CANopen node missing or dropping off the bus

intermediate · 20 min

A field procedure for a CANopen node that never appears, or appears and then drops. Separate bit timing, termination, duplicate node IDs, NMT state and bus-off by what the bus actually does — then fix each one without dropping the machine.

ℹ️ A CANopen node that vanishes is rarely a dead node. Either the bus cannot agree on how fast bits are clocked, or the node is alive and simply not in the NMT state where it is allowed to talk. One SDO read tells you which — before you touch a single terminal.

The CANopen NMT state machine beside a real DIN-rail CAN segment, showing why SDO answering while PDO stays silent is a state fault rather than a wiring fault — and how a 250k node on a 500k bus or a duplicated node-ID 0x02 makes a device vanish from the scan.

Tell the causes apart first

Five faults, one complaint. Tell them apart by what the bus does.

• Many nodes fail at once, analyser full of error frames. Bit rate, bit timing, or termination.
• A node answers configuration reads but its I/O never updates. Alive, wrong NMT state. The most common of all.
• A node appears, drops, reappears; replies sometimes corrupt. Duplicate node ID.
• A node that was fine went silent, red LED solid. Bus-off.
• Never appeared since power-up. Wrong bit rate or ID, no power, broken drop.

Read the LEDs first. CiA 303-3 recommends green RUN (blinking = Pre-operational, single flash = Stopped, solid = Operational) and red ERR (single flash = CAN warning limit, double flash = error-control event i.e. guarding or heartbeat, triple flash = SYNC timeout, solid = bus-off) — a recommendation, not a rule. Vendors deviate; check the manual before you trust the pattern.

Bit timing: get this wrong and everyone suffers

The bit rate is how fast the bus clocks bits. CiA 301 lists 10, 20, 50, 125, 250, 500, 800 and 1000 kbit/s. Every node must use the same one; CANopen does not negotiate it. A node at the wrong rate misreads every frame, sends an error frame, and that error frame destroys the frame in flight. One node can stop the whole segment.

Inside each bit the controller also picks a sample point; CiA 301 recommends as close as possible to 87.5% of the bit time. Different sample points at the same nominal rate still fail, and the failure gets worse the longer the cable. CiA 301's bus-length estimation, based on 5 ns/m propagation delay:

These are estimates; controller, transceiver and optocoupler delays come off the top. A bus that works at 125 kbit/s and dies at 500 has a length or timing problem.

Termination is one 120 ohm resistor across CAN_H and CAN_L at each physical end of the trunk, nowhere else. Two in parallel measure about 60 ohms; 120 ohms means one is missing, 40 ohms means a third.

Node IDs

Node IDs run 1 to 127, and every CAN identifier (COB-ID) is built from one — SDO request 600h + ID, response 580h + ID, heartbeat and boot-up 700h + ID — so two devices on one ID share identifiers. CAN arbitration assumes identifiers are unique. Two nodes sending the same identifier with the same data stay in lockstep and nothing visibly breaks; the moment the data differs, both senders think they won arbitration, bit errors follow, and the frames are retransmitted endlessly. That is why the damage is intermittent rather than clean, and why the symptom can hide for hours.

The NMT state machine: the key diagnostic split

NMT (network management) holds each device in one of four states. Initialisation runs at power-up and ends with a boot-up message on 700h + ID carrying one zero byte, then the device enters Pre-operational on its own. In Pre-operational, SDOs work, heartbeat works, PDOs do not. Operational allows everything. Stopped allows only NMT commands and error control.

The split that solves most calls: SDOs work in Pre-operational, PDOs only in Operational. If you can read parameters but process data never arrives, the node is not broken — it is not Operational. In practice that is almost always because no NMT Start was ever sent to it: the master never ran its start-up sequence, its autostart option is off, or the node is not in the master's configured node list.

A device can also leave Operational by itself after a serious device failure. Object 1029h (error behavior) selects what it does then — enter Pre-operational, enter Stopped, or stay in state. The default, and the fixed behaviour when 1029h is not implemented, is a transition to Pre-operational. That is a possible second cause of a node sitting in Pre-operational, not the primary one; check whether the master ever sent Start before you go reading 1029h.

NMT commands go on COB-ID 000h with the node ID as the second byte, 0 meaning all nodes: 01h start, 02h stop, 80h enter pre-operational, 81h reset node, 82h reset communication. 82h is the useful one here — it re-runs communication initialisation and re-issues boot-up without resetting the application.

Object dictionary, PDO vs SDO, EDS

The object dictionary is a device's table of settings and data, addressed by a 16-bit index and an 8-bit subindex. Communication profile objects live at 1000h–1FFFh, manufacturer-specific at 2000h–5FFFh, device profile at 6000h–9FFFh.

An SDO reads or writes one entry, confirmed: configuration and diagnostics. A PDO carries up to 8 bytes of process data, no reply, no addressing overhead — the real I/O. PDO content is defined by the mapping objects: RPDO parameters at 1400h–15FFh with mapping at 1600h–17FFh, TPDO parameters at 1800h–19FFh with mapping at 1A00h–1BFFh.

The EDS (electronic data sheet, CiA 306) is the vendor's INI-style listing of a device's dictionary; a DCF is the same file carrying the values for one installed device. A stale EDS makes the master map objects the device lacks, the SDO aborts 06020000h or 06090011h, and configuration stops.

Heartbeat and node guarding

Heartbeat: the producer sends 700h + ID on the timer in 1017h; consumers list who they watch and the timeout in 1016h. The data byte carries the NMT state — 00h boot-up, 04h Stopped, 05h Operational, 7Fh Pre-operational.

Set the consumer time in 1016h comfortably above the producer time in 1017h — roughly 1.5x or more is the usual practice. A consumer time set equal to the producer time will report 8130h on ordinary jitter with nothing physically wrong, and that false alarm is easy to spend a shift chasing.

Node guarding is older: the master polls each node with a CAN remote frame, and 100Ch (guard time) times 100Dh (life time factor) is the lifetime. CiA no longer recommends remote-frame-based services. Do not run both mechanisms on the same node; if both are configured, keep heartbeat and set 100Ch to 0.

Error counters, error-passive and bus-off

Every CAN controller keeps a transmit error counter (TEC) and a receive error counter (REC): a transmit fault costs 8, a receive fault 1, a good frame pays back 1. When either counter exceeds 127 — that is, on reaching 128 — the node goes error-passive: still on the bus, but no longer asserting active error flags. When TEC exceeds 255, at 256, it goes bus-off and stops transmitting.

Devices announce this by emergency message (EMCY) on 80h + ID: 8110h CAN overrun, 8120h error-passive, 8130h life guard or heartbeat error, 8140h recovered from bus-off. On Linux, ip -details -statistics link show can0 prints the controller state (ERROR-ACTIVE, ERROR-WARNING, ERROR-PASSIVE, BUS-OFF, STOPPED), berr-counter tx/rx, restart-ms, and cumulative bus-error / error-warn / error-pass / bus-off counts. CODESYS and TwinCAT expose equivalent diagnostics.

Step-by-step

Work outward from observation to intervention. Everything up to step 5 is passive; nothing before then disturbs a running machine.

1. Read the LEDs — the missing node and its neighbours. Solid red goes to step 6. Blinking green goes to step 5.
2. Attach an analyser in listen-only (silent) mode and watch. PCAN-View, CanKing, canAnalyser, CANoe or candump. Safety: listen-only is not optional on a live bus. An analyser in normal mode at the wrong bit rate does not listen — it misreads every frame, emits error frames, and takes down the traffic you came to observe. (The converse also matters: a listen-only node does not acknowledge, so it must never be the only receiver on a two-node bench test.)
3. Power-cycle the node and watch for boot-up at 700h + ID. Safety: this drops that device's outputs — confirm with the operator before removing power from a drive, valve island or I/O block on a running machine. Silence means wrong rate, wrong ID, no power, or a broken drop.
4. Read identity object 1018h by SDO. A clean answer proves the node is powered, on the right ID and at the right bit rate, and that the physical layer is at least workable — so look at state and mapping first. It does not clear a marginal physical layer: a bus that passes one SDO can still collapse under PDO load. Abort 05040000h means nobody answered.
5. Check the NMT state from the heartbeat byte, then the error history in 1003h. If the node is in Pre-operational, check whether the master ever sent NMT Start before suspecting the device. Safety: NMT Start makes devices Operational, PDO data reaches outputs, machinery can move. Whatever is sitting in each receive PDO buffer goes straight out. Clear the area first.
6. Confirm the configured bit rate on every node, master and analyser included, from device configuration or DIP switches — not from what the drawing says.
7. Measure termination. Safety: the segment must be de-energised for a resistance measurement, which drops its outputs. Plan this as a scheduled stop, not an ad-hoc probe. Expect ~60 ohms; 120 ohms means a missing terminator, 40 ohms means an extra one.
8. For bus-off, clear the fault and watch the counters climb again under load. A slow climb over minutes points at a marginal physical layer — connectors, stub length, a weak terminator. An immediate return points at something gross and constant: a bit rate or sample-point mismatch, a shorted or open pair, a missing terminator, or a failed transceiver. Do not settle on bit rate without confirming step 6.
9. For a suspected duplicate, power one candidate down and see if the symptom moves. Same safety caution as step 3. Suspect any recently fitted spare — replacement units ship on default IDs.

Never do this

Never send NMT Start Remote Node to node ID 0 to "wake up" one device on a live machine. Node 0 means every node. Every drive, valve island and I/O block goes Operational at once, and whatever sits in each receive PDO buffer goes straight to outputs: axes driven to stale setpoints, valves opening unannounced. Address the one node ID you mean.

Never connect an analyser to a live bus in normal mode when you are not certain of the bit rate. A mis-timed interface transmits error frames and can stop production while you are "just looking". Listen-only first, always.

Never add termination "to be safe." Two resistors, one at each physical end. A third loads the bus and shrinks the differential signal, producing intermittent dropouts blamed on a device that is then replaced at cost.

Never live with a node that keeps going bus-off by power-cycling it each shift. Bus-off is the controller protecting the network from a real fault, and repeated recovery hides that fault until it is permanent.