Introduction to UDS: Unified Diagnostic Services

Image Credit: rapidrepairautocenter.com

Agenda

Why UDS?
Communication Protocol vs. Diagnostic Protocol?
Core of UDS?
Benefits of Diagnostics:
Frame Format
Request Frame Format
Positive Response
Negative Response
Examples of: Service IDs
Examples of: Negative Responses
References

___________________________________________________________

As Humans need Doctors, ECUs need Diagnostics.

But what are ECUS?
ECUs, like humans seeking medical help, use Diagnostics to communicate and find solutions for their issues.

What is UDS?

UDS: Unified Diagnostic Services.
UDS Protocol is an automotive vehicle diagnostic protocol.
Globally used for diagnosing vehicles.
Defined in ISO-14229 standard.
“Unified” means that it is an international and not a company-specific standard.
Allowing diagnostic tools to contact all ECUs installed in a vehicle, which has UDS services enabled.

___________________________________________________________

Communication Protocol vs. Diagnostic Protocol?

Communication Protocol:

Used for information exchange between ECUs.
Facilitates communication and operation of vehicles through ECUs.

Diagnostics Protocol:

UDS Protocol falls into this category.
It's specifically designed for diagnosing vehicles, ensuring a common computer system for diagnostics.

___________________________________________________________

What is the Core of UDS?

Explanation of how machines can communicate issues within their components (memory, peripherals..) or detect problems like (short circuits, sensor failures...).
Diagnostic programs periodically run to identify faults.
Faults are logged as Diagnostic Trouble Codes (DTC) and stored in the ECU's Non-Volatile memory.
DTCs can be accessed by humans to simplify vehicle repairs.

___________________________________________________________

Benefits of Diagnostics:

Viewing stored data.
Monitoring live data (vehicle speed, sensor measurements).
Transferring data (flashing ECU).
Controlling module I/O (disabling features to identify faults).
Running specific routines (self-calibration or testing).
Applying security locks.

___________________________________________________________

Frame Format:

Diagnostic Request Frame

With or without Sub-function-ID

Diagnostic Response Frame

Positive Response.
Negative Response.

___________________________________________________________

Request Frame Format (through CAN)

PCI: Protocol Control Information:

relevant to CAN not UDS.

SID: Service ID: such as:

Diagnostic Session Control
Routine Control

Sub Function Byte: such as:

Diagnostic Session Type
Routine Control Type

Request Data Parameters:

Such as ECU Serial Number in Read-Data-By-Identifier requests.

___________________________________________________________

Positive Response

Response SID: Calculated as the Service Identifier (SID) of the request plus 0x40.
2-byte DID (Data Identifier).
Actual data payload for the requested DID

The structure may vary depending on the specific UDS service being used.

Negative Response

PCI field
Negative Response Code SID, 0x7F
SID of the rejected request
Negative Response Code (NRC)

___________________________________________________________

Examples of Service IDs

Diagnostic and Communications Management Service IDs:

0x10: Diagnostic Session Control

Default Session (Subfunction 01):

The initial session when the control unit starts.
Provides basic diagnostic functions.

Programming Session (Subfunction 02):

Used for uploading software to the control unit.

Extended Diagnostic Session (Subfunction 03):

Unlocks additional diagnostic functions, such as sensor adjustments.

0x11: ECU Reset

Hard Reset:

Simulates a power supply shutdown.
Useful for resetting the ECU.

Soft Reset:

Used for resetting and initializing certain aspects of the ECU.

0x27: Security Access

Provides security checks for enabling the most security-critical services.
An example of Security Process:

A "Seed" is generated by the ECU.
The "Seed" is sent to the client.
The client computes a "Key" based on the received "Seed."
The computed "Key" is sent back to the control unit.
The control unit uses the "Key" to unlock the security-critical services.

0x3E: Tester Present

If NO communication is exchanged with the client for a long time, the control unit automatically exits the current session and returns to the "Default Session" back, and might go to sleep mode.
Therefore, there is an extra service which purpose is to signal to the device that the client is still present.

___________________________________________________________

Data Transmission Service IDs:

0x22: Read Data By Identifier

To retrieve one or more values from an ECU.
These values can be of various types and lengths, such as part numbers, software versions, or dynamic data like sensor readings.
Each value is associated with a Data Identifier (DID) ranging from 0 to 65535.

0x2E: Write Data By Identifier

This feature allows for the modification of certain parameters or settings associated with the specified DID.

___________________________________________________________

Stored Data Transmission Service IDs:

0x19: Read DTC Information

DTC stands for "Diagnostic Trouble Codes".
Each DTC handled by the control unit fault is stored with its own code in the error memory.
It can be read at any time.
In addition to the error, additional information will be stored, which can also be read.

0x14: Clear Diagnostic Information

Delete all stored DTC

___________________________________________________________

Input / Output Control Service IDs:

0x2F: Input Output Control By Identifier

Allows external system intervention on internal and external signals via the diagnostic interface.
Additional conditions for a request can be specified using option bytes.

ReturnControlToECU
ResetToDefault
Freeze Current State
Short-Term Adjustment

___________________________________________________________

Remote Activation of Routine Service IDs:

0x31: Routine Control

Supports different message types to perform routines
Start Message: Used to initiate a service, with the option to confirm the beginning of execution or notify when the service is completed.
Stop Message: Allows the interruption of a running service at any time.
Query Message: Used to request the results of a service.

___________________________________________________________

Upload / Download Service IDs:

0x34: Request Download

Downloading new software or other data into the control unit

0x36: Transfer Data

Aims to send data packets.
If the data set exceeds the maximum packet size, the "Transfer Data" service must be used multiple times to transmit the entire dataset in successive packets.

0x37: Request Transfer Exit

Used to signal the completion of data transmission.
Primarily used for comparison between the ECU and the tester to ensure that data transfer is finished.

___________________________________________________________

Examples of:

Negative Responses

0x10: generalReject

Indicates that the requested action has been rejected by the UDS server.
Should only be implemented in the server when none of the other negative response codes defined in UDS meet the specific needs of the implementation.
It should not be used as a general replacement for other defined response codes in UDS.

0x11: serviceNotSupported

Sent by the server when the client has sent a request message with a service identifier that is either unknown or not supported by the server.

0x12: subFunctionNotSupported

Sent by the server when the client has sent a request message with a known and supported service identifier but includes a "subfunction" that is either unknown or not supported.

0x13: incorrectMessageLengthOrInvalidFormat

Sent when the length of the received request message does not match the expected length for the specified service
Or when the format of the parameters in the request does not match the prescribed format for the specified service.

0x14: responseTooLong

Sent when the server cannot generate a response because the response size exceeds the maximum number of bytes allowed by the underlying network layer.

0x22: conditionsNotCorrect

Sent when requested action will not be taken because the server prerequisite conditions are not met.

0x24: requestSequenceError

Indicate that the requested action will not be taken because the server expects a different sequence of request messages or a different message order than what was sent by the client.
For example:

a SecurityAccess service may specify a specific sequence of requestSeed and sendKey as sub-functions in the request messages.
If the client sends these sub-functions in a different sequence, the server responds with a negative response message containing the 0x24 Request Sequence Error code.

0x31: requestOutOfRange

Used to indicate that the requested action will not be taken because the server has detected issues with the request message.
These issues may include:

Attempting to substitute a value that exceeds the server's authorized range (e.g., attempting to set a data byte to 111 when it's only defined up to 100).
Trying to access a data identifier or routine identifier that is not supported or is not valid in the active session.
This response code is required for all services that involve reading data, writing data, or adjusting functions using data in the server.

0x33: securityAccessDenied

Indicates that the requested action will not be taken because the server's security requirements have not been satisfied by the client.
This response code is sent by the server in several situations, including:

When the test conditions of the server are not met.
When the required message sequence, such as DiagnosticSessionControl and securityAccess, is not followed.
When the client has sent a request message that requires access to a locked server.

0x7E: subFunctionNotSupportedInActiveSession

Indicates that the requested action will not be taken because the server does not support the requested sub-function in the currently active session.
It is applicable to diagnostic services with a sub-function parameter.

0x7F: serviceNotSupportedInActiveSession

Indicates that the requested action will not be taken because the server does not support the requested service in the currently active session.
This response code should only be used when the requested service is known to be supported in another session; otherwise, response code 0x11 (serviceNotSupported) should be used.

___________________________________________________________

References:

Regards.