Unified Diagnostic Services (UDS)
Reshma Elizabeth Varghese
Chennai, India
16th October 2020
Agenda
▪ What is Diagnostics
▪ What is UDS
▪ Client-Server Topology
▪ Diagnostic Frame Format
▪ NRCs Supported in UDS
▪ Services in UDS Protocol
▪ Functional Units in UDS Protocol
10/16/2020 2
What is Diagnostics
⮚ Diagnostics is a service which provides assistance for the tester to find out
the issues present in the vehicle (In case of Automotive).
⮚ Diagnostic Protocols are Data layer protocols that requires a
communication medium(Physical Layer Protocol) for executing their
services.
⮚ In General, these Data Layer Protocols are implemented on CAN.
⮚ Generally used protocols for diagnostics in Automotive Industry are Key
Word Protocol (KWP2000) and Unified Diagnostic Service(UDS).
⮚ Diagnostic Protocol provides the diagnostic services, which allow a
diagnostic tester (client) to control diagnostic functions in an on-vehicle
Electronic Control Unit (server).
3
What is UDS
▪ UDS is the latest automotive vehicle diagnostic protocol used to diagnose
any vehicles all over the world.
▪ Diagnostic services are defined by several standards by ISO, SAE, OEMs
(Original Equipment Manufacturers) or even by the vehicle manufacturer
themselves.
▪ The UDS protocol was developed by ISO,SAE(Society Of Automotive
Engineers),OEM and major manufacturers in response to these variety of
diagnostic services.
▪ This protocol is defined in ISO 14229-1standard and it is derived from the
ISO14230-3(KWP-2000) and ISO-15765-3(DoCAN)
▪ UDS protocol serves as common tester communication language across
the world.
10/16/2020 4
UDS Client –Server Topology
▪ UDS Protocol uses both the addressing methods(physical&functional)
to give a spontaneous interface to the tester for easy diagnostics.
10/16/2020 5
Diagnostic Frame Format
⮚ A diagnostic service will have Service Identifier(SID), Sub Function, Data.
⮚ For Each Diagnostic Service ECU will respond with either positive or negative
response.
⮚ Positive Response will be SID + 0x40 (changing bit 6 to 1)
⮚ Negative Response will be 0x7F(always)
⮚ Along with Negative response ECU will give corresponding Response
Codes. For each error there will be some generic codes defined by the
protocol (also OEM is allowed to create there own).
⮚ Eg:
Request: 19 06 92 84 11(19- SID; 06- Sub Function; 92 84 11-Data)
Positive Response: 59 06 92 84 11 56
Negative Response: 7F 19 31
6
Negative Response Codes(NRC) in UDS
Protocol
SL.No. NRC NRC Description SL.No. NRC NRC Description
1 0x00 Server Internal Implimentation 28 0x73 Wrong Block Sequence Counter
0x01 - 0x74 -
2 0x0F ISO Reserved 29 0x77 ISO Reserved
Request Correctly Received - Response
3 0x10 General Reject 30 0x78 Pending
0x79 -
4 0x11 Service Not Supported 31 0x7D ISO Reserved
5 0x12 Sub Function Not Supported 32 0x7E Sub Function Not Supported in Active Session
6 0x13 Incorrect Message Length Or Invalid Format 33 0x7F Service Not Supported in Active Session
7 0x14 Response Too Long 34 0x80 ISO Reserved
0x15 -
8 0x20 ISO Reserved 35 0x81 RPM Too High
9 0x21 Busy Repeat Request 36 0x82 RPM Too Low
10 0x22 Conditions Not Correct 37 0x83 Engine Is Running
11 0x23 ISO Reserved 38 0x84 Engine Is Not Running
12 0x24 Request Sequence Error 39 0x85 Engine Run Time Too Low
13 0x25 No Response From SubNet Component 40 0x86 Temperature Too High
14 0x26 Failure Prevents Execution of Requested Action 41 0x87 Temperature Too Low
0x27 -
15 0x30 ISO Reserved 42 0x88 Vehicle Speed Too High
16 0x31 Request Out Of Range 43 0x89 Vehicle Speed Too Low
17 0x32 ISO Reserved 44 0x8A Throttle/Paddle Too High
18 0x33 Security Access Denied 45 0x8B Throttle/Paddle Too Low
19 0x34 ISO Reserved 46 0x8C Transmission Range Not In Neutral
20 0x35 Invalid Key 47 0x8D Transmission Range Not In Gear
21 0x36 Exceed No. Of Attempts 48 0x8E ISO Reserved
22 0x37 Required Time Delay Not Expired 49 0x8F Brake Switch Not Closed or Not Applied
0x38 - Reserved By Extended Data Link Security
23 0x4F Document 50 0x90 Shifter Lever Not in Park
0x50 -
24 0x6F ISO Reserved 51 0x91 Torque Converter Clutch Locked
25 0x70 Upload Download Not Accepted 52 0x92 Voltage Too High
26 0x71 Transfer Data Suspended 53 0x93 Voltage Too Low
0x94 -
27 0x72 General Programming Failure 54 0xFE Resreved for Specific Conditions Not Correct
55 0xFF ISO Reserved 10/16/2020 7
Services in UDS Protocol
Service ID Service Name
0x10 Diagnostic Session Control Service
0x11 ECU Reset Service
0x14 Clear Diagnostic Information Service
0x19 Read DTC Information Service
0x22 Read Data By Identifier
0x23 Read Memory By Address
0x24 Read Scaling Data By Identifier
0x27 Security Access Service
0x28 Communication Control Service
0x2A Read Data By Periodic Identifier Service
0x2C Dynamicall Define Data Identifier Service
0x2E Write Data By Identifier Service
0x2F Input Output Control By Identifier Service
0x31 Routine Control Service
0x34 Request Download Service
0x35 Request Upload Service
0x36 Transfer Data Service
0x37 Request Transfer Exit Service
0x3D Write Memory By Address Service
0x3E Tester Present Service
0x83 Access Timing Parameter Service
0x84 Secure Data Transmission Service
0x85 Control DTC Setting Service
0x86 Response On Event Service
0x87 Link Control Service
10/16/2020 8
Functional Units in UDS Protocol
▪ Diagnostic and Communication Management Functional Unit: The main function of
the UDS Protocol. It specifies the ECU functionality, manages the diagnostic system,
defines the user accessibility, controls the transmission of data etc.
▪ Data Transmission Functional Unit: It is the functional unit that has the capability of
accessing current data. Data must be read or written immediately after each request.
▪ Stored Data Transmission Functional Unit: This group of functional unit allows
Diagnostic tools to access the server’s memory. The diagnostic tools can clear or read
diagnostic information defined by the server’s database inside memory.
▪ Input Output Control Functional Unit: This functional group is used for controlling
actuators, sensors, devices and equipment attached to the server. All of those inputs
and outputs must be defined as Data Identifiers by OEM, Vehicle Manufacturer, etc.,
following the ISO standard.
▪ Remote Activation of Routines Functional Unit: This functional unit contains a service
that influences an ECU’s behavior. In order to use this service, the routine identifier
must be defined first by the vehicle manufacturer, the ISO standard, system supplier,
etc.
▪ Upload Download Functional Unit: The last group of functional units is used for
requesting the negotiation of data transfer between a client and a server. This
functional group contains services for requesting to start the transmission to
manipulate data in an ECU’s memory, for transferring data and for requesting to
terminate a data transmission.
10/16/2020 9
Diagnostic and Communication Management
Functional Unit
▪ There are 10 Services available in this module to control the diagnostics
and communication-related in the ECU.
10/16/2020 10
Diagnostic Session Control Service (0x10)
Mainly 4 Different sessions are available in UDS:
1. Default Diagnostic Session
2. Programming Session
3. Extended Diagnostic Session
4. Safety System Diagnostic Session
⮚ There shall always be exactly one diagnostic session active in a server. A
server shall always start the default diagnostic session when powered up. If
no other diagnostic session is started, then the default diagnostic session
shall be running as long as the server is powered.
10/16/2020 11
ECU Reset Service (0x11)
⮚ The ECU Reset service is used by the client to request a server reset.
⮚ Different types of reset are available as per UDS protocol such as Hard
Reset, Soft Reset, Key Off-On Reset etc..
⮚ This service requests the server to effectively perform a server reset
based on the content of the resetType parameter value embedded in the
ECUReset request message.
⮚ The ECUReset positive response message (if required) shall be sent
before the reset is executed in the server(s).
⮚ After a successful server reset, the server shall activate the
defaultSession.
10/16/2020 12
Security Access (0x27)
⮚ The purpose of this service is to provide a means to access data and/or
diagnostic services which have restricted access for security, emissions or
safety reasons.
⮚ Diagnostic services for downloading/uploading routines or data into a
server and reading specific memory locations from a server are situations
where security access may be required.
⮚ Improper routines or data downloaded into a server could potentially
damage the electronics or other vehicle components or risk the vehicle’s
compliance to emissions, safety or security standards.
⮚ The security concept uses a seed and key relationship.
10/16/2020 13
Communication Control service (0x28)
⮚ The purpose of this service is to switch on/off the transmission and/or
the reception of certain messages of server (e.g. application
communication messages)
⮚ The sub-function parameter control Type contains information on how
the server shall modify the communication type referenced in the
communication Type parameter.
10/16/2020 14
Tester Present service (0x3E)
⮚ This service is used to indicate to a server (or servers) that a client is still
connected to the vehicle and that certain diagnostic services and/or
communications that have been previously activated are to remain
active.
⮚ This service is used to keep one or multiple servers in a diagnostic session
other than the default Session.
⮚ This can either be done by transmitting the Tester Present request
message periodically or, in case of the absence of other diagnostic
services, preventing the server(s) from automatically returning to the
default Session.
⮚ Service keeps communication alive- avoid timeout.
⮚ There is no sub function parameters unlike other services.
⮚ There is no response sent by the server(s).
10/16/2020 15
Access Timing Parameter service (0x83)
⮚ The Access Timing Parameter service is used to read and change the
default timing parameters of a communication link for the duration that
this communication link is active.
⮚ The use of this service is complex and depends on the server’s capability
and the data link topology.
⮚ Only one extended timing parameter set will be supported per diagnostic
session.
⮚ It is recommended to use this service only with physical addressing
because of the different sets of extended timing parameters supported
by the servers.
10/16/2020 16
Secured Data Transmission service (0x84)
⮚ The purpose of this service is to transmit data that is protected against
attacks from third parties, which could endanger data security.
⮚ The Secured Data Transmission service is applicable if a client intends to
use diagnostic services defined in a secured mode.
⮚ It may also be used to transmit external data which conform to some other
application protocol, in a secured mode between a client and a server.
⮚ A secured mode in this context means that the data transmitted is
protected by cryptographic methods.
⮚ Only physical addressing is allowed, which means that only one server is
involved.
⮚ In a secured mode, only confirmed services are allowed. Based on this
requirement, the following services are not allowed to be executed in a
secured mode,
- ResponseOnEvent (86 hex)
⎯ ReadDataByPeriodicIdentifier (2A hex)
⎯ TesterPresent (3E hex)
10/16/2020 17
Control DTC Setting service (0x85)
⮚ The ControlDTCSetting service shall be used by a client to stop or resume
the setting of diagnostic trouble codes (DTCs) in the server(s)
⮚ If the server being addressed is not able to stop the setting of diagnostic
trouble codes, it shall respond with a ControlDTCSetting negative
response message indicating the reason for the rejection.
⮚ If a clearDiagnosticInformation (14 hex) service is sent by the client, the
ControlDTCSetting shall not prohibit resetting the server's DTC memory.
⮚ If a successful ECUReset is performed, then this re-enables the setting of
DTCs.
10/16/2020 18
ResponseOnEvent service (0x86)
⮚ The ResponseOnEvent service requests a server to start or stop
transmission of responses on a specified event.
⮚ This service provides the possibility of automatically executing a
diagnostic service in the event that a specified event occurs in the server.
⮚ The client specifies the event (including optional event parameters) and
the service (including service parameters) to be executed if the event
occurs.
10/16/2020 19
Link Control service (0x87)
⮚ The Link Control service is used to control the communication link baud
rate between the client and the server(s) for the exchange of diagnostic
data.
⮚ This service optionally applies to those data link layers which allow for a
baud rate transition during an active diagnostic session.
⮚ This service is used to transition the baud rate of the data link layer.
10/16/2020 20
Data transmission functional unit
⮚ These are the services included in this functional unit.
10/16/2020 21
Stored data transmission functional unit
⮚ These are the services included in this functional unit.
⮚ One of the major services in UDS Protocol is Fault Diagnostics.
⮚ Whenever a fault occurs in a vehicle, a DTC (Diagnostic Trouble Code)
corresponding to the fault s stored in the ECU fault Memory(FCM).
⮚ Diagnostic Service Engineer can retrieve these DTCs by using the Read
DTC Information (0x19)
⮚ Clear Diagnostic Information (0xFFFFF) is used to clear the FCM of the
ECU.
10/16/2020 22
Input/output control functional unit
⮚ Input Output ControlByIdentifier (0x2F) service included in this functional
unit.
⮚ The InputOutputControlByIdentifier service is used by the client to
substitute a value for an input signal, internal server function and/or
control an output (actuator) of an electronic system.
⮚ The service allows the control of a single dataIdentifier with the
corresponding controlOptionRecord in a single request message.
⮚ The server shall send a positive response message if the request message
was successfully executed.
10/16/2020 23
Remote activation of routine functional unit
⮚ This functional unit specifies the services of remote activation of
routines(0x31) as they shall be implemented in the servers and client.
⮚ The RoutineControl service is used by the client to
⮚ ⎯ start a routine,
⮚ ⎯ stop a routine, and
⮚ ⎯ request routine results.
⮚ A routine is referenced by a two-byte routineIdentifier.
10/16/2020 24
Upload download functional unit
⮚ This functional unit specifies the following services,
⮚ The RequestDownload (0x34)service is used by the client to initiate a data
transfer from the client to the server (download).
⮚ The RequestUpload (0x35) service is used by the client to initiate a data
transfer from the server to the client (upload).
⮚ The TransferData (0x36) service is used by the client to transfer data either
from the client to the server (download) or from the server to the client
(upload).
⮚ RequestTransferExit (0x37) service is used by the client to terminate a
data transfer between client and server (upload or download).
10/16/2020 25
Thank You
