CAN Transceiver Fault Question

Paul, CAN is a very robust protocol (hamming distances, CRC, etc) and system  including the current state of the art physical layers (transceivers).  There are a few fail modes in a CAN system that will render the bus inoperable. 

Please refer to the protection features section in the TI SN65HVD255 datasheet for a full descirption of the protection built into a modern CAN transceiver. 

From the CAN transceiver perspective the main failure that would block the CAN network would be a PCB failure or uP (CAN controller / protocol) failure that would driver the TXD pin of the transceiver continuously "dominant' or logic low.   Due to how CAN arbitration (protocol & PHY) works, dominant overwrites recessive on the bus so this fault would block all communication where as a fault on TXD that is logic high (recessive) will not block the bus.  In modern transceivers we have a feature called TXD dominant time out which effectively will stop the transceiver with this fault from driving continuously and blocking the bus (see app section in this data sheet for details). 

The second protection feature is the undervoltage lock out, transceiver level is a back up to the voltage supervision on the supply / processor rails). This UV lockout makes sure when the transceiver goes undervoltage it is put in a controlled state to not influence the bus. The SN65HVD255 for example does this without glitching the bus and an unpowered HVD255 is "ideal passive", thus no loading on the bus communication that remains. 

In terms of another failure where the transeiver would block the bus it would have to be a catastrophic fail of the device likely due to improper protection from external transient or out of spec event on the bus lines.  You should match the abs max and protection circuits of the CAN system to the environment you will put the CAN network into, normally this would be transient suppressors on the CAN bus lines. 

There are several system level faults that would render a network in-operable:  cut bus line or lines (open), shorted bus lines to each other (short), bus lines shorted to GND or a power supply may or may not still work depending on a lot of circumstances around the short but generally it wouldn't work.  Thus most of the other main fail modes have to do with wiring / h/w faults of the system.

We will shortly have a CAN transceiver in the HVD25x family specifically designed with features for redundant physical media (cabling ) set up if you feel the system risks to wiring / cabling are high enough you need redundancy but the trade off is a 2nd set of cables & PHYs for the redundant physical media link. 

-- Scott