Service Interaction Protocol
Communication Control
Overview
“The CommunicationControl service is used by the client to switch on/off the transmission and/or reception of certain messages of the server.”
Primary Purpose
- Isolate target ECU for flashing
- Reduce bus load during diagnostics
- Disable Network Management (NM)
- Manage multi-node architectures
Critical Notes
Diagnostic communication is never disabled by this service. The ECU must always remain responsive to the tester.
Control Logic
SID 0x28 acts as a gatekeeper for different message types. By specifying the Communication Type, you can selectively block application data while keeping network management alive, or vice-versa.
Selective isolation of Normal vs. Network Management communication paths.
When to Use SID 0x28
🔄 Firmware Updates
Isolate ECU during flash programming to prevent network interference and bus errors.
🔧 Diagnostics
Test one ECU without interference from others. Reduce bus load during sensitive operations.
📦 Production Line
EOL testing with controlled communication environment. Configure VIN/calibration safely.
Interactive Control Type Explorer
Explore how different control types enable/disable RX and TX on the ECU bus. Click on a control type to see how the request bytes are assembled.
All non-diagnostic messages
Diagnostic messages (0x7DF, SID 0x3E Tester Present) are NEVER affected by control type changes. Only application and network management messages are controlled.
Message Structure
Understand the byte-level anatomy of a CommunicationControl request and how each byte controls the ECU’s communication state.
◆ PROTOCOL ANATOMY
0x28 COMMUNICATION CONTROL
0x28 RESPONSE
Control Types (Sub-function)
Byte 1: Controls whether RX and/or TX are enabled or disabled
| Value | Action | RX State | TX State | Use Case |
|---|---|---|---|---|
| 0x00 | Enable RX, Disable TX | Enabled | Disabled | Listen-only mode |
| 0x01 | Enable RX and TX | Enabled | Enabled | Normal operation (restore) |
| 0x02 | Disable RX, Enable TX | Disabled | Enabled | Transmit-only (rare) |
| 0x03 | Disable RX and TX | Disabled | Disabled | Complete isolation (flash) |
| 0x04 | RX only + Enhanced | Enabled | Disabled | Advanced addressing |
| 0x05 | RX & TX + Enhanced | Enabled | Enabled | Advanced addressing |
Note: Diagnostic messages (0x7DF, SID 0x3E, etc.) are NEVER affected by control type. Only application and network management messages are controlled.
Communication Types
Byte 2: Specifies which message categories are controlled
| Value | Type | Controls | Description |
|---|---|---|---|
| 0x01 | Normal | App messages | Engine RPM, vehicle speed, sensor data, actuator commands |
| 0x02 | Network Mgmt | NM messages | Node alive, sleep requests, network state transitions |
| 0x03 | Both | All non-diagnostic | Combined: normal + NM + all application-layer messages |
Subnet & Node Targeting
Bytes 3-4 (optional): Target specific ECU or subnet
| Message Length | Format | Effect |
|---|---|---|
| 3 bytes | [28 CC TT] | Apply to ALL subnets and nodes |
| 5 bytes | [28 CC TT NN NN] | Apply ONLY to specified node ID (Bytes 3-4) |
Example: [28 03 03] = Disable all RX/TX on all subnets
Example: [28 03 03 F0 00] = Disable all RX/TX only on subnet 0xF0 (Powertrain)
Response Suppression Logic
Setting the suppressPosRspMsgIndicationBit (bit 7) allows disabling communication silently without generating positive response traffic on the bus.
!Critical: NRC 0x7F bypasses suppression logic and will always broadcast.
Session & Security Requirements
Understand which sessions and security levels are required for different SID 0x28 operations.
Session & Security Matrix
Which CommunicationControl sub-functions execute in each session, and security requirements. Select a row for details.
| Control Type & Sub-function | DEFAULT 0x01 | EXTENDED 0x03 | PROGRAMMING 0x02 | Security |
|---|---|---|---|---|
| ✗ | ✓ | ✓ | — | |
| ✗ | ✓ | ✓ | — | |
| ✗ | ✓ | ✓ | — | |
| ✗ | ✓ | ✓ | Level 1 | |
| ✗ | ✓ | ✓ | Level 1 |
Required Session Type
| Session | SID 0x28 Allowed? | Notes |
|---|---|---|
| DEFAULT (0x01) | ❌ Usually NO | Service typically not available in default session |
| EXTENDED (0x03) | ✅ YES | Standard for diagnostics and isolated operations |
| PROGRAMMING (0x02) | ✅ YES | Standard for firmware updates |
Session Timeout: If session times out and reverts to DEFAULT, SID 0x28 becomes unavailable and communication automatically restores to normal. Use SID 0x3E (TesterPresent) every 2 seconds to maintain session.
Security Requirements
| Operation | Security Required? | When |
|---|---|---|
| Disable normal messages | ⚠️ Sometimes | Depends on ECU configuration |
| Disable ALL communication | ✅ Usually YES | Safety-critical operation |
| Subnet-specific control | ✅ Usually YES | Requires unlocking |
| Re-enable communication | ⚠️ Sometimes | Some ECUs require re-unlock |
Typical Security Flow:
[10 03] → Extended Session
[27 01] → Request Seed
[27 02 KEY] → Send Key (Unlock)
[28 03 03] → Now communication control works
Security State Behavior
When locked, critical bus isolation commands (such as disabling normal and NM communication across all subnets) return NRC 0x33 (SecurityAccessDenied) on safety-critical ECUs to prevent unauthorized vehicle disabling.
All communication control types (0x00 to 0x05) and subnets are accessible.
Triggered when this service or requested resource requires an active security unlock that has not been granted.
Triggered during unlock attempts if the calculated key fails ECU cryptographic verification.
Enforced delay lockout if the maximum number of failed key submissions (typically 3) has been exceeded.
Communication State Machine
SID 0x28 transitions the ECU between different communication states. The interactive state machine below shows all valid transitions and auto-restore triggers.
0x000x010x020x03Full communication enabled. ECU receives and transmits all application and NM messages normally.
Default operating state after power-on or ECU reset.
0x01enableRxAndDisableTxRX ONLY0x02disableRxAndEnableTxTX ONLY0x03disableRxAndTx[SID 0x27]ISOLATED0x00enableRxAndTxNORMAL MODEAlready in NORMAL_MODE. Use Send Command to enter a restricted state first.
—SID 0x28 never gates diagnostic communication. Functional addressing (0x7DF), SID 0x3E Tester Present, and all UDS service responses remain active regardless of comm state. Only application and NM messages are controlled.
Isolation Simulator
Watch the complete firmware flash isolation lifecycle in action. Play, pause, and control the speed to understand each step of the secure programming sequence.
Simulate session setup, security unlock, bus shutdown, payload transfer, and reboot sequence.
10 02DiagnosticSessionControl50 02 00 19 01 F4SessionResponse27 03SecurityAccess (Seed)67 03 4A 2B 9C 1DSeedResponse27 04 5F 58 CB 68SecurityAccess (Key)67 04SecurityGranted28 03 03CommunicationControl68 03Comm Control Confirmed34 00 44 00 08 00 00 10 00RequestDownload74 20 01 00Download Accepted36 01 DE AD BE EF ...TransferData76 01Block Transferred OK3E 80TesterPresent36 02 C0 FF EE 00 ...TransferData76 02Block Transferred OK37RequestTransferExit77Transfer Exit OK28 00 03CommunicationControl68 00Comm Control Confirmed11 01ECUReset51 01Reset AcknowledgedPress Simulate to animate the full message sequence.
Persistence: Communication control is volatile. An ECU Reset (0x11) or session timeout (P3 timeout) will restore normal communication automatically.
Key Behavior:
- • Diagnostic RX/TX always work: TesterPresent (0x3E), session control (0x10), etc. cannot be blocked
- • Session change (Extended → Default): Communication automatically restored to normal
- • Session change (Extended ↔ Programming): Communication state is preserved
- • During isolation: Send TesterPresent [3E 80] every 2 seconds to maintain session and prevent timeout
Multi-Service Integration
Standard Protected Operation Pattern
[10 XX] → [27 01/02] → [28 03 03] → [Operation] → [28 01 03] → [10 01]
Session Security Isolate Do Work Restore Exit
0x28 silences non-diagnostic CAN network communication to optimize bandwidth for flashing and calibration. Select a node to inspect interactions.
TesterPresent Integration During Isolation
When communication is disabled, diagnostic messages (including TesterPresent) still work:
T=0s [28 03 03] → [68 03] (Isolated)
T=2s [3E 80] → (No response, suppressed)
T=4s [3E 80] → (Session kept alive)
T=6s [3E 80] → (Continue every 2s)
Use 0x80 subflag to suppress response and reduce bus load.
Flash Programming Workflow
Negative Response Codes
EXCEPTION_MATRIX_V3
The controlType parameter (sub-function) is not supported (only 0x00, 0x01, 0x02, 0x03, 0x04, 0x05 are valid).
This negative response indicates a rejection while processing the Communication Control (SID 0x28) request. Verify preconditions, session levels, and message formatting per ISO 14229.
Troubleshooting Guide
Encounter an issue? Select your symptom below to get a guided diagnostic checklist with ISO 14229 best practices.
Select a symptom card above to open the diagnostic checklist.
Quick Reference
SID 0x28 Quick Reference
16 ready-to-send commands across 4 categories. Click the byte string to copy.
Showing all 16 commands
controlType=0x03 = disableRxAndTx per ISO 14229
controlType=0x01 = enableRxAndDisableTx per ISO
commType=0x02 targets NM traffic only
commType=0x03 = normalAndNmComm. Most aggressive isolation.
controlType=0x00 = enableRxAndTx. Session reset also restores.
Must re-enable NM before transitioning back to DEFAULT session
Preferred recovery command after programming sequence ends
Implicit restore. Useful when explicit 0x28 re-enable is unavailable.
controlType=0x02 = disableRxAndEnableTx
Allows monitoring of incoming NM without polluting the bus
controlType=0x04 = enableRxAndDisableTx (enhanced addr.) — not universally supported
Combined commType=0x03 with Tx-disable only. Less drastic than full isolation.
Subnet ID 0xFE = all nodes. ECU-specific — verify ODX before use.
Response byte 4 = session ID: 0x01 DEFAULT, 0x03 EXTENDED
Subfunction 0x80 = suppress response. Critical during long 0x28 isolation windows.
NRC 0x22 often means a prior disable was partial. Full re-enable before retry.