Distributed embedded control systems for safety-critical applications require a high level of dependability. Despite the existence of communication protocols such as TTP or FlexRay specifically developed to provide that level of dependability, there has also been an increasing interest in CAN, given its low-cost, electrical robustness, good real-time properties and widespread use. However, the use of CAN in these applications has been controversial due to dependability limitations. To overcome some of those limitations, namely those arising from its non-redundant bus topology, we have proposed a replicated star topology, ReCANcentrate, which is transparent for any CAN-based application and protocol, and whose hubs incorporate the necessary fault-treatment and fault tolerance mechanisms. In this document we focus on how each node of ReCANcentrate manages the transmissions and the receptions on the replicated star, as well as how it tolerates faults.

Prototype level evaluation and verification of communication networks in various configurations over all possible corners, temperature ranges, etc. is a time consuming and expensive task. Moreover only certain corners coming from tolerances of all network parts (cables, common mode chokes, ESD protections) can be evaluated by measurements. Proper behavioral modeling of all network components including relevant corners conditions, allows handy verifications by simulation in early development stages and brings significant improvement in terms of cost and time to market for network designers. Modeling of a full network prior to prototyping can also serve as input for e.g. semiconductor manufactures to develop new transceivers based on simulation results. The paper deals with behavioral models of CAN bus transceivers. To allow various kinds of verification simulations in a reasonable CPU time starting from basic verifications up to detailed signal integrity analysis, thermal behavior, etc. a set of three behavioral models of a commercial CAN bus transceiver has been developed. The models were developed in VHDL AMS language with accuracy, speed and convergence trade-off being addressed. A network of CAN transceivers was simulated in various operating conditions and the results prove the effectiveness of chosen approach.

This paper describes CAN application in a modular robot system. RobMAT is made up of modules that form a new structure called molecule when they are joined together. Every molecule has a master module, which is in charge of receiving external message and retransmitting to the rest of the modules by CAN bus. The message contains all related information about movement control references, sensor data and module synchronization. CAN features allow faster transmission of up to 1Mbit/s. It is also flexible to connecting another CAN device. Such features make CAN appropriate for this application. Task performance using modular robots requires flawless communication among modulest herefore, synchronization is a key factor to take into account where in CAN plays an important role. The importance of synchronization requires a dedicated mailbox to manage it among the modules. Each module comes with a clock in order to process information by itself and correspondingly synchronize. Among the modules, one module has the master clock pulse that has to be transmitted to the rest of the modules of the molecule for readjustment of time. The experiments highlight the excellent performance of synchronization in crucial task.

This paper describes the B-Live® system targetted to automate house appliances for severely impaired people, in particular quadriplegic. This system has been developed at Micro I/O for enhancing the quality of life and the independence of its potential users. The envisaged application is the retrofitting of common dwellings. The B-Live system is described and details on its software, hardware and CAN-based communications architecture are provided. A survey of the supported appliances and interfaces is presented as well as a description of the B-live configuration and operation procedures. The adequacy of the B-Live system to improve the autonomy of the envisaged users was informally evaluated by C5 and C6 patients at a demonstration house located in the CMRRC Rovisco Pais, a rehabilitation center near Aveiro, in Portugal. The conclusion is that the system has a short learning curve and can cope with the requirements of its potential users. The use of CAN in this application opens the possibility to include safety critical real-time systems in the B- Live system. This is the case of the monitoring of the ventilator used for quadriplegic people that require breath assistance.

The new XML device descriptions for CANopen devices (CiA 311) substitute the existing electronic data sheets (EDS) and provide considerably more possibilities to describe CANopen devices with its application and its communication part in detail. This paper gives an overview of the XML device descriptions (XDD), illustrates the new possibilities in comparison to the EDS files according to CiA 306 and focuses on use cases and its advantages for CANopen device manufactures and system integrators e.g. for specification or testing of CANopen devices. Possible solutions for future trends like the description of finite state machines and dynamic behavior with constraints are discussed as well.

A personnel interlock system is a safety critical part in an accelerator. It switches off all relevant radiation sources in case of danger, e.g. klystrons, magnets and particle sources. The personnel interlock system at DESY is a logical circuit made up of relays that are hardwired to emergency off switches, access doors, safety key boxes, beam shutters and other dry contacts. The interlock software monitors each relay with a current monitor (optocoupler) and a bottom contact. To operate an accelerator, a warning procedure with optical and acoustical warnings is required. The interlock software controls the warning procedure by influencing the current path in the relay circuit. If any of the signals going into the relay circuit is missing, beam operation is denied or withdrawn. All safety critical paths are realized with the relays only, the interlock software must not have any safety critical tasks. Besides the safety critical aspect, personnel interlock systems must provide high availability to ensure long operation times. This applies especially to the interlock software and its components. CANopen based modules are used by the personnel interlock system to monitor the relays with a current monitor and a bottom contact. The personnel interlock software had to be overhauled from ground up. The new system had to be integrated into the existing interlock hardware infrastructure and makes use of standard CANopen means for configuration of CANopen modules (CiA-302-2) and process image processing (CiA-405). This paper discusses the used system architecture and aspects of integrating CANopen to Java.

The Gran Telescopio Canarias (GTC) is the most powerful ground telescope ever built. The segmented primary mirror has the largest collecting surface equivalent to one circular mirror of 10.4 meters. The control system (GCS) includes the hardware and software to control all the telescope subsystems, from the real time applications to the astronomer interfaces. Most of the real time GCS subsystems use CAN as the main control bus or to perform support functions. The main CAN application is the control of the primary mirror which is composed of 36 hexagonal segments. The GCS is responsible for making the 36 segments behave like a monolithic mirror. Three positioners per segment (total 108) will move it in tip/tilt and piston. Two position sensowrs (total 168) between adjacent segments will measure their relative displacement. This loop controls the positioners and reads the sensors at 200Hz over CAN buses. The figure of each segment is also actively controlled thanks to 6 actuators (total 216) that act on three whiffletrees attached to the back of a segment. This actuation is made at very low frequency. Finally, the temperature of each segment is measured in six points (total 216). Specific CANopen protocols where developed to control the positioners and read the edge sensors. CAN bus and CANopen protocols are also used to control and monitor several other subsystems of the GTC: tertiary mirror, dynamic counterweights, optics and filter wheels, temperature and humidity control loops, start up and stop systems, calibration lamps, etc.rimary Mirror Active Optic System.

Safety standards oblige to know the presence of people inside an escalator and moving walkways before changing its operation state. A photoelectric curtain based on emitter/receiver photocells is a good low cost solution. As a pair of emitter/receiver must be positioned every 30 cm along the escalator, the number of detectors increases greatly in long type conveyors and also increases the assembly and wiring cost. This paper shows a solution based in a CAN slave node network distributed along both balustrades of the conveyor (Figure 1). Every CAN slave node is based on a low cost CAN Input/Output Expander chip and controls a set of detectors (emitters or receivers). There is also a master CAN node based on a PIC microcontroller that treats all messages information received from the slave CAN nodes and controls a safety relay that informs to the motor drive controller.

To accentuate the growth of DeviceNet in the market place, a new media option has been released for DeviceNet. This low cost media provides a whole new approach to installing DeviceNet networks saving both time and money through Insulation Displacement Contact (IDC) technology. This paper will describe the technical merits of the media including topologies and connectorization options. In addition this paper will provide time studies on installation time savings over the traditional DeviceNet media options. Being that DeviceNet is based on CAN physical layer, this media can also apply to other powered CAN based networks using 4 or 5 conductors.

Tecnalia Automocion is working on an ECG sensor integrated into the steering wheel as one of several concepts following Ambient Intelligence (AmI) principles. This work is related to a previously developed prototype of a sensorized active headrest which was designed to maintain desired horizontal and vertical safety distances from the head. A networked solution, with smart sensors and actuators integrating the IEEE 1451 standard group, is being designed to be applied to the active headrest prototype and this ECG sensor. Following this standard, Tecnalia-Automocion has selected CANopen high level protocol to network this ECG sensor and obtain data about the car-driver, adding the plug & play feature with the mentioned IEEE 1451 standard.

The operational environment and physical conditions can affect significant embedded control networks to the point of failure. Fault tolerant systems usually require customized platforms which makes them not as flexible to use when only determinism is required rather than safety critical operation. In this paper, a Fault Tolerance layer is introduced that is designed as an add-on to the MilCAN standard, which offers an option to use off-the-self equipment achieving determinism and redundancy.

This paper introduces the new LSS Fastscan method that implements a generic and efficient scan cycle for non-configured devices. The LSS Fastscan was conceived for the CiA Application Profile 447 “car add-on devices” to simplify plug-and-play in the environment of taxis and other special vehicles. It was added to the CiA Document 305 “Layer Setting Services” and can thus be used by any CANopen implementation. Furthermore, the method is generic enough to also be used in CAN based systems using another higher-layer protocol.

This paper presents preliminary findings from research into a methodology for ascertaining nodal cost from the number of nodes and signal information. An estimation of nodal cost is useful in Design to Cost processes and can therefore be used to help partition CAN based systems using cost based decisions and help decide the number of networks and nodes. Published costing work and methodologies are reviewed. Then work on the estimation of microcontroller ROM and RAM requirements from the number of nodes and signals is presented and it is shown how this relates to nodal cost. The paper closes with a discussion on how this may fit into a Design to Cost process for distributed automotive electrical architecture design. This is shown for CAN and LIN based systems which are popular automotive networking technologies. However, the process discussed may also be useful for non-automotive distributed control systems.

CAN is the dominating network technology in automotive applications. Enhanced by the higher layer protocol CANopen it is a well established Fieldbus technology, im- plemented in a large variety of devices and systems. EtherCAT is an Industrial Ethernet technology which provides high end communication performance, flexible topology options and low system costs. In many applications, the distinct advantages of both networks have to be combined. With CAN/CANopen to EtherCAT gateways, this can be done efficiently, if certain design rules are followed. This paper discusses the requirements on such gateways from the application and from the device vendor point of view. Besides CANopen gateways, the special re- quirements of generic CAN to EtherCAT gateways as used e.g. in automotive test bed applications are considered. It is shown that CANopen protocols can be used to con- figure the gateway also from the EtherCAT side. Example implementations and their representation in software tools are shown as well as application examples. It is also shown that such gateways enable a smooth migration path from CANopen devices towards Industrial Ethernet.

Distributed control systems are ubiquitous nowadays, with applications ranging from vehicle to shop-floor control. With the increased penetration of control systems in all application, the need for reliable communication among the members of the system is more crucial than ever. Standard CAN bus networks already have embedded a mechanism to guarantee the provision of service in face of a one-wire fault in a two-wire differential cabling infrastructure. However there is no mechanism to guarantee continuity of service in the event of a two-wire fault. To achieve this, one needs spatial redundancy for the cabling infrastructure. However, the design and implementation of such kind of solutions places problems with a non-trivial solution, despite the end result is quite simple. This paper addresses how a FPGA-based solution may be used to enhance CAN network availability through the management of the several physical media which support a single, logical medium.

Perishable food products such as vegetables, fruit, meat or fish require refrigerated transports. As a consequence effective cold management is fundamental for maintaining the quality of these products along the supply chain. The use of standardized CAN technology can improve monitoring transports, ensuring the inter-operability of the system. A variety of sensors and actuators can be integrated in the CAN. Information provided by sensors has to be processed in order to check the adequate status of settings. In case of anomaly data, alarms should be triggered. Also actual devices for fleet management, such as Global Positioning System (GPS), tachograph and satellite communications, can be a part of whole system. And, in near future, more emergent technologies like Wireless Sensor Networks (WSN) or Radio-Frequency Identification (RFID) will be ready to implement in an on-line monitoring environment. Thus, the challenge today is interconnecting these heterogeneous systems and the harmonization of the different interfaces.

Complex machines use today control-systems consisting of multiple buses because any single bus can not support enough nodes. Moreover, any fatal failure in a single bus system will stop the whole system. With CAN, requirement of linear topology limits efficient networking in some systems. CAN-switch has successfully been used to solve those challenges. Benefits of a switch have been proved in real systems during last four years. This paper presents latest improvements in CAN-switch technology. Most significant improvement has been made in forwarding. A new state-of-the-art TX-buffering scheme has been adopted from Ethernet and ATM-switches. With the new buffering packet loss no more exists at full 1Mbps bit rate in 4-port switch. According to the measurements, forwarding delay remains constant for all CAN-IDs due to table-based forwarding rules. The forwarding delay of the switch has been significantly reduced from the delay of the first prototype. Another significant improvement is CANopen-based management interface. It enables seamless integration of CAN-switch into CANopen networks by offering object- dictionary based managing. Fault monitoring exceptions are provided as EMCY- objects and heartbeat producer enables existence monitoring of a switch. Support of existing CANopen design flow and network design tools has made use of a switch as easy as any other CANopen node.

In a standard DeviceNet system, reconnecting an existing slave device to a master can take between 2 and 10 seconds due to certain minimum wait times specified for the Master/Slave Connection Set. These wait times and the consequent safeguarding are acceptable for most DeviceNet systems where device replacement in a running system only occurs when a defective device needs to be replaced. However, such a long wait time is by far too much for highly dynamic systems with frequent device changes such as robots with exchangeable tools that contain active devices. To overcome this issue, the DeviceNet Quick Connect mechanism was invented. This mechanism bypasses the long wait times of standard devices and thus results in reconnect times of well under 1 second. This paper will discuss the standard wait times, explain the Quick Connect mechanisms and demonstrate the improvement in real applications.

The growing complexity of today’s system architectures is associated with an increase in the effort that must be invested in test specification, test creation and test execution during the development of such systems and system components. Test specifications should be available in early phases of the development process, e.g. after the system architecture has been created or during component design. This makes it possible to detect errors early and correct them cost-effectively. Device descriptions can be prepared for CANopen systems as early as after definition of the component architecture. Together with the system definition, the device descriptions form the basis for creating test specifications. They can be used to derive executable test sequences, which in turn can be executed in a suitable runtime environment.

CiA DS-405 defines a way to publish variables of IEC 61131-3 programmables CANOpen nodes through their Object Dictionary, using Dynamic Index Assignment defined in DS-302. Correspondence between IEC 61131-3 variables and Object Dictionary entries is let to the responsibility of the PLC manufacturer. IEC 61131-3 defines some Directly Represented Variables, specifying direction, size, and location of physical variables. In this representation, location is an arbitrary count of integers separated by dots. Again, correspondence between location of IEC 61131-3 and physical variables is manufacturer-specified. As a consequence, and despite of the standardization efforts of PLCopen and CiA, there is still no real interchangeability of PLC nodes in a CANopen network. This paper proposes a method for the PLC application writer to explicitly publish and subscribe to CanOpen remote variables with Directly Represented Variables location. As a complement to DS-405, it could suppress most network reconfiguration steps when moving PLC programs from one brand to another. Presented concepts and algorithms are already implemented in the Beremiz and CanFestival open source projects, and are publicly available.

Embedded systems are now-a-days complex distributed systems (e.g. automobiles, elevators, building climate control systems, and aircrafts) with various demands on networking capabilities. These Networked Control Systems are Distributed Control Systems (DCS) where controllers, sensors, actuators and other system components communicate over a network. It is easy to imagine that according to the high complexity of the networked electronic systems, the risk of failures of the system is increasing. So there is a need to provide high levels of reliability within the network. To accomplish this task a network management system is used. CANopen protocol is a networking system based on CAN serial bus. It has been widely applied into networked control systems. The CANopen networking functionality is implemented in one of the CAN nodes. This node is responsible for conducting networking functionality such as mode control, error control and configuration control. The network is vulnerable if this node fails. This paper presents a fault tolerant system, which deals with failure of so called Network Manager and sorting out this situation by providing a redundant node. The redundant node is provided with optional functionality of Network Management along with its original functionality of Slave Node.

The Stewart Platform is a well known and studied parallel robot. It is composed by an upper ring and six linear actuators. The actuators can be hydraulic, pneumatic or electrical, being the last used on applications where moderated forces and moments are required. In this paper a control of a Stewart Platform with electrical motors is described, the motors are regulated by CANopen based controllers. A CAN network is built to communicate and synchronize the motion of the six motors. A PC104 board and a Real Time Operating System (RTOS) are selected to create a fast and reliable CANopen master. The software running in the PC104 is developed from scratch however some basic features are ported from open-source software. The PC104 board is connected to a desktop PC through an Ethernet network, allowing a remote controlled system. The Stewart platform control is running on the desktop PC due to its high computational requirements.

Light electric vehicles (LEV) driven by battery-powered motors require embedded communication networks. In order to standardize the communication between the different devices, some suppliers and some vehicle manufacturers have selected the CANopen application layer. The paper discusses the technical and market requirements and the possible CANopen profile solutions.