1 Frame format .............................................................................................

2
1.1 Single frame transmission.......................................................................... 2
1.2 Multiple frame transmission ....................................................................... 2
2 TesterPresent (3Eh)................................................................................... 3
3 DiagnosticSessionControl (10h)................................................................. 3
4 SecurityAccess (27h) ................................................................................. 3
5 RoutineControl (31h).................................................................................. 4
5.1 Checksum calculation ................................................................................ 5
5.2 Page switch................................................................................................ 7
6 ReadMemoryByAddress (23h)................................................................... 8
7 WriteMemoryByAddress (3Dh) .................................................................. 8
8 Measurement ............................................................................................. 9
8.1 Address mode............................................................................................ 9
8.2 Block mode .............................................................................................. 10
8.3 Free running mode................................................................................... 11
Used UDS Commands in INCA ................................................................................ 12
Error codes ............................................................................................................... 12
1 Frame format
See also ISO 15765-2.

1.1 Single frame transmission

Single frame
service
length xxh xxh xxh xxh xxh xxh
ID

Positive response
command
length xxh xxh xxh xxh xxh xxh
ID + 40h

Negative response
error
length 7Fh xxh xxh xxh xxh xxh
code

1.2 Multiple frame transmission

First frame
service
1uh vwh xxh xxh xxh xxh xxh
ID

uvwh = Blocksize in Byte

Response (Flow Control Frame)

don’t don’t don’t don’t don’t
3xh maxBS STmin
care care care care care

x = 0 continue to send
x = 1 wait

Consecutive frame
21h … xxh xxh xxh xxh xxh xxh xxh

Byte 1 of the consecutive frame counts up from 21h to 2Ah, starts again at 21h and so on, until all
data is transmitted.

Response

After the last consecutive frame the ECU sends a response. See response on single frame.
2 TesterPresent (3Eh)
This command is used to monitor the link between the ECU und the tool.

Request
don’t don’t don’t don’t don’t
02h 3Eh 00h
care care care care care

Response
don’t don’t don’t don’t don’t
02h 7Eh 00h
care care care care care

3 DiagnosticSessionControl (10h)
This command is used to initialize a communication.

diagnostic don’t don’t don’t don’t don’t

02h 10h
mode care care care care care

Diagnostic mode can be 01h (defaultSession) or according to the A2L file:

/begin SESSION
"Default Session" /* session indentification string used */
/* as displayed name in the HWC select- */
/* ion box */
0x66 /* diagnostic mode for this session */
/end SESSION

4 SecurityAccess (27h)
To carry out a seed’n’key negotiation is the following entry in the A2L necessary:

/begin SECURITY_ACCESS
9 /* accessMode */
1 /* method of calculation */
10 /* delay time after DiagnosticSessionControl */
SEED_KEY /* optional, presetting for Seed’n’key dll */
“SEED_N_KEY.dll”
/end SECURITY_ACCESS

The seed’n’key negotiation can take place at different times of the initialization depending on the entry
in the A2L file:

/begin SESSION
"Default Session"
0x66
SessionOpeningOrder /* optional Keyword */
SeedKey_StartDiagSession /* this two Keys define the order of */
/* StartDiagSession_SeedKey SecurityAccess and */
/* DiagnosticSessionControl */
/* StartDiagSession no seed’n’key */
/end SESSION
Example:

Asking for the seed

accessMo don’t don’t don’t don’t don’t
02h 27h
de care care care care care

Transmitting the seed

accessMo don’t don’t don’t
06h 67h seed seed
de care care care

Transmitting the key

don’t don’t don’t
02h 27h 0Ah key key
care care care

Positive response
don’t don’t don’t don’t don’t
06h 67h 0Ah
care care care care care

If the ECU sends 00h 00h as seed, it means the ECU is unlocked.

5 RoutineControl (31h)
This command starts and stops routines on the ECU and fetches routine results from the ECU. This is
used for checksum calculation, page switching and detecting the current page.

Example as single frame

routine routine- routine-
don’t don’t don’t
04h 31h Control identifi identifi
care care care
Type er, MSB er, LSB

Example as first frame

routine routine- routine-
10h 0Eh 31h Control identifi identifi param. 1 param. 2
Type er, MSB er, LSB

routineControlType:
01h: startRoutine
02h: stopRoutine
03h: requestRoutineResults

routineIdentifier:
specified in A2L file

param. 1 … param. n:
Parameter for routine on ECU like ECU addresses or page numbers.
5.1 Checksum calculation
The checksum calculation with UDS uses the command RoutineControl. The tool starts the calculation
on the ECU. At this time, the tool has already calculated the CS in the work base and transmits the CS
to the ECU. The ECU compares the CS calculated in the tool with its own and sends a negative or
positive response to the tool. So the tool will not recognize the value of the CS calculated on the ECU
if the CS comparison in the ECU failed. INCA values the CS for a memory area with a failed CS
comparison as 0x0. The Following A2L entries are necessary:

/begin CHECKSUM
0x010201 /*
calculation algorithm */
1 /*
CS calculation no active page only (1: yes)*/
1 /*
routine number for checksum */
CHECKSUM_RESULT /*
this keyword specifies the 3 different */
/*
possibilities to get CS result from the ECU */
StartRoutine /*
result is in first response included */
/* CodedResult ?? */
/* RequestRoutineResults ECU polls the result */
/* RNC_RESULT 0x23 Routine not complete Result */
/end CHECKSUM

A CS calculation on data pages like RP and WP is always possible. To calculate a CS on a code area
like the pointer table for IC2, the data access has to be defined in the A2L File:

/begin DATA_ACCESS
0 /* ECU address offset for flash page */
/* (this value is added to the original address, */
/* default 0x0) */
0 /* ECU address offset for K-Line (this value is */
/* added to the original address, default 0x0) for */
/* RAM page */

/* The ECU provides .. .. via protocol coded as (0:No, 1:Yes) */

1 /* ..read access on ECU flash data.. */
1 /* ..verify/chechsum access on ECU flash code.. */
1 /* ..read access on ECU flash code.. */
0 /* ..upload and download only on active page.. */
/end DATA_ACCESS
Example with key “StartRoutine”:
start-
start-
10h 0Eh 31h 01h 00h 01h address
address
MSB

don’t don’t don’t don’t don’t

30h 0h 0h
care care care care care

start- stop- stop-

start- stop- stop- checksum
21h address address address
address address address MSB
LSB MSB LSB

checksum don’t don’t don’t don’t don’t don’t

22h
LSB care care care care care care

don’t don’t don’t

04h 71h 01h 00h 01h
care care care

Example with key “RequestRoutineResults”:

start-
start-
10h 0Eh 31h 01h 00h 01h address
address
MSB

don’t don’t don’t don’t don’t

30h 0h 0h
care care care care care

start- stop- stop-

start- stop- stop- checksum
21h address address address
address address address MSB
LSB MSB LSB

checksum don’t don’t don’t don’t don’t don’t

22h
LSB care care care care care care

don’t don’t don’t

04h 71h 01h 00h 01h
care care care

Tool requests the result:

don’t don’t don’t
04h 31h 03h 00h 01h
care care care

Response if the tool requests the result while the ECU is not ready:
23h don’t don’t don’t
04h 7Fh 00h 01h
(RNC) care care care

The tool has to request again:

don’t don’t don’t
04h 31h 03h 00h 01h
care care care

Positive response:
don’t don’t don’t
04h 71h 03h 00h 01h
care care care
5.2 Page switch
Page switching with UDS uses the command RoutineControl. The tool has the possibility to request
the current page of the ECU depending on the implementation.

Example A: The ECU supports page switch and request the current page.

/begin PAGE_SWITCH
PAGE_CODE 0x00 0x01 /* Defines page codes. Two pages are possible, the first page*/
/* represents the RP, the second one the WP. */
/* If a page is not available it needs to be marked with 0xFF */
/* example: PAGE_CODE 0xFF 0x01 for a working page only ECU */
/* PAGE_CODE 0x01 0x02 for a Reference- and Working*/
LOCAL_ROUTINE
ROUTINE_NUMBER_SET 4 /* no of routine to switch the page */
ROUTINE_PARAM_SET 0x80 /* parameter for local routine */
ROUTINE_NUMBER_READ 4 /* no of routine to get current page */
ROUTINE_PARAM_READ 0x82 /* parameter for local routine */
/* Note: It's possible to use the same */
/* routine with different parameter */
/* or different routine numbers */
ROUTINE_RESULTS
StartRoutine
/end PAGE_SWITCH

Request the current active page (in the example RP, correctly supported since INCA V6.0.0):

don’t don’t
05h 31h 01h 00h 04h 82h
care care

don’t
06h 71h 01h 00h 04h 82h 00h
care

It is not specified, that the ECU has to send the routine identifier and the page code, so the ECU may
only send the page code in the response. Then the response from the ECU looks as follows:

don’t don’t
05h 71h 01h 00h 04h 00h
care care

Set a Page (in the example WP):

don’t
06h 31h 01h 00h 04h 80h 01h
care

don’t don’t don’t

04h 71h 01h 00h 04h
care care care

Example B: The ECU supports only setting the page.

/begin PAGE_SWITCH
PAGE_CODE 0x00 0x01 /* Reference Page, Working Page */
LOCAL_ROUTINE
ROUTINE_NUMBER_SET 0xF002
StartRoutine
/end PAGE_SWITCH

Set a Page (in the example WP):

don’t don’t
05h 31h 01h F0h 02h 01h
care care

don’t don’t don’t

04h 71h 01h F0h 02h
care care care
6 ReadMemoryByAddress (23h)
This service is used to upload data from the ECU.

Example with single frame

Request
Address Address memory don’t
06h 23h xyh Address
MSB LSB Size care

xh -> length of memorySize (in example 1)

yh -> length of address (in example 3)
memorySize assumed in example as 3

Response
don’t don’t don’t
04h 63h data data data
care care care

Example with consecutive frame

don’t
06h 23h 13h 06 00 00 0Ch
care

10h 0Dh data data data data data data

don’t don’t don’t don’t don’t

30h 00h 00h
care care care care care

21h data data data data data data data

7 WriteMemoryByAddress (3Dh)
This service is used download data to the ECU and to calibrate data in the ECU.

Example with single frame

Request
Address Address memory
07h 3Dh xyh Address data
MSB LSB Size

xh -> length of memorySize (in example 1)

yh -> length of address (in example 3)
memorySize assumed in example as 1

Response
Address Address memory don’t
06h 7Dh 13h Address
MSB LSB Size care
Example with consecutive frame

Request
12h 06h 3Dh 13h 06h 02h 00h 00h

Flow Control
don’t don’t don’t don’t don’t
30h 00h 00h
care care care care care

Consecutive Frame
21h data data data data data data data
•
•
•
2xh data data data data data data data

Response
don’t
06h 7Dh 13h 06h 02h 00h 00h
care

8 Measurement

8.1 Address mode

Measurement using the address mode corresponds to an upload using ReadMomoryByAddress.

Settings in A2L file:

/begin SOURCE
"timeslot" /* Name of raster */
4 /* Scaling Unit: 4 = 10 ms */
1 /* Rate in Scaling Unit: 1 */
/* Refresh rate = 10 ms * 1 = 10 */
/* Codes for Scaling units (CSE) look at*/
/* ASAP1b Spezifikation */

QP_BLOB /* QP-BLOB includes special info about measure sampling rate*/

QP_BLOB_VERSION 0x0300 /* Measurement mode of ECU: Blockmode */
ADDRESSMODE
MAX_NO_OF_SIGNALS 20 /* max. number of signals */
MAX_NO_OF_BYTES 40 /* Block mode: local identifier */
AVAILABLE_ON CAN /* availability of this raster : K-line,*/
/* CAN or both */
/end SOURCE
8.2 Block mode
Settings in A2L file:

/begin SOURCE
"timeslot" /* Name of raster */
4 /* Scaling Unit: 4 = 10 ms */
1 /* Rate in Scaling Unit: 1 */
/* Refresh rate = 10 ms * 1 = 10 */
/* Codes for Scaling units (CSE) look at*/
/* ASAP1b Spezifikation */

QP_BLOB /* QP-BLOB includes special info about measure sampling rate*/

QP_BLOB_VERSION 0x0300 /* Measurement mode of ECU: Blockmode */
BLOCKMODE
LOCAL_ID 0xf0 /* Block mode: Local Identifier */
MAX_NO_OF_SIGNALS 20 /* max. number of signals */
MAX_NO_OF_BYTES 40 /* Block mode: local identifier */
AVAILABLE_ON CAN /* availability of this raster : K-line,*/
/* CAN or both */
/end SOURCE

Example for a single measurement

Setting up a measurement uses the service DynamicallyDefineDataIdentifier (2Ch).

Request
address
10h 09h 2Ch 02h uvh wxh yzh
MSB

uvwxh = DynamicallyDefinedIdentifier
yh = length of MemorySize (in example assumed as 1)
zh = length of address (in example assumed as 3)

Flow Control
don’t don’t don’t don’t don’t
30h 00h 00h
care care care care care

Consecutive frame
address Memory don’t don’t don’t don’t
21h address
LSB Size care care care care

Response
don’t don’t don’t
04h 6Ch 02h uvh wxh
care care care

If more than one measurement should be used, the address of the next measurement would be sent
to the ECU after the MemorySize of the previous measurement, followed by its memory size and so on.

Receiving measure data works via polling using the service ReadDataByIdentifier (22h)

Request
don’t don’t don’t don’t
03h 22h uvh wxh
care care care care

Response
07h 62h uvh wxh data data data data

The measure data is transmitted in the order of the addresses while setting up the measurement.
8.3 Free running mode
Settings in A2L file:

/begin SOURCE
"SLOW"
4
1
QP_BLOB
QP_BLOB_VERSION 0x0300
FREERUNNINGMODE
RDBPI_PARAMETER
RESPONSE_TYPE
RDBPI_RESPONSE_TYPE_UUDT
/begin CAN
/begin UUDT_CAN_IDs
FIRST_CAN_ID 0x7BE
LAST_CAN_ID 0x7BE
/end UUDT_CAN_IDs
/end CAN
TRANSMISSION_MODE TRANSMISSION_MODE_SLOW
/begin AVAILABLE_PERIODIC_IDENTIFIER_RANGE
FIRST_ID 0xF200
LAST_ID 0xF20F
/end AVAILABLE_PERIODIC_IDENTIFIER_RANGE
AVAILABLE_ON CAN
/end SOURCE

Example for a single measurement

First a possibly existing measure element is cleared using the service DynamicallyDefineDataIdentifier
(2Ch) with sub function 03h.

Request
don’t don’t don’t
04h 2Ch 03h uvh wxh
care care care

uvwxh = DynamicallyDefinedIdentifier

Response
don’t don’t don’t
04h 6Ch 03h uvh wxh
care care care

Setting up a measurement uses the service DynamicallyDefineDataIdentifier (2Ch) with sub function
02h.

Request
address
10h 09h 2Ch 02h uvh wxh yzh
MSB

uvwxh = DynamicallyDefinedIdentifier
yh = length of MemorySize (in example assumed as 1)
zh = length of address (in example assumed as 3)

Flow Control
don’t don’t don’t don’t don’t
30h 00h 00h
care care care care care

Consecutive frame
address Memory don’t don’t don’t don’t
21h address
LSB Size care care care care
Response
don’t don’t don’t
04h 6Ch 02h uvh wxh
care care care

If more than one measurement should be used, the address of the next measurement would be sent
to the ECU after the MemorySize of the previous measurement, followed by its memory size and so on,
until the CAN frame is filled. If more than one CAN frame has to be used, a new
DynamicallyDefinedIdentifier has to be defined. This is also valid if a new raster is started.

The data transmission is started and stopped using the command ReadDataByPeriodicIdentifier (2Ah)

Request
don’t don’t don’t don’t
03h 2Ah xyh 00h
care care care care

xyh = 01h means start measurement in TRANSMISSION_MODE_SLOW

xyh = 02h means start measurement in TRANSMISSION_MODE_MEDIUM
xyh = 03h means start measurement in TRANSMISSION_MODE_FAST
xyh = 04h means stop measurement
00h means in this example, that dataId 00h (byte 2 of the DynamicallyDefinedIdentifier, used like the
PID in CCP) is activated or deactivated in this raster. Other dataID’s may follow (in data byte 4 of the
CAN frame and so on), if they also belong to that raster.

Response
don’t don’t don’t don’t don’t don’t
01h 6Ah
care care care care care care

Used UDS Commands in INCA

3Eh TesterPresent
10h DiagnosticSessionControl
27h SecurityAccess
31h RoutineControl
23h ReadMemoryByAddress
3Dh WriteMemoryByAddress
2Ch DynamicallyDefineDataIdentifier
22h ReadDataByIdentifier
2Ah ReadDataByPeriodicIdentifier

Error codes
12h subFunctionNotSupported
13h incorrectMessageLengthOrIncorrectFormat
22h conditionsNotCorrect
24h requestSequenceError
31h requestOutOfRange
33h securityAccessDenied
35h invalidKey
36h exceededNumberOfAttempts
37h requiredTimeDelayNotExpired
72h generalProgrammingFailure