CAN Error Counters behaviour
The counters are updated as follows:


When a receiver detects an error, the rx_count will be
increased by 1, except when the detected error was a bit
error during the sending of an active error flag or an
overload flag.
When a receiver detects a dominant bit as the first bit
after sending an error flag, the rx_count will be increased
by 8.
When a transmitter sends an error flag, the tx_count is
increased by 8.
Exception 1: If the transmitter is error passive and detects
an ack error because of not detecting a dominant ack and
does not detect a dominant bit while sending its passive
error flag.
Exception 2: If the transmitter sends an error flag because a
stuff error occurred during arbitration whereby the stuff bit
is located before the RTR bit, and should have been
recessive, and has been sent as recessive but monitored as
dominant.
If a transmitter detects a bit error while sending an active
error flag or an overload flag, the tx_count is increased
by 8.
If a receiver detects a bit error while sending an active
error flag or an overload flag the rx_count is increased
by 8.
Any node accepts up to 7 consecutive dominant bits after
sending an active or passive error flag or an overload flag.
After detecting the 14th consecutive dominant bit (in the
case of an active error flag or an overload flag), or after
detecting the 8th consecutive dominant bit following a
passive error flag, and after each sequence of additional 8
consecutive dominant bits every transmitter increases its
tx_count by 8 and every receiver increases its rx_count
by 8.
After the successful transmission of a message (getting
ack and no error until end of frame is finished) tx_count is
decreased by 1 unless it was already 0.
After the successful reception of a message (reception
without error up to the ack slot and the successful sending
of the ack bit), rx_count is decreased by 1 if it was between
1 and 127. If rx_count was 0 it stays 0, and if it was greater
than 127, it will be set to a value between 119 and 127.
Note: If a node is the only one on the bus (or during startup
the only one that has become active), and it transmits a
message, it will get an acknowledgement error, and will
retransmit the message. This may lead to that node going to
error passive mode, but not to it becoming bus off 


Reference for the above points