Unified Diagnostic Services

From Wikipedia, the free encyclopedia

Jump to navigationJump to search
Unified Diagnostic Services (UDS) is a diagnostic communication protocol in the electronic
control unit (ECU) environment within the automotive electronics, which is specified in the ISO
14229-1.[1] It is derived from ISO 14230-3 (KWP2000) and ISO 15765-3 (Diagnostic
Communication over Controller Area Network (DoCAN)[2]). Unified in this context means that it
is an international and not a company-specific standard. By now this communication protocol
is used in almost all new ECUs made by Tier 1 suppliers of Original Equipment
Manufacturer (OEM). These ECUs control a wide range of functions in vehicles
including electronic fuel injection (EFI), engine control, the transmission, anti-lock braking
system, door locks, braking, and more.
The diagnostic tool contacts all control units installed in a vehicle, which have UDS services
enabled. In contrary to the CAN protocol, which only uses the first and second layers of
the OSI model, UDS services utilize the fifth and seventh layers of the OSI model. The Service
ID (SID) and the parameters associated with the services are contained in the 8 data bytes of
a message frame issued from the diagnostic tool.
Modern vehicles have a diagnostic interface for off-board diagnostics, which makes it possible
to connect a computer (client) or diagnostics tool, which is referred to as tester, to the bus
system of the vehicle. Thus, the messages defined in UDS can be sent to the controllers which
must provide the predetermined UDS services. This makes it possible to interrogate the fault
memory of the individual control units or to update them with a new firmware.

Contents

 1Services
 2See also
 3References
 4External links

Services[edit]
SID (Service Identifier)

Function Request SI Response SI

Service Description
group D D

UDS uses different

operating sessions, which
can be changed using the
"Diagnostic Session
Diagnostic and
Diagnostic Control". Depending on
Communicatio
$10 $50 Session which session is active,
ns
Control different services are
Management
available. On start, the
control unit is by default in
the "Default Session".
Other sessions are defined,
but are not required to be
 implemented depending on
the type of device:

 "Programming
Session" used to
upload software.
 "Extended Diagnostic
Session" used to
unlock additional
diagnostic functions,
such as the adjustment
of sensors.
 "Safety system
diagnostic session"
used to test all safety-
critical diagnostic
functions, such as
airbag tests.
In addition, there are
reserved session identifiers
that can be defined for
vehicle manufacturers and
vehicle suppliers specific
use.

The service "ECU reset" is

used to restart the control
unit (ECU). Depending on
the control unit hardware
and implementation,
different forms of reset can
be used:

 "Hard Reset"
simulates a shutdown
of the power supply.
 "key off on Reset"
$11 $51 ECU Reset simulates the drain and
turn on the ignition
with the key.
 "Soft Reset" allows
initialization of certain
program units and
their storage
structures.
Again, there are reserved
values that can be defined
for vehicle manufacturers
and vehicle suppliers
specific use.

Security check is available

Security to enable the most security-
$27 $67
Access critical services. For this
purpose a "Seed" is
 generated and sent to the
client by the control unit.
From this "Seed" the client
has to compute a "Key"
and send it back to the
control unit to unlock the
security-critical services.
With this service, both the
Communicati sending and receiving of
$28 $68
on Control messages can be turned off
in the control unit.
If no communication is
exchanged with the client
for a long time, the control
unit automatically exits the
current session and returns
to the "Default Session"
$3E $7E Tester Present
back, and might go to sleep
mode. Therefore, there is
an extra service which
purpose is to signal to the
device that the client is still
present.
In the communication
between the controllers and
the client certain times
must be observed. If these
Access are exceeded, without a
$83 $C3 Timing message being sent, it must
Parameters be assumed that the
connection was
interrupted. These times
can be called up and
changed.
Secured Data
$84 $C4
Transmission
Enable or disable the
detection of any or all
errors. This is important
Control DTC when diagnostic work is
$85 $C5
Settings performed in the car,
which can cause an
anomalous behavior of
individual devices.
Response On
$86 $C6
Event
The Service Link Control
is used to set the baud rate
$87 $C7 Link Control of the diagnostic access. It
is usually implemented
only at the central gateway.
Data Read Data By With this service it is
$22 $62
Transmission Identifier possible to retrieve one or
 more values of a control
unit. This can be
information of all kinds
and of different lengths
such as Partnumber or the
software version. Dynamic
values such as the current
state of the sensor can be
queried. Each value is
associated to a Data
Identifier (DID) between 0
and 65535. Normal CAN
signals are meant for
information that some
ECU uses in its
functionality. DID data is
sent on request only, and is
for information that no
ECU uses, but a service
tool or a software tester
can benefit from.
Read data from the
physical memory at the
provided address. This
Read Memory
$23 $63 function can be used by a
By Address
testing tool, in order to
read the internal behaviour
of the software.
Read Scaling
$24 $64 Data By
Identifier
With this service values are
sent periodically by a
Read Data By control unit. The values to
$2A $6A Identifier be sent must be defined to
Periodic only using the
"Dynamically Define Data
Identifier".
This service offers the
possibility of a fix for a
device specified Data
Identifier (DID) pool to
configure another Data
Identifier. This is usually a
combination of parts of
Dynamically different DIDs or simply a
$2C $6C Define Data concatenation of complete
Identifier DIDs.
The requested data may be
configured or grouped in
the following manner:

 Source DID, position,

length (in bytes), Sub-
 Function Byte:
defineByIdentifier
 Memory address
length (in bytes), Sub-
Function Byte:
defineByMemoryAddr
ess
 Combinations of the
two above methods
through multiple
requests.
With the same Data
Identifier (DID), values
Write Data By
$2E $6E can also be changed. In
Identifier
addition to the identifier,
the new value is sent along.
Write
$3D $7D Memory By
Address
Clear
$14 $54 Diagnostic Delete all stored DTC
Information
DTC stands for
"Diagnostic Trouble
Codes". Each DTC handled
Stored Data by the control unit fault is
Transmission stored with its own code in
Read DTC
$19 $59 the error memory and can
Information
be read at any time. In
addition to the error,
additional information will
be stored, which can also
be read.
This service allows an
external system
intervention on internal /
external signals via the
diagnostic interface.
By specifying a so-called
option bytes additional
conditions for a request can
Input Output be specified, the following
Input / Output
$2F $6F Control By values are specified:
Control
Identifier
ReturnControlToECU: The
device must get back
controls of the mentioned
signals.
ResetToDefault: The tester
prompts to reset signals to
the system wide default
value.
 Freeze Current State: The
device shall freeze the
current signal value.
ShortTermAdjustment: The
device shall use the
provided value for the
signal

The Control service routine

services of all kinds can be
performed. There are three
different message types:

 With the start-

message, a service can
be initiated. It can be
defined to confirm the
beginning of the
execution or to notify
when the service is
completed.
Remote
Activation of $31 $71
Routine  With the Stop
Control message, a running
Routine
service can be
interrupted at any
time.
 The third option is a
message to query the
results of the service.
The start and stop message
parameters can be
specified. This makes it
possible to implement
every possible project-
specific service.

Downloading new software

or other data into the
control unit is introduced
using the "Request
Request Download". Here, the
$34 $74
Download location and size of the
data is specified. In turn,
the controller specifies
how large the data packets
Upload / can be.
Download
The service "request
upload" is almost identical
to the service "Request
Download". With this
Request
$35 $75 service, the software from
Upload
the control unit is
transferred to the tester.
The location and size must
be specified. Again, the
 size of the data blocks are
specified by the tester.
For the actual transmission
of data, the service
"Transfer Data" is used.
This service is used for
both uploading and
downloading data. The
transfer direction is
notified in advance by the
service "Request
Download" or "Upload
$36 $76 Transfer Data
Request". This service
should try to send packets
at maximum length, as
specified in previous
services. If the data set is
larger than the maximum,
the "Transfer Data" service
must be used several times
in succession until all data
has arrived.
A data transmission can be
'completed' when using the
"Transfer Exit" service.
This service is used for
comparison between the
control unit and the tester.
When it is running, a
Request control unit can answer
$37 $77
Transfer Exit negatively on this request
to stop a data transfer
request. This will be used
when the amount of data
(set in "Request
Download" or "Upload
Request") has not been
transferred.
This service is used to
initiate a file download
from the client to the
Request File server or upload from the
$38 $78
Transfer server to the client.
Additionally information
about the file system are
available by this service.
This response is given
when a service request
could not be performed, for
Negative
$7F example having a not
Response
supported Data Identifier.
A Negative Response Code
will be included.
See also[edit]
 On-board diagnostics, general article about diagnostic services in vehicles
 OBD-II PIDs, about the US standard