Modern vehicle design now incorporates an ever-increasing list of driveability, safety and interconnectivity features that have placed a huge demand on typical vehicle networks (i.e. CAN)
As a result, a consortium of vehicle manufacturers has developed a bespoke protocol capable of handling the required transfer of data between ECUs at high speed (10 Mbit/s) in a combined deterministic and event-driven fashion; this protocol is called FlexRay
The development roots of FlexRay go back as far as the late 90s; however, the first production vehicles with FlexRay on board were not released until 2006. As a result, all remaining consortium members have followed suit, making FlexRay the high-speed network of choice for millions of vehicles from multiple prestige brands
In addition to the inherent high speed and bandwidth properties of FlexRay, the principle by which large content, critical data is assured of delivery (with zero latency) is called “Time Division Multiple Access” (TDMA) Thanks to the ultra-precise timing of each ECU on a FlexRay network, the protocol is designed to utilise reserved “static” time slots allocated to specified ECUs and messages which can cyclically access the bus for scheduled “deterministic” bus traffic.
In contrast, “Flexible Time Division Multiple Access” (FTDMA) utilises “dynamic” time slots (further divided into mini slots) allocated for the relevant ECU wishing to transmit non-scheduled messages (i.e. event driven) without affecting deterministic data, ensuring a successful transmission without delay regardless of bus load.
Whilst the properties of FlexRay lend themselves to the demands of modern vehicles, there is an increased cost implication and therefore, FlexRay is utilised only where required (i.e. safety critical systems & drive-by-wire components) while complementing existing on-board network protocols such as CAN & LIN
The physical construction of a FlexRay network is similar to that of CAN, where an unshielded twisted pair of cables (utilising differential signalling) is used to connect the ECUs together. Termination resistors are also used at each end of the network between Bus Plus (BP) and Bus Minus (BM) cables to match the impedance of the FlexRay wiring and prevent signal reflections
The typical value of FlexRay termination resistors ranges from 80 to 110 Ω, whereby the total network impedance measured between BP & BM equates to 40 & 55 Ω, respectively.
Typically, there are 4 voltage levels expected on a FlexRay bus:
- Bus idle, Low power mode: BP & BM = 0 V (Differential voltage = BP 0 V – BM 0 V = 0 V)
- Bus idle: BP & BM = 2.5 V (Differential voltage = BP 2.5 V – BM 2.5 V = 0 V)
Note: When the bus is in either idle mode, it is considered in the “Recessive” state
- Data 1: BP 3.5 V, BM 1.5 V (Differential voltage = BP 3.5 V – BM 1.5 V = 2 V)
- Data 0: BP 1.5 V, BM 3.5 V (Differential voltage = BP 1.5 V – BM 3.5 V = – 2 V)
Note: When the bus is transmitting Data 1 or 0, it is considered in the “Dominant” state
In addition to the typical voltage levels above, consideration must also be given to the time interval of a single voltage pulse from Bus Idle to Data 1 or 0, which denotes a single bit. Given our FlexRay network baud rate is 10 Mbit/s, we can use the reciprocal value to find the minimum time interval that will represent 1 bit: 1 / 10,000,000 = 0.0000001 s or 100 ns
Note: A time interval of 100 ns (1-bit) equates to a frequency value of 10 MHz
Based on the summary above, we will now take a look at how a FlexRay packet is formed and break down each section into its respective functions
FlexRay packet – Figure 1. point 1, 2 & 3
A FlexRay packet can be divided into 3 main segments:
- Header, which is further divided into the following sections:
- Reserved & Indicators bits
- Frame ID
- Payload length
- Header CRC
- Cycle count
- Payload, 0 – 254 bytes, can be transmitted in one FlexRay packet
- Trailer, which includes the Cyclic Redundancy Check (CRC) sequence

Transmission start sequence (TSS), Frame start sequence (FSS) and Byte start sequence (BSS) – Figure 2. point A
TSS is required for FlexRay topologies utilising an “Active Star” configuration; the TSS limits any possible timing errors generated as a result of Active Star input/output configuration whilst preventing truncation of message content, which is inherent during the configuration process
FSS is used to allow for any delay in interpreting the first byte after the TSS. Delays may occur due to minuscule errors introduced during the conversion of voltage pulses into digitized data within the ECU
BSS is utilised throughout the FlexRay packet prior to each transmitted byte (every 8-bits) as a form of time synchronisation for receiving ECUs. The BSS consists of 2-bits, one low and one high, with a time interval of 200 ns

Entire header – Figure 3. point 1
As previously mentioned, the header is divided into 5 sections:
Reserved & Indicators bits – Figure 3. point B
5-bits are used to complete the Reserved & Indicators fields, which serve to provide an accurate description of the content within our FlexRay packet
Starting from left to right of point B, we have:
- Reserved bit (1-bit) set to logic 0 and reserved for future protocol use (i.e. not currently used)
- Payload preamble (1-bit) indicates the presence of network management data at the beginning of the payload (if transmitted in the static segment of a packet) or a message ID if transmitted in the dynamic segment (indicated by logic 1)
A Logic 0, therefore, indicates the packet does not contain network management data or a message ID in its respective segments
- The null frame indicator (1-bit) informs the network whether the frame contains usable data within the payload section of a FlexRay packet. When set to logic 0, the payload has no valid data; when set to logic 1, the payload contains sufficient data
- Sync frame indicator (1-bit) indicates whether a packet is being used for network-wide synchronisation of communication
- The start-up frame indicator is used to indicate that the packet is indeed a “start-up” packet, which serves to wake the network ECUs accordingly.
Note: only designated “cold start” ECUs can transmit start-up packets, where logic 0 indicates the packet is not a start-up packet and logic 1 indicates the packet is to be utilised for start-up
Frame ID – Figure 3. point C
The frame ID is 11-bits long (1.3 µs – 200 ns [BSS] = 1.1 µs) and transmitted by an ECU such as to define the allocated time slot within the static segment of a packet or the message priority within the dynamic segment. (The lower the Frame ID in the dynamic segment, the higher the priority)
Figure 3. point D (Payload length 7-bits)
The payload length indicates the number of bytes within the payload field only. The value is encoded using the actual number of bytes contained in the payload field divided by two. Hence, packet 282 in Figure 3 has a payload length of 3 for a payload containing 6 bytes
Header CRC 11-bits – Figure 3. point E
The header CRC covers the header field values, providing data verification and error detection. Based on the contents of the Sync frame indicator, start-up frame indicator, Frame ID and payload length, the receiving ECU will calculate the CRC using an algorithm defined by the FlexRay specification. Should the CRC values fail to compute, an error is detected and managed accordingly
Cycle count 6-bits – Figure 3. point F
The cycle count indicates the transmitting ECU’s interpretation of the current communication cycle. The transmitting ECU is responsible for maintaining the cycle count up to a maximum of 63, whereby the counter then reverts to 0 and the count recommences

Payload 0 – 254 bytes – Figure 4. point 2
The payload segment incorporates a potential combination of static data (deterministic) and dynamic data (event-driven), with the predominant data being deterministic. In addition, the first 0 – 12 bytes within the payload static segment may be utilised as “Network Management Vector”, which ensures good network housekeeping and internal data management
To determine if the payload field incorporates dynamic/housekeeping data, refer to Figure 3. Point B, Payload preamble, which is set to Logic 1 in such a scenario
By dividing the payload segment into discrete time slots for static data, accompanied with additional time slots (subdivided into “mini slots”) for dynamic data, each ECU on the FlexRay network will know the precise time slot to transmit either form of data, to avoid collisions and disruption to bus traffic
Note: The payload segment will only contain an even number of bytes, where each data byte is numbered and named using “Data 0” for the first byte (after the “header”) and increasing numerically thereafter (i.e. Data 1, Data 2 etc.)
Static segment
The data bytes within the static segment ultimately contain scheduled information (of a fixed length) required by the connected ECUs (e.g. parameter data), which in turn must be converted to the correct units with the relevant scale and offset values applied. Such conversion definitions remain proprietary information held by the vehicle manufacturer, where access will be limited and require the relevant license.
Note: Access to the bus within the static segment is via “Time Division Multiple Access” (TDMA) and permitted solely by allocated time within a communication cycle
Dynamic segment
The dynamic segment handles event-driven traffic of varying lengths (up to 254 bytes) on a similar basis to the arbitration method used in CAN. Access for such messaging is once again via time & mini time slots reserved for ECUs, whereby the highest priority message will be allowed access to the bus and lower priority messages await the next time slot allocated to the “waiting” ECU
Note: Access to the bus within the dynamic segment is via “Flexible Time Division Multiple Access” (FTDMA) and permitted solely on a priority basis within a communication cycle
Trailer 24-bits – Figure 4. point 3
The trailer segment incorporates the Cyclic Redundancy Check (CRC) sequence calculated over the entire packet, providing data verification and error detection. Based on the contents of the packet, the receiving ECU will calculate the CRC using an algorithm defined by the FlexRay specification and compare the derived value against the transmitted CRC. Should the CRC values fail to compute, an error is detected and managed accordingly

Frame end sequence FES 2-bit – Figure 5. point 4
The FES denotes the final byte of a static data packet and consists of 2-bits, one low and one high, with a time interval of 200 ns. In addition to the Frame end sequence, a Dynamic trailing sequence (DTS) follows the FES, where the packet includes dynamic data. The duration of the DTS is variable and consists of two parts: a variable-length period at low level and a fixed period at high level. The shortest possible duration of the DTS is 200 ns, consisting of one low bit and one high.
Note: The absence of the DTS indicates the packet consists of static data only

More information. The above article serves as an introduction and overview of FlexRay. To dive deeper, please refer to official publications to broaden your knowledge and improve diagnostic skills. Thank you as ever for taking the time to read these articles and view the associated videos here: https://www.youtube.com/playlist?list=PLwQU2pgVAGvEpq8u9OHz3hOIsZj1fPBR3
FAQ Section
Question: What are the standard voltage levels for a FlexRay bus?
Answer: FlexRay operates using a differential signal across two wires: Bus Plus (BP) and Bus Minus (BM). In an idle state (recessive), both wires sit at 2.5V. When transmitting data (dominant):
- Data_0: BP falls to 1.5V and BM rises to 3.5V.The differential voltage is either $+2.0V$ or $-2.0V$, providing high noise immunity.
- Data_1: BP rises to 3.5V and BM falls to 1.5V.
Question: Why do I need a high-bandwidth oscilloscope for FlexRay diagnostics?
Answer: Unlike CAN, which typically runs at 500 kbps, FlexRay operates at 10 Mbps. To accurately see the “square” edges of the data packets and identify reflections or ringing, you need an oscilloscope with at least 20 MHz bandwidth, such as the PicoScope 4000 series. Using standard leads or a low-bandwidth scope will “round off” the signal, potentially hiding physical layer faults.
Question: What is the difference between the Static and Dynamic segments in a FlexRay packet?
Answer: FlexRay uses a Time Division Multiple Access (TDMA) cycle. The static segment consists of time slots allocated to specified ECUs and messages that can cyclically access the bus for scheduled “deterministic” bus traffic. The Dynamic segment utilises “Flexible Time Division Multiple Access” (FTDMA) time slots (further divided into mini slots) allocated for the relevant ECU wishing to transmit non-scheduled messages (i.e. event driven) without affecting deterministic data, ensuring a successful transmission without delay, regardless of bus load.
Question: What causes a “Start of Frame” (TSS) error in FlexRay?
Answer: The TSS is a fixed signal period used for limiting timing errors and preventing message truncation. Errors here are often caused by excessive bus length, poor termination (100–110 ohms), or a faulty node failing to synchronize with the network’s global timebase. Because FlexRay is time-triggered, even a tiny timing drift can cause the entire node to stop communicating.