The operational flexibility of distributed embedded systems is receiving growing attention because it is required to support on-line adaptation to varying operational conditions, either due to changes in the environment or to faults in the system. However, flexibility makes dependability more difficult to achieve, because there is less a priori knowledge. One protocol that favors flexibility and is widely used in embedded systems, particularly in automotive and robotic systems, is CAN, but some claim that it is not adequate to support safety-critical applications. We argue that CAN, deployed with an adequate overlay protocol, can provide the required support for dependability and flexibility. One such overlying protocol is Flexible Time-Triggered CAN (FTTCAN), that enforces a global notion of time and a global periodic schedule by means of specific messages issued by a master node.
Distributed embedded control systems for safety-critical applications require a high level of dependability. Despite the existence of protocols such as TTP or FlexRay specifically developed to provide that level of dependability, there has also been an increasing interest in CAN, given its low-cost, electrical robustness, good real-time properties and widespread use. However, the use of CAN in these applications has been controversial due to dependability limitations. In order to overcome some of those limitations, namely those arising from the bus topology of CAN, several active star topologies have been proposed, such as CANcentrate and, more recently, ReCANcentrate1, which incorporates redundant hubs. In this paper we focus on the experimental assessment of ReCANcentrate, based on a prototype implementation using CAN COTS components.