FSoE: Functional Safety over EtherCAT
What is FSoE?
Functional Safety over EtherCAT (FSoE) is a safety-certified communication protocol in accordance with ETG.5100 that builds a safety layer on top of standard EtherCAT. It enables the transmission of safety-related process data up to SIL 3 via the existing EtherCAT network — without separate safety cabling.
Why is this important?
Without FSoE, every servo drive with safety functions requires dedicated, two-channel redundant safety cables from the safety PLC to the drive. In a multi-axis system with 6 or more axes, this means considerable cabling effort, large connectors, and complex commissioning.
FSoE solves this problem fundamentally:
- No separate safety cabling — safety commands (STO, SLS, SS1, etc.) and safety feedback (safe position, safe speed, status) run in the same EtherCAT frame as the standard process data
- SIL 3 via standard hardware — normal Cat5e cables, no special safety cables or connectors required
- Reduced costs — fewer cables, smaller control cabinets, faster commissioning
- Integrated diagnostics — Safety status and error information are available directly in the fieldbus protocol
How does it work?
Black channel principle: FSoE treats the entire EtherCAT infrastructure—cables, master stack, slave controllers—as a "black channel" that is excluded from the security assessment. Data integrity is ensured end-to-end between the FSoE master (safety PLC) and FSoE slave (safety device). Even if the transport medium corrupts, delays, duplicates, or loses data, the safety layer detects this and triggers the safe state.
Frame structure: Each FSoE frame contains safety data blocks, each secured by its own CRC, as well as a connection ID for identifying the connection. This granular test scheme detects all eight error categories according to IEC 61508: falsification, repetition, incorrect sequence, message loss, impermissible delay, insertion, masking, and addressing errors.
Watchdog monitoring: The FSoE master starts a watchdog timer for each frame sent. If the valid response from the slave is not received within the configured watchdog time, the safe state (STO) is triggered. Typical watchdog times are 15 ms or higher.
Master-slave model: Each FSoE connection is a point-to-point connection between an FSoE master and an FSoE slave. The master sends safety commands (control words), and the slave responds with safety status, safe position, and safe speed.
How does SOMANET implement this?
The SOMANET Circulo with Safe Motion Module (SMM) operates as an FSoE slave and connects to an external safety PLC (e.g., Beckhoff TwinSAFE). The internal SMM cycle time is 1 ms, and the minimum FSoE cycle time is 6 ms.
All safety functions are controlled via FSoE: STO, SBC, SS1, SS2, SOS, SLS (four instances), and SMS. In addition to the safety commands, the FSoE data frames also transport safe position values (0x6611), safe speed values (0x6613) and status information — all CRC-protected and marked with validity flags.
Synapticon was one of the first providers in the field of integrated servo technology to implement FSoE as a certified standard product—an essential component for the safety architecture of collaborative robots and autonomous mobile robots (AMR).
Further links:
