Efficient fault detection and isolation
One of the most interesting features of the CAN protocol is its exceptional ability to detect transmission faults. This enables the protocol to meet the extremely high standards required of Electronic Control Units in vehicles. This high capability for error detection is achieved through a combination of different error detection methods. One of the most effective methods involves the transmitting node of a message monitoring the bus level to detect all known errors.
Based on defined format elements and the CRC segment, each receiving node then checks every message it receives. In this way, errors can be detected whilst they are still confined to the local network. In addition to detecting transmission errors, the CAN protocol also includes a mechanism for detecting and isolating faulty nodes. This prevents faulty nodes from continuously disrupting message traffic on the bus.
Each receiving node then checks every message it receives against predefined format elements and the CRC segment. In this way, errors can be detected whilst they are still confined to the local network. In addition to detecting transmission errors, the CAN protocol also includes a mechanism for detecting and isolating faulty nodes. This prevents faulty nodes from continuously disrupting message traffic on the bus.
Error signalling instead of an acknowledgement
Unlike bus systems with node-oriented transmission, the message-oriented CAN system uses the principle of error signalling. Each node checks every message sent via the bus for errors. As soon as a transmitting or receiving node detects an error, a signal is sent to all other nodes by transmitting an error message (error frame). This generally consists of a dominant bit sequence; a combination of 6 bits of the same polarity. All nodes detect the error signal and discard the message they had already (partially) received. This ensures data consistency for all nodes within the network. As soon as a transmission node has sent or received an error frame, an immediate retry is made to send the previously transmitted message using the familiar bus arbitration process. The mechanism for detecting errors in a timely manner ensures that message transmission for all nodes in the network is error-free and consistent. Because the error signal is issued immediately after an error is detected, extremely short error recovery times are possible. The fact that the bus is only subjected to additional load when an error is detected results in a significantly lower additional bus load.
Reliability of CAN
Error frames prevent a situation where some nodes accept a message whilst others do not: either all nodes accept it, or none do. This error handling in CAN has one key objective: to prevent a node from accepting an incorrect message as correct. The probability of this occurring is defined as follows in CAN:
To illustrate with an example: suppose we are examining a CAN network that communicates at 500 kbit/s with full bus load for 8 hours a day, 365 days a year. If an error rate of one bit error per 700 msec occurs, this will result in one undetected error once every 1,000 years (!).
Error counters
Error handling therefore largely takes place between the CAN controllers themselves. To keep the host systems informed of this, so-called error counters have been implemented: a transmission and a reception error counter.
Transmission error counter
Whenever an error occurs whilst sending a message, this counter is incremented. If a message is sent successfully and the counter is not zero, it is decremented. As soon as the counter exceeds the value 96, the CAN controller issues an interrupt and an error flag to the host. If the counter exceeds the value 127, the CAN controller sends a so-called ‘Error Passive’ message to inform other CAN controllers.
As soon as the counter reaches its maximum value (255), the CAN controller automatically disconnects from the bus. The CAN controller must then be brought back online via a so-called software (soft) reset. After 128 × 11 bits, the CAN controller will reconnect to the bus.
Receive error counter
The receive error counter works in the same way as the transmit counter, but for received messages. Due to technical limitations, the maximum value of the receive counter is limited to the Error Passive Level (127).
Incidentally, CAN uses a complex algorithm for incrementing and decrementing fault counters by values greater than one. Apart from the above algorithm and the Bus OFF status, the fault counters have no direct influence on the operation of the CAN controllers. It is up to the underlying software to take action based on the fault counter values.
