Almost every modern car uses some sort of a CAN bus (Car Area Network). There are differences between particular makes and models, but in general – it’s the simpliest way of providing bidirectional communication between car’s components.
Each car can have one or more CAN buses that are usually connected with each other by using a gateway module. You can imagine a gateway as a switch that’s responsible to pass the information from one CAN bus to another (or, in some cars – to filter them out). It’s necessary because different CAN buses can work with different speeds and they cannot be connected together. One would ask why complicate this that much, instead of using one CAN bus over whole car. Well… it’s not that simple. The main disadvantage is the CAN bus speed limit. First CAN buses where only 11 kpbs, so there can only be 11,264 bits per second transferred, what give us a total of 1,408 bytes per second. Most cars use a standard of 16 byte message + three-byte address so one message will take 19 bytes of a bandwidth. After doing some math – it’s clear that there can be only 74 messages transferred over the 11kbps CAN bus per second, which is very low value. Some, more important messages (e.g. speed, engine temperature, AIR-BAG system etc.) are being sent every 100 or even 50 milliseconds. It’s clear that a single 11kbps CAN bus can’t provide enough bandwidth, and it needed to be split into few, separate buses. After few years, when the technology allowed to reach higher speeds – car manufacturers were not interested in upgrading of existing CAN protocols as this would cost money and also, the higher speed CAN bus is more expensive in manufacturing process. That’s why many cars are using few CAN buses, with different speeds.
Okay, I’ve mentioned the “messages”, but what does it mean? A message is just a set of bytes that are transferred over a CAN bus and they cointain some more-or-less-important information. The main idea is that the message is widely available on a bus and every device connected to this bus can make use of it, or simply – ignore it. The most basic CAN message contains a header (often also called “an address” – that’s how I’ll call it here) and set of bytes with some info. Here’s an example message:
Address: 2D0; Message: 14, CD, F2, 88, 9A, 33, DD, A2
Of course – a car can have a lot of different messages, where one will contain information regarding current date and time, and other will cause the AIR-BAG to blow… Each car manufacturer will have it’s own CAN protocol and a module from Toyota won’t work in Fiat etc. There can even be some changes between model years of one model, so the EPB (Electronic Parking Brake) module from 2008 VW Passat won’t work in 2013 VW Passat.
To understand, how the CAN bus work – let’s stick with the already mentioned EPB module. During every day usage of a car equipped with EPB – the car needs to know what’s that status of a parking brake and disengage it when driving out from home or engage it when coming back.
So… When you go to your car at the morning and turn on the ignition – you can see the red indicator on your dashboard that tells you that the parking brake is engaged. This is caused by the EPB that sends an information to the CAN bus, which is later picked up by the dashboard (and the ECU – Engine Control Unit). When you’ll start the engine, fasten your seatbelt and set the gear to D (Drive), the ECU will send a message to EPB with a command to disengage the parking brake. The EPB then sends back the message with an information that parking brake is disengaged. The parking brake indicator will disappear and the car will start to roll. And this wole magic will happen by using only two twisted wires!
You can think of a CAN bus as very simple version of a computer network.
Hackers, like us, can “brake” into the CAN bus and read the information that car sends, but also we can use it to play with some components, what I’ll describe on other pages of this site.
I really hope you’d enjoyed this content and you’ll stay tuned for more content that I’ll provide soon!