RE: Guaranteed Valid Messages

If your definition of "NEVER" equals "pretty improbable", then yes: for a
well-designed node it should not happen.

 

However, you should take the law of truly large numbers into account (with a
large enough number of opportunities, any outrageous thing is likely to
happen). As far as I have understood it, the CRC in CAN should detect all
two bit errors, so messages with more than two bit errors -however unlikely
they may be-might just fool the CRC. The good news is that (statistically)
for each really unlikely falsely passed message you should get loads of (far
less unlikely) properly detected malformed messages hammering your error
counters. For a good design: keep an eye on the error counters, and have
your node signal you (preferably not over CAN ;-) that something is amiss.

 

Secondly, if your nodes are using a dedicated CAN controller, there is
always the opportunity for data corruption to happen between your MCU and
the CAN controller that might go unnoticed (both on the sending and
receiving node). SPI does not have any error correction, so a bit flip
during an SPI transfer will result in your CAN controller happily wrapping a
valid CRC around (functionally) invalid content.

 

There are probably other failure modes that could lead to invalid data being
passed down the stack (or valid data never arriving), so your design should
never rely on the "infallibility" of CAN to pass an invalid message down to
your code, doubly so if that code is controlling some kind of machinery with
the potential to do (bodily) harm. Either the error is transient and your
code should be able to deal with it securely, or it is
systematic/reproducible and should be sniffed out and squashed during
testing and validation.

 

cheers,

Bram

From: [email protected]
[mailto:[email protected]] On Behalf Of Chuck
Hackett
Sent: dinsdag 5 mei 2015 4:20
To: [email protected]
Subject: [CANLIST] Guaranteed Valid Messages

 

Just to be sure my understanding is correct .

 

Assuming a CAN bus controller is correctly configured (e.g.: set to receive
ONLY valid messages as in my previous post), there is no way that an invalid
(i.e.: corrupt/damaged) message will be received . lost maybe, but NEVER
corrupt . regardless of bus disturbances, excessive length, too many loads,
etc.

 

If an invalid message is received it must have been invalid when it was
given to the sending CAN controller.

 

True?

 

Cheers,

 

Chuck Hackett

"Sometimes it is the people that no one imagines anything of who do the
things that no one can imagine ."

7.5" gauge Union Pacific Northern (4-8-4) 844
http://www.whitetrout.net/Chuck