Back

UDS

Loading views...
← PreviousNext →

UDS (ISO 14229)

Overview

UDS (Unified Diagnostic Services, ISO 14229) is an automotive diagnostic protocol defining services for ECU programming, fault reading, I/O control, and data reading. It runs over ISO-TP on CAN, Ethernet (DoIP), or LIN.

1. Theory & Fundamentals

  • Application-layer protocol; transport = ISO-TP (CAN) or DoIP (Ethernet)
  • Service IDs: 0x10–0x3E (request); response = SID+0x40
  • Sessions: Default (0x01), Extended (0x03), Programming (0x02)
  • Security Access: Seed/key challenge to unlock protected services
  • DTC: Diagnostic Trouble Codes; read/clear/freeze frame
  • Routine Control: Run ECU tests, erase flash, check memory
  • Data Transfer: Upload/download firmware (0x34–0x37)

2. Frame / Packet Structure

UDS Request: [SID] [Sub-function or params] [Data]
UDS Response: [SID+0x40] [Data] (positive)
             [0x7F] [SID] [NRC] (negative)

NRC (Negative Response Codes):
  0x10=generalReject, 0x11=serviceNotSupported
  0x22=conditionsNotCorrect, 0x24=requestSequenceError
  0x25=noResponseFromSubnetComponent, 0x31=requestOutOfRange
  0x33=securityAccessDenied, 0x35=invalidKey, 0x36=exceededNumberOfAttempts

Key Services:
  0x10 DiagnosticSessionControl
  0x11 ECUReset
  0x14 ClearDiagnosticInformation
  0x19 ReadDTCInformation
  0x22 ReadDataByIdentifier
  0x27 SecurityAccess
  0x2E WriteDataByIdentifier
  0x31 RoutineControl
  0x34/36/37 Download/Transfer/Exit
  0x3E TesterPresent

3. Protocol Mechanics

  • Session management: extended session needed before most services
  • TesterPresent (0x3E): keepalive to prevent session timeout (default 5s)
  • Security access: ECU sends seed; tester computes key (algorithm proprietary)
  • Suppress positive response: sub-function bit 7 set suppresses response
  • Timing: P2 server (50ms), P2* server (5s) for slow operations

4. Hardware Implementation

  • Any CAN-capable MCU with ISO-TP stack
  • UDS library: udsoncan (Python), uds-c (C), AUTOSAR Dcm module
  • Test tool: ETAS INCA, Vector CANdela, PEAK DIAG
  • Target: STM32 as simulated ECU for testing
  • Ethernet UDS: via DoIP (Diagnostics over IP, ISO 13400)

5. Register-Level / Configuration

// UDS positive response helper
void UDS_SendPositive(uint8_t sid, uint8_t *data, uint16_t len) {
    uint8_t resp[len+1];
    resp[0]=sid+0x40;
    memcpy(&resp[1],data,len);
    ISOTP_Send(0x7E8,resp,len+1);
}
// Negative response
void UDS_SendNegative(uint8_t sid, uint8_t nrc) {
    uint8_t resp[3]={0x7F,sid,nrc};
    ISOTP_Send(0x7E8,resp,3);
}
// Session control handler
void handle_0x10(uint8_t subf) {
    if(subf==0x01){current_session=DEFAULT; UDS_SendPositive(0x10,&subf,1);}
    else if(subf==0x03){current_session=EXTENDED; UDS_SendPositive(0x10,&subf,1);}
    else UDS_SendNegative(0x10,0x12);
}

6. Driver / Software Development

  • Implement init, TX, RX functions; use interrupts or DMA
  • Handle errors: timeout, CRC mismatch, arbitration loss
  • Use circular/ring buffers for high-throughput RX
  • Add retry logic and watchdog for reliability
  • Separate hardware layer from protocol logic

7. Debugging & Testing

  • udsoncan Python library: script-based UDS tester
  • Vector CANalyzer/CANdela for automotive-grade testing
  • Common issues: wrong session for service; security not unlocked; TesterPresent missed
  • Log all request/response pairs; check NRC codes

8. Real-World Applications

  1. ECU firmware update (reflash)
  2. Production end-of-line programming
  3. Dealer diagnostic scan tools
  4. Field service reprogramming
  5. Calibration data read/write

9. Advanced Topics & Edge Cases

  • DoIP (ISO 13400): UDS over Ethernet for high-speed flash
  • AUTOSAR Dcm: Standardized UDS server in AUTOSAR architecture
  • UDS on LIN: Diagnostic frames over LIN (using 0x3C/0x3D IDs)
  • Cybersecurity: UDS services gated behind security access + certificates
  • Remote diagnostics: UDS tunneled via cellular (telematics ECU proxy)

10. Standards & Variants

Service SID Function
Session Control 0x10 Switch diagnostic session
Security Access 0x27 Seed/key unlock
Read DID 0x22 Read data by 2-byte ID
Write DID 0x2E Write data by 2-byte ID
Read DTC 0x19 Read fault codes
Routine Ctrl 0x31 Run ECU routines
Download 0x34 Initiate flash download

💡 Practical Examples

Example 1

Read VIN: 0x22 0xF190 → ECU responds with 17-byte VIN string

Example 2

Flash sequence: 0x10 02 (prog session) → 0x27 01/02 (security) → 0x34 (request download) → 0x36×N (transfer data) → 0x37 (exit)

Example 3

Read all DTCs: 0x19 0x02 0xFF → all confirmed DTCs returned

🧪 Practice Questions

Beginner

  1. What is UDS and what layer does it use?
  2. What does NRC 0x33 mean?
  3. What SID reads a data identifier?
  4. What is TesterPresent used for?
  5. What is the programming session?

    6. Intermediate

  6. Implement UDS DiagnosticSessionControl handler.
  7. Design seed/key security access algorithm.
  8. Implement ReadDataByIdentifier for 5 DIDs.
  9. Handle TesterPresent suppression bit.
  10. Build UDS flash download sequence.

    11. Advanced

  11. Implement full UDS server with all mandatory services.
  12. Build UDS-based firmware updater for STM32.
  13. Add cybersecurity: certificate-based authentication before security access.
  14. Implement UDS over DoIP on Ethernet.
  15. Write a UDS fuzzer to test ECU robustness.

    16. Hands-on Projects

  16. ECU Flasher: complete UDS reflash tool in Python with progress bar.
  17. Simulated ECU: STM32 UDS server responding to all standard services.
  18. DTC Dashboard: read and display all DTCs with descriptions.

Checklist

  • [ ] Explain UDS service structure and session concept
  • [ ] Implement session control (0x10)
  • [ ] Implement security access seed/key (0x27)
  • [ ] Implement ReadDataByIdentifier (0x22)
  • [ ] Implement WriteDataByIdentifier (0x2E)
  • [ ] Implement ReadDTCInformation (0x19)
  • [ ] Implement flash download sequence (0x34/36/37)
  • [ ] Handle TesterPresent keepalive
  • [ ] Test with udsoncan Python tool
  • [ ] Integrate with AUTOSAR Dcm module
← PreviousNext →