Reliability Analysis of CAN nodes under Electromagnetic Interference

Controller Area Network (CAN) is the main bus network that connects electronic control units in automobiles. Although CAN protocols have been revised to improve the vehicle safety, the security weaknesses of CAN have not been fully addressed. Security threats on automobiles might be from external wireless communication or from internal malicious CAN nodes mounted on the CAN bus. Despite of various threat sources, the security weakness of CAN is the root of security problems. Due to the limited computation power and storage capacity on each CAN node, there is a lack of hardware-efficient protection methods for the CAN system without losing the compatibility to CAN protocols. To save the cost and maintain the compatibility, we propose to exploit the built-in CAN fault confinement mechanism to detect the masquerade attacks originated from the malicious CAN devices on the CAN bus. Simulation results show that our method achieves the attack misdetection rate at the order of 10-5 and reduces the encryption latency by up to 68% over the complete frame encryption method.

In manufacturing systems, Controller Area Network (CAN) based systems has been widely used. Hence the reliability of the Controller Area Network has become increasingly important. In order to ensure production safety and reduce unnecessary maintenance costs, evaluating the reliability of a CAN network becomes necessary. The reliability of the CAN network can be assessed by determining the status of nodes and predicting the times of each node reaching its bus off states using node transmit error counter (TEC) values. However, the TEC values of the nodes cannot be accessible online in most industrial applications. This paper presents a novel method for node TEC value estimation based on the segmented discrete time Markov chains using network error information. We also consider the special scenario where data frame arbitration area is damaged by the error so that node identifier (ID) information of the interrupted data frame cannot be identified. Case studies are carried out to demonstrate the effectiveness of proposed method. Experiment results show that the estimation results using the proposed method agree well with actual observations.

Recent years have seen an exponential rise in complex software-driven functionality in vehicles, leading to a rising number of electronic control units (ECUs), network capabilities, and interfaces. These expanded capabilities also bring-in new planes of vulnerabilities making intrusion detection and management a critical capability; however, this can often result in more ECUs and network elements due to the high computational overheads. In this paper, we present a consolidated ECU architecture incorporating an Intrusion Detection System (IDS) for Automotive Controller Area Network (CAN) along with traditional ECU functionality on an off-the-shelf hybrid FPGA device, with near-zero overhead for the ECU functionality. We propose two quantised multi-layer perceptrons (QMLP's) as isolated IDSs for detecting a range of attack vectors including Denial-of-Service, Fuzzing and Spoofing, which are accelerated using off-the-shelf deep-learning processing unit (DPU) IP block from Xilinx, operating fully transparently to the software on the ECU. The proposed models achieve the state-of-the-art classification accuracy for all the attacks, while we observed a 15x reduction in power consumption when compared against the GPU-based implementation of the same models quantised using Nvidia libraries. We also achieved a 2.3x speed up in per-message processing latency (at 0.24 ms from the arrival of a CAN message) to meet the strict end-to-end latency on critical CAN nodes and a 2.6x reduction in power consumption for inference when compared to the state-of-the-art IDS models on embedded IDS and loosely coupled IDS accelerators (GPUs) discussed in the literature.

Post-Silicon validation is the final level checking the silicon before it is delivered to customer. Automotive microcontrollers use CAN (Controller Area Network) as major communication protocol, which can be used in the mission critical systems and hence should be validated under extreme scenarios to test the robustness of the Microcontroller. Since validation space is huge, there are numerous scenarios that can occur in a real system. Traditional test cases follow directed approach of testing, which behave in a predicted way and lacks flexibility to control dynamically the variation in the stimulus. To overcome the limitations of directed approach and to ensure reliability of the communication modules, we came up with the methodology of Randomization, which is a well-proven methodology in pre-silicon verification environment. Proposed methodology uses the internal micro architecture of the module to explore the huge validation space to find the unknown bugs, which are not detected by the traditional directed approach. The objective is to test the robustness of Microcontroller by Stressing the module to find unknown bugs faster in the early phase of Silicon validation by hitting the architecturally interesting conditions (corner case) in Probabilistic manner. A multi-level seed-based algorithm has been implemented to achieve randomization of CAN and other communication modules. Some target parameters and events have been identified for randomization (e.g. Baud Rate, Frequency, Bus Load, Sample points, order of CAN nodes, Message Buffers, Sleep and Suspend etc.). These target parameters and events will be randomized based on the values, which are generated by pseudo-random function. In this approach, the sequence of state-machines of test-execution can also be randomized in order to hit humanly not-conceivable corner cases and thus checking robustness of the chip. The methodology includes steps for root cause identification of failure and it is cyclicrepeatable. Our experiment reveals one corner-case silicon bug, which can only be found with randomized methodology.

Controller Area Network (CAN) is a kind of serial communication network that supports the distributed control and the real time control. The CAN have high performances and high reliabilities. It can solve many problems of complex circuitry, wiring harness increasing, operation reliability reducing and the difficulty of fault maintain increasing while using CAN Bus technology in automobile. In this paper, the form of CAN bus and node design method based on MC912D60A single chip microcomputer were studied and introduced. At last, the hardware design principle diagrams and software flow charts were given.

Controller Area Network (CAN) is used extensively in automotive applications, with in excess of 400 million CAN enabled microcontrollers manufactured each year. In 1994 schedulability analysis was developed for CAN, showing how worst-case response times of CAN messages could be calculated and hence guarantees provided that message response times would not exceed their deadlines. This seminal research has been cited in over 200 subsequent papers and transferred to industry in the form of commercial CAN schedulability analysis tools. These tools have been used by a large number of major automotive manufacturers in the design of in-vehicle networks for a wide range of cars, millions of which have been manufactured during the last decade.This paper shows that the original schedulability analysis given for CAN messages is flawed. It may provide guarantees for messages that will in fact miss their deadlines in the worst-case. This paper provides revised analysis resolving the problems with the original approach. Further, it highlights that the priority assignment policy, previously claimed to be optimal for CAN, is not in fact optimal and cites a method of obtaining an optimal priority ordering that is applicable to CAN. The paper discusses the possible impact on commercial CAN systems designed and developed using flawed schedulability analysis and makes recommendations for the revision of CAN schedulability analysis tools.

<div class="section abstract"><div class="htmlview paragraph">The amount of data communicated in automotive networks is increasing rapidly, leading to more complex systems alongside the rising number of Electronic Control Units (ECUs) in modern vehicles. As the number of ECUs has risen, Controller Area Network (CAN) communication bandwidth has been pushed to its limit. Existing solutions - such as using multiple CAN buses, sending multiple CAN frames or switching to another protocol - require a significant system-design effort and replacement of hardware and software. This has paved the way for CAN Flexible Data-rate (CAN FD), which extends the CAN standard and permits significantly higher data rates, enabling faster firmware upgrades. However, some changes must be made like: exchange the classical CAN microcontroller with a CAN FD microcontroller and also a CAN FD transceiver must be used.</div><div class="htmlview paragraph">This article will explore the benefits of CAN FD, how it compares with the classical CAN protocol, requirements for systems and how to introduce CAN FD into existing CAN networks.</div></div>

This paper discusses aspects of dependability of real-time communication. In particular, we consider timing behaviour under fault conditions for Controller Area Network (CAN) and the extension Time-triggered CAN (TTCAN) based on a time-driven schedule. We discuss the differences between these buses and their behaviour under electromagnetic interference. We present response timing analyses for CAN and TTCAN in the presence of transient network faults using a probabilistic fault model where random faults from electromagnetic interference occur. The CAN analysis provides a probability distribution of worst case response times for message frames. The results indicate that CAN may generally provide a higher probability of delivering messages on time than TTCAN. The CAN analysis result is used to discuss an approach to implementing a bus guardian for event-triggered systems.

The controller area network (CAN) system is one of the serial bus systems used in various applications, such as automobiles, airplanes, and industry. This study describes the analysis of electromagnetic interference (EMI) caused by a buck converter that is installed close to a CAN communication bus, and highlights the problems in a conventional EMI evaluation, followed by the development of an experimental EMI mitigation method. The experiments performed for verification show that the periodic switching noise of a buck converter causes data-transmission failure of CAN. Finally, this study proposes a novel control method for a buck converter, which can reduce the data-transmission failure of CAN.

Study and Prototype Implementation of Basic Non-CAN and CAN Based Communication in Context with Automotive Application(s)

<div class="section abstract"><div class="htmlview paragraph">In-vehicle communication among different vehicle electronic controller units (ECU) to run several applications (I.e. to propel the vehicle or In-vehicle Infotainment), CAN (Controller Area Network) is most frequently used. Given the proprietary nature and lack of standardization in CAN configurations, which are often not disclosed by manufacturers, the process of CAN reverse engineering becomes highly complex and cumbersome. Additionally, the scarcity of publicly accessible data on electric vehicles, coupled with the rapid technological advancements in this domain, has resulted in the absence of a standardized and automated methodology for reverse engineering the CAN. This process is further complicated by the diverse CAN configurations implemented by various Original Equipment Manufacturers (OEMs).</div><div class="htmlview paragraph">This paper presents a manual approach to reverse engineer the series CAN configuration of an electric vehicle, considering no vehicle information is available to testing engineers. To execute reverse engineering, the CAN data log is to be taken from the OBD-II port by systematically identifying and mapping the CAN with various ECUs interfaced with that CAN line. Driver actions and continuous data logged from the OBD-II port are cross-referenced with CAN data to determine the byte order of signals and message frames. The signals derived from one vehicle use scenario (driving) are then validated against another scenario (charging) to ensure consistency and accuracy.</div></div>

As de facto standards of in-vehicle network communications among various ECUs (Electronic Control Units), CAN (Controller Area Network) protocols invented by Bosch rely on the privately-defined unique identifiers CAN ID in CAN messages which do not convey any destination address. On the other hand, sticking to error handling mechanisms in CAN protocols, an ECU with an amount of transmission errors would enter bus-off state (i.e., go offline thereupon) and shall be recovered according to some prescribed bus-off recovery mode (BOM). All these sensitive CAN knowledge concealed inside an ECU by OEMs (Original Equipment Manufacturers) shall not be revealed and could be found extensive practical applications to both adversarial behavior (e.g., target ECU attacks) and security enhancement mechanisms (e.g., intrusion detection system designs). The paper presents FirmCAN, the first automatic analysis framework to dope out sensitive CAN knowledge (CAN IDs and bus-off recovery mode in particular) compiled in automotive ECU firmwares. FirmCAN first identifies base address (using accurate absolute function entry addresses), and then performs CAN module API positioning and sensitive configuration information resolution. We buckle down to automotive ECUs that resort to fixed-address mailboxes as CAN module transmission buffers (e.g., Renesas SuperH/RA series) and present concrete algorithms for each analysis phase. Our experimental evaluations first investigate firmwares extracted from real automotive ECUs. We then develop our own applications using RA6M4 development boards, which not only produce required firmwares to evaluate FirmCAN, but also create ground truth through hardware debugging. All evaluations demonstrate that FirmCAN can accurately garner above-mentioned sensitive CAN knowledge. FirmCAN can be trivially generalized to engage in extended frames and CAN modules with similar transmission logic, e.g., TI (Texas Instruments), ST (ST Microelectronics), etc.

In the present day scenario, industrial automation is the most prominent and very common phenomena. Normally, to establish communication among different modules, in industrial applications controlled area network (CAN) protocol is very popular. As the number of devices connected to CAN bus increases, response time also increases for devices connected to CAN, which may lead to catastrophic effects in the system. As CAN deals with electrical signals it may generate electromagnetic interference (EMI) in signal sensitive areas. To avoid EMI and to reduce response time due to CAN bus protocols, other alternatives are to be thought of. So, to overcome the limitations and to resolve the problems due to CAN bus in industrial controlling a novel idea is proposed by the authors for controlling and monitoring the remote plant using Li-Fi. Remote plant is a signal sensitive area, where first a communication link based on Li-Fi is developed to monitor various modules of the plant and then collected data is stored in a server using Wi-Fi module, and necessary control signals are also sent through the Wi-Fi protocol to the plant to control it.

Modern cars are equipped with a wide variety of sensors generating continually growing amounts of data. This data is transmitted via bus systems such as Controller Area Network (CAN) inside of the vehicle to the microcontroller-based Electronic Control Units. By connecting the vehicle to its surroundings using wireless interfaces, this data becomes accessible to the vehicle manufacturer from a distance. Through the opening to the outside, cyber attacks can exploit these interfaces and introduce major risks to the privacy and safety of vehicle users. Hence, suitable methods for vehicle security monitoring such as intrusion detection and logging are needed. In this work, we focus on the logging of network data, since this data is useful for the development of security updates, countermeasures and incident signatures. On this account, we propose a new method to aggregate the data of the CAN bus. The method combines CAN frames into so-called flows. Each flow contains a set of packets that share a certain common attribute (e.g.: frame type and identifier). To integrate security monitoring of vehicle fleets seamlessly into backend server systems, the gathered CAN flow data is stored in an industry standard data format. Additionally, the payload data is included in the flow format using a compression algorithm to leverage deep-packet inspection. The evaluation results with realworld vehicle data indicate that in our case about 40 % reduction of the overall data size is possible with our method compared to industry-standard formats for storing CAN frames. On this account, we propose a new method to aggregate the data of the CAN bus. The method combines CAN frames into so-called flows. Each flow contains a set of packets that share a certain common attribute (e.g.: frame type and identifier). To integrate security monitoring of vehicle fleets seamlessly into backend server systems, the gathered CAN flow data is stored in an industry standard data format. Additionally, the payload data is included in the flow format using a compression algorithm to leverage deep-packet inspection. The evaluation results with realworld vehicle data indicate that in our case about 40 % reduction of the overall data size is possible with our method compared to industry-standard formats for storing CAN frames.

The Controller Area Network (CAN) dominates in-vehicle networking systems in modern vehicles. CAN was designed with low-latency and reliability as key features. Authenticity of a CAN frame was not considered in the design, thus, most in-vehicle network nodes inherently trust received messages as coming from a legitimate source. As a result, it is trivial to program (or hack) a network node to spoof traffic. Authentication is challenging for CAN and related protocols, such as SAE J1939, due to limited frame sizes and high bus utilization. Adding a message authentication code (MAC) as a separate message can unduly stress the real-time delivery of safety-critical messages. Although this stressor is well-known, the impact of authentication protocols on real-time message delivery in CAN has not yet been thoroughly examined. In this paper, we provide the first comprehensive analysis of realtime schedulability analysis applied to authentication schemes for CAN, CAN Flexible Data-rate (CAN FD), and CAN extra long payload (CAN XL). We formulate the response time analysis for addition of MACs and periodic transmission of MACs, and we examine their impact on two case studies and through evaluation with randomized schedulability experiments over a wide range of message sets.