UDS (Unified Diagnostic Services)

What is Unified Diagnostic Service (UDS) Protocol?

With rapid implementation of electronic embedded systems in vehicles,
the need to track and control the vehicle’s different parameters was
imperative. Thus, diagnostic systems were developed so that the clients
(designers, testers, and mechanics) could detect the faults in the vehicle
by connecting their diagnostic tester tool to the electronic control units
(ECUs) in the vehicle.
Unified Diagnostic Service (UDS) is an automotive protocol that lets the
diagnostic systems communicate with the ECUs to diagnos e faults and
reprogram the ECUs accordingly (if required).
It is called unified because it combines and consolidates all the standards
like KWP 2000, ISO 15765 and others.

The Architecture of the UDS protocol is designed based on the Open

System Interconnection (OSI) Reference Model, and hence the UDS
software stack has a layered architecture.

1
One of the major functions of UDS software stack is to store fault code in
the ECU memory for every issue that occurs in the vehicle and transfer it
(to the client side) as and when required.
The diagnostic tester tool has a GUI that connects to the ECU, retrieves
the fault code and displays it.

Need for UDS Protocol for Vehicle Diagnostics

As OEMs integrate/assemble automotive ECUs and components from
different suppliers, a need for a standard diagnostic protocol was felt.
This is because, prior to a Unified Protocol OEMs’ and suppliers had to
deal with compatibility issues between different diagn ostic protocols like
KWP 2000, ISO 15765, and diagnostics over K-Line.
Unified Diagnostic Service (UDS) is the preferred choice of protocols for
all the off-board vehicle diagnosis. Off-board diagnostics refers to the
diagnostics of the vehicle parameters when the car is at servicing in the
garage (when the car is stationary).
ECU flashing and reprogramming can also be performed efficiently with
the help of UDS protocol stack.
Also, UDS protocol is quite flexible and is capable of performing more
detailed diagnostics as compared to other protocols like OBD and J1939.

2
Following is the list of 4 important categories of services offered by an UDS protocol
stack

 Upload/Download Capabilities

As already mentioned in the blog, UDS protocol also supports ECU

reprogramming. ECU reprogramming refers to updating the ECU
software. This is required to resolve any existing bug or add newly
developed modules in the ECU.
Using the upload and download capabilities of UDS protocol, large
packets of data can be sent and received to and from the car’s EC U
for ECU reprogramming purpose.
The client can invoke Request Download and Transfer Data service
to initiate a data transfer to the server (ECU) from the client
(diagnostic tester) using a tester device. The server upon receiving
the request will take all necessary actions to receive the data. A
positive response message is sent when the server has successfully
received the message.
Likewise, a Request Upload service is used by the client to request
data packets from the server to the client.
One of its practical examples can be configuring the parameters
relating to the vehicle’s variant code. It implies that the client can
download or upload the settings/configurations in order to change
or adapt a particular variant.
Suppose a car has two variants and one of them has Anti-lock brake
system (ABS) and the other doesn’t. The ECU of the variant with
the ABS will need to be updated with configurations and settings
to control the ABS. A task like this can be performed using this
service.

 Remote Routine Activation

Vehicle Diagnostics may require testing the faulty component in a

given range of parameters. Moreover, during the testing phase of

3
 the vehicle, some system tests may be required to run over a
period of time.
For all such tasks, remote routine activation service of UDS
protocol is used.
In order to perform a test, a routine is triggered by the client, or
to put it in another words, a routine is started by the client in the
server’s memory.
There are two methods in this remote request, one is w here the
client interrupts the routine to stop it; and the other is when the
server/ECU finishes the routine after a specified time frame.
Using this service, the client can start a routine, stop a routine and
also check the result that the routine produced after a successful
execution.
For instance, the service personnel in the garage may use this
service to run the engine fan for a certain period of time and
record the results. This would help him understand a particular
issue well and rectify it without using any hit and trial method.

 Data Transmission Capabilities

The data transmission capabilities enable the clients to read or

write any information to or from the ECU.
The data can be read or written on the basis of identifiers and
periodic identifiers. The client can also read data from the physical
memory at the specified address.
The information can range from static info like ECU serial number
to some real time data like the current status of the sensors,
engine speed etc.
If the client wants the ECU to send periodic service values, then
‘Read Data By Identifier Periodically’ service will be required. The
client can also write data by identifier and address. Using the write
service, certain values can be changed such as threshold values
and angles.

4
 Usually, the permission to write some sensitive data to the ECU
can be controlled by restricting the access using ‘Security Access
Service’. Such permissions are reserved by the OEMs as it can
interfere with the security and overall functioning of the vehicl e.

 Fault Diagnostics

One of the major services of UDS protocol is fault diagnostics.

Whenever an issue occurs in the vehicle, a diagnostic trouble code
(DTC) corresponding to the fault is stored in the ECU fault code
memory (FCM). The service personnel at the garage can retrieve
these DTCs by using the Read DTC Information service.
Fault Diagnostics service allows the client to read both emissions
related or non-emission related DTC information. The client can
define a status mask based on which the DTC infor mation will be
displayed.
DTC Snapshot data can also be retrieved using this service.
Note: DTC Snapshot data gives additional information about the
engine’s parameters during the occurrence of the fault.
The DTC information along with other data stored i n the server can
also be erased if need be. Clear Diagnostic Information service can
be invoked to delete all such diagnostics data stored in the server.
Once the fault codes are retrieved, the problem can be diagnosed
efficiently and repair work can follow.
The Final Word
UDS protocol is by far the smartest diagnostic protocol capable of
performing detailed vehicle diagnostics.
The future of UDS protocol is quite bright in the automotive industry as it
gives the flexibility to implement Diagnostics independent of the medium
that the vehicle communicates on whether the medium is CAN,K -Line or
Flex-Ray.

5
1Introduction
An automobile as we know it was not invented in a single day by a single inventor.
It is more than an engine and a body; it is a complex machine that has undergone
over a century of evolution. Over the years we have seen a constant stream of
innovations and improvements in engine design. We have seen the advent of 4
wheel brakes, fuel injection and the automatic transmission.
Detecting a failure in this complex machine would be a tedious task. However, most
of the vehicles today include computers (Electronic Control Unit (ECU)), which
monitors several sensors, located throughout the engine, fuel and exhaust systems.
When the computer system of the car detects a fault, two things are supposed to
happen/monitored. First, a warning light on the dashboard is set, to inform the
driver that a problem exists. Second the code is recorded in the computer’s
memory (Electrically Erasable Programmable Read-Only Memory) so that it can
later be retrieved by a technician for diagnosis and repair.
The key to good auto repair lies in troubleshooting the problem. Problem in cars
could be caused due to number of reasons. Proper troubleshooting will eliminate
the potential issues that aren’t the real problem and point you in the right direction.
This can be achieved through ‘Diagnostics’.
Did you notice when a problem happens in a car or a vehicle? Ok!! Let me say one
situation.
There is a Check Engine Light (warning Lamp) present in our car’s dashboard, which
alerts us when a problem occurs in the engine control system. Depending on the
nature of the problem, the Check Engine Light may come on and go off, remain on
continuously or flash. Some intermittent problems will make the Check Engine Light
come on only when the fault is occurring. When the problem goes away, the Check
Engine Light goes off. So, When the Check Engine Light comes on, a diagnostic
trouble code (DTC) is recorded in the on-board computer memory that corresponds
to the fault. Some problems can generate more than one trouble code, and some
vehicles may have multiple problems that set multiple trouble codes.

6
2Overview of Diagnostics

2.1Diagnostics
Diagnostics, as the word suggests, is to identify the cause of a problem or a
situation. Whenever the ECU finds a problem, it stores that problem as a
Diagnostics Trouble Code (DTC) in the Electrically Erasable Programmable Read-
Only Memory (EEPROM) for later retrieval. Diagnostic Tools are used to read data
(DTC’s) from the EEPROM to analyze the cause of failure.

2.2Diagnostics Protocol
Protocol refers to a set of rules for communication. Here the communication
happens between two ECUs which follow the same rule and able to exchange the
information. The protocols which are used for Diagnostics purposes are known as
Diagnostics Protocol.
The automotive industry has come up with Diagnostics protocols which are used
for diagnostics purposes like, CAN (Control Area Network), K-Line, UDS (Unified
Diagnostics Services), and KWP (Keyword Protocol) and so on. Here (in this
document) we will study/know about UDS.

2.3Diagnostics Session
Diagnostic session is the basis for/of communication between the ECU and the
diagnostic tool. During ‘Diagnostics’ the ECU being analyzed is in a particular
session. Basically there are different types of diagnostics sessions like Default
Session, Extended Diagnostic Session and ECU Programming Session.
After Ignition on, ECU will be switched to a Default Diagnostic Session and after
receiving the request from Diagnostic Tool, the ECU will be switched to the
Extended Diagnostic Session. Further, after receiving the ECU Programming Session
start request from Diagnostic tool, it will switch to the ECU Programming Session.

2.4Automotive Diagnostic Service

Automotive diagnostic service is the way to discover, what’s wrong with the vehicle
if it is not running / behaving properly. Diagnosing a vehicles problem in order to
fix or repair a car can be done through a professional automobile diagnostic center.

7
Diagnostic Service uses the read command for retrieving the information/data from
ECU and the write command to write/program the data to the ECU.
Some of the services are given below as,
Ø Diagnostic Session Control
Ø ECU Reset
Ø Clear Diagnostic Information
Ø Read DTC Information
Ø Read Data By Identifier
Ø Read Memory By Address
Ø Security Access
Ø Communication Control
Ø Write Data By Identifier
Ø Input Output Control By Identifier
Ø Write Memory By Address
Ø Tester Present
Ø Control DTC Setting
For communicating with the ECU, the diagnostic tool uses either Physical
addressing or Functional addressing method. Physical addressing is the kind of
addressing where the Diagnostics tool communicates with a single ECU. Functional
addressing is where the Diagnostics tool communicates with multiple ECUs.

ISO 14229
Services

Service ID (hex) Service Description

0x10 Diagnostic Session Control

8
0x11 ECU Reset

0x14 Clear Diagnostic Information

0x19 Read DTC Information

0x22 Read Data By Identifier

0x23 Read Memory By Address

0x27 Security Access

0x28 Communication Control

0x2A Read Data by Periodic ID

0x2E Write Data By Identifier

0x2F Input Output Control By Identifier

0x31 Routine Control

0x34 Request Download

0x35 Request Upload

0x36 Transfer Data

9
0x37 Transfer Exit

0x3D Write Memory By Address

0x3E Tester Present

0x85 Control DTC Setting

Negative response codes

The negative response codes (NRC) are divided into 3 ranges:

 0x00: positive Response parameter value for server internal implementation,

 0x01 – 0x7F: communication related negative response codes,
 0x80 – 0xFF: negative response codes for specific conditions that are not correct at the
point in time the request is received by the server. These response codes may be
utilized whenever response code 0x22 (conditions Not Correct) is listed as valid in order
to report more specifically why the requested action cannot be taken.

value Response Code Description

This response code shall not be used

in a negative response message. This
0x00 Positive Response positive Response parameter value is
reserved for server internal
implementation.

This range of values is reserved by

0x01 - 0x0F ISO SAE Reserved
this document for future definition.

This response code indicates that the

requested action has been rejected by
0x10 General Reject the server. The general Reject
response code shall only be
implemented in the server if none of
the negative response codes defined

10
 in this document meet the needs of
the implementation. At no means shall
this response code be a general
replacement for other response codes
defined.

This response code indicates that the

requested action will not be taken
because the server does not support
the requested service. The server
shall send this response code in case
the client has sent a request message
with a service identifier, which is either
0x11 Service Not Supported unknown or not supported by the
server. Therefore this negative
response code is not shown in the list
of negative response codes to be
supported for a diagnostic service,
because this negative response code
is not applicable for supported
services.

This response code indicates that the

requested action will not be taken
because the server does not support
the service specific parameters of the
request message. The server shall
0x12 Sub Function Not Supported
send this response code in case the
client has sent a request message
with a known and supported service
identifier but with "sub function“ which
is either unknown or not supported.

This response code indicates that the

requested action will not be taken
Incorrect Message Length Or because the length of the received
0x13
Invalid Format request message does not match the
prescribed length for the specified
service or the format of the
parameters do not match the

11
 prescribed format for the specified
service.

This response code shall be reported

by the server if the response to be
0x14 Response Too Long generated exceeds the maximum
number of bytes available by the
underlying network layer.

This range of values is reserved for

0x15 - 0x20 ISO SAE Reserved
future definition.

This response code indicates that the

server is temporarily too busy to
perform the requested operation. In
this circumstance the client shall
perform repetition of the "identical
request message" or "another request
message". The repetition of the
request shall be delayed by a time
specified in the respective
implementation documents.

Example: In a multi-client environment

the diagnostic request of one client
0x21 Busy Repeat Request might be blocked temporarily by a
NRC $21 while a different client
finishes a diagnostic task. If the
server is able to perform the
diagnostic task but needs additional
time to finish the task and prepare the
response, the NRC 0x78 shall be used
instead of NRC 0x21.This response
code is in general supported by each
diagnostic service, as not otherwise
stated in the data link specific
implementation document, therefore it
is not listed in the list of applicable
response codes of the diagnostic
services.

0x22 Conditions Not Correct This response code indicates that the
requested action will not be taken

12
 because the server prerequisite
conditions are not met.

This range of values is reserved for

0x23 ISO SAE Reserved
future definition.

This response code indicates that the

requested action will not be taken
because the server expects a different
sequence of request messages or
message as sent by the client. This
may occur when sequence sensitive
requests are issued in the wrong
order.
0x24 Request Sequence Error
EXAMPLE A successful Security
Access service specifies a sequence
of request Seed and send Key as sub-
functions in the request messages. If
the sequence is sent different by the
client the server shall send a negative
response message with the negative
response code 0x24
(requestSequenceError).

This range of values is reserved for

0x25 - 0x30 ISO SAE Reserved
future definition.

This response code indicates that the

requested action will not be taken
because the server has detected that
the request message contains a
parameter which attempts to substitute
a value beyond its range of authority
(e.g. attempting to substitute a data
byte of 111 when the data is only
0x31 Request Out Of Range defined to 100), or which attempts to
access a data
Identifier/routineIdentifer that is not
supported or not supported in active
session. This response code shall be
implemented for all services, which
allow the client to read data, write data
or adjust functions by data in the
server.

13
 This range of values is reserved for
0x32 ISO SAE Reserved
future definition.

This response code indicates that the

requested action will not be taken
because the server's security strategy
has not been satisfied by the client.
The server shall send this response
code if one of the following cases
occur:

 the test conditions of the server

are not met,
 the required message sequence
e.g. Diagnostic Session Control,
0x33 Security Access Denied security Access is not met,
 The client has sent a request
message which requires an
unlocked server.

Beside the mandatory use of this

negative response code as specified
in the applicable services within this
standard, this negative response code
can also be used for any case where
security is required and is not yet
granted to perform the required
service.

This range of values is reserved for

0x34 ISO SAE Reserved
future definition.

This response code indicates that the

server has not given security access
because the key sent by the client did
not match with the key in the server's
0x35 Invalid Key
memory. This counts as an attempt to
gain security. The server shall remain
locked and increment its internal
security Access Failed counter.

This response code indicates that the

0x36 Exceed Number Of Attempts requested action will not be taken
because the client has unsuccessfully
attempted to gain security access

14
 more times than the server's security
strategy will allow.

This response code indicates that the

requested action will not be taken
because the client's latest attempt to
0x37 Required Time Delay Not Expired
gain security access was initiated
before the server's required timeout
period had elapsed.

This range of values is reserved by

Reserved By Extended Data Link
0x38 - 0x4F ISO 15764 Extended data link
Security Document
security.

This range of values is reserved for

0x50 - 0x6F ISO SAE Reserved
future definition.

This response code indicates that an

attempt to upload/download to a
0x70 Upload Download Not Accepted server's memory cannot be
accomplished due to some fault
conditions.

This response code indicates that a

data transfer operation was halted due
0x71 Transfer Data Suspended
to some fault. The active transfer Data
sequence shall be aborted.

This response code indicates that the

server detected an error when erasing
0x72 General Programming Failure or programming a memory location in
the permanent memory device (e.g.
Flash Memory).

This response code indicates that the

server detected an error in the
sequence of block Sequence Counter
values. Note that the repetition of a
0x73 Wrong Block Sequence Counter Transfer Data request message with a
block Sequence Counter equal to the
one included in the previous Transfer
Data request message shall be
accepted by the server.

15
 This range of values is reserved for
0x74 - 0x77 ISO SAE Reserved
future definition.

This response code indicates that the

request message was received
correctly, and that all parameters in
the request message were valid, but
the action to be performed is not yet
completed and the server is not yet
ready to receive another request. As
soon as the requested service has
been completed, the server shall send
a positive response message or
negative response message with a
response code different from this. The
negative response message with this
response code may be repeated by
the server until the requested service
is completed and the final response
message is sent. This response code
might impact the application layer
timing parameter values. The detailed
Request Correctly Received- specification shall be included in the
0x78 data link specific implementation
Response Pending
document.
This response code shall only be used
in a negative response message if the
server will not be able to receive
further request messages from the
client while completing the requested
diagnostic service. When this
response code is used, the server
shall always send a final response
(positive or negative) independent of
the suppress Positive Response
Message Indication Bit value. A typical
example where this response code
may be used is when the client has
sent a request message, which
includes data to be programmed or
erased in flash memory of the server.
If the programming/erasing routine
(usually executed out of RAM) is not
able to support serial communication
while writing to the flash memory the

16
 server shall send a negative response
message with this response code.
This response code is in general
supported by each diagnostic service,
as not otherwise stated in the data link
specific implementation document,
therefore it is not listed in the list of
applicable response codes of the
diagnostic services.

0x79 - This range of values is reserved for

ISO SAE Reserved
0x7D future definition.

This response code indicates that the

requested action will not be taken
because the server does not support
the requested sub-function in the
session currently active. Within the
programming Session negative
response code 0x12 (sub Function Not
Supported) may optionally be reported
instead of negative response code
0x7F (sub Function Not Supported In
Active Session). This response code
Sub Function Not Supported In shall only be used when the requested
0x7E
Active Session sub-function is known to be supported
in another session, otherwise
response code 0x12 (sub Function Not
Supported) shall be used. This
response code shall be supported by
each diagnostic service with a sub-
function parameter, if not otherwise
stated in the data link specific
implementation document, therefore it
is not listed in the list of applicable
response codes of the diagnostic
services.

This response code indicates that the

requested action will not be taken
Service Not Supported In Active because the server does not support
0x7F the requested service in the session
Session
currently active. This response code
shall only be used when the requested
service is known to be supported in

17
 another session, otherwise response
code 0x11 (service Not Supported)
shall be used. This response code is
in general supported by each
diagnostic service, as not otherwise
stated in the data link specific
implementation document, therefore it
is not listed in the list of applicable
response codes of the diagnostic
services.

This range of values is reserved for

0x80 ISO SAE Reserved
future definition.

This response code indicates that the

requested action will not be taken
because the server prerequisite
0x81 Rpm Too High
condition for RPM is not met (current
RPM is above a pre-programmed
maximum threshold).

This response code indicates that the

requested action will not be taken
because the server prerequisite
0x82 Rpm Too Low
condition for RPM is not met (current
RPM is below a pre-programmed
minimum threshold).

This is required for those actuator

tests which cannot be actuated while
0x83 Engine Is Running the Engine is running. This is different
from RPM too high negative response
and needs to be allowed.

This is required for those actuator

tests which cannot be actuated unless
0x84 Engine Is Not Running the Engine is running. This is different
from RPM too low negative response,
and needs to be allowed.

This response code indicates that the

0x85 Engine Run Time Too Low requested action will not be taken
because the server prerequisite
condition for engine run time is not

18
 met (current engine run time is below
a preprogrammed limit).

This response code indicates that the

requested action will not be taken
because the server prerequisite
0x86 Temperature Too High
condition for temperature is not met
(current temperature is above a
preprogrammed maximum threshold).

This response code indicates that the

requested action will not be taken
because the server prerequisite
0x87 Temperature Too Low
condition for temperature is not met
(current temperature is below a
preprogrammed minimum threshold).

This response code indicates that the

requested action will not be taken
because the server prerequisite
0x88 Vehicle Speed Too High
condition for vehicle speed is not met
(current VS is above a pre-
programmed maximum threshold).

This response code indicates that the

requested action will not be taken
because the server prerequisite
0x89 Vehicle Speed Too Low
condition for vehicle speed is not met
(current VS is below a pre-
programmed minimum threshold).

This response code indicates that the

requested action will not be taken
because the server prerequisite
0x8A throttle/Pedal Too High
condition for throttle/pedal position is
not met (current TP/APP is above a
preprogrammed maximum threshold).

This response code indicates that the

requested action will not be taken
because the server prerequisite
0x8B throttle/Pedal Too Low
condition for throttle/pedal position is
not met (current TP/APP is below a
preprogrammed minimum threshold).

19
 This response code indicates that the
requested action will not be taken
Transmission Range Not In because the server prerequisite
0x8C
Neutral condition for being in neutral is not met
(current transmission range is not in
neutral).

This response code indicates that the

requested action will not be taken
because the server prerequisite
0x8D Transmission Range Not In Gear
condition for being in gear is not met
(current transmission range is not in
gear).

This range of values is reserved by

0x8E ISO SAE Reserved
this document for future definition.

For safety reasons, this is required for

Brake Switch(es)Not Closed
certain tests before it begins, and must
0x8F (Brake Pedal not pressed or not
be maintained for the entire duration of
applied)
the test.

For safety reasons, this is required for

certain tests before it begins, and must
0x90 Shifter Lever Not In Park
be maintained for the entire duration of
the test.

This response code indicates that the

requested action will not be taken
because the server prerequisite
0x91 Torque Converter Clutch Locked
condition for torque converter clutch is
not met (current TCC status above a
preprogrammed limit or locked).

This response code indicates that the

requested action will not be taken
because the server prerequisite
0x92 Voltage Too High condition for voltage at the primary pin
of the server (ECU) is not met (current
voltage is above a pre-programmed
maximum threshold).

This response code indicates that the

0x93 Voltage Too Low requested action will not be taken
because the server prerequisite

20
 condition for voltage at the primary pin
of the server (ECU) is not met (current
voltage is below a pre-programmed
maximum threshold).

Reserved For Specific Conditions This range of values is reserved for

0x94 - 0xFE
Not Correct future definition.

This range of values is reserved for

0xFF ISO SAE Reserved
future definition.

DTC Status Byte

bit
hex state description
#

0 0x01 Test Failed DTC failed at the time of the request

1 0x02 Test Failed This Operation Cycle DTC failed on the current operation cycle

DTC failed on the current or previous

2 0x04 Pending DTC
operation cycle

DTC is confirmed at the time of the

3 0x08 Confirmed DTC
request

Test Not Completed Since Last DTC test not completed since the last
4 0x10
Clear code clear

DTC test failed at least once since last

5 0x20 Test Failed Since Last Clear
code clear

Test Not Completed This DTC test not completed this operation
6 0x40
Operation Cycle cycle

21
 Server is requesting warning Indicator to
7 0x80 Warning Indicator Requested
be active

3DetailedDiagnostic Services
The services supported by the UDS protocol are described in the table below:
Service Name Description
Diagnostic Session Control Used to enable different diagnostic sessions in one
ECU or a group of ECUs.
ECU Reset Used by the external diagnostic tool to request an
ECU reset based on content of the reset type
parameter included in the ECU Reset request
message.
Clear Diagnostic Used by the external diagnostic tool to clear
Information diagnostic information in one or multiple ECU’s
memory.

Read DTC Information Allows a diagnostic tool to read the status of ECU
resident Diagnostic Trouble Code (DTC) information
from any ECU, or group of ECU’s within a vehicle.
Read Data By Identifier Allows the diagnostic tool to request data record
values from the ECU identified by Record data
identifier.
Read Memory By Address Allows the diagnostic tool to request memory data
from the ECU via provided starting address and size
of memory to be read.
Security Access Provides a means to access data and/or diagnostic
services, which have restricted access for security,
emissions, or safety reasons.
Communication Control Switches on and off the transmission of certain ECU
messages
Write Data By Identifier Allows the diagnostic tool to write information into
the ECU at an internal location specified by the
provided data identifier.

22
 Input Output Control By Used by the diagnostic tool to substitute a value for
Identifier an input signal, internal ECU function and/or control
an output (actuator) of an electronic system.
Write Memory By Address Allows the external diagnostic tool to write
information into the ECU at one or more contiguous
memory locations.
Tester Present Used to indicate to an ECU or a group of ECU’s that
a diagnostic tool is still connected to the vehicle.
Control DTC Setting Used by diagnostics tool to stop or resume the
setting of DTCs in ECU.

3.1Diagnostic Session Control

The “Diagnostic Session Control” service shall be used to enable different
diagnostic sessions in one ECU or a group of ECU’s. If no diagnostic session has been
requested by the client after start communication a default session shall be
automatically enabled in the server. The default session shall support at least the
following services stop Communication service and tester Present service.
If a diagnostic session has been requested by the client which is already running,
the server shall send a positive response message.
The Diagnostic Session Control request message shall meet the format defined in
the Table below:
Data Byte No. Parameter Name Data Value
1 Diagnostic Session Control 10
Service Id
2 sub Function
Default Session 01
Programming Session 02
Extended Session 03
Request Message Definition – Diagnostic Session Control
Diagnostic Session Control Responses
Once ECU receives the request message from Tester, it has to send the response
message to Tester.
If the response message is positive, then response should meet the format, given
in below table.

23
 Data Byte No. Parameter Name Data Value
1 Diagnostics Session Control 50
Response Service Id
2 sub Function 00-FF
3 Session Parameter Record 00-FF
Positive Response
And if the response message is negative, then response should meet the format,
given in below table.
Data Byte No. Parameter Name Data Value
1 Negative Response 7F
2 Diagnostics Session Control 10
3 sub function 00-FF
Sub function Not supported 12
Incorrect Message Length 13
or Invalid Format
Conditions are not correct 22
Negative Response

3.2ECU Reset
The ECU Reset service is used by the external diagnostic tool to request an ECU
reset based on content of the reset type parameter included in the ECU Reset
request message.
Basically there are two different types of ECU resets.
Hard Reset Soft Reset
Hard Reset:
This type identifies a “hard reset” condition which simulates the power-on/start-
up sequences typically performed after an ECU has been previously disconnected
from its power supply (i.e Battery). This implies the memory (Volatile or Non-
volatile) as well as electronic sub-components directly connected to the ECU are
initialized upon request of this reset type which are also initialized during the
power-up sequence.
Soft Reset:
This type identifies a “soft reset” condition, which causes the ECU to immediately
restart the application program if applicable. Before restarting the application the

24
ECU saves any data in non-volatile memory that might be lost during the startup
sequence.
The ECU Reset request message shall meet the format defined in the Table below,
Data Byte No. Parameter Name Data Value
1 ECU Reset Request Service Id 11
2 sub Function
Hard Reset – Positive 01
response required
Key On-Off Reset – Positive 02
Response Required
Soft Reset – Positive 03
Response Required
Request Message Definition – ECU Reset
ECU Reset Responses
If the response message is positive, then response should meet the format, given
in below table.

Data Byte No. Parameter Name Data Value

1 ECU Reset Response Service 51
Id
2 sub Function 00-FF
3 Power Down Time 00-FF
Positive Response
And if the response message is negative, then response should meet the format,
given in below table.
Data Byte No. Parameter Name Data Value
1 Negative Response 7F
2 ECU Reset 11
3 sub Function 00-FF
Sub function Not supported 12
Incorrect Message Length 13
or Invalid Format
Conditions are not correct 22
Negative Response

25
3.3Clear Diagnostic Information
The “Clear Diagnostic Information” service is used by the external diagnostic tool
to clear diagnostic information in one or multiple ECUs’ memory.
A “Clear DTC information” request shall reset/erase all DTC information including
the following:
a) DTC
b) DTC status byte
c) Other DTC related data such as first/most recent DTC, flags, counters, timers, etc.
specific to DTC

Data Byte No. Parameter Name Data Value

1 Clear Diagnostic 14
Information Request
Service Id
2 Group Of DTC [2] = [Group 00-FF
Of DTC High Byte Group Of
DTC Low Byte ]
3 Emission Related Systems 000000
Request Message Definition – Clear DTC Information
Clear Diagnostic Information Responses
If the response message is positive, then response should meet the format, given
in below table.
Data Byte No. Parameter Name Data Value
1 Clear Diagnostic 54
Information Positive
Response Service Id
Positive Response
And if the response message is negative, then response should meet the format,
given in below table.
Data Byte No. Parameter Name Data Value
1 Negative Response 7F

26
 2 Clear Diagnostic 14
Information Request
Service Id
3 sub-function 00-FF
Incorrect Message Length – 13
Invalid Format
Conditions Not Correct 22
Request Out Of Range 31
Negative Response

3.4Read DTC Information

This service allows a diagnostic tool to read the status of ECU resident Diagnostic
Trouble Code (DTC) information from any ECU, or group of ECU’s within a vehicle.
Requesting the ECU to report Most Recent Confirmed DTC or all Supported DTCs
the diagnostic tool shall use the format defined in the Table below.
Data Byte No. Parameter Name Data Value
1 Read DTC Information 19
request Service Id
2 sub-function 00-FF
Report Supported DTCs - 0A
Positive Response Required
Report Most Recent 0E
Confirmed DTC – Positive
Response Required
Request Message Definition – Read DTC Information
Read DTC Information Responses
If the response message is positive, then response should meet the format, given
in below table.
Data Byte No. Parameter Name Data Value
1 Read DTC Information 59
response Service Id
2 Report Type 00-FF
Report Number Of DTC By 01
Status Mask

27
 Report Number Of Mirror 11
Memory DTC By Status
Mask
Report Number Of DTC By 07
Severity Mask Record
3 DTC Status Availability Mask 00-FF
4 DTC Format Identifier 00-FF
5 DTC Count [ 2] = [DTC Count 00-FF
High Byte DTC Count Low
Byte ]
Positive Response
And if the response message is negative, then response should meet the format,
given in below table.

Data Byte No. Parameter Name Data Value

1 Negative Response 7F
2 Read DTC Information 19
3 sub-function 00-FF
Sub Function Not 12
Supported
Incorrect Message Length – 13
Invalid Format
Request Out Of Range 31
Negative Response

3.5Read Data By Identifier

The “Read Data By Identifier” service allows the diagnostic tool to request data
record values from the ECU identified by Record Data identifiers.
Data Byte No. Parameter Name Data Value
1 Read Data By Identifier 22
Request Service Id
2 Data Identifier[2] 00-FF
Request Message Definition – Read Data By Identifier
Read Data By Identifier Responses

28
 If the response message is positive, then response should meet the format, given
in below table.
Data Byte No. Parameter Name Data Value
1 Read Data By Identifier 62
Response Service Id
2 Data Identifier[2] 00-FF
4 Data Record [2] 00-FF
Positive Response
If an ECU responds positively to a “Read Data By Identifier” request, the response
message Data Identifier parameter value shall be an echo of the value provided in
the request message by the diagnostics tool
And if the response message is negative, then response should meet the format,
given in below table.

Data Byte No. Parameter Name Data Value

1 Negative Response 7F
2 Read Data By Identifier 22
3 sub-function 00-FF
Incorrect Message Length- 13
Invalid Format
Conditions Not Correct 22
Request Out of Range 31
Security Access Denied 33
Negative Response

3.6Read Memory By Address

The “Read Memory By Address” services allows the diagnostics tool to request
memory data from the ECU via provided starting address and size of memory to be
read.
Read / Write Description
Memory By
Address
Parameter

29
 Address And This parameter is a one byte value with each nibble encoded
Length Format separately :bit 3 – 0: Length(number of bytes) of the Memory
Identifier Address parameter bit 7 – 4: Length(number of bytes) of the
Memory Size parameter
Memory Address The parameter Memory Address is the starting address of
ECU’s memory where the data is to be written or from which
the data is to be read.
Memory Size The parameter Memory Size in the Read / Write Memory By
Address request message specifies the number of bytes to be
read or written starting at the address specified by Memory
Address in the ECU’s memory. The number of bytes used for
this size is defined by the high nibble (bit 7 – 4) of the Address
And Length Format Identifier.
Data Record This parameter is used by the Read Memory By Address
positive response message to provide the requested data
record values to the diagnostic tool. The content of the Data
Record is not defined in this document and is vehicle
manufacturer specific.
Read / Write Memory By Address Request Parameters
The “Read Memory By Address” request message shall meet the format defined in
table below.
Data Byte No. Parameter Name Data Value
1 Read Memory by Address Request Service ID 23
2 Address And Length Format Identifier 00-FF
3 Memory Address[2] 00-FF
4 Memory Size[2] 00-FF
Request Message Definition – Read Memory By Address
Read Memory By Address Responses
If the response message is positive, then response should meet the format, given
in below table.
Data Byte No. Parameter Name Data Value
1 Read Memory By Address Response Service Id 63
2 Data Record [2] = [data number 1,data number 2] 00-FF
Positive Response
And if the response message is negative, then response should meet the format,
given in below table.

30
 Data Byte No. Parameter Name Data Value
1 Negative Response 7F
2 Read Data By Identifier 23
3 sub-function 00-FF
Incorrect Message Length- Invalid Format 13
Conditions Not Correct 22
Request Out of Range 31
Security Access Denied 33
Negative Response

3.7Security Access
The purpose of this service is to provide a means to access data and/or diagnostic
services, which have restricted access for security, emissions, or safety reasons. The
security concept uses a seed and key relationship.
Security Access Request Type Description
Security Description
Access type
Request This type specifies that the ECU shall transmit to the test device the
Seed so called seed value with a defined security level for calculating an
appropriate key value to unlock the ECU.
Send Key This type signalizes to the ECU that the diagnostic tool transmits
now the appropriate key value associated with the seed requested
before.
The Security Access request message shall meet the format defined in table below.
Data Byte No. Parameter Name Data
Value
1 Security Access Request Service 27
ID
2 sub Function = [Security Access 00-FF
type]
Request Seed – Positive Response 01
Required
Send Key – Positive Response 02
Required
3 Security key[1] 00-FF
Request Message Definition – Security Access
31
 Security Access Responses
If the response message is positive, then response should meet the format, given
in below table.
Data Byte No. Parameter Name Data Value
1 Security Access Response Service Id 67
2 Security Access Type 00-FF
3 Security Seed [2] 00-FF
Positive Response
And if the response message is negative, then response should meet the format,
given in below table.
Data Byte No. Parameter Name Data Value
1 Negative 7F
Response
2 Security Access 27
3 sub-function 00-FF
Sub-Function Not Supported 12
Incorrect Message Length 13
Conditions Not Correct 22
Request Sequence Error 24
Invalid Key 35
Exceeded Number Of Attempts 36
Required Time Delay Not Expired 37
Negative Response

3.8Communication Control
The purpose of this service is to switch on and off the transmission of certain ECU
messages.
Control Type description
Some possible Communication Control types are,
Control Type Description
Enable Rx And This type indicates that the ECU shall enable reception and
Tx transmission of messages.
Enable Rx And This type indicates that the ECU shall enable reception of
Disable Tx messages and disable transmission of messages.
Communication Type description
32
Some possible Communication types are,
Control Type Description
Normal Communication This type references all application-related
Messages communication
Network Management This type references all network
Communication Messages management related communication.
The ECU shall perform the requested communication type control after sending the
Communication Control positive response message to the diagnostic tool if a
positive response is requested (Suppress Position Response Message Indication Bit
= FALSE).
In case no response is requested from the diagnostic tool (Suppress Position
Response Message Indication Bit = TRUE) then the ECU shall perform the requested
communication type control immediately after the successful evaluation of the
request message.
The Communication Control request message shall meet the format defined in the
Table below.

Data Byte No. Parameter Name Data

Value
1 Communication Control 28
Request Service Id
2 Security Function / Sub 00-FF
function
Enable Rx And Tx – Positive Response 01
Required
Enable Rx And Disable Tx – Positive 11
Response Required
Vehicle Manufacturer Specific – 40-5F
Positive Response Required
System Supplier Specific – Positive 60-7E
Response Required
3 Communication Type 00-FF
Normal Communication Messages 01
Network Management 02
Communication Messages
33
 Request Message Definition – Communication Control
Communication Control Responses
If the response message is positive, then response should meet the format, given
in below table.
Data Byte No. Parameter Name Data Value
1 Communication Control Response Service Id 28
2 Control Type 00-FF
Positive Response
And if the response message is negative, then response should meet the format,
given in below table.
Data Byte No. Parameter Name Data Value
1 Negative Response 7F
2 Communication Control 28
3 sub-function 00-FF
Sub-Function Not Supported 12
Incorrect Message Length 13
Conditions Not Correct 22
Request Sequence Error 31
Negative Response

3.9Write Data By Identifier

The “Write Data By Identifier” service allows the diagnostic tool to write
information into the ECU at an internal location specified by the provided data
identifier.
Following table defines the possible request and response parameter types,
Data This parameter identifies the ECU’s data record that, the diagnostic
Identifier tool is requesting to write to.
Data This parameter provides the data record associated with the Data
Record Identifier that the diagnostic tool is requesting to write to.
The Write Data By Identifier request message shall meet the format defined in the
Table below,
Data Byte No. Parameter Name Data Value
1 Write Data By Identifier Request Service Id 2E
2 Data Identifier[2] 00-FF

34
 3 Data Record [2] 00-FF
Request Message Definition – Write Data By Identifier
Write Data By Identifier Responses
If the response message is positive, then response should meet the format, given
in below table.
Data Byte No. Parameter Name Data Value
1 Write Data By Identifier Response Service Id 6E
2 Data Identifier[2] 00-FF
Positive Response
And if the response message is negative, then response should meet the format,
given in below table.
Data Byte No. Parameter Name Data Value
1 Negative Response 7F
2 Write Data By Identifier 2E
3 sub-function 00-FF
Security Access Denied 33
Incorrect Message Length 13
Conditions Not Correct 22
Request Out Of Range 31
Negative Response

3.10Input Output Control By Identifier

The “Input Output Control By Identifier” service is used by the diagnostic tool to
substitute a value for an input signal, internal ECU function and/or control an
output (actuator) of an electronic system.
The “Input Output Control By Identifier” request message shall meet the format
defined in the Table below.
Data Byte No. Parameter Name Data
Value
1 Input Output Control By Identifier Request 2F
Service Id
2 Data Identifier[2] 00-FF
3 Input Output Control Type 00-FF
Return Control To 00
ECU

35
 Reset To Default 01
Freeze Current State 02
Short Term 03
Adjustment
Request Message Definition – Input Output Control By Identifier
Input Output Control By Identifier Responses
The ECU shall send a positive response message if the requested control operation
was successfully executed. After an ECU returns a positive response to this service,
the diagnostic tool shall assume control over the inputs/outputs specified by the
Input Output Data Identifier.
If the response message is positive, then the expected response is as given in the
table below.

Data Byte Parameter Name Data

No. Value
1 Input Output Control By Identifier Response Service 6F
Id
2 Data Identifier[2] 00-FF
3 Input Output Control Type 00-03
Positive response
And if the response message is negative, then response should meet the format,
given in below table.
Data Byte No. Parameter Name Data
Value
1 Negative Response 7F
2 Input Output Control By 2F
Identifier
3 sub-function 00-FF
Incorrect Message Length – Invalid 13
Format
Conditions Not Correct 22
Request Out Of Range 31

36
 Security Access denied 33
Negative response

3.11Write Memory By Address

The “Write Memory By Address” service allows the external diagnostic tool to write
information into the ECU at one or more contiguous memory locations.
The “Write Memory By Address” request message shall meet the format defined in
the Table below.
Data Byte No. Parameter Name Data Value
1 Write Memory By Address Request Service Id 3D
2 Address And Length Format Identifier 00-FF
3 Memory Address[2] 00-FF
4 Memory Size[2] 00-FF
5 Data Record[2] 00-FF
Request Message Definition – Write Memory By Address
Write Memory By Address Responses
If the response message is positive, then response should meet the format, given
in below table.
Data Byte No. Parameter Name Data Value
1 Write Memory By Address Response Service Id 7D
2 Address And Length Format Identifier 00-FF
3 Memory Address[2] 00-FF
4 Memory Size[2] 00-FF
Positive Response
And if the response message is negative, then response should meet the format,
given in below table.
Data Byte No. Parameter Name Data
Value
1 Negative Response 7F
2 Write Memory By 3D
Address
3 sub-function 00-FF
Incorrect Message Length – Invalid 13
Format
Conditions Not Correct 22
37
 Request Out Of Range 31
Security Access denied 33
General Programming Failure 72
Negative Response

3.12Tester Present
This service is used to indicate to an ECU or a group of ECU’s that a diagnostic tool
is still connected to the vehicle and that certain diagnostic services and/or
communication that have been previously activated are to remain active.
The “Tester Present” request message shall meet the format defined in the Table
below.
Data Byte No. Parameter Name Data Value
1 Tester Present Request Service Id 3E
2 sub Function XX
Positive Response Required 00
No Positive Response Required 80
Request Message Definition – Tester Present
Tester Present Responses
If the response message is positive, then response should meet the format, given
in below table.
Data Byte No. Parameter Name Data Value
1 Tester Present Response Service Id 7E
2 sub Function 00
Positive Response
And if the response message is negative, then response should meet the format,
given in below table.
Data Byte No. Parameter Name Data Value
1 Negative Response 7F
2 Tester Present 3E
3 sub-function 00-FF
Sub Function Not Supported 12
Incorrect Message Length – Invalid Format 13
Negative Response

38
3.13Control DTC Setting
The “Control DTC setting” service is used by a diagnostic tool to stop or resume the
setting of DTCs in the ECU.
DTC setting type description
The below table defines the possible DTC Setting types,
DTC Setting Type Description
On This type requires the ECU to enable setting of DTCs.
Off This type requires the ECU to disable setting of DTCs.
The “Control DTC Setting” request message shall meet the format defined in the
Table below.
Data Byte No. Parameter Name Data
Value
1 Control DTC Setting Request Service 85
Id
2 Sub Function 00-FF
On – Positive Response 01
Required
Off – Positive Response 02
Required
Request Message Definition – Control DTC Setting
Control DTC Setting Responses
If an ECU responds positively to a “Control DTC Setting” request, the DTC Setting
type in the response shall match the DTC Setting sent in the request
If the response message is positive, then response should meet the format, given
in below table.
Data Byte No. Parameter Name Data Value
1 Control DTC Setting Positive Response Service Id C5
2 sub Function XX
Positive Response
And if the response message is negative, then response should meet the format,
given in below table.

39
 Data Byte No. Parameter Name Data Value
1 Negative Response 7F
2 Control DTC Setting 85
3 sub-function 00-FF
Sub Function Not Supported 12
Incorrect Message Length – Invalid Format 13
Conditions Not Correct 22
Request Out Of Range 31
Negative Response

4Conclusion
Due to much technological advancement, today’s cars are more complex than ever
before and so the troubleshooting of car’s problem has even become more
complex and tedious job. Thanks to advanced diagnostic facilities within the car
which assist in pin-pointing the exact cause of trouble in a car.

40