Embedded Systems & CAN Communication Interview Questions & Answers

eMobility Academy — Embedded Systems & CAN Communication interview questions

1. Q1.Why is CAN used in vehicles?

   Fresher

   CAN (Controller Area Network, ISO 11898) is a multi-master serial bus designed by Bosch for automotive use. It uses a differential twisted pair (CAN_H and CAN_L), which gives strong noise immunity in the electrically harsh vehicle environment. It is message-based rather than address-based: every node sees every message and filters by ID. It has non-destructive bitwise arbitration, so the highest-priority message always gets through without collision delay, which gives deterministic latency for critical signals. It has robust error detection (CRC, bit monitoring, stuffing, form and acknowledgement checks) with automatic retransmission and fault confinement. It reduces wiring compared with point-to-point connections, and it is cheap because CAN controllers are built into most automotive microcontrollers.

2. Q2.Explain CAN arbitration.

   Fresher

   CAN uses CSMA with bitwise arbitration. A dominant bit (logic 0) overwrites a recessive bit (logic 1) on the bus. When several nodes start transmitting at the same time, each sends its identifier bit by bit while reading the bus. If a node sends recessive but reads dominant, it knows a higher-priority message is on the bus, so it stops transmitting and becomes a receiver, retrying later. The node with the lowest numerical identifier wins without any data being corrupted, which is why arbitration is non-destructive. Consequently, IDs must be unique per transmitter, and critical messages such as BMS faults or torque commands are assigned low IDs. Arbitration also limits bus length at a given bit rate, because the bit must propagate across the bus within a bit time.

3. Q3.What is the structure of a classical CAN data frame?

   Fresher

   A standard CAN 2.0A frame has: SOF (one dominant bit); an 11-bit identifier; RTR bit (dominant for data frames); IDE bit (dominant for standard frames) and a reserved bit; a 4-bit DLC giving data length; 0 to 8 data bytes; a 15-bit CRC plus a CRC delimiter; an ACK slot that any receiver drives dominant to acknowledge correct reception, plus an ACK delimiter; and EOF of seven recessive bits, followed by interframe space. Extended frames (CAN 2.0B) use a 29-bit identifier, with an SRR bit and IDE recessive. Bit stuffing inserts a complementary bit after five identical consecutive bits, from SOF through the CRC, to keep receivers synchronised.

4. Q4.Why are there 120 Ω resistors on a CAN bus?

   Fresher

   A CAN bus is a transmission line with a characteristic impedance of about 120 Ω. A 120 Ω termination at each end matches that impedance, preventing signal reflections that would corrupt bits at higher speeds, and it also pulls the bus back to the recessive state, since CAN transceivers drive only the dominant state. With the vehicle off, measuring resistance between CAN_H and CAN_L should give about 60 Ω (two 120 Ω in parallel). A reading near 120 Ω means one terminator is missing or a branch is open; a reading near zero means a short. On the scope, recessive has both lines near 2.5 V, while dominant puts CAN_H near 3.5 V and CAN_L near 1.5 V, about 2 V differential.

5. Q5.What is CAN-FD and how is it different from classical CAN?

   Fresher

   CAN-FD (Flexible Data-rate) extends CAN with two main changes. First, payload up to 64 bytes per frame instead of 8. Second, bit rate switching: arbitration happens at a nominal rate such as 500 kbit/s for compatibility and robustness, then the data phase switches to a higher rate, commonly 2 to 5 Mbit/s. New control bits include FDF (marks an FD frame), BRS (bit rate switch) and ESI (error state indicator), and it uses stronger 17- or 21-bit CRCs with stuff-bit counting. Benefits: higher throughput and fewer frames for big data such as cell voltages or firmware flashing. Classical CAN controllers do not understand FD frames and will flag errors, so mixed networks need care.

6. Q6.What is a DBC file?

   Fresher

   A DBC file is a text database, originally from Vector, that describes the messages and signals on a CAN network. For each message it lists the ID, name, length and transmitting node, and for each signal its start bit, length, byte order (Intel little-endian or Motorola big-endian), signed or unsigned, factor and offset to convert raw values to physical units, minimum and maximum, unit, and receivers. It can also contain value tables and attributes such as cycle time. Tools like CANoe, CANalyzer, BusMaster, SavvyCAN and python-can with cantools use DBC files to decode traffic into readable signals, and code generators use them to build pack and unpack functions. Keeping the DBC under version control is basic discipline in integration teams.

7. Q7.What does the volatile keyword do in embedded C?

   Fresher

   volatile tells the compiler that a variable's value can change outside the normal program flow, for example by hardware registers, an interrupt service routine or another thread or DMA, so the compiler must read it from memory on every access and must not optimise reads or writes away or keep it cached in a register. Typical uses are memory-mapped peripheral registers, flags shared between an ISR and the main loop, and variables modified by DMA. It does not make access atomic or provide synchronisation: a 32-bit variable on an 8-bit MCU can still be torn, and read-modify-write sequences still need interrupts disabled or atomic instructions. Interviewers often follow up with exactly that distinction.

8. Q8.What is an RTOS and when would you use one in an EV ECU?

   Fresher

   A real-time operating system schedules tasks so that time-critical work meets its deadlines deterministically. It provides preemptive priority-based scheduling, tasks, queues, semaphores, mutexes and timers. Examples are FreeRTOS, Zephyr, ThreadX and AUTOSAR OS (based on OSEK). Use an RTOS when an ECU has several activities at different rates, for example a BMS measuring cells every 10 ms, running SoC every 100 ms, handling CAN messages, logging and balancing. A bare-metal super loop with interrupts is fine for simple controllers, but the motor control fast loop is usually handled in a high-priority interrupt tied to the PWM regardless of the RTOS. Watch for priority inversion, which mutexes with priority inheritance address.

9. Q9.What is UDS and what are its common services?

   Experienced

   UDS (Unified Diagnostic Services, ISO 14229) is the application-layer protocol used by testers to talk to ECUs. Key services: 0x10 DiagnosticSessionControl (default, programming, extended sessions), 0x11 ECUReset, 0x14 ClearDiagnosticInformation, 0x19 ReadDTCInformation, 0x22 ReadDataByIdentifier and 0x2E WriteDataByIdentifier, 0x27 SecurityAccess (seed and key), 0x28 CommunicationControl, 0x31 RoutineControl, 0x34 / 0x36 / 0x37 RequestDownload, TransferData and RequestTransferExit for flashing, 0x3E TesterPresent and 0x85 ControlDTCSetting. A positive response uses the service ID plus 0x40 (for example 0x62 for 0x22). A negative response is 0x7F, followed by the service ID and an NRC, such as 0x78 responsePending, 0x33 securityAccessDenied or 0x31 requestOutOfRange.

10. Q10.How does ISO-TP (ISO 15765-2) transport long messages over CAN?

    Experienced

    Classical CAN carries at most 8 bytes, but UDS responses can be thousands of bytes, so ISO 15765-2 segments them. A Single Frame carries up to 7 bytes of payload with a length nibble. Longer messages begin with a First Frame containing the total length and the first 6 bytes. The receiver replies with a Flow Control frame specifying block size (how many frames before the next flow control) and STmin (minimum gap between frames). The sender then sends Consecutive Frames with a 4-bit sequence number that wraps from 15 to 0. On CAN-FD, frames carry more data and lengths are extended. In OBD and many OEM implementations, functional requests go to ID 0x7DF and physical ones to 0x7E0 to 0x7E7, with responses at the request ID plus 8.

11. Q11.How is SecurityAccess (0x27) used during ECU flashing?

    Experienced

    Protected operations such as writing calibration data or reprogramming require an unlocked security level. The tester sends 0x27 with an odd sub-function (for example 0x01) to request a seed; the ECU returns a random seed. The tester computes the key using a secret algorithm and sends it with the even sub-function (0x02). If it matches, the ECU unlocks that level; if not, it returns NRC 0x35 invalidKey and, after a set number of failures, 0x36 exceededNumberOfAttempts and a time delay. A typical flashing sequence is: extended session (0x10 03), disable DTC setting and normal communication, programming session (0x10 02), 0x27 unlock, erase via 0x31 RoutineControl, 0x34/0x36/0x37 download, checksum or signature check routine, then 0x11 reset. Modern ECUs add authenticated, signed software.

12. Q12.How does CAN error handling and fault confinement work?

    Experienced

    CAN detects five error types: bit error, stuff error, CRC error, form error and acknowledgement error. On detection, the node transmits an error frame, destroying the current message so it is retransmitted. Each node keeps a transmit error counter (TEC) and receive error counter (REC). Errors increase them (typically by 8 for transmit errors) and successful frames decrease them. A node is error active while both are below 128 and sends active (dominant) error flags; error passive when either exceeds 127, sending only recessive flags so it cannot disrupt the bus; and bus off when TEC exceeds 255, when it stops participating until it sees 128 occurrences of 11 recessive bits and the application allows recovery. Bus-off handling strategy is a common interview topic.

13. Q13.How do you choose the CAN bit timing and sample point?

    Experienced

    A CAN bit is divided into time quanta (tq): the sync segment (one tq), propagation segment, phase segment 1 and phase segment 2. The sample point is between phase 1 and phase 2. The time quantum comes from the CAN clock divided by a prescaler. Automotive practice, guided by CiA and SAE J2284, uses a sample point around 75 to 87.5%, commonly about 80% at 500 kbit/s, so the bit is sampled late enough to allow for propagation delay across the bus but early enough for resynchronisation. The SJW (synchronisation jump width) sets how much a node can adjust timing on edges. All nodes on the bus should use consistent sample points. For CAN-FD, the data phase has its own timing and transmitter delay compensation is needed.

14. Q14.What is ISO 26262 and what are ASIL levels?

    Experienced

    ISO 26262 is the functional safety standard for electrical and electronic systems in road vehicles (2018 edition, 12 parts), adapted from IEC 61508. It defines a safety lifecycle on a V-model: item definition, HARA (hazard analysis and risk assessment), functional and technical safety concepts, hardware and software development, integration, verification and safety validation. In HARA, each hazardous event is rated for Severity (S0 to S3), Exposure (E0 to E4) and Controllability (C0 to C3), which determines an ASIL from A (lowest) to D (highest), or QM where normal quality management suffices. Higher ASILs demand more rigorous methods, independence, diagnostic coverage and hardware metrics such as SPFM, LFM and PMHF. Unintended acceleration or a BMS failing to prevent overcharge typically lands at higher ASILs.

15. Q15.What is AUTOSAR Classic and how is it structured?

    Experienced

    AUTOSAR Classic Platform is a standardised software architecture for deeply embedded ECUs. It has three main layers. The application layer contains software components (SWCs) that communicate through ports and interfaces. The RTE (runtime environment) is generated middleware that connects SWCs to each other and to basic software, making them hardware-independent. The basic software (BSW) splits into the services layer (OS, COM, diagnostics through DCM and DEM, NvM memory, communication and mode management), the ECU abstraction layer, the microcontroller abstraction layer (MCAL) with drivers for ADC, PWM, CAN and so on, plus complex device drivers for special timing needs like motor control. It is configured with tools from Vector, ETAS or Elektrobit. AUTOSAR Adaptive targets high-performance computers with POSIX OS and service-oriented communication such as SOME/IP.

16. Q16.How would you design a firmware update mechanism for an EV controller?

    Experienced

    Use a bootloader in a protected flash region that never gets overwritten in the field. Prefer A/B (dual-bank) partitions so the new image is written to the inactive bank while the old one keeps running; only after the image is fully received, its CRC verified and its cryptographic signature checked against a public key in the bootloader does the bootloader switch banks. On first boot, the new application must confirm health, otherwise the bootloader rolls back. Use UDS-based flashing (0x34, 0x36, 0x37) over CAN or DoIP for service tools, and an over-the-air path through the telematics unit. Define preconditions such as vehicle stationary, enough SoC and 12 V supply, and handle power loss mid-update gracefully. Anti-rollback counters prevent installing older vulnerable versions.

17. Q17.What causes CAN bus-off in a vehicle and how do you debug it?

    Experienced

    Bus-off means a node's transmit error counter exceeded 255, so it kept seeing errors on its own transmissions. Common causes: wrong bit rate or sample point on one node; missing or extra termination (measure about 60 Ω with power off); CAN_H and CAN_L swapped or shorted to each other, to ground or to battery; damaged transceiver; ground offset between ECUs exceeding common-mode range; EMI from inverter switching coupling into the harness; and a node transmitting when it should not, such as a misconfigured ID collision. Debug with a scope on CAN_H, CAN_L and the differential signal, a CAN analyser to see error frames and which node generates them, and by disconnecting nodes one at a time to isolate the culprit.

18. Q18.What is a watchdog timer and how should it be serviced?

    Fresher

    A watchdog timer resets the microcontroller if software fails to service it, or kick it, within a timeout, recovering from hangs, infinite loops or corrupted program flow. Good practice: service the watchdog from one place that confirms all critical tasks have run, rather than from a timer interrupt, which would keep kicking even if the main application is stuck. A windowed watchdog also resets on servicing too early, catching runaway code that kicks too fast. Safety-relevant ECUs often use an external watchdog or a system basis chip with its own clock, independent of the MCU, and perform question-and-answer checks. After a watchdog reset, firmware should log the cause and enter a safe state where appropriate.

More free EV career resources: emobility.academy/career-resources