The CAN buses are primarily separate to
- manage congestion
- reduce regulatory concerns over safety-critical systems
- exert more control over who can access the various buses
Simple vehicles will have two CAN buses, one for the engine and safety systems, and one for body controls (lighting, user experience, etc).
Complex vehicles will have a separate bus for systems affecting vehicle motion, for instance radar assisted cruise control, parking systems, lane guidance, etc, as well as additional systems for user features beyond simple body controls, such as in vehicle entertainment systems.
While the buses could be shared, there are a few reasons not to do so:
Congestion
Even high speed CAN buses don't have unlimited badnwidth, and in fact compared to modern communications systems they are very slow. However there is still a lot of data they must carry, and most of it is time critical, so maintaining a low utilization allows messages to be delivered more quickly (fewer collisions) which means that real-time messages arrive on time, rather than late.
Testing
Safety critical systems are often separate from other systems so that testing is reduced. All the devices attached to the safety critical bus must have a higher standard of operation and therefore testing in order to be certain they won't cause a problem on a safety critical bus. With a separate body bus you can have slightly lower standards since an outage won't cause a safety issue, therefore testing is reduced.
Rather than combining everything on one bus and making sure everything is up to the higher standards, separate buses allow the designers to segment the bus and reduce costs.
Industry regulations are difficult, particularly since throttle issues and other drive-by-wire problems the industry has experienced in the past. By keeping critical systems separate from non critical systems, finding out what went wrong after the fact, and resolving it becomes much easier, as well as less likely since there are fewer devices that could interfere with the correct operation of the safety system.
Control
Once modders found that they could alter the engine management and other computers through a single interface, vehicle manufacturers have worked to separate the diagnostic connector and its bus from the rest of the vehicle buses, and use a gateway to pass only those messages that they permit user and garage access to. They do usually have additional features permitting their own technician access, and many even add another bus to the diagnostic connector, but without publishing message details, so they can have higher speed access while still maintaining backwards compatibility with diagnostic emissions regulations.
Separating the buses, however, allows them to exert a little more control over who has easy access to the onboard computers using the simple diagnostics connector.
Additional Complexity
The complexity introduced by additional buses is handled by a gateway controller. In some vehicles this is the body controller, and often has other bus connections, such as LIN. This passes messages between buses so that when a diagnostic device is connected, for instance, the device can access all the relevant diagnostic information throughout the vehicle.
