EMCY service

The EMCY service is a mapped to a producer/consumer protocol. The producer sends the EMCY message indicating some detected “errors”. The 8-byte message contains the one-byte error register, the two-byte emergency error code, and five bytes, which are CANopen profile-specific. Some profiles allow using the five bytes for manufacturer-specific purposes.

The error register is a variable listed in the CANopen object dictionary. It controls the Emergency state machine. If any “error” is detected, the CANopen device triggers the EMCY service and sends the EMCY message. If further “errors” occur, the CANopen device remains in the error state. Only if all “errors” are recovered, the CANopen device transits into the error-free state. The error state behavior could be defined by CANopen profiles. In the CiA 401 profile for modular I/O devices, the outputs are set to pre-defined values, when the device is in error state.

The detected misbehavior could be regarding the CAN data link (e.g. recovered from bus-off state or error passive mode indication), the CANopen application layer (e.g. PDO length exceeded or RPDO timeout), or the device’s application (e.g. mains voltage or over-temperature). Besides some general emergency error codes, the CANopen profiles specify additional ones.

The system designer needs to configure the EMCY message consumers depending on the application requirements. This is done by means of the emergency consumer parameter listed in the CANopen object dictionary. This array parameter contains all COB-IDs of EMCY messages, which are consumed. Remember, the COB-ID is a 32-bit value providing the CAN-ID of the data frames to be consumed as well as three control bits.

The reaction on the received EMCY messages is highly application-specific. By default the EMCY message is transmitted in a CAN data frame with a high-prior CAN ID: 8016 plus node-ID. The system designer assigns uniquely the node-ID to the CANopen devices. The EMCY COB-ID parameter, which contains the CAN-ID to be used, can be configured by means of an SDO write service to the CANopen object dictionary.

16-bit error code 8-bit error register
(1001 0116)
Device-profile of manufacturer-specific error information

Structure of the EMCY message: The 16-bit error code is specified in CiA 301 and optionally in the implemented CiA device profile

Error state machine

Error state machine

Value Description
00xx16 No error or reset
10xx16 Generic error
20xx16 Current
21xx16 Current, CANopen device input side
22xx16 Current inside the CANopen device
23xx16 Current, CANopen device output side
30xx16 Voltage
31xx16 Mains
32xx16 Voltage inside the CANopen device
33xx16 Output voltage
40xx16 Temperature
41xx16 Ambient temperature
42xx16 CANopen device temperature
50xx16 CANopen device hardware
60xx16 CANopen device software
61xx16 Internal software
62xx16 User software
63xx16 Data set
70xx16 Additional modules
80xx16 Monitoring
81xx16 Communication
82xx16 Protocol
90xx16 External
F0xx16 Additional functions
FFxx16 CANopen device specific

16-bit error code classes

Communication errors

CiA 301 specifies some detailed communication error codes. They are related to the CAN data link layer protocol as well as to the CANopen application layer protocols. The implementation of the following error codes is recommended:

  • 811016: CAN overrun (data frame lost)
  • 812016: CAN protocol controller in error passive mode (node cannot indicate bus errors, when it is a receiver)
  • 814016: CAN node recovered from bus-off (may have missed some CAN data frames)
  • 815016: CAN-ID collision (node has detected data frames with CAN-IDs that are assigned to it)

The following CANopen protocol error codes are also recommended to be supported:

  • 813016: Heartbeat error (one of the supervised CANopen device has not sent its Heartbeat)
  • 821016: PDO not processed due to length error (PDO receiving CANopen device detected a mismatch of the PDO length)
  • 822016: PDO length exceeded (the mapped process data is longer than 8 byte)
  • 824016: Unexpected SYNC message length (SYNC consumer expect another SYNC format with or without SYNC counter)
  • 825016: RPDO timeout (RPDO event timer elapsed)