UDS

Unified Diagnostics Services is the Diagnostics communication protocol in the ECU

environment with in the automotive electronics, which is specified in the ISO 14229-1.
It is identified from ISO 14230-3 (KWP-2000) and ISO 15765-3(Diagnostic communication
over a CAN)

Introduction:
 Unified it means that it is international standard not a company specific.
 UDS is used for find the failures in a car
 Diagnostics word suggest, it is identify the case of problem or a situation whenever the
ECU finds the Problem.
 It store the problem as a DTC (Diagnostics Trouble Codes) in EEPROM for later
retrieval
 Diagnostics tools are used to read the DTC from EEPROM to find the case of failures.
 These services used in Electronic fuel injection(EFI), Gere box, ABS and Air bags etc.,

UDS Messages:
 Every message includes at least one or two Protocol Control Information (PCI) byte(s)
and one Service Identifier (SID) byte.
 PCI tells what type of frame it is and how many bytes of data is in the frame. There are
three types of frames.
o Single Frame
o First Frame
o Consecutive Frame
 Single Frame (SF) is used when the whole message is shorter or equal to 7 bytes, PCI
byte not included.
 If the message is longer than 7 bytes, then the message needs to be divided and send with
multiple frames.
 When sending multiple frames a First Frame (FF) is send first and then it is followed by
Consecutive Frames (CF).
 The FF holds information about the length of the message (FF_DL) and the first six (6)
bytes of data.
 The rest of the message is sent in CF and every CF consists of one sequence number (SN)
and up to seven (7) bytes of data.
 The sequence number is used by the receiver to reassemble the message in the correct
order after the reception is complete.
 UDS specifies that a CAN data frame shall always contain eight (8) bytes so if a request
message doesn’t fill eight bytes the remaining bytes are filled with 0x55. Response
messages are filled with 0xAA instead of 0x55.
 BYTE 0 BYTE 1 BYTE 2

Higher Nibble Lower Nibble

SF PCI type SF_DL DATA DATA
FF PCI type FF_DL DATA DATA
CF PCI type SN DATA DATA
Table - Frame layout

UDS Services (for Boot loader):

1. Diagnostic Session Control
2. Communication Control
3. Control DTC Settings
4. Security Access
5. Request Download
6. Transfer Data Requests
7. Transfer Exit
8. Routine Control
9. ECU Reset

1. Diagnostic Session Control

UDS uses different modes/states/sessions which can be switched between them based on
usage/slandered/recommendation/OEMs.
o The main purpose of these services is to switch between the states..
o In default session (0x01) Diagnostic services are not supported, only supports Diagnostic
Session Control and ECU Reset. The ECU is always locked when it is in the default
session.
o Programming Session (02 hex) This session enables all services that are required to
support reprogramming of an ECU e.g. Request Download, Routine Control and Transfer
Data.
o Extended Session (02 hex) All diagnostic services can be active
Service : 0x10
Sub function Service Name Mnemonic Description
00 Reserved - -
01 Default Session DS Power on this state will be operates as
long as state change request receives
02 Programming PRGS To upload the Software
Session
 03 Extend EXTDS Access security to unlock the ECU
Diagnostic
session
04 Safety System SSDS When we deal with the passive safety
Diagnostic ECUs ex: Air Bags, seatbelt
Session validation etc.,
05-3F Reserved - -
40-5F Vehicle VMS OEM specific
manufacturer
specific
60-3E System suppler SSS ECU Design and modelling specific
Specific
7F Reserved - -

Request Frame:
PCI SID Sub fiction - - - - -
type
BYTE # 0 1 2 3 4 5 6 7
Value 0x02 0x10 0x01 0x55 0x55 0x55 0x55 0x55

Response Frame:
PCI SID Sub fiction - - - - -
type
BYTE # 0 1 2 3 4 5 6 7
Value 0x02 0x50 0x01 0xAA 0xAA 0xAA 0xAA 0xAA

Negative response codes:

 subFunctionNotSupported (12 hex)
Function (session type) in the request message is not supported.

 ncorrectMessageLengthOrInvalidFormat (13 hex)

The length of the message is wrong.

 conditionsNotCorrect (22 hex)

Used when the server is in a critical normal mode activity and therefore cannot perform
the requested control functionality
1. ECU Reset (0x11)
ECU Reset is used by external diagnostic tool to reset the ECU reset is done by the
content of reset type.
 The positive response message is sent before reset is executed in the ECU
 After a successful reset, ECU will activate the Default session
Sub function Service Name Description
01 Hard reset Hard reset message triggers a reset
that simulates start-up sequence that
are executed when the processor is
power up
02 Key Off On Shall be used when a condition
Reset similar to that the driver turns off and
on the ignition key. The reset shall
simulate an interruption on the
switched power supply
03 Soft Reset This reset restarts the application
program.
04 Enable Rapid Enables so that the ECU transition to
Power Shut sleep mode after the ignition is turned
Down Session off.
05 Disable Rapid Disables “transition to sleep mode
Power Shut after ignition is turned off”.
Down
-- Reserved sub -
functions
Request Frame:
PCI SID Sub fiction - - - - -
type
BYTE # 0 1 2 3 4 5 6 7
Value 0x02 0x11 0x01 0x55 0x55 0x55 0x55 0x55

Response Frame:
PCI SID Sub fiction - - - - -
type
BYTE # 0 1 2 3 4 5 6 7
Value 0x02 0x51 0x01 0xAA 0xAA 0xAA 0xAA 0xAA

Note: response from for Enable Rapid Power Shut Down Session will add the stand by time (06)
byte will add After this time(sec) only rapid shut down should happens
Request Frame:
PCI SID Sub fiction - - - - -
type
BYTE # 0 1 2 3 4 5 6 7
Value 0x02 0x11 0x04 0x55 0x55 0x55 0x55 0x55

Response Frame:
PCI SID Sub fiction - - - - -
type
BYTE # 0 1 2 3 4 5 6 7
Value 0x03 0x51 0x04 0x06 0xAA 0xAA 0xAA 0xAA

Negative response codes:

 subFunctionNotSupported (12 hex)
Function (session type) in the request message is not supported.

 ncorrectMessageLengthOrInvalidFormat (13 hex)

The length of the message is wrong.

 conditionsNotCorrect (22 hex)

Used when the server is in a critical normal mode activity and therefore cannot perform
the requested control functionality
  securityAccessDenied (33 hex)
This code shall be sent if this code is returned if a client sends a request with a valid
secure routine Identifier and the server’s security feature is currently active

..