forces fail-safe outputs on error.
  • Safety stack placement: the FSoE safety stack is implemented in the device's safety-related firmware, logically separate from the standard EtherCAT stack. The standard stack may move frames; it must not be able to bypass the safety checks.
  • The black channel does not provide SIL/PL by itself; the safety case must include the FSoE measures and residual error.

Worked example

A safety PLC has one EtherCAT master and an FSoE master task. A remote safety I/O has an FSoE slave stack. The standard EtherCAT stack forwards process data. The FSoE master builds a Data frame with connection ID and CRC; the FSoE slave checks CRC, connection ID, sequence and watchdog before energizing outputs. If the standard stack corrupts a byte, CRC_0 fails; if the frame is delivered to the wrong connection, CRC_1/connection check fails. The safety function therefore depends on the FSoE endpoints, not on EtherCAT's own CRC.

Traps

Assuming EtherCAT's frame-check sequence is a safety CRC. Putting safety logic in the non-safety application. Believing a black channel needs no residual-error calculation. Forgetting that the slave must react locally when the master or network fails.