Assessing safety of CAN-communications systems

Controller Area Network (CAN) is a de-facto communications standard in many fields of machine automation. Such fields are example forestry machines and mining machines. In many cases the CAN-bus carries data that is safety relevant. However, the implementation of the CAN-bus does not often include a certified safety layer and is thus not characterised as a safety bus. The paper describes a procedure to assess non-certified CAN communications systems in regard to safety. The procedure is partly based on the message error model of the IEC 61784-3 standard for the functional safety of fieldbuses and partly on the validation methods defined in the Swedish Pålbus-project. The message error model consists, according to IEC 61784-3, of eight communication error types, corruption, unintended repetition, incorrect sequence, loss, unacceptable delay, insertion, masquerade and wrong addressing. Besides these, excessive transmission time jitter and inconsistency are additional error types, the latter being a special case of the eight error types above. Of these, corruption threat and unacceptable delay can be assessed quantitatively; for others qualitative analysis is adequate. A more precise assessment of corruption error compared to that of IEC 61784-3 is discussed in the paper.