EMCY service

The EMCY service is a mapped to a producer/consumer protocol. The producer sends the EMCY message indicating some detected “errors”. The 8-byte message contains the one-byte error register, the two-byte emergency error code, and five bytes, which are CANopen profile-specific. Some profiles allow using the five bytes for manufacturer-specific purposes.

The error register is a variable listed in the CANopen object dictionary. It controls the Emergency state machine. If any “error” is detected, the CANopen device triggers the EMCY service and sends the EMCY message. If further “errors” occur, the CANopen device remains in the error state. Only if all “errors” are recovered, the CANopen device transits into the error-free state. The error state behavior could be defined by CANopen profiles. In the CiA 401 profile for modular I/O devices, the outputs are set to pre-defined values, when the device is in error state.

The detected misbehavior could be regarding the CAN data link (e.g. recovered from bus-off state or error passive mode indication), the CANopen application layer (e.g. PDO length exceeded or RPDO timeout), or the device’s application (e.g. mains voltage or over-temperature). Besides some general emergency error codes, the CANopen profiles specify additional ones.

The system designer needs to configure the EMCY message consumers depending on the application requirements. This is done by means of the emergency consumer parameter listed in the CANopen object dictionary. This array parameter contains all COB-IDs of EMCY messages, which are consumed. Remember, the COB-ID is a 32-bit value providing the CAN-ID of the data frames to be consumed as well as three control bits.

The reaction on the received EMCY messages is highly application-specific. By default the EMCY message is transmitted in a CAN data frame with a high-prior CAN ID: 80₁₆ plus node-ID. The system designer assigns uniquely the node-ID to the CANopen devices. The EMCY COB-ID parameter, which contains the CAN-ID to be used, can be configured by means of an SDO write service to the CANopen object dictionary.

Structure of the EMCY message: The 16-bit error code is specified in CiA 301 and optionally in the implemented CiA device profile

Error state machine

Communication errors

CiA 301 specifies some detailed communication error codes. They are related to the CAN data link layer protocol as well as to the CANopen application layer protocols. The implementation of the following error codes is recommended:

• 8110₁₆: CAN overrun (data frame lost)
• 8120₁₆: CAN protocol controller in error passive mode (node cannot indicate bus errors, when it is a receiver)
• 8140₁₆: CAN node recovered from bus-off (may have missed some CAN data frames)
• 8150₁₆: CAN-ID collision (node has detected data frames with CAN-IDs that are assigned to it)

The following CANopen protocol error codes are also recommended to be supported:

• 8130₁₆: Heartbeat error (one of the supervised CANopen device has not sent its Heartbeat)
• 8210₁₆: PDO not processed due to length error (PDO receiving CANopen device detected a mismatch of the PDO length)
• 8220₁₆: PDO length exceeded (the mapped process data is longer than 8 byte)
• 8240₁₆: Unexpected SYNC message length (SYNC consumer expect another SYNC format with or without SYNC counter)
• 8250₁₆: RPDO timeout (RPDO event timer elapsed)