Topics:
- Introduction
- Multiple networks in a vehicle
- CAN network with the control modules
- CAN bus signals
- Speeds and voltage levels
- Structure of the CAN bus message with a (standard) 11-bit identifier
- Structure of the CAN bus message with an (extended) 28-bit identifier
- Math channel and serial decoding
- Error detection via Bitstuffing and CRC & ACK delimiters
- Twisted pair wiring
- Termination resistors
- Gateway
- CAN bus diagnostics
Introduction:
Modern vehicles are full of electronics. Control units collect and process data from sensors and control actuators. Often, different ECUs use the same data: the accelerator pedal position sensor registers the position of the accelerator pedal. This signal is sent directly to the engine ECU via the wiring. The engine ECU isn’t the only ECU that uses this signal:
- The engine ECU uses the signal from the accelerator pedal position sensor to control the throttle, to provide acceleration enrichment by commanding the injectors to stay open longer during acceleration, to adjust the ignition timing, and possibly to control the wastegate or VGT of the turbo;
- The automatic transmission ECU uses the accelerator pedal position to determine the shift timing of the clutches in the automatic transmission. If the accelerator is only slightly pressed, the transmission will upshift at a lower engine speed than if the pedal is pressed halfway. Rapidly flooring the accelerator triggers the “kick down” by shifting to a lower gear and increasing engine speed;
- The amount of throttle in a curve can be a reason for the ESP ECU to intervene, reducing engine power and possibly applying the brake of a slipping wheel.
During an ESP intervention, engine power is reduced by (partially) closing the throttle and injecting less fuel. An indicator light on the instrument panel will also illuminate or flash to alert the driver that the ESP system is intervening.
The above already shows how various ECUs work together. CAN bus ensures that ECUs can communicate with each other and thus exchange data. CAN stands for: Controller Area Network.a0
In the 1980s, cars were increasingly equipped with accessories, and manufacturers began implementing control modules. Each function received a separate wire. This led to increased wire thickness and a larger number of connector terminals.
Thick wiring harnesses have the disadvantage that they are difficult to route behind trim panels, and the chance of faults greatly increases.
With CAN bus, ECUs communicate over just two wires: CAN-high and CAN-low. All communication between ECUs is provided via these two wires. In the following two images you can clearly see that the number of wires at one door is significantly reduced when using CAN bus.
Tens of control modules can be connected to the two CAN bus wires. All connected control modules can exchange data with each other.
a0
The image below shows a vehicle with eleven control modules (marked by red blocks). These modules are all connected to each other via two wires: one orange and one green wire. These wires represent CAN-high and CAN-low. Each control module has its own function and, via CAN bus, can communicate with any other module in the network. More detailed information about the control modules can be found on the control modules page.
1. Trailer module
2. Rear right door module
3. Front right door module
4. Gateway
5. Comfort module
6. Alarm system module
7. Instrument cluster
8. Steering column electronics module
9. Front left door module
10. Rear left door module
11. Park Distance Control module
With the arrival of CAN bus, EOBD has also been further expanded. EOBD stands for European On Board Diagnosis. EOBD relates to emissions. Various sensors from the engine and exhaust provide information to the ECU. If incorrect values are detected (for example, due to poor combustion), the MIL (Malfunction Indicator Light) illuminates. This is a sign that the vehicle should be scanned. A diagnostic tester must be connected to the OBD socket to read out the faults. The ECU stores a hexadecimal fault code related to the fault, which is displayed by the tester as a P-code or a textual description (the latter is usually manufacturer specific).a0Click here for more information about OBD1, OBD II, and EOBD.
Multiple networks in a vehicle:
A vehicle can have multiple networks. The image below shows an overview with legend of the control modules in several networks of a BMW 3-series E90.
The K-CAN, PT-CAN, and F-CAN networks in the image above are part of the CAN bus family. The differences lie in speed, voltage levels, and applications. The PowerTrain-CAN and the F-CAN have the same high-speed and voltage levels, but the PT-CAN is used for engine and transmission management, whereas the F-CAN contains the chassis control units.
CAN network with the control modules:
The CAN bus network consists of control modules equipped with hardware and software to receive, process, and transmit messages. CAN-high and CAN-low wires are used for data transfer. In the image below, CAN-High is marked in red, and CAN-Low in blue.
The control modules (also called control units or nodes) are connected to these wires. All control modules can both send and receive information. An example of a network is the CAN bus system inside the vehicle; here, various modules can be connected to one bus system.
For example, let’s look at a reverse camera (node 5) that is retrofitted. This camera is mounted near the license plate holder or handle. The CAN wiring is connected at any convenient location in the interior. The prerequisite is that the camera module has the correct identifier (pre-programmed by the manufacturer) because other control modules must recognize it. If the camera is registered to the compatible radio, the image becomes visible immediately.
After programming the software, the radio receives a signal from the transmission that reverse gear has been selected. At that moment, the radio switches to the reverse camera view. When first gear (forward) is selected, the image switches off again. This is all thanks to CAN bus data transfer.
Unsupported devices (for example, with an incorrect identifier) can cause problems. If such devices transmit messages that are not recognized by other modules, a fault code will be generated. These devices could also keep the CAN bus active after the ignition is switched off. The car would then not enter “sleep mode,” causing the battery to discharge quickly. This is known as a parasitic drain.
CAN bus signals:
The CAN bus system uses the broadcast principle; a sender places a message on the CAN bus. Every node on the same bus receives the message. However, the sender indicates in the message for which nodes the message is intended. All nodes receive the message and send their feedback (more about this later). Nodes for which the message is not intended recognize it and ignore it.
A CAN bus signal consists of a CAN-high and CAN-low voltage. In the image below, CAN-high is shown in red and CAN-low in blue. The high and low signals are identical but mirrored. When the bus is dominant, the voltage of CAN-high rises from 2.5 to 3.5 volts, and CAN-low drops from 2.5 to 1.5 volts. In the recessive state (at rest), both signals measure 2.5 volts.
The above image shows an example of a measurement with an oscilloscope. It clearly illustrates that both voltages are identical but mirrored. Eventually, the voltage difference in the active (dominant) region is 2 volts. This refers to the difference between 1.5 and 3.5 volts. The 2-volt difference is recognized as a 0 (dominant), and a 0-volt difference is recognized as a 1 (recessive).
If a (transmitting) node wants to send the binary code “0 0 1 0 1 1 0 1,” it will apply the mentioned voltages to the CAN-High and CAN-Low (see the example above). The receiving node will view these voltages as binary code and then convert them into a hexadecimal code. The cited binary code will be converted from hexadecimal to 2D.
To convert binary to hexadecimal, it is helpful to draw a table of 8 boxes with a thick line in the middle. Name the boxes on the right 1, 2, 4, and 8 (see the red numbers in the image). Do the same on the left.
Write down the numbers where a 1 from the binary code is above. On the left, that is only the 2; on the right, they are 8, 4, and 1. Add all the numbers on the right together (13) and do the same for the left (2). Hexadecimal switches from 10 to A, 11 = B, 12 = C, 13 = D. So in the end, that’s 2D.
More information about converting between binary and (hexa-)decimal and vice versa can be found on the Binary, Decimal, and Hexadecimal page. There, clear examples are extensively described.
Speeds and voltage levels:
In vehicles, we can encounter CAN bus networks with different speeds:
- High speed: ECUs related to the powertrain, including engine electronics, transmission, ABS/ESP, EBS (commercial vehicles);
- Medium or low speed: interior electronics such as the instrument cluster, radio, climate control, parking brake, trailer module.
The two images below show the CAN-high and CAN-low signals of the high-speed CAN bus. At rest, the voltage of both signals is 2.5 volts. To send a message, CAN-high rises from 2.5 to 3.5 volts and CAN-low drops from 2.5 to 1.5 volts.
Below, the signal of the CAN high speed is shown once again, now zoomed in (50 microseconds per division), whereas the scope in the image above was set to 200 microseconds per division.
In comfort electronics, the high speed of communication is less important. Medium or low speed CAN bus is characterized by the following voltage levels at rest and when forming a message:
- CAN-high is at 5 volts at rest and drops to 1 volt;
- CAN-low is at 0 volts at rest and rises to 4 volts.
In the measurement where the zero lines of channels A and B are set at the same height, you can see that the voltages “overlap.” This makes it difficult to check the clarity of the CAN-high and CAN-low signals.
To properly assess the clarity of the messages, it is recommended to shift the zero lines. In the image below, the zero line of channel A is shifted down, and that of channel B is shifted up. This stretches the signals apart, making the voltage variations easier to see.
Structure of the CAN bus message with a (standard) 11-bit identifier:
The structure of a CAN bus message is always based on the image below. There are some differences in the structure; for example, the ARB and the CTRL fields differ between an 11-bit identifier and a 29-bit identifier. The information below relates to the 11-bit identifier. For reference: a 29-bit identifier can accommodate more data than the 11-bit. More on this later.
The structure of the message is summarized simply here, and described in more detail later:
SOF:
Every CAN message begins with SOF (Start of Frame). When a node wants to send a message, it will place a dominant bit on the bus. The CAN bus is always recessive at rest (a 1, so both CAN-High and CAN-Low are at 2 volts). The dominant bit (a 0) indicates that other nodes must wait to send a message until the entire message has been transmitted. Only after IFS (Interframe Space) may the next node send a message. Even if it is an important message, it cannot interrupt.
If two nodes want to send a message simultaneously (without knowing it from each other) and both make the bus dominant by placing a 0, the ARB (arbitration) determines which message takes precedence.
From here, each part of the CAN bus message discussed will be added to the gray image. This way, I try to keep things organized.a0The message has started with SOF.
ARB:
The arbitration field of an 11-bit identifier consists of two parts: the identifier and the RTR bit.
Suppose two nodes simultaneously make the CAN bus dominant. The node with the least important message then waits until the more important message is fully placed (until after the IFS). The identifier in the message contains a series of ones and zeros. These values are deliberately assigned to a message by the programmer. An identifier containing a 0 in the message (dominant) has higher priority than an identifier containing a 1 in the message (recessive).
The bit value 0 (dominant) always overrides bit value 1 (recessive). If two nodes transmit at the same time, and one sends a 0 while the other sends a 1, the final bus state is 0. The node that sent the 1 notices this difference, stops transmitting, and becomes a receiver. This is how priority is established on the bus.
The animation below with three ECUs demonstrates how the messages with a 1 drop out and the message with the most zeros from the far-right control unit ends up being transmitted.
The three ECUs begin placing an 11-bit message in the identifier. At the SOF, the dominant bit is placed. The first two bits of the three identifiers are the same (0 0). The third bit is a 1 for the second ECU and a 0 for the third ECU. Dominant prevails, so ECU 3 places the CAN message. The two ECUs whose bits were recessive then listen to the full message and determine if they need to respond.a0
The gray image of SOF is now expanded with the ARB, which consists of two parts: the identifier and the RTR bit.
RTR bit:
The last bit of the 11-bit identifier is the Remote Transmit Request bit (RTR bit). This bit determines whether a CAN frame contains data or whether it is requesting data.
0 = data frame (dominant): the message contains data in the data field
1 = remote frame (recessive): the message requests data from another ECU, which then sends a data frame with the same identifier
CTRL:
The Control Field consists of the IDE (Identifier Extension), an R bit, and the DLC. The IDE bit indicates whether it is a standard (11-bit) or an extended (29-bit) identifier.
0 = standard identifier (11 bits)
1 = extended identifier (29 bits)
The R bit is reserved for future use and is always recessive in standard frames.
Then comes the DLC. A CAN network can send a maximum of 8 data bytes. One byte contains 8 bits, so a maximum of 64 bits of data can be transmitted according to the standard protocol. The Control Field indicates how much data is being sent. It is not practical to send a large message with empty data fields just for a simple confirmation (for example, 1 for on or 0 for off). The DLC (Data Length Code) specifies how many bytes of data are included. The DLC is set in the programming software and is assigned in advance by the programmer.
If the DLC specifies one byte, 8 bits of data are sent. For short confirmation messages, this is enough. For extensive messages, the DLC will be set to a maximum value of 8 data bytes.
The example is expanded further now. The IDE, R, and DLC are added.
DATA:
In the data field, the actual data to be transmitted is placed. The size depends on the value of the DLC (Data Length Code). As mentioned before, the DLC has a maximum size of 8 bytes. Each byte consists of 8 bits, so in total, the data field can be up to 64 bits.
CRC:
The Cyclic Redundancy Check consists of a mathematical calculation that is sent along with the CAN message. The sending node calculates a control value for the message so far: SOF, ARB, CTRL, and DATA. This calculation forms the CRC.
When the receiving node receives the message including the CRC, it performs the same calculation over the received part (up to and including the DATA field) and compares the result with the received CRC value. If the values do not match (for example, due to a faulty bit or interference), the message is not accepted and is requested to be sent again, up to a maximum number of retries.
The example is expanded with the CRC field.
ACK:
The Acknowledge Field serves as a receipt confirmation. When the sender has transmitted the message up to and including the CRC, the ACK slot follows. The sender places a recessive bit (1) on the bus. If one or more receiving nodes have received the message correctly, they overwrite this recessive bit with a dominant bit (0). It doesn’t matter how many nodes confirm: one dominant confirmation is sufficient.
After that comes the ACK delimiter, which is always recessive. The transmission of the message then continues.
EOF:
The End Of Frame consists of 7 recessive bits (1 1 1 1 1 1 1). This signals to all control units that the message has ended.
IFS:
To prevent interference, an Inter Frame Space is always applied after EOF. The IFS consists of 11 recessive bits. All nodes wait until these 11 recessive bits have passed before sending a message.a0After these 11 recessive bits, for example, two nodes can try to send a message simultaneously again. Arbitration (ARB) is then used again to determine which message has the highest priority. The whole cycle then repeats.
Structure of the CAN bus message with an (extended) 29-bit identifier:
The 11-bit identifier was designed at a time when vehicles contained relatively few control modules (nodes). It soon became clear that more identifier capacity was needed. An 11-bit identifier provides 2^11 = 2048 possibilities, of which 2032 are unique combinations available for messages. Modern vehicles therefore use the extended 29-bit identifier, called the extended identifier. This allows 2^29 = 536870912 combinations. This provides more than enough capacity, even for future applications.
When a CAN bus message uses an extended identifier, several things change. Both types of identifiers (standard and extended) can coexist. The message thus indicates which type of identifier is being used, after which the rest of the message structure follows.
The basis of the 11-bit identifier remains and forms the starting point. Only the parts that differ when a 29-bit identifier is used are described below. The SOF (Start Of Frame) remains unchanged: the sending node places a dominant bit at the start of the message.a0Next come the ARB and CTRL fields, where the differences become apparent.
ARB:
During arbitration, the standard 11-bit identifier is placed first (the first part of the 29-bit identifier). The RTR bit (which, in the 11-bit identifier, is at this position) is moved to the end of the ARB field for the extended identifier. In the original RTR position, there is now the SRR bit (Substitute Remote Request), which is always recessive (1) in an extended identifier.
After the SRR bit comes the IDE bit. In a standard 11-bit message, this bit is in the CTRL field. For an extended identifier, the IDE bit is taken out of the control field and placed directly after the SRR bit in the arbitration field.
For clarification, the images below show the standard identifier (11 bits) and the extended identifier (29 bits).
The IDE bit stands for Identifier Extension. The IDE bit tells you whether it is a standard or extended identifier.
IDE 0 = Standard (11-bit ID)
IDE 1 = Extended (29-bit ID)
After the IDE bit, the rest of the extended identifier follows. The 11 and 18 bits together make 29. These cannot be placed together in the message, as this would break the CAN protocol. Essentially, the IDE bit now indicates that the message is split in two.
CTRL:
The Control Field is therefore different for the extended identifier. The IDE bit has been moved to the ARB.
The IDE bit is replaced by an R bit (reserve), which is recessive by default. Then follows another R bit and the DLC (Data Length Code), which indicates how many bytes the message contains.
Again, the control fields of both the 11-bit and 29-bit identifiers are shown.
Math channel and serial decoding:
When measuring CAN bus, the following functions can assist in analyzing the signals: the math channel and serial decoding. Below is an explanation of the math channel. The explanation for serial decoding follows the PicoScope screenshot.
Math channel:
The math channel performs an arithmetic comparison between two measurement channels. When CAN-low is measured on channel A and CAN-high on channel B, select “B-A.” An extra Y-axis with a voltage appears on the screen. Under the voltage curves of channels A and B, you’ll see a voltage from 0 to 2 volts:
- Recessive: B-A = 2.5 – 2.5 = 0 volt
- Dominant: B-A = 3.5 – 1.5 = 2 volt
The math channel helps analyze the signal pattern, even if the measured voltages contain some noise. More information about this can be found in the Twisted Pair section.
After the screenshot, the explanation for serial decoding follows.
Serial decoding:
In the left column of the PicoScope software you’ll find the “Serial Decoding” button. After selecting this function, a screen with options appears, where you need to select the desired measurement channel (in this example, channel A), and the settings for baud rate and high or low are shown. The baud rate matches the CAN speed and is usually set correctly automatically. Under “High or Low” you choose whether to measure CAN-high or CAN-low. Since channel A is selected, and this is CAN-low, choose “Low.” In the next screen, the display settings (decimal, hexadecimal) can be adjusted, but these can be left as-is.
After confirming, an extra color bar appears below the voltage trace, and at the bottom of the screen the decoded data and hexadecimal data are shown. The colored blocks represent the structure of the CAN message. In the scope image, the colors are shown without red warnings or crosses, and in the lower data field all texts are blue with a V for valid. This means the CAN data can be properly read by the PicoScope software. In most cases, we can therefore assume that the ECUs in the car can also read these data. As soon as the data contains errors, you’ll see them with red texts and crosses in the serial decoding.
Error detection using Bitstuffing and CRC & ACK delimiters:
Bitstuffing:
To maintain synchronization between transmitting and receiving nodes, bitstuffing is applied. This means that after five identical bits, the sender automatically inserts an opposite bit. This does not change the original data contents, but an extra bit is added.
The receiver recognizes bitstuffing. As soon as it receives five consecutive identical bits, the next (opposite) bit will be removed. This keeps the original bit pattern intact.
When a message consists, for example, only of ones, the sender inserts a zero after every group of five ones. The message length is increased, but these extra bits are not counted in the DLC (Data Length Code). The receiver strips out the added bits and thus retains the original bit pattern.
CRC & ACK delimiters:
CRC and ACK delimiters are fixed recessive bits that immediately follow the CRC and ACK fields, respectively. These bits have a fixed value, so both sender and receivers know exactly which bus state should be present there. If a node detects an unexpected value, it is interpreted as a bit error. The node then marks the message as invalid and generates an error frame. The message will be resent later, depending on the error handling mechanism and protocol layer configuration.
For example, suppose a CAN message contains the following (fictitious) data field: 1010
The sender must now determine a simple checksum (CRC). In this example, we use a simple addition instead of the actual polynomial division for clarity:
Add the numbers together:
1 + 0 + 1 + 0 = 2Convert the result to a binary value:
2 decimal = 10 binaryThis binary value is sent as the CRC after the message:
1010 10
The receiver does the same:
1 + 0 + 1 + 0 = 2 192 10 binary
The received CRC was also 10 192 so the message is correct.
If a bit is received incorrectly due to noise (for example, 1010 becomes 1110):
1 + 1 + 1 + 0 = 3 192 11 binary
The calculated value (11) no longer matches the received CRC (10). The receiver then knows there is an error in the message.
This example shows the basic principle:
The CRC is a check number that the receiver uses to confirm all bits have remained unchanged during transmission. In reality, the calculation is much more extensive and accurate, so even multiple bit errors at once can be detected.
Twisted pair wiring:
CAN bus wiring utilizes twisted pair cables. The CAN High and CAN Low wires are twisted around each other (braided), as shown in the image. Because these wires constantly swap positions due to the twisting, they receive almost the same interference signals from the environment. This keeps the voltage difference between CAN High and CAN Low stable. This type of interference suppression is called common mode noise rejection and is an important advantage of twisted pair wiring.
The CAN bus also works differentially. This means that not the absolute voltage on one wire but the voltage difference between the two wires is decisive. With a dominant signal, CAN High rises and CAN Low drops, making the voltage difference greater. If a disturbance affects both wires simultaneously, the difference remains nearly the same and the signal remains readable.
In vehicles, many power cables run close to sensitive data lines. Without twisted pair, electromagnetic induction would easily cause voltage spikes or bit errors on the CAN line. Using twisted pair keeps the CAN signal reliable, even with strong external interference or long cable runs.
Suppose both wires (CAN High and CAN Low) run straight and parallel, not twisted together. External interference causes induction voltages in the wiring. In that case, these induction voltages work in the same direction, resulting in a large voltage difference relative to the original signal.
When CAN High and CAN Low are twisted pair, both wires experience the same induction voltages from an external power cable. Because the wires are twisted, it constantly changes which wire is closest to the noise source. As a result, the induction voltages largely cancel each other out, and the original signal is better preserved.
The oscilloscope image below shows how twisted pair wiring prevents interference. Because the induction voltages in both channel A (blue) and channel B (red) occur at the same level, the voltage difference (94U) remains zero. The image confirms this: during the voltage spike, 94U remains the same as during the normal signal pattern.
Without twisted pair, the red peak could be inverted, thus doubling the voltage difference (94U) and potentially being misinterpreted as a bit.
A signal with a lot of noise is hardly visually assessable. In this example, it is clear there is a fault in an ECU or in part of the network, causing significant noise. In the next data block on the same oscilloscope image, the signal is normal. With the math channel (purple), the differential voltage between channel A and B can be displayed. That channel shows a correct pattern. From this, we can conclude that twisted pair ensures that despite the heavy noise, a reliable signal is maintained because no unintentional voltage differences arise. The noise thus has no effect on the data communication. As a result, the bits remain readable, even if the signal quality otherwise appears totally lost.
Termination resistors:
Every high-speed CAN bus network uses termination resistors. These are often located in the nodes at the ends of the CAN bus wire or integrated into the wiring. Each of these resistors has a resistance of 120a9 (Ohm). The combined resistance is measured as 60a9 when performing a resistance measurement on the wires.
These termination resistors serve for noise suppression; without them, signal reflection would occur. The voltage signal travels through the CAN bus wire, reaches the end, and would bounce back if the termination was absent. The resistor absorbs the voltage. Reflection would cause rebounding voltage signals, which could interfere with the transmitted messages and cause the control modules to report faults.
The image below shows the signal pattern of CAN-high and CAN-low where many oscillations (reflections) are visible in the signal. The reflections arise because parts of the signal bounce back at the point where termination is missing, due to missing or faulty termination resistors.a0This causes overshoot, undershoot, and ringing, as is visible in the scope pattern. The poorer the termination, the greater the reflection and the less reliable the signal. As a result, the signals can no longer be reliably received by the ECUs.
Gateway:
The car is equipped with a network of control modules (nodes). The gateway connects several CAN bus networks (such as interior, engine/transmission, and chassis), the MOST bus, LIN bus, and Flexray, allowing all networks to communicate. It is, in fact, a hub between all networks. Differences in speed between networks are irrelevant at the gateway. Click here to go to the page where the operation and functions of the Gateway are described.
CAN bus diagnostics:
With a multimeter and an oscilloscope, diagnostics can be performed by measuring the resistance or voltage levels on the wires. Read more about this on the page CAN bus diagnostics.
Related page: