Vehicle networks: CAN, LIN and gateways

The Lindqvists' minivan is back, this time with a dashboard that lights up like a fairground on some mornings: the stability control, airbag and parking sensor warnings all come on together, the speedometer drops to zero, and then, after a restart, everything is normal for days. The van had a rear bumper repair at a body shop in the summer. Kiran plugs in the scan tool and finds a long list of stored codes beginning with U, the letter for network communication faults, in at least eight modules. Marty pulls up a stool. "When a dozen modules all complain at once," he says, "they are not all broken. They are telling you they lost contact with each other. Today you learn how they talk."

This lesson explains why vehicles use networks, how a controller area network, or CAN, carries messages on two wires, how LIN, CAN FD and automotive Ethernet fit in, what gateways and secure gateways do, how network faults show up, and how to test a network with a meter, a scope and the scan tool.

Why vehicles use networks

A vehicle speed signal is needed by the instrument cluster, the engine control module, the transmission module, the stability control module, the radio, the power steering, the driver assistance cameras and others. Wiring that one signal separately to each module would take a dozen wires; multiplied over hundreds of signals, the harness would be enormous. Instead, modules share information over networks: each module that measures something sends it as a message, and every module that needs it reads it from the network. This is called multiplexing, and it cuts wiring, weight and connectors while letting modules cooperate, such as the stability control module asking the engine module to reduce torque.

A vehicle usually has several networks running at different speeds, each for a different group of modules: a high-speed powertrain and chassis network, a medium-speed body or comfort network, low-speed LIN sub-networks for switches and small motors, and often separate networks for infotainment, driver assistance and diagnostics. A gateway module connects them and passes messages between them.

How CAN works

The controller area network was developed for vehicles in the 1980s and standardized internationally as ISO 11898. Heavy-duty trucks use a version defined by SAE J1939. Since the 2008 model year, all new light vehicles sold in the US have had to support CAN for diagnostics, and Canadian vehicles followed the same practice. A high-speed CAN network uses two wires, CAN high and CAN low, twisted together. At rest, called recessive, both wires sit at about 2.5 volts. To send a dominant bit, a module drives CAN high up to about 3.5 volts and CAN low down to about 1.5 volts at the same moment. The receivers read the difference between the two wires, not their voltage to ground, so electrical noise that affects both wires equally cancels out; that is why the wires are twisted, so that any interference reaches both alike.

Each end of a high-speed CAN network has a 120-ohm terminating resistor across CAN high and CAN low, often built into the two modules at the physical ends of the network. The terminations stop the signals reflecting from the ends of the wires like echoes. With the network unpowered, the two 120-ohm resistors in parallel make a resistance of about 60 ohms between CAN high and CAN low, measured at any point on the network, including the diagnostic connector. That one measurement is the quickest network test there is.

Messages and arbitration

CAN has no master module. Any module can send a message, called a frame, when the network is quiet. Each frame starts with an identifier, 11 bits in a standard frame or 29 bits in an extended frame, that says what the message is, such as engine speed or wheel speeds, rather than who sent it. It then carries a data length code, up to 8 bytes of data in classic CAN, a cyclic redundancy check that lets receivers detect corrupted frames, and an acknowledgment slot that receivers fill in. If two modules start to send at once, the one whose identifier has a dominant bit where the other has a recessive bit wins without either message being damaged, so the lowest identifier, the most important message, always gets through first. A module that keeps detecting errors in its own transmissions eventually takes itself off the network, a state called bus-off, rather than disrupt everyone else.

# Decode a classic CAN frame as a scan tool's network monitor might show it (illustrative IDs and scaling)
frames = [("0C9", "8 1E 10 00 00 00 00 00 00"), ("3E9", "8 05 DC 05 E1 05 D8 05 DF"), ("1F5", "2 04 00")]
names = {"0C9": "engine speed", "3E9": "four wheel speeds", "1F5": "transmission range"}
for ident, payload in frames:
    parts = payload.split()
    dlc = int(parts[0])
    data = [int(b, 16) for b in parts[1:1 + dlc]]
    print(f"ID 0x{ident} ({int(ident, 16):4d}) {names[ident]:<18} DLC {dlc}: " + " ".join(f"{b:02X}" for b in data))
    if ident == "0C9":
        print(f"   engine speed = ({data[0]} x 256 + {data[1]}) / 4 = {(data[0] * 256 + data[1]) / 4:.0f} rpm")
    if ident == "3E9":
        speeds = [(data[i] * 256 + data[i + 1]) / 100 for i in range(0, 8, 2)]
        print("   wheel speeds, km/h: " + ", ".join(f"{s:.2f}" for s in speeds))
print("lower identifiers win arbitration: 0x0C9 beats 0x1F5 beats 0x3E9")

ID 0x0C9 ( 201) engine speed       DLC 8: 1E 10 00 00 00 00 00 00
   engine speed = (30 x 256 + 16) / 4 = 1924 rpm
ID 0x3E9 (1001) four wheel speeds  DLC 8: 05 DC 05 E1 05 D8 05 DF
   wheel speeds, km/h: 15.00, 15.05, 14.96, 15.03
ID 0x1F5 ( 501) transmission range DLC 2: 04 00
lower identifiers win arbitration: 0x0C9 beats 0x1F5 beats 0x3E9

LIN, CAN FD and automotive Ethernet

LIN, the local interconnect network, is a cheap single-wire network for low-speed devices such as switch packs, window motors, mirror motors, rain sensors and smart alternators. One master module, often the BCM or a door module, controls a small group of slave devices, polling them in turn. The LIN wire sits near battery voltage when idle and is pulled toward ground to send bits, at speeds up to about 20 kilobits per second; a meter on a working LIN wire typically reads somewhat below battery voltage, and a scope shows the bursts of data.

Classic CAN runs at up to 1 megabit per second, with 500 kilobits per second typical for powertrain networks. CAN FD, for flexible data rate, keeps the same wires and arbitration but switches to a faster bit rate for the data part of each frame and carries up to 64 bytes of data, and it is now common in newer vehicles for driver assistance and powertrain data. Driver assistance cameras, radar, infotainment and newer zonal architectures, in which a few powerful computers control the vehicle by zone rather than by function, increasingly use automotive Ethernet, which runs at 100 megabits per second to several gigabits per second over a single twisted pair. A short-range version, 10BASE-T1S, lets several devices share one pair, much like CAN. Ethernet networks cannot be checked with the simple resistance test that works on CAN, and their twisted pairs are even less tolerant of poor repairs; the service information gives the repair rules.

Gateways and secure gateways

A gateway module connects a vehicle's networks, forwards the messages each network needs, and connects the diagnostic connector to the networks. Many manufacturers now fit a secure gateway that blocks diagnostic commands from the connector that could change the vehicle, such as clearing codes, running output tests, calibrating or programming, unless the tool and the technician are authorized. Reading codes and live data is usually still allowed. Stellantis vehicles, for example, have used a secure gateway since about the 2018 model year; independent shops unlock it through an online authorization service, AutoAuth, using a registered account and a compatible scan tool, or with a bypass cable on some models. Other manufacturers use their own systems, and the details change often, so Kiran checks the shop's scan tool notes and the manufacturer's service site before starting work on a secured vehicle.

Right-to-repair rules are part of this picture. In Canada, the Copyright Act was amended in 2024 to allow technological protection measures to be bypassed for diagnosis, maintenance and repair, and agreements between manufacturers and the aftermarket on access to repair information have been in place for years. In the US, a voluntary agreement covers most manufacturers, and some states have their own vehicle data laws. The practical effect at Ridgeline is that most secured functions can be reached legitimately with the right subscriptions and credentials.

What network faults look like

Network faults usually show up as several symptoms at once: warning lamps, gauges dropping to zero, features that stop working, and U codes in several modules, each saying it has lost communication with others. The key diagnostic step is to work out which modules are communicating and which are not, which the scan tool's network scan or topology view shows. If every module on a network is silent, the network itself is down, from an open, a short or a module that is jamming it. If only one module is silent, that module's power, ground or connection to the network is suspect. If the modules that stopped talking are all on one branch, the fault is probably in that branch's wiring.

# Topology fault finder: which part of a CAN network explains the silent modules? (an illustrative layout)
branches = {
    "front": ["engine module", "transmission module", "brake module"],
    "cabin": ["gateway", "instrument cluster", "airbag module", "steering angle sensor"],
    "rear": ["parking aid module", "liftgate module"],
}
silent = {"airbag module", "steering angle sensor", "brake module", "parking aid module", "liftgate module", "instrument cluster"}
talking = {m for ms in branches.values() for m in ms} - silent
for b, ms in branches.items():
    s = [m for m in ms if m in silent]
    print(f"{b:<6} silent {len(s)} of {len(ms)}: {', '.join(s) if s else 'none'}")
if len(talking) <= 3:
    print("almost every module is silent: look for a short or a module disturbing the whole network, or loss of terminations")

front  silent 1 of 3: brake module
cabin  silent 3 of 4: instrument cluster, airbag module, steering angle sensor
rear   silent 2 of 2: parking aid module, liftgate module
almost every module is silent: look for a short or a module disturbing the whole network, or loss of terminations

Testing a CAN network

Kiran's tests on the minivan follow the standard order. First, with the ignition off and the network asleep, she measures resistance between CAN high and CAN low at the diagnostic connector: 119 ohms, not 60. Only one terminating resistor is being seen, so the network is open somewhere between the diagnostic connector and one of its ends. Next, with the ignition on, she measures each CAN wire to ground: CAN high at 2.62 volts and CAN low at 2.38 volts, both close to normal for an active network, so neither wire is shorted to ground or to battery voltage. Common faults and their resistance readings are an open in one leg, about 120 ohms; a short between CAN high and CAN low, near zero ohms; and a missing termination inside a module, about 120 ohms with every wire intact.

The scope adds the last piece of evidence. With both channels connected at the diagnostic connector, the CAN high and CAN low signals look like mirror images, but at the moments the warning lamps flash, the scope shows bursts of distorted, ringing edges. A network with only one termination reflects its own signals, and on cold mornings, when the connector contracts, the reflections become bad enough to corrupt frames. The diagram shows that the rear end of the network is the parking aid module behind the bumper. At the rear harness connector behind the bumper cover, which the body shop had unplugged and reconnected, Kiran finds the CAN low terminal pushed back out of its cavity: its locking tang had been bent, and the terminal was making contact only some of the time. She replaces the terminal with a new one from the terminal kit, crimped and locked in place, refits the connector position assurance, and measures 61 ohms at the diagnostic connector. After she clears the codes, the network scan shows every module communicating, and a week of cold mornings later, the Lindqvists report no warnings.

# CAN resistance checks with the network asleep, measured between CAN high and CAN low
def read(ohms):
    if ohms < 5: return "short between CAN high and CAN low"
    if 50 <= ohms <= 70: return "two terminations seen: normal"
    if 105 <= ohms <= 135: return "only one termination seen: open leg or missing terminating resistor"
    if ohms > 1000: return "no terminations seen: open at the connector or both ends missing"
    return "unusual value: recheck, then look for corrosion or an extra resistor"
for where, r in [("diagnostic connector, as found", 119), ("after terminal repair", 61), ("example: wet connector", 38), ("example: both legs open", 99999)]:
    print(f"{where:<32} {r:6d} ohm -> {read(r)}")

diagnostic connector, as found      119 ohm -> only one termination seen: open leg or missing terminating resistor
after terminal repair                61 ohm -> two terminations seen: normal
example: wet connector               38 ohm -> unusual value: recheck, then look for corrosion or an extra resistor
example: both legs open           99999 ohm -> no terminations seen: open at the connector or both ends missing