[{"data":1,"prerenderedAt":336},["Reactive",2],{"kb-nav":3,"kb-doc":96},[4,10,15,20,25,30,35,40,45,50,55,60,65,70,75,81,86,91],{"_path":5,"title":6,"description":7,"part":8,"chapterNumber":9},"/knowledge-base/networks/introduction","Introduction","Overview of the communication networks used in modern vehicles, from LIN to Automotive Ethernet.","Vehicle Networks & Protocols",1,{"_path":11,"title":12,"description":13,"part":8,"chapterNumber":14},"/knowledge-base/networks/vehicle-documentation","Vehicle Documentation","Where to find manufacturer wiring diagrams, J2534 passthrough devices, and the different types of diagrams that are useful when researching a vehicle.",2,{"_path":16,"title":17,"description":18,"part":8,"chapterNumber":19},"/knowledge-base/networks/lin-bus","Local Interconnect Network (LIN)","Local Interconnect Network — a single-wire low-speed bus used as a low-cost alternative to CAN for non-critical body electronics.",3,{"_path":21,"title":22,"description":23,"part":8,"chapterNumber":24},"/knowledge-base/networks/controller-area-network","Controller Area Network (CAN)","ISO 11898 — the differential bus that became the backbone of automotive networking. Frames, bit timing, errors, CAN FD, message contents, and practical attacks.",4,{"_path":26,"title":27,"description":28,"part":8,"chapterNumber":29},"/knowledge-base/networks/flexray","FlexRay","Time-triggered, deterministic automotive bus standardized as ISO 17458, designed for higher speeds and drive-by-wire systems.",5,{"_path":31,"title":32,"description":33,"part":8,"chapterNumber":34},"/knowledge-base/networks/automotive-ethernet","Automotive Ethernet","Automotive variants of Ethernet — 100BASE-T1, 1000BASE-T1, and 10BASE-T1S — built around single twisted-pair cabling and strict EMC requirements.",6,{"_path":36,"title":37,"description":38,"part":8,"chapterNumber":39},"/knowledge-base/networks/secure-onboard-communication","Secure Onboard Communication (SecOC)","AUTOSAR's standard for cryptographic message authentication on in-vehicle networks — freshness values, MAC computation and key management.",7,{"_path":41,"title":6,"description":42,"part":43,"chapterNumber":44},"/knowledge-base/diagnostics/introduction","Overview of automotive diagnostic protocols — ISO-TP, OBD-II, UDS, CCP and XCP — and how they layer on top of CAN.","Diagnostic Protocols",8,{"_path":46,"title":47,"description":48,"part":43,"chapterNumber":49},"/knowledge-base/diagnostics/iso-tp","ISO 15765-2 (ISO-TP)","ISO 15765-2 transport layer for sending diagnostic payloads larger than 8 bytes over CAN — single, first, consecutive and flow-control frames.",9,{"_path":51,"title":52,"description":53,"part":43,"chapterNumber":54},"/knowledge-base/diagnostics/vw-tp20","VW Transport Protocol 2.0 (TP 2.0)","Volkswagen's pre-ISO-TP transport layer for KWP2000 over CAN — channel setup, parameter negotiation, and the data exchange counter scheme.",10,{"_path":56,"title":57,"description":58,"part":43,"chapterNumber":59},"/knowledge-base/diagnostics/obd-ii","On-board diagnostics (OBD-II)","On-Board Diagnostics II — the J1962 connector, signal protocols, service IDs, parameter IDs, and DTC encoding.",11,{"_path":61,"title":62,"description":63,"part":43,"chapterNumber":64},"/knowledge-base/diagnostics/uds","Unified Diagnostic Services (UDS)","ISO 14229-1 — the modern diagnostic protocol for sessions, Read/Write DID, Security Access, Routine Control and firmware Request Download / Upload.",12,{"_path":66,"title":67,"description":68,"part":43,"chapterNumber":69},"/knowledge-base/diagnostics/ccp","CAN Calibration Protocol (CCP)","A low-level debug/calibration protocol over CAN — Command Receive Object, Data Transfer Object, and the commands used to read and write ECU memory.",13,{"_path":71,"title":72,"description":73,"part":43,"chapterNumber":74},"/knowledge-base/diagnostics/xcp","Universal Measurement and Calibration Protocol (XCP)","ASAM XCP — successor to CCP supporting CAN, CAN FD, FlexRay, and Ethernet, with synchronous data acquisition, stimulation, and calibration.",14,{"_path":76,"title":77,"description":78,"part":79,"chapterNumber":80},"/knowledge-base/tools/can-adapters","CAN Adapters","USB-to-CAN adapters — comma.ai red panda and PEAK-System PCAN — and the standard DB-9 pinout for CAN.","Tools",15,{"_path":82,"title":83,"description":84,"part":79,"chapterNumber":85},"/knowledge-base/tools/can-analysis","CAN Analysis","Tools for analysing and reverse-engineering CAN traffic — comma.ai cabana, SavyCAN, VehicleSpy, and Wireshark.",16,{"_path":87,"title":88,"description":89,"part":79,"chapterNumber":90},"/knowledge-base/tools/scripting","Scripting","Python libraries and CLI tools for talking to a CAN bus — comma.ai panda, SocketCAN can-utils, python-can, and Scapy with ISO-TP and UDS examples.",17,{"_path":92,"title":93,"description":94,"part":79,"chapterNumber":95},"/knowledge-base/tools/dbc-files","DBC Files","The DBC file format used to describe the contents of CAN messages — nodes, messages, signals, comments, and value tables.",18,{"_path":46,"_dir":97,"_draft":98,"_partial":98,"_locale":99,"title":47,"description":48,"part":43,"chapterNumber":49,"body":100,"_type":331,"_id":332,"_source":333,"_file":334,"_extension":335},"diagnostics",false,"",{"type":101,"children":102,"toc":320},"root",[103,111,128,135,140,170,176,188,194,200,212,217,229,234,240,245,252,257,262,267,273,278,284,289,295,316],{"type":104,"tag":105,"props":106,"children":108},"element","h1",{"id":107},"iso-15765-2-iso-tp",[109],{"type":110,"value":47},"text",{"type":104,"tag":112,"props":113,"children":114},"p",{},[115,117,126],{"type":110,"value":116},"CAN is limited to just 8 bytes of payload. Diagnostic exchanges with an ECU often need to send more than 8 bytes of data. ISO-TP is a standard for sending larger amounts of data over CAN. It's defined in ",{"type":104,"tag":118,"props":119,"children":123},"a",{"href":120,"rel":121},"https://www.iso.org/standard/66574.html",[122],"nofollow",[124],{"type":110,"value":125},"ISO 15765-2",{"type":110,"value":127}," and covers layer 3 (network) and layer 4 (transport) of the OSI model. ISO-TP is used in OBD and in UDS.",{"type":104,"tag":129,"props":130,"children":132},"h2",{"id":131},"message-structure",[133],{"type":110,"value":134},"Message Structure",{"type":104,"tag":112,"props":136,"children":137},{},[138],{"type":110,"value":139},"Every ISO-TP message consists of a header followed by the payload. If the payload is 7 bytes or less, the data fits into a single CAN frame. If the payload is larger, it needs to be broken up into multiple frames. The first nibble of the frame specifies the type of message — Single, First, Consecutive, or Flow. After the first nibble comes a length or index, followed by the actual payload.",{"type":104,"tag":112,"props":141,"children":142},{},[143,145,152,154,160,162,168],{"type":110,"value":144},"If the CAN frame is less than 8 bytes in length, it can either be padded or sent with a shorter DLC. The ISO spec calls for padding with ",{"type":104,"tag":146,"props":147,"children":149},"code",{"className":148},[],[150],{"type":110,"value":151},"0xCC",{"type":110,"value":153},", but ",{"type":104,"tag":146,"props":155,"children":157},{"className":156},[],[158],{"type":110,"value":159},"0xAA",{"type":110,"value":161}," or ",{"type":104,"tag":146,"props":163,"children":165},{"className":164},[],[166],{"type":110,"value":167},"0x55",{"type":110,"value":169}," is more common in practice.",{"type":104,"tag":129,"props":171,"children":173},{"id":172},"single-frame",[174],{"type":110,"value":175},"Single Frame",{"type":104,"tag":112,"props":177,"children":178},{},[179,181,186],{"type":110,"value":180},"If the payload is 7 bytes or smaller, it fits in a single CAN frame. The first nibble is set to 0 to indicate a ",{"type":104,"tag":182,"props":183,"children":184},"em",{},[185],{"type":110,"value":175},{"type":110,"value":187},". The next nibble is the length of the payload. The payload follows the length byte.",{"type":104,"tag":189,"props":190,"children":193},"isotp-frame",{":fields":191,"title":192},"[{\"name\":\"N_PCI\",\"mnemonic\":\"PCI\",\"bytes\":\"07\",\"nibbles\":{\"high\":\"Frame type (0 = SingleFrame)\",\"low\":\"SF_DL — payload length (7)\"}},{\"name\":\"payload\",\"mnemonic\":\"DATA\",\"bytes\":\"22 F1 90 31 4A 34 47\",\"description\":\"Up to 7 bytes of service data.\"}]","SingleFrame — 7-byte payload",[],{"type":104,"tag":129,"props":195,"children":197},{"id":196},"first-frame-and-consecutive-frame",[198],{"type":110,"value":199},"First Frame and Consecutive Frame",{"type":104,"tag":112,"props":201,"children":202},{},[203,205,210],{"type":110,"value":204},"If the payload is too large to fit in a single frame, it needs to be broken up into multiple messages. The first nibble of the first message is set to 1 to indicate a ",{"type":104,"tag":182,"props":206,"children":207},{},[208],{"type":110,"value":209},"First Frame",{"type":110,"value":211},", followed by 12 bits indicating the length of the payload and 6 bytes of payload. The other side will then respond with a flow control message. This flow control message tells the sender whether it can continue sending, how long it needs to wait between frames, and how often it should wait for a new flow control message.",{"type":104,"tag":189,"props":213,"children":216},{":fields":214,"title":215},"[{\"name\":\"N_PCI byte 1\",\"mnemonic\":\"PCI1\",\"bytes\":\"10\",\"nibbles\":{\"high\":\"Frame type (1 = FirstFrame)\",\"low\":\"FF_DL — high nibble of total length (0)\"}},{\"name\":\"N_PCI byte 2\",\"mnemonic\":\"PCI2\",\"bytes\":\"14\",\"description\":\"FF_DL — low byte of total length. 0x014 = 20 bytes total.\"},{\"name\":\"payload\",\"mnemonic\":\"DATA\",\"bytes\":\"62 F1 90 31 4A 34\",\"description\":\"First 6 bytes of the message.\"}]","FirstFrame — start of a multi-frame message",[],{"type":104,"tag":112,"props":218,"children":219},{},[220,222,227],{"type":110,"value":221},"After the flow control, the sender can send the rest of the payload using ",{"type":104,"tag":182,"props":223,"children":224},{},[225],{"type":110,"value":226},"Consecutive Frames",{"type":110,"value":228},". These start with a 2 for the first nibble, followed by a 4-bit index to make sure the messages arrive in the correct order. When the index reaches 15 it wraps back to 0.",{"type":104,"tag":189,"props":230,"children":233},{":fields":231,"title":232},"[{\"name\":\"N_PCI\",\"mnemonic\":\"PCI\",\"bytes\":\"21\",\"nibbles\":{\"high\":\"Frame type (2 = ConsecutiveFrame)\",\"low\":\"SequenceNumber (1, increments per CF, wraps at 0xF → 0x0)\"}},{\"name\":\"payload\",\"mnemonic\":\"DATA\",\"bytes\":\"47 58 34 38 53 38 31\",\"description\":\"Up to 7 more bytes of the message. The last CF may be shorter (and padded).\"}]","ConsecutiveFrame",[],{"type":104,"tag":129,"props":235,"children":237},{"id":236},"flow-control",[238],{"type":110,"value":239},"Flow Control",{"type":104,"tag":112,"props":241,"children":242},{},[243],{"type":110,"value":244},"The flow control message is used to control the rate at which the rest of the data is sent. The first nibble of the flow control message is set to 3. The next nibble is the status of the flow control. The status can be either Continue (0), Wait (1), or Overflow (2).",{"type":104,"tag":246,"props":247,"children":249},"h3",{"id":248},"continue",[250],{"type":110,"value":251},"Continue",{"type":104,"tag":112,"props":253,"children":254},{},[255],{"type":110,"value":256},"Part of the continue message is the Block Size and Separation Time. The Block Size is the number of consecutive frames the sender is allowed to send before waiting for a new flow control message, and can be between 1 and 255. A Block Size of 0 indicates that the sender can send all consecutive frames without stopping.",{"type":104,"tag":112,"props":258,"children":259},{},[260],{"type":110,"value":261},"The Separation Time is the time the sender should wait between sending consecutive frames. If the separation time is between 0 and 127, the unit is milliseconds; if the time is between 241 and 249, the unit is multiples of 100 µs (where 241 represents 100 µs).",{"type":104,"tag":189,"props":263,"children":266},{":fields":264,"title":265},"[{\"name\":\"N_PCI\",\"mnemonic\":\"PCI\",\"bytes\":\"30\",\"nibbles\":{\"high\":\"Frame type (3 = FlowControl)\",\"low\":\"FlowStatus (0 = ContinueToSend, 1 = Wait, 2 = Overflow)\"}},{\"name\":\"BlockSize\",\"mnemonic\":\"BS\",\"bytes\":\"08\",\"description\":\"Number of CFs the sender may transmit before the next FC. 0 = no further FCs.\"},{\"name\":\"SeparationTime\",\"mnemonic\":\"STmin\",\"bytes\":\"0A\",\"description\":\"Minimum gap between CFs. 0x00–0x7F = 0–127 ms. 0xF1–0xF9 = 100–900 µs.\"}]","FlowControl — ContinueToSend",[],{"type":104,"tag":246,"props":268,"children":270},{"id":269},"wait",[271],{"type":110,"value":272},"Wait",{"type":104,"tag":112,"props":274,"children":275},{},[276],{"type":110,"value":277},"When the sender is instructed to wait, it will wait for a second flow control message of the continue type before sending any more messages. A typical timeout is 1000 ms, so if a longer wait is needed the sender will need to send multiple wait messages.",{"type":104,"tag":246,"props":279,"children":281},{"id":280},"overflow",[282],{"type":110,"value":283},"Overflow",{"type":104,"tag":112,"props":285,"children":286},{},[287],{"type":110,"value":288},"When the receiver indicates an overflow the transmission is aborted. The overflow flow control can only be sent as a reply to a first frame and should be used when the requested payload is too large to fit in the receiver's buffer.",{"type":104,"tag":129,"props":290,"children":292},{"id":291},"full-transfer",[293],{"type":110,"value":294},"Full transfer",{"type":104,"tag":112,"props":296,"children":297},{},[298,300,306,308,314],{"type":110,"value":299},"The transfer below is generated from the payload you choose. The tester sends data and the ECU sends flow-control frames; expand the advanced controls to change the ECU's ",{"type":104,"tag":146,"props":301,"children":303},{"className":302},[],[304],{"type":110,"value":305},"BS",{"type":110,"value":307}," and ",{"type":104,"tag":146,"props":309,"children":311},{"className":310},[],[312],{"type":110,"value":313},"STmin",{"type":110,"value":315},".",{"type":104,"tag":317,"props":318,"children":319},"isotp-transfer",{},[],{"title":99,"searchDepth":14,"depth":14,"links":321},[322,323,324,325,330],{"id":131,"depth":14,"text":134},{"id":172,"depth":14,"text":175},{"id":196,"depth":14,"text":199},{"id":236,"depth":14,"text":239,"children":326},[327,328,329],{"id":248,"depth":19,"text":251},{"id":269,"depth":19,"text":272},{"id":280,"depth":19,"text":283},{"id":291,"depth":14,"text":294},"markdown","content:7.knowledge-base:2.diagnostics:2.iso-tp.md","content","7.knowledge-base/2.diagnostics/2.iso-tp.md","md",1778093002002]