ECSS-CAN Onboard Bus Controller

What it is

ecss_can is an ECSS-E-ST-50-15C “CANbus extension protocol” layer — the European spacecraft onboard-bus standard — delivered as synthesizable SystemVerilog soft-IP with an APB4-lite control interface and built-in ISO 26262 (ASIL-B) / space-grade safety instrumentation.

Key Features

• Dual-bus A/B redundancy with independent per-bus liveness watchdogs and automatic failover on loss (err_code 4) — the key space-availability mechanism, so one dead or jammed bus never takes CANopen services down
• Structural frame-integrity check on top of the MAC’s CRC/ACK: every frame’s {function-code, node-id} is validated and an out-of-range SDO object-dictionary index is blocked at the write, not just flagged (err_code 3)
• Onboard time distribution (CANopen TIME, COB-ID 0x100): a time-master pulses the 32-bit onboard time, a time-slave tracks it and raises a sync-loss timeout on a missing master (err_code 4)
• CANopen object dictionary + SDO + heartbeat (CiA 301 subset): a host-provisioned OD RAM serviced by SDO_RX/SDO_TX requests, plus a heartbeat producer/consumer with a missing-heartbeat watchdog (err_code 4)
• Config-register even parity over CTRL/NODECFG/TIME_VAL (err_code 1) and a complementary-DMR shadow of the redundancy-management + CANopen service FSM (err_code 9), both provable via fi_* fault-injection, including fi_kill_a/fi_kill_b to prove failover
• Bus-fault confinement by failover rather than the classic CAN error-active/passive/bus-off state machine, which stays the job of the attached can_fd/can_xl core
• ASIL-B pre-sign-off FMEDA: SPFM 93.20%, LFM 88.36%, PMHF 4.60×10⁻⁹/h — PASS against the ASIL-B target; pairs with rad_tol_wrap (TMR/EDAC) for radiation-tolerant flight deployment

Standards & Compliance

ECSS-E-ST-50-15C (Spacecraft CANbus extension protocol), CANopen (CiA 301), CAN 2.0B / CAN-FD (via can_fd/can_xl); ISO 26262 ASIL-B SEooC (SPFM 93.20%, LFM 88.36%, PMHF 4.60×10⁻⁹/h)

Functional Safety

ASIL-B target (SEooC) · SPFM 93.20% · LFM 88.36% · Informational — not gated

Informational FMEDA — this IP is reported but NOT gated. The SPFM/LFM figures above are engineering estimates from a model that is not held to the ASIL metric gates (QM, safety-by-composition, a vendor-core overlay, or a pre-sign-off Technology Preview, depending on the IP). They are not a certification claim and must not be relied on as one. See the safety manual for this IP’s exact status, assumptions of use, and any open items.

ISO 26262-5 FMEDA method (transferable evidence for the ECSS-Q-ST-60 / radiation case) · FMEDA available · Safety Manual included

Register Map

…5 more registers — see datasheet for the full table.

Getting Started

// Minimal instantiation
ecss_can #(
 .ADDR_W(6)
) u_ecss_can (
 .clk (clk),
 .rst_n (rst_n),
 // APB4
 .p_paddr (paddr),
 .p_psel (psel),
 .p_penable (penable),
 .p_pwrite (pwrite),
 .p_pwdata (pwdata),
 .p_prdata (prdata),
 .p_pready (pready),
 // Safety
 .err_clear (1'b0),
 .err_valid (err_valid),
 .err_code (err_code)
);

Configure via the CTRL register after reset to enable the IP and set operating parameters. Monitor err_valid / err_code for any safety faults reported by the built-in safety monitor.