Domain 5: Error detection and residual-error measures
Domain 5 tests the error-detection measures that justify the black channel. You need to explain sequence monitoring, timeouts and watchdogs, addressing checks, data integrity, and how residual error is treated in the safety case.
Core rules
- Sequence monitoring: each FSoE data frame carries a sequence counter. The receiver checks that frames are new and in order; duplicates, repeats, lost frames, and reordering are detected. A jump from 5 to 8 means frames 6 and 7 were lost and the data is not accepted as a continuous update.
- Timeouts and watchdogs: the connection watchdog defines the maximum time without a valid frame. It must be longer than normal cycle jitter and shorter than the process safety time, with margin.
- Addressing checks: the connection identifier and configured FSoE address ensure a frame is consumed by the intended endpoint, not a similar slave on the same network.
- Data integrity: CRC_0 and CRC_1 detect corruption in the safe data and connection information. They are not a substitute for sequence and timeout checks.
- Residual error: FSoE reduces but does not eliminate undetected failure. The residual error rate of the black channel plus FSoE measures must be included in the PFH/PFD calculation.
Worked example
A safety input is sampled every 4 ms and the process safety time is 50 ms. Set the watchdog to 20 ms: 5 cycles of margin for jitter, still 30 ms before the safety function must respond. If a frame is delayed 25 ms, the slave trips fail-safe even though the data may be old but valid. If a frame arrives with sequence 12 after 9, the receiver rejects it and waits for a valid sequence; the watchdog then times out if the stream does not recover.
Traps
Setting the watchdog equal to the cycle time and causing nuisance trips. Setting it longer than the process safety time, so the safety reaction is too late. Relying on CRC alone for lost or duplicated frames. Ignoring sequence wrap or accepting a repeated sequence as fresh data.