CAN Bus

The CAN Bus Revolution

Before CAN, vehicles used thick bundles of individual wires, each sensor connected directly to controls. A luxury car could have over 2 kilometers of wiring. CAN simplified this by creating a shared network where all ECUs could communicate over just two wires.

How CAN Works

CAN uses a broadcast network—no central controller. Any ECU can transmit when the bus is idle. Messages (frames) have an identifier (11 bits for standard CAN, 29 bits for extended) that determines priority. If two ECUs transmit simultaneously, the higher-priority message wins through non-destructive bitwise arbitration.

Message Structure

• Arbitration ID: Message identifier (0-2047 standard)
• DLC: Data Length Code (0-8 bytes)
• Data: The actual payload
• CRC: 15-bit checksum for error detection
• ACK: Acknowledgment slot

CAN in Modern Vehicles

Modern vehicles typically have multiple CAN networks at different speeds:

• High-Speed CAN (500 kbps): Powertrain, safety systems
• Low-Speed CAN (125 kbps): Body controls, comfort systems
• LIN Bus: Low-speed sub-network for switches/sensors
• FlexRay: High-speed deterministic network (now declining)
• CAN FD: Flexible Data rate up to 8 Mbps

The Hacking Attack Surface

Security researchers Charlie Miller and Chris Valasek famously demonstrated remote car hacking in 2015, remotely controlling a Jeep Cherokee via its Uconnect infotainment system, which connected to the CAN bus. They could disable brakes, steering, and engine control—all through the OBD-II port or any networked connection.

CAN Security Solutions

The industry is responding with CAN-specific security:

• MAC: Message Authentication Codes to prevent spoofing
• Intrusion Detection: CAN IDs check, timing anomalies
• SecOC: AUTOSAR secure onboard communication
• Physical Security: Secure gateways between CAN networks