DoIP

Loading views...

DoIP (ISO 13400)

Overview

DoIP (Diagnostics over IP) is the automotive standard for remote diagnostics and ECU reprogramming over Ethernet/IP, replacing the need for direct CAN access. It carries UDS messages over TCP/UDP, enabling over-the-air (OTA) updates and fast flash programming through the vehicle's Ethernet backbone.

1. Theory & Fundamentals

Transport: UDP (port 13400) for discovery; TCP (port 13400) for diagnostics
Enables UDS over Ethernet at >100 Mbps (vs 500 kbps CAN)
Edge node: DoIP gateway in vehicle bridges Ethernet ↔ CAN
External tester: laptop/diagnostic tool connects to vehicle OBD-II Ethernet port
Logical address: 16-bit address identifies each ECU
VIN-based routing: DoIP gateway routes messages to correct ECU
OTA: Cloud server sends DoIP updates through telematics ECU

2. Frame / Packet Structure

DoIP Generic Header:
  Protocol Version(1B)=0xFD | Inv Version(1B) | Payload Type(2B) | Payload Length(4B)

Payload Types:
  0x0001 = Vehicle ID Request
  0x0004 = Vehicle Announcement/ID Response
  0x0005 = Routing Activation Request
  0x0006 = Routing Activation Response
  0x8001 = Diagnostic Message
  0x8002 = Diagnostic Message ACK
  0x8003 = Diagnostic Message NACK

Diagnostic Message payload:
  Source Address(2B) | Target Address(2B) | User Data (UDS PDU)

Vehicle ID Response:
  VIN(17B) | Logical Address(2B) | EID(6B) | GID(6B) | Further Action

3. Protocol Mechanics

Node discovery: tester broadcasts Vehicle ID Request on UDP multicast
Routing activation: tester sends activation request; gateway authenticates and opens TCP session
Diagnostic messages: UDS requests forwarded by gateway to target ECU
Alive check: periodic UDP messages maintain connection
Entity status: gateway reports active connections and available memory

4. Hardware Implementation

DoIP gateway: Automotive Ethernet switch + gateway ECU (NXP S32G)
Tester side: PC with DoIP stack, Vector VN5640, PEAK PCAN-Ethernet
Target ECU: receives UDS via CAN from gateway
Ethernet PHY: 100BASE-T1 (BroadR-Reach) for in-vehicle; 1000BASE-T for OBD-II port
OBD-II Ethernet: Pin 1 and 9 (or 3 and 11) for 100BASE-T1

5. Register-Level / Configuration

// DoIP client (simplified) — Python pseudocode in C style
void DoIP_VehicleIDRequest(uint8_t *vin_filter) {
    uint8_t pkt[9]={0xFD,0x02,0x00,0x01,0,0,0,0}; // payload type 0x0001, len=0
    UDP_SendBroadcast(13400,pkt,8);
}
void DoIP_RoutingActivation(uint16_t src_addr) {
    uint8_t pkt[11]={0xFD,0x02,0x00,0x05,0,0,0,3,src_addr>>8,src_addr&0xFF,0x00};
    TCP_Send(13400,pkt,11);
}
void DoIP_SendUDS(uint16_t src,uint16_t tgt,uint8_t *uds,uint16_t ulen) {
    // Header + src(2) + tgt(2) + UDS
    uint32_t total=4+ulen;
    uint8_t hdr[8]={0xFD,0x02,0x80,0x01,total>>24,total>>16,total>>8,total&0xFF};
    TCP_Send(13400,hdr,8); TCP_Send(13400,(uint8_t*)&src,2);
    TCP_Send(13400,(uint8_t*)&tgt,2); TCP_Send(13400,uds,ulen);
}

6. Driver / Software Development

Implement init, TX, RX functions; use interrupts or DMA
Handle errors: timeout, CRC mismatch, arbitration loss
Use circular/ring buffers for high-throughput RX
Add retry logic and watchdog for reliability
Separate hardware layer from protocol logic

7. Debugging & Testing

Wireshark: DoIP dissector built-in; filter with 'doip'
Vector CANoe with DoIP option
Common issues: routing activation rejected (wrong auth); TCP connection dropped; wrong logical address
Check DoIP gateway configuration for allowed tester addresses

8. Real-World Applications

Over-the-air ECU firmware updates (OTA)
High-speed factory-end-of-line programming
Remote diagnostics via telematics ECU
Multi-ECU simultaneous flash in production
Cloud-based vehicle health monitoring

9. Advanced Topics & Edge Cases

DoIP + TLS: Secure OTA using TLS over TCP
Vehicle REST API: OEM cloud ↔ DoIP gateway ↔ ECU
DoIP over 5G: Cellular-connected vehicle OTA
Automotive Ethernet backbone: 100BASE-T1 between ECUs; DoIP runs on top
AUTOSAR: DoIP module standardized in AUTOSAR 4.x

10. Standards & Variants

Protocol	Transport	Speed	Notes
DoIP	TCP/UDP	100+ Mbps	Ethernet, OTA
UDS on CAN	ISO-TP	1 Mbps	In-vehicle
UDS on LIN	LIN	20 kbps	Body electronics
KWP2000	K-line	10 kbps	Legacy

💡 Practical Examples

Example 1

Discovery: broadcast Vehicle ID Request → gateway responds with VIN + logical addresses

Example 2

Flash ECU: routing activation → 0x10 03 (prog session) → 0x27 (security) → 0x34/36/37

Example 3

Remote diagnostics: cloud sends DoIP over cellular; reads DTCs from all ECUs simultaneously

🧪 Practice Questions

Beginner

What port does DoIP use?
What is a DoIP gateway?
What is routing activation?
What carries diagnostic data in DoIP?
How fast is DoIP compared to CAN-based UDS?

Intermediate

Implement DoIP vehicle discovery (UDP broadcast + response parsing).
Send a UDS Read Data message via DoIP TCP connection.
How does DoIP handle multi-ECU routing?
Implement DoIP routing activation with OEM extension.
Secure DoIP with TLS for OTA updates.

Advanced

Build a complete DoIP client tool that discovers and flashes ECUs.
Implement DoIP gateway bridging Ethernet to CAN.
Create OTA update system: cloud → DoIP → 5 ECUs simultaneously.
Add certificate-based authentication to DoIP gateway.
Implement DoIP entity status and alive check properly.

Hands-on Projects

DoIP Tester: Python tool discovering ECUs and reading DTCs via DoIP.
Gateway Simulator: STM32 + Ethernet acts as DoIP gateway.
OTA Demo: send firmware update from laptop to ECU via DoIP TCP.

Checklist

[ ] Explain DoIP architecture and payload types
[ ] Implement vehicle ID request/response
[ ] Implement routing activation
[ ] Send UDS messages via DoIP TCP
[ ] Handle diagnostic ACK/NACK
[ ] Use Wireshark DoIP dissector
[ ] Connect to real vehicle DoIP port
[ ] Implement DoIP gateway forwarding
[ ] Secure with TLS
[ ] Build OTA update pipeline

← Previous Next →