Back

ISO_TP

Loading views...
← PreviousNext →

ISO-TP (ISO 15765-2)

Overview

ISO-TP (ISO 15765-2) is the transport protocol layer used to carry large diagnostic messages over CAN. It segments data up to 4095 bytes into CAN frames and handles flow control, making it the transport for OBD-II diagnostic services and UDS.

1. Theory & Fundamentals

  • Sits between CAN (data link) and UDS/OBD-II (application)
  • Max payload: 4095 bytes per PDU
  • Single Frame (SF): up to 7 bytes — most OBD-II fits
  • Multi-frame: First Frame (FF) + Consecutive Frames (CF)
  • Flow Control (FC): Receiver controls TX pacing (block size, separation time)
  • Normal (N) and extended (NE) addressing modes
  • CAN IDs: 0x7DF functional, 0x7E0–0x7E7 physical

2. Frame / Packet Structure

Single Frame (SF): PCI=0x0N (N=length 1–7)
  [0x0N] [D1..DN]
First Frame (FF): PCI=0x1H, 0xLL (total length)
  [0x1H][0xLL] [D1..D6] (6 bytes of data)
Consecutive Frame (CF): PCI=0x2S (S=sequence 0–F)
  [0x2S] [D1..D7] (7 bytes of data)
Flow Control (FC): PCI=0x3F
  [0x30|FS] [BS] [STmin]
  FS: 0=CTS, 1=Wait, 2=Overflow
  BS: block size (0=send all)
  STmin: separation time (0–127 ms)

3. Protocol Mechanics

  • Sender waits for FC after every FF, and after every BS consecutive frames
  • STmin enforced between consecutive frames
  • Sequence counter wraps 0x0F→0x00
  • Timeout: NBs, NCr timers defined by spec
  • Padding: unused bytes filled with 0xCC (or per application)

4. Hardware Implementation

  • Implemented in software above CAN peripheral
  • isotp Linux kernel module for SocketCAN
  • Arduino isotp library
  • STM32: custom implementation above HAL CAN
  • Test with ELM327 / PEAK PCAN + diagnostic tool

5. Register-Level / Configuration

// Minimal ISO-TP transmit (single frame only)
void ISOTP_Send(uint32_t tx_id, uint8_t *data, uint8_t len) {
    if(len<=7) {
        uint8_t frame[8]={0};
        frame[0]=len; // SF PCI
        memcpy(&frame[1],data,len);
        CAN_Send(tx_id,frame,8);
    } // multi-frame: implement FF+CF+FC state machine
}
// Receive: parse PCI byte, reassemble CF into buffer

6. Driver / Software Development

  • Implement init, TX, RX functions; use interrupts or DMA
  • Handle errors: timeout, CRC mismatch, arbitration loss
  • Use circular/ring buffers for high-throughput RX
  • Add retry logic and watchdog for reliability
  • Separate hardware layer from protocol logic

7. Debugging & Testing

  • SavvyCAN with ISO-TP decode
  • Kvaser / PCAN with diagnostic software
  • Common issues: STmin too short → buffer overflow; wrong block size; sequence counter mismatch
  • Log all CAN frames; trace FF→CF→FC sequence

8. Real-World Applications

  1. OBD-II multi-frame responses (many DTCs)
  2. UDS firmware download (large blocks)
  3. Calibration data upload to ECU
  4. Event data recorder read-out
  5. ECU software update (FOTA)

9. Advanced Topics & Edge Cases

  • Extended addressing: 1-byte address prefix for multi-ECU on one CAN ID
  • Remote diagnostics: DoIP (Diagnostics over IP) uses similar segmentation
  • CAN FD ISO-TP: Up to 64-byte frames, far fewer CF needed
  • N_PDU padding: ISO 15765-4 mandates 0xCC padding to 8 bytes

10. Standards & Variants

Frame Byte 0 Max data Notes
SF 0x0N 7 bytes N=length
FF 0x1H+0xLL 6 bytes start of long msg
CF 0x2S 7 bytes S=sequence
FC 0x3F+FS+BS+ST - flow control

💡 Practical Examples

Example 1

Read ECU DTCs: Request Mode $03 → FF returns count + first 3 DTCs → CF for rest

Example 2

UDS read data: 0x22 0xF190 (VIN) → multi-frame 17-byte VIN in FF+CF

Example 3

Flow control: BS=5, STmin=10ms → sender transmits 5 CF, waits for next FC

🧪 Practice Questions

Beginner

  1. What are the 4 ISO-TP frame types?
  2. What is the maximum ISO-TP payload size?
  3. What does BS mean in Flow Control?
  4. When is a Single Frame used?
  5. What CAN IDs are used for OBD-II?

    6. Intermediate

  6. Implement ISO-TP transmit state machine for payloads up to 4095 bytes.
  7. Handle FC Wait (FS=1) in transmit state machine.
  8. What padding value does ISO 15765-4 require?
  9. Implement ISO-TP receive with timeout handling.
  10. How does CAN FD improve ISO-TP efficiency?

    11. Advanced

  11. Build complete ISO-TP stack with all frame types and timeouts.
  12. Implement UDS service 0x34/0x36/0x37 for flash download over ISO-TP.
  13. Port isotp Linux module to bare-metal STM32.
  14. Add extended addressing support.
  15. Test ISO-TP with CAN FD frames (up to 64 bytes).

    16. Hands-on Projects

  16. UDS Flasher: send firmware in 1 KB blocks over ISO-TP/UDS.
  17. DTC Reader: handle multi-frame DTC responses correctly.
  18. Fuzzer: send malformed ISO-TP frames, check ECU robustness.

Checklist

  • [ ] Explain all 4 frame types with byte layout
  • [ ] Implement single-frame TX/RX
  • [ ] Implement multi-frame TX with FC handling
  • [ ] Implement multi-frame RX with sequence tracking
  • [ ] Handle FC Wait and Overflow
  • [ ] Enforce STmin separation time
  • [ ] Add NBs / NCr timeout watchdogs
  • [ ] Test with real OBD-II scan tool
  • [ ] Integrate with UDS application layer
  • [ ] Debug with SavvyCAN / logic analyzer
← PreviousNext →