UDS Services - $10 Diagnostic Session

Background knowledge link:

Basic Concepts of UDS - Getting Started

Where do the UDS services—DID and DTC—come from?

A few days ago, I introduced the basic concept of UDS, and then introduced the four super-critical services of UDS. Today, I will introduce other services of UDS. These services may be some professional terms that you often hear at work but don’t understand. Since I am learning this recently, I think it is necessary to learn them together. Let’s learn about 10 services first, because basically before operating the ECU, you must send a request for 10 services.

The significance of the existence of 10 services. When I first learned about this, I thought it seemed useless, but I saw that every article seemed to spend a lot of space introducing this service. The significance of the existence of 10 services is:

Through different session modes, it is limited to support certain other services only when in a specific session mode, which is equivalent to changing the state of the ECU. The default session has the least permissions and few services can be operated; the extended session is usually used to unlock high-privilege diagnostic services, such as writing data/parameters, reading and writing diagnostic codes; the programming session is used to unlock bootloader-related diagnostic services, that is, program burning.

The following table illustrates the problem well as to which session mode other services need to be supported in.

Of course, we have a $3E service that keeps the diagnostics in a non-default state. The picture above is a switching logic in different session modes.

For example, the following are request instructions for entering three different states: 01, 02, and 03.

By checking whether the response is positive or negative, we know that: entering session 01 is successful, entering session 02 fails, and entering session 03 is successful

The third line is a request to enter a programming session: 02 10 02 xx xx xx xx xx; 02 is a single frame SF at the network layer, indicating that the application layer contains 2 bytes, 10 is a service ID (SID), and 02 is a subfunction. But the ECU rejected the Tester's request. And NRC is 7E, indicating that the reason for the rejection is: the Subfunction is not supported in the current session. (The programming session cannot jump from the default session to the programming session, but can only jump from the extended session to the programming session. But when the ECU is in the default session, it executes the request for the 10 02 programming session, and the ECU will reply with a negative response of 7E NRC.)

There is a negative response for all services. The negative response is to tell the tester the reason, and the reason is NRC. The above example introduces the explanation of NRC being 7E.

There are many types of NRC, but there are three negative responses related to session services : 31, 7E, and 7F. (NRC for negative responses is universal, not different for different services, NRC is unique).

7F : NRC 7F means that the service is not supported in the current session. The 28 communication control service is not supported in the default session, but can be supported in the extended session. When the ECU is in the default session, our host computer sends the 28 service, and after receiving it, the ECU will reply with a negative response of 7F NRC.

7E : As mentioned above, 7E means not supported under the current service.

31 : A common usage of NRC 31 is to request out of range, for example, for service 22, the DID sent is not supported by the ECU. For example, the request sent is 22 01 01, because the ECU does not support the DID 01 01, it will send a negative response of NRC 31. Another usage is: 22 is supported in 3 sessions (default, programming, and extension). The DID following 22 is used to read data. There are requirements for each session level. For example, reading the hardware version number is supported in the programming session mode, but reading the vehicle speed is not supported in the programming session. When the ECU is in a programming session, the vehicle speed is read through C0 01, and the ECU will reply with a negative response of NRC 31.

To summarize, the request and response formats of 10 services are as follows :

Request: SID + one-byte Subfunction (commonly used are 01 default session, 02 programming session, 03 extended session),

Positive response: 50 (that is, 10+40) + one byte of Subfunction (that is, the diagnostic session type) + 4 bytes of session parameters.

The content of the session parameters is also defined as shown in the figure above. The specific meaning of the session parameters can also be learned in detail in the ISO14229 standard. I will only give a very basic introduction here.

Previous recommendations

If you find it useful, click on the lower right corner to read ↓