A Communication Anomaly Detection and Self-Recovery Method in CANFD Single Transmission Mode

Abstract

This application relates to the technical field of bus communication technology, and in particular to a communication anomaly detection and self-recovery method in CANFD single-transmission mode. The method includes acquiring the buffer occupancy rate and error status of the CANFD controller's transmit FIFO; determining a communication anomaly state when the buffer occupancy rate reaches a preset full-load threshold for a preset time window, or when an ACK error is detected in the error status; switching the data transmission cycle from a preset communication cycle to a test cycle longer than the preset communication cycle, and sending test data frames to the CANFD bus according to the test cycle; and when a successful ACK response is detected for the test data frame, releasing the application layer protection lock and resuming writing service data to the transmit FIFO according to the preset communication cycle. This application can overcome cascading deadlocks caused by no response, perform cross-layer backpressure and frequency reduction detection, and achieve communication self-recovery.

Description

Technical Field

[0001] This application relates to the technical field of bus communication technology, and in particular to a communication anomaly detection and self-recovery method in CANFD single-transmission mode. Background Technology

[0002] With the increasing demands for data interaction bandwidth and communication determinism in aerospace electronic systems, CANFD bus technology, which features extended data frame length and higher transmission rates, is widely used. Due to the extremely stringent constraints on real-time performance and security in systems, network nodes are typically forced into a single-transmission mode to avoid uncontrollable bus occupancy time or duplicate data frames caused by automatic retransmission mechanisms. In this specific mode, the node's underlying hardware attempts only one unidirectional transmission when sending a message, and even without receiving an ACK signal from the bus, the automatic retransmission logic of the underlying hardware is strictly prohibited from being triggered, thus ensuring the absolute predictability of communication timing.

[0003] To address the issue of no response from the receiving node during communication, Chinese invention patent application publication number CN103163863A discloses a CAN information transmission control method and system. This technical solution sets a first time threshold and a second time threshold to handle abnormal boundaries where the receiving controller does not respond. When the first controller sends a message and starts a first timer, if no controller is detected to receive the message, the system will continuously force a retransmission of the message for the period before the first time threshold is reached. Once the first timer reaches the set first time threshold, the controller stops transmitting and simultaneously starts a second timer, during which other control nodes in the bus network are allowed to occupy the transmission channel. After the second timer reaches the set threshold, the original transmitting controller will attempt to retransmit the previous communication message.

[0004] However, the aforementioned unidirectional delay control mechanism based on dual timers exposes its inherent blind spots in underlying logic when facing communication environments with stringent timing differences during node startup. When the host computer communication node completes initialization first and pushes service data onto the bus at a predetermined high-frequency cycle, while the onboard control equipment at the other end is still in operation due to a cumbersome loading process, the bus physical layer absolutely lacks an effective receiver capable of providing an ACK response signal. Under these conditions, the above scheme, limited by the pure time-dimensional intervention lacking cross-layer state awareness, only implements a physical-level unidirectional transmission blockade, without establishing any constraints or intervention mechanisms for the high-frequency data writing behavior of the upper-layer service process. Limited by this unidirectional underlying physical cutoff, the application-layer microprocessor continuously pushes new messages into the controller buffer queue in the blind spot without underlying feedback, causing the transmission FIFO to overflow in a very short time. This inevitably leads to a cascading deadlock caused by the superposition of underlying hardware resource suspension and upper-layer memory exhaustion. This deep communication deadlock phenomenon completely exceeds the technical scope of intervention and recovery by conventional state polling or timed restart mechanisms. Summary of the Invention

[0005] To overcome cascading deadlock caused by no response, perform cross-layer backpressure and down-frequency detection, and achieve communication self-recovery, this application provides a communication anomaly detection and self-recovery method in CANFD single-transmission mode.

[0006] This application provides a communication anomaly detection and self-recovery method in CANFD single-transmission mode, which adopts the following technical solution: A communication anomaly detection and self-recovery method in CANFD single-transmission mode, characterized in that a controller is included, and the method comprises: Obtain the buffer occupancy rate and error status of the transmit FIFO of the CANFD controller; When the cache occupancy rate reaches a preset full load threshold and continues for a preset time window, or when the error status indicator shows an ACK error, it is determined that the communication is in an abnormal state. In the abnormal communication state, an application layer protection lock is set to block the writing of service data to the transmission FIFO, and an index mask is written to the transmission cancellation request register of the CANFD controller to terminate the transmission request corresponding to the index mask. The data transmission period is switched from the preset communication period to a test period that is longer than the preset communication period, and test data frames are sent to the CANFD bus according to the test period. When the test data frame is detected to have successfully received an ACK response, the application layer protection lock is released, and the service data is resumed to be written to the sending FIFO according to the preset communication cycle.

[0007] Optionally, before obtaining the buffer occupancy rate and error status of the transmit FIFO of the CANFD controller, the method further includes: An application-layer microprocessor is provided to connect to the CANFD controller, and a global identification variable and a continuous error counter are allocated in the application-layer microprocessor; The global identifier variable is reset to carry the application layer protection lock, and the continuous error counter is cleared to establish a count value benchmark for determining the occurrence of the ACK error; The single-transmission mode is locked by setting the disable auto-retransmission flag in the underlying register of the CANFD controller, and the transmission completion hardware interrupt and transmission error interrupt are enabled to trigger the application layer microprocessor to obtain the error status.

[0008] Optionally, the application layer microprocessor acquires the error status, including: In response to the transmission error interruption, the underlying protocol status register of the CANFD controller is read; When the underlying protocol status register indicates a single-frame ACK error, the continuous error counter is controlled to increment based on the count value reference, and the corresponding interrupt flag is cleared. When the count value of the continuous error counter reaches the preset error threshold, the error status indication indicates that the ACK error has occurred.

[0009] Optionally, the determination of entering a communication abnormal state includes: The application layer microprocessor is controlled to poll and obtain the cache occupancy rate according to a preset scheduling cycle; When the duration for which the cache occupancy rate reaches the preset full load threshold covers multiple preset scheduling cycles to form the preset time window, or when the count value of the continuous error counter reaches the preset error threshold, the application layer microprocessor is switched to the communication abnormal state, and the continuous error counter is reset to the count value baseline.

[0010] Optionally, setting an application-layer protection lock to block the writing of service data to the sending FIFO includes: The application layer microprocessor is controlled to invoke atomic operations to set the global identifier variable. In response to the global identifier variable being set, the service data packet process running on the application layer microprocessor is suspended to cut off the inbound flow of the service data to the sending FIFO.

[0011] Optionally, writing an index mask to the transmit cancellation request register of the CANFD controller to abort the transmit request corresponding to the index mask includes: When the global identifier variable is in the set state, extract the hardware index value of the buffer in the pending state in the transmit FIFO; The index mask generated based on the hardware index value is written into the send cancellation request register to abort the send request and release the memory space occupied by the buffer.

[0012] Optionally, the step of switching the data transmission period from a preset communication period to a test period longer than the preset communication period, and sending test data frames to the CANFD bus according to the test period, includes: After releasing the memory space occupied by the buffer, construct the test data frame containing the pre-allocated network management identifier and the status heartbeat payload; The test data frame is pushed into the buffer of the transmit FIFO according to the test cycle to trigger a single transmit request to probe the physical channel connectivity of the bus.

[0013] Optionally, the step of pushing the test data frame into the buffer of the transmission FIFO according to the test period includes: Obtain a preset frequency reduction factor, which is used to limit the bus load rate generated by sending the test data frame to be lower than a preset safe load threshold; The test period is derived by multiplying the preset communication period by the preset frequency reduction factor, and the packet sending scheduler of the application layer microprocessor is overwritten using the test period. The packet sending scheduling timer is controlled to perform the operation of pushing the test data frame into the buffer according to the test cycle.

[0014] Optionally, when the test data frame is detected to have successfully received an ACK response, the application layer protection lock is released, and the writing of the service data to the sending FIFO is resumed according to the preset communication cycle, including: When the first test data frame receives the ACK response, the packet sending scheduler is overwritten using the preset communication period, and the packet sending scheduler is controlled to continuously push a preset number of test data frames into the buffer according to the preset communication period. If the preset number of test data frames all receive the ACK response consecutively, the application layer protection lock is released to resume writing the service data; If any of the test data frames does not receive the ACK response, the packet sending scheduler is overwritten using the test cycle to roll back the operation of pushing the test data frame according to the test cycle.

[0015] Optionally, releasing the application-layer protection lock to restore the writing of the business data includes: The system responds to the ACK response received by the preset number of test data frames, triggering a hardware interrupt for transmission completion, and controls the application layer microprocessor to run an interrupt service routine. The global identifier variable is reset by invoking an atomic operation using the interrupt service routine, thereby releasing the application-layer protection lock; The suspended service data packet process is woken up based on the reset global identifier variable to resume writing service data to the send FIFO.

[0016] In summary, this application includes the following beneficial technical effects: 1. By simultaneously monitoring two conditions—the transmission FIFO buffer occupancy rate reaching a preset full load threshold and lasting for a preset time window, and the error status indicator showing an ACK error—communication anomalies are determined. In this anomaly state, an application-layer protection lock is set to block the writing of service data, and the suspended transmission requests are terminated by sending a cancellation request register. This immediately blocks continuous writing behavior at the application layer and clears the accumulated invalid transmission requests, thereby breaking the cascading deadlock caused by the superposition of upper-layer buffer overflow and lower-layer hardware suspension due to the lack of an acknowledgment node in the single transmission mode. This achieves accurate detection of communication anomalies and protection of system resources.

[0017] 2. An index mask is generated based on the hardware index value of the pending buffer in the transmit FIFO and written to the transmit cancellation request register to abort the corresponding transmit request. In conjunction with switching the data transmission period from the preset communication period to a test period longer than that period for frequency reduction detection, the bus load rate is limited to the preset safe load threshold during the abnormal period and the hardware space occupied by invalid transmit requests is released. Under the premise of ensuring that the fairness of bus arbitration is not affected, the continuous detection of channel connectivity is maintained, and the bus utilization and detection efficiency under abnormal conditions are improved.

[0018] 3. After successfully receiving an ACK response for the first test data frame, the sending cycle is restored to the preset communication cycle, and a preset number of test data frames are continuously sent for verification. The application layer protection lock is released only when responses are received consecutively; otherwise, the frequency reduction detection cycle is returned. This closed-loop verification process effectively eliminates misjudgments in single response recovery caused by bus transient interference. Service data writing is only resumed after confirming that the peer node is stably online, thereby improving the stability and reliability of the communication self-recovery process. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the system hardware and cross-layer communication architecture of an embodiment of this application; Figure 2 This is a comparison diagram of the cascade deadlock generation and cross-layer collapse mechanisms in embodiments of this application; Figure 3This is the core communication state machine transition diagram of an embodiment of this application; Figure 4 This is a timing diagram of two-factor anomaly detection in an embodiment of this application; Figure 5 This is a trend chart of channel detection down-frequency and bus load rate in an embodiment of this application. Detailed Implementation

[0020] The following combination Figures 1-5 This application will be described in further detail.

[0021] This application discloses a communication anomaly detection and self-recovery method in CANFD single-transmission mode. It is applied to a CANFD controller connected to the CANFD bus and configured in single-transmission mode, with the execution entity being an application-layer microprocessor communicatively connected to the CANFD controller. This method identifies communication anomalies by jointly determining the transmission FIFO buffer status and ACK error status. It dismantles cascading deadlocks through the coordinated operation of application-layer protection lock blocking and underlying hardware transmission termination. It achieves communication self-recovery without manual intervention through frequency reduction channel detection and closed-loop wake-up. This method is fully adaptable to CANFD bus applications with stringent requirements for communication determinism and reliability, such as aerospace and automotive control.

[0022] In this embodiment, CANFD stands for Controller Area Network Flexible Data Rate, ACK stands for Acknowledgment Signal, and FIFO stands for First-In-First-Out Queue; these abbreviations are used throughout the description. The following detailed description, in conjunction with embodiments, further illustrates the invention. These embodiments are for illustrative purposes only and are not intended to limit the scope of protection of the invention. Example 1

[0023] This embodiment is based on a dual-node CANFD communication system, which includes a product-side communication node and an ACK response node. Both types of nodes are connected to the CANFD bus through their respective CANFD controllers. The product-side communication node carries an application-layer microprocessor and a CANFD controller that are interconnected. The CANFD controller is pre-configured for single-transmission mode and serves as the execution carrier for this method.

[0024] like Figure 1As shown in the diagram, this system hardware and cross-layer communication architecture include an application-layer microprocessor and a CANFD controller physically and communicatively connected via an internal bus. The application-layer microprocessor's memory space is configured with a continuous error counter, a global identifier variable for carrying application-layer protection locks, and a packet scheduling timer. The CANFD controller has a protocol status register, a transmit cancellation request register, and a transmit FIFO at its bottom. The CANFD controller externally connects to the CANFD bus to establish a channel connection with the peer node. Under normal operating conditions, the application-layer microprocessor pushes service data frames into the transmit FIFO through the bus interface and reads the status register of the underlying controller in real time to achieve synchronous acquisition of cross-layer hardware status.

[0025] S1 System Initialization Configuration After the application layer microprocessor completes its power-on startup, it first performs the initialization configuration of the CANFD controller and the system's global operating parameters. The application layer microprocessor allocates a global identifier variable and a continuous error counter in the memory space, resets the global identifier variable to support subsequent application layer protection lock functions, and clears the continuous error counter to establish the count value benchmark for ACK error judgment.

[0026] Next, the application layer microprocessor accesses the underlying registers of the CANFD controller through the internal bus, configures the arbitration segment communication rate and data segment communication rate of the CANFD controller in sequence, initializes the transmit FIFO and receive buffer, sets the disable automatic retransmission flag in the underlying register, and simultaneously disables the auxiliary configuration bits related to automatic retransmission of the CANFD controller, ensuring that the controller only performs one transmission attempt when no ACK is received during data frame transmission, without triggering any form of hardware retransmission action, thereby locking the single transmission mode.

[0027] Reconfigure and enable the CANFD controller's transmit completion hardware interrupt and transmission error interrupt, setting their interrupt priorities to be higher than the task scheduling priority of the application layer service data packet process. This ensures timely responses to interrupt events and completes the mapping and binding of interrupt vectors to their corresponding interrupt service routines. After completing all configurations, the application layer microprocessor enables the CANFD controller's transmit function, putting the system into normal communication operation.

[0028] S2 Normal Communication Operation and Status Parameter Acquisition After the system enters normal communication operation, the application layer microprocessor writes service data frames to the CANFD controller's transmit FIFO according to a preset communication cycle. The CANFD controller then automatically transmits the data frames on the bus according to a first-in-first-out (FIFO) rule. The application layer microprocessor polls the transmit FIFO's buffer occupancy rate according to a preset scheduling cycle, which is consistent with the preset communication cycle to ensure synchronization between buffer status monitoring and service data transmission. The buffer occupancy rate is calculated based on the address difference between the read and write pointers of the transmit FIFO. When an out-of-bounds read / write pointer address or a difference exceeding the FIFO's total depth is detected, a FIFO pointer anomaly is determined, and a hardware reset operation is performed to reset the read / write pointers to their initial addresses. While polling for the buffer occupancy rate, the application layer microprocessor simultaneously reads the CANFD controller's underlying error status register to monitor whether the controller has entered a bus-off state. Upon detecting a bus-off state, the application layer microprocessor first reads and clears the CANFD controller's hardware error counter, then performs an error status reset operation, while simultaneously counting the number of bus-off resets. When the number of resets reaches 5, automatic reset stops, and a system-level fault alarm is triggered.

[0029] During operation, the application layer microprocessor responds to transmission error interrupts triggered by the CANFD controller, reads the underlying protocol status register of the CANFD controller, and when the underlying protocol status register indicates a single-frame ACK error, controls the continuous error counter to increment and clears the corresponding interrupt flag. When the continuous error counter reaches a preset error threshold, it confirms that the current error state indicates a persistent ACK error. The preset error threshold is set to three times. Transient electromagnetic interference at the CANFD bus physical layer may cause single-frame ACK signal sampling failure. Three consecutive ACK errors can eliminate single-sampling anomalies caused by transient interference, accurately identify the persistent abnormal state of the bus without a valid acknowledgment node, and avoid interference with normal communication caused by single-error-triggered abnormal handling procedures. When the application layer microprocessor detects that three consecutive service data frames have successfully received ACK acknowledgments and triggered a transmission completion hardware interrupt, it resets the continuous error counter to its initial count value.

[0030] S3 Communication Anomaly Detection and State Switching The main loop task of the application layer microprocessor continuously performs communication anomaly detection. The polling of cache occupancy is performed by the idle task of the main loop, independent of the service routines for transmission error interrupts and transmission completion hardware interrupts, avoiding status read errors caused by nested interrupts. During polling, the application layer microprocessor continuously compares the cache occupancy with a preset full-load threshold, and calculates the duration for which the cache occupancy reaches the preset full-load threshold. The preset full-load threshold is the percentage of the number of used buffers in the transmit FIFO relative to the total buffer depth, ranging from 90% to 95%, preferably 95% in this embodiment. The transmit FIFO of the CANFD controller is a hardware circular buffer, with a fixed proportion of address space reserved at the end to prevent memory overflow when the read / write pointers roll back. This threshold accurately identifies the critical state of the buffer about to overflow, while avoiding uncontrollable anomalies caused by hardware address overflows. It is compatible with mainstream CANFD controller hardware designs such as the NXP S32K series FlexCAN module and the Infineon TC3xx series MCAN module.

[0031] When the duration for which the buffer occupancy rate reaches a preset full-load threshold covers multiple consecutive preset scheduling cycles to form a preset time window, or when the count value of the continuous error counter reaches a preset error threshold, the application layer microprocessor determines that the system has entered a communication abnormal state and resets the continuous error counter to its initial count value. In this embodiment, the preset time window is preferably 10 preset scheduling cycles. Under normal communication conditions, the buffer occupancy rate of the transmission FIFO will decrease synchronously with the completion of data frame transmission within a single communication cycle. If the buffer occupancy rate remains above the full-load threshold for 10 consecutive scheduling cycles, buffer accumulation caused by continuous transmission blocking can be accurately identified. Alternatively, when the count value of the continuous error counter reaches the preset error threshold, it can directly reflect the root cause of data frame transmission failure. The parallel and independent triggering of these two conditions can accurately distinguish between occasional interference, instantaneous traffic peaks, and core anomalies such as the lack of effective acknowledgment nodes on the bus, eliminating logical deadlocks caused by physical mutual exclusion from the root cause and ensuring the necessary triggering and accuracy of anomaly detection. In this embodiment, confirming the error state indication of an ACK error by the count value of the continuous error counter reaching the preset error threshold is the preferred implementation method.

[0032] Reference Figure 4The two-factor anomaly detection timing shown illustrates the synchronization logic between the application layer microprocessor and the MAC layer. The microprocessor sends data frames sequentially. Under the condition of continuous no ACK feedback from the CANFD bus physical layer, the MAC layer continuously triggers transmission error interrupts, driving the internal continuous error counter to increase in increments of 0-1-2-3. In the parallel timing dimension, the buffer occupancy rate of the transmission FIFO gradually increases as transmission stalls and penetrates the 95% full load threshold. When the cumulative value of the continuous error counter reaches the preset error threshold (3), or when the period of buffer occupancy rate remaining above the full load threshold completely covers the preset time window, the arrival of any single trigger edge will force the application layer's communication state machine to transition from the normal communication state to the abnormal state.

[0033] S4 Abnormal State Handling and Channel Connectivity Detection After the application-layer microprocessor determines that a communication anomaly has occurred, it first performs application-layer backpressure blocking and underlying hardware cleanup operations. The application-layer microprocessor calls an atomic operation to set the global flag variable. This atomic operation uses native atomic operation instructions provided by the real-time operating system. For processors without native atomic operation support, a task-disabling scheduling approach is used to ensure the indivisibility of the setting operation. Only application-layer task scheduling switching is disabled; global interrupts are not disabled to ensure that the CANFD controller's hardware interrupts can be responded to normally. In response to the global flag variable being set, the service data packet process is suspended, and the inbound flow of service data to the transmit FIFO is cut off, completing the setting of the application-layer protection lock. The application-layer protection lock only blocks write operations in the service data packet process and does not restrict write operations of test data frames to the transmit FIFO.

[0034] With the global flag variable set, the application layer microprocessor reads the buffer status register of the CANFD controller, distinguishes between buffers in the transmit FIFO that are in a suspended state and those in the transmit state, extracts only the hardware index values ​​of the buffers in the suspended state, writes the index mask generated based on the hardware index values ​​into the transmit cancellation request register of the CANFD controller, aborts the transmit request for the corresponding index mask, and releases the memory space occupied by the buffer. For buffers in the transmit state, it waits for the current transmit action to complete before performing the corresponding buffer release operation based on the transmit result. The index mask is generated by bit mapping according to the hardware index values ​​of the transmit FIFO buffers, with each hardware index value corresponding to an independent bit in the mask. The bit corresponding to the index value of the suspended buffer is set to 1, and the remaining bits are set to 0 to generate the final index mask.

[0035] Reference Figure 2This paper demonstrates the logic behind cascading deadlocks in the absence of valid ACK responses and the cross-layer collapse resolution principle provided in this application. In the prior art's pain point illustration, the application layer process continuously injects high-frequency service data frames (N, N+1, N+2), driving the transmit FIFO to quickly exceed the full load threshold (95%) and causing physical blocking. This, coupled with the transmit hangup state of the underlying CANFD controller, forms a cascading deadlock between upper and lower layers. In this embodiment, the application layer microprocessor sets the application layer protection lock to cut off the enqueue write flow of new service data frames to the transmit FIFO; in parallel, it writes an index mask instruction to the transmit cancellation request register of the CANFD controller, forcibly clearing the existing data frames in the transmit FIFO that are in a suspended state by the underlying hardware. Through the synchronized operation of upper-layer write blocking and lower-layer memory sweeping, the deadlock occupation of hardware resources and application layer cache is resolved.

[0036] By blocking the continuous writing of new data through application-layer protection locks, the re-accumulation of the transmission FIFO is avoided from the source. Combined with the underlying transmission cancellation operation to release the occupied hardware buffer, the risk of cascading deadlock caused by continuous writing at the application layer and suspension of transmission at the underlying layer is eliminated, freeing up complete hardware resources for subsequent channel probing.

[0037] After hardware cleanup, the application-layer microprocessor performs channel probe configuration, switching the data transmission period from the preset communication period to a test period longer than the preset communication period. It constructs test data frames containing a pre-allocated network management identifier and a status heartbeat payload, and sends these test data frames to the CANFD bus according to the test period to probe the connectivity of the bus's physical channel. The test data frames use the CANFD standard data frame format, with a data segment length set to 8 bytes. The status heartbeat payload includes the current node's operating status identifier and sequence number. The pre-allocated network management identifier uses a unique node probe ID assigned to each node in the bus system. Each node's test data frame identifier is unique, using the standard frame format, and the ID value is higher than that of the service data frame ID value, ensuring that the arbitration priority is lower than all service data frames.

[0038] The test period is obtained by multiplying the preset communication period by the preset frequency reduction factor. In this embodiment, the preset frequency reduction factor is set to 10. The bus load rate is calculated based on the ratio of the number of bits transmitted on the bus per unit time to the theoretical maximum number of bits transmitted on the bus. The preset frequency reduction factor is determined based on the preset communication period, the arbitration segment baud rate, and the test data frame length to ensure that the bus load rate generated by the test data frame is lower than the preset safe load threshold.

[0039] like Figure 5As shown, during the channel probing phase after entering an anomaly state, the packet scheduling frequency and bus load rate undergo a controlled nonlinear step change. In the normal communication state, the application layer executes high-density service packet sending according to the first preset communication cycle, and the system bus load rate fluctuates within the rated range of approximately 30%. After the system state machine enters the anomaly probing state, the microprocessor overwrites the packet scheduling timer using the second preset cycle (i.e., 10 times the preset communication cycle), forcibly compressing the injection frequency of test data frames. The probe message waveform on the physical bus channel subsequently becomes sparse, causing the CANFD bus load rate to plummet and remain at an extremely low safety level below 5%. This scheduling strategy, while maintaining online status probing of the peer node, releases the arbitration bandwidth of the physical bus.

[0040] Stable operation of the CANFD bus requires the bus load rate to be controlled within 30% to ensure real-time communication and fairness of bus arbitration. This frequency reduction factor can control the bus load rate generated by the test frame to within 10% of the normal business communication state, which is far below the bus safety load threshold. This avoids the test frame in abnormal state from occupying too much bus bandwidth, while ensuring that the detection frequency of the bus status meets the real-time requirements of system recovery.

[0041] Upon entering anomaly detection mode, the application layer microprocessor initiates a timeout period. If the accumulated runtime reaches the preset timeout duration without a successful ACK response for the test data frame, a system communication fault alarm is triggered, and the hardware reset procedure of the CANFD controller is executed. In this embodiment, the preset timeout duration is set to 1000 test cycles. Simultaneously with the controller hardware reset operation, the application layer microprocessor resets the global flag variable, clears the continuous error counter, switches the communication state machine to normal communication state, and re-executes the system initialization configuration procedure to ensure complete synchronization between the hardware state and the software state machine. The application layer microprocessor monitors the transmission results of the test data frame in real time through transmission completion hardware interrupts and transmission error interrupts. If the test data frame does not receive an ACK response, before the packet scheduling timer pushes the next test data frame, the hardware index value of the suspended test data frame is extracted and written to the transmission cancellation request register to release the corresponding buffer. The system maintains the anomaly detection mode and continues to send test data frames according to the test cycle. If the test data frame successfully receives an ACK response, a transmission completion hardware interrupt is triggered, and the communication recovery verification procedure begins.

[0042] S5 Communication Status Recovery and Abnormal Rollback Control During channel probing, the application layer microprocessor continuously monitors the transmission results of test data frames. When the first test data frame successfully receives an ACK response, the test cycle scheduling is immediately stopped. A preset communication cycle is used to overwrite the packet scheduling timer, controlling it to continuously push a preset number of test data frames into the transmission FIFO according to the preset communication cycle. This continuous transmission process must not be interrupted. During verification mode operation, the application layer protection lock remains in the set state, the service data packetization process is suspended, and only test data frames are allowed to be written to the transmission FIFO. In this embodiment, the preset number is set to 3 frames. Successful ACK responses for 3 consecutive test data frames eliminate the possibility of false positives due to transient bus interference, confirming the existence of a stable and valid acknowledgment node on the bus, and ensuring the stability of service data transmission after communication is restored.

[0043] If a preset number of test data frames receive ACK responses consecutively, the application layer microprocessor responds to the hardware interrupt indicating the completion of the transmission of the last test data frame, running the corresponding interrupt service routine. In the interrupt service routine, the completion status of the preset number of consecutive test data frames is first verified. After confirming that all ACK responses have been successfully received, an atomic operation is invoked to reset the global flag variable, release the application layer protection lock, and exit the interrupt service routine. Then, the suspended service data packet process is woken up, and the writing of service data to the transmission FIFO resumes according to the preset communication cycle. The atomic operation is implemented using native atomic operation instructions provided by the real-time operating system. For processors without native atomic operation support, a task-disabled scheduling method is used to ensure the indivisibility of the reset operation, only masking the application layer task switching, without disabling global interrupts.

[0044] If any test data frame fails to receive an ACK response during continuous transmission, the current continuous transmission action is immediately stopped. The hardware index value of the suspended test data frame is extracted and written to the transmission cancellation request register to release the corresponding buffer. The packet scheduling timer is overwritten using the test cycle, and the channel probe operation of pushing test data frames according to the test cycle is rolled back. The application layer microprocessor counts the number of consecutive verification failures. When the number of consecutive verification failures reaches 3, the test cycle is doubled. The maximum upper limit of the test cycle is 100 times the preset communication cycle. Once the maximum upper limit is reached, the test cycle will not be increased further. If no ACK response is detected after the cumulative test duration reaches the preset timeout period, a system-level fault alarm and hardware reset procedure are triggered. Example 2

[0045] This embodiment is implemented based on the underlying hardware characteristics of the CANFD controller and the state machine management mechanism of the real-time operating system. Addressing the cascading deadlock problem caused by delayed initialization or offline status of the peer node in CANFD single-transmission mode, which results in underlying hardware suspension and application-layer memory overflow, an interrupt-driven cross-layer collaborative self-recovery scheme is constructed. The execution entities in this embodiment are the application-layer microprocessor and the CANFD controller. The application-layer microprocessor runs a real-time operating system, executing the service data packet process, communication state machine, and interrupt service routine. The CANFD controller includes a transmit cancellation request register, a protocol status register, and a transmit FIFO, responsible for the transmission and reception of physical layer signaling. This embodiment is suitable for multi-node CANFD bus network scenarios.

[0046] S1MAC layer initialization and interrupt vector mapping After the application layer microprocessor completes its power-on startup, it first executes the low-level configuration of the CANFD controller's MAC layer and the initialization of the system state machine. The application layer microprocessor accesses the CANFD controller's low-level registers via the internal bus, sets the disable auto-retransmission flag, and simultaneously disables the CANFD controller's auxiliary configuration bits related to bus auto-retransmission. This ensures that when the controller does not receive an ACK response for a data frame transmission, it only performs one transmission attempt and does not trigger any form of hardware retransmission, thus locking the single-transmission mode and disabling the hardware auto-retransmission logic.

[0047] Then, configure and enable the CANFD controller's transmit completion hardware interrupt and transmission error interrupt, setting their interrupt priorities to be higher than the task scheduling priority of the application layer service data packet process. This ensures timely response to interrupt events and completes the mapping and binding of interrupt vectors to their corresponding interrupt service routines. In the real-time operating system's memory space, the application layer microprocessor initializes the communication state machine to normal communication mode, resets the global atomic variable application layer protection lock, and clears the continuous ACK error counter. After completing all configurations, the application layer microprocessor enables the CANFD controller's transmit function, allowing the system to enter normal communication operation.

[0048] S2 interrupt-driven state synchronization and service transmission Under normal communication conditions and with the application layer protection lock in a reset state, the application layer microprocessor pushes service data frames into the transmit FIFO according to a first preset cycle, and then the CANFD controller executes the bus transmission operation according to the first-in-first-out rule. When the CANFD controller fails to receive an ACK response for a data frame transmission, a transmission error interrupt is triggered. In the corresponding interrupt service routine, the application layer microprocessor reads the protocol status register, confirms that the register indicates an ACK error, controls the continuous ACK error counter to increment automatically, and clears the corresponding interrupt flag. The main loop task of the application layer microprocessor reads the current buffer occupancy rate of the transmit FIFO in real time according to a scheduling cycle consistent with the first preset cycle, completing the real-time synchronization between the underlying hardware state and the application layer state machine. The polling of the buffer occupancy rate is executed by the main loop idle task of the application layer microprocessor, which is independent of the service routines for transmission error interrupts and transmission completion hardware interrupts, avoiding status read errors caused by interrupt nesting.

[0049] The buffer occupancy rate is calculated based on the address difference between the read and write pointers of the transmitting FIFO. When an out-of-bounds read / write pointer address or a difference exceeding the total FIFO depth is detected, a FIFO pointer anomaly is determined, and a hardware reset operation is performed to reset the read / write pointers to their initial addresses. While polling for the buffer occupancy rate, the application layer microprocessor synchronously reads the underlying error status register of the CANFD controller to monitor whether the controller has entered a bus-off state. Upon detecting a bus-off state, it first reads and clears the CANFD controller's hardware error counter, then performs an error status reset operation, while simultaneously counting the number of bus-off resets. When the number of resets reaches 5, automatic reset stops, and a system-level fault alarm is triggered. When the application layer microprocessor detects that three consecutive service data frames have successfully received ACK responses and triggered a transmission completion hardware interrupt, the continuous ACK error counter is reset to its initial zero state. By responding to ACK error events through hardware interrupts, in conjunction with the main loop polling for buffer occupancy status, zero-delay synchronization between the underlying communication state and the application layer's operational state is achieved. This eliminates the blind spots of lacking cross-layer state awareness in existing technologies, providing accurate input for judging the system's operational state.

[0050] S3 Anomaly Detection and State Transition The main loop task of the application layer microprocessor continuously executes the judgment of communication anomalies. When the buffer occupancy rate reaches a preset full load threshold for a preset time window, or when the count value of the continuous ACK error counter reaches a preset error threshold, the application layer microprocessor completes the confirmation of the communication anomaly. The preset full load threshold is the percentage of the number of used buffers in the sending FIFO to the total buffer depth, with a value ranging from 90% to 95%. It can be flexibly adjusted according to the FIFO hardware depth of different CANFD controllers, adapting to the hardware ring buffer design of mainstream CANFD controllers on the market, and taking into account both buffer overflow warning and hardware address out-of-bounds protection. The preset time window can cover multiple consecutive preset scheduling cycles. In this embodiment, 10 preset scheduling cycles are preferred. It can be matched and set according to the real-time requirements of different systems to balance the response speed and anti-interference capability of anomaly detection. The preset error threshold ranges from 2 to 5 times. In this embodiment, 3 times is preferred, which can adapt to the anti-interference requirements of different electromagnetic environments and eliminate single ACK sampling anomalies caused by physical layer transient interference. In this embodiment, the error status indication of an ACK error is confirmed by the count value of the continuous error counter reaching the preset error threshold. This method is the preferred implementation.

[0051] After completing the anomaly detection, the application layer microprocessor switches the communication state machine to anomaly detection mode and resets the continuous ACK error counter to zero. Through the parallel determination mechanism of buffer occupancy status or ACK error status, it can accurately distinguish between occasional interference, instantaneous traffic peaks, and core anomalies such as no valid response node on the bus. This fundamentally avoids logical decision deadlocks caused by blockage of a single physical path and provides reliable triggering conditions for subsequent anomaly handling.

[0052] like Figure 3 As shown, the core communication state machine has three baseline residing nodes: normal communication state, anomaly detection state, and verification recovery state. When the system is in the normal communication state, if the underlying layer collects three consecutive single-frame ACK errors, or the duration of the FIFO being fully loaded (≥95%) covers a preset time window, the state machine unidirectionally switches to the anomaly detection state along the transition trigger condition. During the anomaly detection state period, in response to the system detecting that the first test data frame has successfully obtained an ACK response, the state machine synchronously transitions to the verification recovery state. In the verification recovery state, if three consecutive test data frames have successfully obtained ACK responses, the state machine removes the application layer restriction and switches back to the normal communication state; if any test data frame reports an ACK error during this period, the state machine immediately reverses back to the anomaly detection state to resume low-frequency detection.

[0053] S4 Cross-Layer Cooperative Self-Rescue and Adaptive Channel Detection After the application-layer microprocessor enters anomaly detection mode, it first performs a cross-layer collaborative deadlock resolution operation. The application-layer microprocessor calls the atomic operation of the real-time operating system to set the application-layer protection lock. The atomic operation uses native atomic operation instructions provided by the real-time operating system. For processors without native atomic operation support, a task-disabled scheduling approach is used to ensure the indivisibility of the setting operation, only shielding application-layer task scheduling switching, without disabling global interrupts, ensuring that the state transition process is not interrupted by multi-task scheduling. Upon detecting that the application-layer protection lock is set, the business data packet process immediately enters a suspended state, completely blocking the write path of new data to the send FIFO. The application-layer protection lock only blocks the write behavior of the business data packet process, not the write operation of test data frames to the send FIFO.

[0054] The application-layer microprocessor reads the buffer status register of the CANFD controller, distinguishes between buffers in the transmit FIFO that are in a suspended state and those in the transmit state, extracts only the hardware index values ​​of the buffers in the suspended state, generates a corresponding index mask, and writes it to the transmit cancellation request register of the CANFD controller. The hardware then forcibly terminates the transmit requests in the suspended state, releasing the corresponding hardware buffers and memory space. For buffers in the transmit state, the corresponding buffer release operation is performed after the current transmit action is completed, based on the transmit result. The index mask is generated by bit mapping according to the hardware index values ​​of the transmit FIFO buffers. Each hardware index value corresponds to an independent bit in the mask. The bit corresponding to the index value of the suspended buffer is set to 1, and the remaining bits are set to 0 to generate the final index mask. This approach simultaneously eliminates the conditions for cascading deadlock from two dimensions: application-layer write blocking and hardware-layer resource release, completely dismantling the operational risks caused by continuous application-layer writes and underlying transmit suspension.

[0055] After deadlock resolution, the application layer microprocessor switches the packet scheduling cycle to a second preset cycle, which is 10 times longer than the first preset cycle. Stable operation of the CANFD bus requires keeping the bus load rate below 30% to ensure real-time communication and fairness in bus arbitration. This cycle setting keeps the bus load rate generated by test frames below 10% of normal business communication, far below the bus safety load threshold, preventing test frames in abnormal states from consuming excessive bus bandwidth while ensuring the frequency of bus status detection meets the real-time requirements for system recovery. The bus load rate is calculated based on the ratio of the number of bits transmitted on the bus per unit time to the theoretical maximum number of bits transmitted. The second preset cycle can be flexibly adjusted according to the first preset cycle, the arbitration segment baud rate, and the test data frame length to ensure that the bus load rate generated by test data frames is below the preset safety load threshold.

[0056] The application-layer microprocessor constructs a test data frame containing a pre-allocated network management identifier and a status heartbeat payload. It pushes the test data frame into the transmit FIFO according to a second preset cycle, triggering a single transmit request to probe the connectivity of the bus physical channel. The test data frame adopts the CANFD standard data frame format, with a data segment length set to 8 bytes. The status heartbeat payload includes the current node's operating status identifier and sequence number. The pre-allocated network management identifier uses a unique node probe ID assigned to each node in the bus system. Each node's test data frame identifier is unique, using the standard frame format. The ID value is higher than the ID value of the service data frame, ensuring that the arbitration priority is lower than all service data frames. This adapts to multi-node CANFD bus network scenarios and avoids interference with the normal service communication of other nodes on the bus.

[0057] Upon entering anomaly detection mode, the application-layer microprocessor initiates a timeout period. If the accumulated runtime reaches the preset timeout period without a successful ACK response for the test data frame, a system communication fault alarm is triggered, and the CANFD controller's hardware reset procedure is executed. The preset timeout period can be set to 1000 second preset cycles. Simultaneously with the controller hardware reset, the application-layer microprocessor resets the application-layer protection lock, clears the continuous ACK error counter, switches the communication state machine to normal communication state, and re-executes the system initialization configuration procedure to ensure complete synchronization between the hardware and software state machines. The application-layer microprocessor monitors the transmission results of the test data frame in real time through transmit completion hardware interrupts and transmission error interrupts. If the test data frame does not receive an ACK response, before pushing the next test data frame, the hardware index value of the suspended test data frame is extracted and written to the transmit cancellation request register to release the corresponding buffer. The system maintains anomaly detection mode and continues to send test data frames according to the second preset cycle. If the test data frame successfully receives an ACK response, a transmit completion hardware interrupt is triggered, and the communication recovery verification procedure begins.

[0058] S5 Closed-Loop Wake-Up and Communication Recovery Control Upon receiving a hardware interrupt upon completion of the first test data frame transmission, the application layer microprocessor switches the communication state machine to verification mode, immediately halts the second preset cycle scheduling, and overwrites the packet sending scheduler using the first preset cycle. It then continuously sends a preset number of test data frames according to the first preset cycle, and this continuous transmission process must not be interrupted. During verification mode operation, the application layer protection lock remains in the set state, the service data packet encapsulation process remains suspended, and only test data frames are allowed to be written to the transmission FIFO. The preset number is set to 3 frames. Successful ACK responses for 3 consecutive test data frames eliminate false positives caused by transient bus interference, confirming the existence of stable and valid ACK nodes on the bus and ensuring the stability of service data transmission after communication is restored.

[0059] If a preset number of test data frames consecutively trigger a transmission completion hardware interrupt and receive a stable ACK response, the application layer microprocessor responds to the transmission completion hardware interrupt of the last test data frame by running the corresponding interrupt service routine. In the interrupt service routine, the transmission completion status of the preset number of consecutive test data frames is first verified. After confirming that all ACK responses have been successfully obtained, an atomic operation is invoked to reset the application layer protection lock, switching the communication state machine back to normal communication. After exiting the interrupt service routine, the suspended service data packet process is woken up, and service data transmission resumes according to the first preset cycle. The atomic operation is implemented using native atomic operation instructions provided by the real-time operating system. For processors without native atomic operation support, a task-disabled scheduling method is used to ensure the indivisibility of the reset operation, only masking the application layer task scheduling switch, without disabling global interrupts.

[0060] If any test data frame fails to receive an ACK response during continuous transmission in verification mode, the current continuous transmission action is immediately stopped. The hardware index value of the suspended test data frame is extracted and written to the transmission cancellation request register to release the corresponding buffer, triggering a transmission error interrupt. The application layer microprocessor immediately switches the communication state machine back to anomaly detection mode, overwrites the packet scheduling timer using the second preset period, and reverts to the channel probing process. The application layer microprocessor counts the number of consecutive verification failures. When the number of consecutive verification failures reaches 3, the second preset period is doubled. The maximum upper limit of the second preset period is 100 times the first preset period. Once the second preset period reaches its maximum upper limit, it will not be increased further. If the cumulative test duration reaches the preset timeout period without detecting an ACK response, a system-level fault alarm and hardware reset process are triggered.

[0061] In summary, the method disclosed in this invention addresses the communication anomaly caused by the lack of a valid acknowledgment node on the CANFD bus during a single transmission mode, constructing a complete closed-loop process of detection, blocking, cleanup, probing, and recovery. Through a two-factor joint judgment mechanism, accurate identification of communication anomalies is achieved, avoiding misjudgments caused by occasional events. By coordinating application-layer protection lock blocking and underlying hardware cleanup, cascading deadlocks are fundamentally eliminated, preventing system communication hangs. Through frequency reduction channel probing and closed-loop wake-up mechanisms, communication self-recovery without manual intervention is achieved, significantly improving the stability and reliability of CANFD bus communication and fully adapting to application scenarios with stringent deterministic communication requirements, such as aerospace and automotive control.

[0062] The above are all preferred embodiments of this application, and are not intended to limit the scope of protection of this application. Therefore, all equivalent changes made in accordance with the structure, shape and principle of this application should be covered within the scope of protection of this application.

Claims

1. A method for communication anomaly detection and self-recovery in CANFD single-transmission mode, characterized in that, The method is applied to a CANFD controller connected to a CANFD bus and configured in single-transmission mode. The method includes: Obtain the buffer occupancy rate and error status of the transmit FIFO of the CANFD controller; When the cache occupancy rate reaches a preset full load threshold and continues for a preset time window, or when the error status indicator shows an ACK error, it is determined that the communication is in an abnormal state. In the abnormal communication state, an application layer protection lock is set to block the writing of service data to the transmission FIFO, and an index mask is written to the transmission cancellation request register of the CANFD controller to terminate the transmission request corresponding to the index mask. The data transmission period is switched from the preset communication period to a test period that is longer than the preset communication period, and test data frames are sent to the CANFD bus according to the test period. When the test data frame is detected to have successfully received an ACK response, the application layer protection lock is released, and the service data is resumed to be written to the sending FIFO according to the preset communication cycle.

2. The communication anomaly detection and self-recovery method in CANFD single-transmission mode according to claim 1, characterized in that, Before obtaining the buffer occupancy rate and error status of the transmit FIFO of the CANFD controller, the following steps are also included: An application-layer microprocessor is provided to connect to the CANFD controller, and a global identification variable and a continuous error counter are allocated in the application-layer microprocessor; The global identifier variable is reset to carry the application layer protection lock, and the continuous error counter is cleared to establish a count value benchmark for determining the occurrence of the ACK error; The single-transmission mode is locked by setting the disable auto-retransmission flag in the underlying register of the CANFD controller, and the transmission completion hardware interrupt and transmission error interrupt are enabled to trigger the application layer microprocessor to obtain the error status.

3. The communication anomaly detection and self-recovery method in CANFD single-transmission mode according to claim 2, characterized in that, The application layer microprocessor acquires the error status, including: In response to the transmission error interruption, the underlying protocol status register of the CANFD controller is read; When the underlying protocol status register indicates a single-frame ACK error, the continuous error counter is controlled to increment based on the count value reference, and the corresponding interrupt flag is cleared. When the count value of the continuous error counter reaches the preset error threshold, the error status indication indicates that the ACK error has occurred.

4. The communication anomaly detection and self-recovery method in CANFD single-transmission mode according to claim 3, characterized in that, The determination of entering a communication abnormal state includes: The application layer microprocessor is controlled to poll and obtain the cache occupancy rate according to a preset scheduling cycle; When the duration for which the cache occupancy rate reaches the preset full load threshold covers multiple preset scheduling cycles to form the preset time window, or when the count value of the continuous error counter reaches the preset error threshold, the application layer microprocessor is switched to the communication abnormal state, and the continuous error counter is reset to the count value baseline.

5. The communication anomaly detection and self-recovery method in CANFD single-transmission mode according to claim 4, characterized in that, The setting of the application layer protection lock to block the writing of service data to the sending FIFO includes: The application layer microprocessor is controlled to invoke atomic operations to set the global identifier variable. In response to the global identifier variable being set, the service data packet process running on the application layer microprocessor is suspended to cut off the inbound flow of the service data to the sending FIFO.

6. The communication anomaly detection and self-recovery method in CANFD single-transmission mode according to claim 5, characterized in that, The step of writing an index mask to the transmit cancellation request register of the CANFD controller to abort the transmit request corresponding to the index mask includes: When the global identifier variable is in the set state, extract the hardware index value of the buffer in the pending state in the transmit FIFO; The index mask generated based on the hardware index value is written into the send cancellation request register to abort the send request and release the memory space occupied by the buffer.

7. The communication anomaly detection and self-recovery method in CANFD single-transmission mode according to claim 6, characterized in that, The step of switching the data transmission period from a preset communication period to a test period longer than the preset communication period, and sending test data frames to the CANFD bus according to the test period, includes: After releasing the memory space occupied by the buffer, construct the test data frame containing the pre-allocated network management identifier and the status heartbeat payload; The test data frame is pushed into the buffer of the transmit FIFO according to the test cycle to trigger a single transmit request to probe the physical channel connectivity of the bus.

8. The communication anomaly detection and self-recovery method in CANFD single-transmission mode according to claim 7, characterized in that, The step of pushing the test data frame into the buffer of the transmission FIFO according to the test period includes: Obtain a preset frequency reduction factor, which is used to limit the bus load rate generated by sending the test data frame to be lower than a preset safe load threshold; The test period is derived by multiplying the preset communication period by the preset frequency reduction factor, and the packet sending scheduler of the application layer microprocessor is overwritten using the test period. The packet sending scheduling timer is controlled to perform the operation of pushing the test data frame into the buffer according to the test cycle.

9. A communication anomaly detection and self-recovery method in CANFD single-transmission mode according to claim 8, characterized in that, When the test data frame is detected to have successfully received an ACK response, the application layer protection lock is released, and the writing of service data to the sending FIFO is resumed according to the preset communication cycle, including: When the first test data frame receives the ACK response, the packet sending scheduler is overwritten using the preset communication period, and the packet sending scheduler is controlled to continuously push a preset number of test data frames into the buffer according to the preset communication period. If the preset number of test data frames all receive the ACK response consecutively, the application layer protection lock is released to resume writing the service data; If any of the test data frames does not receive the ACK response, the packet sending scheduler is overwritten using the test cycle to roll back the operation of pushing the test data frame according to the test cycle.

10. A communication anomaly detection and self-recovery method in CANFD single-transmission mode according to claim 9, characterized in that, The step of releasing the application layer protection lock to restore the writing of the business data includes: The system responds to the ACK response received by the preset number of test data frames, triggering a hardware interrupt for transmission completion, and controls the application layer microprocessor to run an interrupt service routine. The global identifier variable is reset by invoking an atomic operation using the interrupt service routine, thereby releasing the application-layer protection lock; The suspended service data packet process is woken up based on the reset global identifier variable to resume writing service data to the send FIFO.

Images