Hardware support for fault tolerance in triple redundant CAN controllers

There is a growing interest in using the controller area network (CAN) protocol for critical control applications. In many studies considering this possibility, it is assumed that CAN controllers, which are the circuits that implement most of the protocol specification, never present faults. Our work permits us to substantiate this assumption by proposing a fault-tolerant CAN controller subsystem, which is made-up from three standard CAN controllers and a specifically designed circuit that manages the introduced redundancy. This circuit has been designed to adapt to the specific characteristics of the CAN protocol. This paper is focused on the presentation of the general criteria that have been followed in the design of the circuit. It is to be noted that our approach is perfectly compatible with other fault tolerance mechanisms that could be applied to other parts of the system.