Topics:
- Introduction
- Multiple Networks in a Car
- CAN Network with Control Units
- CAN Bus Signals
- Speeds and Voltage Levels
- Structure of the CAN Bus Message with a (Standard) 11-Bit Identifier
- Structure of the CAN Bus Message with an (Extended) 28-Bit Identifier
- Error Detection using Bitstuffing and CRC & ACK Delimiters
- Twisted Pair Wiring
- Termination Resistors
- Gateway
- CAN Bus Diagnosis
Introduction:
Modern vehicles are full of electronics. The control units collect and process data from sensors and control actuators. Often, different ECUs use the same data: the throttle position sensor records the position of the throttle pedal. This signal is sent via the wiring directly to the engine ECU. The engine ECU is not the only ECU that uses this signal:
- The engine ECU uses the signal from the throttle position sensor to control the throttle valve, for acceleration enrichment by activating the injectors longer, adjusting the ignition timing, and possibly controlling the turbo’s wastegate or VGT;
- The automatic transmission ECU uses the throttle position to determine the shifting times of the clutches in the automatic transmission. If the throttle pedal is slightly pressed, the automatic transmission will upshift at a lower rpm than if the throttle pedal is half pressed. The sudden rapid depression of the throttle pedal will activate the “kick-down” by shifting to a lower gear and increasing engine speed;
- The degree of throttle in a curve can cause the ESP ECU to intervene in the ESP by reducing engine power and possibly applying a brake on a spinning wheel.
During an ESP intervention, engine power decreases by partially closing the throttle and injecting less fuel. An indicator light will also light up or blink on the instrument panel to alert the driver that ESP is in operation.
The above already shows the cooperation between different ECUs. The CAN bus ensures that ECUs communicate with each other and can therefore exchange data. CAN stands for: Controller Area Network.a0
In the 1980s, cars began to have more and more accessories, and manufacturers started to integrate control units. Each function received a separate wire, significantly increasing wire thickness and the number of connector connections.
Thick wiring harnesses have the disadvantage of being difficult to hide behind interior paneling and the likelihood of malfunctions increases significantly.
With the CAN bus, ECUs communicate with only two wires: the CAN-high and the CAN-low. All communication between the ECUs is provided via these two wires. In the next two images, it is clear to see that the number of wires in one door is already significantly reduced by using the CAN bus.
On the CAN bus, dozens of control units can be connected on the two CAN bus wires. All connected control units can exchange data with each other.
a0
The image below shows a vehicle with eleven control units (indicated with the red blocks). These control units are all connected to each other with two wires; an orange and a green wire. These wires represent the CAN-high and CAN-low. Each control unit has its function and can communicate with any other control unit in the network via the CAN bus. More detailed information about the control units can be found on the page control units.
1. Control Unit Towbar Installation
2. Door Control Unit R.A.
3. Door Control Unit R.V.
4. Gateway
5. Comfort Control Unit
6. Control Unit Alarm System
7. Instrument Panel
8. Control Unit Steering Column Electronics
9. Door Control Unit L.V.
10. Door Control Unit L.A.
11. Control Unit Park Distance Control
With the advent of the CAN bus, the EOBD has also expanded. EOBD stands for European On Board Diagnosis. EOBD is related to emissions. Various sensors from the engine and exhaust provide information to the ECU. If there are incorrect values (for example, due to a poor combustion process), a MIL (Motor Indication Light) will illuminate. This is a sign that the car needs to be read. A diagnostic tester must then be connected to the OBD socket to read the faults. The ECU has stored a hexadecimal fault code in response to the malfunction, which is displayed by the diagnostic tester as a P-code or a fault with text (the latter is more brand-specific).a0Click here for more information about OBD1, OBD II, and EOBD.
Multiple Networks in a Car:
A car can contain multiple networks. The image below shows an overview with a legend for control units in multiple networks of a BMW 3 Series E90.
The K-CAN, PT-CAN, and F-CAN networks in the above image fall under the CAN bus. The differences are the speeds with their voltage levels and applications. Although the PowerTrain-CAN and F-CAN have the same high-speed and voltage levels, the difference is that the PT-CAN is used for engine and transmission control, while the F-CAN contains the control units of the chassis.
CAN Network with Control Units
The CAN bus network consists of control units equipped with hardware and software to receive, process, and send messages. For data transmission, a CAN-high wire and a CAN-low wire are used. In the image below, the CAN-High is colored red, and CAN-Low is blue.
The control units (also called controllers or nodes) are connected to these wires. All control units can both send and receive information. An example of a network is the CAN bus system in the car’s interior; here, various control units can be connected to one bus system.
As an example, let’s take a backup camera (node 5) installed later. This camera is mounted at the license plate holder or handle. The CAN wiring is connected at any place inside the interior. The requirement is that the node of the camera has the correct identifier (pre-programmed by the manufacturer) because the other control units must recognize it. If the camera is registered with the supported radio, the image is immediately visible.
After programming the software, the radio receives a signal from the gearbox that the reverse gear is selected. At that moment, the radio switches to the image from the backup camera. When the first gear (forward) is selected, the image switches off again. All thanks to the data transfer of the CAN bus system.
Non-supported equipment (with, for example, an incorrect identifier) can cause problems. If it sends messages that other control units do not recognize, a fault will be generated. Such equipment can also keep the CAN bus active after the ignition is turned off. The car will not go into “sleep mode,” causing the battery to drain quickly. This is a case of a parasitic drain.
CAN Bus Signals:
The CAN bus system uses the broadcast principle; a sender puts a message on the CAN bus. Every node on the same bus receives the message. However, the sender indicates in the message for which nodes the message is intended. All nodes receive the message and provide feedback accordingly (more on this later). The nodes for which the message is not intended recognize this and ignore it.
A CAN bus signal consists of a CAN-high and CAN-low voltage. In the image below, CAN-high is depicted in red and CAN-low in blue. The high and low signals are identical but mirrored. When the bus becomes dominant, the CAN-high voltage rises from 2.5 to 3.5 volts, and CAN-low drops from 2.5 to 1.5 volts. In recessive state (at rest), both voltages are 2.5 volts.
The above image shows an example of a measurement with an oscilloscope. It is clear to see that both voltages are identical to each other but mirrored. Ultimately, the voltage difference in the active (dominant) area is 2 volts. This refers to the difference between 1.5 and 3.5 volts. The difference of 2 volts is seen as a 0 (dominant), and the difference of 0 volts is seen as a 1 (recessive).
If a (sending) node wants to send the binary code “0 0 1 0 1 1 0 1,” it will output the mentioned voltages on the CAN-High and CAN-Low (see the above example). The receiving node will interpret these voltages as a binary code and then convert them into a hexadecimal code. The mentioned binary code will be converted from hexadecimal to 2D.
To convert binary to hexadecimal, it is easy to draw a table of 8 boxes with a thick line in the middle. Name the boxes on the right 1, 2, 4, and 8 (see the red numbers in the image). Then do the same on the left.a0Write down the numbers above which a 1 from the binary code stands. On the left, that’s only 2; on the right, 8, 4, and 1. Add everything on the right together (13) and do the same on the left (2). Hexadecimal goes from 10 to A, 11 = B, 12 = C, 13 = D. This ultimately results in 2D.
More information about converting binary to (hexa-)decimal and vice versa can be found on the page Binary, Decimal, and Hexadecimal. Here, clear examples are extensively described.
Speeds and Voltage Levels:
In vehicles, we can encounter CAN bus networks with different speeds:
- High speed: ECUs related to the powertrain, including engine electronics, transmission, ABS/ESP, EBS (commercial vehicles);
- Medium or low speed: interior electronics like the instrument cluster, radio, climate control, parking brake, towbar.
In the two images below, the CAN-high and CAN-low signals of the high-speed CAN bus can be seen. In rest, the voltage of both signals is 2.5 volts. To send a message, the CAN-high rises from 2.5 to 3.5 volts, and CAN-low decreases from 2.5 to 1.5 volts.
Below is again the signal of the CAN high speed, but now zoomed in (50 microseconds per division), where the scope for the above signal was set to 200 microseconds per division.
In comfort electronics, the high speed of communication is less important. Characteristic of the medium or low-speed CAN bus are the voltage levels at rest and during message formation as follows:
- CAN-high is at rest 5 volts and drops to 1 volt;
- CAN-low is at rest 0 volts and rises to 4 volts.
During the measurement where the zero lines of channels A and B are set at the same height, it can be seen that the voltages are “overlaying” each other. This makes it challenging to read the purity of the CAN-high and low signals.
To assess the purity of the messages, it is advisable to shift the zero lines. In the image below, the zero line of channel A is moved down, and the zero line of channel B is moved up. This separates the depicted signals and shows a clearer course of the voltages.
Structure of the CAN Bus Message with a (Standard) 11-Bit Identifier:
The structure of a CAN bus message is always based on the image below. There are differences in the structure; for example, the ARB and the CTRL field of an 11-bit identifier and a 29-bit identifier are different. The information below pertains to the 11-bit identifier. For reference: a 29-bit identifier has space for more data than the 11-bit. More about this later.
The structure of the message is now simply summarized and will be described in more detail later:
SOF:
Each CAN message begins with an SOF (start of frame). When a node wants to send a message, a dominant bit will be set on the bus. The CAN bus is always recessive at rest (a 1, so both the CAN-High and the CAN-Low are 2 Volts). The dominant bit (a 0) indicates that other nodes must wait to send a message until the entire message is placed. Only after the IFS (Interframe Space) can the next node send its message. Even if it is an important message, it cannot interrupt.
If 2 nodes want to send a message simultaneously (they are unaware of each other) and therefore both make the bus dominant by placing a 0, the ARB (arbitration) determines which message takes precedence.
From here, the part of the CAN bus message being discussed will be added to this grey image at each section. In this way, I try to keep an overview. The message started with the SOF.
ARB:
The Arbitration Field of an 11-bit identifier consists of 2 parts; the identifier and the RTR bit.
Identifier:
Suppose 2 nodes make the CAN bus dominant simultaneously, then the node with the least important message will wait until the important message is placed (until after the IFS). In the identifier of the message, there is a series of ones and zeros. These numbers are deliberately assigned to a message by the programmer. The identifier with a 0 in the message (dominant) has a higher priority than one with a 1 in the message (recessive). The 0 message goes through, and the 1 message must wait.
Both identifiers start to place a message of 11 bits. At the SOF, the dominant bit is placed. Then the first 5 bits of both identifiers are identical (0 1 1 0 1). The 6th bit is a 0 from identifier number 2, and a 1 from the first identifier. Dominant prevails, so identifier 2 forms the final CAN message.
Identifier 1 placed a 1 as the 6th bit. The node sending the identifier recognizes only when another node places a 0 on the bus that two nodes are sending a message simultaneously. At this point, identifier 1 stops sending and now acts as a receiver. Although it was initially intended that the message starting with 0 1 1 0 1 was actually the message this node wanted to send, it will now consider it the received message. The node then listens to the entire message and determines if anything is to be done with it.
The grey image of the SOF is now expanded with the ARB, which consists of 2 parts, namely the identifier and the RTR bit:
RTR bit:
The last bit of the 11-bit identifier is called an RTR; this is a Remote Transmit Request bit. This RTR bit indicates whether it is a data frame or a remote frame.
0 = Data frame
1 = Remote frame
A data frame contains data forwarded to the nodes that need the information. A node can also request information; for example, what the coolant temperature is at a particular moment. The node will then place a 1 as an RTR bit because it asks for the data.
CTRL:
The Control Field consists of the IDE (Identifier Extension), an R-bit, and the DLC. The IDE bit indicates whether it is a standard (11 bits) or an extended (29 bits) identifier:
0 = Standard identifier (11 bits)
1 = Extended identifier (29 bits)
The R-bit is reserved for the future and is now always recessive.
Then follows the DLC: A CAN bus network can send a maximum of 8 bytes. Each byte contains 8 bits, so in total, 64 bits can be sent according to the standard protocol. The Control Field indicates how much data is sent. It would be pointless to send a large message with all empty data fields for a confirmation bit (1 for on or 0 for off). The number of bytes is listed in the DLC (Data Length Code). The DLC is a function in the programming software and is thus a predetermined value by the programmer.
Suppose the DLC states 1 byte, then 8 bits are sent. This is sufficient for short confirmation messages.
For very detailed messages, the DLC will display a maximum of 8 data bytes.
The example has been expanded again. The IDE, R, and DLC have been added.
DATA:
In the data field, the final data to be sent is placed. The size depends on the DLC (Data Length Code) value. It has already been stated that the DLC is a maximum of 8 bytes large. Each byte consists of 8 bits, so in total, the data field can consist of 64 bits.
CRC:
The Cyclic Redundancy Check consists of a mathematical calculation, which is sent along with the message. The sending node makes a calculation of the total CAN message so far; the SOF, ARB, CTRL, and DATA. The CRC is thus the calculation. When the receiving node receives the message up to the CRC, it will perform the mathematical calculation up to the DATA and compare it with the calculation in the CRC. If this does not match (due to an erroneous bit / fault), the message is not accepted, and a request is made to resend the message (with a specific maximum number of attempts).The example has been expanded with the CRC.
ACK:
The Acknowledge field serves as receipt confirmation. When the sender has sent the message up to the CRC, a pause is inserted; the sender makes the bus recessive (with a 0) and waits for one or multiple nodes to make the bus dominant (1). It does not matter whether one or multiple nodes have received the message, because if one node has received it, it is then well sent. After the bus has been made dominant with a 1, the sending of the message resumes.
EOF:
The End Of Frame consists of 7 recessive bits (1 1 1 1 1 1 1). This indicates to all control units that the message has ended.
IFS:
To prevent disturbances, an Inter Frame Space is always applied after the EOF. The IFS consists of 11 recessive bits. All nodes wait until these 11 recessive bits have passed before they send a message.a0After these 11 recessive bits, for example, 2 nodes can send a message simultaneously again. Then the ARB (Arbitration) is checked again to determine which message has the highest priority. The whole cycle then begins again.
Structure of the CAN Bus Message with an (Extended) 28-Bit Identifier:
The 11-bit identifier was designed at a time when cars did not have so many control units (nodes). Programmers soon realized that the 11-bit identifier was not enough. It has only (2^11) = 2048 possibilities. There are 2032 unique binary code combinations left out of these. Modern cars now use many more codes thanks to the extended 28-bit identifier. This is called the extended identifier.
It allows for as many as (2^29) = 536,870,912 possible combinations. This is more than enough for the future.
In the CAN bus message, some things change. Both identifiers (standard and extended) are used interchangeably. The CAN message indicates what type it is before a long message follows.
The basis of the 11-bit identifier is used and also serves as preparation before this is read through; now only the changes the message undergoes when it is a 29-bit identifier are indicated.
The SOF (Start Of Frame) remains the same. The sending node makes this dominant when it starts sending a message.
Then follow the ARB and the CTRL, where the differences lie.
ARB:
In arbitration, a standard 11-bit identifier (so part of the 29 bits) comes first. The RTR bit is moved to the end of the ARB (as it is in the 11 bits). Instead of the RTR, now comes the SRR: (Substitute Remote Request). This bit is always recessive (1) with an extended identifier.
After the SRR bit comes the IDE bit, which in the 11-bit identifier is in the CTRL (Control Field). This is now removed from the control field and placed after the SRR bit in the extended identifier.
For clarification, the standard (11-bit) and extended (29-bit) identifiers are shown below.
The IDE bit stands for Identifier Extension. The IDE bit indicates whether it is a standard or extended identifier.
IDE 0 = Standard (11-bit ID)
IDE 1 = Extended (29-bit ID)
After the IDE bit comes the rest of the extended identifier. Together, the 11 and 18 bits make 29. These cannot be placed in the message as one entity because it would disrupt the CAN protocol. In essence, the IDE bit now indicates that the message is split in two.
CTRL:
The Control Field is thus changed in the extended identifier. The IDE bit is moved to the ARB.
The IDE bit is replaced by an R bit (reserve). This is typically recessive. It is followed by another R bit and the DLC (Data Length Code), which indicates how many bytes the message will consist of.
The control fields of both the 11-bit and the 29-bit identifiers are also shown now.
Error Detection using Bitstuffing and CRC & ACK Delimiters:
Bitstuffing:
Bitstuffing is applied to keep synchronization between the sending and receiving nodes optimal. Bitstuffing means that after 5 identical bits, an opposite bit is added. The bit value of the originally sent message does not change, but a bit is added.
The receiver recognizes this. After 5 identical bits, the receiver will delete the 6th bit (see the image below).
The original message of only ones is sent, but the sender adds a 0 every 6th bit. So the message length increases due to the zeroes (but this length does not count towards the DLC (Data Length Code). The receiver filters the opposite bits (the zeroes) and then reads the message with only ones again.
CRC & ACK Delimiters:
Delimiters are placed after the CRC field and the ACK field. This is a bit with a known value for both the sender and the receiver. When an error occurs in the message, this value will differ. The receiver receives a different bit value than expected and marks the message as faulty. The sender will resend the message.
Twisted Pair Wiring:
Twisted pair cables are used for the CAN bus wiring. The CAN-High and CAN-Low cables are twisted together as shown in the image.a0In this way, interference influences from outside are avoided; if an induction of a few tenths of a volt enters one cable, it also enters the other. The voltage difference between CAN-high and low remains the same. This cancels out the interference, leaving the ECUs unaffected.
Termination Resistors:
Each high-speed CAN bus network uses termination resistors. These are often located in the nodes at the end of the CAN bus line (wire) or integrated into the wiring. Each resistor has a resistance of 120a9 (Ohm). The replacement resistance is measured as 60a9 in a resistance measurement on the wires.
These termination resistors serve for interference suppression; if they were not present, reflection would occur. The voltage signal travels through the CAN bus wire, reaches the end, and bounces back. The last is prevented. The voltage is absorbed in the resistor. Reflection could cause the voltage signals to bounce back, influencing the sent messages and causing the control units to go into a fault state.
Gateway:
The car is equipped with a network of control units (nodes). The gateway connects various CAN bus networks (think of the interior, the engine/transmission, and the chassis), the MOST bus, and the LIN bus, allowing all networks to communicate with each other. It is essentially a hub between all networks. Speed differences are irrelevant at a gateway. Click here to go to the page where the operation and functions of the Gateway are described.
CAN Bus Diagnosis:
With a multimeter and an oscilloscope, a diagnosis can be made by measuring the resistance or voltage levels on the wires. Read all about it on the page CAN Bus Diagnosis.
Related Page: