Fault confinement mechanisms on CAN: analysis and improvements

The Controller Area Network (CAN) protocol possesses fault confinement mechanisms aimed at differentiating between short disturbances caused by electromagnetic interference (EMI) and permanent failures due to hardware dysfunctioning. In this paper, we derive a Markovian analysis of these mechanisms which enables one to assess the risk of reaching one of the two degraded modes-busoff and error-passive-defined by CAN. We identify several problems with the existing mechanisms, the major one being that the busoff state is reached too easily. In particular, it happens with bursts of EMI causing several consecutive transmission errors. We propose new mechanisms that address these drawbacks. The basic idea is to weigh the progression toward the degraded mode by the quantity of information given by the last transmission. In our experiments, these mechanisms proved to be effective: the hitting time of busoff for nonfaulty nodes increases hugely while faulty systems reach busoff in the same amount of time. In the last part of this paper, implementation issues are discussed and different techniques for tuning the parameters of the algorithm are provided, either off-line or at run-time.