CAN Frame Layout and Why Bit Stuffing Is Mandatory

CAN is designed for a bus that several nodes share, with no master, no clock wire, and no addressing in the sense that a target device is named. A frame carries an identifier that says what the data means, not who should receive it, and any node may begin transmitting when the bus is idle. Two nodes may therefore begin in the same bit time, and the protocol has to resolve that without losing bits, which it does with the same wired-AND arbitration that open-drain buses use, applied to a differential pair.

The frame structure follows from that requirement plus a second one: every receiver must maintain bit synchronisation for the entire frame, including during long runs of identical bits, because there is no clock wire and no way to re-synchronise mid-frame.

The fields and what each one is for

A classical CAN data frame in standard format has seven fields.

The start-of-frame bit is a single dominant bit that marks the beginning and lets every receiver align its bit timing on that edge.

The arbitration field holds an eleven-bit identifier plus the remote transmission request bit. The identifier is the priority: a lower numeric value wins arbitration because dominant is the zero state, so a frame with identifier 0x100 always beats a frame with identifier 0x200 that starts at the same time. The remote request bit distinguishes a data frame from a request for data with the same identifier.

The control field holds four bits of data length, the identifier extension flag, and a reserved bit. The four-bit length field caps the payload at eight bytes in classical CAN, and values above eight are interpreted as eight.

The data field holds zero to eight bytes.

The cyclic redundancy check field is fifteen bits, computed over the start bit, the arbitration field, the control field, and the data field, followed by a single recessive delimiter bit.

The acknowledge field is two bits. Every receiver that accepts the frame without error drives the first bit dominant during this slot, and the transmitter reads it back. The transmitter therefore learns that at least one node received the frame, but not which one and not how many.

The end-of-frame field is seven recessive bits, and it is followed by at least three recessive bits of intermission before the bus is considered idle again.

The extended format inserts a second arbitration field: a substitute remote request bit, an identifier extension bit, and an eighteen-bit extension of the identifier. The total identifier becomes twenty-nine bits. Both formats coexist on the same bus, and a standard frame beats an extended frame with the same eleven-bit base identifier, because the bit that follows the base identifier is the dominant remote request bit in the standard frame and the always-recessive substitute remote request bit in the extended one. This is deliberate: a node that only understands standard frames can still win the bus against extended traffic with the same base identifier, provided identifiers are assigned so that standard frames need the priority.

Bit stuffing, and the reason it cannot be optional

A receiver recovers its bit clock by comparing each incoming edge against its own oscillator and adjusting the sample point. A phase-locked loop can only do that if edges arrive regularly. A frame with a long run of identical bits has no edges, and the receiver’s clock drifts until the sample point moves out of the bit.

CAN solves this by forbidding long runs. After five consecutive bits of the same polarity, the transmitter inserts one bit of the opposite polarity, which is not part of the data. The receiver knows the rule, so it sees the inserted bit as a stuff bit, removes it, and uses the transition to resynchronise. The stuffed bits occupy time on the wire but carry no payload.

The cost is bounded and predictable. In the worst case, a frame of n bits before stuffing expands to n plus n divided by four bits, because every fifth bit forces one extra. A standard data frame with eight data bytes carries forty-four bits of overhead — start bit, eleven identifier bits, remote request bit, the identifier extension and reserved bits with the four-bit length, the fifteen-bit CRC and its delimiter, the two acknowledge bits, and the seven-bit end of frame — plus sixty-four data bits. Before stuffing that is a hundred and eight bits. The stuffable portion — start bit through the CRC sequence — is ninety-eight bits, which can take at most twenty-four stuff bits, so the worst case is a hundred and thirty-two bits on the wire.

The rule has a second purpose beyond synchronisation. Because a stuffed bit is inserted at a known position, any deviation from the expected pattern is an error. A run of six identical bits where five was the maximum is a stuff error, and it is detected immediately, before the CRC is even complete. That gives the receiver a way to reject a corrupted frame early.

The fields that have a fixed pattern — the start of frame, the acknowledge field, the end of frame, the CRC delimiter, and the acknowledge delimiter — are not stuffed. This is deliberate: those fields are defined as fixed sequences of identical bits, and stuffing them would destroy their meaning. Getting this wrong in an implementation — stuffing a field that the specification exempts — produces frames that a conforming receiver rejects, and the error is invisible on a logic analyser unless the analyser decodes stuffing.

Arbitration in detail

When a node transmits a recessive bit and observes a dominant bit on the bus, it has lost arbitration. It stops transmitting and becomes a receiver of the frame that won, without corrupting it. Because the identifier occupies the first bits after the start bit, and because a lower identifier is more dominant, the frame with the numerically lowest identifier wins. Nothing is retransmitted by the loser, and the winner’s frame arrives exactly as if the bus had been free.

The arbitration field includes the remote request bit, so a data frame beats a remote request frame with the same identifier. This ensures that a request cannot preempt the answer to itself.

There is an important limitation. Arbitration resolves contention over the identifier only. If two nodes transmit frames with the same identifier but different data, both win arbitration, both transmit, and the bus ends up with the wired-AND of the two data fields. One node sees an acknowledge and believes its frame was delivered; the other also sees an acknowledge. The payload is a corruption of both. This is why identifier allocation must guarantee uniqueness for frames that can be pending simultaneously from different nodes, and it is a design rule rather than a protocol enforcement.

The error frame is the exception to all of this. Any node that detects an error transmits an error flag, which is six consecutive dominant bits. That deliberately violates the stuffing rule, which is how every other node recognises it as an error rather than as data. The error frame destroys the frame in progress, so a corrupted frame is aborted globally instead of being partially received.

/* dominant is 0, recessive is 1; a node loses when it sends 1 and reads 0 */
static bool can_arbitrate_lost(const uint8_t *id_bits, size_t n)
{
    for (size_t i = 0; i < n; i++) {
        bool tx = id_bits[i] & 1u;
        can_drive(tx);
        bool rx = can_read();
        if (tx && !rx) {               /* sent recessive, bus is dominant */
            can_release();             /* stop driving, become a receiver */
            return true;
        }
    }
    return false;
}

A receiver that has lost arbitration must still track the bit stream and the stuffing, because it now needs to receive the winning frame correctly. The state machine does not restart; it changes role.

Timing, sampling, and the segments of a bit

CAN divides each bit into segments. The synchronisation segment is the initial edge. The propagation segment accounts for the physical delay of the wire and the transceivers, which is why a longer bus forces a slower rate. Phase segment one and phase segment two surround the sample point, which sits between them. Resynchronisation may lengthen phase segment one or shorten phase segment two by an amount bounded by the synchronisation jump width.

The sample point position is expressed as a fraction of the bit, and it is normally chosen late in the bit, around three quarters, so that the signal has had time to settle after the previous edge. A sample point that is too early catches the ringing after an edge; one that is too late leaves no margin before the next edge. The resynchronisation jump width bounds how much the receiver may lengthen or shorten a bit in one correction. It must be large enough to absorb the phase error that accumulates between two resynchronisation edges, and the stuffing rule bounds that gap: no more than five consecutive bits of one polarity, so no more than ten bit times can elapse between edges, which is the number the oscillator tolerance is derived from.

The constraint that ties all of this together is that the propagation delay from the furthest transmitter to the furthest receiver, doubled for the round trip of the arbitration and acknowledge read-back, must fit inside the propagation segment. That is the reason bit rate and bus length trade against each other directly, and it is a property of the physical layer described in differential signalling and bus termination.

The CRC’s blind spot

The fifteen-bit CRC is computed with a specific polynomial and a specific bit ordering, and it detects all single-bit errors, all double-bit errors, all odd numbers of errors, and all bursts of up to fifteen bits. The residual error probability for random corruption is small but not zero, and it is deliberately not zero: the standard’s designers accepted a residual probability rather than paying for a longer check sequence, because the physical layer’s differential signalling and the error frame’s destructive abort already remove most corruption before it reaches the CRC.

The CRC does not cover the acknowledge field or the end-of-frame sequence, and it does not cover the stuff bits themselves, which are removed before the check is computed. An error in a stuff bit position therefore shows up as a stuff error rather than a CRC error, which is why the two mechanisms are complementary rather than redundant.

What happens after an error is detected is a separate mechanism entirely. A node does not simply discard the frame; it increments an error counter, and the counters determine whether the node is allowed to keep participating. That fault confinement behaviour, and the state machine that goes with it, is covered in error counters and fault confinement. The frame layout here is what makes those counters meaningful, because the error types they track — stuff, form, acknowledge, CRC, bit — are each tied to a specific field.