| Parameter | Value | Notes |
|---|---|---|
| Max PDU size | 4095 bytes (classic CAN); 4294967295 bytes (CAN FD extended) | SF: 7 bytes; multi-frame segmented up to limit |
| CAN frame size | 8 bytes (classic CAN); 8/12/16/20/24/32/48/64 bytes (CAN FD) | CAN FD allows 64-byte frames for faster large transfers |
| Block Size (BS) | 0 = no flow control required; N = FC every N consecutive frames | ECU sends in FC frame; 0 = tester sends all CFs without waiting |
| STmin | 0x00–0x7F: 0–127 ms; 0xF1–0xF9: 100–900 µs | Minimum inter-frame separation; ECU specifies in FC frame |
| N_As / N_Bs / N_Cr | 1000 ms / 1000 ms / 1000 ms | ISO 15765-2 timeout values; N_Cr: tester waits for next CF |
ISO 15765-2: CAN Transport Protocol
CAN TP Frame Types
Single Frame (SF): PCI byte 0x0N (N=length, 1–7): ┌──────┬──────────────────────────────────────────┐ │ 0x07 │ UDS payload (7 bytes max) │ └──────┴──────────────────────────────────────────┘ First Frame (FF): PCI bytes 0x1N NN (N=total length): ┌───────┬───────┬────────────────────────────────────┐ │ 0x10 │ 0x?? │ First 6 bytes of UDS payload │ └───────┴───────┴────────────────────────────────────┘ Flow Control (FC): sent by receiver after FF: ┌──────┬──────┬──────┬──────────────────────────────┐ │ 0x30 │ BS │ STmin│ Padding (0x00×5) │ │ CTS │ 0x00 │ 0x0A │ (Block Size=0, STmin=10ms) │ └──────┴──────┴──────┴──────────────────────────────┘ Consecutive Frame (CF): PCI byte 0x2N (N=sequence 1–F, wraps): ┌──────┬────────────────────────────────────────────┐ │ 0x21 │ Next 7 bytes of UDS payload │ └──────┴────────────────────────────────────────────┘ Example: 0x22 0xF1 0x90 (ReadDataByIdentifier: VIN) on 8-byte CAN: Request: 7DF 03 22 F1 90 00 00 00 00 (SF, length=3) Response: 7E8 10 14 62 F1 90 57 42 41 (FF, total=20 bytes) Tester: 7DF 30 00 0A 00 00 00 00 00 (FC: BS=0, STmin=10ms) Response: 7E8 21 31 32 33 34 35 36 37 (CF seq 1) Response: 7E8 22 38 39 30 31 32 33 34 (CF seq 2: VIN complete)
DoIP: Diagnostics over IP (ISO 13400-2)
| Feature | Detail |
|---|---|
| Transport | UDP (discovery: port 13400) + TCP (data: port 13400) |
| Header | 8-byte DoIP header: Protocol version (0xFFFE) + Payload type (2B) + Payload length (4B) |
| Routing Activation | Required before UDS: tester sends activation request; ECU authenticates + activates |
| Security | TLS 1.3 mandatory for remote diagnostics (OBD-II exemption for port 13400 UDP discovery) |
| Max PDU | Practically unlimited (TCP framing); 4 GB payload length field |
| AUTOSAR | SoAd (Socket Adapter) + DoIP module; configured via DoIPConnections in ARXML |
DoIP Routing Activation Sequence
#!/usr/bin/env python3
# DoIP routing activation: required before sending UDS over Ethernet
import socket, struct
DOIP_PROTO_VER = 0xFF
DOIP_INVERT_VER = 0xFE
DOIP_ROUTING_ACT_REQ = 0x0005
DOIP_ROUTING_ACT_RESP = 0x0006
DOIP_UDS_REQ = 0x8001
DOIP_UDS_RESP = 0x8001
def doip_header(payload_type: int, payload: bytes) -> bytes:
return struct.pack(">BBHI", DOIP_PROTO_VER, DOIP_INVERT_VER,
payload_type, len(payload)) + payload
def routing_activate(sock, source_addr=0xE00):
payload = struct.pack(">HBxxxxxx", source_addr, 0x00) # activation type 0x00 = default
sock.send(doip_header(DOIP_ROUTING_ACT_REQ, payload))
resp = sock.recv(256)
# Parse response: payload type 0x0006
ptype = struct.unpack(">H", resp[2:4])[0]
if ptype == DOIP_ROUTING_ACT_RESP:
rcode = resp[12] # routing activation response code
if rcode == 0x10:
print("Routing activation: SUCCESS (0x10)")
return True
else:
print(f"Routing activation FAILED: code=0x{rcode:02X}")
return False
def send_uds(sock, target_addr: int, uds_payload: bytes) -> bytes:
payload = struct.pack(">HH", 0xE000, target_addr) + uds_payload
sock.send(doip_header(DOIP_UDS_REQ, payload))
resp = sock.recv(4096)
return resp[12:] # skip 8-byte DoIP header + 4-byte source/target
sock = socket.create_connection(("192.168.1.100", 13400), timeout=5)
if routing_activate(sock):
response = send_uds(sock, 0x0726, bytes([0x22, 0xF1, 0x90]))
print(f"VIN response: {response.hex()}")Summary
ISO 15765-2 CAN TP handles segmentation transparently — the UDS layer only sees the reassembled payload. The Flow Control frame's Block Size = 0 (no flow control) and STmin = 0 are the fastest settings; an STmin of 10 ms (0x0A) gives the ECU breathing room for processing between consecutive frames. DoIP over Ethernet removes the 8-byte CAN frame limitation and enables high-speed reprogramming; routing activation is the mandatory handshake that authorises the tester before any UDS can flow. TLS 1.3 on the TCP connection is mandatory for production remote diagnostics per UNECE R155.
🔬 Deep Dive — Core Concepts Expanded
This section builds on the foundational concepts covered above with additional technical depth, edge cases, and configuration nuances that separate competent engineers from experts. When working on production ECU projects, the details covered here are the ones most commonly responsible for integration delays and late-phase defects.
Key principles to reinforce:
- Configuration over coding: In AUTOSAR and automotive middleware environments, correctness is largely determined by ARXML configuration, not application code. A correctly implemented algorithm can produce wrong results due to a single misconfigured parameter.
- Traceability as a first-class concern: Every configuration decision should be traceable to a requirement, safety goal, or architecture decision. Undocumented configuration choices are a common source of regression defects when ECUs are updated.
- Cross-module dependencies: In tightly integrated automotive software stacks, changing one module's configuration often requires corresponding updates in dependent modules. Always perform a dependency impact analysis before submitting configuration changes.
🏭 How This Topic Appears in Production Projects
- Project integration phase: The concepts covered in this lesson are most commonly encountered during ECU integration testing — when multiple software components from different teams are combined for the first time. Issues that were invisible in unit tests frequently surface at this stage.
- Supplier/OEM interface: This is a topic that frequently appears in technical discussions between Tier-1 ECU suppliers and OEM system integrators. Engineers who can speak fluently about these details earn credibility and are often brought into critical design review meetings.
- Automotive tool ecosystem: Vector CANoe/CANalyzer, dSPACE tools, and ETAS INCA are the standard tools used to validate and measure the correct behaviour of the systems described in this lesson. Familiarity with these tools alongside the conceptual knowledge dramatically accelerates debugging in real projects.
⚠️ Common Mistakes and How to Avoid Them
- Assuming default configuration is correct: Automotive software tools ship with default configurations that are designed to compile and link, not to meet project-specific requirements. Every configuration parameter needs to be consciously set. 'It compiled' is not the same as 'it is correctly configured'.
- Skipping documentation of configuration rationale: In a 3-year ECU project with team turnover, undocumented configuration choices become tribal knowledge that disappears when engineers leave. Document why a parameter is set to a specific value, not just what it is set to.
- Testing only the happy path: Automotive ECUs must behave correctly under fault conditions, voltage variations, and communication errors. Always test the error handling paths as rigorously as the nominal operation. Many production escapes originate in untested error branches.
- Version mismatches between teams: In a multi-team project, the BSW team, SWC team, and system integration team may use different versions of the same ARXML file. Version management of all ARXML files in a shared repository is mandatory, not optional.
📊 Industry Note
Engineers who master both the theoretical concepts and the practical toolchain skills covered in this course are among the most sought-after professionals in the automotive software industry. The combination of AUTOSAR standards knowledge, safety engineering understanding, and hands-on configuration experience commands premium salaries at OEMs and Tier-1 suppliers globally.