Safety over EtherCAT

showstack / protocols / fsoe

Safety over EtherCAT

Also called FSoE, FailSafe over EtherCAT.

The same black-channel idea on EtherCAT: a safety container travels inside ordinary EtherCAT frames, protected by its own CRC, sequence counting and watchdog, so the fieldbus underneath carries it without being safety-rated. This is what a TwinSAFE emergency stop is actually riding on.

Machinery and motionPaid specEtherCAT Technology GroupReported

Control Small, urgent, must arrive

Small messages that either repeat constantly or fire once. Bandwidth is almost never the problem.

What kills it. Latency and loss on the messages that fire once. A repeating level survives a dropped packet; a GO does not.

The four flows, and why the model is worth having →

What goes wrong

The watchdog timeout is a design number, not a default. Too short and the machine nuisance-trips; too long and the stopping distance grows.

Safety-rated and standard I/O on one bus is convenient and makes the boundary less visible. Document which is which before somebody assumes.

Losing the safety connection is a stop, by design. A flaky cable therefore reveals itself as an unexplained e-stop rather than as a fault message.

Typical use

Safe stop, safe position and safe speed on winches, lifts and revolves
Distributed emergency stop across a machine with one cable rather than a parallel loop
Safety I/O sharing the fieldbus with ordinary control I/O

Sources

Safety over EtherCAT — EtherCAT Technology Group primary

Understand the mechanism

Hoists and the safety chain

Something wrong, or missing?

Known gaps on this entry: default_ports, implementations. If you can source one of them, that is a ten minute pull request.

Edit this entry on GitHub — one file, editable in your browser, and your handle goes on it permanently.

Work at EtherCAT Technology Group? Confirm or correct this entry — it is free, it stays free, and nothing about it is for sale.