STM32G474 FDCAN Receive Filters: Close the Nonmatching-Frame Path Explicitly

A narrow STM32G474 FDCAN acceptance-filter entry can be correct while unrelated identifiers still arrive in FIFO0. The filter list has a separate fall-through policy for frames that match no entry. Unless that policy is set deliberately, the list alone does not describe the controller’s complete receive contract.

This article uses RM0440 Rev 9, March 2025, sections 44.3.6, 44.3.8 and 44.4.19. The focus is unexpected admission and receive-header attribution, rather than queue-capacity sizing. No controller was configured and no CAN frames were transmitted or received.

Follow the no-match branch

FDCAN_RXGFC.ANFS controls standard frames that match no standard filter entry. ANFE independently controls extended frames that match no extended entry. Each field can route those frames to FIFO0, route them to FIFO1, or reject them.

For both fields, the documented encodings are:

00: accept in FIFO0
01: accept in FIFO1
10: reject
11: reject

The register reset value is zero. Consequently, the reset nonmatching policy routes both identifier formats to FIFO0. That is a hardware starting state, not proof that the actual HAL or driver leaves it unchanged. Read the effective configuration produced by the selected initialization path.

A filter list with one narrow accepted identifier therefore needs a second question: what should happen to every frame that misses that list? If the answer is reject, express it in the relevant global fields instead of assuming that an unlisted identifier is automatically excluded.

Use receive metadata to distinguish the routes

Consider a hypothetical standard-data rule accepting identifier 0x321 into FIFO0. A standard data frame with identifier 0x322 does not match that rule. If ANFS = 00, it can nevertheless enter the same FIFO through the nonmatching route, assuming no other rule matches and FIFO admission succeeds.

The receive element’s ANMF bit distinguishes the paths. With ANMF = 0, the frame matched the filter index recorded in FIDX. With ANMF = 1, the frame matched no receive-filter element, and FIDX is invalid.

Do not label the nonmatching frame as having passed “filter zero” merely because the raw FIDX bits happen to contain zero. Check ANMF before using the index. Otherwise, diagnostic software can falsely accuse a correctly configured entry of accepting an unrelated identifier.

Preserve the identifier format and raw header fields together. A log containing only the numerical ID and destination FIFO loses the evidence needed to distinguish the standard list, extended list and fall-through policy. A received frame is evidence of admission through some configured route, not automatically a successful match against the rule the developer had in mind.

Audit the installed policy, including active list counts

Record RXGFC, the active standard and extended list counts, and the contents of the enabled entries for the actual instance. Memory containing a filter element does not prove that the controller’s configured list includes it. Likewise, a driver request for a global policy is not evidence that a protected register write took effect.

The manual requires FDCAN_CCCR.INIT and CCE to be set for writes to these global filter fields. Follow the documented initialization sequence in an isolated setup. Changing acceptance while a live operational network is active can disrupt reception; it is not a harmless logging adjustment.

Keep remote-frame handling explicit. RRFS and RRFE separately determine whether standard and extended remote requests are rejected before ordinary filtering. A setting of one rejects that remote-frame class; zero lets it follow the filtering path. These cases concern Classical CAN remote requests, not invented CAN FD remote frames.

Build a small route-oriented fixture

For a proposed inert bench test, prepare one intended standard-data match, one standard-data miss and one extended-data miss. Add applicable Classical CAN remote cases. State the expected destination or rejection for each using the actual global fields and filter list.

First examine a controlled configuration that deliberately accepts nonmatching frames and confirms ANMF attribution. Then compare a configuration that rejects them. This proposed comparison should use only benign traffic on a disconnected development network, with configuration changes made through the supported initialization procedure.

A missing received frame does not alone prove rejection: transmission failure, FIFO loss or an observation problem can also hide it. Preserve independent traffic evidence and controller status where the fixture supports them. Equally, do not call every unexpected reception a mask error before checking whether it carries ANMF = 1.

The completed design record should state both the matched-entry action and the no-match action for each identifier format, plus the remote-frame policy. That makes the complete receive boundary visible and lets software explain why an admitted frame exists without assigning meaning to an invalid filter index.