Sharing | A detailed explanation of the use of TOSUN CAN Disturbance interface

TH7011 is a CAN/CAN FD bus jammer device launched by Tongxing Intelligence, which adopts RJ45 Ethernet interface to connect with PC, and the Windows system drive-free design makes the device have system compatibility. Combined with the powerful TSMaster software, it supports interfering with CAN/CAN FD specific bit values; supports various trigger modes, such as frame trigger, error trigger, software trigger, etc.; and supports functions such as Bus-off behavior test and sampling point test.

It can be used for conformance testing, detecting whether the nodes comply with the communication protocol specification, and guaranteeing the normal and safe operation of the CAN/CAN FD network.

Keywords in this article: interference meter, physical wiring, initialization, interference trigger, BUSOFF, sampling point

01 | Technical background

With the rapid development of automotive electronics and industrial IoT, the stability and reliability of the CAN/CAN FD bus is crucial as a key communication technology. However, communication quality and protocol consistency differences between nodes may lead to network failures and affect system performance. For this reason, TOSUN launches TH7011 Conformance Interference Tester, which ensures that the communication quality and protocol of each node conforms to the standard through efficient and accurate conformance testing, thus guaranteeing the safe and stable operation of the network.

02 | typical application

The TH7011 has a wide range of applications in several fields, especially in scenarios where rigorous conformance testing of CAN/CAN FD bus networks is required. The following are some typical application scenarios:

Sample point testing of the ECU:During the development and validation of automotive electronic control units (ECUs), the TH7011 can be used to check the accuracy of the ECU's sampling points on the CAN/CAN FD bus, ensuring the accuracy and reliability of data transmission.

ECU Bus-off behavior test:In a CAN/CAN FD network, when a node fails or has an error, it may enter the Bus-off state, resulting in interruption of network communication.The TH7011 enables a node to enter the BUSOFF state and accurately measures its recovery time, thus comprehensively evaluating the node's error handling and recovery performance.

and frame interference:During the testing process, TH7011 can interfere with frames on the CAN/CAN FD bus to simulate various complex situations in the actual communication environment and to check the anti-interference ability and stability of network nodes.

03 | Physical Interface of TH7011

Interface Description:

RJ45 network port

This interface is used to enable data communication and configuration settings between the TH7011 and the PC.

DC 9-32V

This interface provides power input for the tamper to ensure its stable operation under different power supply environments.

CAN/CANFD

This interface is used to connect and communicate between the interferometer and the DUT of the CAN/CANFD bus system.

I/O Port

The DO1 and GND pins of this interface enable a clear view of the interference range of the set interferometer on an oscilloscope, making it easy to evaluate and analyze the interference effect.

3.1 Conventional Physical Connection of TH7011

Typical connections for the TH7011 jammer are as follows:

First, connect the TH7011 to the network port side of the computer through the RJ45 network port, then use the special power cord to supply power to the interferometer, and then connect the CAN/CANFD channel of the TH7011 to the DUT as well as the CAN/CANFD pins of the other CAN card respectively. In this way, you can observe or record the message interaction between the DUT and TH7011 in real time in TSMaster, as shown in Figure 1.

Additionally, when performing sample point testing, the CAN card used for monitoring can optionally be temporarily removed from the bus system in order to minimize possible errors introduced by the CAN card itself.

General Physical Wiring of TH7011 — Figure 1: General Physical Wiring of the TH7011

3.2 TH7011Physical Connection of Mating Oscilloscope

In order to more intuitively observe the interference effect of the interferometer (TH7011) on the oscilloscope, we need to use this connection. First, connect the clamp (a.k.a. ground terminal) of one channel of the oscilloscope to the GND (ground) pin on the I/O interface of the tamper, this is to ensure that the signal reference between the oscilloscope and the tamper is consistent. Next, use the hook end of the oscilloscope probe to make precise contact with the DO1 pin on the interferometer's I/O interface and connect it. With this setup, the oscilloscope is able to capture the interference signal from the interferometer as shown in Figure 2.

04 | Initialization of TH7011

4.1 Installation of TH7011 Upper Unit

Open the upper computer of TH7011 at [Hardware] - [Proprietary Devices] - [TH7011] of TSMaster, as shown in Figure 3.

Figure 3: Installation of TH7011 Upper Unit

4.2 Initializing the device

In the [Initialization Interface], connect and initialize the selected interferometer hardware according to the process of [Network Card Selection], [Device Selection], [Obtain Device Information], [Device Communication Parameters], and [CAN Controller Parameters]. As shown in Figure 4.

Detailed Steps:

1. Click [Scanning Network Card], if the computer has more than one network card need to select the interference instrument corresponding to the use of the network card, as shown in Figure 5.

Figure 5: Selecting the Corresponding NIC

2. Click [Scan Device], [Device Selection] drop-down box to get the serial number of the interferometer device (may contain multiple devices). As shown in Figure 6.

Figure 6: Scanning and selecting devices

3. Click the [Get Device Information] button, the right side of the parameter column to get the relevant information about the device. As shown in Figure 7.

4. Before you start connecting the device, check and make sure that the IP address of the WIN Ethernet interface is in the same network segment as the IP of the jammer device. As shown in Figure 8.

Figure 8: Jammer IP and computer IP in the same network segment

Click "Connect Device", the button will be grayed out and the status bar below will show "Network Connection Successful". As shown in Figure 9.

Figure 9: Device Connected Successfully

5. [CAN Controller Parameters] Select the corresponding parameters to set the parameters of the interferometer, click [Application Configuration]. As shown in Figure 10.

05 | Integer Bit Interference Function of TH7011

Necessary engineering environment build:Set up the test environment according to "Physical Wiring of TH7011" in Section 3 and "Initialization of TH7011" in Section 4.

Principle:Whole bit jamming is the explicit and implicit state change of a bit in the entire CAN/CAN FD message.

Generic settings for interference triggering:

(1) Interference number setting
Cycle:It is the disturbance cycle, usually the macrocycle.
Cycle interval:is the number of intervals between two macrocycles.
Number of repetitions:is the number of interference repetitions in a large cycle.
Repeat intervals:is the number of intervals between interference repetitions in a large cycle.

Taking cycle 2, cycle interval 3, repetition number 4, and repetition interval 1 as an example, a total of 8 error frames (cycle * repetition number) can be generated, and their interference out of the corresponding message records, as shown in Figure 12.

Message counts 1 through 7 are the first macrocycle, and message counts 12 through 18 are the second macrocycle.
The interval between two major cycles is 3.
The number of interference repetitions within each macrocycle is 4, and the interval between repetitions is 1.

Figure 12: The effect of the set number of interferences

(2) Selection and setting of output configuration:
In [Trigger Function] - [Output Configuration], make the selection of bit time and interference effect. Steps: First perform the clear sequence, then perform the selection of [Interference Mode] and [Bit Time], and then add segments.

① Interference patterns:
Strongly obvious:What was originally a recessive bit (as a 1) is interfered with to become a dominant bit as a 0.
Strong Hidden:What was originally a dominant bit (as 0) is interfered with to make an invisible bit as 1.
Flip:The interference is implemented based on the level state of the previous frame, and if the strong display interference of the previous frame can effectively trigger the generation of error frames, the subsequent frames will also take strong display interference measures. Therefore, the flip-flop jamming technique is more suitable for jamming a single frame; in multi-frame jamming application scenarios, some frames may not be effectively jammed.
No interference:i.e. no jamming of the specified sequence of messages

② Selection of the bit time:
Whole-bit Interference At this point, either the arbitration segment time or the data segment time is selected based on the frame type and the bit field of the interference.

Arbitration segment time:When the interference is with CAN frames, the arbitration segment time is selected across the board; when the interference is with CANFD frames, when BRS is set to 1, the bit before the BRS bit is selected as well as the bit after the interference CRC defining character bit is selected as the arbitration segment time.

Data segment time:When the interference is with CANFD frames, the selection interferes with the BRS bits up to the CRC definer bits, all of which are data segment bit times.

5.1 CAN frame jamming

In order to jam CAN frames sent from the DUT, the jamming instrument is first used to match a specific CAN frame sent from the DUT by ID, frame type, DLC, etc., and then the bit field of the jamming is selected to implement a predetermined jamming measure on the CAN frame.

5.1.1 Basic configuration for CAN frame jamming

1. In [Trigger Function] - [Trigger Configuration Panel] - [Add] - [Bit Field Trigger] open the panel as Figure 15. After configuration, select [Enable Configuration].

(1) In the process of jamming, in order to accurately match the target frame, the key information in the arbitration field and control field needs to be set. Specifically, in the operation of the upper computer of the jamming instrument, firstly, the frame ID should be converted to 11 to binary and DLC to binary, and at the same time, taking into account that the frame being processed is a CAN frame, and its specific fields, such as RTR/RRS, IDE, FDF, and BRS, are all 0 in the standard CAN frame, as shown in Fig. 16.

Figure 16: Configuration of CAN frames in the panel with arbitration and control fields

(2) Select the bit field to be disturbed as well as the specific bit: it should be noted that the offset of the panel trigger should be the previous bit to be disturbed, as shown in Fig. 17.

Figure 17: When the interference bit is selected as ACK bit

2. Interference number setting: Configure the specific number of interferences according to the demand.

Figure 18: Configuration of the number of CAN frame disturbances

3. CAN frame jamming output configuration:
The selection of [Interference Mode] is based on the selected bit. At the same time, since the interference is with CAN frames, [Arbitration segment bit time] is always selected for bit time selection, as shown in Fig. 19.

Figure 19: Selection of CAN frame jamming output configuration

5.1.2 Basic configuration for CAN frame jamming

In order to demonstrate the effect of interference on CAN frames, a scenario is set up here in which the DUT on the bus is sending a standard CAN frame. The specific parameters of the frame are: identifier (ID) 0x123, type data frame, DLC set to 8 bytes, as shown in Figure 20.

Figure 20: Example of a CAN frame with ID 0x123

1. We take the CRC defining bit of the frame as the jamming target and 20 jamming times as the number of jamming, and perform the following operations:

(1) In order to implement the jamming, we first parse and convert the ID of the frame: we convert the ID 0x123 to the binary form 00100100011 and make sure that the RTR/RRS, IDE, FDF, and BRS bits in the frame type are set to 0. At the same time, we convert the DLC value of 8 to the binary form 1000, as shown in Figure 21:

Figure 21: Standard CAN frame matching 0x123 with DLC of 8

(2) Then select the bit field of the interference is the CRC defining bit, [trigger conditions] for the CRCFIELD, [trigger offset] for the first bit is 15, as shown in Figure 22:

Figure 22: Selection of the bit field for interference is the CRC defining bit

(3) Set the number of disturbances to 20, as shown in Fig. 23:

Figure 23: Setting the number of disturbances to 20

(4) Configuration of interference output is carried out because the CRC defining bit of the frame is used as the target of interference, which is a hidden bit i.e. 1, so the selection of strong apparent interference of the arbitration segment time is carried out here, as shown in Fig. 24:

Selection of CAN frame interference output configuration, interference output configuration of CRC defining bits — Figure 24: Interference output configuration for CRC defining bits

2. Then, after clicking Start Test, the interference effects in TSMaster and the oscilloscope are shown below:

(1) The message information error frame when TC1014 on TSMaster is acting as a receiver node is 20 times, and the error message is FORM ERROR, which is identified as a form error when one or more illegal bits are present in the fixed bit field (CRC definer, ACK definer, end of frame). This is shown in Figure 25.

Figure 25: Message information of the accepting node when interfering with the CRC defining bit

(2) On the oscilloscope, according to the wiring diagram in Section 3.2 Physical Connections for the TH7011 Companion Oscilloscope, you can observe on the oscilloscope that the interference enable is pointing to the CRC defining bit and that this bit is being interfered with as a dominant bit, and that there are 20 error frames. This is shown in Figure 26 and Figure 27.

Figure 26: Interference enable pointing to CRC defining bit

Figure 27: 20 error frames generated by interfering CRCs

5.2 CANFD frame interference

In order to jam CANFD frames from the DUT, a jammer is used to match a specific CANFD frame from the DUT by ID, frame type, DLC, etc., and then to select the bit field to be jammed to implement a predetermined jamming measure on the CANFD frame.

5.2.1 Basic configuration of CANFD frame jamming

1. Click Trigger - Trigger Configuration Panel - Add - Bit Field Trigger to open the panel

(1) In the process of jamming, in order to accurately match the target frame, the key information in the arbitration field and control field needs to be set. Specifically, in the upper computer operation of the jamming instrument, firstly, the frame ID should be converted to 11 to binary and DLC to binary, and at the same time, considering the standard CANFD frames being processed, the specific fields, such as the RTR/RRS and IDE bits, should be set to 0, and the FDF and BRS bits should be set to 1, as shown in Fig. 28.

Figure 28: Configuration of CANFD frames in the panel with arbitration and control fields

(2) Select the bit field to be interfered with and the specific bit: it should be noted that the offset of the panel trigger should be the previous bit to be interfered with, as shown in Fig. 29.

Figure 29: Selection of CANFD frame interference bit for EOF bit 6 when

2. Interference number setting: Configure the specific number of interferences according to the requirements, as shown in Figure 30.

Figure 30: Configuration of the number of disturbances

3.CANFD frame jamming output configuration:

The selection of [Interference Mode] is based on the selected bit. At the same time, due to the interference of CANFD frames, the selection of bit time is different from that of CAN frames. If the bit field of interference is selected between the areas of BRS and CRC defining bits, it is called [data segment time], and the other bit fields are called [arbitration segment time].

5.2.2 Example of CANFD frame jamming

In order to demonstrate the effect of interference on CANFD frames, a scenario is set up here in which the DUT on the bus is sending a standard CANFD frame. The specific parameters of this frame are: identifier (ID) 0x123, type FD frame, DLC set to 9 bytes, as shown in Figure 32.

Example of a CAN/CANFD frame with ID 0x123 — Figure 32: Example of a CANFD frame with ID 0x123

Example 1: We take the SOF bit of this frame as the jamming target, and 20 jamming as the number of jamming times, and perform the following operations:

(1) In order to implement the jamming, we first parse and convert the ID of the frame: convert ID 0x123 to the binary form 00100100011, and make sure that RTR/RRS and IDE in the frame type are set to 0, and that the FDF and BRS bits are set to 1. At the same time, the DLC value of 9 is converted to the binary form 1001, as shown in Figure 33.

Figure 33: Standard CANFD frame matching 0x123 with DLC of 9

(2) Then select the bit field of the interference is SOF, [trigger conditions] for SOF, [trigger offset] for the first bit is 0, as shown in Figure 34.

Figure 34: Selection of the bit field for interference is the SOF bit

(3) Set the number of disturbances to 20, as shown in Fig. 35.

(4) Then, after clicking Start Test, the interference effects on TSMaster and the oscilloscope are shown below:

① The message information error frame for TC1014 on TSMaster as a receiving node is 20 times, as shown in Figure 36.

Fig. 36: Message information of the accepting node when interfering with CANFD SOF

② On the oscilloscope, wired according to the diagram in Section 3.2, you can observe on the oscilloscope that the interference enable points to the SOF bit and the SOF bit is interfered with as a stealth bit with 20 error frames. This is shown in Figure 37 and Figure 38.

Figure 37: Interference Enable Pointing to SOF Bit

Figure 38: 20 error frames generated by interfering with the CANFD SOF

Example 2: Here, the following operation is performed with the 7th bit of the data segment of the frame as the jamming target and 20 jamming times as the number of jamming attempts:

Figure 39: Standard CANFD frame matching 0x123 with DLC of 9

(2) Then select the bit field of the interference is DATA, [trigger conditions] for the DATAFIELD, [trigger offset] for the first bit is 6, as shown in Figure 40.

Figure 40: Bit field for selective interference is bit 7 of the data segment

(3) Set the number of disturbances to 20, as shown in Fig. 41.

(4) Then, after clicking Start Test, the interference effects on TSMaster and the oscilloscope are shown below:

① The message information error frame when TC1014 on TSMaster is acting as a receiver node is 20 times, as shown in Figure 42.

Figure 42: Message information of the receiving node when interfering with CANFD DATA

② On the oscilloscope, according to Section 3.2 TH7011 Mating Oscilloscope Physical Connection Methods of Diagram Wiring, you can observe on the oscilloscope that the interference enable is directed to bit 7 of DATA and that DATA bit 7 is interfered with as a dominant bit, and that there are 20 error frames. This is shown in Figure 43 and Figure 44.

Figure 43: Interference enable pointing to DATA bit 7

Fig. 44: 20 error frames generated by interfering with CANFD DATA bit7

06 | BUSOFF test function of TH7011

TH7011 mainly interferes with the frames sent out by the DUT to make the DUT enter the BUSOFF state. In this process, using the [Message Information] module in the TSMaster tool or the waveforms on the oscilloscope, you can observe and analyze whether the DUT has the ability to recover automatically after entering the BUSOFF state and how long it takes to recover from the BUSOFF state to the normal state.

6.1 BUSOFF Test Configuration Procedure

1. know how to interfere with frames emitted from the DUT according to Chapter 5 TH7011 Whole Bit Interference:
(1) Match the frames to be jammed and select the jamming bit field:
(2) Configure the number of interferences: If you need to enter the BUSOFF state several times to test whether the device under test has a fast or slow recovery and recovery time: you can carry out unlimited interferences as shown in Figure 45, you can also configure the period and the number of times of repetition, for example, if you need to carry out the BUSOFF test for ten times, then you can set the period of 10, the number of repetitions is set to 32, as shown in Figure 46.

(3) Configure the interference output according to the selected interference bit.
(4) Click Start Test to jam the frames emitted by the DUT.

2. Use the message information or oscilloscope waveform to observe the point in time when the measured part enters BUSOFF, and record the time interval for resuming communication, which is the BUSOFF recovery time.

6.2 BUSOFF Test Example

In order to visualize how the TH7011 can effectively test the BUSOFF behavior of the DUT, a specific test scenario was constructed. In this scenario, the DUT is sending a standard CAN frame on the CAN bus with a clear parameter configuration: its ID is set to 0x123, it follows the format specification of a standard data frame, and the DLC indicates that it contains 8 bytes of data, as in Figure 47.

Figure 47: Example of a CAN frame with ID 0x123

The TH7011 device is then used to jam this transmitting CAN frame an unlimited number of times, with the jamming bit field in bit 7 of the data segment (the selection of this bit field can be adjusted according to the actual test requirements). Through this continuous jamming, we aim to trigger the DUT to enter the BUSOFF state continuously.

Next, we will detail the specific steps taken to implement this test and the test results in order to clearly demonstrate how the TH7011 can be utilized to evaluate the performance of the DUT in the BUSOFF state:

The TH7011 performs an unlimited number of interferences on the DUT:

(1) According to the frame sent on the bus in Fig. 47, the [Arbitration Field] and [Control Field] of the upper unit of the jamming instrument are set as shown in Fig. 48, and the jamming bit field is selected as shown in Fig. 49.

Figure 48: Standard CAN frame matching 0x123 with DLC of 8

Figure 50: Bit field for selective interference is bit 7 of the data segment

(2) Configure the number of jamming times: Here, unlimited jamming is performed as shown in Figure 50, and the number of jamming times can be configured according to the actual demand.

(3) According to the selection of the interference bit to interfere with the output configuration: here interference with the seventh bit of the data segment that is, so at this time for strong display of the arbitration segment bit of the interference, as shown in Figure 51.

(4) Observe the point in time when the measured part enters BUSOFF using the message information or the waveform of the oscilloscope, and record the time interval for resuming the communication, i.e. the BUSOFF recovery time.

Observe on the TSMaster's message information:
① Ensure that the configurations of (1) (2) (3) are completed. Click [Start Recording] in [Analyze] - [Record and Playback] function of TSMaster to start recording messages;

② Go to the upper panel of the jammer, click [Open Test] and wait for a few seconds;

③Click "Terminate Test" to end the test;

④ Play back the previously recorded messages on the TSMaster to find the error frames generated by the interference and switch the message information to relative time for analysis.

⑤ By observation it will be found that after 32 frames of error interference, the system enters the BUSOFF state:
If the device under test does not have the BUSOFF recovery function at this time, then this is the time when the device under test stops participating in bus communication and can neither receive messages from the bus nor send messages to the bus, as shown in Figure 52;
If it has the BUSOFF recovery state, then the BUSOFF recovery time is 0.002912 seconds, and the DUT will continue to participate in the bus after the BUSOFF recovery, as shown in Figure 53.

⑥ In order to determine whether the DUT is equipped with the fast or slow recovery function of BUSOFF, the same method as shown in Figure 53 can be used for observation. The specific steps are: observe and record the recovery time of each BUSOFF when playing back the message. If the recovery time of each time is approximately the same, it indicates that the device under test does not have the fast and slow recovery function; on the contrary, if there is a significant difference between the recovery time of the first period and the recovery time of the later period, it indicates that the device under test has the fast and slow recovery function.

Figure 52: Message information without BUSOFF recovery state

Figure 53: Entry into BUSOFF after 32 error frames and BUSOFF recovery time

Observation on an oscilloscopeAt this point, the physical wiring needs to be as described in Section 3.2 Physical Connection of the TH7011 Companion Oscilloscope:

① After connecting the interference enable, you can clearly see the number of error frames generated from the waveform, such as Figure 54, you can see 32 error frames.

② By observing the waveform graph displayed on the oscilloscope (shown in Fig. 55), you can evaluate the BUSOFF recovery characteristics of the part under test. This is done by measuring the BUSOFF recovery time intervals between 32 adjacent waveform frames. If these time intervals are basically the same, it means that the DUT does not have BUSOFF fast or slow recovery mechanism, but only simple BUSOFF recovery; while if there is a significant difference in the time intervals, it means that the DUT has BUSOFF fast or slow recovery mechanism. It can be seen that the time interval of the following figure is consistent every time, so it only has a simple BUSOFF recovery function.

Figure 55: BUSOFF Recovery Time Shown on Waveforms

07 | Sample point test function of TH7011

This section describes the principles and test procedures of the TH7011 to test the sampling point of the DUT as well as the second sampling point.

7.1 Test DUT sampling point configuration

1.TH7011 test DUT sampling point test principle:
The TH7011 searches for the sampling point of the DUT from right to left through the

① Performs intra-bit flip-flop jamming on bit 15 of the data segment of the frame sent by the jammer (at this point the jammer is the transmitting node and the DUT is the receiving node);
② and start jamming at 90% of that bit;
(iii) Gradually increase the interference range by 5 nanoseconds per cut;
④ Until an error frame appears, then it is considered that the sampling point of the measured part is found. Here, assuming that an error frame appears at the location of the interference to 80%, then it is considered that this is the sampling point of the measured part. As shown in Figure 56.

Figure 56: TH7011 Sample Point Test Principle

2. Examples:
In order to visualize how the TH7011 can effectively test the sample points of the DUT, we have chosen the TC1013 as the DUT and pre-configured the sample point parameters of the TC1013 in the TSMaster software. Specifically, we have set the sampling point of the arbitration segment to 75%, while the sampling point of the data segment is set to 80%, as shown in Figure 57.

Figure 57: Setting the Arbitration Segment and Data Segment Sampling Points for the TC1013

Next, we will test the TC1013 using the TH7011 device, aiming to confirm whether the sampling points of the TC1013 in the arbitration field and data field match the parameters we set in TSMaster through actual measurements. The operation steps are as follows:

(1) Environment construction:
① At this time, the physical layer wiring try to ensure that only the measured parts and the interferometer on the bus, to avoid the CAN card to bring some error.
② Initialization of TH7011 is operated according to Section 4 Initialization of TH7011:.

(2) Description of the parameters of the sampling point test OP:

① [ID]: Specify the CAN/CANFD frame ID used to test the location of the sampling point, which needs to avoid conflict with other nodes on the bus.

② [Preset Arbitration Segment/Data Segment Sample Points]: Users are required to fill in the pre-set arbitration segment and data segment sample point values. During the sample point test, the jammer will use these preset values as its own sample points for effective communication with the DUT.

To ensure that the test runs smoothly, the user should preset the value of the sampling point to be smaller than the actual sampling point of the part under test. The reason for this is that if the preset value is too large, the sampling of the interferometer itself may be unnecessarily affected, thus affecting the accuracy of the test results.

④ [Accuracy]: Find the sampling point according to the set sampling point test accuracy (in 5 nanoseconds).

⑤ [Number of Tests]: Allows the user to customize the number of tests in each jamming cycle. Specifically, the TH7011 is capable of sending a specified number of messages for sample point testing at each cut (accuracy * 5) nanoseconds.

⑥ [Timeout Time]: the timeout time for testing the sampling point, if it exceeds this time, the sampling point test will be stopped;

⑦【Open Sampling Test/Stop Sampling Test】：Users can click to open the sampling point test after filling in the above ①-⑨. When the test is completed, the sampling point test will be stopped automatically.

⑧ [test results]: after the completion of the test, the test results column will show the results of this sampling point test, at this time the TH7011 test the arbitration section of the TC1013 and the data section of the sampling point in Figure 59. test results of the specific error analysis can be seen in Chapter 8.7 .

Figure 59: Tested Sampling Point Results

7.2 TH7011 test second sample point

The Second Sample Point (SSP) is unique to the CAN FD protocol and is located in the second half of the bit time and is used to perform additional signal sampling to improve the reliability of data transmission. It is mainly used for bit error detection to ensure that the data sent by the transmitting node is consistent with the data received by the receiving node.

The TH7011 supports the use of the intra-bit interference module of its host computer to perform a test of the second sampling point of the piece under test, with the purpose of verifying that the transmitting node can detect possible bit errors through the second sampling point when sending data frames, and send error frames accordingly.

1. Interpretation of interference within the upper bit of the interferometer:

Intra-bit interference is the process of de-defining the TICKS number to determine the range of interference within a whole bit. If the custom TICKS number is 200 at this point, then this corresponds to an interference range equal to the first 1000 nanoseconds of a whole bit (assuming a whole bit is 2000 nanoseconds).

(1) Calculation of No. of Ticks.
Calculation formula: Bit time/5 nanoseconds
For example: at this time the baud rate of the data segment is 2000Kbps, then the bit time is 500 nanoseconds, 500/5 = 100 nanoseconds, ticks is 100 nanoseconds.

(2) Sequence segment control:
At this time, you can customize the TICKS for intra-bit interference, such as Figure 60: customize the TICKS for intra-bit interference is 200, then the interference effect at this time can be expressed as shown in Figure 61.

Figure 60: Interference TICKS within custom bits is 100

① Entire bit: 2000 nanoseconds, representing 400ticks.
② Customize TICKS to 200: i.e., from 0 nanoseconds to 1000 nanoseconds.

Figure 61: Illustration of customized intra-bit interference TICKS is 100

(3) Error frames will only occur if there is interference to the sampling point, for example, Figure 62.
① Assuming a CANFD data segment bus baud rate is 2000K, the bit time is 500 nanoseconds, a data segment bit is 100TICKS, the sampling point is 80%, that is, at 80TICKS, the sampling point can be seen in the following figure at 400 nanoseconds.
② If the customized TICKS is 50 TICKS at this time, the dotted line indicates the interference part, which cannot interfere with the sampling point to produce no error frame.
③ If the custom TICKS is 81TICKS at this point, the dotted line indicates the interference part, which interferes with the sampling point to generate an error frame.

Figure 62: Intra-bit interference generates an error frame only if it interferes with the sampling point

2. Procedure for testing the second sampling point by the interferometer:
(1) The DUT sends a CANFD frame, in which case the DUT acts as the transmitting node.

(2) The jammer matches a CANFD frame sent by the DUT via the host computer and performs simulated intra-bit jamming of this frame to test the second sample point of the DUT.

(3) Since the TH7011 does not have a direct second sampling point interface operation, it is necessary to combine the output configuration panel of the upper computer of the interference meter to carry out the in-bit interference operation, and combine it with an oscilloscope to observe the actual interference range:

Intra-bit interference is determined by defining the TICKS number to determine the range of interference within an integer bit. the TICKS number indicates the time unit for which the interference lasts, and the range and intensity of the interference can be varied by continually adjusting the TICKS number.
During data frame transmission, the jammer selects specific data bits for intra-bit jamming.
The response of the DUT is observed by continuously adjusting the interference range (i.e., the number of TICKS) within the whole bit. When the DUT sends out an error frame, it is considered that the interference touches the second sampling point at this point, thus determining the location and performance of the second sampling point.

3. Examples:
In order to visualize the steps and effects of the TH7011 on testing the second sampling point of the DUT, the TC1013 is selected as the DUT here and a specific test scenario is set up. In this scenario, we assume that the TC1013 sends out a frame: the frame ID is 0x123 and it is an FD frame, and its DLC is set to 8, as shown in Figure 63.

At this time, it is necessary to first build the environment, then match the frame to be interfered, followed by selecting the Bit bits of the interfered data segment and the number of interferences, and finally constantly adjusting the TICKS of the intra-bit interferences, and judging the position of the second sampling point with the combination of the TSMaster and the oscilloscope. The specific operation steps are as follows:

(1) Environment construction:
① Because it is necessary to test with the oscilloscope at this time, the physical layer wiring is wired in accordance with Section 3.2 TH7011 Matching Oscilloscope Physical Connection.
② Initialization of TH7011 is performed according to Section 4.

(2) Match the frames to be jammed:According to the frame sent on the bus in Figure 63, the settings of the [Arbitration Field] and [Control Field] of the upper computer of the interferometer are shown in Figure 64.

Figure 64: Matching FD frames from Figure 63

(3) Select the Bit position of the interfering data segment:
The selection of the bit bits to be interfered with needs to follow a key principle: the dominant bit, which is located after the recessive bit, should be prioritized. This is because the resynchronization mechanism is an important means of ensuring that the clocks of the sender and the receiver are consistent in the communication process. The principle of "resynchronization of the next dominant bit after the recessive bit" suggests that the dominant bit appearing after the recessive bit is a reliable synchronization point. Selecting the dominant bit for interference ensures that the DUT can correctly use this synchronization point for resynchronization when interference occurs, thus testing its performance more accurately under interference conditions.

So using the frame sent in Figure 63 as an example, where the first byte of the data segment is 0xAA (i.e., the binary representation is 10101010), then bit 6 of the data segment is a dominant bit, located after a recessive bit. Therefore, choosing this bit for jamming makes full use of the resynchronization mechanism and ensures the accuracy and reliability of the test.

Figure 65: Interference with bit 6 of the FD frame data segment

(4) Select the number of interferences:
The recommendation is infinite jamming. Infinite jamming is mainly convenient to see if there will be any error frames in the TSMaster's message information.

(5) Setting of output configuration i.e. setting of intra-bit interference:
In the process of exploring the secondary sampling points, a right-to-left strategy is adopted here, and the position 88% of the data bits is selected as the initial interference starting point (this starting point and test strategy can be flexibly adjusted according to actual needs). Subsequently, the interference range is gradually extended in TICKS (each TICKS represents a time precision of 5 nanoseconds). If the generation of an error frame is not triggered during this process, we will continue to increase the interference range until an error frame is detected in the TSMaster message information, and the point of occurrence of this error frame is considered as the second sampling point of the DUT.

To ensure the accuracy of the secondary sampling point location, it is recommended to analyze it in conjunction with waveform data from an oscilloscope.The reason for this is that although the TH7011 is able to provide a theoretical calculation of the location of the secondary sampling point based on the TICKS value, the actual waveform may deviate from this calculation. This deviation is mainly attributed to the transmission delay of the signal between the transmitter and receiver, which may result in the TICKS value set on the host computer panel not being exactly the same as the time when the actual disturbance reaches the sampling point of the measured part. Therefore, assisted calibration by oscilloscope waveforms can be more effective in determining the precise sampling point location, thus enhancing the accuracy and confidence of the test.

A diagram of the above principle can be seen in Figure 67:

Interference bit selection: a bit in the data segment of the frame sent by the device under test.
The TH7011 initially interferes with the range of frames sent by the DUT: it starts interfering from bit 88%, where the red dashed line is the interference range.
Increase the range of interference: cut downward in 5 nanoseconds or 1 ticks.
Determine the location of the second sampling point: When the first error frame occurs here is considered by the interferometer to be the location of the second sampling point, assuming that the interference to the 79% location of the error frame, then this is considered to be the secondary sampling point of the measured part. The value of the second sampling point = (bit time one bit range - interference range / bit time one bit range) × 100%.

Figure 67: Schematic illustration of the secondary sampling point test

(6) Set up TICKS to locate internal interference and use TSMaster in conjunction with an oscilloscope to determine the location and performance of the second sampling point.
① The interference is first applied starting from the 6th bit of the data segment, specifically from position 88% of this bit. The range of interference was set so that the first 88 TICKS were not interfered with and the subsequent 12 TICKS were interfered with, which corresponds to a total duration of 60 nanoseconds starting from 440 nanoseconds and continuing until 500 nanoseconds. Under this interference condition, no error frames were observed. Figure 68 illustrates the relevant settings of the jammer's upper computer, and it can be clearly seen that when the jamming range was set to 60 nanoseconds, no error frames appeared on the TSMaster's message information.

At the same time, the actual effect of the interference was also observed by means of an oscilloscope. As shown in Fig. 69, the interference range shown on the oscilloscope was approximately 72.7 nanoseconds.

Figure 68: Interference range of the upper computer at this point is 60 nanoseconds without error frames

Figure 69: Interference range shown on the oscilloscope is around 72.7 nanoseconds

② Then the interference range was continued to be increased, at which time the range of interference was set to not interfere with the first 85 TICKS and to interfere with the subsequent 15 TICKS, which corresponds to a total duration of 75 nanoseconds of interference starting at 425 nanoseconds and continuing until 500 nanoseconds. Under this interference condition, no error frames were observed. Figure 70 illustrates the relevant settings of the jammer's upper computer, and it can be clearly seen that when the jamming range was set to 75 nanoseconds, no error frames appeared on the TSMaster's message information.

At the same time, the actual effect of the interference was also observed by means of an oscilloscope. As shown in Fig. 71, the oscilloscope showed an interference range of about 87 nanoseconds.

Fig. 70: At this point the interference range of the host computer is 75 nanoseconds without error frames

Figure 71: Interference range shown on oscilloscope is about 87 nanoseconds

(iii) Continue to increase the interference range, gradually adjusting it downward in a range of TICKS until at this point the range of interference is set to not interfere with the first 79 TICKS and to interfere with the subsequent 21 TICKS, which corresponds to a total duration of 105 nanoseconds starting at 395 nanoseconds and continuing until 500 nanoseconds. Under this interference condition, the generation of error frames can be seen. Figure 72 shows the relevant settings of the jammer's upper computer, and it can be clearly seen that when the jamming range is set to 105 nanoseconds, the message information has the appearance of error frames.

At the same time, we also observed the actual effect of the interference by means of an oscilloscope. As shown in Fig. 73, an error frame appears on the oscilloscope, and Fig. 74 the interference range shown on the oscilloscope is about 118.5 nanoseconds. Then the secondary sampling point of the measured part can be considered to be about (381.5/500) × 100% = 76.30% at this time.

Figure 72: Interference range of the host computer at this point is 105 nanoseconds for error frames to appear

Figure 74: Interference range shown on the oscilloscope is around 118.5 nanoseconds

08 | Q/A Answers

8.1 Q: The TH7011 upper unit does not appear in TSMaster?

The TH7011 Upper Unit has been integrated directly into TSMaster October 14, 2024 and later versions and can be opened and used directly by the user.
Earlier Version Usage (for TSMaster February 28, 2024 and later, but earlier than October 14, 2024)
The user has to add the function manually:
- Open TSMaster and go to [Application] - [Toolbox Design and Development Environment];
- In [Toolbox List], drag the corresponding *.tbmc file in;
- Click the "Run Selected Toolbox" button on the toolbar at the top of the form to start using the TH7011 host computer functions.

8.2 Q: Failure to scan the network card?

After clicking Scan for NICs, the host computer does not respond and there is no NIC selected in the NIC Selection drop-down box.

Whether the power-up is successful or not: see whether the power and config lights of the interferometer are all on, and these two lights should be all on under normal power-up conditions.
Whether the network port of the interferometer and the network port of the computer are connected.

8.3 Q: Scanning device failed?

It may be necessary to disable all firewalls/antivirus software under Windows: e.g. software needs to be whitelisted.
Determine if the selected NIC is the one connected to the jammer (open the adapter, plug in the NIC, and see if it is displayed or appears).
Confirm whether it is a wiring problem: Observe whether the power and config lamps of the jamming instrument are fully lit; the yellow lamp of the network interface lamp is blinking.
It may not run successfully because the computer has an encryption policy.

8.4 Q: Failure to connect the device?

(1) The computer wired network card must be bit static IP, and keep the same network segment with the jammer, but the computer IP and the jammer IP can not be set to the same:
① If you choose to configure the computer network segment and the jammer on the same network segment, then you need to start again from the first step of scanning the network card.
② You can also configure the network segment of the interferometer and the computer on the same network segment, and then directly configure the connection.

(2) It may be necessary to disable all firewalls/antivirus software under Windows: e.g., software needs to be whitelisted.

(3) Check that the network port link is stable.

8.5 Q: How do I perform extended frame jamming?

A:If the DUT sends out extended frames (because there is no function to interfere with extended frames individually) or does not require interference with a specific frame, we can set both the arbitration field and the control field on the panel to X. In this case, the following configuration, with both the arbitration field and the control field set to X, means to interfere with all the frames (X is equivalent to the function of a mask).

8.6 Q: What are the possible reasons for interference not working?

A:(1) Verify that the DUT is on the same bus as the interferometer:
Because the CAN card is connected to the bus at this time, the normal acceptance of the message information inside the message does not represent the measured part and the interference instrument on the same bus, but only indicates that the CAN card and the measured part are on the same bus. To verify whether the jammer and the device under test are on the same bus, it is necessary to use the sampling point function of the jammer's host computer, click to open the sampling point test, and see whether the ID of the sampling point setting appears on the bus, as shown in the following figure:

If not on the bus for a reason:
① wiring error, because the interferometer has only one CAN channel, CAN_H and CAN_L correspond to pins 7 and 2 respectively, pay attention to the measured part of the pin can be corresponded to; and the interferometer is guaranteed and the measured part of a bus, for example, suppose the measured part of the two channels he is a channel, a way is to receive telegrams of the channel, a way is to send the channel, the need for CAN card has been to send him a wake-up message The other channel of the ECU will send out the telegram, at this time, we need to pay attention to, the interference meter must be with the ECU to send the telegram of the channel in a bus, rather than receiving the telegram of the channel.

② Whether the measured part has a terminating resistor or not; the interferometer itself does not have a terminating resistor, and the measured part needs to increase the resistor if it does not have one; if the measured part does not have a terminating resistor, then it directly fails to communicate.

(2) Check whether the parameters are correct: whether the frame parameters configured in the trigger configuration panel interface are the frames sent out by the measured parts, it is necessary to match each parameter one by one in order to allow the jamming instrument to match to the jamming position selected by the frame.

(3) Resulting from the output configuration:
① Determine whether the interference pattern and the interference position are consistent, such as selecting the location of the interference would have been a strong display position, interference into a strong display position, you can not see any effect on the bus.
② If the interference is intra-bit, note whether the interference is to the sample point location of a bit. No interference to the sample point will not generate an error frame.

8.7 Q: Sampling points are not tested or are inaccurate?

A:1. The test doesn't work:

The test sample points exceeded the interferometer sample point test range, which ranges from above 60 percent to 90 percent and below.
Verify that the DUT is on the same bus as the interferometer:
Verification method: connect a CAN card, turn on the sampling point test, and see that when it is sent out, it has the ID specified in the sampling point test, and if it does not, it is not on the same bus.
Does the measured part have a terminating resistor; if it does not, you need to add a resistor because the tester itself does not come with a terminating resistor.
The presence of a wake-up frame for the DUT is required, and the test cannot be performed if the DUT is not started.
Determine whether the jammer and the DUT are communicating successfully.

2. Test results are inaccurate or zero:

When testing the sampling point, the configured outgoing frame ID must not be duplicated with the existing frame ID on the bus; the rest of the parameters are determined to be filled in correctly if they are more demanding.
When the CAN card, ECU, and tamper are on the same bus, if you need to test the ECU's sample point, you should make the CAN card's sample point smaller than the ECU's sample point, or else the test's sample point result will be the one with the higher sample point, and you will not be able to confirm whether it is the ECU's sample point or not. The best case scenario is to remove the CAN card from the bus after ensuring successful communication, leaving only the DUT and the interferometer on the same bus.
The value preset by the household should be smaller than the desired value expected to be tested to avoid measuring the interferometer's own sampling points.
If the sampling points of the ECU tested by the TH7011 deviate significantly from the actual, please contact application support:
- This is because differences in testing methods are likely to cause errors in the sampling points;
- This is because sample point measurements can have some error due to the clock period of the part under test, for example:
  The measurement accuracy of TH7011 is the step size that can be shortened or increased at each noise cycle, i.e., 5ns. Assuming that the CAN clock frequency of the DUT is 40MHz and the prescaler value is 1, the single TQ size is 25ns. At 500K , 2000K baud rate, the bit time is 2000ns and 500ns in respectively:
  The accuracy errors introduced by the TH7011 are: Arbitration segment: 5/2000 = 0.25%, Data segment 5/500 = 1%;
  There is a TQ error due to the DUT hopping edge mechanism itself: 25/2000 = 1.25% for the arbitration segment and 25/500 = 5% for the data segment.
  So its arbitration field sampling point error is ±1.5%. data field sampling point error ±6%.

Tip:
1. Software download:
Click on the software download link below to download and install directly, beta version is recommended:

2. Software upgrades:
You can check for upgrades to the latest version within the software, provided that your computer has an Internet connection.

Note: TOSUN Technical Support Email:support@tosunai.cnWe welcome inquiries! (Company and contact information must be indicated)