BusOff is an error state of the CAN Controller. Only the transmitter can switch in the state BusOff, if the Transmit Error Counter exceeds 255.

(more details needed on this place)

In real life a CAN controller can switch in the mode ErrorPassive sporadic. But the mode BusOff is a critical error and should never arrive without a hardware error or an other critical error.

Jean-Yves Berenger Berenger@nsi.fr:

there are 2 different ways to recover from bus off :

• automatically after 128 occurrence of 11 consecutive 'recessive' bits have been monitored on the bus. (BOSCH CAN 2.0B §8.12)
• A node can start the recovery from »bus off« state only upon a user request. (ISO11898-1 §6.15)

That's right that we can find on the market these 2 ways according the used CAN core. This difference must be taken in account to have the same behavior in drivers and network management according the choosen CAN controller

John Dammeyer johnd@autoartisans.com:

There is actually no difference. Whether the node goes automatically bus off and needs processor intervention to put it back bus on (SJA1000) or goes automatically back to bus on but creates an interrupt that it went bus off (MCP2510) both nodes are required to wait 128 * 11 bits before they can actively participate in bus communication.

If that were not the case then a node with a defective receiver would try to send, go bus off, then go bus on again and try to send thereby using 100% of the bus. The 128 * 11 makes it possible for 128 other messages to sneak through while this defective node goes through its bus on/off cycle.

The interesting thing about handling bus off situations is that on a wired CAN bus, unless there has been a major bus disturbance, the bus off situation almost never happens. But you'd better write code for that worst case scenario.

Anastasios Tsitlakidis proirl@gmx.net:

The ISO states that auto-bus on is not required, i.e. devices with auto-bus on feature are not 11898 compliant. We had this discussion with the Motorola TouCAN (which is still not conformance tested) and other CAN-contoller-cores. I heard also from several sources from CAN-industry that auto-bus-on is not wished very often. It makes more sense to let the application decide what should happen. Especially in the automotive-sector the auto-bus-on-feature is very negative.

Heinz-Jürgen Oertel oe@port.de:

I would support Anastasios. We always suggest our customers, in the case our driver reports the BusOff situation to the application, the application should wait a bit more than required by the ISO and additional have a counter for the bus-on again retry. If the device goes BusOff again and again, application should stop using CAN.