[{"data":1,"prerenderedAt":724},["Reactive",2],{"kb-nav":3,"kb-doc":96},[4,10,15,20,25,30,35,40,45,50,55,60,65,70,75,81,86,91],{"_path":5,"title":6,"description":7,"part":8,"chapterNumber":9},"/knowledge-base/networks/introduction","Introduction","Overview of the communication networks used in modern vehicles, from LIN to Automotive Ethernet.","Vehicle Networks & Protocols",1,{"_path":11,"title":12,"description":13,"part":8,"chapterNumber":14},"/knowledge-base/networks/vehicle-documentation","Vehicle Documentation","Where to find manufacturer wiring diagrams, J2534 passthrough devices, and the different types of diagrams that are useful when researching a vehicle.",2,{"_path":16,"title":17,"description":18,"part":8,"chapterNumber":19},"/knowledge-base/networks/lin-bus","Local Interconnect Network (LIN)","Local Interconnect Network — a single-wire low-speed bus used as a low-cost alternative to CAN for non-critical body electronics.",3,{"_path":21,"title":22,"description":23,"part":8,"chapterNumber":24},"/knowledge-base/networks/controller-area-network","Controller Area Network (CAN)","ISO 11898 — the differential bus that became the backbone of automotive networking. Frames, bit timing, errors, CAN FD, message contents, and practical attacks.",4,{"_path":26,"title":27,"description":28,"part":8,"chapterNumber":29},"/knowledge-base/networks/flexray","FlexRay","Time-triggered, deterministic automotive bus standardized as ISO 17458, designed for higher speeds and drive-by-wire systems.",5,{"_path":31,"title":32,"description":33,"part":8,"chapterNumber":34},"/knowledge-base/networks/automotive-ethernet","Automotive Ethernet","Automotive variants of Ethernet — 100BASE-T1, 1000BASE-T1, and 10BASE-T1S — built around single twisted-pair cabling and strict EMC requirements.",6,{"_path":36,"title":37,"description":38,"part":8,"chapterNumber":39},"/knowledge-base/networks/secure-onboard-communication","Secure Onboard Communication (SecOC)","AUTOSAR's standard for cryptographic message authentication on in-vehicle networks — freshness values, MAC computation and key management.",7,{"_path":41,"title":6,"description":42,"part":43,"chapterNumber":44},"/knowledge-base/diagnostics/introduction","Overview of automotive diagnostic protocols — ISO-TP, OBD-II, UDS, CCP and XCP — and how they layer on top of CAN.","Diagnostic Protocols",8,{"_path":46,"title":47,"description":48,"part":43,"chapterNumber":49},"/knowledge-base/diagnostics/iso-tp","ISO 15765-2 (ISO-TP)","ISO 15765-2 transport layer for sending diagnostic payloads larger than 8 bytes over CAN — single, first, consecutive and flow-control frames.",9,{"_path":51,"title":52,"description":53,"part":43,"chapterNumber":54},"/knowledge-base/diagnostics/vw-tp20","VW Transport Protocol 2.0 (TP 2.0)","Volkswagen's pre-ISO-TP transport layer for KWP2000 over CAN — channel setup, parameter negotiation, and the data exchange counter scheme.",10,{"_path":56,"title":57,"description":58,"part":43,"chapterNumber":59},"/knowledge-base/diagnostics/obd-ii","On-board diagnostics (OBD-II)","On-Board Diagnostics II — the J1962 connector, signal protocols, service IDs, parameter IDs, and DTC encoding.",11,{"_path":61,"title":62,"description":63,"part":43,"chapterNumber":64},"/knowledge-base/diagnostics/uds","Unified Diagnostic Services (UDS)","ISO 14229-1 — the modern diagnostic protocol for sessions, Read/Write DID, Security Access, Routine Control and firmware Request Download / Upload.",12,{"_path":66,"title":67,"description":68,"part":43,"chapterNumber":69},"/knowledge-base/diagnostics/ccp","CAN Calibration Protocol (CCP)","A low-level debug/calibration protocol over CAN — Command Receive Object, Data Transfer Object, and the commands used to read and write ECU memory.",13,{"_path":71,"title":72,"description":73,"part":43,"chapterNumber":74},"/knowledge-base/diagnostics/xcp","Universal Measurement and Calibration Protocol (XCP)","ASAM XCP — successor to CCP supporting CAN, CAN FD, FlexRay, and Ethernet, with synchronous data acquisition, stimulation, and calibration.",14,{"_path":76,"title":77,"description":78,"part":79,"chapterNumber":80},"/knowledge-base/tools/can-adapters","CAN Adapters","USB-to-CAN adapters — comma.ai red panda and PEAK-System PCAN — and the standard DB-9 pinout for CAN.","Tools",15,{"_path":82,"title":83,"description":84,"part":79,"chapterNumber":85},"/knowledge-base/tools/can-analysis","CAN Analysis","Tools for analysing and reverse-engineering CAN traffic — comma.ai cabana, SavyCAN, VehicleSpy, and Wireshark.",16,{"_path":87,"title":88,"description":89,"part":79,"chapterNumber":90},"/knowledge-base/tools/scripting","Scripting","Python libraries and CLI tools for talking to a CAN bus — comma.ai panda, SocketCAN can-utils, python-can, and Scapy with ISO-TP and UDS examples.",17,{"_path":92,"title":93,"description":94,"part":79,"chapterNumber":95},"/knowledge-base/tools/dbc-files","DBC Files","The DBC file format used to describe the contents of CAN messages — nodes, messages, signals, comments, and value tables.",18,{"_path":51,"_dir":97,"_draft":98,"_partial":98,"_locale":99,"title":52,"description":53,"part":43,"chapterNumber":54,"body":100,"_type":719,"_id":720,"_source":721,"_file":722,"_extension":723},"diagnostics",false,"",{"type":101,"children":102,"toc":701},"root",[103,111,117,141,146,153,190,219,226,272,278,320,327,333,338,343,408,414,434,479,508,513,532,538,544,549,554,619,626,632,637,650,655,661,666,671,696],{"type":104,"tag":105,"props":106,"children":108},"element","h1",{"id":107},"vw-transport-protocol-20-tp-20",[109],{"type":110,"value":52},"text",{"type":104,"tag":112,"props":113,"children":114},"p",{},[115],{"type":110,"value":116},"While most diagnostic protocols on CAN use ISO-TP to transfer payloads larger than 8 bytes, Volkswagen uses a custom protocol on older models. This protocol is called VW Transport Protocol 2.0 (TP 2.0). It's usually used to transfer KWP2000 diagnostic messages, but can also be used to transfer other data.",{"type":104,"tag":112,"props":118,"children":119},{},[120,122,128,130,139],{"type":110,"value":121},"TP 2.0 uses the concept of ",{"type":104,"tag":123,"props":124,"children":125},"em",{},[126],{"type":110,"value":127},"channels",{"type":110,"value":129}," to communicate data between the tester and the ECU. Once a channel is opened, data can be exchanged. There is no official specification of TP 2.0, so the protocol description here is based on ",{"type":104,"tag":131,"props":132,"children":136},"a",{"href":133,"rel":134},"https://jazdw.net/tp20",[135],"nofollow",[137],{"type":110,"value":138},"reverse engineering work by Jared Wiltshire",{"type":110,"value":140},".",{"type":104,"tag":112,"props":142,"children":143},{},[144],{"type":110,"value":145},"VW TP 2.0 uses four types of packets: channel setup, channel parameters, data packets, and broadcast.",{"type":104,"tag":147,"props":148,"children":150},"h2",{"id":149},"channel-setup",[151],{"type":110,"value":152},"Channel Setup",{"type":104,"tag":112,"props":154,"children":155},{},[156,158,165,167,173,175,181,183,189],{"type":110,"value":157},"The first step in opening a channel is sending a channel setup request message. It's sent on Arbitration ID ",{"type":104,"tag":159,"props":160,"children":162},"code",{"className":161},[],[163],{"type":110,"value":164},"0x200",{"type":110,"value":166},", and the response will be sent on ",{"type":104,"tag":159,"props":168,"children":170},{"className":169},[],[171],{"type":110,"value":172},"0x200 + logical address of the ECU",{"type":110,"value":174},". For example, the engine control unit has a logical address of ",{"type":104,"tag":159,"props":176,"children":178},{"className":177},[],[179],{"type":110,"value":180},"0x01",{"type":110,"value":182},", so the response will be on ",{"type":104,"tag":159,"props":184,"children":186},{"className":185},[],[187],{"type":110,"value":188},"0x201",{"type":110,"value":140},{"type":104,"tag":112,"props":191,"children":192},{},[193,195,201,203,209,211,217],{"type":110,"value":194},"The channel setup message is 7 bytes long. Each of the RX and TX IDs is split across two bytes: a low byte holding the lower 8 bits of the 11-bit CAN ID, and a \"validity + prefix\" byte where the high nibble is the validity flag (",{"type":104,"tag":159,"props":196,"children":198},{"className":197},[],[199],{"type":110,"value":200},"0x0",{"type":110,"value":202}," = valid, ",{"type":104,"tag":159,"props":204,"children":206},{"className":205},[],[207],{"type":110,"value":208},"0x1",{"type":110,"value":210}," = invalid) and the low nibble is the upper nibble of the CAN ID. Read together as a little-endian 16-bit value, this gives ",{"type":104,"tag":159,"props":212,"children":214},{"className":213},[],[215],{"type":110,"value":216},"V·ID",{"type":110,"value":218}," with V in the top nibble.",{"type":104,"tag":220,"props":221,"children":223},"h3",{"id":222},"opcode",[224],{"type":110,"value":225},"Opcode",{"type":104,"tag":227,"props":228,"children":229},"ul",{},[230,242,253],{"type":104,"tag":231,"props":232,"children":233},"li",{},[234,240],{"type":104,"tag":159,"props":235,"children":237},{"className":236},[],[238],{"type":110,"value":239},"0xC0",{"type":110,"value":241}," — Setup Request",{"type":104,"tag":231,"props":243,"children":244},{},[245,251],{"type":104,"tag":159,"props":246,"children":248},{"className":247},[],[249],{"type":110,"value":250},"0xD0",{"type":110,"value":252}," — Positive Response",{"type":104,"tag":231,"props":254,"children":255},{},[256,262,264,270],{"type":104,"tag":159,"props":257,"children":259},{"className":258},[],[260],{"type":110,"value":261},"0xD6",{"type":110,"value":263},"–",{"type":104,"tag":159,"props":265,"children":267},{"className":266},[],[268],{"type":110,"value":269},"0xD8",{"type":110,"value":271}," — Negative Response",{"type":104,"tag":220,"props":273,"children":275},{"id":274},"example",[276],{"type":110,"value":277},"Example",{"type":104,"tag":112,"props":279,"children":280},{},[281,283,289,291,297,299,304,306,311,313,319],{"type":110,"value":282},"In the example below the tester opens a channel to the ECU with logical address ",{"type":104,"tag":159,"props":284,"children":286},{"className":285},[],[287],{"type":110,"value":288},"0x09",{"type":110,"value":290},". The RX ID is set to invalid to let the ECU decide where it listens. The TX ID is set to ",{"type":104,"tag":159,"props":292,"children":294},{"className":293},[],[295],{"type":110,"value":296},"0x300",{"type":110,"value":298}," to request that the ECU transmit on ",{"type":104,"tag":159,"props":300,"children":302},{"className":301},[],[303],{"type":110,"value":296},{"type":110,"value":305},". The ECU responds with a positive response, acknowledges that it will listen on ",{"type":104,"tag":159,"props":307,"children":309},{"className":308},[],[310],{"type":110,"value":296},{"type":110,"value":312},", and tells the tester to send to ",{"type":104,"tag":159,"props":314,"children":316},{"className":315},[],[317],{"type":110,"value":318},"0x7A8",{"type":110,"value":140},{"type":104,"tag":321,"props":322,"children":326},"uds-exchange",{":request":323,":response":324,"title":325},"{\"fields\":[{\"name\":\"Destination\",\"mnemonic\":\"Dest\",\"bytes\":\"09\",\"description\":\"Logical address of the ECU. 0x09 here.\"},{\"name\":\"Opcode\",\"mnemonic\":\"Op\",\"bytes\":\"C0\",\"description\":\"0xC0 = Setup Request.\"},{\"name\":\"RX ID low byte\",\"mnemonic\":\"RX\",\"bytes\":\"00\",\"description\":\"Low 8 bits of the RX ID (CAN ID the ECU should listen on).\"},{\"name\":\"RX V & prefix\",\"mnemonic\":\"RXVP\",\"bytes\":\"10\",\"nibbles\":{\"high\":\"Validity (1 = invalid, \\\"ECU you decide\\\")\",\"low\":\"Upper nibble of RX ID (0)\"}},{\"name\":\"TX ID low byte\",\"mnemonic\":\"TX\",\"bytes\":\"00\",\"description\":\"Low 8 bits of the TX ID (CAN ID the ECU should transmit on).\"},{\"name\":\"TX V & prefix\",\"mnemonic\":\"TXVP\",\"bytes\":\"03\",\"nibbles\":{\"high\":\"Validity (0 = valid)\",\"low\":\"Upper nibble of TX ID (0x3) — full ID = 0x300.\"}},{\"name\":\"Application\",\"mnemonic\":\"App\",\"bytes\":\"01\",\"description\":\"Always 0x01 for KWP2000.\"}]}","{\"fields\":[{\"name\":\"Destination\",\"mnemonic\":\"Dest\",\"bytes\":\"00\",\"description\":\"Logical address of the tester (always 0x00).\"},{\"name\":\"Opcode\",\"mnemonic\":\"Op\",\"bytes\":\"D0\",\"description\":\"0xD0 = Positive Response. 0xD6–0xD8 indicate a negative response.\"},{\"name\":\"RX ID low byte\",\"mnemonic\":\"RX\",\"bytes\":\"00\",\"description\":\"ECU confirms it will listen on this CAN ID.\"},{\"name\":\"RX V & prefix\",\"mnemonic\":\"RXVP\",\"bytes\":\"03\",\"nibbles\":{\"high\":\"Validity (0 = valid)\",\"low\":\"Upper nibble of RX ID (0x3) — ECU listens on 0x300.\"}},{\"name\":\"TX ID low byte\",\"mnemonic\":\"TX\",\"bytes\":\"A8\",\"description\":\"Tester should send to this CAN ID.\"},{\"name\":\"TX V & prefix\",\"mnemonic\":\"TXVP\",\"bytes\":\"07\",\"nibbles\":{\"high\":\"Validity (0 = valid)\",\"low\":\"Upper nibble of TX ID (0x7) — full ID = 0x7A8.\"}},{\"name\":\"Application\",\"mnemonic\":\"App\",\"bytes\":\"01\",\"description\":\"Echoed.\"}]}","Channel setup",[],{"type":104,"tag":147,"props":328,"children":330},{"id":329},"channel-parameters",[331],{"type":110,"value":332},"Channel Parameters",{"type":104,"tag":112,"props":334,"children":335},{},[336],{"type":110,"value":337},"After opening the channel, some timing parameters need to be negotiated. The tester sends a parameters request message, and the ECU responds with a parameters response message. The parameters are used to determine the timing of the channel.",{"type":104,"tag":220,"props":339,"children":341},{"id":340},"opcode-1",[342],{"type":110,"value":225},{"type":104,"tag":227,"props":344,"children":345},{},[346,357,368,386,397],{"type":104,"tag":231,"props":347,"children":348},{},[349,355],{"type":104,"tag":159,"props":350,"children":352},{"className":351},[],[353],{"type":110,"value":354},"0xA0",{"type":110,"value":356}," — Parameters request (6 bytes)",{"type":104,"tag":231,"props":358,"children":359},{},[360,366],{"type":104,"tag":159,"props":361,"children":363},{"className":362},[],[364],{"type":110,"value":365},"0xA1",{"type":110,"value":367}," — Parameters response (6 bytes)",{"type":104,"tag":231,"props":369,"children":370},{},[371,377,379,384],{"type":104,"tag":159,"props":372,"children":374},{"className":373},[],[375],{"type":110,"value":376},"0xA3",{"type":110,"value":378}," — Channel test (1 byte). The ECU responds with an ",{"type":104,"tag":159,"props":380,"children":382},{"className":381},[],[383],{"type":110,"value":365},{"type":110,"value":385}," message. Used to keep the channel alive.",{"type":104,"tag":231,"props":387,"children":388},{},[389,395],{"type":104,"tag":159,"props":390,"children":392},{"className":391},[],[393],{"type":110,"value":394},"0xA4",{"type":110,"value":396}," — Break (1 byte). The receiver discards all data since last ACK.",{"type":104,"tag":231,"props":398,"children":399},{},[400,406],{"type":104,"tag":159,"props":401,"children":403},{"className":402},[],[404],{"type":110,"value":405},"0xA8",{"type":110,"value":407}," — Disconnect (1 byte). Closes the channel. Receiver responds with a disconnect.",{"type":104,"tag":220,"props":409,"children":411},{"id":410},"timing-parameters",[412],{"type":110,"value":413},"Timing Parameters",{"type":104,"tag":112,"props":415,"children":416},{},[417,419,425,427,432],{"type":110,"value":418},"T1, T2, T3, T4 are each one byte. Bits 7–6 encode the time ",{"type":104,"tag":420,"props":421,"children":422},"strong",{},[423],{"type":110,"value":424},"units",{"type":110,"value":426}," and bits 5–0 encode a ",{"type":104,"tag":420,"props":428,"children":429},{},[430],{"type":110,"value":431},"multiplier",{"type":110,"value":433},". The unit values are:",{"type":104,"tag":227,"props":435,"children":436},{},[437,447,457,468],{"type":104,"tag":231,"props":438,"children":439},{},[440,445],{"type":104,"tag":159,"props":441,"children":443},{"className":442},[],[444],{"type":110,"value":200},{"type":110,"value":446}," — 0.1 ms",{"type":104,"tag":231,"props":448,"children":449},{},[450,455],{"type":104,"tag":159,"props":451,"children":453},{"className":452},[],[454],{"type":110,"value":208},{"type":110,"value":456}," — 1 ms",{"type":104,"tag":231,"props":458,"children":459},{},[460,466],{"type":104,"tag":159,"props":461,"children":463},{"className":462},[],[464],{"type":110,"value":465},"0x2",{"type":110,"value":467}," — 10 ms",{"type":104,"tag":231,"props":469,"children":470},{},[471,477],{"type":104,"tag":159,"props":472,"children":474},{"className":473},[],[475],{"type":110,"value":476},"0x3",{"type":110,"value":478}," — 100 ms",{"type":104,"tag":112,"props":480,"children":481},{},[482,484,490,492,498,500,506],{"type":110,"value":483},"The total time is ",{"type":104,"tag":159,"props":485,"children":487},{"className":486},[],[488],{"type":110,"value":489},"units × multiplier",{"type":110,"value":491},". For example ",{"type":104,"tag":159,"props":493,"children":495},{"className":494},[],[496],{"type":110,"value":497},"0x8A",{"type":110,"value":499}," = ",{"type":104,"tag":159,"props":501,"children":503},{"className":502},[],[504],{"type":110,"value":505},"10 001010",{"type":110,"value":507}," = 10 ms × 10 = 100 ms.",{"type":104,"tag":220,"props":509,"children":511},{"id":510},"example-1",[512],{"type":110,"value":277},{"type":104,"tag":112,"props":514,"children":515},{},[516,518,523,525,530],{"type":110,"value":517},"Example of the tester exchanging the timing parameters. Recall the ECU listens on ",{"type":104,"tag":159,"props":519,"children":521},{"className":520},[],[522],{"type":110,"value":318},{"type":110,"value":524}," and will transmit on ",{"type":104,"tag":159,"props":526,"children":528},{"className":527},[],[529],{"type":110,"value":296},{"type":110,"value":531},". The tester requests a block size of 15, T1 of 100 ms, and T3 of 1 ms. The ECU responds with a block size of 15, T1 of 100 ms, and T3 of 10 ms.",{"type":104,"tag":321,"props":533,"children":537},{":request":534,":response":535,"title":536},"{\"fields\":[{\"name\":\"Opcode\",\"mnemonic\":\"Op\",\"bytes\":\"A0\",\"description\":\"0xA0 = Parameters request.\"},{\"name\":\"BlockSize\",\"mnemonic\":\"BS\",\"bytes\":\"0F\",\"description\":\"15 packets between ACKs.\"},{\"name\":\"T1\",\"mnemonic\":\"T1\",\"bytes\":\"8A\",\"nibbles\":{\"high\":\"Units (bits 7–6 = 10₂ → 10 ms)\",\"low\":\"Multiplier (bits 5–0 = 10) — total 100 ms\"},\"description\":\"Time to wait for ACK. Should satisfy T1 > 4 × T3.\"},{\"name\":\"T2\",\"mnemonic\":\"T2\",\"bytes\":\"FF\",\"description\":\"Always 0xFF (unused).\"},{\"name\":\"T3\",\"mnemonic\":\"T3\",\"bytes\":\"0A\",\"nibbles\":{\"high\":\"Units (bits 7–6 = 00₂ → 0.1 ms)\",\"low\":\"Multiplier (bits 5–0 = 10) — total 1 ms\"},\"description\":\"Interval between packets requested by the tester.\"},{\"name\":\"T4\",\"mnemonic\":\"T4\",\"bytes\":\"FF\",\"description\":\"Always 0xFF (unused).\"}]}","{\"fields\":[{\"name\":\"Opcode\",\"mnemonic\":\"Op\",\"bytes\":\"A1\",\"description\":\"0xA1 = Parameters response.\"},{\"name\":\"BlockSize\",\"mnemonic\":\"BS\",\"bytes\":\"0F\",\"description\":\"ECU agrees to 15 packets per block.\"},{\"name\":\"T1\",\"mnemonic\":\"T1\",\"bytes\":\"8A\",\"description\":\"100 ms (same encoding as request).\"},{\"name\":\"T2\",\"mnemonic\":\"T2\",\"bytes\":\"FF\",\"description\":\"Always 0xFF.\"},{\"name\":\"T3\",\"mnemonic\":\"T3\",\"bytes\":\"4A\",\"nibbles\":{\"high\":\"Units (bits 7–6 = 01₂ → 1 ms)\",\"low\":\"Multiplier (bits 5–0 = 10) — total 10 ms\"},\"description\":\"ECU bumps the inter-packet gap to 10 ms.\"},{\"name\":\"T4\",\"mnemonic\":\"T4\",\"bytes\":\"FF\",\"description\":\"Always 0xFF.\"}]}","Channel parameters",[],{"type":104,"tag":147,"props":539,"children":541},{"id":540},"data-transmission",[542],{"type":110,"value":543},"Data Transmission",{"type":104,"tag":112,"props":545,"children":546},{},[547],{"type":110,"value":548},"After opening a channel, data can be transmitted. Up to 7 bytes of payload can be sent at a time. During channel setup, a block size was negotiated; after this many data transmission packets, an ACK is required. The first nibble of the first byte contains the opcode, and the second is used as a counter. Note that this counter behaves in a counterintuitive way: both tester and ECU have their own counter that persists between transmissions. The counter is incremented after each data transmission. An ACK does not increment any counter, but is expected to use the counter value of the last data transmission that is being acknowledged plus one.",{"type":104,"tag":220,"props":550,"children":552},{"id":551},"opcode-2",[553],{"type":110,"value":225},{"type":104,"tag":227,"props":555,"children":556},{},[557,567,577,587,597,608],{"type":104,"tag":231,"props":558,"children":559},{},[560,565],{"type":104,"tag":159,"props":561,"children":563},{"className":562},[],[564],{"type":110,"value":200},{"type":110,"value":566}," — Waiting for ACK, more packets follow (max block size reached)",{"type":104,"tag":231,"props":568,"children":569},{},[570,575],{"type":104,"tag":159,"props":571,"children":573},{"className":572},[],[574],{"type":110,"value":208},{"type":110,"value":576}," — Waiting for ACK, last packet",{"type":104,"tag":231,"props":578,"children":579},{},[580,585],{"type":104,"tag":159,"props":581,"children":583},{"className":582},[],[584],{"type":110,"value":465},{"type":110,"value":586}," — Not waiting for ACK, more packets to follow",{"type":104,"tag":231,"props":588,"children":589},{},[590,595],{"type":104,"tag":159,"props":591,"children":593},{"className":592},[],[594],{"type":110,"value":476},{"type":110,"value":596}," — Not waiting for ACK, last packet",{"type":104,"tag":231,"props":598,"children":599},{},[600,606],{"type":104,"tag":159,"props":601,"children":603},{"className":602},[],[604],{"type":110,"value":605},"0xB",{"type":110,"value":607}," — ACK, ready for more data",{"type":104,"tag":231,"props":609,"children":610},{},[611,617],{"type":104,"tag":159,"props":612,"children":614},{"className":613},[],[615],{"type":110,"value":616},"0x9",{"type":110,"value":618}," — ACK, not ready for more data",{"type":104,"tag":620,"props":621,"children":625},"uds-packet",{":fields":622,"direction":623,"title":624},"[{\"name\":\"Op & Sequence\",\"mnemonic\":\"Op|Seq\",\"bytes\":\"12\",\"nibbles\":{\"high\":\"Op (1 = waiting for ACK, last packet)\",\"low\":\"Sequence number (2)\"}},{\"name\":\"Length\",\"mnemonic\":\"Len\",\"bytes\":\"00 02\",\"description\":\"Big-endian total payload length (2 bytes). Only present in the first frame of a message.\"},{\"name\":\"Payload\",\"mnemonic\":\"Data\",\"bytes\":\"1A 9B\",\"description\":\"KWP2000 service ID (0x1A read ECU identification) and parameter (0x9B).\"}]","request","Data frame — last packet, expecting ACK",[],{"type":104,"tag":620,"props":627,"children":631},{":fields":628,"direction":629,"title":630},"[{\"name\":\"Op & Sequence\",\"mnemonic\":\"Op|Seq\",\"bytes\":\"B3\",\"nibbles\":{\"high\":\"Op (B = ACK, ready for next)\",\"low\":\"Sequence number (last data Seq + 1 = 3)\"}}]","response","ACK frame",[],{"type":104,"tag":220,"props":633,"children":635},{"id":634},"example-2",[636],{"type":110,"value":277},{"type":104,"tag":112,"props":638,"children":639},{},[640,642,648],{"type":110,"value":641},"In this example the tester has some KWP2000 communication with the ECU. There are some short packets to enter a diagnostics mode, then a larger payload is requested using service ",{"type":104,"tag":159,"props":643,"children":645},{"className":644},[],[646],{"type":110,"value":647},"0x1A",{"type":110,"value":649}," (Read ECU Identification) to get the firmware version.",{"type":104,"tag":651,"props":652,"children":654},"can-log",{":frames":653},"[{\"sender\":\"tester\",\"id\":\"0x7A8\",\"bytes\":\"10 00 02 10 89\",\"comment\":\"Payload 10 89 — enter diag mode 0x89\"},{\"sender\":\"ecu\",\"id\":\"0x300\",\"bytes\":\"B1\",\"comment\":\"ACK\"},{\"sender\":\"ecu\",\"id\":\"0x300\",\"bytes\":\"10 00 02 50 89\",\"comment\":\"Payload 50 89 — mode 0x89 entered\"},{\"sender\":\"tester\",\"id\":\"0x7A8\",\"bytes\":\"B1\",\"comment\":\"ACK\"},{\"sender\":\"tester\",\"id\":\"0x7A8\",\"bytes\":\"11 00 02 10 89\",\"comment\":\"Payload 10 89 — enter diag mode 0x89\"},{\"sender\":\"ecu\",\"id\":\"0x300\",\"bytes\":\"B2\",\"comment\":\"ACK\"},{\"sender\":\"ecu\",\"id\":\"0x300\",\"bytes\":\"11 00 02 50 89\",\"comment\":\"Payload 50 89 — mode 0x89 entered\"},{\"sender\":\"tester\",\"id\":\"0x7A8\",\"bytes\":\"B2\",\"comment\":\"ACK\"},{\"sender\":\"tester\",\"id\":\"0x7A8\",\"bytes\":\"12 00 02 1A 9B\",\"comment\":\"Payload 1A 9B — Read ECU Identification\"},{\"sender\":\"ecu\",\"id\":\"0x300\",\"bytes\":\"B3\",\"comment\":\"ACK\"},{\"sender\":\"ecu\",\"id\":\"0x300\",\"bytes\":\"22 00 30 5A 9B 31 4B 30\",\"comment\":\"Payload \\\"Z.1K0\\\"\"},{\"sender\":\"ecu\",\"id\":\"0x300\",\"bytes\":\"23 39 30 39 31 34 34 45\",\"comment\":\"Payload \\\"909144E\\\"\"},{\"sender\":\"ecu\",\"id\":\"0x300\",\"bytes\":\"24 20 20 32 35 30 31 00\",\"comment\":\"Payload \\\"  2501.\\\"\"},{\"sender\":\"ecu\",\"id\":\"0x300\",\"bytes\":\"25 00 00 00 00 06 40 16\",\"comment\":\"Payload \\\".....@.\\\"\"},{\"sender\":\"ecu\",\"id\":\"0x300\",\"bytes\":\"26 05 4D 45 50 53 5F 5A\",\"comment\":\"Payload \\\".MEPS_Z\\\"\"},{\"sender\":\"ecu\",\"id\":\"0x300\",\"bytes\":\"27 46 4C 53 20 4B 6C 2E\",\"comment\":\"Payload \\\"FLS Kl.\\\"\"},{\"sender\":\"ecu\",\"id\":\"0x300\",\"bytes\":\"28 20 31 38 34 20 20 20\",\"comment\":\"Payload \\\" 184.  \\\"\"},{\"sender\":\"ecu\",\"id\":\"0x300\",\"bytes\":\"19 20\",\"comment\":\"Payload \\\" \\\"\"},{\"sender\":\"tester\",\"id\":\"0x7A8\",\"bytes\":\"BA\",\"comment\":\"ACK\"}]",[],{"type":104,"tag":147,"props":656,"children":658},{"id":657},"broadcast",[659],{"type":110,"value":660},"Broadcast",{"type":104,"tag":112,"props":662,"children":663},{},[664],{"type":110,"value":665},"For diagnostics requests, it might be useful to quickly send a message without needing a (long) response, and without needing to open a channel first. The broadcast packets have no form of ACK, so they are sent 5 times.",{"type":104,"tag":220,"props":667,"children":669},{"id":668},"opcode-3",[670],{"type":110,"value":225},{"type":104,"tag":227,"props":672,"children":673},{},[674,685],{"type":104,"tag":231,"props":675,"children":676},{},[677,683],{"type":104,"tag":159,"props":678,"children":680},{"className":679},[],[681],{"type":110,"value":682},"0x23",{"type":110,"value":684}," — Broadcast request",{"type":104,"tag":231,"props":686,"children":687},{},[688,694],{"type":104,"tag":159,"props":689,"children":691},{"className":690},[],[692],{"type":110,"value":693},"0x24",{"type":110,"value":695}," — Broadcast response",{"type":104,"tag":620,"props":697,"children":700},{":fields":698,"direction":623,"title":699},"[{\"name\":\"Destination\",\"mnemonic\":\"Dest\",\"bytes\":\"01\",\"description\":\"Logical address of the destination module.\"},{\"name\":\"Opcode\",\"mnemonic\":\"Op\",\"bytes\":\"23\",\"description\":\"0x23 = Broadcast request, 0x24 = Broadcast response.\"},{\"name\":\"KWP2000 data\",\"mnemonic\":\"Data\",\"placeholder\":\"4 KWP2000 bytes\",\"description\":\"Service ID and parameters.\"},{\"name\":\"Response flag\",\"mnemonic\":\"Resp\",\"bytes\":\"00\",\"description\":\"0x00 = response expected. 0x55 or 0xAA = no response expected.\"}]","Broadcast frame",[],{"title":99,"searchDepth":14,"depth":14,"links":702},[703,707,712,716],{"id":149,"depth":14,"text":152,"children":704},[705,706],{"id":222,"depth":19,"text":225},{"id":274,"depth":19,"text":277},{"id":329,"depth":14,"text":332,"children":708},[709,710,711],{"id":340,"depth":19,"text":225},{"id":410,"depth":19,"text":413},{"id":510,"depth":19,"text":277},{"id":540,"depth":14,"text":543,"children":713},[714,715],{"id":551,"depth":19,"text":225},{"id":634,"depth":19,"text":277},{"id":657,"depth":14,"text":660,"children":717},[718],{"id":668,"depth":19,"text":225},"markdown","content:7.knowledge-base:2.diagnostics:3.vw-tp20.md","content","7.knowledge-base/2.diagnostics/3.vw-tp20.md","md",1778093002004]