3 ms·

Does anyone know the safety implications of a multi drop bus like this for safety critical systems? Typically if one device fails, it can bring the entire netw

by edrxty 4y ago

Does anyone know the safety implications of a multi drop bus like this for safety critical systems? Typically if one device fails, it can bring the entire network down, hence why single drop buses have become popular for diverse networks

oakwhiz 4y ago
You should have a plan for network instability or outages that causes a safety stop for anything affected by that fault domain. If uptime is important then you might have two separate networks side-by-side. You can also split a large fault domain into a few smaller networks. There is also the possibility of being clever with how things are wired so that the PHY can be physically cut out of the bus by a watchdog, but that doesn't help with cable faults and introduces its own possibility for failures. It's also possible to have another set of emergency stop signal wires side by side with the digital communications in case there's an issue.
dragontamer 4y ago
Isn't CANbus a multi-drop bus? Do car companies run safety-critical functionality off of it? -------- My understanding is that 10BASE-T1S is a replacement for CANbus. Whatever CANbus does, 10BASE-T1S should do it better. It happens to be Ethernet (albeit a much slower Ethernet), but Ethernet/IP/TCP is something modern programmers understand better than UARTs / CANbus.
- PinguTS 4y ago
  Actually, CAN XL is just around the corner with up to 20 Mbps vs 10 Mbps of 10BaseT1S. The other difference is that CAN XL has a paylod of 2048 bytes and will have data link layer security from the get go. While 10BaseT1S has just a little bit over 1 kbytes and MACsec is still ery expansive. That said, both technologies are just prototypes and expected availability is in about 3 years.
  - eigen 4y ago
    > That said, both technologies are just prototypes and expected availability is in about 3 years. OnSemi claims to have a production 10Base-T1s MAC-PHY now. https://www.onsemi.com/products/interfaces/ethernet-controllers/ncn26010 https://www.onsemi.com/products/interfaces/ethernet-controll...
    - edrxty 4y ago
      I'm not an expert on automotive systems specifically, but in general with silicon level stuff like this when used in small, highly integrated systems, just having a PHY isn't nearly enough. Really, you want it to come baked into all the MCUs and MPUs your particular vertical uses so you don't need to waste time making your board designers wire up more shit and you can use the vendor library for your MCU instead of writing more shit. Most automotive microcontrollers come ready to go with a full CAN interface including all the libraries and such that you'd want, as well as dev boards that pin it out to whatever connector so you don't need to waste a board spin cycle creating an EDU.
- edrxty 4y ago
  So you kinda caught me here, I'm pulling my own vague spin on Cunningham's Law because in my industry (satellites) there has suddenly been some interest in using CAN for potentially fault-prone critical systems and this post caught my interest. Traditionally we use single ended buses for everything but traditionally we do a lot of things ¯\_(ツ)_/¯ 10BASE-T1S is also kind of interesting in the same way, especially if it's potentially possible to use an existing linux network stack on top of it.
panax 4y ago
In 10BASE-T1S a device can fail but it won't impact the other nodes on the bus unless there is a physical failure in the wire at the connector. All the nodes are wired together on the same cable and see the same data. The device doesn't need to do anything for the other nodes to receive the data.
- oasisbob 4y ago
  Couldn't a failure in the PHY also cause a significant enough impedance change to be problematic?
  - elcritch 4y ago
    If its like regular ethernet, then the PHY connects through magnetics. That shouldn't affect the line impedance.
PinguTS 4y ago
First of all: this is multidrop. So if a single device fails, there is no immediate feedback to the network meaning all the other devices can still communicate with each other. This different to all other Ethernet-based solution, which requires some sort of switch either central or distributed within each device. When something fails here, it has much deeper impact. About 5 years ago GM thought about this and required switches within each and every device. Then signals should be transmitted redundantly parallel over different links. The problem here is the proper dedublication and verification of the data. Because that costs ressources in terms of time and compute power and memory.

by edrxty 4y ago

oakwhiz 4y ago

You should have a plan for network instability or outages that causes a safety stop for anything affected by that fault domain. If uptime is important then you might have two separate networks side-by-side. You can also split a large fault domain into a few smaller networks. There is also the possibility of being clever with how things are wired so that the PHY can be physically cut out of the bus by a watchdog, but that doesn't help with cable faults and introduces its own possibility for failures. It's also possible to have another set of emergency stop signal wires side by side with the digital communications in case there's an issue.

dragontamer 4y ago

Isn't CANbus a multi-drop bus? Do car companies run safety-critical functionality off of it? -------- My understanding is that 10BASE-T1S is a replacement for CANbus. Whatever CANbus does, 10BASE-T1S should do it better. It happens to be Ethernet (albeit a much slower Ethernet), but Ethernet/IP/TCP is something modern programmers understand better than UARTs / CANbus.

PinguTS 4y ago
Actually, CAN XL is just around the corner with up to 20 Mbps vs 10 Mbps of 10BaseT1S. The other difference is that CAN XL has a paylod of 2048 bytes and will have data link layer security from the get go. While 10BaseT1S has just a little bit over 1 kbytes and MACsec is still ery expansive. That said, both technologies are just prototypes and expected availability is in about 3 years.
- eigen 4y ago
  > That said, both technologies are just prototypes and expected availability is in about 3 years. OnSemi claims to have a production 10Base-T1s MAC-PHY now. https://www.onsemi.com/products/interfaces/ethernet-controllers/ncn26010 https://www.onsemi.com/products/interfaces/ethernet-controll...
  - edrxty 4y ago
    I'm not an expert on automotive systems specifically, but in general with silicon level stuff like this when used in small, highly integrated systems, just having a PHY isn't nearly enough. Really, you want it to come baked into all the MCUs and MPUs your particular vertical uses so you don't need to waste time making your board designers wire up more shit and you can use the vendor library for your MCU instead of writing more shit. Most automotive microcontrollers come ready to go with a full CAN interface including all the libraries and such that you'd want, as well as dev boards that pin it out to whatever connector so you don't need to waste a board spin cycle creating an EDU.
edrxty 4y ago
So you kinda caught me here, I'm pulling my own vague spin on Cunningham's Law because in my industry (satellites) there has suddenly been some interest in using CAN for potentially fault-prone critical systems and this post caught my interest. Traditionally we use single ended buses for everything but traditionally we do a lot of things ¯\_(ツ)_/¯ 10BASE-T1S is also kind of interesting in the same way, especially if it's potentially possible to use an existing linux network stack on top of it.

panax 4y ago

In 10BASE-T1S a device can fail but it won't impact the other nodes on the bus unless there is a physical failure in the wire at the connector. All the nodes are wired together on the same cable and see the same data. The device doesn't need to do anything for the other nodes to receive the data.

oasisbob 4y ago
Couldn't a failure in the PHY also cause a significant enough impedance change to be problematic?
- elcritch 4y ago
  If its like regular ethernet, then the PHY connects through magnetics. That shouldn't affect the line impedance.

PinguTS 4y ago

First of all: this is multidrop. So if a single device fails, there is no immediate feedback to the network meaning all the other devices can still communicate with each other. This different to all other Ethernet-based solution, which requires some sort of switch either central or distributed within each device. When something fails here, it has much deeper impact. About 5 years ago GM thought about this and required switches within each and every device. Then signals should be transmitted redundantly parallel over different links. The problem here is the proper dedublication and verification of the data. Because that costs ressources in terms of time and compute power and memory.