Dual CAN-FD Bus Redundancy for Deterministic I/O Failover
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is no standard for redundancy on a CANOpen FD network, and existing approaches for CANOpen redundancy reduce deterministic operation and make bumpless fail-over in bus failures problematic.
Innovation Solution
A method for a CAN-FD network with dual busses, where a SYNC message designates an active and backup bus, and frames include sequence numbers for transmission on both busses, with fault detection and management to ensure reliable communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a managed approach to network redundancy is used (as in CANOpen), then fault protection is provided, but deterministic operation is reduced and bumpless fail-over becomes problematic
Solution Approach 1:
The system segments the redundancy management by separating active and standby busses with clear role designation through SYNC message flags. Each bus operates independently with defined responsibilities, eliminating the need for complex managed arbitration while maintaining deterministic fail-over capabilities.
Solution Approach 2:
Instead of using a managed approach where the controller actively manages redundancy switching, the system inverts the approach by using a passive standby bus that automatically takes over when the active bus fails. The SYNC message flag indicates which bus is active, and fail-over occurs automatically without complex management logic.
2Reliability
If dual CAN-FD busses are used for redundancy, then high availability is achieved, but message synchronization and duplicate frame handling become complex
Solution Approach 1:
The system performs preliminary action by pre-designating one bus as active and another as standby before any failure occurs. The SYNC message includes a flag that pre-indicates which bus should be active, establishing the hierarchy in advance and simplifying real-time fail-over decisions without complex synchronization logic.
Solution Approach 2:
The system uses copying by transmitting identical SYNC messages and process data frames on both active and standby busses. The standby bus receives a copy of all transmissions, ensuring that when fail-over occurs, the standby bus already has all necessary data and can immediately take over without complex synchronization or data reconstruction.
3Difficulty of detecting and measuring
If SYNC messages are transmitted on both active and backup busses, then fault detection capability is improved, but network traffic increases
Solution Approach 1:
The system extracts the fault detection function from the data transmission function. The SYNC message serves dual purposes: it synchronizes the network and simultaneously indicates which bus is active through its flag. This separation allows fault detection through SYNC message monitoring without requiring additional dedicated fault detection traffic.
Solution Approach 2:
The SYNC message is given universal functionality by making it serve both as a synchronization signal and as an active bus indicator. This multi-functionality eliminates the need for separate fault detection messages, reducing overall network traffic while maintaining comprehensive fault detection and bus status monitoring capabilities.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Controller Area Network with Flexible Data Rate (CAN-FD) system and method providing high availability, redundant process control I/O. A server device coupled to dual CAN-FD busses generates a SYNC message designating one of the dual busses as active and another one as backup. The server device transmits the SYNC message on the active bus and then immediately transmits the SYNC message on the backup bus. A client device coupled to the dual busses transmits process data frames on the busses in response to the SYNC message. Each of the process data frames includes a sequence number for the current communication cycle and indicates on which of the dual busses the process data frame is being transmitted.