\\\\整車控制器系統診斷規范—“EV160”文件編號：“EV160-20150002014編制：校對：審核：“業務高級經理”會簽：“控制系統集成主管”扌比準:“部長”XXX年XXX月

版本信息版本日期編制校對審核更新描述V1.0初始版本Vl.l20151127崔曉靜崔曉靜1、修改數據鏈路層描述；2、刪除31服務的02子服務；3、刪除28服務的01、02子服務；4、刪除2703、04子服務；5、27添加seed為四個字節的隨機數；6、seed和key在列表中定4個字節；7、刪除2F02子服務；8、刪除1906子服務；9、status改為僅bit0、3支持10、刪除NRC11；11、F184修改為9個字節；12、添加故障碼中英文對照表；目錄TOC\o"1-5"\h\z版本信息2\o"CurrentDocument"參考文獻5\o"CurrentDocument"網絡拓撲5\o"CurrentDocument"診斷接口6\o"CurrentDocument"診斷需求7\o"CurrentDocument"4.1.診斷協議7\o"CurrentDocument"4.1.1.物理層7\o"CurrentDocument"4.1.2.數據鏈路層7\o"CurrentDocument"4.1.3.網絡層7應用層時間參數8\o"CurrentDocument"DiagnosticServices(ISO14229-1)8\o"CurrentDocument"SupportedDiagnosticServices9\o"CurrentDocument"DiagnosticSessionControl(10H)11\o"CurrentDocument"ECUReset(11H)13\o"CurrentDocument"CommunicationControl(28H)14\o"CurrentDocument"SecurityAccess(27H)15\o"CurrentDocument"TesterPresent(3EH)21\o"CurrentDocument"ControlDTCSetting(85H)21\o"CurrentDocument"ReadDataByIdentifier(22H)23\o"CurrentDocument"WriteDataByIdentifier(2EH)24\o"CurrentDocument"InputOutputControlByIdentifier(2FH)26\o"CurrentDocument"ClearDiagnosticInformation(14H)27\o"CurrentDocument"ReadDTCInformation(19H)28\o"CurrentDocument"RoutineControl(31H)35\o"CurrentDocument"RequestDownLoad(34H)37\o"CurrentDocument"TransferData(36H)37\o"CurrentDocument"RequestTransferExit(37H)3.7\o"CurrentDocument"故障定義38\o"CurrentDocument"故障碼DTC中英文對照表38附錄A:凍結幀信息40附錄B:42B.1版本信息參數列表：42B.2數據流參數列表：42B.3版本信息參數定義44B.4數據流參數定義46術語DTC故障診斷碼BSBlocksizeSTminMinimumSeparationTimeC有條件的M強制性執行U用戶選用TBD待定義SID服務標識符DID數據標識符NRC負響應碼UDS統的診斷服務Server服務器Client客戶端ECU電控單元參考文獻NO.參考文檔題目[1]ISO11898-1:2003Roadvehicles-Controllerareanetwork(CAN)Part1:Datalinklayerandphysicalsignaling[2]ISO11898-2:2003Roadvehicles-Controllerareanetwork(CAN)Part2:High-speedmediumaccessunit⑶ISO11898-5:2007Roadvehicles-Controllerareanetwork(CAN)Part5:High-speedmediumaccessunitwithlow-powermode[4]ISO15765-2:2004RoadVehicle-DiagnosticonCANPart2:NetworkingLayerServices⑸ISO15765-3:2004RoadVehicle-DiagnosticonCANPart3:ApplicationLayerServices⑹ISO14229-1:2006RoadVehicle-DiagnosticSystemsDiagnosticServicesSpecification[7]ISO15031-6:2005Roadvehicles-Communicationbetweenvehicleandexternalequipmentforemission-relateddiagnosticPart6:Diagnostictroublecodedefinitions網絡拓撲由網絡工程師統一發布網絡拓撲”一「一左:前豐童右At車宙右甘豐宙?控制甦;邃慚樓口；車身押制樓塊；前S1；W平熱纜；方向盤轉拘怙越瓠電子槻宜垂氛；戟擷溝傳感算；嬴一一「一左:前豐童右At車宙右甘豐宙?控制甦;邃慚樓口；車身押制樓塊；前S1；W平熱纜；方向盤轉拘怙越瓠電子槻宜垂氛；戟擷溝傳感算；嬴一CJNFCBUS：宜浪花電越雯;?BMS=電池皆理垂統；?DC-CHM：亶汛充電樁；?RMS=遠程監持乘鑽；整車控tlflh潼斷接口；電范皆理丟統；P捋坤創殍；遠理金揑乘統；充電機瑋制兼軼；電對助力轉向垂統;3EEB皿薪聽舞高通總經;I*VCU：■CHG：EPS：+MCU：電幼電機揑創甦；+ICM=儀盤捽啊垂蛻；+ECC：電子觀捽垂境；EAS=電功空謂.垂蜒；+CHG-S：充電機捽刨垂撫（MJ；卜卜I：CANVBUS：匝車髙速總線;VOJrDLC：BCM：AHL=SAS=ESP：YBS=C1VEBL3：臣車低速總拔；BCM：車身拎制農塊；DLU慈斷?n?PEPS’一梃如垂統；ICM=主儀我單元iSDM=安全氣養樓訣；ESCL：電子轉向柱鈦=RVG個車慮議乘茨；IPMS=SVA+PAS：愎燥犒敬系竦+泊車軻助垂境；AQC：自功汽翼梓制系蛻;EHLL.隕樂主養單元iEU：DVDS示果撓；DS昭罵址員麼椅奧塊；LINBUS：1ZW沁BCM=車身護割換關；Anri-PiDcbl=Anri-PiKb2=Anri-PiKh3=Anri-Puxtri：Anri-PiKh.車宙薛夾氣苑;RaduSensor.酉■怙題鴉，FigFig1.C70GB-2014整車網絡拓撲結構診斷接口丄口口口口口口口口8'口口口口□口口口応丄口口口口口口口口8'口口口口□口口口応Fig2.OBD診斷接口管腳描述1EVBUSCANH2/3/4接地5接地6/7/8/9EVBUSCANL10/11/12/13/14/15/16電源Tab1.OBD診斷接口針腳定義由線束工程師統一發布OBD接口定義”診斷需求診斷協議4.1.1.物理層物理層應滿足ISO11898-2要求及北京新能源汽車股份有限公司企業標準《新能源汽車高速CAN網絡節點級電子控制單元（ECU）技術要求》要求。4.1.2.數據鏈路層數據鏈路層應滿足ISO11898-1要求。所有診斷請求和應答幀的數據長度應為8字節，否則電控單元將忽略該診斷請求幀。當診斷響應長度不足8字節時，空余的字節應用0xAA填充。4.1.3.網絡層網絡層應滿足ISO15765-2要求和下述要求：

.尋址方式可以支持物理尋址和功能尋址。診斷消息ID描述見下表：控制器名稱簡稱物理尋址診斷請求ID(Hex)診斷響應ID(Hex)功能尋址診斷請求ID(Hex)實施網段驅動電機控制器MCU0x7E00x7E80x7DFEVBUSTab2.診斷ID列表“由網絡工程師統一發布所有診斷ID分配，各系統填寫各自的診斷ID至上表”.網絡層時間參數ParameterValueUnitBS8-STmin20msParameterTimeoutPerformanceRequirementUnitNAs/NAr70n/amsNBrn/a<70msNBs150n/amsNCsn/a<70msNCr150n/amsTab3.網絡層時間參數需求4.1.4.應用層時間參數ParameterMinMaxTimeoutUnitP2server050n/amsP2clientn/an/a150msP2*server02000n/amsP2*clientn/an/a5000msP3clientphys2P2servern/an/amsP3clientfuncP2servermaxn/an/amsParameterMinNominalTimeoutUnitS3servern/an/a5000msS3client020004000msTab4.應用層時間參數需求DiagnosticServices(ISO14229-1)ServicesshallbeimplementedaccordingtoISO14229-1.Additionaldetailsare

specifiedinthissection.4.2.1.SupportedDiagnosticServicesTheoverviewofECUsupporteddiagnosticservicesisdescribedinthefollowingtable.Table5SupporteddiagnosticservicesofECUDiagnosticServicesListSessionSecurityAccessAddressingSID(Hex)ServiceNameDefaultExtendedProgrammingPhysicalAddressFunctionAddress10DiagnosticSessionControl7711EcuReset7727SecurityAccess728CommunicationControl773ETesterPresent7785ControlDTCSetting7722ReadDataByIdentifier72EWriteDataByIdentifier71屯72FInputOutputControlBvidentifier71714ClearDiagnosticInformation719ReadDTCInformation731RoutineControl7173734RequestDownLoad73736TransferData73737RequestTransferExit737說明：訪問權限丁1表示需要擴展安全級權限，V3表示需要編程安全級權限。TheservicesneedtosupportsuppressPositveResponseBit(SPRS)areshowedinfollowingtable.Tab5.ServicessupportedSPRSbitDiagnosticServicesListSupportSPRSbitSID(Hex)ServiceName10DiagnosticSessionControl7

DiagnosticServicesListSupportSPRSbitSID(Hex)ServiceName11EcuReset27SecurityAccess28CommunicationControl3ETesterPresent85ControlDTCSetting22ReadDataByIdentifier2EWriteDataByIdentifier14ClearDiagnosticInformation19ReadDTCInformation2FInputOutputContorlByIdentifier31RoutineControl34RequestDownload36TransferData37RequestTransferExitThenegativeResponseCodes(NRC)usedbyECUaredefinedasfollows:Tab6.NegativeResponseCodesNRC(Hex)Description11HserviceNotSupported12HsubFunctionNotSupported13HincorrectMessageLengthOrInvalidFormat22HconditionsNotCorrect24HrequestSequenceError36HexceededNumberOfAttempts31HrequestOutOfRange33HsecurityAccessDenied37HrequiredTimeDelayNotExpired35HInvalidKey72HgeneralProgrammingFailure78HresponsePending7FHserviceNotSupportedInActiveSession92H/93HVoltageTooHigh/voltageTooLow7EHsubFunctionNotSupportedInActiveSessionIftwoormoreNRCsarereasonable,theECUcouldsendthenegativeresponsemessageaccordingtothefollowingpriorityrules：?The7FhNRChavethehighestpriority;?Forothers,theNRCwithsmallernumberhashigherpriority.DiagnosticSessionControl(10H)Thisserviceisusedbytheclienttoenabledifferentdiagnosticsessionsintheserver(s).Adiagnosticsessionenablesaspecificsetofdiagnosticservicesintheserver(s).MessageFormatRequest：ByteNameCvtValue(hex)#1RequestServiceldentifierM10#2Sub-function=[DefaultSessionProgrammingSessionExtendedDiagnosticSession]M010203PositiveResponse：ByteNameCvtValue#1PositiveResponseServiceIdentifierM50#2Sub-Function=[DefaultSessionProgrammingSessionExtendedDiagnosticSession]M010203P2server[]=[#3byte#1M00-FF#4byte#2]M00-FFP2*server[]=[#5byte#1M00-FF#6byte#2]M00-FFTimingP2servervalueisprovidedin1msresolution.TimingP2*servervalueisprovidedin10msresolution.NegativeResponse：ByteNameCvtValue#1NegativeResponseServiceIdentifierM7F#2RequestServiceIdentifierM10#3NegativeResponseCodeMNRCSub-functionParameterDefinitionHEXDescriptionCvt01DefaultSessionThisdiagnosticsessionenablesthedefaultdiagnosticsessionintheserver(s)anddoesnotsupportanydiagnosticapplicationtimeouthandlingprovisions.(e.g.noTesterPresentserviceisMnecessarytokeepthesessionactive).02ProgrammingSessionThisdiagnosticsessionenablesalldiagnosticservicesrequiredtosupportedthememoryprogrammingofaserver.M03ExtendedDiagnosticSessionThisdiagnosticsessioncane.g.beusedtoenablealldiagnosticservicesrequiredtosupporttheadjustmentoffunctionslike“IdleSpeed,COValue,etc."intheserver'smemory.Itcanalsobeusedtoenablediagnosticservices,whicharenotspecificallytiedtotheadjustmentoffunctions.MNegativeResponseCodes(NRC)NRC(Hex)DescriptionCvt12Thesub-functionparameterintherequestmessageisnotsupported.M13Thelengthofthemessageiswrong.M22TheECUcurrentconditionsdonotallowthechangeofdiagnosticSession.M.ImplementationRulesThisserviceisusedbythediagnostictooltoenabledifferenttypesofdiagnosticsessionsinaserver.Inordertoexecuteadiagnosticservicetheappropriatesessionhastobestartedfirst.Thereshallbeonlyonediagnosticsessionactiveatatime.Normal/DefaultSession(01h)shallbeenabledautomaticallybytheECUifnodiagnosticsessionhasbeenrequestedatpowerup.TheECUshallreturntoNormal/DefaultSession(01h)aftertimeoutofExtendedDiagnosticSession.TheECUshallbecapableofprovidingalldiagnosticfunctionalitydefinedforthedefaultdiagnosticsessionundernormaloperatingconditions.TheECUshallfirstsendaDiagnosticSessionControlPositiveResponse(50hxx)messagebeforethenewsessionbecomesactiveintheECU.ADiagnosticSessionControlPositiveResponse(50hxx)messageshallbereturnedbyanECUifthediagnostictoolrequestsasessionthatisalreadyrunning.IftheECUhasalreadyreceivedthesamerequestmessagepreviouslyandperformedtherequestedoperation,theECUshallcontinuetoperformthecurrentoperation(i.e.itisnotachangeofthesession).TheECUshallremaininitscurrentdiagnosticsessionifitisnotabletoswitchintotherequesteddiagnosticsession.TheTesterPresent(3Eh)serviceshallbeusedtokeepthenon-defaultdiagnosticsessionsactivebyretriggeringS3server.AlsoanyotherservicerequestshallretriggerS3server.AfunctionalTesterPresent(3Eh)requestwithoutresponsemaybesentatanytime,evenregardlessofanyotherserviceinprogress.Whenreceivingortransmittinganydiagnosticmessages,including3Ehservice,

theS3servertimerwillreset.DefaultExtendwci1001,10031002Programming^00211031003DefaultExtendwci1001,10031002Programming^002110310031103WO01M1O1101Fig3.SessiontransitiondiagramECUReset(11H)ThisservicerequeststheservertoeffectivelyperformanECUresetbasedonthecontentoftheResetTypeparametervalue(suppressPosRspMsgIndicationBit(bit7)notshown).MessageFormatRequest：ByteNameCvtValue(hex)#1RequestServiceldentifierM11#2Sub-Function=[ResetType:HardResetSoftReset]M0103PositiveResponse：ByteNameCvtValue#1PositiveResponseServiceIdentifierM51#2Sub-Function=[ResetType:HardResetSoftReset]M0103NegativeResponse：ByteNameCvtValue#1NegativeResponseServiceIdentifierM7F#2RequestServiceIdentifierM11#3NegativeResponseCodeMNRCSub-functionParameterDefinitionOption(Hex)DescriptionCvt01HardResetThisvalueidentifiesa“hardreset”conditionwhichSimulaMtesthpower-on/start-upsequencetypicallyperformedafteraserverhasbeenpreviouslydisconnectedfromitspowersupply(i.e.battery).03SoftResetThisvalueidentifiesa“softreset"condition,whichcausestheservertoimmediatelyrestarttheapplicationprogramifapplicable.Theperformedactionisimplementationspecificandnotdefinedbythestandard.Atypicalactionistorestarttheapplicationwithoutreinitializingofpreviouslylearnedconfigurationdata,adaptivefactorsandotherlong-termadjustments.MNegativeResponseCodes(NRC)NRC(Hex)ConditionsCvt12Sub-functionparameterintherequestmessageisnotsupported.M13ThelengthofthemessageiswrongM22ThecriteriafortheECUResetrequestarenotmet.MImplementationRulesThepositiveresponseshallbesentbeforeperformingtheECUreset.Theexecutionofresetwilltake<TBD>ms,whichmeanstheECUcan'trespondtoanynewrequestsentwithinthistime.CommunicationControl(28H)Theserviceisusedto“switchon/off”thetransmissionand/orthereceptionofcertainmessagesof(a)server(s).MessageFormatRequest：ByteNameCvtValue(hex)#1RequestServiceIdentifierM28#2Sub-Function=[EnableRxAndTxDisableRxAndTx]M0003#3CommunicationType=[NormalCommunicationMessagesNetworkManagementCommunicationMessagesNetworkManagementCommunicationMessagesAndNormalCommunicationMessages]M010203PositiveResponse：ByteNameCvtValue#1PositiveResponseServiceIdentifierM68Sub-Function=[EnableRxAndTx00#2EnableRxAndDisableTxM01DisableRxAndEnableTx02DisableRxAndTx]03

NegativeResponse：ByteNameCvtValue#1NegativeResponseServiceIdentifierM7F#2RequestServiceIdentifierM28#3NegativeResponseCodeMNRCNegativeResponseCodes(NRC)NRC(Hex)ConditionsCvt12Sub-functionparameterintherequestmessageisnotsupported.M13ThelengthofthemessageiswrongM22Theoperatingconditionsoftheserverarenotmettoperformtherequiredaction.M31NoneoftherequestedCommunicationTypevaluesaresupportedbythedevice.MSub-functionParameterDefinition：Option(hex)DescriptionCvt00EnableRxAndTxThisvalueindicatesthatthereceptionandtransmissionofmessagesshallbeenabledforthespecifiedCommunicationType.M03DisableRxAndTxThisvalueindicatesthatthereceptionandtransmissionofmessagesshallbedisabledforthespecifiedCommunicationType.MDataParameterDefinition：Option(hex)DescriptionCvt01NormalCommunicationMessagesThisvaluereferencesallapplication-relatedcommunication(inter-applicationsignalexchangebetweenmultiplein-vehicleservers).M02NetworkManagementCommunicationMessagesThisvaluereferencesallnetworkmanagementrelatedcommunication.M03NetworkManagementCommunicationMessagesAndNormalCommunicationMessagesThisvaluereferencesallnetworkmanagementandapplication-relatedcommunicationMImplementationRulesTherearenospecialgeneralimplementationrulesforthisservice.SecurityAccess(27H)Thepurposeofthisserviceistoprovideameanstoaccessdataand/ordiagnosticservices,whichhaverestrictedaccessforsecurityorsafetyreasons.Diagnosticservicesfordownloading/uploadingroutinesordataintoaserverandreadingspecificmemorylocationsfromaserveraresituationswheresecurityaccessmayberequired.Improperroutinesordatadownloadedintoaservercouldpotentiallydamagetheelectronicsorothervehiclecomponentsorriskthevehicle'scompliancetosafetysecuritystandards.Thesecurityconceptusesaseedandkeyrelationship.TheclientshallrequesttheservertounlockbysendingtheserviceSecurityAccess-RequestSeedmessage.Theservershallrespondbysendingaseed.Theseedistheinputparameterforthekeycalculationalgorithm.Itisusedbytheclienttocalculatethecorrespondingkeyvalue.Inasecondstep,theclientshallrequestthekeycomparisonbysendingthecalculatedkeytotheserverusingtheappropriateserviceSecurityAccess-SendKey.Theservershallcomparethiskeytooneinternallystored/calculated.Ifthetwonumbersmatch,thentheservershallenable(unlock)theclient'saccesstospecificservices/dataandindicatethatwiththeserviceSecurityAccess-SendKey.Ifthetwonumbersdonotmatch,thisshallbeconsideredasafalseaccessattempt.Ifaccessisrejectedforanyotherreason,itshallnotbeconsideredasafalseaccessattempt.AninvalidkeyrequirestheclienttostartoverfromthebeginningwithaSecurityAccess-RequestSeedmessage.Ifaserversupportssecurity,butisalreadyunlockedwhenaSecurityAccess-RequestSeedmessageisreceived,thatservershallrespondwithaSecurityAccess-RequestSeedpositiveresponsemessageservicewithaseedvalueequaltozero(0).Theclientshallusethismethodtodetermineifaserverislockedbycheckingforanon-zeroseed.TheSeed-KeyalgorithmforSecurityAccess(Mandatory)：Key=((((seed>>4)XORseed)<<3)XORseed)。TheSecuritySeedis4Bytesrandomnumbers.TesterECURequestSeCUrityAccess?Seed$27$xxCompute

Keypos_m_SendSeed$6Generate

SeedCompute

KeyWecurityAcCompareKeyResP°nse_一—$67$yy/廠AccepKey$7F$27RejectKeyFig4.SecurityAccessprocedureMessageFormatRequestSeedThisservicerequestsaseedfromtheserver.Basedonthisseed,theclientisabletocalculatethecorrespondingkeytobesentforunlockingtheserver.Request：ByteNameCvtValue(hex)#1RequestServiceldentifierM27#2SecurityAccessType=RequestSeedM01,11PositiveResponse：ByteNameCvtValue#1PositiveResponseServiceIdentifierM67#2SecurityAccessType=RequestSeedM01，11SecuritySeed[]=[M#3seed#1(highbyte)M00-FF

#6seed#m(lowbyte)]MOO-FFNegativeResponse：ByteNameCvtValue#1NegativeResponseServiceIdentifierM7F#2RequestServiceIdentifierM27#3NegativeResponseCodeMNRCNegativeResponseCodes(NRC)NRC(Hex)ConditionsCvt12Sub-functionparameterintherequestmessageisnotsupported.M13Thelengthofthemessageiswrong.M22ThecriteriafortheSecurityAccessrequestarenotmet.M37requiredTimeDelayNotExpiredMSendKeyThisservicesendsakeycalculatedbytheclienttotheserver.Theservershallcomparethiskeytooneinternallystored/calculated.Ifthetwonumbersmatch,thentheservershallenable(“unlock”)theclient'saccesstospecificservices/data.Request：ByteNameCvtValue(hex)#1RequestServiceIdentifierM27#2SecurityAccessType=SendKeyM02,12SecurityKey[]=[M#3key#1(highbyte)M00-FF#6key#m(lowbyte)]M00-FFPositiveResponse：ByteNameCvtValue#1PositiveResponseServiceIdentifierM67#2SecurityAccessType=SendKeyM02,12NegativeResponse：ByteNameCvtValue#1NegativeResponseServiceIdentifierM7F#2RequestServiceIdentifierM27#3NegativeResponseCodeMNRCNegativeResponseCodes(NRC)NRC(Hex)ConditionsCvt12Sub-functionparameterintherequestmessageisnotsupported.M13Thelengthofthemessageiswrong.M22ThecriteriafortheSecurityAccessrequestarenotmet.M24requestSequenceErrorThe“sendKey"sub-functionisreceivedwithoutfirstreceivinga“requestSeed"requestmessage.M35invalidKeyM36exceededNumberOfAttemptsSendifthedelaytimerisactiveduetoexceedingthemaximumnumberofMallowedfalseaccessattempts.Sub-functionParameterDefinitionHEXDescriptionCvt01requestSeed(level1)M02sendKey(level1)M11requestSeed(level3flash)M12sendKey(level3flash)MImplementationRulesAfterPowerOn/ResettheECUisinlockedstate.Thesecurityaccessfailurecounterissetto0.TheECUshallwait10sbeforeacceptingthefirstRequestSeedmessageafterEcuReset/PowerOn.AfterthethirdfailureattempttheECUshallwait10sbeforeacceptingthenext“RequestSeed”message.AflagisstoredintheEEPROMoftheECU.OneveryPowerOn/Reset,theECUchecksforthisflag,thenwaitsagain10sbeforeacceptingthenext“RequestSeed”message(ItisallowedtoimplementtheSecurityAccessrequirementwithoutbasedontheFlag)AnySecurityAccessrequestduringthistimewillberejectedwiththenegativeresponsecode“Requiredtimedelaynotexpired”(37h).Ifthetesterrequestsaseed,ithastosendthecorrespondingkeytotheECU.Thissequenceismandatory.Ifthetestersendsaconsecutive“RequestSeed”,therequestisacceptedandthesameseedisreturned,butthesecurityaccessfailurecounterisincremented.Ifthetestersendsaninvalidkey,therequestisrejectedwithnegativeresponsecode“InvalidKey”,thesequenceshallbereset(anycurrentseedbecomesinvalid)andthesecurityaccessfailurecounterisincremented.Whenthesecuritycounterreachesthevalueof3(i.e.3failedtries),theECUshallwait10sbeforeacceptinganother“RequestSeed”message.Anysuchrequestduringthistimewillberejectedwiththenegativeresponsecode“Requiredtimedelaynotexpired”(37h).Whenthe10swaittimeiselapsedthesecurityaccessfailurecounterisdecrementedbyoneandanothertryisallowed.Whenduringthistrythesecurityaccessfailurecounterisincrementedagain(duetoaninvalidkey),theECUshallwaitagain10sbeforeacceptinganother“RequestSeed”message.Whenthistryisvalid,thesecurityaccessfailurecounterisnotchanged.BJEVusesfourstates(threedifferentlevels):Locked,Unlocked(Level1),Unlock(Level2)andUnlocked(Flash).TheECUcouldsupportsomeofthemaccordingtotherequirement.

Lockedi'JMUnlocked(Flash)Urfccked(Level2j'!；IFig5.SecurityAccessTesterECUm匕l匚-丄Lockedi'JMUnlocked(Flash)Urfccked(Level2j'!；IFig5.SecurityAccessTesterECUm匕l匚-丄=二--u」^l=i-/rr-r1-'-I___,:■■-—jFf52.廠'—*LL二泄匚sKtiV127—■二4niIS-L1l"■*—幣I5：仁「r：f-ir?；t；-i|t■■-vii-卜心；-i■:'t三-:xd:mc：_'~ri-_ySi—：-.==；S2-丘?_：?nd$：?：?」SendInval1key=i「mt-e:ter_|：'t—^■f-LirTJ-.?八-LJLL：沁nrl-計￡....''■Wl"_―116questf'；,——_.22^——f..J'TOC\o"1-5"\h\zS^rid-?-'■■:.nl」2r____*—■"i.^F~52.—iPjlLII'~V/-LLLL；^qucLitS，-^—b.——-；nnd3」___—*_■"i■歹吊”￡：-f沁nd-Syy-'■Exceed皿口加匚討aytemuti_27玷E-沁CQI二"f-匚些XquWB*存廠“一一TjmE步1刊口於expifE芒*■—.—-■■■SendirivaldkeySendirivaldkey0t：6T0txii：i-r.'.dlJI-.thirdattemptTesterPresent(3EH)Thisserviceshallbeusedtoindicatetoaserverthattheclientispresent.ThisserviceisrequiredintheabsenceofotherUDSservicestopreventserversfromautomaticallyreturningtonormaloperationandstopcommunication.MessageFormatRequest:ByteNameCvtValue(hex)#1RequestServiceIdentifierM3E#2zeroSubFunctionM00PositiveResponse:ByteNameCvtValue#1PositiveResponseServiceIdentifierM7E#2zeroSubFunctionM00NegativeResponse:ByteNameCvtValue#1NegativeResponseServiceIdentifierM7F#2RequestServiceIdentifierM3E#3NegativeResponseCodeMNRCNegativeResponseCodes(NRC):NRC(Hex)ConditionsCvt12Sub-functionparameterintherequestmessageisnotsupported.M13Thelengthofthemessageiswrong.MSub-functionParameterDefinitionHEXDescriptionCvt00ZeroSubFunctionThisparametervalueisusedtoindicatethatnosub-functionvaluebesidethesuppressPosRspMsgIndicationBitissupportedbythisservice.MImplementationRulesTherearenospecialgeneralimplementationrulesforthisservice.ControlDTCSetting(85H)ThisserviceisusedtoenableanddisablethesettingofDiagnosticTroubleCodes,DTCs,intheECU(s).TheControlDTCSettingrequestmessagecanbeusedtostopthesettingofdiagnostictroublecodesinanindividualserveroragroupofservers.Iftheserverbeingaddressedisnotabletostopthesettingofdiagnostictroublecodes,itshall

respondwithaControlDTCSettingnegativeresponsemessageindicatingthereasonforthereject.MessageFormatRequest:ByteNameCvtValue(hex)#1RequestServiceldentifierM85#2DTCSettingType=[OnOff]M0102PositiveResponse:ByteNameCvtValue#1PositiveResponseServiceIdentifierMC5#2DTCSettingType[OnOff]M0102NegativeResponse:ByteNameCvtValue#1NegativeResponseServiceIdentifierM7F#2RequestServiceIdentifierM85#3NegativeResponseCodeMNRCSub-functionParameterDefinitionHEXDescriptionCvt01OnTheserver(s)shallresumethesettingofdiagnostictroublecodesaccordingtonormaloperatingconditionsM02OffTheserver(s)shallstopthesettingofdiagnostictroublecodes.MNegativeResponseCodes(NRC)NRC(Hex)ConditionsCvt12Sub-functionparameterintherequestmessageisnotsupported.M13ThelengthofthemessageiswrongM22Theoperatingconditionsoftheserverarenotmettoperformtherequiredaction.UImplementationRulesThesettingofDTCsintheECUshallbeswitchedoffdirectlyaftertherequestControlDTCSettingwithsettingmode2(switchoff)isreceived(Option:Suppresspositiveresponsemessageindicationbitisset)oraftersuccessfultransmissionofthepositiveresponse(Option:Suppresspositiveresponsemessageindicationbitisnotset).ThesettingofDTCsintheECUshallbeswitchedonagain,whenoneofthefollowingeventsoccurs:TherequestControlDTCSettingwithsettingmode1(switchon)isreceived(Option:Suppresspositiveresponsemessageindicationbitisset)oraftersuccessfultransmissionofthepositiveresponse(Option:Suppresspositiveresponsemessageindicationbitisnotset).TheECUpowersupplyvoltageisdown(resetorECUpowerdownevent).ThediagnosticsessionchangesfromExtendedDiagnosticSessiontoDefaultSession.TheservicesReadDTCInformation-ReportDTCByStatusMask,ReadDTCInformation-ReportSupportedDTCandClearDiagnosticInformationshallnotbeaffectedbythisservice.ReadDataByIdentifier(22H)TherequestmessagerequestsdatarecordvaluesfromtheserverbyoneormoredataIdentifier(s).WhenreceivingaReadDataByIdentifierrequest,theserverwillaccessthedataelementsoftherecordsspecifiedbythedataIdentifierparameter(s)andtransmittheirvalueinReadDataByIdentifierpositiveresponsecontainingtheassociateddataRecordparameter(s).MessageFormatRequest：ByteNameCvtValue(hex)#1RequestServiceldentifierM22DataIdentifier[]#1=[#2byte#1(MSB)MOO-FF#3byte#2]MOO-FF??DataIdentifier[]#m=[#n-lbyte#1(MSB)UOO-FF#nbyte#2]UOO-FFPositiveResponse：ByteNameCvtValue#1PositiveResponseServiceldentifierM62DataIdentifier[]#1=[#2byte#1(MSB)MOO-FF#3byte#2]MOO-FFDataRecord[]#1=[#4data#1MOO-FF#(k-l)+4data#k]OO-FF#(k-l)+4data#k]OO-FFDataIdentifier[]#m=[#n-(o-1)-2#n-(o-1)-1#n-(o-1)byte#1(MSB)

#n-(o-1)-2#n-(o-1)-1#n-(o-1)byte#1(MSB)

byte#2]DataRecord[]#m=[data#1OO-FFOO-FFOO-FFNegativeResponseNegativeResponse：ByteNameCvtValue#1NegativeResponseServiceIdentifierM7F#2RequestServiceIdentifierM22#3NegativeResponseCodeMNRCdata#o]OO-FF#nUNegativeResponseCodes(NRC)NRC(Hex)ConditionsCvt13Thelengthofthemessageiswrong.M22Theoperatingconditionsoftheserverarenotmettoperformtherequiredaction.U31NoneoftherequesteddataIdentifiervaluesaresupportedbythedevice.MDataParameterDefinition:FordataIdentifiersupportedbytheECU,pleaserefertoappendixB.ImplementationRulesThemaximumnumberofdataIdentifierstobereadwithinasinglerequestislimitedto1.WriteDataByIdentifier(2EH)TheWriteDataByIdentifierserviceisusedbytheclienttowriteadataRecordtoaserver.ThedataisidentifiedbyadataIdentifier.MessageFormatRequest:ByteNameCvtValue(hex)#1RequestServiceIdentifierM2EDataIdentifier]]#1=[#2byte#1(MSB)MOO-FF#3byte#2]MOO-FFDataRecord[]=[

#4data#1U00-FF#m+3data#m]U00-FFPositiveResponse：ByteNameCvtValue#1PositiveResponseServiceIdentifierM6EDataIdentifier[]#1=[#2byte#1(MSB)M00-FF#3byte#2]M00-FFNegativeResponse：ByteNameCvtValue#1NegativeResponseServiceIdentifierM7F#2RequestServiceIdentifierM2E#3NegativeResponseCodeMNRCNegativeResponseCodes(NRC)NRC(Hex)ConditionsCvt13Thelengthofthemessageiswrong.M22TheoperatingconditionsoftheECUaresuchthatitcan'tperformtherequiredaction(e.g.,thedataforaDataIdentifierisstoredinEEPROMandanEEPROMfailurehasoccurred).TheECUinternalconditionsdonotallowthewritingofanyDataIdentifier/IdentificationOption.Thesystemiscurrentlyininitialization.ThesystemiscurrentlyinInputOutputControlByIdentifierserviceactivestage.Thesystemiscurrentlybusyatmodifyingmemory.Thevehicleismoving.U31ThedataIdentifierintherequestmessageisnotsupportedintheserverorthedataIdentifierissupportedforreadonlypurpose(viaReadDataByIdentifierservice).AnydatatransmittedintherequestmessageafterthedataIdentifierisinvalid(ifapplicabletothenode).M33ThedataIdentifier,whichreferenceaspecificaddress,issecuredandtheserverisnotinanunlockedstate.M72Theserverdetectsanerrorwhenwritingtoamemorylocation.MDataParameterDefinition:FordataIdentifiersupportedbytheECU,pleaserefertoappendixB.ImplementationRulesItisthesystemsupplier'sresponsibilitythattheserverconditionsaremetwhenperforminganyactionrequestbythisservice,includingbutnotlimitedtothefollowing:1)Thehighandlowvoltagecurrentfaultdoesnotexistinthesystem.Pleasespecifyotherrulesinyourmodule.

InputOutputControlByIdentifier(2FH)Thisserviceisusedbythetestertosubstituteavalueforaninputsignal,internalECUfunctionand/orcontrolanoutputofanelectronicsystemreferencedbyaninputOutputDataIdentifier.MessageFormatRequest：ByteNameCvtValue(hex)#1RequestServiceIdentifierM2FDataIdentifier[]#1=[#2byte#1(MSB)M00-FF#3byte#2]M00-FFControlOptionRecord#1[]=[#4ControlState#1/InputOutputControlParameterM/U00-FF#4+(m-l)ControlState#m]C00-FFControlEnableMaskRecord#1[]=[#4+mControlMask#1C00-FF#4+m+(r-1)ControlMask#r]C00-FFPositiveResponse：ByteNameCvtValue#1PositiveResponseServiceIdentifierM6FDataIdentifier[]#1=[#2byte#1(MSB)M00-FF#3byte#2]M00-FFControlStatusRecord#1[]=[#4ControlState#1/InputOutputControlParameterC00-FF#4+(m-1)ControlState#m]C00-FFNegativeResponse：ByteNameCvtValue#1NegativeResponseServiceIdentifierM7F#2RequestServiceIdentifierM2F#3NegativeResponseCodeMNRCNegativeResponseCodes(NRC)NRC(Hex)ConditionsCvt13Thelengthofthemessageiswrong.M22ConditionsNotCorrectM24The“returnControlToECU"sub-functionisreceivedwithoutfirstreceivinga“ShortTermAdjustment"requestmessage.M

31Theserverdoesnotsupporttherequesteddataldentifier.TheuseroptionalinputOutputControlParametercontainsinvaliddata.OneormultipleofthecontrolStateareinvalid.M33Thecorrespondingsecurityisnotyetgrantedtoperformtherequiredservice.MDataParameterDefinitionOption(Hex)DescriptionCvt00returnControlToECUThisparameterspecifiesthattheECUshalltakecontrolofthevalueofdataIdentifier.M01ResetToDefaultThevalueshallindi