{"id":15345,"date":"2024-11-18T18:37:16","date_gmt":"2024-11-18T10:37:16","guid":{"rendered":"https:\/\/www.tosunai.com\/?p=15345"},"modified":"2025-02-05T15:58:36","modified_gmt":"2025-02-05T07:58:36","slug":"detailed-explanation-use-tosun-can-disturbance-interface","status":"publish","type":"post","link":"https:\/\/www.tosunai.com\/en\/detailed-explanation-use-tosun-can-disturbance-interface\/","title":{"rendered":"Sharing | A detailed explanation of the use of TOSUN CAN Disturbance interface"},"content":{"rendered":"

TH7011 is a CAN\/CAN FD bus jammer device launched by Tongxing Intelligence, which adopts RJ45 Ethernet interface to connect with PC, and the Windows system drive-free design makes the device have system compatibility. Combined with the powerful TSMaster software, it supports interfering with CAN\/CAN FD specific bit values; supports various trigger modes, such as frame trigger, error trigger, software trigger, etc.; and supports functions such as Bus-off behavior test and sampling point test.<\/p>

It can be used for conformance testing, detecting whether the nodes comply with the communication protocol specification, and guaranteeing the normal and safe operation of the CAN\/CAN FD network.<\/p>

Keywords in this article: interference meter, physical wiring, initialization, interference trigger, BUSOFF, sampling point<\/em><\/strong><\/p>

<\/div>

01 | Technical background<\/strong><\/h2>

With the rapid development of automotive electronics and industrial IoT, the stability and reliability of the CAN\/CAN FD bus is crucial as a key communication technology. However, communication quality and protocol consistency differences between nodes may lead to network failures and affect system performance. For this reason, TOSUN launches TH7011 Conformance Interference Tester, which ensures that the communication quality and protocol of each node conforms to the standard through efficient and accurate conformance testing, thus guaranteeing the safe and stable operation of the network.<\/p>

02 | typical application<\/strong><\/strong><\/h2>

The TH7011 has a wide range of applications in several fields, especially in scenarios where rigorous conformance testing of CAN\/CAN FD bus networks is required. The following are some typical application scenarios:<\/p>

Sample point testing of the ECU:<\/strong>During the development and validation of automotive electronic control units (ECUs), the TH7011 can be used to check the accuracy of the ECU's sampling points on the CAN\/CAN FD bus, ensuring the accuracy and reliability of data transmission.<\/p>

ECU Bus-off behavior test:<\/strong>In a CAN\/CAN FD network, when a node fails or has an error, it may enter the Bus-off state, resulting in interruption of network communication.The TH7011 enables a node to enter the BUSOFF state and accurately measures its recovery time, thus comprehensively evaluating the node's error handling and recovery performance.<\/p>

and frame interference:<\/strong>During the testing process, TH7011 can interfere with frames on the CAN\/CAN FD bus to simulate various complex situations in the actual communication environment and to check the anti-interference ability and stability of network nodes.<\/p>

03 | Physical Interface of TH7011<\/strong><\/strong><\/strong><\/h2>

Interface Description:<\/strong><\/p>

\"\"<\/figure>\n\n

RJ45 network port<\/strong><\/p><\/div>

This interface is used to enable data communication and configuration settings between the TH7011 and the PC.<\/p>

\"\"<\/figure>\n\n

DC 9-32V<\/strong><\/p><\/div>

This interface provides power input for the tamper to ensure its stable operation under different power supply environments.<\/p>

\"\"<\/figure>\n\n

CAN\/CAN FD<\/strong><\/p><\/div>

This interface is used to connect and communicate between the interferometer and the DUT of the CAN\/CAN FD bus system.<\/p>

\"\"<\/figure>\n\n

I\/O Port<\/strong><\/p><\/div>

The DO1 and GND pins of this interface enable a clear view of the interference range of the set interferometer on an oscilloscope, making it easy to evaluate and analyze the interference effect.<\/p>

3.1 <\/strong>Conventional Physical Connection of TH7011<\/strong><\/h3>

Typical connections for the TH7011 jammer are as follows:<\/p>

First, connect the TH7011 to the network port side of the computer through the RJ45 network port, then use the special power cord to supply power to the interferometer, and then connect the CAN\/CAN FD channel of the TH7011 to the DUT as well as the CAN\/CAN FD pins of the other CAN card respectively. In this way, you can observe or record the message interaction between the DUT and TH7011 in real time in TSMaster, as shown in Figure 1.<\/p>

Additionally, when performing sample point testing, the CAN card used for monitoring can optionally be temporarily removed from the bus system in order to minimize possible errors introduced by the CAN card itself.<\/p>

\"General
Figure 1: General Physical Wiring of the TH7011<\/figcaption><\/figure>

3.2 <\/strong>TH7011<\/strong>Physical Connection of Mating Oscilloscope<\/strong><\/h3>

In order to more intuitively observe the interference effect of the interferometer (TH7011) on the oscilloscope, we need to use this connection. First, connect the clamp (a.k.a. ground terminal) of one channel of the oscilloscope to the GND (ground) pin on the I\/O interface of the tamper, this is to ensure that the signal reference between the oscilloscope and the tamper is consistent. Next, use the hook end of the oscilloscope probe to make precise contact with the DO1 pin on the interferometer's I\/O interface and connect it. With this setup, the oscilloscope is able to capture the interference signal from the interferometer as shown in Figure 2.<\/p>

\"Interference
Figure 2: Interference Enable Wiring
<\/figcaption><\/figure>
<\/div>

04 | <\/strong>Initialization of TH7011<\/strong><\/h2>

4.1 Installation of TH7011 Upper Unit<\/strong><\/h3>

Open the upper computer of TH7011 at [Hardware] - [Proprietary Devices] - [TH7011] of TSMaster, as shown in Figure 3.<\/p>

\"\"
Figure 3: Installation of TH7011 Upper Unit
<\/figcaption><\/figure><\/div>

4.2 Initializing the device<\/strong><\/h3>

In the [Initialization Interface], connect and initialize the selected interferometer hardware according to the process of [Network Card Selection], [Device Selection], [Obtain Device Information], [Device Communication Parameters], and [CAN Controller Parameters]. As shown in Figure 4.<\/p>

\"\"
Figure 4: Initialization screen<\/figcaption><\/figure><\/div>

Detailed Steps:<\/p>

1. Click [Scanning Network Card], if the computer has more than one network card need to select the interference instrument corresponding to the use of the network card, as shown in Figure 5.<\/p>

\"\"
Figure 5: Selecting the Corresponding NIC<\/figcaption><\/figure>

<\/p>

2. Click [Scan Device], [Device Selection] drop-down box to get the serial number of the interferometer device (may contain multiple devices). As shown in Figure 6.<\/p>

\"\"
Figure 6: Scanning and selecting devices<\/figcaption><\/figure>

<\/p>

3. Click the [Get Device Information] button, the right side of the parameter column to get the relevant information about the device. As shown in Figure 7.<\/p>

\"\"
Figure 7: Getting Device Information<\/figcaption><\/figure>

<\/p>

4. Before you start connecting the device, check and make sure that the IP address of the WIN Ethernet interface is in the same network segment as the IP of the jammer device. As shown in Figure 8.<\/p>

\"\"
Figure 8: Jammer IP and computer IP in the same network segment<\/figcaption><\/figure>

Click \"Connect Device\", the button will be grayed out and the status bar below will show \"Network Connection Successful\". As shown in Figure 9.<\/p>

\"\"
Figure 9: Device Connected Successfully<\/figcaption><\/figure>

5. [CAN Controller Parameters] Select the corresponding parameters to set the parameters of the interferometer, click [Application Configuration]. As shown in Figure 10.<\/p>

\"\"
Figure 10: Initializing the Jammer<\/figcaption><\/figure>

<\/p>

<\/div>

05 | <\/strong>Integer Bit Interference Function of TH7011<\/strong><\/h2>

Necessary engineering environment build:<\/strong>Set up the test environment according to \"Physical Wiring of TH7011\" in Section 3 and \"Initialization of TH7011\" in Section 4.<\/p>

Principle:<\/strong>Whole bit jamming is the explicit and implicit state change of a bit in the entire CAN\/CAN FD message.<\/p>

Generic settings for interference triggering:<\/strong>
<\/p>

(1) Interference number setting<\/strong>
Cycle:<\/strong>It is the disturbance cycle, usually the macrocycle.
Cycle interval:<\/strong>is the number of intervals between two macrocycles.
Number of repetitions:<\/strong>is the number of interference repetitions in a large cycle.
Repeat intervals:<\/strong>is the number of intervals between interference repetitions in a large cycle.<\/p>

\"\"
Figure 11: Interference count setting<\/figcaption><\/figure>

<\/p>

Taking cycle 2, cycle interval 3, repetition number 4, and repetition interval 1 as an example, a total of 8 error frames (cycle * repetition number) can be generated, and their interference out of the corresponding message records, as shown in Figure 12.<\/p>

  • Message counts 1 through 7 are the first macrocycle, and message counts 12 through 18 are the second macrocycle. <\/li>\n\n
  • The interval between two major cycles is 3.<\/li>\n\n
  • The number of interference repetitions within each macrocycle is 4, and the interval between repetitions is 1.<\/li><\/ul>
    \"\"
    Figure 12: The effect of the set number of interferences<\/figcaption><\/figure>

    (2) Selection and setting of output configuration:<\/strong>
    In [Trigger Function] - [Output Configuration], make the selection of bit time and interference effect. Steps: First perform the clear sequence, then perform the selection of [Interference Mode] and [Bit Time], and then add segments.<\/p>

    \u2460 Interference patterns:<\/strong>
    Strongly obvious:<\/strong>What was originally a recessive bit (as a 1) is interfered with to become a dominant bit as a 0.
    Strong Hidden:<\/strong>What was originally a dominant bit (as 0) is interfered with to make an invisible bit as 1.
    Flip:<\/strong>The interference is implemented based on the level state of the previous frame, and if the strong display interference of the previous frame can effectively trigger the generation of error frames, the subsequent frames will also take strong display interference measures. Therefore, the flip-flop jamming technique is more suitable for jamming a single frame; in multi-frame jamming application scenarios, some frames may not be effectively jammed.
    No interference:<\/strong>i.e. no jamming of the specified sequence of messages
    <\/p>

    \"\"
    Figure 13: Interference Mode Selection<\/figcaption><\/figure>

    <\/p>

    \u2461 Selection of the bit time:<\/strong>
    Whole-bit Interference At this point, either the arbitration segment time or the data segment time is selected based on the frame type and the bit field of the interference.<\/p>

    Arbitration segment time:<\/strong>When the interference is with CAN frames, the arbitration segment time is always selected; when the interference is with CAN FD frames, when BRS is set to 1, the bit before the BRS bit is selected as well as after the interference CRC defining character bit is selected.<\/p>

    Data segment time:<\/strong>When the interference is with CAN FD frames, the selection interferes with the BRS bits up to the CRC delimiter bits, all of which are data segment bit times.<\/p>

    \"\"
    Figure 14: Selection of bit times<\/figcaption><\/figure>

    <\/p>

    5.1 <\/strong>CAN frame jamming<\/strong><\/h3>

    In order to jam CAN frames sent from the DUT, the jamming instrument is first used to match a specific CAN frame sent from the DUT by ID, frame type, DLC, etc., and then the bit field of the jamming is selected to implement a predetermined jamming measure on the CAN frame.<\/p>

    5.1.1 <\/strong>Basic configuration for CAN frame jamming<\/strong><\/h4>

    1. In [Trigger Function] - [Trigger Configuration Panel] - [Add] - [Bit Field Trigger] open the panel as Figure 15. After configuration, select [Enable Configuration].<\/p>

    \"\"
    Figure 15: Trigger Configuration Panel<\/figcaption><\/figure>

    (1) In the process of jamming, in order to accurately match the target frame, the key information in the arbitration field and control field needs to be set. Specifically, in the operation of the upper computer of the jamming instrument, firstly, the frame ID should be converted to 11 to binary and DLC to binary, and at the same time, taking into account that the frame being processed is a CAN frame, and its specific fields, such as RTR\/RRS, IDE, FDF, and BRS, are all 0 in the standard CAN frame, as shown in Fig. 16.<\/p>

    \"\"
    Figure 16: Configuration of CAN frames in the panel with arbitration and control fields<\/figcaption><\/figure>

    <\/p>

    (2) Select the bit field to be disturbed as well as the specific bit: it should be noted that the offset of the panel trigger should be the previous bit to be disturbed, as shown in Fig. 17.<\/p>

    \"\"
    Figure 17: When the interference bit is selected as ACK bit<\/figcaption><\/figure>

    <\/p>

    2. Interference number setting: Configure the specific number of interferences according to the demand.<\/p>

    \"\"
    Figure 18: Configuration of the number of CAN frame disturbances<\/figcaption><\/figure>

    <\/p>

    3. CAN frame jamming output configuration:
    The selection of [Interference Mode] is based on the selected bit. At the same time, since the interference is with CAN frames, [Arbitration segment bit time] is always selected for bit time selection, as shown in Fig. 19.<\/p>

    \"Selection
    Figure 19: Selection of CAN frame jamming output configuration<\/figcaption><\/figure>

    <\/p>

    5.1.2 <\/strong>Basic configuration for CAN frame jamming<\/strong><\/h4>

    In order to demonstrate the effect of interference on CAN frames, a scenario is set up here in which the DUT on the bus is sending a standard CAN frame. The specific parameters of the frame are: identifier (ID) 0x123, type data frame, DLC set to 8 bytes, as shown in Figure 20.<\/p>

    \"\"
    Figure 20: Example of a CAN frame with ID 0x123<\/figcaption><\/figure>

    <\/p>

    1. We take the CRC defining bit of the frame as the jamming target and 20 jamming times as the number of jamming, and perform the following operations:<\/p>

    (1) In order to implement the jamming, we first parse and convert the ID of the frame: we convert the ID 0x123 to the binary form 00100100011 and make sure that the RTR\/RRS, IDE, FDF, and BRS bits in the frame type are set to 0. At the same time, we convert the DLC value of 8 to the binary form 1000, as shown in Figure 21:<\/p>

    \"\"
    Figure 21: Standard CAN frame matching 0x123 with DLC of 8<\/figcaption><\/figure>

    <\/p>

    (2) Then select the bit field of the interference is the CRC defining bit, [trigger conditions] for the CRCFIELD, [trigger offset] for the first bit is 15, as shown in Figure 22:<\/p>

    \"\"
    Figure 22: Selection of the bit field for interference is the CRC defining bit<\/figcaption><\/figure>

    <\/p>

    (3) Set the number of disturbances to 20, as shown in Fig. 23:<\/p>

    \"\"
    Figure 23: Setting the number of disturbances to 20<\/figcaption><\/figure>

    <\/p>

    (4) Configuration of interference output is carried out because the CRC defining bit of the frame is used as the target of interference, which is a hidden bit i.e. 1, so the selection of strong apparent interference of the arbitration segment time is carried out here, as shown in Fig. 24:<\/p>

    \"Selection
    Figure 24: Interference output configuration for CRC defining bits<\/figcaption><\/figure>

    <\/p>

    2. Then, after clicking Start Test, the interference effects in TSMaster and the oscilloscope are shown below:<\/p>

    (1) The message information error frame when TC1014 on TSMaster is acting as a receiver node is 20 times, and the error message is FORM ERROR, which is identified as a form error when one or more illegal bits are present in the fixed bit field (CRC definer, ACK definer, end of frame). This is shown in Figure 25.<\/p>

    \"\"
    Figure 25: Message information of the accepting node when interfering with the CRC defining bit<\/figcaption><\/figure>

    <\/p>

    (2) On the oscilloscope, according to the wiring diagram in Section 3.2 Physical Connections for the TH7011 Companion Oscilloscope, you can observe on the oscilloscope that the interference enable is pointing to the CRC defining bit and that this bit is being interfered with as a dominant bit, and that there are 20 error frames. This is shown in Figure 26 and Figure 27.<\/p>

    \"\"
    Figure 26: Interference enable pointing to CRC defining bit<\/figcaption><\/figure>

    <\/p>

    \"\"
    Figure 27: 20 error frames generated by interfering CRCs<\/figcaption><\/figure>

    <\/p>

    5.2 <\/strong>CAN FD frame interference<\/strong><\/h3>

    In order to jam CAN FD frames sent from the DUT, a jamming instrument is used to match a specific CAN FD frame sent from the DUT with its ID, frame type, DLC, etc., and then the bit field for jamming is selected to implement a predetermined jamming measure on the CAN FD frame.<\/p>

    5.2.1 <\/strong>Basic configuration for CAN FD frame jamming<\/strong><\/h4>

    1. Click Trigger - Trigger Configuration Panel - Add - Bit Field Trigger to open the panel<\/p>

    (1) In the process of jamming, in order to accurately match the target frame, the key information in the arbitration field and control field needs to be set. Specifically, in the upper computer operation of the jamming instrument, firstly, the frame ID should be converted to 11 to binary and DLC to binary, and at the same time, considering the standard CAN FD frames being processed, the specific fields, such as the RTR\/RRS and IDE bits, should be set to 0, and the FDF and BRS bits should be set to 1, as shown in Fig. 28.<\/p>

    \"\"
    Figure 28: Configuration of CAN FD frames in the panel with arbitration and control fields<\/figcaption><\/figure>

    <\/p>

    (2) Select the bit field to be interfered with and the specific bit: it should be noted that the offset of the panel trigger should be the previous bit to be interfered with, as shown in Fig. 29.<\/p>

    \"\"
    Figure 29: When selecting the CAN FD frame interference bit as bit 6 of the EOF<\/figcaption><\/figure>

    <\/p>

    2. Interference number setting: Configure the specific number of interferences according to the requirements, as shown in Figure 30.<\/p>

    \"\"
    Figure 30: Configuration of the number of disturbances<\/figcaption><\/figure>

    <\/p>

    3.CAN FD frame jamming output configuration:<\/p>

    The selection of [Interference Mode] is based on the selected bit. At the same time, because of the interference of CAN FD frames, the selection of the bit time is different from that of CAN frames, if the bit field of interference is selected between the areas of BRS and CRC defining bits, it is [Data segment bit time], and the other bit fields are [Arbitration segment bit time].<\/p>

    \"\"
    Figure 31: Output Configuration for CAN FD<\/figcaption><\/figure>

    <\/p>

    5.2.2 <\/strong>Example of CAN FD frame jamming<\/strong><\/h4>

    In order to demonstrate the effect of interference on CAN FD frames, a scenario is set up here in which the DUT on the bus is sending a standard CAN FD frame. The specific parameters of this frame are: identifier (ID) 0x123, type FD frame, DLC set to 9 bytes, as shown in Figure 32.<\/p>

    \"Example
    Figure 32: Example of a CAN FD frame with ID 0x123<\/figcaption><\/figure>

    <\/p>

    Example 1: We take the SOF bit of this frame as the jamming target, and 20 jamming as the number of jamming times, and perform the following operations:<\/strong><\/p>

    (1) In order to implement the jamming, we first parse and convert the ID of the frame: convert ID 0x123 to the binary form 00100100011, and make sure that RTR\/RRS and IDE in the frame type are set to 0, and that the FDF and BRS bits are set to 1. At the same time, the DLC value of 9 is converted to the binary form 1001, as shown in Figure 33.<\/p>

    \"\"
    Figure 33: Standard CAN FD frame matching 0x123 with DLC of 9<\/figcaption><\/figure>

    <\/p>

    (2) Then select the bit field of the interference is SOF, [trigger conditions] for SOF, [trigger offset] for the first bit is 0, as shown in Figure 34.<\/p>

    \"\"
    Figure 34: Selection of the bit field for interference is the SOF bit<\/figcaption><\/figure>

    (3) Set the number of disturbances to 20, as shown in Fig. 35.<\/p>

    \"Set
    Figure 35: Setting the number of disturbances to 20<\/figcaption><\/figure>

    (4) Then, after clicking Start Test, the interference effects on TSMaster and the oscilloscope are shown below:<\/p>

    \u2460 The message information error frame for TC1014 on TSMaster as a receiving node is 20 times, as shown in Figure 36.<\/p>

    \"\"
    Figure 36: Message information of the accepting node when interfering with the CAN FD SOF<\/figcaption><\/figure>

    <\/p>

    \u2461 On the oscilloscope, wired according to the diagram in Section 3.2, you can observe on the oscilloscope that the interference enable points to the SOF bit and the SOF bit is interfered with as a stealth bit with 20 error frames. This is shown in Figure 37 and Figure 38.<\/p>

    \"\"
    Figure 37: Interference Enable Pointing to SOF Bit<\/figcaption><\/figure>

    <\/p>

    \"\"
    Figure 38: 20 error frames generated by interfering with the CAN FD SOF<\/figcaption><\/figure>

    <\/p>

    Example 2: Here, the following operation is performed with the 7th bit of the data segment of the frame as the jamming target and 20 jamming times as the number of jamming attempts:<\/strong><\/p>

    (1) In order to implement the jamming, we first parse and convert the ID of the frame: convert ID 0x123 to the binary form 00100100011, and make sure that RTR\/RRS and IDE in the frame type are set to 0, and that the FDF and BRS bits are set to 1. At the same time, the DLC value of 9 is converted to the binary form 1001, as shown in Figure 39.<\/p>

    \"\"
    Figure 39: Standard CAN FD frame matching 0x123 with DLC of 9<\/figcaption><\/figure>

    <\/p>

    (2) Then select the bit field of the interference is DATA, [trigger conditions] for the DATAFIELD, [trigger offset] for the first bit is 6, as shown in Figure 40.<\/p>

    \"\"
    Figure 40: Bit field for selective interference is bit 7 of the data segment<\/figcaption><\/figure>

    <\/p>

    (3) Set the number of disturbances to 20, as shown in Fig. 41.<\/p>

    \"Set
    Figure 41: Setting the number of disturbances to 20<\/figcaption><\/figure>

    <\/p>

    (4) Then, after clicking Start Test, the interference effects on TSMaster and the oscilloscope are shown below:<\/p>

    \u2460 The message information error frame when TC1014 on TSMaster is acting as a receiver node is 20 times, as shown in Figure 42.<\/p>

    \"\"
    Figure 42: Message information of the accepting node when interfering with CAN FD DATA<\/figcaption><\/figure>

    <\/p>

    \u2461 On the oscilloscope, according to Section 3.2 TH7011 Mating Oscilloscope Physical Connection Methods of Diagram Wiring, you can observe on the oscilloscope that the interference enable is directed to bit 7 of DATA and that DATA bit 7 is interfered with as a dominant bit, and that there are 20 error frames. This is shown in Figure 43 and Figure 44.<\/p>

    <\/p>

    \"\"
    Figure 43: Interference enable pointing to DATA bit 7<\/figcaption><\/figure>
    \"\"
    Fig. 44: 20 error frames generated by interfering with CAN FD DATA bit7<\/figcaption><\/figure>
    <\/div>

    06 | <\/strong>BUSOFF test function of TH7011<\/strong><\/h2>

    TH7011 mainly interferes with the frames sent out by the DUT to make the DUT enter the BUSOFF state. In this process, using the [Message Information] module in the TSMaster tool or the waveforms on the oscilloscope, you can observe and analyze whether the DUT has the ability to recover automatically after entering the BUSOFF state and how long it takes to recover from the BUSOFF state to the normal state.<\/p>

    6.1 <\/strong>BUSOFF Test Configuration Procedure<\/strong><\/h3>

    1. know how to interfere with frames emitted from the DUT according to Chapter 5 TH7011 Whole Bit Interference:
    (1) Match the frames to be jammed and select the jamming bit field:
    (2) Configure the number of interferences: If you need to enter the BUSOFF state several times to test whether the device under test has a fast or slow recovery and recovery time: you can carry out unlimited interferences as shown in Figure 45, you can also configure the period and the number of times of repetition, for example, if you need to carry out the BUSOFF test for ten times, then you can set the period of 10, the number of repetitions is set to 32, as shown in Figure 46.<\/p>

    \"\"
    Figure 45: Unlimited Interference<\/figcaption><\/figure>

    <\/p>

    \"\"
    Figure 46: 320 interferences conducted<\/figcaption><\/figure>

    <\/p>

    (3) Configure the interference output according to the selected interference bit.
    (4) Click Start Test to jam the frames emitted by the DUT.<\/p>

    2. Use the message information or oscilloscope waveform to observe the point in time when the measured part enters BUSOFF, and record the time interval for resuming communication, which is the BUSOFF recovery time.<\/p>

    6.2 <\/strong>BUSOFF Test Example<\/strong><\/h3>

    In order to visualize how the TH7011 can effectively test the BUSOFF behavior of the DUT, a specific test scenario was constructed. In this scenario, the DUT is sending a standard CAN frame on the CAN bus with a clear parameter configuration: its ID is set to 0x123, it follows the format specification of a standard data frame, and the DLC indicates that it contains 8 bytes of data, as in Figure 47.<\/p>

    \"\"
    Figure 47: Example of a CAN frame with ID 0x123<\/figcaption><\/figure>

    The TH7011 device is then used to jam this transmitting CAN frame an unlimited number of times, with the jamming bit field in bit 7 of the data segment (the selection of this bit field can be adjusted according to the actual test requirements). Through this continuous jamming, we aim to trigger the DUT to enter the BUSOFF state continuously.<\/p>

    Next, we will detail the specific steps taken to implement this test and the test results in order to clearly demonstrate how the TH7011 can be utilized to evaluate the performance of the DUT in the BUSOFF state:<\/p>

    The TH7011 performs an unlimited number of interferences on the DUT:<\/strong><\/p>

    (1) According to the frame sent on the bus in Fig. 47, the [Arbitration Field] and [Control Field] of the upper unit of the jamming instrument are set as shown in Fig. 48, and the jamming bit field is selected as shown in Fig. 49.<\/p>

    \"\"
    Figure 48: Standard CAN frame matching 0x123 with DLC of 8<\/figcaption><\/figure>
    \"\"
    Figure 50: Bit field for selective interference is bit 7 of the data segment<\/figcaption><\/figure>

    <\/p>

    (2) Configure the number of jamming times: Here, unlimited jamming is performed as shown in Figure 50, and the number of jamming times can be configured according to the actual demand.<\/p>

    \"\"
    Figure 45: Unlimited Interference<\/figcaption><\/figure>

    (3) According to the selection of the interference bit to interfere with the output configuration: here interference with the seventh bit of the data segment that is, so at this time for strong display of the arbitration segment bit of the interference, as shown in Figure 51.<\/p>

    \"Selection
    Figure 51: Configuration of the jamming effect for selecting the jamming standard CAN frame data segment bit 7.<\/figcaption><\/figure>

    <\/p>

    (4) Observe the point in time when the measured part enters BUSOFF using the message information or the waveform of the oscilloscope, and record the time interval for resuming the communication, i.e. the BUSOFF recovery time.<\/p>

    Observe on the TSMaster's message information:<\/strong>
    \u2460 Ensure that the configurations of (1) (2) (3) are completed. Click [Start Recording] in [Analyze] - [Record and Playback] function of TSMaster to start recording messages;

    \u2461 Go to the upper panel of the jammer, click [Open Test] and wait for a few seconds;

    \u2462Click \"Terminate Test\" to end the test;

    \u2463 Play back the previously recorded messages on the TSMaster to find the error frames generated by the interference and switch the message information to relative time for analysis.

    \u2464 By observation it will be found that after 32 frames of error interference, the system enters the BUSOFF state:
    If the device under test does not have the BUSOFF recovery function at this time, then this is the time when the device under test stops participating in bus communication and can neither receive messages from the bus nor send messages to the bus, as shown in Figure 52;
    If it has the BUSOFF recovery state, then the BUSOFF recovery time is 0.002912 seconds, and the DUT will continue to participate in the bus after the BUSOFF recovery, as shown in Figure 53.

    \u2465 In order to determine whether the DUT is equipped with the fast or slow recovery function of BUSOFF, the same method as shown in Figure 53 can be used for observation. The specific steps are: observe and record the recovery time of each BUSOFF when playing back the message. If the recovery time of each time is approximately the same, it indicates that the device under test does not have the fast and slow recovery function; on the contrary, if there is a significant difference between the recovery time of the first period and the recovery time of the later period, it indicates that the device under test has the fast and slow recovery function.<\/p>

    \"\"
    Figure 52: Message information without BUSOFF recovery state<\/figcaption><\/figure>

    <\/p>

    \"\"
    Figure 53: Entry into BUSOFF after 32 error frames and BUSOFF recovery time<\/figcaption><\/figure>

    <\/p>

    Observation on an oscilloscope<\/strong>At this point, the physical wiring needs to be as described in Section 3.2 Physical Connection of the TH7011 Companion Oscilloscope:<\/strong><\/p>

    \u2460 After connecting the interference enable, you can clearly see the number of error frames generated from the waveform, such as Figure 54, you can see 32 error frames.<\/p>

    \"\"
    Figure 54: 32 Error Frames on Waveforms<\/figcaption><\/figure>

    <\/p>

    \u2461 By observing the waveform graph displayed on the oscilloscope (shown in Fig. 55), you can evaluate the BUSOFF recovery characteristics of the part under test. This is done by measuring the BUSOFF recovery time intervals between 32 adjacent waveform frames. If these time intervals are basically the same, it means that the DUT does not have BUSOFF fast or slow recovery mechanism, but only simple BUSOFF recovery; while if there is a significant difference in the time intervals, it means that the DUT has BUSOFF fast or slow recovery mechanism. It can be seen that the time interval of the following figure is consistent every time, so it only has a simple BUSOFF recovery function.<\/p>

    \"\"
    Figure 55: BUSOFF Recovery Time Shown on Waveforms<\/figcaption><\/figure>
    <\/div>

    <\/p>

    07 | <\/strong>Sample point test function of TH7011<\/strong><\/h2>

    This section describes the principles and test procedures of the TH7011 to test the sampling point of the DUT as well as the second sampling point.<\/p>

    7.1 <\/strong>Test DUT sampling point configuration<\/strong><\/h3>

    1.TH7011 test DUT sampling point test principle:<\/strong>
    The TH7011 searches for the sampling point of the DUT from right to left through the<\/p>

    \u2460 Performs intra-bit flip-flop jamming on bit 15 of the data segment of the frame sent by the jammer (at this point the jammer is the transmitting node and the DUT is the receiving node);
    \u2461 and start jamming at 90% of that bit;
    (iii) Gradually increase the interference range by 5 nanoseconds per cut;
    \u2463 Until an error frame appears, then it is considered that the sampling point of the measured part is found. Here, assuming that an error frame appears at the location of the interference to 80%, then it is considered that this is the sampling point of the measured part. As shown in Figure 56.<\/p>

    \"\"
    Figure 56: TH7011 Sample Point Test Principle<\/figcaption><\/figure>

    <\/p>

    2. Examples:<\/strong>
    In order to visualize how the TH7011 can effectively test the sample points of the DUT, we have chosen the TC1013 as the DUT and pre-configured the sample point parameters of the TC1013 in the TSMaster software. Specifically, we have set the sampling point of the arbitration segment to 75%, while the sampling point of the data segment is set to 80%, as shown in Figure 57.<\/p>

    \"\"
    Figure 57: Setting the Arbitration Segment and Data Segment Sampling Points for the TC1013<\/figcaption><\/figure>

    <\/p>

    Next, we will test the TC1013 using the TH7011 device, aiming to confirm whether the sampling points of the TC1013 in the arbitration field and data field match the parameters we set in TSMaster through actual measurements. The operation steps are as follows:<\/p>

    (1) Environment construction:<\/strong>
    \u2460 At this time, the physical layer wiring try to ensure that only the measured parts and the interferometer on the bus, to avoid the CAN card to bring some error.
    \u2461 Initialization of TH7011 is operated according to Section 4 Initialization of TH7011:.<\/p>


    (2) Description of the parameters of the sampling point test OP:<\/strong><\/p>

    \"\"
    Figure 58: Sample Point Test Interface<\/figcaption><\/figure>

    <\/p>

    \u2460 [ID]: Specify the CAN\/CAN FD frame ID used to test the location of the sampling point, which is required to avoid conflict with other nodes on the bus.<\/p>

    \u2461 [Preset Arbitration Segment\/Data Segment Sample Points]: Users are required to fill in the pre-set arbitration segment and data segment sample point values. During the sample point test, the jammer will use these preset values as its own sample points for effective communication with the DUT.<\/p>

    To ensure that the test runs smoothly, the user should preset the value of the sampling point to be smaller than the actual sampling point of the part under test. The reason for this is that if the preset value is too large, the sampling of the interferometer itself may be unnecessarily affected, thus affecting the accuracy of the test results.<\/p>

    \u2463 [Accuracy]: Find the sampling point according to the set sampling point test accuracy (in 5 nanoseconds).<\/p>

    \u2464 [Number of Tests]: Allows the user to customize the number of tests in each jamming cycle. Specifically, the TH7011 is capable of sending a specified number of messages for sample point testing at each cut (accuracy * 5) nanoseconds.<\/p>

    \u2465 [Timeout Time]: the timeout time for testing the sampling point, if it exceeds this time, the sampling point test will be stopped;<\/p>

    \u2466\u3010Open Sampling Test\/Stop Sampling Test\u3011\uff1aUsers can click to open the sampling point test after filling in the above \u2460-\u2468. When the test is completed, the sampling point test will be stopped automatically.<\/p>

    \u2467 [test results]: after the completion of the test, the test results column will show the results of this sampling point test, at this time the TH7011 test the arbitration section of the TC1013 and the data section of the sampling point in Figure 59. test results of the specific error analysis can be seen in Chapter 8.7 .<\/p>

    \"\"
    Figure 59: Tested Sampling Point Results<\/figcaption><\/figure>

    <\/p>

    7.2 <\/strong>TH7011 test second sample point<\/strong><\/h3>

    The Second Sample Point (SSP) is unique to the CAN FD protocol and is located in the second half of the bit time and is used to perform additional signal sampling to improve the reliability of data transmission. It is mainly used for bit error detection to ensure that the data sent by the transmitting node is consistent with the data received by the receiving node.<\/p>

    The TH7011 supports the use of the intra-bit interference module of its host computer to perform a test of the second sampling point of the piece under test, with the purpose of verifying that the transmitting node can detect possible bit errors through the second sampling point when sending data frames, and send error frames accordingly.<\/p>

    1. Interpretation of interference within the upper bit of the interferometer:<\/strong><\/p>

    Intra-bit interference is the process of de-defining the TICKS number to determine the range of interference within a whole bit. If the custom TICKS number is 200 at this point, then this corresponds to an interference range equal to the first 1000 nanoseconds of a whole bit (assuming a whole bit is 2000 nanoseconds).<\/p>

    (1) Calculation of No. of Ticks.
    Calculation formula: Bit time\/5 nanoseconds
    For example: at this time the baud rate of the data segment is 2000Kbps, then the bit time is 500 nanoseconds, 500\/5 = 100 nanoseconds, ticks is 100 nanoseconds.<\/p>

    (2) Sequence segment control:
    At this time, you can customize the TICKS for intra-bit interference, such as Figure 60: customize the TICKS for intra-bit interference is 200, then the interference effect at this time can be expressed as shown in Figure 61.<\/p>

    \"\"
    Figure 60: Interference TICKS within custom bits is 100<\/figcaption><\/figure>

    <\/p>

    \u2460 Entire bit: 2000 nanoseconds, representing 400ticks.
    \u2461 Customize TICKS to 200: i.e., from 0 nanoseconds to 1000 nanoseconds.  <\/p>

    \"\"
    Figure 61: Illustration of customized intra-bit interference TICKS is 100<\/figcaption><\/figure>

    <\/p>

    (3) Error frames will only occur if there is interference to the sampling point, for example, Figure 62.
    \u2460 Assuming a CAN FD data segment bus baud rate is 2000K, the bit time is 500 nanoseconds, a data segment bit is 100TICKS, the sampling point is 80% that is, at 80TICKS, the sampling point can be seen in the following figure at 400 nanoseconds.
    \u2461 If the customized TICKS is 50 TICKS at this time, the dotted line indicates the interference part, which cannot interfere with the sampling point to produce no error frame.
    \u2462 If the custom TICKS is 81TICKS at this point, the dotted line indicates the interference part, which interferes with the sampling point to generate an error frame.<\/p>

    \"\"
    Figure 62: Intra-bit interference generates an error frame only if it interferes with the sampling point<\/figcaption><\/figure>

    <\/p>

    2. Procedure for testing the second sampling point by the interferometer:<\/strong>
    (1) The DUT sends a CAN FD frame, in which case the DUT acts as the transmitting node.<\/p>

    (2) The jammer matches a CAN FD frame sent by the DUT via the host computer and performs simulated intra-bit jamming of this frame to test the second sample point of the DUT.<\/p>

    (3) Since the TH7011 does not have a direct second sampling point interface operation, it is necessary to combine the output configuration panel of the upper computer of the interference meter to carry out the in-bit interference operation, and combine it with an oscilloscope to observe the actual interference range:<\/p>

    1. Intra-bit interference is determined by defining the TICKS number to determine the range of interference within an integer bit. the TICKS number indicates the time unit for which the interference lasts, and the range and intensity of the interference can be varied by continually adjusting the TICKS number.<\/li>\n\n
    2. During data frame transmission, the jammer selects specific data bits for intra-bit jamming.<\/li>\n\n
    3. The response of the DUT is observed by continuously adjusting the interference range (i.e., the number of TICKS) within the whole bit. When the DUT sends out an error frame, it is considered that the interference touches the second sampling point at this point, thus determining the location and performance of the second sampling point.<\/li><\/ol>

      3. Examples:<\/strong>
      In order to visualize the steps and effects of the TH7011 on testing the second sampling point of the DUT, the TC1013 is selected as the DUT here and a specific test scenario is set up. In this scenario, we assume that the TC1013 sends out a frame: the frame ID is 0x123 and it is an FD frame, and its DLC is set to 8, as shown in Figure 63.<\/p>

      \"\"
      Figure 63: FD frames from the DUT<\/figcaption><\/figure>

      <\/p>

      At this time, it is necessary to first build the environment, then match the frame to be interfered, followed by selecting the Bit bits of the interfered data segment and the number of interferences, and finally constantly adjusting the TICKS of the intra-bit interferences, and judging the position of the second sampling point with the combination of the TSMaster and the oscilloscope. The specific operation steps are as follows:<\/p>

      (1) Environment construction:<\/strong>
      \u2460 Because it is necessary to test with the oscilloscope at this time, the physical layer wiring is wired in accordance with Section 3.2 TH7011 Matching Oscilloscope Physical Connection.
      \u2461 Initialization of TH7011 is performed according to Section 4.<\/p>

      (2) Match the frames to be jammed:<\/strong>According to the frame sent on the bus in Figure 63, the settings of the [Arbitration Field] and [Control Field] of the upper computer of the interferometer are shown in Figure 64.<\/p>

      \"\"
      Figure 64: Matching FD frames from Figure 63<\/figcaption><\/figure>

      <\/p>

      (3) Select the Bit position of the interfering data segment:<\/strong>
      The selection of the bit bits to be interfered with needs to follow a key principle: the dominant bit, which is located after the recessive bit, should be prioritized. This is because the resynchronization mechanism is an important means of ensuring that the clocks of the sender and the receiver are consistent in the communication process. The principle of \"resynchronization of the next dominant bit after the recessive bit\" suggests that the dominant bit appearing after the recessive bit is a reliable synchronization point. Selecting the dominant bit for interference ensures that the DUT can correctly use this synchronization point for resynchronization when interference occurs, thus testing its performance more accurately under interference conditions.<\/p>

      So using the frame sent in Figure 63 as an example, where the first byte of the data segment is 0xAA (i.e., the binary representation is 10101010), then bit 6 of the data segment is a dominant bit, located after a recessive bit. Therefore, choosing this bit for jamming makes full use of the resynchronization mechanism and ensures the accuracy and reliability of the test.<\/p>

      \"\"
      Figure 65: Interference with bit 6 of the FD frame data segment<\/figcaption><\/figure>

      <\/p>

      (4) Select the number of interferences:<\/strong>
      The recommendation is infinite jamming. Infinite jamming is mainly convenient to see if there will be any error frames in the TSMaster's message information.<\/p>

      \"\"
      Figure 66: Unlimited Interference<\/figcaption><\/figure>

      (5) Setting of output configuration i.e. setting of intra-bit interference:<\/strong>
      In the process of exploring the secondary sampling points, a right-to-left strategy is adopted here, and the position 88% of the data bits is selected as the initial interference starting point (this starting point and test strategy can be flexibly adjusted according to actual needs). Subsequently, the interference range is gradually extended in TICKS (each TICKS represents a time precision of 5 nanoseconds). If the generation of an error frame is not triggered during this process, we will continue to increase the interference range until an error frame is detected in the TSMaster message information, and the point of occurrence of this error frame is considered as the second sampling point of the DUT.<\/p>

      To ensure the accuracy of the secondary sampling point location, it is recommended to analyze it in conjunction with waveform data from an oscilloscope.<\/strong>The reason for this is that although the TH7011 is able to provide a theoretical calculation of the location of the secondary sampling point based on the TICKS value, the actual waveform may deviate from this calculation. This deviation is mainly attributed to the transmission delay of the signal between the transmitter and receiver, which may result in the TICKS value set on the host computer panel not being exactly the same as the time when the actual disturbance reaches the sampling point of the measured part. Therefore, assisted calibration by oscilloscope waveforms can be more effective in determining the precise sampling point location, thus enhancing the accuracy and confidence of the test.<\/p>

      A diagram of the above principle can be seen in Figure 67:<\/p>

      1. Interference bit selection: a bit in the data segment of the frame sent by the device under test.<\/li>\n\n
      2. The TH7011 initially interferes with the range of frames sent by the DUT: it starts interfering from bit 88%, where the red dashed line is the interference range.<\/li>\n\n
      3. Increase the range of interference: cut downward in 5 nanoseconds or 1 ticks.<\/li>\n\n
      4. Determine the location of the second sampling point: When the first error frame occurs here is considered by the interferometer to be the location of the second sampling point, assuming that the interference to the 79% location of the error frame, then this is considered to be the secondary sampling point of the measured part. The value of the second sampling point = (bit time one bit range - interference range \/ bit time one bit range) \u00d7 100%.<\/li><\/ol>
        \"\"
        Figure 67: Schematic illustration of the secondary sampling point test<\/figcaption><\/figure>

        <\/p>

        (6) Set up TICKS to locate internal interference and use TSMaster in conjunction with an oscilloscope to determine the location and performance of the second sampling point.<\/strong>
        \u2460 The interference is first applied starting from the 6th bit of the data segment, specifically from position 88% of this bit. The range of interference was set so that the first 88 TICKS were not interfered with and the subsequent 12 TICKS were interfered with, which corresponds to a total duration of 60 nanoseconds starting from 440 nanoseconds and continuing until 500 nanoseconds. Under this interference condition, no error frames were observed. Figure 68 illustrates the relevant settings of the jammer's upper computer, and it can be clearly seen that when the jamming range was set to 60 nanoseconds, no error frames appeared on the TSMaster's message information.<\/p>

        At the same time, the actual effect of the interference was also observed by means of an oscilloscope. As shown in Fig. 69, the interference range shown on the oscilloscope was approximately 72.7 nanoseconds.<\/p>

        \"\"
        Figure 68: Interference range of the upper computer at this point is 60 nanoseconds without error frames<\/figcaption><\/figure>

        <\/p>

        \"\"
        Figure 69: Interference range shown on the oscilloscope is around 72.7 nanoseconds<\/figcaption><\/figure>

        <\/p>

        \u2461 Then the interference range was continued to be increased, at which time the range of interference was set to not interfere with the first 85 TICKS and to interfere with the subsequent 15 TICKS, which corresponds to a total duration of 75 nanoseconds of interference starting at 425 nanoseconds and continuing until 500 nanoseconds. Under this interference condition, no error frames were observed. Figure 70 illustrates the relevant settings of the jammer's upper computer, and it can be clearly seen that when the jamming range was set to 75 nanoseconds, no error frames appeared on the TSMaster's message information.<\/p>

        At the same time, the actual effect of the interference was also observed by means of an oscilloscope. As shown in Fig. 71, the oscilloscope showed an interference range of about 87 nanoseconds.<\/p>

        \"\"
        Fig. 70: At this point the interference range of the host computer is 75 nanoseconds without error frames<\/figcaption><\/figure>

        <\/p>

        \"\"
        Figure 71: Interference range shown on oscilloscope is about 87 nanoseconds<\/figcaption><\/figure>

        <\/p>

         (iii) Continue to increase the interference range, gradually adjusting it downward in a range of TICKS until at this point the range of interference is set to not interfere with the first 79 TICKS and to interfere with the subsequent 21 TICKS, which corresponds to a total duration of 105 nanoseconds starting at 395 nanoseconds and continuing until 500 nanoseconds. Under this interference condition, the generation of error frames can be seen. Figure 72 shows the relevant settings of the jammer's upper computer, and it can be clearly seen that when the jamming range is set to 105 nanoseconds, the message information has the appearance of error frames.<\/p>

        At the same time, we also observed the actual effect of the interference by means of an oscilloscope. As shown in Fig. 73, an error frame appears on the oscilloscope, and Fig. 74 the interference range shown on the oscilloscope is about 118.5 nanoseconds. Then the secondary sampling point of the measured part can be considered to be about (381.5\/500) \u00d7 100% = 76.30% at this time.<\/p>

        \"\"
        Figure 72: Interference range of the host computer at this point is 105 nanoseconds for error frames to appear<\/figcaption><\/figure>

        <\/p>

        \"\"
        Figure 73: Error frame on oscilloscope<\/figcaption><\/figure>

        <\/p>

        \"\"
        Figure 74: Interference range shown on the oscilloscope is around 118.5 nanoseconds<\/figcaption><\/figure>

        <\/p>

        <\/div>

        08 | <\/strong>Q\/A Answers<\/strong><\/h2>

        8.1 Q: The TH7011 upper unit does not appear in TSMaster?<\/strong><\/h3>

        A:<\/strong><\/p>

        1. The TH7011 Upper Unit has been integrated directly into TSMaster October 14, 2024 and later versions and can be opened and used directly by the user.<\/li>\n\n
        2. Earlier Version Usage (for TSMaster February 28, 2024 and later, but earlier than October 14, 2024)
          The user has to add the function manually: