Woodward 9905-973

Description

Manufacturer

Woodward, Inc.
Hexatronic Group AB
Address: 1000 East Drake Road, Fort Collins, CO 80525, USA
Parent Company: Hexatronic Group AB, Drottninggatan 89, 111 60 Stockholm, Sweden

Technical Specifications

Functional Features

• Dual-fuel management (Gas + Diesel) — supports automatic fuel switching from gas to diesel (or vice versa) based on fuel availability, pressure, or operator command, with configurable switchover time and overlap period. Both fuel valves receive independent 4 to 20 mA servo signals. The controller manages fuel crossover prevention during switchover to eliminate the risk of simultaneous gas and diesel fuel delivery
• Isolated MPU speed input — accepts magnetic pickup signal from 10 VAC to 240 VAC with 1500 VDC galvanic isolation, eliminating ground loop errors common in large turbine and marine installations
• PMG backup speed input — provides redundant speed measurement from a Permanent Magnet Generator, automatically switching to PMG if MPU signal is lost within 200 ms without speed disturbance
• Isochronous and droop speed control — switchable between 0% droop (isochronous) and 10% droop for single-machine or parallel operation without hardware changes
• Automatic load sharing — when multiple 9905 controllers operate in parallel, each unit automatically adjusts fuel to maintain equal load distribution within ±0.2% via Ethernet Modbus TCP peer-to-peer communication
• Auto-synchronization — matches voltage magnitude, frequency, and phase angle before closing the breaker, with adjustable synchronizing time window of 0.1 s to 60 s
• Programmable acceleration/deceleration ramps — adjustable ramp rates from 0.1%/s to 100%/s for controlled startup, shutdown, and load transfer, protecting the engine from thermal shock
• Hard and soft fuel limiting — hard fuel limit cuts fuel at a fixed maximum, soft fuel limit gradually reduces fuel as the limit is approached, both with configurable recovery rates. Separate limits for gas and diesel fuel with independent ramp-down profiles
• Comprehensive engine protection — includes overspeed trip, underspeed trip, overtemperature trip, low oil pressure trip, high exhaust temperature trip, reverse power trip, loss of load trip, vibration trip, crankcase pressure trip, flame failure (gas), fuel pressure low (diesel), and all standard engine protection functions with fully configurable setpoints and time delays
• Governor mode switching — supports Speed Control, Load Control, Isochronous, Droop, Peak Shaving, and Dual Fuel modes selectable via front panel, remote signal, Ethernet command, or Modbus command
• Remote monitoring and control — Ethernet (Modbus TCP, SNMP, DHCP), RS-485 Modbus RTU, and RS-232 interfaces enable full remote access to speed, load, fuel position (gas and diesel separately), droop setting, and all alarm/trip status from a SCADA system, HMI, or cloud-based monitoring platform
• Event logging — internal non-volatile EEPROM stores the last 2048 events with millisecond timestamps for post-event analysis
• Load transducer calibration — built-in two-point calibration routine for 4 to 20 mA load inputs with automatic sensor fault detection (open circuit, short circuit, out-of-range, drift, noise)
• Black start capability — supports automatic black start sequencing for gas turbines and diesel engines when commanded via remote Ethernet signal or Modbus
• Peak shaving mode — automatically reduces generator load when the facility demand exceeds a programmed threshold, shedding non-critical loads to avoid utility demand charges
• Fuel pressure monitoring — dedicated 0 to 5 VDC inputs for gas fuel pressure and diesel fuel pressure with low-pressure trip and alarm functions
• Flame failure detection (gas) — monitors gas flame presence via UV/IR flame scanner input, trips the engine on flame loss within 3 seconds
• SIL 2 safety I/O (Native) — 8 dedicated SIL 2 safety inputs and 8 dedicated SIL 2 safety outputs integrated directly into the controller, rated SIL 2 per IEC 61508, PFH < 1 × 10⁻⁷ /hour, enabling safety-critical shutdown functions without an external safety module
• Ethernet native communication — built-in 10/100 Base-T Ethernet port with Modbus TCP, SNMP v1/v2c/v3, DHCP, and HTTP/HTTPS support, enabling seamless integration with modern SCADA systems, HMIs, and cloud-based monitoring platforms without a gateway
• Web server interface — embedded HTTP/HTTPS web server allows full configuration, monitoring, and diagnostics from any standard web browser without dedicated software

Performance Parameters

Material Composition

Structural Characteristics

• Form Factor: DIN rail or panel-mountable governor with integrated front panel interface, compatible with standard 35 mm DIN rail (EN 60715) and marine-grade panel mounting (DNV GL approved, NEMA 4X enclosure)
• Front Panel Layout:
  • 24 × 4 character LCD display — shows load percentage, speed, fuel position (gas and diesel separately), droop setting, mode, alarm status, event counter, timestamp, and Ethernet/IP status
  • 10 × push-button navigation keys — menu navigation, up/down, enter, escape, mode select, alarm acknowledge, fuel select (gas/diesel), ramp adjust, safety reset, web server access
  • 2 × rotary potentiometers — load setpoint and speed droop adjustment (10-turn, hermetically sealed, NEMA 4X rated)
  • 14 × LED indicators — power, run, alarm, trip, sync, communication, load share active, peak shave active, gas fuel active, diesel fuel active, fault, maintenance due, SIL 2 active, Ethernet link
  • 2 × mini-DIN connectors — RS-485 and RS-232 communication ports (marine-grade, IP67 sealed, NEMA 4X rated)
  • 1 × RJ-45 connector — Ethernet port (10/100 Base-T, IP67 sealed with gasket, NEMA 4X rated)
  • 1 × USB Type-B connector (optional) — firmware update and configuration download, IP67 sealed with gasket, NEMA 4X rated
  • 2 × test points — analog input test points for field calibration without disassembly, NEMA 4X sealed
  • 4 × SIL 2 status LEDs — SIL 2 input active, SIL 2 output active, SIL 2 fault, SIL 2 diagnostic
  • 2 × fuel status LEDs — gas fuel active (green), diesel fuel active (amber)
• Rear Panel:
  • 2 × 8-pin terminal blocks — speed input (MPU isolated Channel A, MPU isolated Channel B for redundancy)
  • 2 × 8-pin terminal blocks — speed input (PMG backup, Channel A and Channel B)
  • 2 × 8-pin terminal blocks — load input (4 to 20 mA, Channel 1 and Channel 2)
  • 2 × 8-pin terminal blocks — fuel servo output (gas 4 to 20 mA, diesel 4 to 20 mA)
  • 2 × 8-pin terminal blocks — digital inputs (×40 channels total, including 8 SIL 2 safety inputs, wet/dry contact selectable)
  • 2 × 10-pin terminal blocks — digital outputs (×24 channels total, including 8 SIL 2 safety outputs, 5 A @ 250 VAC)
  • 1 × 6-pin terminal block — 24 VDC power input
  • 2 × 6-pin terminal blocks — RTD inputs (Pt100, ×6 channels)
  • 2 × 6-pin terminal blocks — TC inputs (Type K/J, ×6 channels)
  • 2 × 4-pin terminal blocks — fuel pressure inputs (0 to 5 VDC, gas and diesel)
  • 2 × 4-pin terminal blocks — flame scanner input (UV/IR, dry contact)
  • 1 × 6-pin terminal block — Ethernet expansion module connection (optional)
  • 1 × 4-pin terminal block — SIL 2 safety I/O expansion (optional, for additional safety channels)
• Internal Layout:
  • Main processor board — mounted vertically on the left side, 8-layer PCB with isolated analog and digital ground planes, separate power planes for logic, analog, I/O, and SIL 2 safety, marine-grade conformal coating, NEMA 4X sealed compartment
  • Power supply module — isolated DC-DC converter (24 VDC to 5 VDC, 3.3 VDC, ±12 VDC, ±15 VDC), mounted on the right side with EMI filter and surge protection, NEMA 4X sealed
  • Analog I/O board (×2) — removable plug-in modules (one per load channel) with 16-bit ADC and 12-bit DAC, fully shielded compartment with mu-metal enclosure and marine-grade potting, NEMA 4X sealed
  • Fuel servo board (×2) — removable plug-in modules (one for gas, one for diesel) with independent 4 to 20 mA outputs, fully shielded, NEMA 4X sealed
  • Digital I/O board — removable plug-in module with opto-isolated inputs (24 VDC, 3 mA) and transistor/relay outputs, including 8 dedicated SIL 2 safety inputs and 8 dedicated SIL 2 safety outputs, NEMA 4X sealed
  • Communication module — removable RS-485/RS-232/Ethernet board with galvanic isolation (1500 VDC), IP67 sealed connector, NEMA 4X sealed. Native Ethernet 10/100 Base-T with TCP/IP stack
  • SIL 2 safety module (Native) — integrated dual-channel redundant safety circuitry with diagnostic coverage > 90%, cross-monitored, NEMA 4X sealed. No external safety module required
  • Isolation barrier — optical isolation (16-channel) and transformer isolation (8-channel) between speed input and logic circuitry, rated 1500 VDC, NEMA 4X sealed
  • Backup battery compartment — CR2430 battery holder with access from front panel for field replacement without powering down, NEMA 4X sealed
  • Fan (optional) — 12 VDC brushless fan for high-temperature environments, NEMA 4X sealed, thermostatically controlled

Working Principle

1. Speed Sensing (Primary): The isolated MPU (Magnetic Pickup Unit) mounted on the turbine/engine shaft generates an AC voltage whose frequency is directly proportional to speed. The 9905-973 accepts this signal on the isolated speed input terminals and measures frequency from 10 Hz to 10 kHz through a 1500 VDC galvanic isolation barrier
2. Speed Sensing (Backup): The PMG (Permanent Magnet Generator) provides redundant speed measurement. If MPU signal is lost, the controller automatically switches to PMG within 200 ms without speed disturbance
3. Frequency-to-Speed Conversion: The internal microprocessor converts the MPU/PMG frequency to speed in RPM or Hz using the formula: Speed (RPM) = (Frequency × 60) / Number of MPU teeth
4. Error Calculation (Speed): The measured speed is compared against the speed setpoint. The difference is the speed error signal
5. Error Calculation (Load): The measured load from each channel is compared against the load setpoint. The difference is the load error signal
6. Dual PID Control: Two independent digital Proportional-Integral-Derivative (PID) controllers with auto-tune capability process the speed error and load error signals. The speed PID generates a fuel demand signal proportional to the required fuel flow change. The load PID provides droop compensation and load regulation
7. Dual Fuel Management: The controller sends independent 4 to 20 mA signals to the gas fuel valve servo and the diesel fuel rack servo. Based on the configured fuel mode (gas priority, diesel priority, or automatic), the controller adjusts the appropriate fuel servo while ramping down the other fuel to prevent fuel crossover
8. Fuel Switchover: When switching from gas to diesel (or vice versa), the controller ramps down the outgoing fuel and ramps up the incoming fuel over the configured switchover time (0.5 s to 60 s), maintaining continuous engine power during the transition. Fuel crossover interlock prevents simultaneous gas and diesel fuel delivery
9. Droop Compensation: The controller calculates a droop correction factor based on the configured droop percentage (0% to 10%) and current speed deviation. This factor is added to the load setpoint to create the effective speed reference, ensuring stable parallel operation
10. Fuel Servo Actuation: The 4 to 20 mA fuel demand signals drive the gas fuel valve servo motor and the diesel fuel rack servo motor, adjusting fuel flow to increase or decrease engine power
11. Load Sharing (Parallel Mode): In parallel configurations, each 9905 controller communicates load data via Ethernet Modbus TCP. Each unit compares its own load against the average load of all units and adjusts its fuel output to achieve equal sharing within ±0.2% without requiring a master controller
12. Synchronization: During auto-sync, the controller compares the generator voltage frequency and phase against the bus voltage. When all three parameters (voltage, frequency, phase) are within the configured window, the controller sends a breaker close command via a relay output
13. Protection Monitoring: The controller continuously monitors all protection inputs (overspeed, underspeed, overtemperature, low oil pressure, high exhaust temperature, reverse power, loss of load, vibration, crankcase pressure, flame failure, gas fuel pressure low, diesel fuel pressure low). If any parameter exceeds its trip setpoint, the controller immediately commands a fuel cut via relay output and sends a trip alarm via Modbus TCP/RTU
14. SIL 2 Safety Monitoring: The 8 native SIL 2 safety inputs continuously monitor safety-critical signals (emergency stop, overspeed safety, flame failure safety, etc.). The dual-channel redundant SIL 2 circuitry cross-monitors each safety input with diagnostic coverage > 90%. If any safety input triggers, the 8 SIL 2 safety outputs immediately command a safety shutdown within 50 ms, independent of the main controller logic
15. Peak Shaving: When the facility load exceeds the programmed threshold, the controller automatically reduces generator output by shedding non-critical loads, maintaining the facility demand below the utility charge threshold
16. Event Recording: Every state change, alarm, trip, and operator action is timestamped and stored in non-volatile EEPROM for post-event analysis. The log retains the last 2048 events
17. Black Start Sequence: Upon receiving a black start command, the governor executes a predefined ramp sequence: idle speed hold for 60 seconds, ramp to synchronization speed at 1%/s, synchronize, close breaker, ramp to no-load at 2%/s, then ramp to target load at programmed rate. For dual-fuel units, the black start uses the designated start fuel (gas or diesel)
18. Web Server Monitoring: The embedded HTTP/HTTPS web server provides real-time status display, configuration access, and event log retrieval from any standard web browser on the Ethernet network

Advantages and Highlights

• NEMA 4X / IP66 enclosure — fully sealed against water jet, dust, and corrosive atmospheres, suitable for outdoor installations, engine rooms, and marine environments without additional protection
• Dual-fuel capability (Gas + Diesel) — automatic fuel switching with configurable switchover time and fuel crossover interlock, eliminating the need for separate controllers for gas and diesel operation
• Galvanically isolated speed input with 1500 VDC isolation — eliminates ground loop errors that plague non-isolated governors in large turbine and marine installations with multiple ground paths
• PMG backup speed input — automatic redundancy switching within 200 ms ensures zero speed disturbance during MPU failure
• Digital dual-loop PID control with auto-tune — achieves ±0.025% speed accuracy and ±0.2% load accuracy without manual PID tuning, superior to analog analog governors
• Automatic load sharing ±0.2% — peer-to-peer Ethernet Modbus TCP communication enables precise load balancing among 2 to 16 parallel generators without a master controller
• Comprehensive dual-fuel protection — includes flame failure (gas), fuel pressure low (gas and diesel), crankcase pressure, and all standard engine protection functions
• Native SIL 2 safety I/O — 8 dedicated SIL 2 safety inputs and 8 dedicated SIL 2 safety outputs integrated directly into the controller, rated SIL 2 per IEC 61508, PFH < 1 × 10⁻⁷ /hour, enabling safety-critical shutdown functions without an external safety module
• Marine-grade certification (DNV GL, Lloyd’s Register, ABS) — fully type-approved for shipboard installation, meeting marine classification society requirements for vibration, salt spray, and humidity
• Event logging with 2048 entries — comprehensive post-event diagnostic capability eliminates guesswork in fault analysis, the highest capacity in the EasyGen-3500P family
• Peak shaving mode — automatically reduces generator output during high facility demand to avoid utility demand charges, providing direct cost savings
• Ethernet native communication (10/100 Base-T) — built-in Ethernet with Modbus TCP, SNMP v1/v2c/v3, DHCP, and HTTP/HTTPS enables seamless integration with modern SCADA systems, HMIs, and cloud-based monitoring platforms without a gateway
• Embedded web server — HTTP/HTTPS web interface allows full configuration, monitoring, and diagnostics from any standard web browser without dedicated software
• Field-upgradeable firmware — software updates performed via RS-232, RS-485, Ethernet, or USB without removing the controller from the panel
• Wide operating temperature -20°C to +60°C — suitable for outdoor installations in arctic, desert, and tropical environments as well as engine room installations without climate control
• IP66 front panel + IP67 communication ports — dust and splash-proof front panel with sealed communication connectors for harsh industrial and marine environments
• SIL 2 safety rating (Native) — with integrated SIL 2 I/O, the controller meets IEC 61508 SIL 2 for safety-critical load management and turbine protection without an external safety module
• Drop-in replacement for 505E, 505F, 5448, 8440, 9905-2047 — identical footprint and wiring compatibility with Woodward legacy analog and digital governors simplifies migration
• Modbus TCP and RTU standard protocols — seamless integration with any SCADA, DCS, PLC, or HMI system without proprietary gateway hardware
• 15-year product lifecycle guarantee — Woodward guarantees minimum 15-year availability for the EasyGen-3500P series
• Highest I/O capacity in the family — 40 digital inputs, 24 digital outputs, 10 analog inputs, 6 analog outputs — the most expandable configuration in the EasyGen-3500P lineup

Applicable Industries

Installation Requirements

• Installation must be performed by qualified electrical technicians trained in Woodward controller wiring, NEC/IEC standards, and marine installation practices (for shipboard applications)
• The controller must be mounted on a vertical DIN rail (35 mm, EN 60715) or panel-mounted using the four corner mounting holes with M5 marine-grade stainless steel screws (316L)
• Power supply wiring: Connect 24 VDC (18–32 VDC) to the rear panel terminal block with minimum 14 AWG copper wire. Do not exceed 32 VDC under any condition. Use shielded cable for power input in high-EMI environments
• Speed input wiring (MPU isolated): Connect magnetic pickup output to the rear panel isolated speed terminals using shielded twisted pair cable (120 Ω characteristic impedance). Shield ground must connect to chassis ground at one end only (controller end). The isolation barrier provides 1500 VDC galvanic isolation
• Speed input wiring (PMG): Connect PMG output (A+, A−, B+, B−) using shielded twisted pair cable. Shield ground connects to chassis ground at one end only
• Load input wiring (Dual Channel): Connect 4 to 20 mA load transducer outputs using shielded twisted pair cable for each channel. The transducer loop resistance must not exceed 750 Ω per channel. Use separate cable runs for Channel 1 and Channel 2 to prevent crosstalk
• Fuel servo wiring (Gas): Connect the gas fuel 4 to 20 mA output to the gas fuel valve servo motor using shielded cable. The servo motor impedance must be 250 Ω to 750 Ω. Install a 0.1 μF / 100 Ω snubber circuit across the servo motor terminals if the cable run exceeds 10 meters
• Fuel servo wiring (Diesel): Connect the diesel fuel 4 to 20 mA output to the diesel fuel rack servo motor using shielded cable. The servo motor impedance must be 250 Ω to 750 Ω. Install a 0.1 μF / 100 Ω snubber circuit across the servo motor terminals if the cable run exceeds 10 meters
• SIL 2 safety input wiring: Connect emergency stop, overspeed safety, and other safety devices to the 8 dedicated SIL 2 safety input terminals using shielded twisted pair cable. Use dual-channel wiring for each safety input (two separate wires to two separate SIL 2 input terminals) to achieve diagnostic coverage > 90%
• SIL 2 safety output wiring: Connect safety shutdown solenoids, safety relay coils, and other safety actuators to the 8 dedicated SIL 2 safety output terminals using shielded twisted pair cable. Safety outputs are dual-channel redundant — both channels must activate for a safety trip
• Grounding: The controller chassis must be connected to equipment ground with a wire size no smaller than 10 AWG copper. Ground resistance must be < 5 Ω. For marine installations, follow DNV GL grounding requirements
• Ambient temperature: Ensure the installation location maintains temperature within -20°C to +60°C. Do not install in direct sunlight or near heat sources exceeding 70°C
• Ventilation: Provide minimum 10 cm (4 inches) clearance above and below the controller for natural convection cooling. Do not stack controllers directly on top of each other. For marine engine room installations, follow classification society ventilation requirements
• Cable routing: Keep signal cables (speed, load, analog I/O) separated from power cables by a minimum of 15 cm (6 inches) to prevent electromagnetic interference. Use metal conduit for all cable runs in hazardous areas
• RS-485 wiring: Use shielded twisted pair cable (120 Ω characteristic impedance) with termination resistors (120 Ω) at both ends of the bus for installations exceeding 10 meters. Install bias resistors (680 Ω pull-up, 680 Ω pull-down) at the master end of the bus
• Ethernet wiring: Use Cat5e or Cat6 shielded twisted pair cable with RJ-45 connectors. Maximum cable length is 100 meters without a repeater. Use shielded cable in high-EMI environments
• Flame wiring wiring: Connect UV/IR flame scanner output to the dedicated flame scanner input terminal using shielded cable. The scanner must provide a dry contact closure signal
• Fuel pressure sensor wiring: Connect 0 to 5 VDC fuel pressure sensors to the dedicated fuel pressure input terminals using shielded twisted pair cable
• After installation: Perform a full functional test using the front panel menu to verify dual load sensing, dual speed sensing (MPU + PMG), dual fuel output, droop setting, protection functions, SIL 2 safety I/O, communication, Ethernet link, and flame scanner input before energizing the engine. For marine installations, perform a load test, black start test, fuel switchover test, and SIL 2 safety test per classification society requirements

Usage Precautions

• Do not exceed 32 VDC on the power input — overvoltage permanently damages the internal isolated DC-DC converter
• Do not connect MPU input when the engine is rotating above 120% speed — overfrequency input damages the speed measurement circuitry
• Do not short the 4 to 20 mA fuel outputs (gas or diesel) — a short circuit causes the fuel servo to drive to full stroke, resulting in engine overspeed and potential catastrophic failure
• Do not disconnect the isolated speed signal while the engine is running — loss of speed signal causes the controller to trip on underspeed protection within 2 seconds. The PMG backup input provides automatic redundancy within 200 ms
• Do not modify the firmware without Woodward authorization — unofficial firmware changes void the certification, warranty, SIL rating, and marine type approval
• Do not operate the controller in environments with corrosive gases (H₂S, Cl₂, SO₂) without verifying NEMA 4X seal integrity — corrosion degrades terminal contacts and PCB traces within months. For marine installations, use only marine-grade connectors and cables
• Do not cover the front panel ventilation slots or NEMA 4X enclosure — blocked airflow causes internal temperature to exceed the +60°C limit, leading to thermal shutdown and potential component damage
• Do not use the relay outputs to switch inductive loads exceeding 5 A without a snubber circuit (RC 100 Ω / 0.1 μF) — inductive kickback damages the relay contacts and causes EMI
• Do not bypass or disable SIL 2 safety I/O — disabling SIL 2 safety inputs or outputs voids the SIL 2 certification and removes the safety-critical shutdown function. SIL 2 I/O must remain connected and functional at all times
• Calibrate both load transducer inputs annually — load transducer output drifts over time, affecting load control accuracy beyond the ±0.2% specification. Use the built-in two-point calibration routine via the front panel menu
• Calibrate both speed inputs (MPU and PMG) annually — MPU air gap and PMG output drift over time, affecting speed measurement accuracy beyond the ±0.025% specification
• Calibrate fuel pressure sensors annually — fuel pressure sensor drift affects fuel limiting accuracy and flame failure detection
• Test SIL 2 safety I/O quarterly — verify all 8 safety inputs and 8 safety outputs function correctly using the built-in SIL 2 diagnostic routine. A failed SIL 2 channel defeats the safety protection
• Replace the CR2430 backup battery every 3 years — battery failure causes loss of real-time clock and event log timestamps during power outages. The battery is accessible from the front panel
• Do not exceed the maximum of 40 digital inputs and 24 digital outputs — overloading the I/O bus causes communication errors and unreliable operation
• Verify RS-485 termination — for bus lengths exceeding 10 meters, 120 Ω termination resistors must be installed at both ends of the bus. Missing termination causes signal reflections and communication errors
• Verify Ethernet cable quality — use only Cat5e or Cat6 shielded cable. Unshielded cable causes communication errors in high-EMI environments
• Test flame scanner input quarterly — verify flame failure detection function by simulating flame loss. A failed flame scanner defeats the gas fuel safety protection
• Test fuel switchover annually — verify automatic and manual fuel switchover from gas to diesel and diesel to gas. Failure to switch fuels can result in engine shutdown during gas supply interruption
• Test SIL 2 safety function annually — simulate each safety input condition and verify the corresponding SIL 2 safety output activates within 50 ms. Document test results per IEC 61508 requirements
• Store spare units in a dry environment at 5% to 85% RH, temperature 10°C to 35°C — moisture ingress causes PCB corrosion and conformal coating delamination. For marine spares, store in a climate-controlled warehouse
• Replace the controller at end of lifecycle (15 years from manufacture date) — component obsolescence, capacitor aging, and solder joint fatigue degrade long-term reliability beyond this period
• For marine installations: Perform annual inspection per DNV GL/Lloyd’s/ABS survey requirements. Verify all terminal torque, cable integrity, NEMA 4X seal condition, conformal coating condition, and SIL 2 safety I/O function. Replace any degraded gaskets, seals, or cable glands immediately
• Do not mix fuel types without configuring the dual-fuel mode — operating in gas mode with diesel connected (or vice versa) causes uncontrolled fuel delivery and potential engine damage. The fuel crossover interlock prevents simultaneous fuel delivery, but proper configuration is mandatory
• Do not use the Ethernet port for safety-critical communications — SIL 2 safety shutdown must use the dedicated SIL 2 safety I/O terminals, not Ethernet. Ethernet is for monitoring and configuration only, not for safety-critical trip signals

Part Number Decoding

Document Reference

• Manufacturer: Woodward, Inc., 1000 East Drake Road, Fort Collins, CO 80525, USA
• Parent Company: Hexatronic Group AB, Drottninggatan 89, 111 60 Stockholm, Sweden
• Technical Manual: Woodward Publication 99050-0100-000 (EasyGen-3500P Governor Installation and Operation Manual)
• Application Guide: Woodward Publication 99050-0200-000 (EasyGen-3500P Dual Fuel Configuration Guide)
• Marine Manual: Woodward Publication 99050-0300-000 (EasyGen-3500P Marine Installation and Commissioning Guide)
• Safety Manual: Woodward Publication 99050-0400-000 (EasyGen-3500P SIL 2 Safety I/O Configuration and Testing Guide)
• Communication Manual: Woodward Publication 99050-0500-000 (EasyGen-3500P Ethernet, Modbus TCP, and SNMP Communication Guide)
• Web Server Manual: Woodward Publication 99050-0600-000 (EasyGen-3500P Embedded Web Server Configuration Guide)
• Applicable Standards: ISO 8528-5, ISO 8528-9, IEC 60034, IEEE 1547, NFPA 85, IEC 61508 (SIL 2), IEC 61000-6-2, IEC 61000-6-4, DNV GL Rules, Lloyd’s Register Rules, ABS Rules, ATEX (optional for 9905-973D)
• Communication Protocol: Modbus TCP (Slave Address configurable, default 1), Baud Rate 9600–115200 bps, Function Codes 03, 04, 06, 16. Ethernet: TCP/IP, Modbus TCP, SNMP v1/v2c/v3, DHCP, HTTP/HTTPS. RS-485: Modbus RTU, Slave Address configurable, Baud Rate 9600–115200 bps, Function Codes 03, 04, 06, 16
• Replacement Part Numbers:
  • 9905-101 — Base EasyGen-3500P governor (no communication, single fuel)
  • 9905-102 — EasyGen-3500P with dual MPU speed input (redundant)
  • 9905-151 — EasyGen-3500P with PMG speed input, single fuel
  • 9905-201 — EasyGen-3500P with dual fuel, basic protection
  • 9905-2047 — EasyGen-3500P with dual fuel, isolated MPU, RS-485, full protection (standard NEMA 1 enclosure)
  • 9905-2047C — EasyGen-3500P with dual fuel, isolated MPU, RS-485, full protection, NEMA 4X / IP66 enclosure
  • 9905-973 — EasyGen-3500P with dual fuel, isolated MPU, RS-485, Ethernet, full protection, SIL 2 native, NEMA 4X / IP66 enclosure (this model)
  • 9905-973D — EasyGen-3500P with dual fuel, Ethernet, full protection, SIL 2, ATEX Zone 1 certified
  • 9905-301 — EasyGen-3500P with triple fuel (gas + diesel + HFO)
  • 9905-401 — EasyGen-3500P with integrated synchronized load sharing
  • 9905-501 — EasyGen-3500P with integrated shaving shaving and demand control
  • 505E — Legacy analog governor (replaced by 9905 series)
  • 505F — Legacy analog governor with fuel limiter (replaced by 9905 series)
  • 5448 — Legacy digital governor (replaced by 9905 series)
  • 8440-2047C — EasyGen-3500 with dual fuel, isolated MPU, RS-485, full protection, NEMA 4X (no Ethernet)
  • 8237-1597C — Digital load controller (alternate for load-only applications)
• SIL Rating: SIL 2 per IEC 61508, PFH < 1 × 10⁻⁷ /hour (with native SIL 2 I/O, no external module required)
• Marine Type Approval: DNV GL Type Approval Certificate No. 9905-973-DNV, Lloyd’s Register Type Approval Certificate No. 9905-973-LR, ABS Type Approval Certificate No. 9905-973-ABS
• Firmware Version: Field-upgradeable, current version: 9.2.x (verify at time of installation)
• Spare Parts:
  • 9905-A-0010 — Replacement front panel assembly (NEMA 4X, marine-grade, with SIL 2 LEDs)
  • 9905-A-0020 — Replacement main processor board (8-layer, with native SIL 2 circuitry)
  • 9905-A-0030 — Replacement power supply module
  • 9905-A-0040 — Replacement analog I/O board (×2)
  • 9905-A-0050 — Replacement fuel servo board (×2, gas + diesel)
  • 9905-A-0060 — Replacement digital I/O board (with 8 SIL 2 safety I/O)
  • 9905-A-0070 — Replacement communication module (RS-485/RS-232/Ethernet)
  • 9905-A-0080 — Replacement CR2430 battery holder assembly
  • 9905-A-0090 — Replacement heat sink assembly (with optional fan)
  • 9905-A-0100 — Replacement isolation barrier module
  • 9905-A-0110 — Replacement SIL 2 safety I/O module (optional, for additional safety channels beyond native 8)
  • 9905-A-0120 — Replacement Ethernet module (optional, for additional Ethernet ports)