🔌 Car Electronics: ECUs, Sensors, and the CAN Bus

What you’ll learn

1. The Invisible HalfReframe the modern car as a distributed real-time computer network — a federation of dozens of ECUs from many suppliers — and pose the course's driving question: why build it that way at all?The mechanical car is the half you can see; the other and now larger half is a network of separate computers, each with its own microcontroller, firmware and supplier. An ordinary modern car has dozens of them; some luxury or heavily optioned cars have more than a hundred. They are not one system but a federation, and that word explains nearly everything strange about how cars behave. Wiring everything to one cheap, powerful chip looks obvious. It is wrong, for reasons that constitute the architecture.
2. Why Not One Big Computer?Explain the three forces — wiring mass, ISO 26262 fault containment, and supplier contracts — that make distributed ECUs the right answer rather than a legacy accident.CiA says Bosch's driving purpose was new functions and harness relief was the bonus; the bonus only works if you stop running a new pair to the centre of the car for every gadget. A centrally-wired door needs a dozen conductors crossing a flexing hinge — putting a small computer in the door reduces the crossing to power, ground and two data wires. Fault containment is the reason it survives: ISO 26262 reserves ASIL D for functions that hurt people, and sharing silicon between a brake controller and a third-party media stack means either certifying the media stack at ASIL D or proving non-interference through shared memory, cache and interrupts. Third, a car maker integrates rather than builds, so the network diagram ends up a picture of the supply chain.
3. The Wiring Crisis That Made the BusShow why point-to-point links fail combinatorially and a shared bus is the only scalable answer, and trace CAN's real history from Bosch in 1983 to ISO 11898 in 1993.Connecting n ECUs pairwise needs n(n-1)/2 links — 1,225 runs for fifty devices — so the answer must be a bus, which makes growth linear at the cost of a new question: what happens when two nodes talk at once? Uwe Kiencke began developing CAN at Bosch in 1983. Kiencke, Siegfried Dais and Martin Litschel presented it at the SAE Congress in Detroit in February 1986; Intel's 82526 arrived in mid-1987; Mercedes-Benz used CAN in upper-class cars from 1991 (the W140 generally credited as first production multiplex); ISO 11898 was published in November 1993. BMW put a five-ECU CAN network in its 7 Series in 1995. By the late 2000s, once US OBD-II rules required CAN, it was in essentially every new car.
4. Two Wires, and Everybody Is ListeningExplain CAN's physical layer — differential signalling, termination, and the dominant/recessive asymmetry that makes the bus a wired-AND — and why messages name subjects rather than destinations.CAN is two twisted wires with a 120 Ω resistor at each end; receivers read only the difference between CAN_H and CAN_L (nominally 2 V when a dominant bit is driven, with CAN_H toward 3.5 V and CAN_L toward 1.5 V), so interference that hits both wires equally cancels in the subtraction. Dominant (0) is actively driven while recessive (1) is passive, so any node sending 0 takes the bus without damage — the bus is a wired-AND gate. Frames carry no source and no destination: the 11-bit or 29-bit identifier names a subject, every node hears everything and filters in hardware, so the model is a public address system.
5. Arbitration: Sharing a Wire With No RefereeExplain bitwise non-destructive arbitration (CSMA/CR), why the lowest identifier always wins, and how that converts an identifier into a provable worst-case latency.Ethernet's random backoff gives an unbounded worst case, token passing is costly and fragile, and a polling master is a single point of failure — so Bosch did none of them. Colliding CAN nodes don't stop: every transmitter listens while it talks, and at the first differing identifier bit the node sending recessive withdraws. Because dominant is 0 and arbitration runs MSB-first, the numerically lowest identifier always wins, so the identifier is simultaneously the subject and the priority. A low-ID message's worst case is one in-progress frame. Classic CAN runs about 1 Mbit/s over a few tens of metres; CiA's tables give 500 m at 125 kbit/s.
6. Sense, Decide, ActuateIdentify the closed control loop as the atom of automotive electronics, and recognise that an ECU's sensor inputs are inferences from proxies rather than direct measurements.Every ECU function is an instance of sense → decide → actuate → sense again. Idle speed control never computes the right answer, because the disturbances are unknowable — it only measures the error and shrinks it. And almost nothing is measured directly: a hot-wire MAF measures the current needed to hold a wire hot and calls it air; an O2 sensor infers mixture from a voltage; engine speed is teeth counted per unit time, from which the ECU cannot even tell where in the four-stroke cycle it is, hence the cam sensor.
7. When One Sensor Isn't EnoughExplain sensor fusion using electronic stability control, and explain plausibility checking and diverse redundancy as the defence against a system that keeps working while being wrong.No sensor can measure whether the car is going where the driver asked, so ESC builds two pictures and subtracts: predicted yaw from steering angle and vehicle speed, against measured yaw from a MEMS gyroscope plus a lateral accelerometer. Less yaw than predicted is understeer, more is oversteer. Bosch's ESP brakes the inside rear for understeer and the outside front for oversteer. Fusion also enables plausibility checks: a yaw sensor claiming rotation while the accelerometer reports no sideways force is caught by physics. Redundancy is made diverse rather than duplicated because identical sensors share a design flaw.
8. The Bus Has No PasswordExplain why CAN has no authentication, why that was correct engineering for its threat model, and analyse the 2015 Jeep Cherokee demonstration as an architectural rather than a protocol failure.CAN was designed for a closed world, so it is paranoid about noise and has no defences against dishonesty. In 2015 Miller and Valasek remotely controlled a Jeep Cherokee via its cellular Uconnect head unit from about ten miles away; they cut the transmission at highway speed and later showed brakes and engine-kill in a lot. FCA recalled 1.4 million vehicles. CAN was not hacked — the failure was a seam between two worlds with incompatible assumptions. Koscher et al. 2010 and Checkoway et al. 2011 had said so in advance.
9. The Gateway, the Domain, and the ZoneExplain gateway-enforced domain separation, the move to zonal architecture, and how CAN FD, CAN XL and SecOC retrofit bandwidth and trust onto a protocol that has no room for either.Classic CAN cannot be given a real signature, so the industry made topology the security boundary, with a gateway whose job is to refuse. Domain architecture groups buses by function; zonal architecture routes by geography and moves software onto a few central computers. CAN FD reaches up to 8 Mbit/s with SIC transceivers and CAN XL up to 20 Mbit/s by switching rate after arbitration. AUTOSAR SecOC bolts on truncated MACs and freshness counters. UN Regulation No. 155 requires a certified cybersecurity management system, mandatory for new types in participating markets from July 2022.
10. Why a Fault Feels Like a HauntingExplain why symptoms appear far from causes in a federated broadcast network, and leave the reader with something to notice and one open question.Three mechanisms produce the 'haunted car': a failing ECU publishes its wrong value onto an unauthenticated broadcast bus; a shared medium fails collectively, and bus-off then silences the only witness; a corroded earth strap shifts a neighbourhood of references without anything technically failing. Next time a lamp flickers or a scan tool throws codes that don't match the rattle, that is federation. The open question is whether manufacturers can pull software onto a few central computers without the contracts refusing to follow.

Questions this course answers

Grounded in trusted sources

• CAN in Automation (CiA) — History of CAN technology: Kiencke 1983; SAE Congress February 1986; Intel 82526 mid-1987; Mercedes-Benz from 1991; ISO 11898 November 1993; BMW 7 Series five-ECU network 1995; functions as the driving purpose, harness relief as the bonus — https://www.can-cia.org/can-knowledge/history-of-can-technology
• Texas Instruments, Introduction to the Controller Area Network (CAN), application report SLOA101 — high-speed ISO 11898 signalling, 1 Mbit/s at about 40 m, 120 Ω termination — https://www.ti.com/lit/pdf/sloa101
• CAN in Automation — CANopen lower layers bit-timing table (125 kbit/s at 500 m) — https://www.can-cia.org/can-knowledge/canopen-lower-layers
• CAN in Automation — CAN XL: data bit rates up to 20 Mbit/s; SIC transceivers up to 8 Mbit/s on the CAN FD data phase — https://www.can-cia.org/canxl
• Miller, C., & Valasek, C. (2015). Remote Exploitation of an Unaltered Passenger Vehicle. Black Hat USA / illmatics — https://illmatics.com/Remote%20Car%20Hacking.pdf
• Greenberg, A. (21 July 2015). Hackers Remotely Kill a Jeep on the Highway—With Me in It. WIRED. 70 mph on I-64; attackers ~10 miles west; transmission cut on the highway; brakes and engine-kill later in a lot; steering in reverse; 1.4 million vehicle recall — https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/
• Koscher, K., Czeskis, A., Roesner, F., et al. (2010). Experimental Security Analysis of a Modern Automobile. IEEE Symposium on Security and Privacy — https://www.autosec.org/pubs/cars-oakland2010.pdf
• Checkoway, S., McCoy, D., Kantor, B., et al. (2011). Comprehensive Experimental Analyses of Automotive Attack Surfaces. USENIX Security Symposium — https://www.usenix.org/legacy/event/sec11/tech/full_papers/Checkoway.pdf

Every Wunder lesson is built from real, reputable sources — never invented.

Related Science courses