Patent Description:
Controller area network (CAN) systems have one or more devices attached to a CAN bus by a CAN chip. The one or more devices communicate with each other by a CAN bus. The one or more devices receive CAN data payload from each other by the CAN bus. However, integrity of the CAN data payload received from the CAN bus is only checked by the CAN chip, and some CAN chips do not provide any safety integrity levels (SIL). Moreover, CAN chips may fail or be corrupted thereby reducing the integrity of the CAN data payload. Furthermore, the health of CAN chips are not even checked thereby further corrupting the CAN data payload. Thus, the reliability of the CAN data payload may be corrupted, and does not satisfy high levels of safety integrity.

European patent application <CIT> discloses a method for operating a system coupled with a master device and slave devices through a bus system. A master device may comprise an access point to a first communication bus such as a CAN bus, an access point to a second communication bus, a transceiver circuit for cooperation with the second communication bus and a transceiver circuit such as a CAN FD transceiver, for cooperation with the first communication bus. Safety features are present in the form of failure detection. Chinese patent application <CIT> discloses a separated dual-Ethernet based double Controller Area Network communication system, having a bus isolating unit connected with a main control unit by a lead wire, and a Controller Area Network bus unit connected with a primary user interface unit.

One or more embodiments are illustrated by way of example, and not by limitation, in the figures of the accompanying drawings, wherein elements having the same reference numeral designations represent like elements throughout. It is emphasized that, in accordance with standard practice in the industry various features may not be drawn to scale and are used for illustration purposes only. In fact, the dimensions of the various features in the drawings may be arbitrarily increased or reduced for clarity of discussion.

The following disclosure provides many different embodiments, or examples, for implementing different features of the provided subject matter. Specific examples of components, values, operations, materials, arrangements, or the like, are described below to simplify the present disclosure. These are, of course, merely examples and are not intended to be limiting. Other components, values, operations, materials, arrangements, or the like, are contemplated. For example, the formation of a first feature over or on a second feature in the description that follows may include embodiments in which the first and second features are formed in direct contact, and may also include embodiments in which additional features may be formed between the first and second features, such that the first and second features may not be in direct contact.

<FIG> is a diagram of a system <NUM>, in accordance with one or more embodiments.

System <NUM> includes a device <NUM> coupled to a computer system <NUM> by a controller area network (CAN) bus <NUM>. In some embodiments, system <NUM> is associated with a vehicle, ships, planes, electric vehicle batteries, machinery and the like. In some embodiments, one or more portions of system <NUM> is located on the vehicle (not shown), ships, planes, electric vehicle batteries, machinery and the like. In some embodiments, a vehicle includes trains, cars, trucks, buses, tractors, or the like.

Device <NUM> includes a CAN chip <NUM>. CAN chip <NUM> is coupled to CAN bus <NUM>. In some embodiments, a CAN chip corresponds to a CAN node. In some embodiments, a CAN node includes at least a central processing unit (CPU), a CAN controller or a transceiver.

In some embodiments, device <NUM> corresponds to one or more sensors, actuators, or other control devices. In some embodiments, device <NUM> corresponds to one or more electronic control units (ECUs). In some embodiments, device <NUM> includes other elements (not shown) including one or more processors coupled to memory and further coupled to the one or more sensors, actuators, or other control devices. In some embodiments, device <NUM> is standardized and is not modified to function within system <NUM>.

Computer system <NUM> is configured to communicate and control device <NUM> by CAN bus <NUM>. In some embodiments, computer system <NUM> is a computer-based system configured to execute one or more functions including safety functions that include high levels of safety integrity. For example, in some embodiments, computer system <NUM> satisfies safety integrity level <NUM> (SIL <NUM>). Other safety integrity levels are within the scope of the present disclosure.

Computer system <NUM> includes a CAN chip <NUM> and a CAN chip <NUM>. CAN chip <NUM> and CAN chip <NUM> are coupled together by a same or common CAN bus (e.g., CAN bus <NUM>). At least CAN chip <NUM> or CAN chip <NUM> is coupled to CAN chip <NUM> by CAN bus <NUM>. At least CAN chip <NUM> or CAN chip <NUM> are configured to send/receive CAN frames to/from CAN chip <NUM> by CAN bus <NUM>. In some embodiments, CAN chips <NUM> and <NUM> are configured to send/receive CAN frames to each other by CAN bus <NUM>. In some embodiments, computer system <NUM> is also referred to as a CAN system.

CAN chip <NUM> is different from CAN chip <NUM>. In some embodiments, a different CAN chip includes CAN chips that are manufactured by different entities. In some embodiments, CAN chip <NUM> is the same as CAN chip <NUM>. In some embodiments, a same CAN chip includes CAN chips that are manufactured by the same entity.

In some embodiments, CAN chips <NUM> and <NUM> are configured to perform a cyclic redundancy check (CRC) of received CAN frames from CAN chip <NUM>, strip off the CRC and forward the remaining portion of the CAN frame (hereinafter referred to as "remaining CAN frame") to a CAN frames comparison portion <NUM>. The remaining CAN frame includes a CAN frame payload (hereinafter referred to as "payload"), CAN frame ID (hereinafter referred to as "ID") and other data.

In some embodiments, CAN chip <NUM> is configured to perform a CRC of received CAN frames from at least CAN chip <NUM> or <NUM>, strip off the CRC and forward the remaining CAN frame to other elements (not shown) within device <NUM>.

Computer system <NUM> further includes a CAN frames comparison portion <NUM>. CAN frames comparison portion <NUM> is coupled to CAN chip <NUM> and CAN chip <NUM>. In some embodiments, CAN frames comparison portion <NUM> is a controller. In some embodiments, CAN frames comparison portion <NUM> is a processor (shown in <FIG>). CAN frames comparison portion <NUM> is configured to detect a failure of at least CAN chip <NUM> or CAN chip <NUM>. In some embodiments, a failure is a deviation from a specified performance of system <NUM> or the consequence of a fault or error in system <NUM>. In some embodiments, a failure includes random failures and systemic failures. In some embodiments, random failures include a failure that occurs randomly in time. In some embodiments, systemic failures include a failure that occurs repeatedly under some particular combination of inputs, or under some particular environmental condition.

In some embodiments, failure of at least CAN chip <NUM> or CAN chip <NUM> results in the corresponding failed CAN chip forwarding corrupted data (e.g., frames) to CAN frames comparison portion <NUM> or other portions (e.g., system <NUM> in <FIG>) of computer system <NUM>.

CAN frames comparison portion <NUM> is configured to detect a failure of at least CAN chip <NUM> or CAN chip <NUM> by comparing the remaining portion of CAN frames (hereinafter referred to as "remaining CAN frames") received from each of CAN chip <NUM> and CAN chip <NUM> during a CAN comparison period. In some embodiments, a CAN comparison period is a maximum time between a remaining CAN frame received from CAN chip <NUM> and a remaining CAN frame received from CAN chip <NUM>. In some embodiments, if a failure is detected, then a redundant system such as system <NUM> (<FIG>) or system <NUM> (<FIG>) are used. In some embodiments, the comparison period ranges from about <NUM> milliseconds (ms) to about <NUM>. In some embodiments, the comparison period is a function of the number of CAN frames that are to be compared. In some embodiments, if the comparison period is less than <NUM>, then the comparison period may not provide sufficient time for CAN frames to be received, and processed by system <NUM> in order for a comparison. In some embodiments, if the comparison period is greater than <NUM>, then the comparison period may cause unwanted delay of CAN frames, and unwanted delay in the payload of the CAN frames useable by system <NUM>.

If the remaining CAN frames received from both independent chips are identical, then both CAN chip <NUM> and CAN chip <NUM> have not failed, and data (e.g., remaining CAN frames) sent from device <NUM> to CAN chips <NUM> and <NUM> is not corrupted by the failed CAN chips, and is therefore trusted or reliable. For example, in some embodiments, if the payload received from both independent chips is identical, then both CAN chip <NUM> and CAN chip <NUM> have not failed, and payload sent from device <NUM> to CAN chips <NUM> and <NUM> is not corrupted by the failed CAN chips, and is therefore trusted or reliable.

In some embodiments, if the CAN frame payload from CAN chip <NUM> is missing or not available within the CAN comparison period, then CAN frames comparison portion <NUM> determines that a failure of at least CAN chip <NUM> occurred.

In some embodiments, if the remaining CAN frame from CAN chip <NUM> or the remaining CAN frame from CAN chip <NUM> is missing or not available within a CAN timeout, then CAN frames comparison portion <NUM> determines that a failure occurred with the CAN chip (<NUM> or <NUM>) with the missing or unavailable CAN frame. In some embodiments, a CAN timeout is the maximum time without any remaining CAN frame on CAN bus <NUM>.

If the content of the remaining CAN frames from corresponding CAN chips <NUM> and <NUM> are not identical within the CAN comparison period, then CAN frames comparison portion <NUM> determines that a failure of at least CAN chip <NUM> or <NUM> occurred.

By using at least two CAN chips (<NUM> and <NUM>) and CAN frames comparison portion <NUM>, computing system <NUM> is able to detect failures in at least CAN chip <NUM> or CAN chip <NUM>, thereby preventing or reducing the number of corrupted frames in the transmission layer (e.g., CAN bus) that passes through computing system <NUM>. By reducing the number of corrupted frames that passes through computing system <NUM> results in more reliable data thereby increasing the safety level of system <NUM> and reducing system errors.

Furthermore, system <NUM> improves reliability of data from device <NUM> without modifying the firmware CAN chip <NUM>, <NUM> or <NUM>.

Moreover, system <NUM> improves reliability of data from device <NUM> without adding CRC or other types of safety code signature protection to the data generated by device <NUM> thereby reducing CAN bus network traffic.

Other quantities, configurations or order of elements within system <NUM> are within the scope of the present disclosure. For example, in some embodiments, system <NUM> includes more than two CAN chips.

System <NUM> is a variation of system <NUM> of <FIG>, and similar detailed description is therefore omitted. In comparison with system <NUM>, system <NUM> further includes a computer system <NUM>. In some embodiments, computer system <NUM> is a redundant system.

Components that are the same or similar to those in one or more of <FIG> (shown below) are given the same reference numbers, and detailed description thereof is thus omitted. In some embodiments, <FIG> include additional elements not shown in <FIG>.

Computer system <NUM> is similar to computer system <NUM>, and similar detailed description is omitted for brevity. In some embodiments, computer system <NUM> is a redundant version of system <NUM>. For example, in some embodiments, if a failure of CAN chip <NUM> or CAN chip <NUM> is detected by system <NUM>, then switchover is performed to a redundant system, such as computer system <NUM>. In some embodiments, prior to switchover to the redundant system, computer system <NUM> is not operational, and after switchover, computer system <NUM> is operational. In some embodiments, prior to switchover to the redundant system, computer system <NUM> is operational, and after switchover, computer system <NUM> remains operational, but computer system <NUM> is not operational.

Computer system <NUM> includes a CAN chip <NUM>, a CAN chip <NUM> and a CAN frames comparison portion <NUM>.

CAN chip <NUM> is similar to CAN chip <NUM>, CAN chip <NUM> is similar to CAN chip <NUM>, CAN frames comparison portion <NUM> is similar to CAN frames comparison portion <NUM>, and similar detailed description is omitted for brevity.

CAN chip <NUM> and CAN chip <NUM> are coupled together by CAN bus <NUM>. At least CAN chip <NUM> or CAN chip <NUM> is coupled to CAN chip <NUM> by CAN bus <NUM>. CAN chip <NUM> is different from CAN chip <NUM>. In some embodiments, CAN chip <NUM> is the same as CAN chip <NUM>. In some embodiments, CAN chip <NUM> is different from CAN chip <NUM>. In some embodiments, CAN chip <NUM> is the same as CAN chip <NUM>. In some embodiments, CAN chip <NUM> is different from CAN chip <NUM>. In some embodiments, CAN chip <NUM> is the same as CAN chip <NUM>.

By including computer system <NUM> in system <NUM>, system <NUM> operates to achieve the benefits discussed above with respect to system <NUM>.

Other quantities, configurations or order of elements within system <NUM> are within the scope of the present disclosure. For example, in some embodiments, system <NUM> includes a number of CAN chips different than five.

System <NUM> is a variation of system <NUM> of <FIG>, and similar detailed description is therefore omitted. In comparison with system <NUM>, system <NUM> further includes a system <NUM>. In some embodiments, system <NUM> is a redundant system.

System <NUM> is similar to system <NUM>, and similar detailed description is omitted for brevity. In some embodiments, system <NUM> is a redundant version of system <NUM>. For example, in some embodiments, if a failure of CAN chip <NUM> or CAN chip <NUM> is detected by system <NUM>, then switchover is performed to a redundant system, such as system <NUM>. In some embodiments, prior to switchover to the redundant system, system <NUM> is not operational, and after switchover, system <NUM> is operational. In some embodiments, prior to switchover to the redundant system, system <NUM> is operational, and after switchover, system <NUM> remains operational, but system <NUM> is not operational.

System <NUM> includes a device <NUM> coupled to a computer system <NUM> by a CAN bus <NUM>. Device <NUM> includes a CAN chip <NUM>. CAN chip <NUM> is coupled to CAN bus <NUM>.

Device <NUM> is similar to device <NUM>, CAN chip <NUM> is similar to CAN chip <NUM>, CAN bus <NUM> is similar to CAN bus <NUM>, computer system <NUM> is similar to computer system <NUM>, and similar detailed description is omitted for brevity.

Computer system <NUM> includes a CAN chip <NUM>, a CAN chip <NUM> and a CAN frames comparison portion <NUM>. CAN chip <NUM> is similar to CAN chip <NUM>, CAN chip <NUM> is similar to CAN chip <NUM>, CAN frames comparison portion <NUM> is similar to CAN frames comparison portion <NUM>, and similar detailed description is omitted for brevity.

CAN chip <NUM> and CAN chip <NUM> are coupled together by CAN bus <NUM>. At least CAN chip <NUM> or CAN chip <NUM> is coupled to CAN chip <NUM> by CAN bus <NUM>. CAN chip <NUM> is different from CAN chip <NUM>. In some embodiments, CAN chip <NUM> is the same as CAN chip <NUM>.

In some embodiments, CAN chip <NUM> is different from CAN chip <NUM>. In some embodiments, CAN chip <NUM> is the same as CAN chip <NUM>. In some embodiments, CAN chip <NUM> is different from CAN chip <NUM>. In some embodiments, CAN chip <NUM> is the same as CAN chip <NUM>.

By including system <NUM> in system <NUM>, system <NUM> operates to achieve the benefits discussed above with respect to system <NUM>.

Other quantities, configurations or order of elements within system <NUM> are within the scope of the present disclosure. For example, in some embodiments, system <NUM> includes a number of CAN chips different than six.

System <NUM> is an embodiment of system <NUM> of <FIG>, and similar detailed description is therefore omitted.

System <NUM> includes device <NUM>, CAN chip <NUM>, CAN bus <NUM> and a computer system <NUM>.

Computer system <NUM> is an embodiment of computer system <NUM> of <FIG>, and similar detailed description is therefore omitted.

Computer system <NUM> includes a converter circuit <NUM> coupled to a system portion 410A by an Ethernet link <NUM>.

Converter circuit <NUM> is coupled to CAN chip <NUM> of device <NUM> by CAN bus <NUM>. Converter circuit <NUM> is configured to send/receive CAN frames to/from CAN chip <NUM> by CAN bus <NUM>.

Converter circuit <NUM> is coupled to an Ethernet interface (shown in <FIG> as network interface <NUM>) of system portion 410A by Ethernet link <NUM>. In some embodiments, Ethernet link <NUM> includes an Ethernet network. Ethernet link <NUM> is configured to carry Ethernet packets between converter circuit <NUM> and system portion 410A. Converter circuit <NUM> is configured to convert Ethernet packets into CAN frames, and send the CAN frames to CAN chip <NUM> by CAN bus <NUM>. Converter circuit <NUM> is configured to convert CAN frames into Ethernet packets, and send the Ethernet packets to system portion 410A by Ethernet link <NUM>.

Other types of network links for system <NUM>, <NUM>, <NUM>, 700A and 700B are within the scope of the present disclosure. For example, in some embodiments, Ethernet link <NUM> is replaced by a different type of network link, and the Ethernet interface of system portion 410A is replaced with a different type of network interface.

System portion 410A includes at least a processor <NUM> (<FIG>), a memory <NUM> (<FIG>), a bus <NUM> (<FIG>). In some embodiments, system <NUM> of <FIG> is an embodiment of system portion 410A.

Converter circuit <NUM> includes a CAN chip <NUM>, a CAN chip <NUM> and a processor <NUM>.

CAN chip <NUM> is similar to CAN chip <NUM>, CAN chip <NUM> is similar to CAN chip <NUM>, and similar detailed description is omitted for brevity.

CAN chip <NUM> is coupled to processor <NUM> by an interface <NUM>. CAN chip <NUM> is coupled to processor <NUM> by an interface <NUM>. At least interface <NUM> or <NUM> is an interface internal of converter circuit <NUM>. In some embodiments, at least interface <NUM> or <NUM> corresponds to memory. In some embodiments, at least interface <NUM> or <NUM> corresponds to inter-integrated circuit (I<NUM>C). In some embodiments, at least interface <NUM> or <NUM> corresponds to serial peripheral interface (SPI).

Processor <NUM> is coupled to the Ethernet interface of system portion 410A by Ethernet link <NUM>. At least processor <NUM> or system portion 410A is an embodiment of CAN frames comparison portion <NUM> of <FIG>, and similar detailed description is therefore omitted. In some embodiments, processor <NUM> is a CPU. In some embodiments, processor <NUM> is a controller. In some embodiments, processor <NUM> is a micro-controller unit (MCU).

In some embodiments, system portion 410A is configured to detect a failure of at least CAN chip <NUM> or CAN chip <NUM>. For example, in some embodiments, CAN chips <NUM> and <NUM> are configured to receive the same CAN frames from device <NUM>, and CAN chips <NUM> and <NUM> are configured to strip off the CRC and forward the remaining CAN frame to processor <NUM>. In these embodiments, processor <NUM> is configured to forward or pass the remaining CAN frame to system portion 410A. In these embodiments, system portion 410A is configured to detect a failure of at least CAN chip <NUM> or CAN chip <NUM> by executing a frame comparison similar to the frame comparison performed by CAN frames comparison portion <NUM> in <FIG>, and similar detailed description is omitted for brevity.

In some embodiments, processor <NUM> is configured to detect a failure of at least CAN chip <NUM> or CAN chip <NUM>, and send failure notifications to system portion 410A. For example, in some embodiments, CAN chips <NUM> and <NUM> are configured to receive the same CAN frames from device <NUM>, and CAN chips <NUM> and <NUM> are configured to strip off the CRC and forward the remaining CAN frame to processor <NUM>. In these embodiments, processor <NUM> is configured to detect a failure of at least CAN chip <NUM> or CAN chip <NUM> by executing a frame comparison similar to the frame comparison performed by CAN frames comparison portion <NUM> in <FIG>, and similar detailed description is omitted for brevity.

In these embodiments, by having processor <NUM> configured to perform frame comparison to detect a failure of at least CAN chip <NUM> or CAN chip <NUM>, processor <NUM> is configured to send less traffic to system portion 410A which thereby reduces traffic sent over Ethernet link <NUM>. In some embodiments, the traffic is reduced by <NUM>%. In these embodiments, processor <NUM> is further configured to execute health checks of CAN chip <NUM> and <NUM>, such as memory tests, voltage monitoring and current monitoring, to ensure the integrity of CAN frames comparison.

Other quantities, configurations or order of elements within system <NUM> are within the scope of the present disclosure. For example, in some embodiments, system <NUM> includes a number of CAN chips different than three.

System <NUM> includes device <NUM>, CAN chip <NUM>, CAN bus <NUM> and a computer system <NUM>. Computer system <NUM> is an embodiment of computer system <NUM> of <FIG>, and similar detailed description is therefore omitted.

Computer system <NUM> is a variation of computer system <NUM> of <FIG>, and similar detailed description is therefore omitted. In comparison with computer system <NUM> of <FIG>, computer system <NUM> includes a converter circuit <NUM> rather than converter circuit <NUM>, and similar detailed description is therefore omitted. Stated differently, converter circuit <NUM> of computer system <NUM> replaces converter circuit <NUM> of computer system <NUM> in <FIG>, and similar detailed description is therefore omitted.

Computer system <NUM> includes a converter circuit <NUM> coupled to system portion 410A by Ethernet link <NUM>. Converter circuit <NUM> is a variation of converter circuit <NUM> of <FIG>, and similar detailed description is therefore omitted.

Converter circuit <NUM> includes CAN chip <NUM>, CAN chip <NUM> and a processor <NUM>. Processor <NUM> is similar to processor <NUM>, and similar detailed description is omitted for brevity.

Processor <NUM> includes a CAN frame data pass through portion <NUM> and a Calculate CRC portion <NUM>. In some embodiments, system portion 410A is configured to detect a failure of CAN chip <NUM> and CAN chip <NUM> by having processor <NUM> configured with CAN frame data pass through portion <NUM> and Calculate CRC portion <NUM>.

In some embodiments, CAN frame data pass through portion <NUM> and Calculate CRC portion <NUM> are portions or regions within processor <NUM>. In some embodiments, processor <NUM> includes at least two processors, and CAN frame data pass through portion <NUM> is part of a first processor of the at least two processors in processor <NUM> and Calculate CRC portion <NUM> is part of a second processor of the at least two processors in processor <NUM>.

In some embodiments, CAN frame data pass through portion <NUM> is configured to execute instructions to pass CAN frames to system portion 410A. In some embodiments, Calculate CRC portion <NUM> is configured to execute instructions to calculate a CRC on remaining CAN frames and send them to system portion 410A.

In some embodiments, system portion 410A is configured to detect a failure of CAN chip <NUM> and CAN chip <NUM>. For example, in some embodiments, CAN chips <NUM> and <NUM> are configured to receive the same CAN frames from device <NUM>, and CAN chips <NUM> and <NUM> are configured to strip off the CRC and forward the remaining CAN frame to each of CAN frame data pass through portion <NUM> and Calculate CRC portion <NUM>.

In these embodiments, CAN frame data pass through portion <NUM> is configured to receive the remaining CAN frame from CAN chip <NUM>, and pass the at least a first CAN frame data payload <NUM> of the remaining CAN frame received from CAN chip <NUM> to system portion 410A by Ethernet link <NUM>.

In these embodiments, Calculate CRC portion <NUM> is configured to receive the remaining CAN frame from CAN chip <NUM>, determine a first CRC <NUM> or other safety code signature on a second CAN frame data payload of the remaining CAN frame received from CAN chip <NUM>, and is configured to pass the first CRC <NUM> to system portion 410A by Ethernet link <NUM>.

In these embodiments, system portion 410A is configured to receive the first CAN frame data payload <NUM> and the first CRC <NUM>, is configured to determine a second CRC <NUM> based on the first CAN frame data payload <NUM>, and is configured to compare the first CRC <NUM> and the second CRC <NUM> to each other. In these embodiments, system portion 410A is configured to determine that a failure of at least CAN chip <NUM> or CAN chip <NUM> occurred in response to determining that the first CRC <NUM> is not identical to the second CRC <NUM>, and therefore the CAN frame payload data <NUM> is not trusted or not reliable. In these embodiments, system portion 410A is configured to determine that the failure of at least CAN chip <NUM> or CAN chip <NUM> did not occur in response to determining that the first CRC <NUM> is identical to the second CRC <NUM>, and therefore the CAN frame payload data <NUM> is trusted or reliable.

Computer system <NUM> is a variation of computer system <NUM> of <FIG>, and similar detailed description is therefore omitted. In comparison with computer system <NUM> of <FIG>, computer system <NUM> includes converter circuits 620a and 620b rather than converter circuit <NUM>, and similar detailed description is therefore omitted. Stated differently, converter circuits 620a and 620b of computer system <NUM> replace converter circuit <NUM> of computer system <NUM> in <FIG>, and similar detailed description is therefore omitted.

Computer system <NUM> includes converter circuits 620a and 620b coupled to system portion 410A by Ethernet link <NUM>. Each of converter circuit 620a and 620b is a variation of converter circuit <NUM> of <FIG>, and similar detailed description is therefore omitted. In some embodiments, converter circuit 620a and 620b are coupled to system portion 410A by separate network links.

Converter circuit 620a includes CAN chip <NUM> and a processor 630a. Processor 630a is similar to processor <NUM>, and similar detailed description is omitted for brevity.

Converter circuit 620b includes CAN chip <NUM> and a processor 630b. Processor 630b is similar to processor <NUM>, and similar detailed description is omitted for brevity. Converter circuit 620a is different from converter circuit 620b. In some embodiments, converter circuit 620a and converter circuit 620b are manufactured by different entities. In some embodiments, at least converter circuit 620a or 620b includes a different number of processors or CAN chips.

CAN chip <NUM> is coupled to processor 630a by an interface <NUM>. CAN chip <NUM> is coupled to processor 630b by an interface <NUM>. At least interface <NUM> or <NUM> is an interface internal of corresponding converter circuit 620a or 620b. In some embodiments, interfaces <NUM> and <NUM> are similar to corresponding interfaces <NUM> and <NUM>, and similar detailed description is omitted for brevity.

In some embodiments, system portion 410A is configured to detect a failure of at least CAN chip <NUM> or CAN chip <NUM>. For example, in some embodiments, CAN chips <NUM> and <NUM> are configured to receive the same CAN frames from device <NUM>, and CAN chips <NUM> and <NUM> are configured to strip off the corresponding CRCs and forward the corresponding remaining CAN frames <NUM> and <NUM> to corresponding processors 630a and 630b.

In these embodiments, processor 630a is configured to forward or pass the remaining CAN frame <NUM> to system portion 410A, and processor 630a is configured to forward or pass the remaining CAN frame <NUM> to system portion 410A.

In these embodiments, system portion 410A is configured to detect a failure of at least CAN chip <NUM> or CAN chip <NUM> by executing a frame comparison of remaining CAN frames <NUM> and <NUM> that is similar to the frame comparison performed by CAN frames comparison portion <NUM> in <FIG>, and similar detailed description is omitted for brevity.

<FIG> is a diagram of a system 700A, in accordance with one or more embodiments.

System 700A is an embodiment of system <NUM> of <FIG>, and similar detailed description is therefore omitted.

System 700A includes device <NUM>, CAN chip <NUM>, CAN bus <NUM> and computer system <NUM>.

System 700A is a variation of system <NUM> of <FIG>, and similar detailed description is therefore omitted. For example, in some embodiments, system 700A corresponds to a first end-to-end check or test of computer system <NUM> of system <NUM>. In some embodiments, the first end-to-end check of computer system <NUM> of system 700A or 700B (<FIG>) is similar to method <NUM> in <FIG> (described below).

In some embodiments, the first end-to-end check of computer system <NUM> of system 700A includes sending a first known data string 750a through computer system <NUM> by a first path. In some embodiments, the first path is from computer system <NUM> to CAN chip <NUM> to CAN chip <NUM> and back to computer system <NUM>. In some embodiments, the data string includes CAN frames.

In some embodiments, the first end-to-end check of computer system <NUM> of system 700A includes computer system <NUM> being configured to send the first known data string 750a to CAN chip <NUM> by a link 740a, CAN chip <NUM> being configured to send a CAN frame based on the first known data string 750a to CAN chip <NUM> by path 706a (e.g., over CAN bus <NUM>), CAN chip <NUM> being configured to receive the CAN frame from CAN chip <NUM>, and CAN chip <NUM> being configured to send the remaining CAN frame, that includes another first data string 752a, to computer system <NUM> by a link 742a. In these embodiments, computer system <NUM> compares the first known data string 750a and the another first data string 752a to determine if there is a match. In some embodiments, computer system <NUM> detects that a failure of at least CAN chip <NUM> or CAN chip <NUM> occurred, if the first known data string 750a is not identical to the another first data string 752a. In some embodiments, computer system <NUM> detects that a failure of at least CAN chip <NUM> or CAN chip <NUM> did not occur, if the first known data string 750a is identical to the first another data string 752a.

In some embodiments, the first end-to-end check of computer system <NUM> of system 700A is periodically performed and the periodicity between the first end-to-end check or test is based on failure rates of CAN chips <NUM> and <NUM>, and the failure rates of processors 630a and 630b.

By including system <NUM> in system 700A, system 700A operates to achieve the benefits discussed above with respect to system <NUM>.

Other quantities, configurations or order of elements within system 700A are within the scope of the present disclosure. For example, in some embodiments, system 700A includes a number of CAN chips different than three.

<FIG> is a diagram of a system 700B, in accordance with one or more embodiments.

System 700B is an embodiment of system <NUM> of <FIG>, and similar detailed description is therefore omitted.

System 700B includes device <NUM>, CAN chip <NUM>, CAN bus <NUM> and computer system <NUM>.

System 700B is a variation of system <NUM> of <FIG>, and similar detailed description is therefore omitted. For example, in some embodiments, system 700B corresponds to a second end-to-end check or test of computer system <NUM> of system <NUM>. In some embodiments, the second end-to-end check of computer system <NUM> of system 700B or 700B (<FIG>) is similar to method <NUM> in <FIG> (described below).

In some embodiments, the second end-to-end check of computer system <NUM> of system 700B includes sending a second known data string 752b through computer system <NUM> by a second path. In some embodiments, the second path is from computer system <NUM> to CAN chip <NUM> to CAN chip <NUM> and back to computer system <NUM>.

In some embodiments, the second end-to-end check of computer system <NUM> of system 700B includes computer system <NUM> being configured to send the second known data string 752b to CAN chip <NUM> by a link 742b, CAN chip <NUM> being configured to send a CAN frame based on the second known data string 752b to CAN chip <NUM> by path 706b (e.g., over CAN bus <NUM>), CAN chip <NUM> being configured to receive the CAN frame from CAN chip <NUM>, and CAN chip <NUM> being configured to send the remaining CAN frame, that includes another second data string 750b, to computer system <NUM> by a link 740b. In these embodiments, computer system <NUM> compares the second known data string 752b and the another second data string 750b to determine if there is a match. In some embodiments, computer system <NUM> detects that a failure of at least CAN chip <NUM> or CAN chip <NUM> occurred, if the second known data string 752b is not identical to the another second data string 750b. In some embodiments, computer system <NUM> detects that a failure of at least CAN chip <NUM> or CAN chip <NUM> did not occur, if the second known data string 752b is identical to the second another data string 750b.

In some embodiments, the second end-to-end check of computer system <NUM> of system 700B is periodically performed and the periodicity between the second end-to-end check or test is based on failure rates of CAN chips <NUM> and <NUM>, and the failure rates of processors 630a and 630b.

In some embodiments, system 700A or 700B is configured to periodically perform a test of device <NUM>, by having computer system <NUM> being configured to send a third known data string to device <NUM> by at least CAN chip <NUM> or <NUM>, and having device <NUM> being configured to send back a fourth data string (similar to the third known data string) to computer system <NUM>. In some embodiments, computer system <NUM> detects that a failure of CAN chip <NUM> occurred, if the third known data string is not identical to the fourth data string. In some embodiments, computer system <NUM> detects that a failure of CAN chip <NUM> did not occur, if the third known data string is identical to the fourth data string. In some embodiments, the third known data string or the fourth data string includes a software (S/W) version number, an interface version and/or an identifier identification (ID), and each of which is known by system 700A or 700B.

By including system <NUM> in system 700B, system 700B operates to achieve the benefits discussed above with respect to system <NUM>.

Other quantities, configurations or order of elements within system 700B are within the scope of the present disclosure. For example, in some embodiments, system 700B includes a number of CAN chips different than three.

<FIG> is a flowchart of a method <NUM> of testing a system, in accordance with some embodiments.

In some embodiments, <FIG> is a flowchart of a method of CAN bus traffic supervision of the system, such as system <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, 700A or 700B, or system <NUM> (<FIG>). In some embodiments, <FIG> is a flowchart of a method of testing system <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, 700A or 700B, or system <NUM> (<FIG>).

It is understood that additional operations may be performed before, during, and/or after the method <NUM> depicted in <FIG>, and that some other operations may only be briefly described herein. In some embodiments, other order of operations of method <NUM> is within the scope of the present disclosure. Method <NUM> includes exemplary operations, but the operations are not necessarily performed in the order shown. Operations may be added, replaced, changed order, and/or eliminated as appropriate, in accordance with the spirit and scope of disclosed embodiments. It is understood that method <NUM> utilizes features of one or more of system <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, 700A or 700B, or system <NUM> (<FIG>). In some embodiments, one or more of operations <NUM>-<NUM> are not performed.

In operation <NUM> of method <NUM>, a first CAN frame received from a first CAN chip is compared to a second CAN frame received from the second CAN chip within a CAN comparison period. In some embodiments, the first CAN chip of method <NUM> includes CAN chip <NUM> or <NUM>. In some embodiments, the second CAN chip of method <NUM> includes CAN chip <NUM> or <NUM>.

In some embodiments, operation <NUM> is performed by system portion 410A. In some embodiments, operation <NUM> is performed by at least system <NUM>-700B or <NUM>. In some embodiments, operation <NUM> is performed by at least processor <NUM>, <NUM>, 630a, 630b or <NUM>. In some embodiments, operation <NUM> is performed by at least CAN frames comparison portion <NUM>, <NUM> or <NUM>.

In operation <NUM> of method <NUM>, a failure of at least the first CAN chip or the second CAN chip is detected. In some embodiments, operation <NUM> is performed by system portion 410A. In some embodiments, operation <NUM> is performed by at least system <NUM>-700B or <NUM>. In some embodiments, operation <NUM> is performed by at least CAN frames comparison portion <NUM>, <NUM> or <NUM>.

In some embodiments, operation <NUM> of method <NUM> includes one or more of operations <NUM>, <NUM> and <NUM>. In some embodiments, failing one or more of the tests of operations <NUM>, <NUM> and <NUM> results in determining that at least the first CAN chip or the second CAN chip have failed, and the method proceeds to operation <NUM>.

In operation <NUM> of method <NUM>, a determination is made if at least the first CAN frame or the second CAN frame payload is missing within the comparison period.

In some embodiments, operation <NUM> is performed by system portion 410A. In some embodiments, operation <NUM> is performed by at least system <NUM>-700B or <NUM>. In some embodiments, operation <NUM> is performed by at least CAN frames comparison portion <NUM>, <NUM> or <NUM>. In some embodiments, operation <NUM> is performed by at least processor <NUM>, <NUM>, 630a, 630b or <NUM>. In some embodiments, operation <NUM> is performed by at least CAN frames comparison portion <NUM>, <NUM> or <NUM>.

In some embodiments, if at least the first CAN frame payload or the second CAN frame payload is missing within the comparison period, then the first CAN chip and the second CAN chip have failed, and the result of operation <NUM> is a "yes", and method <NUM> proceeds to operation <NUM>.

In some embodiments, if at least the first CAN frame payload or the second CAN frame payload is not missing within the comparison period, then the first CAN chip and the second CAN chip have not failed this operation, and the result of operation <NUM> is a "no", and method <NUM> proceeds to operation <NUM>.

In operation <NUM> of method <NUM>, a determination is made if at least the first CAN frame or the second CAN frame is missing within the comparison period.

In some embodiments, if at least the first CAN frame or the second CAN frame is missing within the comparison period, then the first CAN chip and the second CAN chip have failed, and the result of operation <NUM> is a "yes", and method <NUM> proceeds to operation <NUM>.

In some embodiments, if at least the first CAN frame or the second CAN frame is not missing within the comparison period, then the first CAN chip and the second CAN chip have not failed this operation, and the result of operation <NUM> is a "no", and method <NUM> proceeds to operation <NUM>.

In operation <NUM> of method <NUM>, a determination is made if the first CAN frame is identical to the second CAN frame within the CAN comparison period.

In some embodiments, if the first CAN frame is identical to the second CAN frame, then the first CAN chip and the second CAN chip have not failed, and the result of operation <NUM> is a "yes", and method <NUM> proceeds to operation <NUM>.

In some embodiments, if the first CAN frame is not identical to the second CAN frame, then at least the first CAN chip or the second CAN chip has failed, and the result of operation <NUM> is a "no", and method <NUM> proceeds to operation <NUM>.

In operation <NUM> of method <NUM>, a determination is made that no failure of at least the first CAN chip or the second CAN chip occurred. In some embodiments, determining that no failure of at least the first CAN chip or the second CAN chip occurred of operation <NUM> is made in response to determining that the first CAN frame is identical to the second CAN frame.

In operation <NUM> of method <NUM>, the system does not switch over to a redundant system in response to detecting that no failure of at least the first CAN chip or the second CAN chip occurred. In some embodiments, the redundant system of method <NUM> includes at least system <NUM> or <NUM>.

In some embodiments, operation <NUM> is performed by system portion 410A. In some embodiments, operation <NUM> is performed by at least system <NUM>-700B or <NUM>.

In operation <NUM> of method <NUM>, a determination is made that a failure of at least the first CAN chip or the second CAN chip occurred.

In some embodiments, determining that the failure of at least the first CAN chip or the second CAN chip occurred of operation <NUM> is made in response to determining that at least the first CAN frame payload or the second CAN frame payload is missing or unavailable.

In some embodiments, determining that the failure of at least the first CAN chip or the second CAN chip occurred of operation <NUM> is made in response to determining that at least the first CAN frame or the second CAN is missing or unavailable.

In some embodiments, determining that the failure of at least the first CAN chip or the second CAN chip occurred of operation <NUM> is made in response to determining that the first CAN frame is not identical to the second CAN frame.

In operation <NUM> of method <NUM>, the system switches over to a redundant system in response to detecting that the failure of at least the first CAN chip or the second CAN chip occurred.

In some embodiments, after operation <NUM>, method <NUM> returns to operation <NUM> to perform additional testing operations.

In some embodiments, the additional testing operations are performed in operations <NUM>, <NUM>, <NUM>, <NUM> and <NUM> to determine if the redundant system still fails method <NUM>.

By operating method <NUM>, the testing of system <NUM> operates to achieve the benefits discussed above with respect to system <NUM>-700B.

In some embodiments, method <NUM> is the first end-to-end check or test of computer system <NUM> of system 700A. In some embodiments, method <NUM> is the second end-to-end check or test of computer system <NUM> of system 700B.

In some embodiments, method <NUM> is a method of monitoring a system, such as system <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, 700A or 700B, or system <NUM> (<FIG>). In some embodiments, <FIG> is a flowchart of a method of testing system <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, 700A or 700B, or system <NUM> (<FIG>).

In operation <NUM> of method <NUM>, a first data string of a first Ethernet packet is generated by the system. In some embodiments, the first data string of method <NUM> includes first known data string 750a. In some embodiments, system of method <NUM> includes system portion 410A. In some embodiments, system of method <NUM> includes at least system <NUM>-700B or <NUM>.

In operation <NUM> of method <NUM>, the first Ethernet packet is converted into a CAN frame.

In some embodiments, operation <NUM> is performed by a first CAN chip. In some embodiments, operation <NUM> is performed by a first processor of a first converter. In some embodiments, the first converter includes the first CAN chip.

In some embodiments, the first processor of method <NUM> includes processor 630a. In some embodiments, the first processor of method <NUM> includes at least processor <NUM> or <NUM>. In some embodiments, the first converter of method <NUM> includes converter circuit 620a. In some embodiments, the first converter of method <NUM> includes at least converter circuit <NUM> or <NUM>.

In some embodiments, the first CAN chip of method <NUM> includes CAN chip <NUM>. In some embodiments, the first CAN chip of method <NUM> includes CAN chip <NUM>.

In some embodiments, operation <NUM> includes operation <NUM>.

In operation <NUM> of method <NUM>, the Ethernet packet is encapsulated with a CRC by the first converter thereby converting the Ethernet packet into the CAN frame. In some embodiments, operation <NUM> is performed by the first CAN chip.

In operation <NUM> of method <NUM>, the CAN frame is routed from the first CAN chip to the second CAN chip by a common CAN bus. In some embodiments, the CAN frame of operation <NUM> is routed from the first CAN chip to the second CAN chip by path 706a. In some embodiments, the second CAN chip of method <NUM> includes CAN chip <NUM>. In some embodiments, the second CAN chip of method <NUM> includes CAN chip <NUM>. In some embodiments, the common CAN bus of method <NUM> includes CAN bus <NUM>.

In operation <NUM> of method <NUM>, the CAN CRC of the CAN frame is verified by the second CAN chip. In some embodiments, operation <NUM> includes the second CAN chip being configured to perform the CAN CRC of the CAN frame.

In operation <NUM> of method <NUM>, the CAN CRC is stripped off or removed from the CAN frame by the second CAN chip.

In operation <NUM> of method <NUM>, the CAN frame is converted into a second Ethernet packet by a second processor of a second converter. In some embodiments, the second Ethernet packet includes a second data string. In some embodiments, the second converter includes the second CAN chip.

In some embodiments, the second processor of method <NUM> includes processor 630b. In some embodiments, the second processor of method <NUM> includes at least processor <NUM> or <NUM>. In some embodiments, the second converter of method <NUM> includes converter circuit 620b. In some embodiments, the second converter of method <NUM> includes at least converter circuit <NUM> or <NUM>.

In some embodiments, the second data string of method <NUM> includes another first data string 752a.

In operation <NUM> of method <NUM>, the second Ethernet packet is routed to the system by the second processor.

In operation <NUM> of method <NUM>, the first data string is compared with the second data string by the system.

In operation <NUM> of method <NUM>, the system detects that a failure of at least the first CAN chip or the second CAN chip occurred. In some embodiments, operation <NUM> of method <NUM> includes operation <NUM>.

In operation <NUM> of method <NUM>, a determination is made by the system if the first data string is identical to the second data string.

In some embodiments, if the first data string is identical to the second data string, then the first CAN chip and the second CAN chip have not failed, and the result of operation <NUM> is a "yes", and method <NUM> proceeds to operation <NUM>.

In some embodiments, if the first data string is not identical to the second data string, then at least the first CAN chip or the second CAN chip has failed, and the result of operation <NUM> is a "no", and method <NUM> proceeds to operation <NUM>.

In operation <NUM> of method <NUM>, a determination is made by the system that a failure of at least the first CAN chip or the second CAN chip occurred.

In some embodiments, determining that the failure of at least the first CAN chip or the second CAN chip occurred of operation <NUM> is made in response to determining that the first data string is not identical to the second data string.

In some embodiments, after operation <NUM>, method <NUM> returns to operation <NUM> to perform additional testing operations. In some embodiments, the additional testing operations are performed in operations <NUM>-<NUM> to determine if the redundant system still fails method <NUM>.

In operation <NUM> of method <NUM>, a determination is made by the system that no failure of at least the first CAN chip or the second CAN chip occurred. In some embodiments, determining that no failure of at least the first CAN chip or the second CAN chip occurred of operation <NUM> is made in response to determining that the first string is identical to the second string.

In operation <NUM> of method <NUM>, the system does not switch over to a redundant system in response to detecting that no failure of at least the first CAN chip or the second CAN chip occurred.

While method <NUM> was described above with reference to system 700A of <FIG>, it is understood that method <NUM> utilizes the features of system 700B of <FIG> and the second path. For example, in these embodiments, method <NUM> is performed with reference to system 700B, and the first data string of method <NUM> includes second known data string 752b, the second data string of method <NUM> includes the another data string 750b, the first processor of method <NUM> includes processor 630b, the second processor of method <NUM> includes processor 630a, the first CAN chip of method <NUM> includes CAN chip <NUM>, the second CAN chip of method <NUM> includes CAN chip <NUM>, the first converter of method <NUM> includes converter circuit 620b, and the second converter of method <NUM> includes converter circuit 620a.

<FIG> is a block diagram of a system <NUM>, in accordance with one or more embodiments.

In some embodiments, system <NUM> is usable in place of one or more of system <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, 700A or 700B. In some embodiments, system <NUM> is usable in place of one or more of computer system <NUM>, <NUM>, <NUM>, <NUM>, <NUM> or <NUM>. In some embodiments, system <NUM> is usable in place of system portion 410A.

System <NUM> includes a specific-purpose hardware processor <NUM> and a non-transitory, computer readable storage medium <NUM> encoded with, i.e., storing, the computer program code <NUM>, i.e., a set of executable instructions. Computer readable storage medium <NUM> is also encoded with instructions <NUM> for interfacing with at least CAN chip <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM> or <NUM> or at least converter circuit <NUM>, <NUM>, 620a or 620b. The processor <NUM> is electrically coupled to the computer readable storage medium <NUM> via a bus <NUM>. The processor <NUM> is also electrically coupled to an I/O interface <NUM> by bus <NUM>. A network interface <NUM> is also electrically connected to the processor <NUM> via bus <NUM>. Network interface <NUM> is connected to a network <NUM>, so that processor <NUM> and computer readable storage medium <NUM> are capable of connecting to external elements via network <NUM>. The processor <NUM> is configured to execute the computer program code <NUM> encoded in the computer readable storage medium <NUM> in order to cause system <NUM> to be usable for performing a portion or all of the operations as described in at least method <NUM> or <NUM>. In some embodiments, network interface <NUM> is an embodiment of the Ethernet interface of Ethernet link <NUM>, and network <NUM> is an embodiment of Ethernet link <NUM>.

In some embodiments, the processor <NUM> is a central processing unit (CPU), a multi-processor, a distributed processing system, an application specific integrated circuit (ASIC), and/or a suitable processing unit.

In some embodiments, the computer readable storage medium <NUM> is an electronic, magnetic, optical, electromagnetic, infrared, and/or a semiconductor system (or apparatus or device). For example, the computer readable storage medium <NUM> includes a semiconductor or solid-state memory, a magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk, and/or an optical disk. In some embodiments using optical disks, the computer readable storage medium <NUM> includes a compact disk-read only memory (CD-ROM), a compact disk-read/write (CD-R/W), and/or a digital video disc (DVD).

In some embodiments, the storage medium <NUM> stores the computer program code <NUM> configured to cause system <NUM> to perform at least method <NUM> or <NUM>. In some embodiments, the storage medium <NUM> also stores information needed for performing method <NUM> as well as information generated during performing at least method <NUM> or <NUM> such as a CAN frames parameter <NUM>, a CAN frames payload parameter <NUM>, a CAN frames comparison period parameter <NUM>, a CAN frame CRC parameter <NUM> and a data strings parameter <NUM>, and/or a set of executable instructions to perform the operation of at least method <NUM> or <NUM>.

In some embodiments, the storage medium <NUM> stores instructions <NUM> to effectively implement at least method <NUM> or <NUM>.

System <NUM> includes I/O interface <NUM>. I/O interface <NUM> is coupled to external circuitry. In some embodiments, I/O interface <NUM> includes a keyboard, keypad, mouse, trackball, trackpad, and/or cursor direction keys for communicating information and commands to processor <NUM>.

System <NUM> also includes network interface <NUM> coupled to the processor <NUM>. Network interface <NUM> allows system <NUM> to communicate with network <NUM>, to which one or more other computer systems are connected. Network interface <NUM> includes wireless network interfaces such as BLUETOOTH, WIFI, WIMAX, GPRS, or WCDMA; or wired network interface such as ETHERNET, USB, or IEEE-<NUM>. In some embodiments, method <NUM> is implemented in two or more Systems <NUM>, and information such as memory type, memory array layout, I/O voltage, I/O pin location and charge pump are exchanged between different Systems <NUM> via network <NUM>.

System <NUM> is configured to receive CAN frames. The information is stored in computer readable medium <NUM> as CAN frames parameter <NUM>. System <NUM> is configured to receive information related to the CAN frames payload through I/O interface <NUM> or network interface <NUM>. The information is stored in computer readable medium <NUM> as CAN frames payload parameter <NUM>. System <NUM> is configured to receive information related to the CAN frames comparison period through I/O interface <NUM> or network interface <NUM>. The information is stored in computer readable medium <NUM> as CAN frames comparison period parameter <NUM>. System <NUM> is configured to receive information related to the CAN frame CRC through I/O interface <NUM> or network interface <NUM>. The information is stored in computer readable medium <NUM> as CAN frame CRC parameter <NUM>. System <NUM> is configured to receive information related to the data strings through I/O interface <NUM> or network interface <NUM>. The information is stored in computer readable medium <NUM> as data strings parameter <NUM>.

During operation, processor <NUM> executes a set of instructions to detect a failure of at least CAN chip <NUM> or CAN chip <NUM> by comparing remaining CAN frames received from each of CAN chip <NUM> and CAN chip <NUM> during the CAN comparison period. In some embodiments, processor <NUM> is an embodiment of each of processor <NUM>, <NUM>, 630a and 630b, and similar detailed description is therefore omitted.

An aspect of this description relates to a system. In some embodiments, the system includes a first CAN system a first common CAN bus coupled to the first CAN system. In some embodiments, the first CAN system includes a first CAN chip, a second CAN chip different from the first CAN chip. In some embodiments, the first common CAN bus couples the first CAN chip and the second CAN chip together. In some embodiments, the first CAN chip and the second CAN chip are configured to receive a first CAN frame from the first common CAN bus, and the first CAN system is configured to detect a failure of at least the first CAN chip or the second CAN chip.

Another aspect of this description relates a method of common CAN bus traffic supervision on a system having a common CAN bus, a first CAN chip and a second CAN chip, the first CAN chip and the second CAN chip are coupled together with the common CAN bus. In some embodiments, the method includes comparing a first CAN frame received from the first CAN chip to a second CAN frame received from the second CAN chip within a CAN comparison period, and detecting a failure of at least the first CAN chip or the second CAN chip. Detecting the failure of at least the first CAN chip or the second CAN chip includes determining that the first CAN frame is not identical to the second CAN frame within the CAN comparison period.

Yet another aspect of this description relates to a method of monitoring a system having a common CAN bus, a first CAN chip and a second CAN chip, the first CAN chip and the second CAN chip are coupled together with the common CAN bus. In some embodiments, the method comprises generating, by the system, a first data string of a first Ethernet packet; converting, by a first processor of a first converter, the first Ethernet packet into a CAN frame, the first converter including the first CAN chip; routing the CAN frame from the first CAN chip to the second CAN chip by the common CAN bus; converting, by a second processor of a second converter, the CAN frame into a second Ethernet packet, the second Ethernet packet including a second data string, the second converter including the second CAN chip; routing the second Ethernet packet to the system; comparing the first data string with the second data string; and detecting that a failure of at least the first CAN chip or the second CAN chip occurred. In some embodiments, detecting that the failure of at least the first CAN chip or the second CAN chip occurred comprises determining that the first data string is not identical to the second data string.

Claim 1:
A system comprising:
a first controller area network, CAN, system (<NUM>) including:
a first CAN chip (<NUM>); and
a second CAN chip (<NUM>) different from the first CAN chip; and
a first common CAN bus (<NUM>) coupled to the first CAN system, the first common CAN bus coupling the first CAN chip and the second CAN chip together;
wherein the first CAN chip and the second CAN chip are configured to receive a first CAN frame from the first common CAN bus, and the first CAN system is configured to detect a failure of at least the first CAN chip or the second CAN chip, wherein the first CAN system configured to detect the failure of at least the first CAN chip or the second CAN chip comprises:
the first CAN system being configured to determine that the first CAN frame as received by the first CAN chip is not identical to the first CAN frame as received by the second CAN chip.