CAN

What is CAN (Controller Area Network)?

CAN (Controller Area Network) is a serial bus system that lets multiple electronic control units exchange messages over a single shared twisted pair without a central master, using a built-in priority mechanism to decide who may transmit and extensive error detection to recover corrupted messages automatically. Bosch developed CAN from 1983 onwards for cars, where it drastically simplified wiring harnesses. Today CAN also runs in industrial automation, agricultural machinery, ships, lifts, medical equipment and countless embedded systems, usually with a higher-layer protocol such as CANopen or J1939 on top.

Every participant on the bus is a controller with its own CAN chip. There is no central Controller managing the traffic: as soon as the bus is idle, any node may transmit.

🕰️ How did CAN come about?

🧠 How does a CAN bus work?

All nodes are connected in parallel to two wires, CAN_H and CAN_L, which together carry a differential signal. In high-speed CAN (ISO 11898-2) a dominant bit drives CAN_H to about 3.5 V and CAN_L to about 1.5 V; during a recessive bit the difference is close to zero. Because the receiver only looks at the difference, CAN is immune to interference that couples equally into both wires, such as noise from variable frequency drives and motor cables. A 120 Ω termination resistor sits at each end of the bus.

Three mechanisms make CAN distinctive:

• Message-based addressing - a CAN frame has no sender or receiver address. The identifier describes the content (for example “engine speed”) and each node uses acceptance filters to decide whether the message is relevant to it.
• Bitwise arbitration - if two nodes start transmitting at the same moment, both read back their own bits. A dominant 0 overrides a recessive 1; a node that sends a 1 but reads a 0 stops and retries later. The lowest identifier therefore wins, and not a single bit is lost.
• Built-in error handling - every node checks every frame for five error types (bit error, stuff error, CRC error, form error and missing acknowledgement) and destroys a faulty frame with an error frame, after which the sender retransmits automatically.

A Classical CAN frame consists of a start bit, an 11-bit (standard, 2.0A) or 29-bit (extended, 2.0B) identifier, a length field (DLC), 0 to 8 data bytes, a 15-bit CRC, an acknowledgement slot (ACK) and an end-of-frame marker. After five identical bits the transmitter inserts one opposite bit (bit stuffing) so that receivers stay synchronised.

🔧 Which CAN variants exist?

Besides high-speed CAN there is low-speed, fault-tolerant CAN (ISO 11898-3, up to 125 kbit/s), which keeps working when one of the two wires breaks or is shorted.

📏 How long can a CAN bus be?

Because every bit has to travel to the far end of the bus and back before the sample point within one bit time (arbitration relies on reading back), the bus length limits the maximum bit rate. Indicative values for high-speed CAN:

Practical rules of thumb for installation:

1. Linear topology - use one continuous bus line with short drop cables (stubs of no more than a few decimetres at 1 Mbit/s), not a star.
2. Check the termination - with the bus powered down, measure between CAN_H and CAN_L: about 60 Ω means two correct 120 Ω terminators.
3. Cable and earthing - use twisted, shielded cable with a characteristic impedance of 120 Ω and earth the shield in one consistent way.
4. Watch the bus load - preferably keep it below roughly 70% so that low-priority messages are not systematically late.
5. Read the error state - every node keeps a transmit (TEC) and receive error counter (REC). If either exceeds 127 the node goes error passive; if the transmit counter exceeds 255 it disconnects itself from the bus (bus off). Rising counters almost always point to cabling, termination or interference.

🔄 How does CAN compare with other protocols?

CAN behaves deterministically for the highest-priority messages: their worst-case latency can be calculated. Messages with a high identifier, on the other hand, can be delayed when the bus is busy. In a plant architecture, CAN therefore lives mainly inside and around the machine, while Industrial Ethernet and ProfiNET connect to the PLC and SCADA. Gateways translate between the two worlds, including to serial protocols such as Modbus. For where CAN sits among other buses, see fieldbuses.

🧱 Which protocols run on top of CAN?

CAN itself only defines the physical layer and the data link layer of the OSI model. What the bytes mean is defined by a higher-layer protocol:

• CANopen - open CiA standard (CiA 301, EN 50325-4) with an object dictionary and device profiles for I/O, drives and medical equipment
• J1939 - SAE standard for trucks, buses and construction machinery, with 29-bit identifiers and usually 250 or 500 kbit/s
• ISOBUS (ISO 11783) - derived from J1939; lets tractors and implements from different brands work together
• DeviceNet - ODVA protocol on CAN for factory automation, increasingly replaced by Ethernet IP in new installations
• NMEA 2000 - marine network for navigation and engine data, also based on J1939
• ISO-TP and UDS - transport and diagnostic protocols that workshops use to read out and reflash electronic control units in cars

🔐 How secure is CAN?

CAN was designed for a closed, reliable network and has no authentication and no encryption. Every node can read every message and send any identifier. Anyone with access to the bus can therefore spoof messages, replay recorded traffic (a replay attack) or flood the bus with high-priority frames. An attacker can also deliberately trigger errors so that a legitimate node is forced into bus off.

Charlie Miller and Chris Valasek showed in 2015 that this is not theoretical: through the internet-connected infotainment unit of a Jeep Cherokee they reached the CAN bus and could remotely affect functions including the brakes and transmission. Fiat Chrysler then recalled 1.4 million vehicles for a software update.

Practical countermeasures:

• Segment with gateways - separate critical CAN segments from infotainment, diagnostics and external connections, comparable to network segmentation in IEC 62443
• Message authentication - in the automotive industry AUTOSAR SecOC adds a cryptographic authentication code; CAN XL offers optional CANsec
• Monitoring and IDS - CAN traffic is highly regular, so anomaly detection on timing and identifiers works well
• Restrict physical access - protected diagnostic ports and no open CAN connectors in accessible places

In Europe, vehicle cybersecurity under UN Regulation UNECE R155 has been mandatory for new type approvals since July 2022 and for all new vehicles since July 2024, with SAE 21434 as the supporting engineering standard. Machine builders face the Machinery Regulation (applicable from 20 January 2027) and the Cyber Resilience Act, whose reporting obligations apply from 11 September 2026 and which applies in full from 11 December 2027.

🏭 Where is CAN used?

• Automotive - engine management, ABS, airbags and dashboard; a modern car contains several CAN segments
• Agricultural and construction machinery - ISOBUS and J1939 between tractor, implement and engine
• Machine building - CANopen I/O, encoders, servomotors and actuators in packaging machines and robots
• Medical equipment - ventilators, infusion pumps and X-ray systems
• Lifts, shipping and rail - from lift controllers to NMEA 2000 on board
• Embedded systems - communication between microcontrollers inside one device

For functional safety there is CANopen Safety (EN 50325-5), which carries safety functions up to SIL 3 over the same bus. In cars, too, CAN is part of safety concepts according to ISO 26262.

❓ Frequently asked questions

What is the difference between CAN and CANopen?

CAN is the bus system that defines how bits and frames travel over the two wires. CANopen is a protocol on top of CAN that defines what those frames mean, how devices are configured and how the network is managed. A CANopen device therefore always uses CAN, but not every CAN device speaks CANopen.

Why does a CAN bus need 120 ohm termination resistors?

The 120 Ω resistors at both ends of a CAN bus prevent signal reflections and make the bus return quickly to recessive after a dominant bit. Without correct termination, bit errors occur, especially at higher bit rates. On a powered-down bus you should measure about 60 Ω between CAN_H and CAN_L.

How many devices can you connect to one CAN bus?

The CAN protocol itself has no hard limit, but the electrical load of the transceivers does. Depending on the transceiver, the limit is typically between 32 and 127 nodes per segment, and CANopen limits addressable nodes to 127. More devices require repeaters or multiple segments.

Is CAN real-time?

CAN is predictably real-time for the highest-priority messages, because bitwise arbitration resolves access conflicts without collisions or retransmission. Lower-priority messages must wait until the bus is free, so their latency grows at high bus load. A well-designed CAN network therefore keeps the bus load well below 100%.

Can a CAN bus be hacked?

Yes. Classical CAN has no authentication or encryption, so anyone who gains physical or network access to the bus can read, spoof or block messages. The best-known example is the 2015 Jeep Cherokee hack, which led to a recall of 1.4 million vehicles; protection comes from segmentation with gateways, monitoring and message authentication such as SecOC or CANsec.

Is CAN being replaced by Ethernet?

In cars, automotive Ethernet and Single Pair Ethernet are taking over the backbone and data-heavy functions, but CAN FD and CAN XL remain in use for control units and sensors. In industry, CAN stays popular inside machines because it is cheap and robust. Most architectures therefore combine Ethernet and CAN through gateways.

📌 In summary

Over four decades CAN has grown from a car bus into one of the most widely used communication buses in embedded and industrial systems. Its strength is simplicity: two wires, message-based addressing, bitwise arbitration and strict error detection. Its weakness is security: anyone who can reach the bus can join the conversation. With CAN FD and CAN XL the bus keeps pace with higher data volumes, and CAN XL brings security into the protocol layer itself with CANsec.

CAN is a robust, multimaster real-time bus for controllers in vehicles and machines, in which the identifier defines both content and priority; because the protocol has no authentication, every CAN bus belongs behind a gateway.