RE: reliable CAN connection

There are systems that use dual CAN systems for fault redundancy.  The Space
Shuttle used 5 computers, 4 of one type and a 5th of a different and
programmed by a different group.  I believe each control surface etc. had 3
actuators and used a voting system to determine if one of the
cumputers/actuators/sensors would be disabled.

So needless to say fault tolerance can be built into anything and it all
comes with a cost.

Generally any system is only as strong as the weakest part and a CAN bus
failure could be a weak link.  But if the system is designed to be optimal
for price/size/functionality it's unlikely you'd have multiple sensors or
actuators to do the same thing.  

Let's look at a simple example.  A multi-panel solar panel with multiple
MPPT chargers and a dual axis servo motor system that tracks the sun.  If
the CAN bus connecting it all fails then the system fails since the goal of
such a system is to optimize each charger on a solar panel to operate in
its' MPPT point for a given output voltage.

If there is a master controller and each MPPT charger was Ethernet Enabled
you could use a hub or switch and run a star network from the controller to
all the MPPT chargers.  Now the weak link is the hub and a single failure
there also takes down the system.  Or use an RS485 system with a repeater in
each MPPT Charger so data goes in but is also sent out again with the second
driver.  Disconnecting the bad unit requires a small jumper module to
connect the now separated bus.  But wait, for CAN just unplug the bad MPPT
charger.  No plug needed.

Take it one step further with CAN and bring the CAN bus into the module with
a DPDT relay controlled by the module or by a star network f wires from the
master controller.  Now you can mechanically disconnect any module without
impacting the rest of the system.  

Each of those scenarios increases the price and complexity.  In the case of
solar farms that might be useful since losing one unit isn't a big deal.
But on a system that loses the end travel limit switch because the CAN bus
failed likely loses the ability to operate anyway.   That means the CAN bus
isn't the weak point.  The missing sensor would be.

So I think a generalization that CAN bus needs to be dual or more depends
totally on the application.  Where it's needed it's already done.  Notice
many of the embedded micro-processors have dual controllers.

John Dammeyer
Automation Artisans Inc.
http://www.autoartisans.com
Ph. 1 250 544 4950








> -----Original Message-----
> From: [email protected] [mailto:[email protected]] On
> Behalf Of Peter Lauer
> Sent: June-04-16 8:05 AM
> To: [email protected]
> Subject: [CANLIST] reliable CAN connection
> 
> 
> Hi,
> we recently reviewed a study that showed that the reliability of a system
> goes down when you use one CAN bus instead of discrete connections. lets
> say you have 3 actuators and 3 sensors on one bus, the bus goes down, you
> loose all actuators and all sensors.
> 
> instead of going back to all discrete wiring, what about staying with CAN
on
> the actuator and sensor side but have a separate CAN channel on the
> controller? Basically like the switch from BNC Ethernet to 10BaseT. Than
> only one channel can go down at a time, and you still have control over
the
> rest.
> 
> Peter--
> Archives and useful links: http://groups.yahoo.com/group/CANbus
> Subscribe and unsubscribe at www.vector.com/canlist/
> Report any problems to <[email protected]>

--
Archives and useful links: http://groups.yahoo.com/group/CANbus
Subscribe and unsubscribe at www.vector.com/canlist/
Report any problems to <[email protected]>