start	end	text
2400	9960	Okay, we're live. Thank you, John, for the lead off. And welcome back, everyone, to another
9960	17560	Car Hacking 101 talk for DEF CON Safe Mode 2020's Car Hacking Village. My name is Kamal,
17560	22000	and in this lecture, I'm going to be talking about in-vehicle networks. I'm also doing a talk
22000	29440	for Bluetooth in the same kind of vein of Car Hacking 101 talks. So if you've already seen
29440	34900	or heard my introduction, I apologize profusely, but I have to give it again for those of you that
34900	40920	might not be interested in Bluetooth or just coming to this one first. So a very short speaker
40920	45540	introduction, right? As I mentioned before, my name is Kamal, Kamal Ghali. I'm an automotive
45540	50820	cybersecurity technology architect at White Motion. White Motion is a small automotive
50820	56380	cybersecurity-focused company. We're a subsidiary of Morelli. It's a much larger Italian automotive
56380	63800	tier one supplier. It's actually the combination of the older Magneti Morelli, Italian automotive
63800	71200	tier one, and a Japanese tier one called CalSonic Kansei. They actually merged a couple of years
71200	77420	ago, and White Motion was at the time owned by CalSonic Kansei, and now we are a full subsidiary
77420	85040	of Morelli Corporation. So I myself am based in Tokyo. I'm a trilingual car hacking enthusiast,
85440	89700	because for me, this is very much more than just a job. It is more than just a profession. It's
89700	95540	something I enjoy, and I enjoy doing a lot of volunteer activities in the industry as well.
95540	100440	For example, this Car Hacking 101 talk is not something anyone is paying me for. No one is,
100440	104160	you know, my boss didn't tell me to go do this. This is entirely because I enjoy what I do,
104160	107760	and I think a lot of people would enjoy doing what I do, and I want to make sure that the
107760	114140	knowledge is easily accessible for people that want to join the industry. So along those lines,
114140	120700	I am an ex-admin of ASRG Detroit. I got involved in Automotive Security Research Group while I was
120700	125640	living in Michigan, helping out with things like working on collaboration between industry
125640	130540	and academia, and I'm the founder of the Automotive Security Research Group Japan.
130540	136360	For any of you that aren't aware, Automotive Security Research Group is an organization
136360	142000	dedicated to sharing information about automotive cybersecurity, making it more readily available,
142000	148860	mainly being driven by the community as opposed to, you know, its own industrial entity, right?
148860	153740	So it's a pretty open community, and a lot of, you know, freely available talks, etc. are available
153740	158400	online for anyone that wants to learn about automotive security. But anyway, I've gone on a
158400	163920	bit of a rant there, but I like to consider myself a jack of some trades, a master of none.
163920	168080	My recent areas of interest are Bluetooth, USB, radio frequency, digital forensics,
168080	171240	and I have some interesting hobbies of mine that I have listed down below.
171240	175620	But today we're not talking about any of these technologies, we're going to talk about in-vehicle
175620	182520	networks. So what is an in-vehicle network? An in-vehicle network is, as you know, I would hope
182520	188220	is obvious, it is a network that's used inside a vehicle, right? So it's a networking technology
188220	194500	that's used to allow the ECUs inside a vehicle to efficiently and, you know, safely share information
194500	200400	between one another. So these in-vehicle network technologies are designed specifically for use
200400	205700	in these closed environments where you have, you know, several ECUs inside a vehicle, they need to
205700	210880	share sensor information, you know, the results of calculations, calibration information, vehicle
210880	217000	status, so on and so forth, with other distributed processing units throughout the vehicle, right?
217520	221860	If you consider, you know, very broadly speaking, a network can be anything. It can be
221860	228040	Bluetooth as a network, you know, 4G, 5G, those are networks, DSRC is a network, Wi-Fi is a network.
228040	231940	But for the purposes of this talk, I'd like to make it clear that I'm talking about
232420	237460	physical networks, I'm talking about guided medium networks, right? For those of you with a background
237460	242480	in networking, you might know the difference between a guided and an unguided medium for your
242480	248820	network is that guided means it's got copper or fiber in place that actually, well, guides the
248820	254260	transmission of information along a specified path, right? It's not radiated like it is in most
254260	259800	wireless communications, right? So we're going to be talking about those kind of physical wire
259800	264380	communications, be they copper-based or fiber-based, and how they're used in a vehicle. I'm going to go
264380	269320	over some of the different types of inter-vehicle networks that are found in the industry today.
269320	272940	I'm going to talk a little bit about each one of them, how they're used, what their strengths are,
272940	277320	what their weaknesses are, etc, right? Strengths and weaknesses are a big part of inter-vehicle
277320	284920	networks because, as you can see, I have listed here, they are selected based on what role they
284920	290500	fill for a given application, right? There's no one-size-fits-all, best-in-vehicle-network
290500	294520	solution that can do everything. There are different solutions, different technologies
294520	299440	available that manufacturers selectively include in their vehicles based on where
299440	303340	they're most appropriate, right? You'll see how this works out in just a second.
303980	310820	So, in the context, excuse me, I was drinking some pineapple juice and some of it's got stuck
310820	316220	in my throat, which is probably not a great way to get ready for giving a recorded talk.
316240	322780	But in the context of a self-driving or autonomous vehicle, this is a fairly common, you know,
322780	328260	logical setup within a vehicle, right? In this diagram, we have a couple of ECUs alongside a
328260	333020	sensor and some actuators, right? The sensor in this case could be, you know, any number of things.
333020	339420	It could be a camera, it could be an accelerometer, a CO2 sensor, a LiDAR sensor, user input sensor,
339420	344540	radio, you know, it could be almost anything, right? The sensor is, at this point, in this logical
344540	350920	diagram, we're just treating this sensor as a source of raw information, right? The data that
350920	356940	this device generates needs to be processed. This is, the sensor isn't, is intaking raw information
356940	361440	and that information needs to be processed, it needs to be interpreted by a processing unit so
361440	368300	that the vehicle as a whole can kind of understand what that raw data means about the vehicle's
368300	373980	environment, what it has to do next, so on and so forth, right? So based on what kind of sensor it is,
373980	378540	you know, what kind of data it's going to be producing and how much of that data it's producing
378540	383720	is going to be different. And a different in-vehicle network technology might be chosen
383720	388900	to carry that data from where it's generated to where it gets processed here in the ECU, right?
388900	393780	So along this diagram, if we take it, you know, kind of from start to finish, this sensor here is
393780	397680	going to generate some raw data, right? This is going to be a camera that's facing, you know,
397680	402020	towards the front of the vehicle. It could be, you know, just assume it's a camera, right? And it takes
402020	407040	that image data and it sends it to ECU 1 for processing, right? Because the processing power
407040	413200	is going to be contained here on the ECU's microcontroller, right? So this line here is
413200	417700	meant to represent an in-vehicle network, right? Because something needs to be in place for this
417700	423180	sensor to be able to send that data to ECU number 1 over here, right? Once ECU 1 has the raw data,
423180	428540	it's going to be able to do some calculations, you know, interpret that data, understand what
428540	433140	that data means, right? Is there, you know, a traffic sign, you know, a stop sign in front of us,
433280	438000	a red stoplight, you know, how self-driving cars should stop for stoplights, so on and so forth.
438000	441640	It's going to make those decisions and, you know, understand the raw data it received,
441640	447100	and then it's going to pass the results of those calculations on to another ECU, right? And then
447100	451800	maybe this ECU is in charge of something else, right? Here I have, you know, two very broadly
451800	459900	defined actuators, right? An actuator in this scenario being any device that upon receiving,
459900	469000	you know, an input from a processing unit converts that input into a physical real-world stimulus,
469000	473880	right? A thing that happens, right? This is what I mean when I'm talking about an actuator.
476140	480600	So each of these lines here is meant to represent an in-vehicle network, and I have them all
480600	484200	colored the same way because at this stage, you know, I haven't talked about the different types
484200	488880	of in-vehicle networks, but each one of these is likely going to be a different type of in-vehicle
488880	494300	network technology because the amount of data being processed from here to here might be
494300	497640	different with the amount of data processed between these two, and it might be different
497640	502520	from the amount of data processed between, you know, ECU 2 and the actuators, right? So some
502520	506440	things to take into consideration when considering which in-vehicle network technology to choose
506900	512400	would be things like safety and robustness requirements, distance from the ECU to the
512400	517120	actual sensor, right? Bandwidth necessities, how much data is being processed, what kind of data
517120	521740	it is, how, you know, how fast it needs to be processed. All of these are metrics you want to
521740	529080	take into consideration when picking the appropriate in-vehicle network to use, right? So going on,
529080	533440	we're going to talk a little bit about network topologies and how they relate to
533440	537840	in-vehicle networks. So I have here, I ripped this image from the internet somewhere. I have
537840	542220	the source listed down here. This is a look at a couple of common network topologies, right?
542220	546320	You have your mesh network, you have your fully connected network, which is also called a full
546320	552140	mesh network, right? You have star topology, ring, and a common bus topology. These might be pretty
552140	558580	familiar to you if you've worked as a systems administrator or you have any, you know, experience
558580	565260	as an actual networking engineer, right? Some of these would be familiar and how they relate to
565260	574380	in-vehicle networks is that we... where am I going with this? Okay, most of the in-vehicle networks
574380	578400	that I'm going to talk about today will use a common bus topology, right? But that doesn't
578400	585040	mean that there aren't some that use other topologies instead, right? Because in-vehicle
585040	589960	networks are designed to be reliable and robust because they are, you know, part of a vehicle
589960	597280	ecosystem. A vehicle is a moving object that moves very fast, is very heavy, and has living breathing
597280	604000	people inside it. There are a lot of important, you know, safety thresholds that need to be met.
604000	608980	There are a lot of standards that, you know, are in place to best guarantee the safety of the
608980	614780	passengers and the environment around the vehicle. And so when we talk about things like the networks
614780	618320	that we use for transferring this information, it's important to know that they need to be
618320	625160	designed with a level of robustness and reliability and safety in mind, right? So with regards to the
625160	631320	networks shown here, some of them have strengths and weaknesses that are realized, or I suppose
632200	636840	they can be seen in the in-vehicle network technologies that make use of these topologies,
636840	643400	right? So say you have a fully connected network. This is a very expensive, very hard to implement
643400	649300	type of network, because every single unit in this device is going to have a direct link to
649300	653920	every other unit in the network, right? This means you need to have the hardware and infrastructure
653920	662240	to connect every unit to every other unit, right? And the positive to this is that, you know,
662240	667300	you have incredible redundancy. If any link goes down, it doesn't matter. Every computer has a link
667300	671760	to every other computer, or every other processor, right? Every other microcontroller, so on and so
671760	676440	forth, whatever it could be, right? So if this ECU here, let's pretend these are ECUs and not
676440	682360	desktops, if this ECU wants to communicate with this ECU, but this direct link between them breaks,
682360	687860	right? The obvious logical conclusion is then, well, I can still talk to this ECU, but through
687860	692080	any number of other paths. I can go from him to him, I can go from him to him, or from him to him,
692080	696960	or from him to him. The fully connected network topology offers the most amount of redundancy,
696960	702360	right? But the downsides are, like I mentioned earlier, they're expensive, they're sometimes a
702360	708300	little bit more complicated to implement, and especially when it comes to cars, the actual
708300	715000	physical cable weight is becoming a sort of rising concern for automotive manufacturers, right? The
715000	721960	actual weight of the cable harness is not a trivial thing. It's not a trivial part of the vehicle
721960	726880	ecosystem, right? The actual designing of a vehicle needs to take into account how much cabling is
726880	731380	going to be in there, because you can have, you know, I don't, I'm not, you know, an expert on how
731380	737400	much cable goes into cars, but I'd say it can amount to quite a bit of weight, right? A couple,
737400	743020	maybe tens of kilograms, I would assume, right? This is just an educated guess, right? But I'm
743020	748000	sure someone more familiar with that actual metric would be able to give you a more accurate
748640	753280	number there. But those are the pros and cons of something like a full connected,
753280	760200	fully connected network topology. A mesh network is kind of like a not full connected network
760200	764800	topology. It's kind of like an in-between, right? You'll have different devices here with different
764800	771780	connections to some, if not all, of the other processors in the network, right? This is good
771780	776220	because you'll have some level of redundancy where if, say, this line goes down, right, then you can
776220	782500	still reach this processor here by going, okay, we'll go here, here, and then here, right? So you have
782500	787640	different paths that your data can take if you need to send data from one processor to another
787640	793020	on the network. A common bus topology, this is where all of the ECUs, in this case, will be
793020	799120	connected to a single common bus that they can all send or receive data from at the same time.
799120	804340	This is how CAN bus works. I'll talk about that in the next couple of slides, as it's the most
804340	810820	common in-vehicle network in the automotive industry currently. But this is a pretty common
812280	816660	implementation because of how easy it is, right? All of the nodes are just
816660	821360	connected to one network, and there isn't any kind of routing protocol you have to implement,
821360	825600	especially when it comes to CAN, right? It's very simple, it's easy to get set up, and it works
825600	829980	pretty well. But one of the downsides, and it's cheap, by the way, but one of the downsides is
829980	835140	that this common bus then becomes a single point of failure. So maybe, you know, you wouldn't use
835140	839700	something like this in a very high, a very critically important system, right? Especially
839700	843460	when we're talking about things like government systems or military systems, you're more likely
843460	848160	to see something like this because they are prioritizing, you know, in the moment operational
848160	852560	stability over everything else, whereas for a mass-produced vehicle, right, this is kind of
852560	857260	how you want to go, right? It's because it needs to be mass-produced, it's not feasible to make
857260	864040	every single car on the road in this, you know, fancy of an architecture. Moving on, ring topology
864040	868320	is pretty rare, but I believe that the most protocol... I'm talking about rare as in within
868320	873820	the vehicle or context, right? Within the most protocol, I believe a ring topology is used,
873820	877500	although there are different versions of most and some of them might be able to be used in other
877500	882400	versions. Most isn't a technology I've personally worked with a lot because it is pretty rare, but
882400	886620	I will touch on it briefly in this presentation. And then you have a star network topology. This
886620	893220	is one of the more common topologies, and especially when it comes to discussing technologies
893220	898360	like automotive ethernet and, you know, trying to run TCP IP inside cars, right? Those are
898360	904120	point-to-point protocols, and for that, a star topology makes a lot of sense. It's a very happy
904120	908260	medium, you know, it doesn't have an excessive amount of cabling and it doesn't have...
910080	914260	if one of these links goes down, then the rest of the network is usually protected,
914260	918940	but you do have to rely on something like a switch or something in the middle to handle
918940	923860	forwarding of communication between the different ECUs, right? But it's kind of seen as a happy
923860	930140	medium network topology, right? But anyway, enough about topologies, let's start talking about
930140	937180	individual in-vehicle networks. So CAN bus is kind of the main character of the in-vehicle network
937180	943020	technology world, right? CAN stands for controller area network. It is the most commonly used in-vehicle
943020	951020	network today by far, right? It is more or less standardized and mandated on most vehicles in the
951020	957240	United States and Europe for diagnostic purposes. It was developed by Robert Bosch in 1991,
957240	964360	is when the 2.0 standard came out, right? The most common nodes you'll find in the market today are
964360	972380	actually 2.0b standard CAN bus nodes, and the 2.0b distinction is that they allow for the
972380	977260	use of 29-bit arbitration identifiers. Arbitration is the process by which
977260	984820	CAN messages have their priority established, and this is the process by which CAN bus actually
984820	990300	handles collisions, right? Collisions are detected and then resolved instantaneously,
990300	995980	almost instantaneously, through the use of arbitration IDs. I don't think we're going to
995980	1000180	talk too much about the actual arbitration process today because that's slightly more in-depth for
1000180	1007860	CAN bus, but this is how CAN bus is addressing, is with arbitration IDs. But I'll just put this
1007860	1013560	out here now. CAN bus runs in a bus architecture, and it's a multi-master serial communication. So
1013560	1018880	anyone can send a message, and the arbitration identifier isn't really meant as a source address
1018880	1025180	or a destination address. It just identifies what kind of data is in this packet, right? So if you
1025180	1032260	slapped a sticker to a car saying, you know, this car has oranges in it, right? That's kind of what that
1032260	1038380	does. Saying this truck has oranges in it doesn't mean, you know, it's specific oranges for one
1038380	1043960	person. There's just oranges, and anyone that wants an orange can stop this truck and get an orange.
1043960	1049620	That's a horrible example, but hopefully that'll get across the idea of
1049620	1056020	what an arbitration ID does in a CAN frame, right? And then, you know, back to the CAN frames
1056020	1062320	themselves. Each CAN bus frame in Classical CAN can hold up to eight bytes of data, right?
1063200	1069720	So there are a couple different kinds of CANs. The main, most common CAN bus is high-speed CAN,
1069720	1074920	also called a dual-wire CAN. And this is important because there's a single-wire CAN that also exists,
1074920	1079480	but dual-wire CAN is the most common one. It uses differential signaling and commonly employs
1079480	1085740	twisted pair cabling to include, to add some EMI resistance to it, right? I mentioned that
1085740	1090740	in-vehicle networks need to be reliable, they need to be robust, and this is because a vehicle is a
1090740	1095900	pretty noisy environment. If you're not familiar with what EMI is, right, this EMI here, it's
1095900	1101980	electromagnetic interference. This is when things like power supplies or radios or microwaves or
1101980	1108540	anything that's giving off, you know, radio waves, those radio waves can have on a physical,
1108540	1113720	you know, physics electronics level, they can actually corrupt some of the data being carried
1113720	1121640	by a guided medium if that guided medium isn't properly shielded, right? So this twisted pair
1121640	1126600	cabling is also there to help that because all... well, the way twisted pair cabling works, I'll
1126600	1130980	explain that in a second. I have a slide where I like to go a little bit more in depth into that.
1130980	1137020	But the differential signaling and the twisted pair cabling work together to help mitigate EMI
1137020	1141920	impact, right? Speeds are theoretically up to one megabit per second, although in practice you're
1141920	1148340	more likely to find 125 kilobits per second, 250 kilobits per second, and 500 kilobits per second
1148340	1154960	speeds in most cars, right? One megabit speeds are heavily restricted by cable length because at a
1154960	1160200	certain length of cable it's no longer practical to transmit that fast, and it's just usually a
1160200	1165180	better idea to stick with 500 kilobits. It's more reliable, right? Just take my word for it.
1165540	1170340	This is a quick look at what a CAN bus actually looks like from the physical perspective.
1171040	1176080	CAN buses are usually terminated with 120 ohms on both ends, right? This is a high-speed CAN bus,
1176080	1182140	by the way. And then on each end, each node will have its own CAN transceiver that is connected
1182140	1188420	to a CAN low line and a CAN high line, right? So CAN bus is technically a dual-wire system when
1188420	1195240	we're talking about high-speed CAN. CAN, right? And these are intertwined like this. This is the
1195240	1200480	twisted pair that I was talking about, right? So you can see that there's a high voltage CAN line
1200480	1205460	and a low voltage CAN line, and the difference between these two CAN lines is what is read when
1205760	1212440	a logic is being registered. That's the differential signaling. Excuse me, pineapple juice is starting
1212440	1217260	to make me burp a little bit. But anyway, back to differential signaling, as I was mentioning.
1217260	1222300	So this is a very easy to understand diagram showing how differential signaling works in CAN,
1222300	1227680	right? Here we have a logic graph and an actual physical voltage graph, right? So in high-speed
1227680	1234040	CAN, CAN high and CAN low both rest at around 2.5 volts. This is their kind of resting state,
1234040	1239660	and this is what is read as a recessive logic or a logic zero, right? As counterintuitive as it
1239660	1245760	might seem, logic one in CAN bus is considered recessive and logic zero is considered dominant,
1245760	1251120	so this shows here how the physical bus would look and the logic bus would look
1251120	1258000	if we were to transmit 101 on a CAN bus, right? We'd have the recessive, both lines here at 2.5
1258000	1264660	volts with a zero volt differential. We have dominant for one bit cycle. During that bit
1264660	1272740	cycle time, the CAN high line gets driven to 3.5 volts and the CAN low line gets driven down
1272740	1279200	to 1.5 volts, right? This two volt differential is what is kind of registered. It's what's
1279200	1286420	recognized as a logic zero, right? And then the bus voltages go back down to 2.5 and another
1286420	1292800	recessive logic one is registered. I'm going to talk a little bit about how the twisted pair
1292800	1298940	cabling actually protects against EMI. Let me pull out my pen and PowerPoint. So twisted pair
1298940	1304800	cabling means that the two bus lines, CAN high and CAN low, are intertwined with each other
1304800	1311260	very tightly, right? They aren't just straight across, you know, from one node to another.
1311260	1317300	You can make them that way, but it's better not to because of EMI, right? So the way that works,
1317300	1324400	because those cables are intertwined so tightly, any electromagnetic interference that hits that
1324400	1331760	bus is very likely to hit both CAN high and CAN low, right? So what happens if that
1332400	1337220	kind of scenario occurs? Well, let's draw it out. Say there's an electromagnetic pulse
1337220	1342480	and it's CAN high and CAN low at the same time. It causes a voltage spike that looks
1342480	1348560	kind of like this, right? And then later down here it also comes up like that, right?
1349320	1353760	So that's the CAN high. I should have switched the colors here. I'm kind of a fool,
1353760	1359300	but I didn't do it, so just forgive me, right? The idea is because they're twisted so tightly,
1359300	1364440	we're likely to see the same exact behavior on CAN low, right? Now I'm doing a really shitty
1364440	1371080	job of actually drawing this exactly the same from one to the other, but let's just pretend
1371080	1376860	that these look exactly the same. And then while the bus is in the recessive state, let's say that
1376860	1385180	that interference continues, right? We'll see the same physical impact on both bus lines, right?
1385180	1391120	Now, why is that important, right? Remember how the differential signaling, the differential part
1391120	1396380	means that we're measuring the voltage not based on the raw voltage values of the lines,
1396380	1401180	but by the difference between the voltages. So here, when we're trying to transmit the zero,
1401180	1406240	even though we have this interference, the difference between this point and this point
1406860	1413560	is still two volts, right? So we'll still read a zero. The difference between this point and this
1413560	1419360	point is still two volts, right? Even if this goes negative, right, and we have the same interference
1419360	1424680	here because those wires are twisted together, the difference between this low point here and
1424680	1429920	this low point here is still two volts, right? So the idea is by combining differential signaling
1429920	1436940	with twisted pair, you have this very robust system where even if you bombard this cable,
1436940	1442060	this cabling with electromagnetic radiation, you're still likely to get your message across
1442060	1447120	because of the way Canvas is set up. I think this is very clever and it's one of my favorite things
1447120	1453980	about Canvas. So it's always good to talk about this and just appreciate the quality of engineering
1453980	1460360	put into this technology. But onto less common types of Canvas, there's single wire CAN.
1460360	1467100	It is designated as Society Automotive Engineers Standard J2411. It's CAN for applications with
1467100	1473880	incredibly low bandwidth requirements and not as much robustness requirements. And as the name
1473880	1479900	would suggest, it uses only one wire as opposed to high-speed CAN's dual wire. But on that note,
1479900	1486960	it uses 33 kilobits per second as its maximum data rate, so quite a bit slower than high-speed
1486960	1492460	CAN. And it does not use differential signaling, so it's not as robust or resilient to EMI.
1492840	1498800	And the way the signaling works in single wire CAN is more of a raw voltage value reading,
1498800	1504160	right? So you have a much larger differential between the recessive value and the dominant
1504160	1509420	value. So in single wire CAN, zero volts is considered recessive and four volts is considered
1509700	1515660	a dominant bit, right? Low-speed fault-tolerant CAN, the importance of introducing single wire
1515660	1521860	CAN is that you understand that low-speed fault-tolerant CAN exists as a way to
1524020	1528200	increase the reliability of high-speed CAN, right? Even if you thought high-speed CAN was
1528200	1533740	incredibly reliable and robust from the description I just gave of it, there's still
1533740	1537620	more that can be done. So the way low-speed fault-tolerant CAN works is it does a couple of
1537620	1543640	things. It actually divides the termination on the bus amongst the nodes, right? So if you remember
1543640	1549940	in the... let's just go back a second to the slide where I showed the high-speed CAN bus, right? You
1549940	1555660	have 120 ohms here and 120 ohms here, right? These two 120 ohm resistors in parallel come out to be
1555660	1561060	60 ohms, right? But these become more or less single points of failure. You remove one of these and
1561060	1567120	your bus doesn't work anymore. But in fault-tolerant CAN, right? Low-speed fault-tolerant CAN, you
1567120	1574040	distribute the resistors along the nodes on the bus to actually give the opportunity for the bus
1574040	1578180	to keep working even if one of these nodes gets removed. Even if one of these resistors gets
1578180	1585100	removed, you still have enough resistance on the bus for CAN bus to work properly, right? It also
1585100	1593360	has higher voltage differentials to keep things from getting too... it's just more robustness
1593360	1598560	just in case there's, you know, an especially large amount of EMI interference, right? CAN high gets
1598560	1603900	driven to 5 volts and CAN low gets driven to zero volts in the event of a dominant bit
1603900	1610560	transmission, right? And then another fault-tolerance feature included is that if a wire is damaged,
1610560	1617320	then LSFT can actually switch over to single-wire CAN operation, right? But at the cost of this is
1617320	1621680	that it's, you know, more expensive to implement and the maximum data rate you can get with this
1621680	1627380	kind of implementation is only 125 kilobits per second. And for those reasons, it's not
1627380	1632940	very commonly seen but it does exist and I figured I'd share, you know, knowledge of its existence
1632940	1639060	with you guys today. So just to summarize, where CAN is used, right? Instrument clusters, component
1639060	1646180	control, HVAC, so your car's, you know, climate control, etc. Headlights, brake lights, window status,
1646180	1652240	GPS, diagnostic information, so much more, right? GPS, I mean, like the CAN bus will carry GPS data
1652240	1658340	to share with other parts of the vehicle. Your CAN bus isn't generating GPS data, you're getting that
1658340	1663740	from a satellite, but you already knew that, right? So the point is CAN bus is truly the main character
1663740	1668960	of in-vehicle network technologies. It has the most applications and it is also, I would say,
1668960	1673400	the easiest in-vehicle network technology to begin to learn how to use because there are lots of
1673400	1678720	open source, freely available software tools that you don't even need any hardware, really, to get
1678720	1683460	started to learn how to use a CAN bus, right? They have visualization software available that you can
1683460	1689140	use if you wanted to get started, but that's not what this talk is about. But it's truly, truly
1689140	1693440	the coolest in-vehicle network, I believe, and I don't think it's ever going to be phased out, no
1693440	1698000	matter what anyone tells you. But moving on, the next one we're going to talk about is LIN. LIN
1698000	1703180	stands for local interconnect network. It's kind of like CAN bus's little brother, right? It was
1703180	1708080	actually created after CAN bus, despite having much lower specs from a technical perspective,
1708080	1713260	and it was made to take the place of CAN bus for low bandwidth applications that didn't require
1713260	1718640	the same grade of reliability and robustness that CAN offered, right? Like CAN is pretty
1718640	1722840	cheap as far as in-vehicle network technologies go, but you can always go cheaper, right? So for
1722840	1729140	things like your, you know, very... I'll say some examples later, but very low speed, very low
1729140	1734120	bandwidth applications, LIN bus will usually do the trick, right? And it's also a uniform standard
1734120	1741740	for improved compatibility across manufacturers. It runs on basic... you can actually program a
1741740	1747780	basic UART transceiver to work with LIN, right? It utilizes a bus topology and it's a broadcast
1747780	1752600	serial network with a master-slave architecture, supports up to 16 nodes, right? So it's much
1752600	1758380	simpler in its design compared to CAN, but like I said, it has its place in the industry because
1758380	1766460	sometimes you don't need any more than those very basic capabilities. So LIN also uses a
1766460	1771420	single wire, similar to single wired CAN, and it only communicates at 20 kilobits per second, so
1771420	1776640	it's even slower than single wired CAN, right? But it has guaranteed latency on its transmissions
1776640	1781880	because it utilizes a scheduling table where the master will periodically pull slave nodes for
1781880	1790860	their data, right? And it includes data checks on error detection for basic error handling,
1790860	1795540	right? As you'd expect of something used in automotive, right? It even has that, you know, bare
1795540	1801900	minimum robustness included into it. And like I mentioned just previously, the transmission is
1801900	1807600	done according to a scheduling table, and here I have a quick diagram showing how a transmission
1807600	1813200	will go. So normally you'll have one device on the bus considered the master device, and that
1813200	1821120	master has a schedule according to which it will send out this master header frame, which kind of
1821120	1828140	includes, you know, it'll essentially say like, hey, I want this data, right? According to this
1828140	1833500	identifier. And then the corresponding slave node that has the data associated with the identifier
1833500	1838680	will then fill in the rest of that data, right? The slave node will then begin to transmit from
1838680	1843480	this point, right, after this response space. And on the bus, the way that messages appear
1843480	1848860	is as one lin message, but it's actually half transmitted by the master and half by the slave,
1848860	1855320	right? So this is all part of a automated sequence where the master header, or the,
1855320	1861440	sorry, the master node will send out these requests periodically for data updates,
1861440	1866740	and the slave nodes will respond in churn as they're pulled, right? So it's pretty simple,
1866740	1872720	but it's pretty effective. You'll actually see Linbus used in things like, if you have
1872720	1878180	powered seats in your car, right? You know, the ability to relax your, you know, your lumbar
1878180	1885680	support, right? Kind of the motorized seat control, right, for comfort. That's usually done
1885680	1893500	in Linbus. Other things of very low importance, I'd say probably moving your mirrors, right, that
1893500	1899520	might be dedicated to Linbus. Anything that you can see as being not incredibly important in a
1899520	1905860	real-time high-speed driving situation, there's a chance it could be dedicated to Linbus. So it's
1905860	1909940	always good to know that Linbus exists, even if it is kind of a small-time player in the automotive
1909940	1915860	sector. So talking about some of the bigger boys, the more newer in-vehicle network technologies,
1915860	1920760	the more recent ones with higher specs, we get to FlexRay. It's high-bandwidth, high-reliability
1920760	1926500	communication, and it's developed for applications where CAN isn't appropriate or fast enough,
1926500	1931340	right? So FlexRay is kind of like a next-gen in-vehicle network. It uses two communication
1931340	1937840	channels between each node, and it uses differential signaling like CAN, but it actually has two
1938440	1943640	channels, an A and a B channel, so you have four wires per connection, right? So it adds
1943640	1950460	redundancy, but it also makes it a pretty expensive protocol to implement, right? But that's kind of
1950460	1956540	how it goes, right? If you want to add more speed, more functionality, you need to make things a
1956540	1961940	little bit more expensive, just because that's how the world works, right? FlexRay payloads support
1961940	1970460	up to 254 bytes in size, and FlexRay is commonly used in X-by-wire systems, right? So because of
1970460	1975920	its high speed, because of its robustness, you know, in a similar vein to that of CAN bus,
1975920	1981200	you're able to use it for things like direct control of throttle, direct control of steering,
1981200	1986380	and direct control of braking, right? The theoretical maximum data rate is about 10
1986380	1991060	megabits per second, so about 10 times as much as CAN's theoretical maximum speed,
1991060	1996540	but since it's a proprietary protocol, it is a little bit more expensive and also a little bit
1996540	2001820	more complicated, especially for the car hacking crowd. It's not as easy to get tools that can work
2001820	2008580	with FlexRay, especially if you're just starting and you don't have a, you know, a wealthy industry
2008580	2013680	supporter providing you with industry-grade tools. It can be hard to get involved with FlexRay just
2013680	2020600	because of how complex it is, right? But moving on, so I'm going to talk about another next-gen
2020600	2027160	vehicle network technology is CAN FD. So CAN FD, the FD stands for flexible data rate. It's the
2027160	2033920	evolution, quote-unquote, of traditional CAN bus, right? It retains many, if not all of the features
2033920	2041800	of classic CAN, right? And this is, it was kept that way because of the success CAN had in the
2041800	2045620	industry, right? It worked really well, we're still using it today even though it's over 30 years old
2045620	2052220	now, I think, yeah, about 30 years old, but it does its job so well there's no real reason to
2052220	2058920	phase it out. But if you wanted to be able to add higher, you know, if you wanted to be able to use
2058920	2063660	CAN in applications where its basic data rate wasn't appropriate, you would need some kind of
2063660	2071180	evolution for that, and CAN FD is the manifestation of that desire, right? So the flexible data rate
2071180	2076660	is achieved by increasing the rate of transfer of the data portion of a CAN message
2076660	2083560	after the message arbitration has been completed, right? And this is just a reality of things, it's
2083560	2089720	due to some issues with classical CAN controllers, some of them will flag CAN FD messages as errors,
2089720	2096100	so it has a bit of backwards compatibility issues. Sorry, I'm trying to talk
2096580	2102200	a little bit faster than I should, I'll slow down a little bit. But CAN FD payloads can
2102200	2109240	range from 8 bytes of data to 64 bytes, which means it transmits 64 bytes in the same time
2109240	2116280	it takes classic CAN to transmit 8 bytes, right? So the theoretical maximum speed of CAN FD is
2116280	2122420	going to be about 8 megabits per second, but in reality, because you only speed up the data
2123060	2128680	field portion of a CAN FD message, the real-time practical throughput is about 6 times that of
2128680	2134540	CAN bus, so about 6, maybe 7 megabits per second at absolute maximum, right? Because you have to
2134540	2142180	keep the overhead and so on the same speed in order to keep cable lengths feasible, cable lengths
2142180	2146200	appropriate, and for, you know, backwards compatibility, especially if you have nodes that
2146200	2151240	are equipped to experience CAN FD messages but aren't really CAN FD nodes themselves, you know,
2151240	2156260	there's kind of like a gray material, gray material, gray zone for that, right? But the
2156840	2161560	maximum data rates, according to estimates, will vary. Some people will say it can go as high as
2161560	2169200	10 megabits, but, you know, more, less optimistic estimates settle around the 5 to 7 megabit marker.
2169680	2175880	So moving on, MOST is the Media Oriented Systems Transport. It's optimized for in-vehicle media
2175880	2182540	systems, so it's very, very high speed, uses a daisy chain topology, the ring topology that I
2182540	2190720	showed earlier, right? And it's, it uses a master device for timing that manages communications,
2190720	2197240	and MOST is one of the first in-vehicle networks to support optical fiber physical layer, making
2197240	2201560	it more or less impervious to electromagnetic interference. MOST has never been used for
2201560	2206340	like critical vehicle control, right? I mentioned that it's optimized for in-vehicle media systems,
2206340	2212860	and that's why it has such a high frequency, right? High frequency, high bandwidth, right? Because you
2212860	2218620	need to be able to process things like video, process things like audio data, process, you know,
2218620	2222940	anything that's going to be used by a media console is probably going to be very high quality data
2223680	2228200	if you want it to be, you know, competitive in the market today, right? I'm kind of a quality
2228200	2233700	buff myself when it comes to watching anything on a screen. But it comes in a couple of flavors,
2233700	2239700	right? MOST 25, 50, and 150, right? Each of these corresponding to the actual speed, and each one of
2239700	2244520	them has shown to be applicable to different physical mediums, right? To the best of my
2244520	2250220	knowledge, MOST 25 was only implemented on fiber, and then 50 and 150 can be used on fiber or
2250920	2258700	optical fiber or copper. And then there was also... it was also a candidate for implementation of
2258700	2265680	Ethernet in automobiles, right? The way MOST was set up. But speaking of Ethernet,
2265680	2271640	automotive Ethernet is kind of like the cool kid on the block, right? The new transfer student that
2271640	2277600	everyone is interested in is automotive Ethernet, right? They're very dynamic, they're
2277600	2283220	very high-powered, and everyone is interested in seeing what they can do, right? It's almost
2283220	2288680	traditional to Ethernet used in computers and traditional network infrastructure, but it uses
2288860	2293160	a different physical, you know, physical layer, right? I believe it only uses two wires as opposed
2293160	2298880	to most traditional Ethernet connections is four wires for data transfer, but don't quote me on
2298880	2304480	that. I wouldn't call myself an automotive Ethernet expert per se, just because it's not actually
2304480	2309160	found in that many cars yet, right? It's hard to do a lot of research on something that's not really
2309160	2314100	in the industry yet. But unlike some of the other networks we talked about today, Ethernet is
2314100	2319180	point-to-point, which makes it a little bit harder to scale to more nodes because you need to add a
2319180	2324320	lot more hardware, right? But it has incredibly high bandwidth potential, which is especially
2324700	2329780	attractive if you're talking about autonomous cars, you know, fusing data from tons of different
2329780	2335400	sensors and processing all of that data for real-time decision-making on the road, right?
2335940	2340800	Some more details about automotive Ethernet. Your traditional RJ45 connector isn't really
2340800	2346020	appropriate for an automotive environment. It's not resistant enough to vibrations to stay
2346020	2351160	connected without deteriorating very quickly. So there are a lot of different physical connectors
2351160	2355100	that have been, you know, made by different vendors, but I wouldn't say there's an industry
2355100	2359480	standard that's been established yet. But some of the more common ones include Broadcom's
2360240	2366360	BroadReach type, right? That's a decently common automotive Ethernet connector type as far as
2366360	2371060	connectors go. But anyway, about, you know, the important thing, the data rates, they can
2371060	2376580	reach as high as 10 gigabits per second. I don't know why I wrote 10G megabits per second here.
2376580	2383460	That doesn't actually mean anything. Typo on my part, but please forgive my ignorance, I suppose.
2383460	2387760	But it is an expensive technology to implement, especially with how new it is.
2387760	2392560	And so there isn't... there's a case to be made that you shouldn't always use Ethernet just because
2392560	2399080	you can. And looking at this chart that shows a comparison of the different data rates, right,
2399080	2405780	Ethernet is quite, you know, easily winning the race, right? This is a logarithmic scale, so you
2405780	2412320	can see we go from 1 to 10 to 100 all the way up to 1 million kilobits per second, right? These other
2412320	2418100	technologies don't even compare to the speed Ethernet can put out. But at the end of the day,
2418100	2425060	do you need this much speed for most of your applications? And the answer is no, right? Like,
2425060	2428420	why don't we just use Ethernet for everything now that we've figured out how to use it? Isn't it
2428420	2434120	just going to save, you know, save in-vehicle networking, right? No more thinking about what
2434120	2438980	technology to use, just use Ethernet. Well, no, right? It's expensive to implement. It's new to
2438980	2447540	the automotive domain, so there's no, like, proven use for it as the only in-vehicle network you need,
2447540	2451740	right? It requires more hardware, thanks to the fact that you might need switching hardware in
2451740	2458180	place to actually do the addressing, you know, at a higher level, especially if you want to implement
2458180	2466220	TCP or IP into your TCP IP in your vehicle, which increases the point of failure relative to,
2466220	2470620	you know, that one switch being a single point of failure for the entire network, so on and so forth,
2470620	2477380	right? And the real important thing here at the end of the day is the cost argument. It's
2477380	2481920	not necessary to have that much bandwidth all the time, right? The old saying, why use a fire hose
2481920	2489140	where a squirt gun will suffice, right? It's truly a case of knowing how much data you need,
2489140	2495060	how fast of a, you know, connection you need between these two ECUs. Is it really worth it
2495060	2500360	to invest in an Ethernet implementation if that means you have to increase the processing power
2500360	2505480	on each of those ECUs as well, right? Because CAN bus, for example, is much simpler to
2505480	2510420	implement than Ethernet and doesn't require as much processing power on the ECUs, so you can use
2510420	2515080	slightly lower grade ECUs for a CAN bus connection than you would for an Ethernet
2515080	2520700	connection, right? There's a lot of reasons to choose a more optimal solution when it comes to
2520700	2529440	lower bandwidth requirement applications, right? So that about wraps up my talk. I don't have any
2529440	2534980	more cute diagrams or clever things to say, so thank you all for listening. I hope you were able
2534980	2539520	to learn something about in-vehicle network technologies and how they're used in the
2539520	2544360	automotive industry. My email address is listed below. You're welcome to send me an email if you
2544360	2551080	have any questions, and yeah, I hope you enjoy the rest of the Car Hacking Village, and I will
2551080	2553200	be signing off now. Thank you very much!