Handle bus-off

Informative

How upper-layer software handles a bus-off event. Binding rules: CHI-CAN-MUST-06/CHI-CAN-MUST-07 in Can — Requirements; rationale: Design Decisions.

What the driver does

When the controller goes bus-off (or hits an unrecoverable channel error), the driver:

moves the channel to CAN_CH_STATE_STOPPED and stops it participating on the bus;
cancels still-pending messages;
notifies you via CanIf_OnError (bus-off) or LogM_Report (other unrecoverable errors).

Detection is in Can_Interrupt for interrupt-configured channels, or in Can_CyclicFunction for polled ones.

What you must do

The driver does not recover automatically (CHI-CAN-MUST-07) — recovery is your decision:

void CanIf_OnError(uint8 channel, Can_ErrorType error)
{
    if (error == CAN_ERR_BUS_OFF) {
        /* The channel is now STOPPED. Decide whether/when to rejoin the bus. */
        /* When ready, restart it: */
        Can_SetChannelState(channel, CAN_CH_STATE_STARTED);
    }
}

Because the channel is already STOPPED, restarting is a normal STARTED transition. In a safety-related system you may instead choose to stay off the bus, apply a back-off delay, or flag a fault — the driver leaves that policy to you.

Note

Don’t restart blindly in a tight loop. A persistent bus-off usually indicates a physical fault (wiring, termination, a babbling node); immediate unconditional retries can mask it.