XCP Server Protocol

XCP Overview

XCP (Universal Measurement and Calibration Protocol) is a communication protocol standardized by ASAM (Association for Standardization of Automation and Measuring Systems). It enables external tools to interface with ECUs for the purposes of measurement and calibration. XCP is transport-independent, making it adaptable across various communication interfaces such as CAN, Ethernet, FlexRay, LIN, and SxL (SPI and SCI).

The protocol is widely adopted in the automotive and embedded industries due to its flexibility, standardization, and cross-platform compatibility. XCP enables engineers to access internal ECU parameters, observe real-time behavior and tune calibration parameters without recompilation.

Transport Layer Abstraction

XCP operates independently of the physical layer by defining a standardized command set and memory access protocol. Its abstraction model separates the protocol logic from the transport medium, allowing developers to switch between different interfaces (e.g., from CAN to Ethernet) with minimal changes to the upper layers.

Key Capabilities

Measurement: Read internal signals, variables, and memory locations in real time without halting ECU execution.
Calibration: Modify parameters during runtime for optimization and validation, including tuning of control logic.
Memory Access: Perform safe memory read/write operations for debugging, development.
Event and DAQ-Based Acquisition: Enables scheduled or triggered data acquisition for time-synchronized logging.

RAPIDSEA XCP Stack

Embien offers XCP Stack for server configurations. Our implementation supports the standard commands defined by the protocol over the Ethernet transport layer.

Some of the salient features of RAPIDSEA XCP protocol stack are :

Supports standard XCP commands for calibration, measurement, and memory access.

Implements polling-based data acquisition using standard SHORT_UPLOAD and DOWNLOAD commands.

Lightweight, embeddable design suited for real-time environments and compatible with linux.

The implementation can be configured in server mode and is completely flexible.

XCP Server

RAPIDSEA implements an XCP slave that allows a client tool to connect and communicate with it to perform calibration, measurement, and memory access operations

Supported Functionalities

Following commands are supported in the XCP Stack

Supported Functionalities
Command Code	Command Name	Description
0xFF	CONNECT	Initializes a session with the XCP client and establish a connection.
0xFE	DISCONNECT	Terminates the current session with the XCP client
0xFD	GET_STATUS	Returns the current state of the server, including session and resource status.
0xFC	SYNCH	Used to maintain synchronization between client and server.
0xFB	GET_COMM_MODE_INFO	Provides communication configuration details and optional features.
0xF6	SET_MTA	Sets the Memory Address (MTA), which points to the memory address used by upload/download operations.
0xF4	SHORT_UPLOAD	Reads a small block of memory directly from the server using the previously set MTA (Memory Transfer Address).
0xF0	DOWNLOAD	Writes a block of data from the client to server’s memory at the current MTA(Memory Transfer Address) location.
0xDD	START_STOP_SYNC	Starts or stops server-side DAQ (Data Acquisition) processes in synchronous (polling) mode.

Application Interface

While the RAPIDSEA XCP server stack can handle most of the functionality such as client request validation, if it has error request, proper intimation to the client. The RAPIDSEA XCP server clearly defines API and callback functions that are essential for the user to use/implement.

The below table captures the primary function that are to be called from the application logic.

API Functions
Function	Description
rs_xcp_server_open	To Initialize the serial/socket configuration.
rs_xcp_server_run	To set the state to be open
rs_xcp_server_process	To be called periodically to prepare the client response.

The below table contains rcb calls to perform the server stack.

callback Functions
Function	Description
rcb_xcp_server_connect	Called when a CONNECT command is received from the client. Initializes session, displays connected mode and sets default parameters
rcb_xcp_server_disconnect	Called when a DISCONNECT command is received. Used to terminate the active session
rcb_xcp_server_get_status	Called to report current status of the XCP session, including session flags and event states
rcb_xcp_server_sync	Called when a SYNC command is received. Used to synchronize polling-based data acquisition
rcb_xcp_server_get_comm_mode_info	Called to return communication mode capabilities and configuration supported by the server
rcb_xcp_server_set_mta	Called to set the Memory Transfer Address (MTA) pointer for subsequent upload or download operations
rcb_xcp_server_short_upload	Called to write a short block of data into the memory address specified by the MTA
rcb_xcp_server_download	Called to read data from the memory address set via MTA.
rcb_xcp_server_start_stop_synch	Called to start or stop polling-based data acquisition as requested by the client
rcb_xcp_server_unknown_command	Called when an unsupported or unknown command is received. Used for error handling

Implementation Guide

This section explains how to implement the XCP server stack using the RAPIDSEA stack, the steps to be followed are

Initially start the XCP server task from the application layer.
Then the server task state is in idle condition, until the XCP server starts.
XCP server starts change the state from the idle to state open.
In XCP server process, process the client requested command, process it and prepare the response for the client.
In case of a requesting failing or invalid command, error code will be sent from the server as response.

The below diagram captures the high level sequence of operations associated with the XCP server.

High level flow chart is depicted below for XCP server:

XCP Supported Modes

XCP UDP (User Datagram Protocol)

This version of the XCP protocol is implemented for communication over UDP/IP networks linking over port 5555. XCP over UDP allows faster and connectionless data exchange. No additional checksum is implemented at the protocol level. XCP messages are encapsulated directly within UDP datagrams for efficient real-time access to ECU memory for measurement and calibration.

Socket communication header details refer to the socket interface page for more details Socket Interface

XCP Server Stack Memory Usage

The XCP server stack has the size of bytes

XCP server stack RAM consumption

The RAM consumption is different for the each of the interfaces.

RAM Consumption
Interface	Size
UDP	bytes

XCP Server header Details

Documentation from the relevant server header as follows :

XCP server Module.

This file contains the APIs for using xcp server feature

Author: Embien RAPIDSEA Team
Copyright: Embien Technologies India Pvt. Ltd.

Defines

RS_XCP_SERVER_DEBUG_PRINT: Enable (1) or disable (0) debug print messages.

RS_XCP_SERVER_STACK_XCP_VERSION: Overall XCP protocol stack version (Core + Transport Layer)

RS_XCP_SERVER_PROTOCOL_VERSION: XCP Protocol Layer version.

RS_XCP_SERVER_TRANSPORT_LAYER_VERSION: XCP Transport Layer version.

RS_XCP_SERVER_MAX_CTO: Maximum size of Command Transfer Object (CTO) in bytes.

RS_XCP_SERVER_MAX_DTO: Maximum size of Data Transfer Object (DTO) in bytes.

RS_XCP_SERVER_MAX_EVENT: Maximum number of DAQ events supported.

RS_XCP_SERVER_HEADER_LENGTH: Fixed header length for XCP messages.

RS_XCP_SERVER_UDP_BUF_MAX_LEN: Maximum buffer length for UDP communication.

RS_XCP_SERVER_UDP_ADDR_LEN: Length of UDP address buffer.

RS_XCP_SERVER_COMM_TYPE_UDP: Communication type identifier for UDP.

RS_XCP_SERVER_COMM_TYPE_CAN: Communication type identifier for CAN.

RS_TRANSPORT_INTERFACE_ADDR_LEN: Address length for generic transport interface.

RS_XCP_SERVER_DAQ_MEM_SIZE: Size of DAQ memory used to store events or buffers.

RS_XCP_SERVER_CRM_UPLOAD_MAX_SIZE

Maximum payload size for upload response.

Number of bytes in server’s IPv4 address

RS_XCP_SERVER_ADDR_LEN

Typedefs

typedef struct tag_rs_xcp_server_daq_list rs_xcp_server_daq_list_t: Contains information about DAQ list entries for XCP server.

typedef struct tag_rs_xcp_server_daq rs_xcp_server_daq_t: Contains information about DAQ for XCP server.

typedef struct tag_rs_xcp_server_odt rs_xcp_server_odt_t: Contains ODT (Object Descriptor Table) entry index information.

typedef struct tag_rs_xcp_server_config rs_xcp_server_config_t: Contains information about XCP server configuration.

typedef struct tag_rs_xcp_server_instance rs_xcp_server_instance_t: Contains runtime state and configuration for an XCP server instance.

typedef struct tag_rs_xcp_udp_server_instance rs_xcp_udp_server_instance_t: Contains instance-specific configuration for UDP-based XCP server.

typedef struct tag_rs_xcp_msg rs_xcp_msg_t: Structure representing an XCP message.

Functions

rs_handle_t rs_xcp_server_open(rs_xcp_server_instance_t *ptr_instance, rs_xcp_server_config_t *ptr_config)

Open an XCP server instance.

This function initializes and opens an XCP server using the provided server instance and configuration settings.

Parameters:

ptr_instance – [in] - Pointer to the XCP server instance structure to be initialized.
ptr_config – [in] - Pointer to the configuration structure containing the server’s communication settings.

Returns:

A valid handle for the server instance on success, or an error code on failure.

rs_ret_val_t rs_xcp_server_process(rs_handle_t handle)

Process XCP server communication and message handling.

This function processes the communication and message handling for the XCP server. It calls internal functions to handle server communication and process incoming messages.

Parameters:: handle – [in] - Handle to the XCP server instance.
Returns:: RS_ERR_OK on success, or an error code on failure.

rs_ret_val_t rs_xcp_server_run(rs_handle_t handle, uint32_t u32_run)

Start or stop the XCP server.

This function sets the run state of the XCP server. If the u32_run parameter is set to 1, the server is started by changing its state to OPEN. If u32_run is 0, the server is stopped by changing its state to IDLE.

Parameters:

handle – [in] - Handle to the XCP server instance.
u32_run – [in] - 1 to start the server, 0 to stop it.

Returns:

Returns RS_ERR_OK on success, or RS_ERR_NULL_POINTER if the instance is not found.

rs_ret_val_t rs_xcp_server_set_rx_msg_buf(rs_handle_t handle, rs_xcp_msg_t *ptr_rx_msgs, uint32_t u32_num_msg, void *ptr_msg_ptr_buf)

Set the receive message buffer for the XCP server.

This function initializes and configures the buffers for receiving XCP messages. It sets up the buffer manager for managing the message status and initializes the queue for incoming messages.

Parameters:

handle – [in] - Handle to the XCP server instance.
ptr_rx_msgs – [in] - Pointer to the array of receive messages.
u32_num_msg – [in] - Number of messages in the receive buffer.
ptr_msg_ptr_buf – [in] - Pointer to the buffer for the message pointers.

Returns:

Returns RS_ERR_OK on success, or RS_ERR_NULL_POINTER if the instance is not found.

rs_ret_val_t rs_xcp_server_set_tx_msg_buf(rs_handle_t handle, rs_xcp_msg_t *ptr_tx_msgs, uint32_t u32_num_msg, void *ptr_msg_ptr_buf)

Set the transmit message buffer for the XCP server.

This function initializes and configures the buffers for transmitting XCP messages. It sets up the buffer manager for managing the message status and initializes the queue for outgoing messages.

Parameters:

handle – [in] - Handle to the XCP server instance.
ptr_tx_msgs – [in] - Pointer to the array of transmit messages.
u32_num_msg – [in] - Number of messages in the transmit buffer.
ptr_msg_ptr_buf – [in] - Pointer to the buffer for the message pointers.

Returns:

Returns RS_ERR_OK on success, or RS_ERR_NULL_POINTER if the instance is not found.

rs_ret_val_t rs_xcp_server_close(rs_handle_t handle)

Called to free the XCP server handle.

This function called to free the XCP server handle.

Parameters:: handle – [in] - Handle of the XCP instance information
Returns:: Return 0 if success or negative value if failure.

rs_ret_val_t rcb_xcp_server_connect(rs_handle_t xcp_server_handle, uint8_t u8_mode)

Handles the XCP server connect command from the master.

This function processes the CONNECT command received from the XCP master. It uses the provided mode to determine how the connection should be established. If debug printing is enabled, it logs whether the connection is established.

Parameters:

xcp_server_handle – - Handle to the XCP server instance.
u8_mode – Connection mode sent by the master.

Returns:

Returns the status of the operation.

rs_ret_val_t rcb_xcp_server_disconnect(rs_handle_t xcp_server_handle)

Handles the XCP server DISCONNECT command.

This function processes a DISCONNECT request from the XCP master. It logs the disconnect event .

Parameters:: xcp_server_handle – - Handle to the XCP server instance.
Returns:: Returns the status of the operation.

rs_ret_val_t rcb_xcp_server_get_status(rs_handle_t xcp_server_handle)

Handles the XCP server GET_STATUS command.

This function processes a GET_STATUS request from the XCP master. It logs the status retrieval event.

Parameters:: xcp_server_handle – - Handle to the XCP server instance.
Returns:: Returns the status of the operation.

rs_ret_val_t rcb_xcp_server_unknown_command(rs_handle_t xcp_server_handle)

Handles unknown or unsupported XCP commands.

This function is invoked when the XCP server receives a command that it does not recognize or support. It logs the occurrence of an unknown command for debugging purposes.

Parameters:: xcp_server_handle – - Handle to the XCP server instance.
Returns:: Returns the status of the operation.

rs_ret_val_t rcb_xcp_server_get_comm_mode_info(rs_handle_t xcp_server_handle, uint8_t *ptr_comm_mode, uint8_t *ptr_max_bs, uint8_t *ptr_min_st)

Retrieves communication mode information for the XCP server.

This function provides the master with current communication parameters such as communication mode, maximum block size, and minimum separation time. These values are used to configure communication behavior.

Parameters:

xcp_server_handle – - Handle to the XCP server instance.
ptr_comm_mode – - Pointer to store the communication mode.
ptr_max_bs – - Pointer to store the maximum block size.
ptr_min_st – - Pointer to store the minimum separation time.

Returns:

Returns the status of the operation.

rs_ret_val_t rcb_xcp_server_set_mta(rs_handle_t xcp_server_handle, uint8_t *ptr_rx_data, uint8_t u8_addr_ext)

Sets the Memory Transfer Address (MTA) for the XCP server.

This function configures the MTA, which points to the memory location for data transfers during XCP operations. It accepts the address and the address extension as parameters.

Parameters:

xcp_server_handle – Handle to the XCP server instance.
ptr_rx_data – Pointer to the received data containing the address to set.
u8_addr_ext – Address extension byte specifying the memory segment or address space.

Returns:

Returns the status of the operation.

rs_ret_val_t rcb_xcp_server_short_upload(rs_handle_t xcp_server_handle, uint8_t *ptr_rx_data, uint8_t u8_payload_size, uint8_t u8_addr_ext, uint8_t *ptr_tx_data)

Handles the SHORT_UPLOAD command from the XCP master.

This function processes a SHORT_UPLOAD request by reading a block of memory from the specified address. It reads the data based on the provided payload size and address extension and stores the result in the transmit buffer.

Parameters:

xcp_server_handle – Handle to the XCP server instance.
ptr_rx_data – Pointer to the received data buffer containing address information.
u8_payload_size – Number of bytes to upload from the memory address.
u8_addr_ext – Address extension used to determine the memory segment.
ptr_tx_data – Pointer to the buffer where the uploaded data will be stored.

Returns:

Status code indicating the result of the operation.

rs_ret_val_t rcb_xcp_server_download(rs_handle_t xcp_server_handle, uint8_t u8_payload_size, uint8_t *ptr_rx_data)

Handles the DOWNLOAD command from the XCP master.

This function writes the received data into the memory pointed to by the current MTA (Memory Transfer Address). The data size is determined by the payload size parameter.

Parameters:

xcp_server_handle – Handle to the XCP server instance.
u8_payload_size – Number of bytes to write into memory.
ptr_rx_data – Pointer to the buffer containing the value to be write.

Returns:

Status code indicating the result of the operation.

rs_ret_val_t rcb_xcp_server_start_stop_synch(rs_handle_t xcp_server_handle, uint8_t u8_mode)

Handles the start or stop synchronization command for DAQ (Data Acquisition).

This function processes the start/stop synchronization request based on the mode:

Mode 1: Start all selected DAQ
Mode 2: Stop all selected DAQ
Other: Stop all DAQ It logs the action taken when debug printing is enabled.

Parameters:

xcp_server_handle – Handle to the XCP server instance.
u8_mode – Mode indicating the start/stop action for DAQ.

Returns:

Result of the operation indicating success or failure.

struct tag_rs_xcp_server_daq_list

#include <rs_xcp_server.h>

Contains information about DAQ list entries for XCP server.

Public Members

uint8_t last_index_odt: Last ODT index for this DAQ list.

uint8_t first_index_odt: First ODT index for this DAQ list.

uint8_t flags: Flags for DAQ list configuration.

struct tag_rs_xcp_server_daq

#include <rs_xcp_server.h>

Contains information about DAQ for XCP server.

Public Members

uint8_t daq_count: Total number of DAQ.

uint8_t odt_count: Total number of ODTs.

uint16_t odt_entry_count: Total number of entries across all ODTs.

uint8_t event_daq[RS_XCP_SERVER_MAX_EVENT]

rs_xcp_server_daq_list_t daq_list[RS_XCP_SERVER_DAQ_MEM_SIZE / sizeof(rs_xcp_server_daq_list_t)]: Array of DAQ lists.

struct tag_rs_xcp_server_odt

#include <rs_xcp_server.h>

Contains ODT (Object Descriptor Table) entry index information.

Public Members

uint16_t first_odt_entry: Index of the first ODT entry.

uint16_t last_odt_entry: Index of the last ODT entry.

struct tag_rs_xcp_server_config

#include <rs_xcp_server.h>

Contains information about XCP server configuration.

Public Members

uint8_t comm_type: Communication type.

uint8_t ip_addr[RS_XCP_SERVER_UDP_ADDR_LEN]: IP address of the server.

uint16_t port: port used for communication

struct tag_rs_xcp_server_instance

#include <rs_xcp_server.h>

Contains runtime state and configuration for an XCP server instance.

Public Members

rs_xcp_server_config_t *ptr_config: Pointer to XCP server configuration.

rs_handle_t transport_handle: Transport layer handle.

uint32_t data_len: Data length of the packet.

uint8_t state: state of the XCP server

uint8_t conn_status: Connection status.

uint8_t run_state: Run state of the server.

uint8_t reconfigure: Flag indicating reconfiguration is required.

uint8_t *ptr_buff: Pointer to RX/TX buffer.

uint16_t buf_len: Length of RX/TX buffer.

rs_handle_t xcp_handle: Handle visible to the user for XCP server.

uint16_t session_status: Session status as per XCP protocol.

uint8_t protection_status: Protection flags/status (e.g., encryption/auth)

uint32_t *ptr_mta_addr

uint8_t *ptr_odt_entry_addr

pointer for MTA(Memory Transfer Address) address

Pointer to ODT entry address array

uint8_t *ptr_odt_entry_size: Pointer to ODT entry size array.

uint16_t daq_list_index: Index to currently active DAQ list.

rs_xcp_server_odt_t *ptr_odt: Pointer to ODT metadata table.

rs_search_mgr_t si_search_mgr: Search manager for session/interface.

rs_buffer_mgr_t tx_buf_mgr: Transmit buffer manager.

rs_buffer_mgr_t rx_buf_mgr: Receive buffer manager.

rs_buffer_mgr_t rx_msg_queue_mgr: RX message queue FIFO manager.

rs_buffer_mgr_t tx_msg_queue_mgr: TX message queue FIFO manager.

rs_xcp_server_daq_t daq_info: DAQ configuration and tracking info.

struct tag_rs_xcp_udp_server_instance

#include <rs_xcp_server.h>

Contains instance-specific configuration for UDP-based XCP server.

Public Members

rs_xcp_server_instance_t server_instance: XCP server instance state.

rs_socket_config_t udp_socket_config: UDP socket configuration.

rs_udp_instance_t udp_socket_instance: UDP socket runtime instance.

uint8_t buff[RS_XCP_SERVER_UDP_BUF_MAX_LEN]: Static buffer for UDP communication.

struct tag_rs_xcp_msg

#include <rs_xcp_server.h>

Structure representing an XCP message.

Public Members

uint8_t status: Message Status.

uint8_t source_addr[RS_XCP_SERVER_ADDR_LEN]: Source address for server address.

uint32_t target_addr: Target address.

uint8_t *ptr_data: Pointer to data buffer.

uint32_t data_len: Number of bytes of data.

uint16_t max_data_len: Max number of bytes allowed.