CAN bus — frame format, arbitration, error handling — critical in aerospace

CAN = Controller Area Network. A robust, multi-master serial bus designed by Bosch (1986) for cars, now critical in aerospace, trains, medical, and industrial control. The genius of CAN is that many nodes share one pair of wires, decide who talks WITHOUT a master, and tolerate noisy environments — all in hardware.

[!intuition] The one-sentence soul of CAN

A polite committee of nodes shouting at once on a single wire. Whoever has the most urgent message (lowest ID) automatically wins the floor — and everyone else steps back without losing their message. No central referee needed.

WHY this matters in aerospace: wires are heavy and failure-prone. CAN lets dozens of sensors/actuators share two wires (CAN_H, CAN_L), self-prioritize life-critical messages (e.g. engine fire alarm beats cabin-light status), and detect + recover from bit errors automatically — exactly what a DO-178C / DO-254 certified system needs.

[!definition] Core vocabulary

• Dominant bit : logic 0 on the bus. If any node drives 0, the bus reads 0.
• Recessive bit : logic 1. The bus is 1 only if every node lets it float to 1.
• Wired-AND : the electrical rule — bus value = AND of all transmitted bits. This is the physical foundation of arbitration.
• Identifier (ID) : 11 bits (standard) or 29 bits (extended). Lower numeric ID = higher priority.
• Bit stuffing : after 5 identical consecutive bits, transmitter inserts 1 opposite bit, so receivers can resynchronize their clocks.

WHY dominant=0? Because in an AND, a single 0 forces the result to 0. The node sending 0 "wins" without even knowing it's competing. This is the trick that makes arbitration free.

[!intuition] Picture the wire as a giant AND gate

If three nodes simultaneously send bits $b_1, b_2, b_3$, the bus shows $\text{bus} = b_1 \wedge b_2 \wedge b_3.$ A node that sent recessive (1) but reads dominant (0) on the bus instantly knows: "someone with higher priority is talking — I'll back off." It stops, waits, and retransmits later automatically. Its message is never corrupted, just delayed.

Frame format — derived field by field (Standard Data Frame)

We build the frame by asking: what does a receiver need, in order?

HOW the ACK works (subtle!): the transmitter sends the ACK slot as recessive. Every receiver that passed the CRC check overwrites it with dominant. The transmitter then reads dominant → "at least one node heard me correctly." No individual acknowledgment, just a collective thumbs-up.

[!example] Arbitration: two nodes fight, nobody loses data

Node A wants to send ID 0b00010110000 (= 176). Node B wants to send ID 0b00010111000 (= 184).

Both start at SOF together. They transmit ID bits MSB→LSB. Watch bit by bit:

Why this step? At bit 3, A drives dominant (0), B drives recessive (1). Wired-AND → 0. B's transceiver compares "I sent 1 but bus is 0" → loses arbitration, becomes a receiver, retries later. A's transmission was never interrupted. Lower ID (176 < 184) = higher priority = wins. ✅

This is non-destructive bitwise arbitration — the defining feature of CAN.

Error handling — the five guardians

CAN runs 5 independent error checks in hardware:

1. Bit error — a transmitter reads back a bit different from what it sent (except in arbitration/ACK).
2. Stuff error — 6+ identical bits seen (bit-stuffing rule violated).
3. CRC error — computed CRC ≠ received CRC.
4. Form error — a fixed-format field (delimiter, EOF) has wrong bit value.
5. ACK error — transmitter sees no dominant ACK → nobody heard it.

When any node detects an error it sends an Error Frame (6 dominant bits = "active error flag"), which violates bit-stuffing on purpose so everyone notices and the frame is globally discarded + automatically retransmitted.

[!formula] Fault confinement — derived from counters

To stop a broken node from jamming the bus forever, each node keeps two counters:

• TEC = Transmit Error Counter
• REC = Receive Error Counter

Rules (the key numbers): $\text{Error-Active} : TEC \le 127 \text{ and } REC \le 127$ $\text{Error-Passive} : TEC > 127 \text{ or } REC > 127$ $\text{Bus-Off} : TEC > 255$

• On error: TEC += 8 (transmitter), REC += 1 (receiver).
• On success: counters decrement by 1.

WHY +8 / −1 asymmetry? A node causing errors (transmitter) is punished 8× faster than it heals, so a faulty transmitter quickly silences itself (Error-Passive → Bus-Off) while a node merely witnessing others' errors barely climbs. This is fault confinement: the bus protects itself by isolating the offender. Critical for aerospace — one bad LRU can't take down the network.

[!mistake] Steel-manned misconceptions

Mistake 1: "The highest ID number has highest priority." Why it feels right: "high number = high importance" matches everyday intuition. The fix: It's the opposite. Lower ID = higher priority, because dominant=0 wins the wired-AND, and a smaller binary number has more leading zeros (dominant bits). Assign your fire alarm ID 0x001, not 0x7FF.

Mistake 2: "Arbitration loss corrupts or drops the message." Why it feels right: In Ethernet/CSMA-CD a collision destroys both frames → retransmit both. The fix: CAN is non-destructive. The winner's frame is untouched; the loser simply waits and retries. Zero data lost.

Mistake 3: "Bus-Off means the node is dead permanently." Why it feels right: "off" sounds terminal. The fix: A Bus-Off node can recover after observing 128 occurrences of 11 consecutive recessive bits (bus idle), then rejoins with counters reset. Recovery is part of the spec.

Mistake 4: "More data bytes = higher priority because it's a bigger message." The fix: Priority depends ONLY on the ID field during arbitration; DLC/data come later and never affect who wins.

[!recall]- Feynman: explain to a 12-year-old

Imagine a classroom where everyone can talk on one microphone at once. There's a rule: if anyone presses the "0 button," the speaker says 0; only if everybody presses "1" does it say 1. Each kid has a secret number. They all start counting out their number digit by digit. The moment a kid sees the mic say 0 while they pressed 1, they politely shut up and wait — they know someone more important is talking. The kid with the smallest number always wins and finishes their sentence perfectly, nobody gets garbled. And if a kid keeps making mistakes, a scorekeeper counts his fouls; after too many he benches himself so he can't ruin the class.

[!mnemonic]

"Dominant Drives Down, Lowest ID Leads."

• Dominant = Down = 0 wins.
• Lowest = Leads (highest priority). Frame order: "Some Idiots Read Data, Check ACK End" → SOF, ID, RTR, DLC, Data, CRC, ACK, EOF.

Flashcards

Connections

• Wired-AND logic and Open-collector buses — the electrical basis of dominant/recessive.
• CSMA-CD (Ethernet) — contrast: destructive collision vs CAN's non-destructive arbitration.
• CRC cyclic redundancy check — used in the CAN error check.
• Bit stuffing and clock recovery — synchronization without a separate clock line.
• DO-178C / DO-254 aerospace certification — why deterministic fault confinement matters.
• Real-Time scheduling — CAN priority ≈ fixed-priority message scheduling (rate-monotonic on the wire).
• ARINC 825 — the aerospace profile built on top of CAN.

Concept Map

Hinglish (regional understanding)