CODESYS CANopen node status and guard timer explained

The implicit variables

CANopen implicit variables are globals the CANopen library declares for you; you read them, you never declare them. pCANopenMaster covers the master. pCanOpenNode is the node array, sized by the library constant MAX_NODEINDEX, and each entry carries the fields supervision needs: nStatus, ucNodeNbr, and GuardTimer. The exact member list moves between runtime releases, so open the reference installed with your copy. On a V2.3 install that is the CANopen runtime PDF in the Documents/English folder, titled CANopen for 3S Runtime Systems. The move itself is ordinary library work, the same one you make when you read an I2C register from a CODESYS function block: find the window onto the hardware and read it every cycle.

What nStatus tells you

nStatus carries the node's NMT state in the CiA 301 coding: 5 operational, 4 stopped, 127 pre-operational, 0 boot-up. A node exchanges process data only in the operational state, so 5 is the number a running machine should show. 4 means the node was sent an NMT stop command. 127 is the state after power-up or reset, before the master starts the node.

The library's own example tests for any value other than 5, and that is the right test:

FOR i := 0 TO MAX_NODEINDEX DO
    IF pCanOpenNode[i].nStatus <> 5 THEN
        xNodeFault := TRUE;
        uiFaultNode := pCanOpenNode[i].ucNodeNbr;
        EXIT;
    END_IF
END_FOR

The array index is not the node number; that is what ucNodeNbr is for. Keep EXIT when one fault is enough to stop the machine. Drop it and collect every hit into an array when the operator needs the whole list on one screen. Run the scan every PLC cycle; it costs one comparison per entry.

When every entry faults in the same cycle, one cause sits behind all of them: the master, its cable, or its supply. Before you walk the line, check if a CODESYS runtime is running or stopped on the controller.

GuardTimer.Q and the two supervision protocols

CANopen supervises nodes with two mechanisms, heartbeat and node guarding, and GuardTimer.Q covers both. With the heartbeat protocol, each node transmits one byte, its state, on COB-ID 0x700 plus its node number, at a producer interval you configure. The master only listens. The intent, as the CiA 301 error control protocols set it out, is that every participant on the bus shows it is still available and still in its intended NMT state.

Node guarding works the other way around: the master polls each node once per guard time, the node answers with its state, and bit 7 of that answer toggles on every reply so a repeated answer is visible. The slave watches the polls as well. Life time is guard time times life time factor: 200 ms x 3 = 600 ms, after which an unpolled slave raises its own communication error.

GuardTimer.Q is TRUE when the entry's supervision timed out: heartbeats that stopped, or a guard poll that was never answered. nStatus shows the last state the node reported, so on a node that went quiet the timer trips while the status still holds the old value. Treat the timer as the trip signal and the status as the last known state.

Example: six nodes on a palletizer

A palletizer cell runs six CANopen nodes: two drives, three remote I/O blocks, one print-mark encoder. Each node produces a heartbeat every 500 ms, and the master's consumer timeout is 750 ms, the common 1.5 x 500 ms. Pull the CAN lead off the second drive, node number 4, right after one of its heartbeats, and count.

That heartbeat left at t = 0. Nothing follows it. At t = 750 ms the consumer times out and the entry's GuardTimer.Q goes TRUE. The cycle scan then finds the first nStatus other than 5, sets xNodeFault, and copies ucNodeNbr = 4 into uiFaultNode. From cable out to fault on the panel: about three quarters of a second, with the node number attached. Plug the lead back in, the next heartbeat lands within 500 ms, the timer resets, and the entry reads 5 again. Latch the fault with your own one-shot so somebody acknowledges it.

The numbers scale straight. A 200 ms producer time with a 300 ms timeout detects in about 300 ms; 1000 ms with a 1500 ms timeout takes about one and a half seconds. Choose the producer time from how fast the machine can damage product or tooling when a drive stops talking, not from the bus baud rate.

When you need a message-received flag

Supervision answers whether the node is alive. It carries one state byte about the node and nothing about your process data, so it cannot stand in for a receive flag on one message. When the question is whether one data object is updating, watch the data itself.

The mapped PDO variable is already in your program. Time it. A drive position that should change every 10 ms and has held still for 50 ms is stale, whatever the node status says. When the value can legitimately sit still, have the slave append a free-running counter to its transmit PDO and reset a timer on every change of the counter. That check is yours, it is per message, and it trips on exactly the object you care about.

Slow SDO traffic is a third fault family. If supervision is clean and SDO transfers still stall, CANopen SDO block transfer support and troubleshooting covers that path before you touch the wiring.

Showing the fault list on the floor

The node number on the machine HMI tells the operator. A list of the line's dead nodes on a wall screen tells maintenance where to walk first, and that second job is a display job, not an HMI job: factory status display or operator HMI draws the line, and shop-floor status screens cover what a screen on the floor has to survive. Once the scan names the drive, PLC fault code decoding for drive diagnostics tells you why it went quiet. Keep an event history and the same data feeds both screens: log PLC variables to a database from CODESYS is the storage side.

What to set

Recommendation: Run heartbeat supervision on every new machine: 500 ms producer time, 750 ms consumer timeout, one scan of pCanOpenNode for nStatus other than 5 every cycle, and GuardTimer.Q latched as the fast fault bit. Use node guarding only for legacy slaves that cannot produce a heartbeat. When one data object must provably update, add the counter to its transmit PDO and time it in the PLC, and keep that check separate from node supervision.

Questions