WOODWARD 9905-972

Description

Model Series

Technical Specifications

Functional Features

• Dual-channel intrinsically safe barrier interface — two independent barrier channels for safe-area to hazardous-area signal isolation; compatible with all major IS barrier manufacturers (MTL, Bartec, Pepperl+Fuchs)
• High-output exciter driver (10 A DC per channel) — powers large brushless exciter field windings directly; eliminates need for external power amplifiers in hazardous areas
• Integrated governor and AVR in one unit — replaces separate governor, AVR, and protection relay hardware; reduces panel space, wiring, and cost by up to 60%
• Isochronous and droop speed control with user-selectable droop percentage (1% to 10%) for single-unit or parallel operation
• 3-phase voltage sensing with phase-loss detection, phase-sequence verification, phase-rotation indication, and negative-sequence voltage monitoring
• Magnetic pickup (MPU) speed input compatible with all standard engine-mounted pickups (5–30 VAC, 100 Hz to 10 kHz)
• 240 × 128 color LCD touchscreen display — shows real-time speed, voltage, frequency, load, fuel level, alarm status, and waveform diagrams; supports multiple languages
• 12 digital inputs for remote start/stop, emergency stop, mode selection, alarm signals, and synchronization commands
• 6 programmable relay outputs for alarm, pre-alarm, run status, fault indication, and synchronization status
• 2 configurable analog outputs (4–20 mA or 0–10 VDC) for external monitoring of speed, voltage, load, frequency, or power factor
• Comprehensive protection suite: over-speed, under-speed, over-voltage, under-voltage, over-frequency, under-frequency, over-current, reverse power, short circuit, ground fault, engine crank timeout, over-temperature, low oil pressure, high exhaust temperature, and emergency stop
• Governor fuel limit control with adjustable high-fuel-limit, low-fuel-limit, and rate-of-change-of-frequency (ROCOF) limits
• Soft-start function for controlled engine startup and voltage buildup with adjustable ramp rate
• Load-share (droop) mode for stable parallel operation of multiple generators without external load-sharing controllers
• Remote sensing capability for compensating voltage drop across long cable runs (up to 500 m)
• RS-485 Modbus RTU communication for SCADA, BMS, and remote monitoring integration (baud rate: 9600 to 115200 bps, configurable)
• Built-in data logger — records operating parameters (speed, voltage, frequency, load, alarms) at configurable intervals (1 second to 1 hour) for preventive maintenance
• Event logging stores the last 500 alarm events with timestamps (expandable to 5,000 with SD card option) for root-cause analysis
• Adjustable governor gain, speed loop bandwidth, and voltage loop bandwidth for optimization to specific engine/generator combinations
• Engine cranking output — provides a timed cranking signal (adjustable: 5–30 seconds) to the engine starter during startup sequence
• Pre-lubrication timer — delay between start command and fuel admission for engine oil pressure buildup (adjustable: 0–60 seconds)
• Emergency stop (E-stop) input — hardwired input that immediately shuts down fuel and excitation within 10 ms
• Adjustable acceleration/deceleration ramp rates for smooth speed transitions (adjustable: 0.1 Hz/s to 10 Hz/s)
• Password-protected configuration — prevents unauthorized parameter changes; three access levels (operator, technician, engineer)
• Built-in synchroscope function — visual and numeric indication of phase angle, frequency difference, and voltage difference for manual or automatic paralleling
• Automatic paralleling capability — when configured with synchronization relay, the controller automatically closes the breaker when all synchronization conditions are met (voltage within ±5%, frequency within ±0.1 Hz, phase angle within ±10°)

Performance Parameters

Material Composition

Structural Features

• Large-format DIN-rail mountable module (200 mm × 150 mm × 140 mm) designed for installation inside generator control panels, marshalling cabinets, or dedicated controller enclosures
• Front panel with 240 × 128 pixel color LCD touchscreen display — shows real-time speed, voltage, frequency, load percentage, fuel level, alarm status, waveform diagrams, and event logs; supports multi-touch gestures (pinch-to-zoom, swipe)
• Front-panel silicone membrane keypad — 12-button matrix with backlit LED indicators for navigating menus, adjusting setpoints, and viewing alarms; all buttons are sealed behind the IP65 membrane
• LED indicators on front panel: Power (green), Run (green), Fault (red), Alarm (yellow), Emergency Stop (red flashing), Barrier Fault (amber)
• Rear terminal block array with clearly labeled connections for:
  • Safe area inputs (24 VDC supply, MPU speed, voltage sensing, digital inputs, analog inputs)
  • Hazardous area outputs (barrier channel 1 and channel 2 outputs to field instruments)
  • Exciter field output (F+, F−) — high-output, 10 A DC per channel
  • Governor actuator output (0–10 VDC or 4–20 mA, configurable)
  • Remote sense (RS+, RS−)
  • Analog outputs (AO1, AO2)
  • Digital inputs (DI1–DI12, common)
  • Relay outputs (RO1–RO6, NO/NC/common)
  • RS-485 communication (A, B, GND)
  • CAN bus (CAN H, CAN L, GND) — on CAN variants
  • Ethernet (RJ45) — on EtherNet/IP variants
  • USB port (Type-A) — for firmware updates and data export
  • SD card slot — for data logging and firmware storage
  • Emergency stop (E-stop, NO/NC)
  • Crank output (CRANK+, CRANK−)
  • Synchroscope input (SYNC+, SYNC−) — for automatic paralleling
  • Ground connections (chassis ground, IS ground, signal ground)
• Dual-channel barrier interface — two independent intrinsically safe barrier channels with dedicated terminal blocks, each with its own fuse, surge protection, and isolation monitoring
• Adjustable gain and stability trimmers accessible via front panel (under hinged cover with tamper-resistant screws)
• Ventilation slots on top, bottom, and sides for natural convection cooling (no internal fan; relies on finned aluminum heat sink)
• EMC shielding via metal enclosure, beryllium copper gasket, and filtered I/O connections (all barrier channels include EMC filters)
• IP65 front panel rating — protected against water jets and dust ingress from the front; suitable for outdoor and washdown installations
• IP20 rear rating — rear terminals require enclosure protection (install in NEMA 1 or higher enclosure)
• Tamper-resistant terminal cover — hinged cover with gasket protects terminals from dust, moisture, and accidental contact
• DIN rail clip — heavy-duty spring-loaded 35 mm DIN rail mounting clip with captive M8 stainless steel screws
• Label area — laser-etched stainless steel plate on the enclosure face (model number, ratings, certifications, serial number); etching is permanent and resistant to chemicals, UV, and abrasion
• Cable entry points — M20 × 1.5 cable glands (4 × top, 2 × bottom, 2 × sides) with IP68 rated seals

Working Principle

1. The controller draws self-power from the generator terminals via the 24 VDC system — no external power supply is required during normal operation
2. Dual-Channel Barrier Interface:
   • The controller connects to two independent intrinsically safe barriers (MTL, Bartec, or Pepperl+Fuchs) on the safe-area side
   • Each barrier channel provides galvanic isolation and energy limitation between the safe-area controller and the hazardous-area field instruments
   • The barrier limits voltage to Uo ≤ 28 VDC and current to Io ≤ 100 mA per channel (for standard IS) or Io ≤ 10 A per channel (for high-output IS barrier variants)
   • The barrier ensures that even under fault conditions, the energy delivered to the hazardous area remains below the minimum ignition energy (MIE) of the surrounding explosive atmosphere
3. Speed Control Loop (Governor):
   • The magnetic pickup (MPU) mounted on the engine flywheel generates an AC voltage proportional to engine speed
   • The controller converts the MPU signal to a digital speed value via an internal frequency-to-voltage converter
   • The microprocessor compares the actual speed to the user-defined setpoint (isochronous or droop mode)
   • The error signal is processed by a digital PID control algorithm with adjustable gain, integral, and derivative terms
   • The PID output drives the governor actuator output (0–10 VDC or 4–20 mA), which controls the fuel valve actuator on the engine
   • The fuel valve adjusts fuel flow to maintain the set speed regardless of load changes
4. Voltage Control Loop (AVR):
   • The 3-phase voltage sensing circuit continuously measures the generator terminal voltage (L1, L2, L3) via the barrier interface
   • The microprocessor computes the RMS voltage and compares it to the user-defined voltage setpoint
   • The error signal is processed by a digital PID control algorithm with adjustable gain and bandwidth
   • The PID output drives a high-output PWM exciter field driver, which controls the DC current supplied to the brushless exciter field winding (up to 10 A DC per channel)
   • The exciter field current adjusts the exciter stator output, which controls the main generator field current via the rotating rectifier assembly
   • This closed-loop system maintains constant terminal voltage under all load conditions
5. Protection Logic:
   • The microprocessor continuously monitors speed, voltage, frequency, current, barrier status, and I/O states
   • If any parameter exceeds a configurable threshold (over-speed, under-speed, over-voltage, under-voltage, over-frequency, under-frequency, over-current, reverse power, short circuit, ground fault, engine crank timeout, over-temperature, low oil pressure, high exhaust temperature, barrier fault), the controller immediately reduces or cuts excitation and/or fuel
   • The emergency stop input takes immediate priority over all other functions, shutting down fuel and excitation within 10 ms
   • The barrier fault monitoring detects open-circuit, short-circuit, or degraded isolation on either barrier channel and triggers an alarm or shutdown
6. Parallel Operation (Droop Mode):
   • When multiple generators operate in parallel, each unit is set to the same droop percentage (typically 4% or 5%)
   • The droop characteristic causes each generator to share load proportionally to its capacity without a central load-sharing controller
   • The automatic paralleling function monitors voltage, frequency, and phase angle; when all synchronization conditions are met (voltage within ±5%, frequency within ±0.1 Hz, phase angle within ±10°), the controller sends a close command to the breaker
7. Data Logging and Communication:
   • The controller records operating parameters (speed, voltage, frequency, load, alarms, barrier status) at configurable intervals (1 second to 1 hour)
   • Event log stores the last 500 alarm events with timestamps (expandable to 5,000 with SD card) for root-cause analysis
   • Data is accessible via the LCD display, RS-485 Modbus RTU, CAN bus, EtherNet/IP, USB, or SD card

Advantages and Highlights

• Dual-channel IS barrier interface — two independent barrier channels for maximum redundancy; if one barrier fails, the other maintains safe operation
• High-output exciter driver (10 A DC per channel) — powers large brushless exciter field windings directly; eliminates external power amplifiers in hazardous areas
• Single-unit GAVR + protection integration — replaces governor, AVR, protection relay, and synchronizing relay in one compact unit; reduces panel space, wiring, and cost by up to 60%
• Digital precision — ±0.05% speed regulation and ±0.5% voltage regulation; superior to analog controllers (typically ±0.5% speed, ±3% voltage)
• Zero drift over time — microprocessor-based control eliminates component aging drift inherent in analog designs
• Self-powered operation — derives all operating power from generator terminals; no external power supply needed
• Wide engine compatibility — supports gas turbines, diesel engines, dual-fuel engines, and steam turbines from 100 kW to 10,000 kW
• Fast transient response — <50 ms speed recovery and <30 ms voltage recovery on 100% load steps
• Built-in Modbus RTU, CAN, and EtherNet/IP communication — seamless integration with SCADA, BMS, and remote monitoring systems
• 240 × 128 color LCD touchscreen — real-time visualization of all operating parameters, waveforms, and event logs without a laptop
• Comprehensive protection suite — adjustable over/under-speed, over/under-voltage, over/under-frequency, over-current, reverse power, short circuit, ground fault, engine crank timeout, over-temperature, low oil pressure, high exhaust temperature, barrier fault, and emergency stop
• Parallel operation ready — droop control and automatic paralleling enable stable load sharing without external load-sharing controllers
• Event logging (500 events) — stores alarm history with timestamps for preventive maintenance
• Password-protected configuration — three access levels (operator, technician, engineer) prevent unauthorized parameter changes
• Front-panel commissioning — all setpoints, gains, and protection thresholds adjustable via touchscreen keypad without a laptop
• PC-based configuration — Woodward TOOLBOX software enables full parameter tuning, data logging, and firmware updates via RS-485, CAN, Ethernet, or USB
• Long service life — MTBF >200,000 hours, no moving parts, no wear-out components
• Robust environmental rating — operates from -25°C to +70°C; IP65 front panel rated for outdoor and washdown installations
• ATEX Zone 1/2 and IECEx certified — approved for the most hazardous gas atmospheres including hydrogen and acetylene (T6 temperature class)
• SIL 2 capable — meets IEC 61508 functional safety requirements for safety instrumented systems
• Compact form factor — fits in tight spaces on DIN rails and in control cabinets despite the large display and dual-channel architecture

Applicable Industries

Installation Requirements

Usage Precautions

• Never connect the controller to a live generator without verifying all wiring against the wiring diagram — incorrect connections will destroy the controller and damage the generator
• Verify phase sequence before energizing the generator — reverse phase sequence will cause the governor to malfunction and may damage the engine fuel system
• Verify MPU polarity and signal level before startup — incorrect MPU wiring causes erratic speed control and overspeed conditions
• Do not exceed the rated exciter output current of 10 A DC per channel (20 A total) — overloading will destroy the PWM output driver
• Do not bypass the built-in surge protection devices on barrier channels — external transients from lightning or switching will damage internal circuitry and compromise intrinsic safety
• Allow 30 seconds warm-up time after initial power-on before expecting accurate speed or voltage regulation
• Do not adjust internal gain trimmers unless qualified — incorrect settings cause governor oscillation (hunting) or AVR instability
• Use shielded cable for all analog and digital I/O in electrically noisy environments (near VFDs, welders, or large motors) to prevent false readings
• Ensure proper ventilation — do not install in a sealed enclosure without airflow; overheating above 70°C causes thermal shutdown
• Perform annual inspection of all terminal connections for tightness, corrosion, and wire insulation integrity
• Do not operate the controller with the front cover removed — exposed terminals carry up to 300 VDC and 10 A
• When replacing the unit, match the model number exactly — 9905-972 is not interchangeable with 9905-971 without reconfiguration
• Log all fault events using the built-in event log or external SCADA for preventive maintenance
• Do not use the controller with generators exceeding 690 VAC line-to-line — this will destroy the voltage sensing input circuit
• For parallel operation, configure identical droop settings on all units — mismatched droop causes circulating currents, instability, and equipment damage
• Test the emergency stop input monthly — verify that E-stop shuts down fuel and excitation within 10 ms
• Do not connect the governor actuator output to a non-compatible fuel valve — verify actuator type (0–10 VDC or 4–20 mA) matches the valve specification
• Store spare units in a dry, temperature-controlled environment (0°C to 40°C, <70% RH) with anti-static packaging
• Update firmware via Woodward TOOLBOX software to the latest version for improved algorithms and bug fixes
• Do not modify the internal firmware — only Woodward-authorized personnel should perform firmware updates
• Protect the LCD display from direct sunlight and UV exposure — prolonged UV exposure degrades the display contrast over time
• Use the correct system voltage variant — 9905-972 is for 24 VDC systems only; do not connect to 12 VDC, 120 VAC, or 240 VAC systems
• Verify barrier compatibility before commissioning — ensure the connected IS barrier is rated for the same gas group (IIC) and temperature class (T6) as the controller
• Do not mix IS cables with non-IS cables in the same tray — this creates a risk of energy transfer to non-IS equipment and voids ATEX/IECEx certification
• Perform barrier isolation testing annually — verify isolation resistance exceeds 100 MΩ on each barrier channel
• Do not use the controller in explosive atmospheres without a certified IS barrier — the controller alone is not intrinsically safe; the barrier provides the safety function
• When using automatic paralleling, verify synchroscope input wiring — incorrect synchroscope wiring causes false synchronization and equipment damage
• Do not exceed the maximum cable capacitance of 200 nF per barrier channel — excessive capacitance degrades signal integrity and may cause instability
• Do not exceed the maximum cable inductance of 10 mH per barrier channel — excessive inductance limits signal bandwidth and may cause false readings

Software and Configuration Tools

Key Parameters Summary (Bold Reference)