1. Physical Layer Architecture & Galvanic Transceiver Isolation

The physical CAN layer utilizes balanced differential signaling across a twisted wire pair: CAN_H (CAN High) and CAN_L (CAN Low). Signal states are defined by differential voltage:

• Recessive State (Logical 1): Both lines idle at approximately 2.5V ($V_{diff} approx 0V$). Any node transmitting a dominant bit overrides a recessive state.
• Dominant State (Logical 0): CAN_H is driven to 3.5V while CAN_L is pulled down to 1.5V ($V_{diff} approx 2.0V$). Dominant bits resolve message arbitration collisions non-destructively based on message ID priority.

The bus terminates at both physical cable ends with exact 120-ohm resistors to prevent high-frequency signal reflections. In commercial gateways, transceivers like the TI ISO1042 or NXP TJA1051 provide galvanic isolation barriers rated up to 5,000 $V_{RMS}$, shielding gateway processors from destructive alternator load dumps (ISO 7637-2 transients) and chassis ground loops.

2. Linux SocketCAN Architecture & Kernel Configuration

Rather than treating serial CAN controllers via proprietary character devices, Linux treats CAN hardware as first-class network interfaces using the SocketCAN subsystem. Configuration executes directly via standard iproute2 commands:

# Configure can0 interface for 500 kbps with automatic bus-off restart
sudo ip link set can0 type can bitrate 500000 restart-ms 100

# Enable listen-only mode for passive eavesdropping / telematics
sudo ip link set can0 type can listen-only on

# Bring interface up
sudo ip link set can0 up

# Inspect interface statistics and error frames
ip -details -statistics link show can0

In gateway firmware, C/C++ services open raw CAN sockets and apply hardware-assisted kernel filters to discard irrelevant traffic before it reaches user space, reducing CPU utilization by over 70%:

int s = socket(PF_CAN, SOCK_RAW, CAN_RAW);

// Set filter for J1939 EEC1 engine data (PGN 0xF004)
struct can_filter rfilter[1];
rfilter[0].can_id   = 0x0CF00400;
rfilter[0].can_mask = 0x00FFFF00;
setsockopt(s, SOL_CAN_RAW, CAN_RAW_FILTER, &rfilter, sizeof(rfilter));

// Read incoming frame
struct can_frame frame;
int nbytes = read(s, &frame, sizeof(struct can_frame));

3. SAE J1939 Protocol Decoding: PGNs and SPNs

In heavy commercial vehicles (Class 7/8 trucks, agricultural machinery), messages follow the SAE J1939 standard using extended 29-bit CAN identifiers:

The middle 18 bits define the Parameter Group Number (PGN). Individual data fields within the 8-byte payload are designated as Suspect Parameter Numbers (SPNs):

4. Automotive Network Protocol Comparison

5. Key Engineering Invariants & Functional Safety

• Bus-Off Auto-Recovery Policy: When electrical interference generates severe transmit error counts (TEC > 255), the CAN controller enters the Bus-Off state. Linux network daemons must configure kernel auto-recovery (restart-ms 100) to prevent the telemetry gateway from remaining permanently disabled after temporary wiring disconnects.
• Strict Read-Only Enforcement on Diagnostic Ports: Aftermarket telematics gateways connected to the in-cabin OBD-II J1962 port must enforce hardware-level listen-only operation. Injecting unauthorized frames onto vehicle body buses can activate diagnostic test modes, disable airbags, or trigger emergency braking.
• Power Management & Wake-Up on CAN: Parked vehicle gateways must draw minimal current ($< 200 mu A$) to avoid battery drain. Transceivers support low-power standby modes with wake-up pin (WAKE / INH) interrupts that alert the gateway processor upon detecting CAN bus traffic when the vehicle ignition activates.

6. OBD-II Diagnostic PID Request Architecture & ISO 15765-2 Flow Control

While commercial SAE J1939 buses broadcast engine parameters cyclically without external prompts, light-duty passenger vehicles (using standard OBD-II) require an active request-and-response protocol. The telematics edge gateway sends functional query frames to the standard 11-bit CAN identifier 0x7DF and listens for ECU responses on identifiers 0x7E8 through 0x7EF.

Each OBD-II request specifies the Service Mode and the Parameter ID (PID). For example, querying Mode 01 PID 0x0D requests vehicle speed, while PID 0x0C requests engine RPM. When diagnostic data exceeds the standard 8-byte CAN frame (such as reading multi-byte Diagnostic Trouble Codes or vehicle VIN strings), the system switches to the ISO 15765-2 (ISO-TP) transport layer:

• Single Frame (SF): Carries payloads up to 7 bytes, indicated by Protocol Control Information (PCI) type 0x0 in the upper nibble of byte 0.
• First Frame (FF): Sent by the responding ECU when the payload exceeds 7 bytes, carrying the total payload length across 12 bits (PCI type 0x1).
• Flow Control (FC): Transmitted back by the gateway to indicate read readiness, block size (BS), and separation minimum time (STmin) in milliseconds before the ECU may proceed.
• Consecutive Frames (CF): Streamed sequentially by the ECU with rolling sequence numbers (0 to 15) until all diagnostic bytes are completely assembled.

Implementing robust ISO-TP state machines prevents gateway buffers from overflowing during intensive diagnostic scans while protecting automotive bus arbitration from message congestion.