Patent Description:
In-vehicle network (IVN) buses, such as CAN (Controller Area Network), CAN FD (CAN with Flexible Data-Rate), LIN (Local Interconnect Network), FlexRay, Ethernet based network buses, and other types, can be used for communications within vehicles. For example, controller area network (CAN) bus is a message-based communications bus protocol that is often used within automobiles. It will be appreciated that CAN networks also have application outside of the field of automobiles. A CAN bus network may include multiple bus devices, so called nodes or electronic control units (ECUs), such as an engine control module (ECM), a power train control module (PCM), airbags, antilock brakes, cruise control, electric power steering, audio systems, windows, doors, mirror adjustment, battery and recharging systems for hybrid/electric cars, and many more. The CAN bus protocol is used to enable communications between the various bus devices. The data link layer of the CAN protocol is standardized as International Standards Organization (ISO) <NUM>-<NUM>:<NUM>. CAN Flexible Data-Rate or "CAN FD," which is an extension of the standardized CAN data link layer protocol and is meanwhile integrated into the ISO11898-<NUM>:<NUM> standard, can provide higher data rates. The standardized CAN data link layer protocol is being further extended to provide even higher data rates. A further extension, referred to as CAN XL, with a new level scheme allowing even higher data rates is in the definition phase discussed under CiA610 (CAN in Automation) and is moving towards standardization in the form of either a further update of the existing ISO11898 standards or a new standard.

<CIT> relates to an apparatus to facilitate flexible data rate controller area network (CAN FD) communications in a mixed network having both non-FD CAN nodes and CAN FD nodes.

According to a first aspect of the present disclosure there is provided an apparatus for a Controller Area Network, CAN, transceiver, the apparatus comprising:.

In one or more examples, said apparatus is configured to detect error frames in the transmit-data and to detect the occurrence of an error in said receive-data according to one or more rules, wherein the apparatus is configured to prevent transmission if said transmit-data contains an error frame and the apparatus does not detect the occurrence of an error in said receive-data.

In one or more embodiments, the apparatus is configured to detect, based on the receive-data, the occurrence of an error in said receive-data according to one or more rules, and wherein the apparatus is configured to provide for transmission of an error signal or error frame on the CAN bus based on the occurrence of the error.

In one or more embodiments, the apparatus is configured to provide said transmission of the error frame or error signal at least at times corresponding to said detected one or more fields of the CAN frame.

In one or more embodiments, said one or more rules used for determining the occurrence of the error in said receive-data include one or more of:.

In one or more embodiments, said apparatus is configured to determine, based on said receive-data and said transmit-data during an arbitration field of a CAN frame, whether arbitration was won or not won; and
if it is determined that arbitration was not won, said one or more fields of the CAN frame comprise one or more of:.

In one or more embodiments, said apparatus is configured to determine, based on said receive-data and said transmit-data during an arbitration field of a CAN frame, whether arbitration was won or not won; and
if it is determined that arbitration was won, said one or more fields of the CAN frame comprise one or more of:.

In one or more embodiments, the apparatus is configured to store a security level index, wherein the security level index comprises at least a first value or a second value, different to the first value; and wherein.

In one or more embodiments, the apparatus is configured to store a security level index, wherein the security level index comprises at least a first value or a second value, different to the first value; and wherein
the detected one or more fields of the CAN frame in which the apparatus is configured to prevent transmission comprises a first selection when said security level index comprises the first value; and
the detected one or more fields of the CAN frame in which the apparatus is configured to prevent transmission comprises a second selection, different to the first selection, when said security level index comprises the second value.

In one or more embodiments, the apparatus is configured to change the security level index from the first value to the second value based on detection of one or more anomalous events in the transmit-data, the one or more anomalous events determined based on a predetermined behaviour rule set.

In one or more embodiments, the apparatus is configured to change the security level index from the second value to the first value based on non-detection, over a predetermined time period or over a predetermined number of frames, of one or more anomalous events in the transmit-data, the one or more anomalous events determined based on a predetermined behaviour rule set.

In one or more embodiments, based on said apparatus providing for transmission of the error frame, the apparatus is configured to stop the prevention of the transmission by said CAN transceiver of said signalling that represents said transmit-data.

In one or more embodiments, the apparatus comprises part of a CAN transceiver and.

In one or more embodiments, the apparatus is configured to prevent transmission by said CAN transceiver of said signalling that represents said transmit-data by one or more of:.

In one or more embodiments, the apparatus is configured to, based on detection of an error frame in said transmit-data and wherein the apparatus acts to prevent transmission, modify said receive-data such that it appears to the CAN controller that the error frame was transmitted on the CAN bus.

In one or more examples, the apparatus is configured to, based on said prevention of transmission of said signalling that represents said transmit-data and said modification of the receive-data, provide for transmission of an overload flag on the CAN bus and, following said modification of the receive-data and prior to said overload flag, block the receive-data from being provided to the CAN controller.

According to a second aspect of the disclosure, we provide a method for a Controller Area Network, CAN, transceiver, the method comprising:.

According to a third aspect of the disclosure we provide a computer readable medium comprising computer program code, which when executed, is configured to cause a processor perform the method of the second aspect.

Example <FIG> shows a CAN bus system <NUM> with a plurality of nodes or ECUs (Electronic Control Units) <NUM>-<NUM> connected to the same CAN bus wires <NUM> comprising a first CANH wire and a second CANL wire. The nodes <NUM>-<NUM> may comprise nodes that implement Classical CAN, CAN FD nodes that implement the CAN FD protocol or CAN XL nodes that implement the new CAN XL protocol.

Example <FIG> shows one of the nodes <NUM>-<NUM> in more detail. A node mainly comprises a CAN controller <NUM>, such as a microcontroller, that implements the CAN, CAN FD or CAN XL protocol such as by using an embedded CAN, CAN FD or CAN XL protocol controller <NUM>. The CAN controller <NUM> may be known as a host. The controller <NUM> and, more particularly, the protocol controller <NUM> is connected to the CAN bus <NUM> by a CAN transceiver <NUM>. The CAN controller <NUM> is connected to the CAN transceiver <NUM> through two interface connections called TXD (Transmit Data) <NUM> and RXD (Receive Data) <NUM>. The controller may therefore have a transmit output terminal that couples with a transmit input terminal of the CAN transceiver <NUM>. Likewise, the CAN transceiver <NUM> may have a receive output terminal that couples with a receive input terminal of the CAN controller <NUM>. The transceiver <NUM> is used to convert transmit data, comprising a digital bit stream on TXD <NUM>, into analogue signalling on the bus wires <NUM> using a transmitter module <NUM>. The transceiver <NUM> is also used to convert analogue signalling from the bus <NUM> into receive data comprising a digital output signal or bit stream by a receiver module <NUM> for providing to the RXD connection <NUM>. The transmitter module <NUM> is thus configured to convert the transmit data into dominant bit and recessive bit differential signals for the bus <NUM>. The receiver module <NUM> is thus configured to receive the differential signals from the bus <NUM> and determine the presence of either a dominant bit or a recessive bit and generate the receive data based thereon. In general, the CAN transceiver comprises an interface device to the network and the CAN controller comprises a controller that is configured to transmit data to and receive data from the network via the interface device.

In one or more examples, and for context, if node <NUM> is transmitting a CAN frame, the receiving nodes <NUM>, <NUM> and <NUM>, are, according to the CAN protocol, configured to verify the received frame and may acknowledge the frame or invalidate the frame with an error frame. The error frame can be transmitted during the frame or in an End Of Frame (EOF) field (described below in relation to <FIG>). If there is an error frame transmitted on the bus, all receiving nodes <NUM>, <NUM>, <NUM> will discard the frame they just received and the transmitting node <NUM> will optionally retry to transmit the frame for a number of times. With this property each node has a veto with which it can invalidate a frame on the bus <NUM>. If a node has a CAN controller or associated host with a defect or compromised software, it can occur that the node will try to invalidate CAN frames that are received correctly and that should have been acknowledged according to the CAN protocol. For safety and security reasons this may be unwanted behaviour.

We disclose an apparatus that may, in one or more examples, act as a guardian to monitor and possibly take over the error frame transmission task from a local host. In one or more examples, the apparatus may prevent the local host transmitting error frames on the bus during predefined phases or fields of the CAN frame. In one or more examples, said predefined fields may change over time.

Thus, in one or more example embodiments of the disclosure, the CAN transceiver <NUM> may additionally include an apparatus <NUM> for controlling when the CAN transceiver <NUM> provides the signalling to the bus <NUM> in response to receipt of the transmit data from the CAN controller <NUM> on TXD <NUM>. In one or more examples, the apparatus <NUM> may be configured to block or allow the transmit data received on TXD <NUM> from being received by the transmitter module <NUM> of the CAN transceiver <NUM>.

The apparatus <NUM> may also receive the receive data from the receiver module <NUM> that is to be provided to the CAN controller on RXD <NUM>. The apparatus <NUM> may be CAN protocol aware, meaning that it can identify one or more parts of a CAN frame and provide its control in response to one or more parts of the CAN frame being transmitted and/or present in the signalling on the bus <NUM>. The apparatus <NUM> may include a CAN ISO11898 compliant receiver that is capable of decoding frames on the bus <NUM>. However, it will be appreciated that it may not require all the functionality provided in ISO11898 and may, instead, be configured to decode CAN frames according to one or more predetermined decoding rules, which may be derived from or comprise a subset of the rules defined in ISO11898 for a CAN receiver.

A more detailed view of the apparatus <NUM> is provided in <FIG> shows an example of the functional parts the apparatus <NUM> may require to implement the control. The same reference numerals as used in <FIG> are also used in <FIG> for like parts.

In summary, the apparatus <NUM> is for a CAN transceiver. In <FIG>, the apparatus <NUM> is shown as part of the CAN transceiver <NUM> and as an interface between the combination of the receiver module <NUM> and the transmitter module <NUM> and the receive output terminal <NUM> and the transmit input terminal <NUM>. In other examples, the apparatus <NUM> may be external to the CAN transceiver <NUM>, and couple to the receive output terminal <NUM> and the transmit input terminal <NUM>. In such a configuration, the transmit-data from the CAN controller <NUM> may pass through the apparatus to the transmit input terminal <NUM> and the receive data received from the receive output terminal <NUM> may be passed to the CAN controller through the apparatus.

In whichever configuration, the apparatus <NUM> may comprise a first input <NUM> for receiving transmit-data generated by a CAN controller <NUM>. The transmit-data, as will be familiar to those skilled in the art, causes the CAN transceiver <NUM> to transmit signalling that represents said transmit-data on the CAN bus, such as by way of the transmitter module <NUM>. Further, the apparatus <NUM> may comprise a second input <NUM> for receiving receive-data, wherein the receive-data is indicative of signalling from the CAN bus <NUM>, which may be received from the receiver module <NUM>.

The apparatus <NUM> comprises protocol-and-sampling block <NUM> configured to read the CAN frames and signalling in the transmit-data and the receive-data. To provide such functionality and subsequent control, the protocol-and-sampling block <NUM> includes a first timing recovery block <NUM> for determining the signal timing in the transmit-data. Further, the protocol-and-sampling block <NUM> includes a second timing recovery block <NUM> for determining the signal timing in the receive-data. An edge-timing-check block <NUM> is configured to receive the transmit data and check the timing of the edges, that is transitions between dominant and recessive bits, in the transmit-data for errors or compliance with the CAN protocol. A bus-state block <NUM> is configured to determine the state of the bus from the receive data. Accordingly the bus-state block may be configured to determine one or more of the type of CAN frame being received, the part of the frame being received and whether the bus <NUM> is in use or not. A violation-detector-and-TXD-gating block <NUM> is configured to provide for detection of the violation of one or more predetermined rules in the transmit data. The violation of the one or more predetermined rules may be determined based on one or more bits of the transmit-data and the current state of the bus <NUM>, determined from the receive-data.

The violation-detector-and-TXD-gating block <NUM> may be configured to perform one or more control actions.

In this example, a first control action comprises the violation-detector-and-TXD-gating block <NUM> being configured to manipulate the transmit data that is provided to the transmitter module <NUM> by way of one or more signals provided at a first output <NUM>. The signals from the first output <NUM> may control switch <NUM>. Switch <NUM> may interrupt the connection between the transmit input terminal <NUM> and the transmit module <NUM>. In other examples, the signal <NUM> may be configured to insert or change bits in the transmit-data.

In this example and one or more other examples, a second control action comprises the violation-detector-and-TXD-gating block <NUM> being configured to send error frames by providing appropriate signals to the transmit module <NUM> from second output <NUM>.

In this example and one or more other examples, a third control action comprises the violation-detector-and-TXD-gating block <NUM> being configured to manipulate the receive-data that is provided to the CAN controller <NUM> by one or more signals provided at a third output <NUM>. The signals from third output <NUM> may control switch <NUM>. Switch <NUM> may interrupt the connection between the receive module <NUM> and the receive output terminal <NUM>. In other examples, the signals at third output <NUM> may be configured to insert or change bits in the receive data.

The protocol-and-sampling block <NUM> may be configured to receive one or more reference signals to provide these functions. Thus, a bit-timing-settings block <NUM> is configured to store the bit rate setting for the CAN network, as will be familiar to those skilled in the art. A clock <NUM> provides a clock signal.

It will be appreciated that <FIG> provides one example of an implementation of the apparatus <NUM>. In other implementations, the functions of the apparatus <NUM> described herein may be provided by a general purpose processor with appropriately configured software or a FPGA or a PLC or a dedicated die. Accordingly, in the description that follows, the functionality will be described as being provided by the apparatus <NUM> in general rather than by one or more of the blocks, such as block <NUM>.

In the present examples, switch <NUM> is used to prevent transmission by said CAN transceiver of said signalling that represents said transmit-data. However in other examples, the prevention of transmission may be achieved by modification of the transmit-data such that an un-warranted error frame or the like is not present therein. In other examples, the apparatus may be configured to temporarily block the transmit-data from receipt by a transmitter module <NUM> of the CAN transceiver. In other examples, the apparatus may be configured to block the output of the transmitter module <NUM> of the CAN transceiver <NUM> and, as such, may include a switch at the output of the transmitter module <NUM> prior to the connection to the CAN bus <NUM>.

<FIG> shows a series of CAN frames <NUM> to illustrate the action of the apparatus. The structure of a typical CAN frame will be described first to highlight the parts thereof. The frame comprises a Start-of-Frame field <NUM> which designates the start of a CAN frame <NUM>. An arbitration field <NUM> follows the Start-of-Frame field <NUM> in which it is determined which node <NUM>-<NUM> wins access to the bus <NUM>. The arbitration field <NUM> may include signalling of an ID for the node <NUM>-<NUM>, and may comprise an <NUM> or <NUM> bit ID. Following the arbitration field <NUM>, the frame comprises a field of control bits <NUM>, including IDE, FDF and res, which can be used for signalling the type of CAN protocol that will follow. A data field <NUM> follows the control bits field <NUM>, which contains the data content of the frame. A CRC field <NUM> follows the data field <NUM>, which contains error detection and/or error correction information. An acknowledgement field <NUM> follows. An acknowledgement Del field <NUM> follows. An end-of-frame field <NUM> indicates the end of the frame <NUM>. An interframe space <NUM> is provided to provide an identifiable separation between different frames. The bus (and therefore the nodes) may be considered idle in this inter-frame space <NUM>. A subsequent frame may then begin with the Start-of-Frame field. Thus, at time <NUM> multiple nodes will be transmitting, arbitrating for the bus. At time <NUM>, only one node should be transmitting (except in the event of error or invalidation signals). At the acknowledgement field <NUM>, the nodes <NUM>-<NUM> receiving the frame will become active.

The CAN frames <NUM> and <NUM> include shading to illustrate where in the CAN frame the apparatus <NUM> may exert its control.

Thus, the apparatus <NUM> is configured to detect, in said receive-data, one or more fields of a CAN frame, such as illustrated in <FIG>. In the examples herein, the one or more fields detected by the apparatus <NUM> may include the interframe space <NUM>, even though it is a part of the signalling between frames. Thus, the apparatus <NUM> may be configured to detect the end-of-frame field <NUM>. In other examples, the apparatus <NUM> may be configured to detect the end-of-frame field <NUM> and the interframe space <NUM>. Thus, the apparatus <NUM> may be protocol aware as much as necessary to identify the occurrence of the one or more fields of a CAN frame. Alternatively, the apparatus <NUM> may have the capability to identify a plurality of (or all) fields of the CAN frame and the one or more fields described above may comprise a subset of those.

In one or more examples described herein, the apparatus <NUM> is configured to prevent transmission by said CAN transceiver of said signalling that represents said transmit-data at times corresponding to said detected one or more fields of the CAN frame to at least prevent an error frame in said transmit-data being transmitted. Thus, as described above, a CAN controller <NUM> that has a defect or compromised software, may try to invalidate CAN frames that are received correctly and that should have been acknowledged according to the CAN protocol. For safety and security reasons this may be unwanted behaviour. Thus, the apparatus <NUM> may be configured to act to prevent the transmission of error frames by the CAN controller during the one or more fields.

In a first example, the apparatus <NUM> may be configured to prevent the transmission of error frames by being configured to prevent transmission of signalling onto the bus during the one or more fields. Thus, the apparatus <NUM> may be configured such that it selectively silences the CAN controller during said one or more fields of the CAN frame, which may occur irrespective of what the CAN controller may be trying to send.

In one or more other examples, said apparatus <NUM> may be configured to detect error frames in the transmit-data, such as the CAN controller attempting to send an error frame. The apparatus <NUM> may further by configured to detect the occurrence of an error in said receive-data according to one or more rules. The apparatus <NUM> may thus be configured to determine whether the CAN controller is attempting to send an error frame in response to a genuine error or not. The apparatus <NUM> may therefore monitor the behaviour of the CAN controller by inspecting the transmit-data and/or controlling when the CAN transceiver provides the signalling to the CAN bus in response to the transmit-data. The apparatus <NUM> may be configured to prevent transmission if said transmit-data contains an error frame and the apparatus does not detect the occurrence of an error in said receive-data.

In one or more examples, the apparatus <NUM> is configured to, based on detection of an error frame in said transmit-data and wherein the apparatus acts to prevent transmission of the error frame by the CAN transceiver, modify said receive-data such that it appears to the CAN controller <NUM> that the error frame was transmitted on the CAN bus. By performing this action, it may appear to the CAN controller that its error frame was in fact transmitted (even when it was not) because, after a delay it can see what it will believe is the corresponding signalling on the bus <NUM>. This may therefore hide the action of the apparatus <NUM> from the CAN controller <NUM>. It will be appreciated that the detection of the error frame in said transmit-data may comprise detecting one or more dominant bits that arrive unexpectedly according to rules of the CAN protocol. Those one or more bits may thus be blocked to prevent transmission of them by the CAN transceiver.

The apparatus may be configured to then generate an overload flag on the bus. The overload flag helps the CAN controller <NUM> and the other CAN controllers coupled to the CAN bus <NUM> to reach the next intermission field at the same point in time; allowing all CAN controllers to equally participate in the next arbitration. The receive-data passed to the CAN controller may be modified by the apparatus in the period between its initial modification to make it appear the error frame was sent and the transmission of the overload flag. Thus, the "genuine" receive-data is blocked.

In one or more examples, the apparatus <NUM> may be configured to, at least in part, take responsibility for sending error frames from the CAN controller <NUM>. It will be appreciated that because the apparatus <NUM> is configured to receive the transmit-data from the CAN-controller <NUM>, it is downstream of the CAN controller and may therefore take responsibility for sending error frames with or without the CAN controller knowing (i.e. being able to detect) that the apparatus <NUM> is performing such a function. Thus, in one or more examples, the apparatus <NUM> may be configured to detect, based on the receive-data, the occurrence of an error in said receive-data according to one or more rules. The one or more rules may comprise a subset of the rules of the CAN protocol or may be based on the rules of the CAN protocol. The one or more rules may include adherence to one or more of timing of transmissions by the other nodes; transmissions by the other nodes conditional on whether arbitration was won or lost, CAN frame type, which may include CAN, CAN FD and CAN XL frame types and others. Thus, if the apparatus <NUM> determines that one or more of the rules have not been adhered to, then the apparatus <NUM> may be configured to provide for transmission of an error frame or error signal on the CAN bus based on the occurrence of the error and independent of the sending of an error frame or signal by the CAN controller, as could be observed in the transmit-data. An "error frame" may comprise a frame as defined by ISO11898-<NUM>. An "error signal" can be any signalling provided to the bus that corrupts the current frame.

In one or more examples, the responsibility for sending error frames may be shared with the CAN controller <NUM>. Thus, the apparatus <NUM> may be configured to provide for said transmission of error frames at least at times that correspond to when said detected one or more fields of the CAN frame are currently present in the receive-data. Thus, at times when the apparatus <NUM> is configured to prevent transmission of signalling on the CAN bus that represents said transmit-data from the CAN controller, the apparatus <NUM> may provide for transmission of error frames, if errors are detected. Outside the times of the one or more fields of the CAN frame, the apparatus may allow for the CAN controller <NUM> to provide for transmission of error frames on the CAN bus <NUM>.

In one or more examples, the one or more rules used for determining the occurrence of the error in said receive-data include a stuff error rule, the stuff error rule comprising adherence to a stuffing rule for the CAN protocol. Thus, for the CAN protocol, it is allowable for up to five bits to have the same value before a stuff bit is inserted to provide an edge for synchronisation. The stuff error rule thus determines whether the receive-data meets the CAN protocol stuffing rule. In one or more examples, the stuff error rule may include determining whether the CRC field <NUM> of a CAN FD frame includes the required four stuff bits defined in the protocol for CAN FD.

In one or more examples, the one or more rules used for determining the occurrence of the error in said receive-data include a form error rule configured to determine whether the value of predetermined bits in a CAN frame have invalid values according to the CAN protocol. For example, delimiter bits or reserved bits are expected to have a predetermined value and if that value is not detected then there is a form error.

In one or more examples, the one or more rules used for determining the occurrence of the error in said receive-data include a bit error rule, the bit error rule defining that bits in the transmit-data should be seen in the receive-data.

In one or more examples, the one or more rules used for determining the occurrence of the error in said receive-data include a CRC error rule, the CRC error rule defining that the CRC field <NUM> indicates that the data in the data field <NUM> is correct.

With reference to <FIG>, the first CAN frame <NUM> illustrates the situation when arbitration is won by the CAN controller with which the apparatus <NUM> is associated. The second CAN frame <NUM> illustrates the situation when arbitration is lost by the CAN controller with which the apparatus <NUM> is associated.

The apparatus <NUM> may be configured to determine whether arbitration was won by the CAN controller <NUM> with which it is associated. In some examples, the apparatus <NUM> may be further configured to determine whether arbitration was not won or lost, by the CAN controller <NUM> with which it is associated. Thus, arbitration may be not won because it was lost or because the controller <NUM> did not participate in arbitration. Thus, by monitoring the "ID" received from the CAN bus in the receive-data and the ID sent by the CAN controller <NUM> in the transmit-data during the arbitration field <NUM> of a CAN frame, the apparatus <NUM> can determine if arbitration was won or lost, including the situation when the CAN controller <NUM> did not participate in arbitration. In one or more examples, the apparatus <NUM> may have predetermined information of the ID of the CAN controller with which it is associated and may therefore be configured to determine whether arbitration was won and/or not won or lost based on the receive-data and not the transmit-data.

If it is determined that arbitration was won (it will be appreciated that the determination may be made during the arbitration field or after), with reference to the first CAN frame <NUM>, said one or more fields of the CAN frame may comprise one or more of:.

Thus, during any one or more of these parts of the CAN frame (including the interframe space <NUM> between frames), with reference to second CAN frame <NUM>, the apparatus <NUM> may be configured to prevent transmission by said CAN transceiver of the signalling on the bus that represents said transmit-data. Thus, the shading in these parts of the frame indicate where the apparatus <NUM> restricts transmission of the transmit-data onto the CAN bus by the CAN transceiver.

If arbitration was not won (e.g. lost or where the CAN protocol controller <NUM> did not participate in arbitration to win access to the CAN bus) then said one or more fields of the CAN frame may comprise one or more of: the data field <NUM>; the end-of-frame field <NUM>; and the interframe space <NUM>. Further, the one or more fields of the CAN frame <NUM> may include a portion <NUM> of an arbitration field <NUM> following a time arbitration is lost. It will be appreciated that the node <NUM>-<NUM> with the lowest ID wins access to the bus and therefore it can be determined that arbitration has been lost before then end of the arbitration field if a node with a lower ID continues to participate in arbitration. Therefore, from the time point in the arbitration field that the CAN controller has lost, the apparatus <NUM> may be configured to prevent transmission of signalling that is based on the transmit-data.

The apparatus <NUM> may be configured to prevent transmission of the transmit-data dependent on a current security level. Thus, the apparatus <NUM> may be configured to monitor the behaviour of the CAN controller <NUM> by inspecting the transmit-data. The apparatus <NUM> may also receive the receive-data and may therefore be configured to determine whether the behaviour of the CAN controller <NUM> based on the transmit-data it is generating. Further, the apparatus may be configured to determine if the transmit-data is appropriate transmit-data in response to the receive-data from the CAN bus <NUM>. Thus, the apparatus <NUM> may be configured to detect the occurrence of one or more anomalous events in the transmit-data, the one or more anomalous events determined based on a predetermined behaviour rule set. The predetermined behaviour rule set may include rules that define what is considered inappropriate or suspicious behaviour of the CAN controller <NUM>. For example, the predetermined behaviour rule set may define rules based on the timing of bits in the transmit-data and the adherence to the fields of the CAN frame, which may not require knowledge of the receive-data to verify. In other examples, the predetermined behaviour rule set may include the generation of error frames when no error was detected by the apparatus <NUM>, which may require the apparatus <NUM> to monitor the receive-data and the transmit-data to determine whether the CAN controller <NUM> was acting appropriately or not.

The current security level may be stored using a security level index, which indicates the current security level. Thus, if a predetermined number of anomalous events are detected, the current security level index may be increased. This may lead to the apparatus <NUM> being configured to prevent transmission of the transmit-data during a greater number of fields of the CAN frame. If no anomalous events are detected over a predetermined period, the current security level index may be decreased. This may lead to the apparatus <NUM> being configured to prevent transmission of the transmit-data during a fewer number of field of the CAN frame. There may be two or more or three or more security levels.

Example <FIG> shows four security levels <NUM>, <NUM>, <NUM>, <NUM>. A first level <NUM> represents the CAN controller <NUM> being trusted. At this level, the apparatus <NUM> may be configured to allow the transmission of the signalling representative of the transmit-data. Second level <NUM> represents the apparatus being suspicious of the CAN controller's <NUM> behaviour and may indicate the introduction of restrictions on the one or more fields of the CAN frame in which the apparatus <NUM> prevents transmission of the transmit-data. The third level <NUM> designates a "forced passive" state in which the apparatus <NUM> is configured to prevent transmission for a greater proportion of the CAN frame. The fourth level <NUM> designates a "disconnected" state in which the apparatus <NUM> is configured to prevent transmission of all transmit-data and, in some examples, prevent receipt of receive-data by the CAN controller.

In this example, each occurrence of an anomalous events as defined in the predetermined behaviour rule set causes the apparatus <NUM> to increase the security level. However, if there are no occurrences of anomalous events as defined in the predetermined behaviour rule set for a predetermined time period or over a predetermined number of CAN frames, then the apparatus <NUM> may decrease the security level, as indicated at <NUM> and <NUM>.

However, once the fourth security level is reached, the apparatus <NUM> may be configured to require a reset before leaving the fourth security level. In one or more examples, the predetermined behaviour rule set may define one or more severe violations which, if they occur, cause the apparatus <NUM> to move directly to the fourth security level <NUM>. It will be appreciated that other rules may be provided for when security levels should be increased or decreased.

<FIG> also shows an example state diagram of the apparatus <NUM>. State <NUM> indicates the apparatus <NUM> being off. State <NUM> indicates an idle state while the apparatus awaits the transmit-data and the receive-data. State <NUM> shows the monitoring of the arbitration phase and thus, the arbitration field <NUM>. State <NUM> shows the apparatus determining that arbitration was lost. State <NUM> is presented with a double line border indicating that at the second security level <NUM> or above, the apparatus <NUM> acts to prevent transmission of the transmit-data. This is shown in CAN frame <NUM> by the square pattern shading that begins in the arbitration field <NUM>. If the apparatus detects an error at this time and the CAN controller <NUM> is trusted in the first security level <NUM>, the apparatus stops preventing transmission and allows the CAN controller <NUM> to send an error frame to the bus at state <NUM>. The apparatus then moves to state <NUM>, which in the trusted state, provides no restriction on transmission in the end-of-frame field shown by the half shaded field <NUM>. Alternatively, if the security level is the second security level <NUM> or above and an error <NUM> is detected, then the apparatus <NUM> moves to state <NUM> in which transmission is prevented for the rest of the frame as shown at <NUM> and in the end-of-frame field. The apparatus <NUM> then moves to idle state <NUM> and on to state <NUM>.

State <NUM> comprises the state the apparatus <NUM> enters when it is determined that arbitration was won. If the CAN controller is currently trusted in the first security level <NUM>, then the apparatus <NUM> does not restrict transmission. The apparatus <NUM> moves to state <NUM> after the CRC field <NUM> in which transmission is restricted if in the second security level or above. The apparatus moves to state <NUM> in which the end-of-frame field <NUM> is provided by the CAN controller without restriction. If the security level is in security level three <NUM> or greater the apparatus <NUM> moves to state <NUM> in which transmission during the end-of-frame field <NUM> is restricted as shown by the part shading in CAN frame <NUM>. From state <NUM>, the apparatus <NUM> may move to state <NUM> wherein if the security level is level two <NUM> or below and error frame may be permitted to be transmitted by the CAN controller.

Thus, in general, the apparatus <NUM> is configured to store a security level index <NUM>, <NUM>, <NUM>, <NUM>. The number of the one or more fields of the CAN frame in which the apparatus is configured to prevent transmission is lower (or a different selection of fields) when the security level index is lower. The number of the one or more fields of the CAN frame in which the apparatus is configured to prevent transmission is higher (or a different selection of fields) when said security level index is higher. In some examples, the apparatus may act to inhibit all transmission of signalling based on the transmit data when the security levels is higher.

<FIG> illustrates an example method of for a Controller Area Network, CAN, transceiver, to provide for mitigation against a compromised CAN controller coupled to said CAN transceiver, the method comprising:.

<FIG> shows a non-transitory computer readable medium comprising computer program code which is configured to cause a processor and a memory to perform the method of <FIG>.

The terms automated or automatically mean controlled operation of an apparatus, system, and/or process using computers and/or mechanical/electrical devices without the necessity of human intervention, observation, effort and/or decision.

Claim 1:
An apparatus (<NUM>) for a Controller Area Network, CAN, transceiver (<NUM>), the apparatus comprising:
a first input (<NUM>) for receiving transmit-data, the transmit-data comprising data generated by a CAN controller (<NUM>) to cause a CAN transceiver to transmit signalling that represents said transmit-data on the CAN bus (<NUM>);
a second input (<NUM>) for receiving receive-data, the receive-data indicative of signalling from the CAN bus; and
wherein the apparatus is characterized by being configured to:
detect, in said receive-data, one or more fields (<NUM> - <NUM>) of a CAN frame (<NUM>); and
prevent transmission, by said CAN transceiver, of said signalling that represents said transmit-data at times corresponding to said detected one or more fields of the CAN frame to at least prevent an error frame in said transmit-data being transmitted.