There are a number of questions on the CAN bus but none (so far as I can tell) that explain why there are several CAN buses in a vehicle. From what I understand many different nodes can be connected to a single CAN bus, so I am not sure why you would need more than one. My only thoughts are that:

A. there is a fairly small limit to how many nodes can be attached to a single CAN bus. But if that is the case I would imagine there must be some inter-CAN connection so that arbitration and error checking can occur (CAN SPEC 2.0).

-- or --

B. Nodes are prioritized as primary, secondary, and tertiary systems and each level has their own CAN bus and these levels only contain devices that are independent of each other in terms of functionality. I.E. brakes, engine control, exterior lights, locks are on the primary bus. Radio, AC, seat control, are on the secondary bus etc etc.

If anyone could explain/clarify I would really appreciate it. Thanks in advance.

  • 1
    I admittedly don't know much about this, but I thought there was only one bus since there is only one connection - the OBDII port. How are the separate buses addressed? What makes them separate?
    – JPhi1618
    Commented Feb 16, 2016 at 19:36
  • @JPhi1618 Honestly I don't know that much myself, that's why I am asking around. I was discussing with a peer vehicle security via the CAN bus after he got back from a Hackathon event where it was brought up and we found number of individuals mentioning that most vehicles had multiple CAN buses. I agree that the only connection I know of is the OBDII port. There are several posts here where people have mentioned there are multiple. (mechanics.stackexchange.com/questions/8559/obd2-and-can-bus - am6sigma mentions it in the answer).
    – Moeman69
    Commented Feb 16, 2016 at 19:43
  • Found this discussion that says: To request data you need to handshake with the CAN Gateway, negotiate connection settings, request a set of data from a particular CAN device and read the data that is returned. With the right requests you can access data from any of the 3 busses from the one connection - so your CBT can request RPM from the Engine controller, Odometer from the Instrument Cluster, Window Position from the Front Right Door controller etc. So it looks like a "gateway" is the key.
    – JPhi1618
    Commented Feb 16, 2016 at 19:48
  • @JPhi1618 Ahh thank you. I never saw that page. It also looks like my thought B was sort of correct in that instruments are connected in clusters to different buses. However the CAN gateway seems to be unique to VW vehicles and not necessarily a standard. I can only imagine that other vehicles have a similar device and setup but that is purely speculation. I wish I could PM people since there people like I mentioned who seem to have first hand knowledge of multiple buses.
    – Moeman69
    Commented Feb 16, 2016 at 20:04

3 Answers 3


The CAN buses are primarily separate to

  • manage congestion
  • reduce regulatory concerns over safety-critical systems
  • exert more control over who can access the various buses

Simple vehicles will have two CAN buses, one for the engine and safety systems, and one for body controls (lighting, user experience, etc).

Complex vehicles will have a separate bus for systems affecting vehicle motion, for instance radar assisted cruise control, parking systems, lane guidance, etc, as well as additional systems for user features beyond simple body controls, such as in vehicle entertainment systems.

While the buses could be shared, there are a few reasons not to do so:


Even high speed CAN buses don't have unlimited badnwidth, and in fact compared to modern communications systems they are very slow. However there is still a lot of data they must carry, and most of it is time critical, so maintaining a low utilization allows messages to be delivered more quickly (fewer collisions) which means that real-time messages arrive on time, rather than late.


Safety critical systems are often separate from other systems so that testing is reduced. All the devices attached to the safety critical bus must have a higher standard of operation and therefore testing in order to be certain they won't cause a problem on a safety critical bus. With a separate body bus you can have slightly lower standards since an outage won't cause a safety issue, therefore testing is reduced.

Rather than combining everything on one bus and making sure everything is up to the higher standards, separate buses allow the designers to segment the bus and reduce costs.

Industry regulations are difficult, particularly since throttle issues and other drive-by-wire problems the industry has experienced in the past. By keeping critical systems separate from non critical systems, finding out what went wrong after the fact, and resolving it becomes much easier, as well as less likely since there are fewer devices that could interfere with the correct operation of the safety system.


Once modders found that they could alter the engine management and other computers through a single interface, vehicle manufacturers have worked to separate the diagnostic connector and its bus from the rest of the vehicle buses, and use a gateway to pass only those messages that they permit user and garage access to. They do usually have additional features permitting their own technician access, and many even add another bus to the diagnostic connector, but without publishing message details, so they can have higher speed access while still maintaining backwards compatibility with diagnostic emissions regulations.

Separating the buses, however, allows them to exert a little more control over who has easy access to the onboard computers using the simple diagnostics connector.

Additional Complexity

The complexity introduced by additional buses is handled by a gateway controller. In some vehicles this is the body controller, and often has other bus connections, such as LIN. This passes messages between buses so that when a diagnostic device is connected, for instance, the device can access all the relevant diagnostic information throughout the vehicle.

  • 1
    I agree with your points but would stress "Safety" more than "Testing". The safety critical controllers are isolated from the other ones by the gateway which filters and restricts the communication between the busses to a defined subset. The DVD player should not be able to control the breaks or airbags (after you hijack it with a well-crafted USB stick) or accidentally compromise their CAN bus, logically or electrically. The strategy is the same as for any LAN with mission critical servers which you wouldn't expose to the internet. Testing only goes so far; isolation is fool proof. Commented Feb 17, 2016 at 8:47
  • @PeterA.Schneider I don't disagree with you, but I worked on the body module for model year '09 large ford vehicles, and while the desired outcome may have been increased or verifiable safety, the evidence was testing, and in the case of this module reducing the time to test. The reality is that testing a single complex module alone can take months in all its internal permutations, and testing a single complete vehicle bus years. This can be paralleled to a degree with significant cost, but even a few weeks is unacceptable. Separating the buses allows simpler, faster testing.
    – Adam Davis
    Commented Feb 17, 2016 at 12:50
  • @PeterA.Schneider This allows the modules and buses to be more completely tested, which does increase safety, but the primary goal was to reduce development time while maintaining a certain standard of safety - not to increase safety. The way the modules are designed and the message passing is designed, there's little possibility that a re-flashed DVD player on the engine bus could cause a problem. The hardware that connects the bus prevents DOS attack at the silicon level, and the microcontrollers that connect to this hardware is not programmable via software.
    – Adam Davis
    Commented Feb 17, 2016 at 12:53
  • @PeterA.Schneider Perhaps this may be semantics, or a distinction without a difference, but if the manufacturer demanded a single bus, the systems can be designed with the same level of safety that exist in separate buses. The development time is the only thing that would really suffer. Fortunately the additional cost of separate buses is low, otherwise we would be designing for a single bus if the cost of separate buses was too large.
    – Adam Davis
    Commented Feb 17, 2016 at 12:56

When talking specifically about CAN the answer is none of the above.

In a CAN system the nodes do not talk directly to each other, instead the system is message based. Every message has a priority based on its address and that determines who gets to talk. Who ever has the priority message transmits the message to all and who ever needs it reads it in.

There are some limits to how many nodes can be had but that limit is electrical and not a function of the actual bus.

The reason is that high speed CAN is very complicated electrically due to its speed. (I can go on about transmission lines, signal integrity, stubs and termination but this is way beyond what this answer needs) This makes the design complicated and the modules that use it more expensive. Further not everything needs the break neck speed of high speed CAN. The CAN bus system is usually broken down into three buses, low speed, medium speed and high speed.

  • High speed CAN connects all the important systems. Engine, ABS, Air Bag, Transmission, Body. The Body computer then serves as the gateway between the other buses.
  • Medium speed CAN is usually used for car functions like exterior lighting, power locks, power mirrors etc.
  • Low speed CAN picks up the rest of the non critical systems. These can include interior lighting, entertainment etc.

As mentioned previously the CAN bus uses message addresses instead of node addresses. For example, vehicle speed would be a message. This message gets transmitted by the ABS unit and has a fairly high priority. The Engine, Air Bag, Transmission and Body are all interested in the message and read it in. After receiving the message the Body retransmits the message over the other buses. The lower speed buses usually don't need updates as frequent as the highs speed bus so the Body only updates them occasionally.

If a module needs information that is not commonly transmitted a module can request information. The design of the bus is such that when data is requested the module that has the information only knows that the information is needed and not who needs the information.

The gateway does not have to be the Body, it could be the Instrument Cluster or some other computer.

  • Thanks for the solid answer. I am pretty well familiar with the CAN messages and message arbitration. I guess the question I am really looking for is are messages on one CAN (say the low speed non critical CAN) seen by nodes connected on another CAN (like the high speed critical systems CAN)? I would imagine that the system could operate perfectly fine if all devices were connected to a single CAN as the arbitration system would inherently handle message priority. Or even if the different CAN's were connected together. Is it solely a matter of necessity and expense that they're separate?
    – Moeman69
    Commented Feb 16, 2016 at 20:12
  • @Moeman69 Yes. There could be over a hundred different nodes in a car. Equipping them all with high speed CAN would be cost prohibitive. It would also congest the bus and give much more failure points in the critical system.
    – vini_i
    Commented Feb 16, 2016 at 20:18

One of the reasons is nicely summed up in this cartoon from 2003:

enter image description here

("New device found: Airbus A310. Start auto configuration? [Start][Cancel]")

Similar attacks have indeed been reported recently. Having the safety critical components on a separate bus which is only accessible through a well-configured gateway greatly reduces the likelihood of inadvertent problems like the one above, and makes hacking much harder.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .