Response-Time Analysis for Controller Area Networks With Randomly Occurring Messages

A probabilistic approach to determine response-time distribution for messages in Controller Area Network (CAN) is presented here. CAN is a field bus level communication network for exchanging short real-time messages. CAN is mostly used to carry periodic messages for control and automation systems. Traditional response-time analysis of CAN messages only gives worst-case response-times. This introduces pessimism in analysis, resulting in over designing and under utilization of resources. Response-time distribution is a probabilistic function. Response-time distribution provides a complete characterization of CAN message response-time. It can provide probability of meeting/missing any specified response-time limit. This probability is useful for system reliability and performance modeling. In this paper response-time model of CAN messages is discussed. Technique to derive probabilistic parameters of response-time model, for periodic CAN messages with deterministic transmission times is given. The method has been applied to a standard data set, results are compared with that of worst-case analysis and reasons for deviations are discussed.

The Controller Area Network (CAN) is widely employed in automotive control system networks. In the last few years, the amount of data has been increasing rapidly in these networks. With the purpose of improving CAN bandwidth efficiency, scheduling and analysis are considered to be particularly important. As an effective method, it has been known that assigning offsets to the CAN messages can reduce their worst case response time (WCRT). Meanwhile, the fact is that many commercial CAN controllers have been equipped with a priority or first-in-first-out (FIFO) queue to transmit messages to the CAN bus. However, previous researches for WCRT analysis of CAN messages either assumed a priority queue or did not consider the offset. For this reason, in this paper we propose a WCRT analysis method for CAN messages with assigned offset in the FIFO queue. We first present a critical instant theorem, then we propose two algorithms for WCRT calculation based on the given theorem. Experimental results on generated message sets and a real message set have validated the effectiveness of the proposed algorithms.

The Controller Area Network (CAN) is widely used in in-vehicle networks. As increasing the number of Electronic Control Units (ECUs) in an in-vehicle system, the delay of the CAN message is critical issues to achieve high accuracy of the control applications. This protocol employs an arbitration mechanism for priority-based transmission, therefore, although it is easy to estimate the worst-case response time (WCRT) of each message by using real-time scheduling theory, there is no way to know the delay time at which each CAN message was generated in the run-time environment. To address this issue, in this paper, we propose a method is to notify the real delay time of each message without synchronizing to global time between each node in the run-time environment. Our proposed method can provide the delay time of each CAN message with a small improvement so it can be applied for the existing in-vehicle systems.

Controller Area Network (CAN) is used extensively in automotive applications, with in excess of 400 million CAN enabled microcontrollers manufactured each year. In 1994 schedulability analysis was developed for CAN, showing how worst-case response times of CAN messages could be calculated and hence guarantees provided that message response times would not exceed their deadlines. This seminal research has been cited in over 200 subsequent papers and transferred to industry in the form of commercial CAN schedulability analysis tools. These tools have been used by a large number of major automotive manufacturers in the design of in-vehicle networks for a wide range of cars, millions of which have been manufactured during the last decade.This paper shows that the original schedulability analysis given for CAN messages is flawed. It may provide guarantees for messages that will in fact miss their deadlines in the worst-case. This paper provides revised analysis resolving the problems with the original approach. Further, it highlights that the priority assignment policy, previously claimed to be optimal for CAN, is not in fact optimal and cites a method of obtaining an optimal priority ordering that is applicable to CAN. The paper discusses the possible impact on commercial CAN systems designed and developed using flawed schedulability analysis and makes recommendations for the revision of CAN schedulability analysis tools.

In recent years, the complexity of real-time embedded systems has increased dramatically. For those modern real-time systems, the limitations of original static Response Time Analysis (RTA) become more and more conspicuous. Most static analysis methods not only require much detailed system information, but also only target to some specific system model with non-realistic assumptions. As a result, those methods may produce overly pessimistic results, making them unsuitable to be applied on a complex industrial system. The best system model may be the system itself. Therefore, statistical RTA, which can produce probabilistic analysis results based on samples provided by real systems or simulators, may become more expedient. Statistical RTA usually requires more relaxed assumptions and less system information than static RTA. In this paper, we present an Extreme Value Theory (EVT) based method to compute Worst-Case Response Time (WCRT) targeting complex real-time systems. In the evaluation phase, we have applied this method to the calculation of worst-case transmission delays of messages over Controller Area Network (CAN), and some comparisons with static RTA are also provided. According to the experimental results, as the system complexity increases, our approach performs much more stable and less pessimistic.

The vehicle industry is quickly becoming more connected and growing. This growth is due to advancements in cyber physical systems (CPSs) that enhance the safety and automation in vehicle. The modern automobile consists of more than 70 electronic control units (ECUs) that communicate and interact with each other over automotive bus systems. Passenger comforts, infotainment features, and connectivity continue to progress through the growth and integration of Internet-of-Things (IoT) technologies. Common networks include the Controller Area Network (CAN), Local Interconnect Network (LIN), and FlexRay. However, the benefits of increased connectivity and features comes with the penalty of increased vulnerabilities. Security is lacking in preventing attacks on safety-critical control systems. I will explore the state of the art methods and approaches researchers have taken to identify threats and how to address them with intrusion detection. I discuss the development of a hybrid based intrusion detection approach that combines anomaly and signature based detection methods. Machine learning is a hot topic in security as it is a method of learning and classifying system behavior and can detect intrusions that alter normal behavior. In this paper, we discuss utilizing machine learning algorithms to assist in classifying CAN messages. I present work that focuses on the reverse engineering and classification of CAN messages. The problem is that even though CAN is standardized, the implementation may vary for different manufacturers and vehicle models. These implementations are kept secret, therefore CAN messages for every vehicle needs to be analyzed and reverse engineered in order to get information. Due to the lack of publicly available CAN specifications, attackers and researchers need to reverse engineer messages to pinpoint which messages will have the desired impact. The reverse engineering process is needed by researchers and hackers for all manufacturers and their respective vehicles to understand what the vehicle is doing and what each CAN message means. The knowledge of the specifications of CAN messages can improve the effectiveness of security mechanisms applied to CAN.

The existing response-time analysis for messages in Controller Area Network (CAN) with CAN controllers facilitating transmission abort requests in transmission buffers does not support mixed messages. The existing analysis assumes that a message is queued for transmission either periodically or sporadically. However, a message can also be queued both periodically and sporadically using a mixed transmission mode implemented by several high-level protocols for CAN used in the industry today. We extend the existing analysis for mixed messages in CAN which is generally applicable to any high-level protocol that uses periodic, sporadic and mixed transmission modes and supports transmission abort requests in CAN controllers.

The Controller Area Networks (CAN) are widely used in industrial Networked Control Systems (NCSs), such as construction machineries, hybrid vehicles, robotics, and other applications. The message response time (MRT) or communication delay is the main issue to degrade the performance of CAN-based NCSs since its exact value is time-varying and unpredictable. The online acquisition of exact MRT can be quite helpful for the delay compensation of NCSs. However, since the clocks on different nodes are asynchronous, the MRT acquisition in CAN is a challenging work. The current delay acquisition methods for asynchronous systems are not suitable for the delay compensation in CAN-based NCSs because they either increase the bus load of CAN or cannot acquire the exact MRT in real time. In this paper, we propose a novel online real-time MRT estimation method for periodic CAN messages based on the analysis of message traces on CAN bus. The proposed method can estimate the exact MRT of the received message instance in real time without increasing the bus load and can be conveniently embedded into the CAN nodes without requiring additional equipment. In order to validate the proposed method, practical experiments are carried out and the experimental results show that the proposed method can effectively estimate the exact MRT of periodic CAN messages.

Controller area network (CAN) has wide applications in modern industrial control systems. Automobile manufacturers use this communication protocol for vehicle control, which is subject to real-time and high-reliability performance. However, with the increasing actuators gathered in the vehicle, time delay will lead to a serious problem for the vehicle safety and performance control. Thus, the information transmission stability of the CAN message needs to be investigated. In order to find out the delay response time of nonperiodic CAN message in the vehicle bus area, the response of the message transmitted in the CAN bus is modeled based on the GI/G/1 queue theory. The test platform is developed to verify the methodology. In the experimental test, some conditions with different IDs, load ratios, and priorities are investigated. Experimental results are compared with the theoretical results, and the simulation results show that the method is valid and verify the real response delay time of nonperiodic CAN message.

This paper discusses aspects of dependability of real-time communication. In particular, we consider timing behaviour under fault conditions for Controller Area Network (CAN) and the extension Time-triggered CAN (TTCAN) based on a time-driven schedule. We discuss the differences between these buses and their behaviour under electromagnetic interference. We present response timing analyses for CAN and TTCAN in the presence of transient network faults using a probabilistic fault model where random faults from electromagnetic interference occur. The CAN analysis provides a probability distribution of worst case response times for message frames. The results indicate that CAN may generally provide a higher probability of delivering messages on time than TTCAN. The CAN analysis result is used to discuss an approach to implementing a bus guardian for event-triggered systems.

As de facto standards of in-vehicle network communications among various ECUs (Electronic Control Units), CAN (Controller Area Network) protocols invented by Bosch rely on the privately-defined unique identifiers CAN ID in CAN messages which do not convey any destination address. On the other hand, sticking to error handling mechanisms in CAN protocols, an ECU with an amount of transmission errors would enter bus-off state (i.e., go offline thereupon) and shall be recovered according to some prescribed bus-off recovery mode (BOM). All these sensitive CAN knowledge concealed inside an ECU by OEMs (Original Equipment Manufacturers) shall not be revealed and could be found extensive practical applications to both adversarial behavior (e.g., target ECU attacks) and security enhancement mechanisms (e.g., intrusion detection system designs). The paper presents FirmCAN, the first automatic analysis framework to dope out sensitive CAN knowledge (CAN IDs and bus-off recovery mode in particular) compiled in automotive ECU firmwares. FirmCAN first identifies base address (using accurate absolute function entry addresses), and then performs CAN module API positioning and sensitive configuration information resolution. We buckle down to automotive ECUs that resort to fixed-address mailboxes as CAN module transmission buffers (e.g., Renesas SuperH/RA series) and present concrete algorithms for each analysis phase. Our experimental evaluations first investigate firmwares extracted from real automotive ECUs. We then develop our own applications using RA6M4 development boards, which not only produce required firmwares to evaluate FirmCAN, but also create ground truth through hardware debugging. All evaluations demonstrate that FirmCAN can accurately garner above-mentioned sensitive CAN knowledge. FirmCAN can be trivially generalized to engage in extended frames and CAN modules with similar transmission logic, e.g., TI (Texas Instruments), ST (ST Microelectronics), etc.

In scheduling algorithms based on the Rate Monotonic (RM) method which are widely used in development of real-time systems, tasks with shorter periods have higher priorities. In contrast, ones with longer periods are likely to suffer from increased response times and jitter due to their lower priorities. We propose an Execution Right Delegation (ERD) method based on RM where a high-priority server for particular (or important) task is introduced to shorten response time and jitter of the task. In the evaluation, it is confirmed that response times and jitter of a particular (important) task are reduced. We also show Response Time Analysis (RTA), which assures worst-case response time of the task. This paper shows the algorithm and RTA of ERD and evaluates it by comparing it to a Deadline Monotonic method. The evaluation by simulation shows that ERD can reduce the average worst-case response time by 13.45% at maximum compared to the Deadline Monotonic scheduling. In addition, we confirm that the RTA provides a worst-case response time close to the simulation results.

The Controller Area Network (CAN) bus system works inside connected cars as a central system for communication between electronic control units (ECUs). Despite its central importance, the CAN does not support an authentication mechanism, i.e., CAN messages are broadcast without basic security features. As a result, it is easy for attackers to launch attacks at the CAN bus network system. Attackers can compromise the CAN bus system in several ways: denial of service, fuzzing, spoofing, etc. It is imperative to devise methodologies to protect modern cars against the aforementioned attacks. In this paper, we propose a Long Short-Term Memory (LSTM)-based Intrusion Detection System (IDS) to detect and mitigate the CAN bus network attacks. We first inject attacks at the CAN bus system in a car that we have at our disposal to generate the attack dataset, which we use to test and train our model. Our results demonstrate that our classifier is efficient in detecting the CAN attacks. We achieved a detection accuracy of 99.9949%.

Controller area network (CAN) data-reduction techniques have been developed to reduce CAN bus loads, which have increased due to the large number of electronic control units in modern automobiles. Automotive communication uses various in-vehicle network. These techniques make it possible that same information to be sent using less bandwidth. However, the existing CAN DR algorithms only consider the CAN network. Automotive communication uses various in-vehicle network (IVN) protocols such as CAN, FlexRay, and Ethernet. The use of DR techniques may cause compatibility issue in heterogenous IVNs. This paper proposes a gateway system for data-reduced communication between Ethernet and CAN systems with data-reduction. The proposed gateway system receives a compressed CAN message, decompresses it, and transmits it to the Ethernet network. Additionally, the gateway receives a normal Ethernet message, compresses it, and transmits it to the CAN protocol. An evaluation of the performance of the developed gateway system is also presented.

Recently, numerous electronic components are installed in vehicles, providing drivers and passengers with increased safety and convenience. The electronic components construct an in-vehicle network that internally shares relevant status information about the vehicle. As modern vehicles become more computerized, the potential for automotive cyber-security threats also increases a fact that has been illustrated clearly by various car-hacking demonstrations. Using the controller area network (CAN), the de facto standard protocol in the automotive industry that facilitates in-vehicle network communication, car-hacking demonstrations inject critical CAN messages to control vehicular functions. In efforts to address this security issue, car manufacturers, in turn, have made confidential the CAN database (i.e., DBC format file), where signal information assigned in the CAN data payload is specified. However, it has since become known that this policy does not hermetically seal a vehicular network against cyber attacks. On the contrary, in-depth automotive security research has been hindered significantly because of the limited information accessible by researchers. For example, automotive intrusion detection systems (IDS) identify and alert when there is a vehicular break-in, and this technology is a major area of study in automotive cyber security research. For the automotive IDS that analyzes CAN traffic, information in the DBC format file greatly improves detection veracity. However, most IDS technologies to date have been independently developed without the confidential CAN DB information and, as a result, do not mitigate threats to a satisfactory standard. In this paper, we propose an enhanced method that identifies signal boundaries in a CAN data payload, which is specified in the DBC format file. Unlike an existing method that is designed based on total bit-flip rates, our method analyzes bit-flip time series not total bit-flip rates so that signal boundaries can be more clearly identified. In this paper, we use a publicly available DBC format file called OpenDBC as a reference, and show that our method outperforms the existing method.