When Is CAN the Weakest Link? A Bound on Failures-in-Time in CAN-Based Real-Time Systems