| Episodes drawn on | 100 |
| Cited here | 36 |
| Claims extracted | 124 |
| Gathering | concept union |
| Other themes | |
Automotive electronics is the design and supply of electronic systems for road vehicles, a sector characterised less by advanced silicon than by the number of modest parts involved and the conditions they must survive: a modern car contains on the order of one hundred to three hundred microcontrollers.[691] A large share of that content is small embedded microcontrollers performing airbag control and sensor signal conditioning, together with LIN and CAN transceivers and smart sensors, rather than high-performance processors.[169] The sector’s defining technical artefact is the CAN bus, designed by Bosch in the mid-1980s as a multiplexing scheme to replace the individual signal wires then run point to point for each sensor value, which were turning the car into a copper harness problem.[634] Electronics has become a substantial fraction of vehicle development effort, with one carmaker reporting that twenty to twenty-five percent of its research and development went into the hardware and software of the vehicle rather than the mechanical product.[134]
Environment and qualification
Automotive-grade electronics are qualified across roughly minus 40 to plus 125 degrees Celsius, though the applicable range depends on where a module sits: electronics in the passenger compartment are typically rated minus 40 to plus 85.[339][93] Chips are graded into consumer, industrial, automotive and military temperature ranges, with industrial and automotive commonly sharing the minus 40 to plus 85 degree band.[93] A module mounted against the metal roof, such as an overhead console, is rated to 105 degrees rather than 85, and the higher grade carries a price premium that keeps designers on the lower grade wherever they can stay there.[93] An 85-degree ambient specification is in any case a starting point rather than a limit, because the die temperature rise from the module’s own dissipation sits on top of that ambient, which is what makes thermal simulation load-bearing in automotive design.[399] The wide range means every design engineer in the sector works fluently with junction-to-ambient thermal resistance and performs thermal analysis as routine practice, even on otherwise simple body electronics.[93]
The electrical environment is equally demanding. During a cold crank the nominal 12 volt supply can collapse to around four volts while the starter turns the engine, so every module powered from that rail must survive and ideally continue operating through the dip.[106] A DC-DC converter feeding from that line must be automotive grade, because the transients present on the rail will eventually destroy an ordinary converter even though it works on the bench.[568] An automotive high-side switch answers the same problem in a component: a MOSFET with added protection intelligence, driven by a simple logic level like any switch, but protecting itself against transients, over-temperature and over-current without external circuitry.[568] Automotive modules are also effectively powered for ten years, since a great deal of vehicle electronics remains energised with the key off, which makes quiescent current and long-term reliability first-order design parameters.[93] That follows a shift in the electrical architecture itself, from a mechanical ignition switch carrying 40 amps that cut everything dead to a permanently networked system of buses in which nothing is fully switched off.[93]
Vibration adds a further failure mode. Multi-layer ceramic capacitors have become thin enough that mechanical stress or a board flex fracture turns the part into a resistor rather than an open circuit, a leading failure mode in vibration-exposed equipment.[539] Flexible-termination capacitors, whose end caps float on a compliant layer to absorb board stress, exist specifically for automotive and other high-vibration applications.[539] A cracked ceramic presents as unexplained battery drain rather than as a functional fault, the usual culprit being the first ceramic across the battery, with the leakage visible as a warm spot under a thermal camera.[539] Electromagnetic compatibility discipline in the sector likewise began as self-imposed industry restriction rather than external regulation, driven by the consequences of interference in engine control, airbag and cruise control circuits.[165]
Supply and vendor structure
Automotive-qualified vendors such as Infineon are largely invisible to engineers outside the sector, because their parts are priced for automotive volumes and are not sold in low quantities, so a designer searching a catalogue distributor rarely reaches them.[225] Several semiconductor makers deliberately do not advance process nodes at all, serving automotive and medical customers from older equipment and 8-inch rather than 12-inch wafers, because those parts do not need billions of transistors and their customers value process continuity.[297] Automotive-focused vendors also cannot discontinue old 8-bit microcontrollers at will, because their largest customers have designed them into vehicles still in production, and automotive microcontroller share has long been concentrated in the ex-Motorola line that became Freescale and then NXP, a position built on the older MC series designed into vehicles.[116] For microcontroller vendors more generally the automotive segment rather than the hobbyist or maker segment is where the revenue is, which shapes product roadmaps and tool ecosystems.[659]
Supply horizon is itself a selection criterion, so an explicit ten-year supply guarantee in a part’s headline features signals that the vendor is aiming it at industrial or automotive customers.[482] Automakers require such agreements, and a low-volume buyer who cannot promise large orders can still obtain one by offering the vendor a guaranteed long-term revenue stream instead.[567] The field of usable vendors is narrowed further by peripheral requirements that general-purpose suppliers do not meet, such as four LIN controllers and two CAN controllers on one device, and by software and platform certification, which is as large a factor as the silicon.[413] Automotive-rated parts are nonetheless sometimes cheaper than their non-automotive equivalents, because the volumes they are manufactured in outweigh the cost of the higher qualification.[645] Manufacturers also frequently qualify an existing part up to 125 degrees rather than 85 and sell it under the same part number, which merges the automotive and industrial demand pools onto one item; when the two share a part number, allocation during a shortage follows volume, so a small buyer competing against a vehicle programme simply does not receive parts.[530] The consequence at the other end is that hardware has no partial-completion state, and a single missing component stops a production line, which is why shortages hit vehicle production directly rather than merely delaying features.[558]
The tier-one suppliers occupy the structural centre of the sector. Firms such as Continental and Bosch design the electronics that goes into vehicles from many different brands, so cars from Fiat, Peugeot and Renault can contain substantially the same modules.[635] Because a tier one aggregates designs across many carmakers, it approaches semiconductor vendors with combined volume and negotiates as a very large customer, a structural advantage the individual carmakers do not have.[635] Those suppliers have also placed engineering sites where talent is cheaper, such as Romania, where in some regions they are essentially the whole electronics job market.[568]
Component integration follows the same commercial logic. ECU silicon roadmaps are driven by margin, with the supplier integrating as much as possible onto the chip to avoid populating external parts, which also reduces the number of separate devices the buyer must source during a shortage.[568] Automotive-oriented parts often integrate drive capability that general-purpose logic lacks, such as a 595 shift register rated 250 milliamps per channel, which is functionally that shift register merged with a 2803 open-drain driver array, saving a package and the interconnect between them.[600] At the other end of the scale, small configurable mixed-signal parts find automotive use as single-purpose workaround devices, since a carmaker needing one specific problem solved on a load-dump-capable board will design one in across a million units.[567]
System architecture
Vehicle control is conventionally split between the engine control unit, responsible for keeping engine performance within specification, and the body control unit, which handles door locks, windows, seats and other non-powertrain functions.[388] The engine control unit is deliberately given no responsibility it does not need and is built with multiple processors running in lockstep checking one another, because a fault that mistimes variable valve timing destroys the engine.[388] Warranty liability drives that robustness directly: with a hundred-thousand-mile engine warranty, an ECU fault that damages an engine at sixty thousand miles is a warranty replacement, so carmakers over-engineer against that specific exposure.[388] For the same reason, sensors feeding the engine ECU are usually wired point to point rather than placed on the CAN bus, which limits the damage a bus fault or bus intruder can do to engine control.[388] Airbag deployment is isolated in a comparable way, since the squib fires autonomously and the airbag still works if the CAN interface fails, the bus being used only for status reporting and warning lamps.[93]
Architectures differ in whether a single supervisor exists: in the Tesla Model S the computer behind the seventeen-inch centre display is the central brain and controls the drivetrain and ABS, whereas most cars distribute authority and give modules substantial autonomy.[388] Separate modules were consolidated into the body control module because integration reduces mass and wiring, which feeds directly into fuel economy, emissions and weight requirements.[620] Wiring nonetheless remains a defining constraint, and a car harness is built as a single custom cable assembly carrying LIN, CAN and power together and snaked through the vehicle, so automotive designers treat custom cable assemblies as the default rather than a last resort because the distances rule out board-to-board connections.[277] Software practice diverges from general computing for related reasons: layered abstraction that helps elsewhere hurts in automotive embedded work because low-level behaviour propagates upward, and generated code following such abstractions has been observed at four to five times the size of the application itself.[634]
The CAN bus
Origins
CAN was developed by Bosch in 1985 and appeared in Bosch engine control units from around 1986, a year after the protocol was defined.[388] The design started from an RS-485 multi-drop scheme with an addressing protocol; that worked but cost too much CPU load, so the arbitration was moved into hardware, and that hardware became CAN.[634] Before it prevailed in the mid-2000s the SAE automotive bus standard was an umbrella over incompatible Ford, GM and Chrysler protocols that shared only a data rate, so it standardised almost nothing.[93] CAN displaced those manufacturer-specific buses because chip vendors supported it, whereas each of the others required a licensed standalone bus interface chip carrying both the physical layer and the media access controller, which was expensive.[93] It was mandated in cars only from 2009, so despite dating from the mid-1980s it can be relied on as universally present only from that model year onward.[388]
Protocol mechanics
CAN is a publish-subscribe broadcast bus: a node publishes its sensor values, every other node sees them, and subscribers act on the ones they need, with no addressing of a recipient.[634] Arbitration is a bit-by-bit state machine in which every contending node transmits and simultaneously reads back, and any node that reads a value different from the one it sent has lost priority and backs off; after the identifier field, by default eleven bits, exactly one node remains and the rest switch to receiving.[634] Because arbitration lives in the physical layer, CAN has no collisions and none of the collision-induced throughput collapse of Ethernet.[93]
The protocol carries several guarantees that system designers rely on, sometimes without knowing it. CAN provides atomic broadcast, a property not offered by other field buses: when the transmitting controller reports a frame as sent, every live node on the bus has received it correctly.[634] Acknowledgement works in-frame, with at least one receiving node pulling the acknowledgement bit dominant against the transmitter’s recessive bit, which tells the sender its frame was heard.[634] Any node detecting an error asserts an error frame of six dominant bits, a pattern the bit-stuffing rule makes impossible in normal traffic, so every controller recognises it, discards the frame and resynchronises before the sender retries.[634] Systems are routinely built on these guarantees without their designers recognising that atomic broadcast is what makes them work, and they then break with obscure race conditions when migrated to a faster bus such as Ethernet, which does not provide it.[634] Fail-silent behaviour is likewise built into the protocol rather than added by the system designer, since every node is required to take itself off the bus if it determines it is babbling, and transceivers contain protective logic, typically a dominant-state timeout, so that a hung microcontroller cannot hold the bus dominant and take the whole network down.[93][518]
CAN is deceptively complex to implement in software, because it looks like a shift register but the full protocol flow chart has many distinct paths, which is why bit-banged implementations on programmable IO are notable achievements rather than routine.[687]
Rates, variants and companion buses
Classical CAN tops out at about one megabit per second, which is slow by modern standards and is why faster automotive buses were introduced alongside it.[93] A 500 kilobit bus carries roughly 4,700 messages per second, which sets the ceiling on how much vehicle data can be published.[388] CAN FD adds a flexible data rate, with arbitration proceeding at the usual 250 or 500 kilobits and the data phase then switching up to as much as 8 megabits per second with larger payloads; the practical driver for it is ECU reflashing, where an image of a couple of megabytes has to be pushed over the vehicle bus and the higher data-phase rate directly shortens service time.[388] CAN is differential, but a single-wire variant exists that uses one of the two lines and omits the other, trading noise immunity for copper.[388]
A typical vehicle runs a high-speed one-megabit powertrain bus carrying the engine and transmission controllers, with the instrument cluster acting as the gateway onto the other buses.[93] LIN exists beneath that as a cheap UART-based sub-bus so low-importance modules can be moved off CAN, keeping the number of CAN nodes low while many LIN sub-buses hang below.[93] It is cheaper because it runs on the UART peripheral of any microcontroller with no dedicated controller and uses a single wire instead of a differential pair.[518] Vehicles carry several other physical layers besides these, including K-Line, L-Line and the older J1850, though the legacy standards are largely gone while LIN remains widespread.[388]
Autonomous sensing exceeds what CAN can carry, so LIDAR and comparable sensors have pushed vehicles onto FlexRay, which runs around 10 megabits per second, and onto automotive Ethernet for the data path.[388] A LIDAR sensor may update object distances a thousand to ten thousand times per second, and video-based autonomy cannot be carried over a CAN link at all, which sets the bandwidth requirement for the sensor bus.[388] The resolution is to keep command and control of camera, LIDAR and other high-bandwidth subsystems on CAN while carrying the sensor data itself on a separate bus, making the control plane and the data plane physically distinct.[388] Sensor content per vehicle was projected to average around twelve cameras alongside radar for collision detection, all layered on top of an already complex conventional vehicle electrical system.[134]
Network design and scheduling
CAN priority arbitration has a starvation failure mode: a node with a low identifier that transmits too frequently wins every arbitration and squeezes the other nodes off the bus, so message rates and identifier assignment have to be budgeted at design time rather than chosen per node.[266] Setting every node to transmit on the same exact period is a specific design error, because the timers coincide, the lowest identifier wins every time, and the remaining nodes back off and drop their data indefinitely; the corrections are to stagger the periods or to let the controller hardware handle retransmission.[266] One workable scheduling pattern is a broadcast poll at a fixed interval, for example every 500 milliseconds, with all nodes required to answer inside that window before the next poll.[266]
Message semantics are not standardised: identifiers, message contents and whether transmission is periodic or event-driven are established by whoever designs that particular network, and there is no lookup table assigning a fixed identifier to a function.[426] A module therefore cannot simply be added to an existing vehicle network and expected to work, since either the existing devices must be configured to supply the information the new module needs or the new module must supply what they expect, which is why aftermarket suppliers work through the vehicle manufacturer.[426] There is likewise little standardisation between vehicle manufacturers in how CAN networks are used or routed, and manufacturers have no commercial incentive to converge because the difficulty of interpreting their data is itself worth something to them.[388] Carmakers also change communications between model years and between models, so a third-party product must be supported per vehicle variant rather than per protocol, a severe burden for a small supplier.[388] The same coupling blocks work that used to be routine: engine swaps between manufacturers, once feasible because the engine was electrically self-contained, are now prevented by the bus, since the ECU expects messages from modules such as ABS or traction control that limit torque, and those messages differ between makers.[388] Add-on equipment on a commercial vehicle accordingly runs its own CAN network rather than joining the vehicle’s bus, which is joined only when a customer explicitly requires data from it.[266]
Design benefits and use beyond cars
Concentrating a module’s interfaces onto CAN pays off beyond communication, because every additional IO needs protection, board area, connector pins and its own test coverage, whereas a CAN-only module can be fully exercised with a CAN dongle and a programmable power supply.[518] A standard bus interface also lets hardware and software development be decoupled, so a module such as a door handle can be exercised from a laptop over a USB LIN dongle and handed off complete to whoever writes the body controller software.[518] A distributed architecture built this way has no single point of failure in the communication path: with the radio acting as a dumb packet router, the battery and other modules remain reachable even if the onboard computer dies.[518]
CAN is not confined to cars, turning up in essentially any mobile system combining motor control with a battery, including humanoid robots.[631] A modern motorcycle carries a full CAN-connected module suite in which the ECU handling fuelling and ignition talks to a fly-by-wire throttle, an ABS module and an active suspension module, matching car architecture in a far smaller package envelope.[426] A six-axis inertial measurement unit shared over that bus gives every module lean angle, gradient, acceleration and slip state, which is what allows the vehicle’s responses to rider input to be modified in context.[426]
Electric drivetrains and charging
An electric drivetrain can be built with CAN as the only signal interconnect: battery packs daisy chain through small latching four-wire connectors, heavy cables carry power only, and the charger and each inverter are addressed the same way from a central vehicle controller.[112] Regenerative braking is not a separate mechanism in such a system, since torque in either direction is a sign change in software and what the bus carries to the inverter is simply a torque magnitude and direction.[112] In a production electric drive system the power electronics account for about 2 percent loss and the motor about 5 to 5.5 percent across the bulk of the operating range.[112]
DC fast charging hardware is trivial, amounting to two large pins and a contactor connected straight across the battery, so the entire difficulty of the standards lies in the communication protocol.[524] The whole information requirement is the car telling the charger a current and a voltage: CHAdeMO does this over CAN, while CCS does the same job over a heavily modulated, encrypted powerline protocol.[524] CHAdeMO is a simple, well-designed standard that runs over CAN, assigns dedicated pins to dedicated functions and already supports exporting power from the vehicle for vehicle-to-grid use, but requires separate AC and DC connectors.[524] CCS instead carries its charging dialogue over HomePlug Green PHY, a protocol originally designed for domestic powerline networking, apparently chosen because the application involves power rather than because the requirement called for it.[524]
Diagnostics, reprogramming and service
The OBD connector originated in Californian clean-air actions as a standardised engine diagnostic interface with a standard connector and pinout, deliberately placed where it is accessible but not obtrusive.[93] Electrically it is nothing more than an access point onto the vehicle’s CAN bus, which is why it is both the standard diagnostic entry and a standing security exposure.[93] Because it is standardised, third-party tools connect through it to reprogram the engine control module, remapping fuel tables, boost pressure and spark timing, though such tools exist mainly for vehicles with a modification community.[212] Modules cannot be removed and reprogrammed through a JTAG header in service, so every module carries a bootloader that validates the application at boot and can accept a replacement image over the vehicle network.[212] The bandwidth cost of that route is real: four software updates delivered through the OBD port over a half-megabit link took four hours at the dealer.[524] Manufacturers are meanwhile progressively gatewaying and locking down the port, which pushes third-party diagnostic products toward tapping the bus directly under the hood instead.[388]
Because the port carries framed and encoded traffic, putting an oscilloscope on it shows only a digital bit stream, so protocol decoding rather than analogue measurement is the only route to interpreting it.[388] Sniffing a vehicle bus yields every frame on it but no meaning, because each manufacturer keeps its message definitions private, making interpretation a reverse-engineering exercise per vehicle.[568] Where a manufacturer needs to send more data than a frame holds, it splits the payload across several frames under its own protocol layered on top of CAN, which makes that reverse engineering substantially harder.[568]
The same message-oriented design changes how vehicles are validated and adapted. Because CAN replaced per-switch wiring with a message whose bits map to individual devices, electrical validation is done by decoding messages, and a specific function such as a door lock can be verified by scoping the relevant bit position while operating the switch.[620] Reusing a vehicle’s existing instrument cluster after a conversion follows the same method: capture bus traffic, identify which message carries the gauge value, then transmit that identifier with the desired value.[112]
Security
The internal vehicle network has essentially no security controls, since CAN is a simple protocol with no authentication, so physical access to the bus wires confers control.[265] Once an attacker controls any one device on the bus, moving to control of many others generally requires little further work, because the network is either flat or split into a few loosely isolated flat networks.[265] Every one of the hundreds of microcontrollers in a car is therefore an attack surface, including peripheral devices such as a tyre sensor, because compromising any bus-connected module yields bus access.[265] Tyre pressure monitors are a partial exception that illustrates the principle: their transmissions are a fixed, very short packet format rather than complete CAN frames and the receiver is correspondingly simple, whereas had they transmitted full frames the exposure would have been severe.[265] Headlights, by contrast, are now CAN-connected modules containing microcontrollers rather than simple bulbs, which is what makes the headlight housing a viable physical entry point.[633]
Cars segment their buses to keep critical systems away from user-accessible ones, but a gateway that speaks on both buses must always exist, and in the Jeep case the attacker compromised the radio and used its access to hop across that gateway onto the critical bus.[388] Research in this area first demonstrated total control of a car through physical access to the bus; because that result depended on physical access, the same work was redone as a remote attack over the internet, and it was the remote version that established the exposure as a real one for shipped vehicles.[265] Decisions in this area have a long latency, since the architecture debate over whether to air-gap the vehicle bus from internet-connected systems happened roughly a decade before the vulnerable cars were being exploited, because those cars were designed about five years before they shipped.[265]
Integrity checking within the protocol is weak by design rather than by oversight. Safety-critical messages such as steering position typically carry one or two extra bytes computed from the message contents, but manufacturers deliberately avoid standard CRC-5 or CRC-8 and use obscure proprietary encodings instead, so the check is a barrier to reproduction rather than an integrity standard.[388] Attack tooling has industrialised around these weaknesses: one commercial CAN injection theft tool was built into a JBL Bluetooth speaker so that possession of it is not incriminating, with the apparent USB cable actually a twisted-pair CAN connection, and internally about ten dollars of parts — a PIC18F with an on-chip CAN controller and transceiver — potted in resin to stop it being copied.[634]
Anti-theft measures operating in the other direction have their own costs. Carmakers pair theft-prone assemblies such as engines and transmissions to the vehicle with a challenge-response exchange at startup, so that if the transmission cannot answer the ECU’s challenge the ECU will not let it engage a gear.[388] Newer vehicles extend this by requiring modules to authenticate to the ECU with encrypted keys before they are allowed to communicate on the bus, specifically to defeat installation of parts harvested from another car.[568] The repair consequence is direct: a vehicle rebuilder must have the original airbag rebuilt rather than fit a replacement, because the car will not recognise a unit it did not come with.[388]