Service Interaction Protocol

Communication Control

0x28

Protocol Identifier

Enables or disables specific types of network communication on an ECU, primarily for preventing interference during firmware updates.

Overview

ISO 14229-1

“The CommunicationControl service is used by the client to switch on/off the transmission and/or reception of certain messages of the server.”

Primary Purpose

Isolate target ECU for flashing
Reduce bus load during diagnostics
Disable Network Management (NM)
Manage multi-node architectures

Critical Notes

Diagnostic communication is never disabled by this service. The ECU must always remain responsive to the tester.

Control Logic

SID 0x28 acts as a gatekeeper for different message types. By specifying the Communication Type, you can selectively block application data while keeping network management alive, or vice-versa.

Click to Enlarge

Selective isolation of Normal vs. Network Management communication paths.

When to Use SID 0x28

🔄 Firmware Updates

Isolate ECU during flash programming to prevent network interference and bus errors.

🔧 Diagnostics

Test one ECU without interference from others. Reduce bus load during sensitive operations.

📦 Production Line

EOL testing with controlled communication environment. Configure VIN/calibration safely.

Interactive Control Type Explorer

Explore how different control types enable/disable RX and TX on the ECU bus. Click on a control type to see how the request bytes are assembled.

Control Type

Communication Type

All non-diagnostic messages

ECU Bus State

✓RX

✓TX

Restore normal operation

Request Bytes

[28·01·03]

SID

Control

Comm Type

ⓘ Diagnostic Messages Unaffected

Diagnostic messages (0x7DF, SID 0x3E Tester Present) are NEVER affected by control type changes. Only application and network management messages are controlled.

Current Control Type Details

Code

0x01

Name

RX+TX (Normal)

RX State

✓ Enabled

TX State

✓ Enabled

Sub-functions & Types

Understand the byte-level anatomy of a CommunicationControl request and how each byte controls the ECU’s communication state.

SID_0x28 — MESSAGE_FRAME_VISUALIZER

REQUEST — [3 BYTES]

SID

ControlType

CommType

28 03 03

POSITIVE RESPONSE — [2 BYTES]

Resp SID

ControlType

68 03

FRAME_BUILDER

Control Type (byte 2)

Communication Type (byte 3)

SID

ControlType

CommType

Node ID

Control Types (Sub-function)

Byte 1: Controls whether RX and/or TX are enabled or disabled

Value	Action	RX State	TX State	Use Case
0x00	Enable RX, Disable TX	Enabled	Disabled	Listen-only mode
0x01	Enable RX and TX	Enabled	Enabled	Normal operation (restore)
0x02	Disable RX, Enable TX	Disabled	Enabled	Transmit-only (rare)
0x03	Disable RX and TX	Disabled	Disabled	Complete isolation (flash)
0x04	RX only + Enhanced	Enabled	Disabled	Advanced addressing
0x05	RX & TX + Enhanced	Enabled	Enabled	Advanced addressing

Note: Diagnostic messages (0x7DF, SID 0x3E, etc.) are NEVER affected by control type. Only application and network management messages are controlled.

Communication Types

Byte 2: Specifies which message categories are controlled

Value	Type	Controls	Description
0x01	Normal	App messages	Engine RPM, vehicle speed, sensor data, actuator commands
0x02	Network Mgmt	NM messages	Node alive, sleep requests, network state transitions
0x03	Both	All non-diagnostic	Combined: normal + NM + all application-layer messages

Subnet & Node Targeting

Bytes 3-4 (optional): Target specific ECU or subnet

Message Length	Format	Effect
3 bytes	[28 CC TT]	Apply to ALL subnets and nodes
5 bytes	[28 CC TT NN NN]	Apply ONLY to specified node ID (Bytes 3-4)

Example: [28 03 03] = Disable all RX/TX on all subnets

Example: [28 03 03 F0 00] = Disable all RX/TX only on subnet 0xF0 (Powertrain)

Session & Security Requirements

Understand which sessions and security levels are required for different SID 0x28 operations.

Session × Operation Access Matrix — SID 0x28

ISO 14229-1 §9.4

Session	Dis. Normal 0x01	Dis. All 0x03	Subnet 0x04–0x05	Re-enable 0x00
Default Session 0x01	NRC 0x7E	NRC 0x7E	NRC 0x7E	NRC 0x7E	▾
Extended Session 0x03	Allowed	Secured	Allowed	Allowed	▾
Programming Session 0x02	Allowed	Secured	Allowed	Allowed	▾

DIAGNOSTIC MESSAGES UNAFFECTED

SID 0x28 never blocks UDS diagnostic traffic. Functional addressing (0x7DF), SID 0x3E Tester Present, and all service responses remain active in all states. Only application and NM messages are controlled.

SESSION RESTORE BEHAVIOUR

ECU Reset (SID 0x11), S3 session timeout, or power cycle automatically restores full communication (0x00 — enableRxAndTx) regardless of active control state.

Required Session Type

Session	SID 0x28 Allowed?	Notes
DEFAULT (0x01)	❌ Usually NO	Service typically not available in default session
EXTENDED (0x03)	✅ YES	Standard for diagnostics and isolated operations
PROGRAMMING (0x02)	✅ YES	Standard for firmware updates

warning _entry

Session Timeout: If session times out and reverts to DEFAULT, SID 0x28 becomes unavailable and communication automatically restores to normal. Use SID 0x3E (TesterPresent) every 2 seconds to maintain session.

Security Requirements

Operation	Security Required?	When
Disable normal messages	⚠️ Sometimes	Depends on ECU configuration
Disable ALL communication	✅ Usually YES	Safety-critical operation
Subnet-specific control	✅ Usually YES	Requires unlocking
Re-enable communication	⚠️ Sometimes	Some ECUs require re-unlock

Typical Security Flow:

[10 03] → Extended Session

[27 01] → Request Seed

[27 02 KEY] → Send Key (Unlock)

[28 03 03] → Now communication control works

Examples

Full Isolation (Pre-Flash)

tx_packet

Request

28 03 03

> Disable RX/TX for All message types

rx_packet

Response

68 03

> Isolation successful

Restore Normal Communication

tx_packet

Request

28 01 03

> Enable RX/TX for All message types

rx_packet

Response

68 01

> Normal signaling resumed

Communication State Machine

SID 0x28 transitions the ECU between different communication states. The interactive state machine below shows all valid transitions and auto-restore triggers.

ECU_COMM_STATE_MACHINE — SID 0x28

NORMAL_MODE

0x00

NORMAL MODE

RX ONTX ON

0x01

RX ONLY

RX ONTX OFF

0x02

TX ONLY

RX OFFTX ON

0x03

ISOLATED

RX OFFTX OFF

NORMAL MODE — 0x00

Full communication enabled. ECU receives and transmits all application and NM messages normally.

Default operating state after power-on or ECU reset.

VALID_TRANSITIONS

NORMAL MODE0x01enableRxAndDisableTxRX ONLY

NORMAL MODE0x02disableRxAndEnableTxTX ONLY

NORMAL MODE0x03disableRxAndTx[SID 0x27]ISOLATED

ANY0x00enableRxAndTxNORMAL MODE

SEND_COMMAND — [28 CC TT]

Control Type (CC)

Comm Type (TT)

[28·01·03]SID · controlType · commType

AUTO-RESTORE — always returns to NORMAL_MODE

Already in NORMAL_MODE. Use Send Command to enter a restricted state first.

TRANSITION_LOG

1 entry

1NORMAL MODEInitial State—

DIAGNOSTIC MESSAGES UNAFFECTED

SID 0x28 never gates diagnostic communication. Functional addressing (0x7DF), SID 0x3E Tester Present, and all UDS service responses remain active regardless of comm state. Only application and NM messages are controlled.

Isolation Simulator

Watch the complete firmware flash isolation lifecycle in action. Play, pause, and control the speed to understand each step of the secure programming sequence.

Phase 1/6 — SESSION

0.0s / 15.0s

Tester → ECU

10 02

DiagnosticSessionControl — Enter Programming Session

BUS

NORMAL

ECU → Tester

Waiting...

Speed:

Space play/pause · ←→ step phases

BUS STATES

Normal — RX + TX active

Isolated — RX + TX disabled

3E 80 — TesterPresent keep-alive

info _entry

Persistence: Communication control is volatile. An ECU Reset (0x11) or session timeout (P3 timeout) will restore normal communication automatically.

Key Behavior:

• Diagnostic RX/TX always work: TesterPresent (0x3E), session control (0x10), etc. cannot be blocked
• Session change (Extended → Default): Communication automatically restored to normal
• Session change (Extended ↔ Programming): Communication state is preserved
• During isolation: Send TesterPresent [3E 80] every 2 seconds to maintain session and prevent timeout

Multi-Service Integration

Standard Protected Operation Pattern

[10 XX] → [27 01/02] → [28 03 03] → [Operation] → [28 01 03] → [10 01]
Session Security Isolate Do Work Restore Exit

Service Dependencies

Primary Service	SID 0x10	SID 0x27	SID 0x3E	Notes
SID 0x28	Required (Ext/Prog)	Optional	Required during long ops	Core isolation service
Flash (0x34/36/37)	Prog Session	Usually required	Every 2 seconds	Isolation critical
Write Data (0x2E)	Extended/Prog	Often required	If slow write	RX-only mode option
Routines (0x31)	Extended	Sometimes required	If long routine	Network-quiet execution

TesterPresent Integration During Isolation

When communication is disabled, diagnostic messages (including TesterPresent) still work:

T=0s [28 03 03] → [68 03] (Isolated)

T=2s [3E 80] → (No response, suppressed)

T=4s [3E 80] → (Session kept alive)

T=6s [3E 80] → (Continue every 2s)

Use 0x80 subflag to suppress response and reduce bus load.

Flash Programming Workflow

Phase 1:[10 02] Programming session → [50 02 …]

Phase 2:[27 01/02] Security unlock → [67 02]

Phase 3:ISOLATE: [28 03 03] → [68 03] (CRITICAL)

Phase 4:[34 …] Download, [36 …] Transfer (with [3E 80] every 2s), [37] Exit

Phase 5:RESTORE: [28 01 03] → [68 01]

Phase 6:[11 01] Reset → [51 01] (Boot new firmware)

Negative Response Codes

NRC	Name	Common Cause
0x12	Sub-Function Not Supported	Invalid control type (0x06+) or unsupported enhanced addressing
0x13	Incorrect Message Length	Not 3 or 5 bytes; incomplete Node ID
0x22	Conditions Not Correct	Vehicle in motion, engine running, or critical system active
0x31	Request Out Of Range	Invalid communication type (0x00, 0x04+)
0x33	Security Access Denied	ECU still locked; requires security unlock first
0x7F	Service Not Supported In Session	Using in DEFAULT session; session timeout occurred

Interactive NRC Decoder

Click an NRC card below to see the error description, what causes it, and how to recover.

Select an NRC to decode

Click a card to view description, message trace, and recovery steps.

Select an NRC code above to see description, message trace, and recovery steps.

Troubleshooting Guide

Encounter an issue? Select your symptom below to get a guided diagnostic checklist with ISO 14229 best practices.

SID_0x28 / TROUBLESHOOTING

Select a symptom card above to open the diagnostic checklist.

🔴 Communication Not Disabled

Symptom: Sent [28 03 03] but ECU still transmitting

✓ Check Response: Did you receive [68 03]? If [7F 28 XX], check NRC code
✓ Diagnostic Messages Normal: SID 0x28 NEVER disables diagnostics. Ignore [7E 80] responses (TesterPresent)
✓ Wrong Communication Type: Tried type 0x01 (normal only)? Use type 0x03 (both normal + NM)
✓ Wrong Subnet Target: Did you specify a subnet that’s not active? Try without Node ID
✓ Use Network Monitor: Verify with CAN/LIN analyzer that normal/NM messages are silent

🔴 Cannot Re-Enable Communication

Symptom: Disabled with [28 03 03] but [28 01 03] doesn’t restore

✓ Check Response Code: Did you get [68 01]? Or [7F 28 XX]?
✓ Session Timeout: Did session revert to DEFAULT? Use [22 F1 86] to read active session
✓ Security Locked: Re-unlock with [27 01/02] if required
✓ Subnet Mismatch: Did you disable [28 03 03 F0 00] but enable [28 01 03] (no subnet)? Use matching Node IDs
✓ Last Resort: ECU Reset [11 01] automatically restores all communication

🔴 Flash Programming Timeout After Isolation

Symptom: [28 03 03] works, but flash fails with timeout or NRC 0x78

✓ TesterPresent Not Sent: Send [3E 80] every 2 seconds throughout flash operation
✓ Diagnostic Subnet Disabled: Only disable non-diagnostic subnets, keep tester interface active
✓ Timing Issue: Wait 100ms after [28 03 03] before sending [34 …] command
✓ Power Supply: Ensure external power supply is stable; TX disable may affect power management
✓ Protocol Sequence: Verify [28 03 03] → wait 100ms → [34 …] → [3E 80] every 2s → [36] blocks

🔴 Always Getting NRC 0x7F

Symptom: SID 0x28 never works, always returns NRC 0x7F

✓ Check Session: Use [22 F1 86] to verify you’re in EXTENDED (0x03) or PROGRAMMING (0x02)
✓ Enter Session First: Send [10 03] to enter Extended session, then retry [28 03 03]
✓ Session Timeout: Session may have expired. Use [3E 80] to keep session alive
✓ ECU Doesn’t Support: Some ECUs don’t support SID 0x28. Check ECU datasheet
✓ Reset ECU: Power cycle and retry with proper session sequence

Quick Reference

SID 0x28 Quick Reference

16 ready-to-send commands across 4 categories. Click the byte string to copy.

Showing all 16 commands

Disable Rx+Tx (Normal)Disable both Rx and Tx for normal communication. Use before ECU flash.

280301

Session: EXTENDED (0x03)NRCs: 0x22, 0x31

controlType=0x03 = disableRxAndTx per ISO 14229

Disable Tx Only (Normal)Suppress Tx while ECU still receives. Allows one-way diagnostic listening.

280101

Session: EXTENDED (0x03)NRCs: 0x22, 0x31

controlType=0x01 = enableRxAndDisableTx per ISO

Disable Rx+Tx (NM Comm)Suppress network management messages. Isolates NM layer during programming.

280302

Session: EXTENDED (0x03)NRCs: 0x22, 0x31

commType=0x02 targets NM traffic only

Disable All ChannelsFull bus isolation — disables both normal comm and NM simultaneously.

280303

Session: EXTENDED (0x03)NRCs: 0x22, 0x31

commType=0x03 = normalAndNmComm. Most aggressive isolation.

Enable Rx+Tx (Normal)Restore full normal communication. Required after disable operations.

280001

Session: EXTENDED (0x03)NRCs: 0x22

controlType=0x00 = enableRxAndTx. Session reset also restores.

Enable Rx+Tx (NM Comm)Restore network management messaging after NM suppression.

280002

Session: EXTENDED (0x03)NRCs: 0x22

Must re-enable NM before transitioning back to DEFAULT session

Enable All ChannelsRestore full bus operation in one request — normal comm + NM together.

280003

Session: EXTENDED (0x03)NRCs: 0x22

Preferred recovery command after programming sequence ends

Session Reset → RestoreReturn to DEFAULT session — ECU auto-restores all comm channels on session change.

1001

Session: ANY

Implicit restore. Useful when explicit 0x28 re-enable is unavailable.

Disable Rx Only (Normal)Silence incoming normal comm — ECU still transmits. Rare but ISO-compliant.

280201

Session: EXTENDED (0x03)NRCs: 0x22, 0x31

controlType=0x02 = disableRxAndEnableTx

Disable Tx Only (NM)Stop NM transmissions while keeping NM Rx active. Useful in gateway ECUs.

280102

Session: EXTENDED (0x03)NRCs: 0x22, 0x31

Allows monitoring of incoming NM without polluting the bus

Enable Rx Only (Normal)Activate enhanced Rx addressing. Accepts messages to additional logical addresses.

280401

Session: EXTENDED (0x03)NRCs: 0x22, 0x31

controlType=0x04 = enableRxAndDisableTx (enhanced addr.) — not universally supported

Disable Tx Normal+NMSuppress Tx on both normal and NM channels simultaneously.

280103

Session: EXTENDED (0x03)NRCs: 0x22, 0x31

Combined commType=0x03 with Tx-disable only. Less drastic than full isolation.

Subnet-Level DisableDisable comm for a specific subnet node using subnet ID byte (optional 4th byte).

280301FE

Session: EXTENDED (0x03)NRCs: 0x22, 0x31, 0x35

Subnet ID 0xFE = all nodes. ECU-specific — verify ODX before use.

Confirm Active SessionRead DID 0xF186 to confirm EXTENDED session before issuing 0x28 commands.

22F186

Session: ANYNRCs: 0x31

Response byte 4 = session ID: 0x01 DEFAULT, 0x03 EXTENDED

TesterPresent (no resp)Keep EXTENDED session alive while comm is disabled. Send every 3–4 seconds.

3E80

Session: EXTENDED (0x03)

Subfunction 0x80 = suppress response. Critical during long 0x28 isolation windows.

NRC 0x22 RecoveryWhen ECU returns NRC 0x22 (conditionsNotCorrect), re-enable all channels and retry.

280003

Session: EXTENDED (0x03)NRCs: 0x22

NRC 0x22 often means a prior disable was partial. Full re-enable before retry.

Service Interaction Protocol

Communication Control

Overview

Primary Purpose

Critical Notes

Control Logic

When to Use SID 0x28

🔄 Firmware Updates

🔧 Diagnostics

📦 Production Line

Interactive Control Type Explorer

Sub-functions & Types

Control Types (Sub-function)

Communication Types

Subnet & Node Targeting

Session & Security Requirements

Required Session Type

Security Requirements

Examples

Full Isolation (Pre-Flash)

Request

Response

Restore Normal Communication

Request

Response

Communication State Machine

Isolation Simulator

Key Behavior:

Multi-Service Integration

Standard Protected Operation Pattern

Service Dependencies

TesterPresent Integration During Isolation

Flash Programming Workflow

Negative Response Codes

Interactive NRC Decoder

Troubleshooting Guide

🔴 Communication Not Disabled

🔴 Cannot Re-Enable Communication

🔴 Flash Programming Timeout After Isolation

🔴 Always Getting NRC 0x7F

Quick Reference

SID 0x28 Quick Reference

Best Practices