CAN Error Handling and Fault Confinement

In this lesson, you will learn how CAN nodes use internal error counters to autonomously monitor their health and prevent faulty hardware from disrupting the entire bus.

The CAN Error Management Logic

In the Controller Area Network (CAN), we cannot afford a single malfunctioning node to "babble" and block all communication. To prevent this, every CAN controller maintains two internal counters: the Transmit Error Counter (TEC) and the Receive Error Counter (REC).

The Three States of a Node

As these counters increment (when errors occur) or decrement (when successful transmissions occur), a node transitions through three specific states:

1. Error-Active: The node is healthy (counters < 128). It participates normally in communication and sends "Active Error Flags" (6 dominant bits) if it detects a violation, immediately invalidating the current frame.
2. Error-Passive: The node is struggling (counters ≥ 128). It can still send and receive messages, but it is restricted. If it detects an error, it sends "Passive Error Flags" (6 recessive bits) instead of dominant ones. This ensures the node cannot force a bus error and destroy other people's packets.
3. Bus-Off: The node is completely disconnected (TEC > 255). The hardware stops all transmission and reception entirely. This is a safety "self-destruct" mechanism to protect the bus from a node that has suffered a catastrophic failure.

Visualizing the Counter Thresholds

You can think of the state machine logic running inside the hardware as a simple conditional block:

// Simplified logic for a CAN Controller's state machine
if (TEC > 255) {
    node_state = BUS_OFF;
} else if (TEC >= 128 || REC >= 128) {
    node_state = ERROR_PASSIVE;
} else {
    node_state = ERROR_ACTIVE;
}

Why this matters

By forcing a node into the Bus-Off state, CAN ensures that a single faulty sensor—perhaps one with a shorted transceiver—cannot indefinitely hold the bus in a dominant state. Recovery from the Bus-Off state typically requires either a software reset or a specific sequence of valid bus messages to prove the node has stabilized.

Key Takeaway: CAN nodes use internal TEC and REC counters to automatically throttle their own communication, moving from Error-Active to Passive, and eventually to a safe Bus-Off state to guarantee network availability.