Presentation Debrecen en 2008 03 27 PDF

Diagnostic Communication of Vehicles
Electronic Transmission Control

GS-
GS-TC/ENC-
TC/ENC-Bp
Piroska, Lá
László
szló
1 GS-TC/ENC-Bp | 2008-03-27 | © Alle Rechte bei Robert Bosch GmbH, auch für den Fall von Schutzrechtsanmeldungen. Jede
Verfügungsbefugnis, wie Kopier- und Weitergaberecht, bei uns.
Debreceni Egyetem - Informatikai Napok
Main Functionality of an Automotive Control Unit

Î Main task: Fulfill its controlling functionality (e.g. control transmission unit)
Î Measure and collect the needed data for its main tasks
Î Check and filter the incoming / measured signals
Î Detect and log errors
Î In case of error – according to the type – surmount error, or restrict
functionality
Î Configuration interface
Î Automatic adaptation to environment
Î Protection against stealing / manipulation
Î Fulfill international and local standards
Î Programmable / Patchable
Î Provide information to other control units
Î Communicate with an external tester
1
Goals of the Diagnostic Communication I.

Î Main task: Fulfill its controlling functionality
Î Measure and collect the needed data for its main task
z Continuous observation of the control unit
z Check reactions of the control unit
Î Check and filter the incoming / measured signals
Î Detect and log errors
z Read error memory (source of the error, art and status)
z Check reliability of incoming / measured signals
Goals of the Diagnostic Communication II.

Î In case of error: surmount error or restrict own functionality according to
the type of error
z Read out error code
z Provide information to find the source of the error
Î After fixing error clear error memory

Î Provide information to other control units
Î Configuration interface
z Read and write configurable parameters (adapting to the other control
units or local law)

Î Automatic adaptation to environment
z Be able to clear learning values
2
Goal of the Diagnostic Communication III.

Î Protection against stealing / manipulation
z Authentification of ignition key and other control units
z Chip-tuning protection
Î Programmable / Patchable
z The main part of the control unit SW can be reprogrammed
Î Should fulfill international and local standards

z CARB (Californian Air Resource Board) /
z OBD (OnBoard Diagnostic)
z EOBD (European OnBoard Diagnostic)
z KOBD (Korean OnBoard Diagnostic)
z ISO 14229 / ISO 14230 / ISO 15031 / ISO 15765 / ISO 11898
z …
Vehicle Network Architecture in a High End Car

D-CAN E/E-Infrastructure
FlexRay
CAN
CGW
Ethernet
W-LAN
USB
BCM1 BCM2 THU Ethernet
VMM PSM EPM
CAN
MOST CAN
TV LRR ESP
AMP
SRR1 EPB ETC
Instr.
DAB/
SDARS SRR2 EPS
S/G
Disp. Video DLC
LIN ...
CDC BM
Disp. PSI5
ARS
Body Infotainment Vehicle Passive Power

& Comfort & Cockpit Motion Safety Train
Electronics Electronics Electronics Electronics Electronics
GS-TC/ENC-Bp | 2008-03-27 | © Alle Rechte bei Robert Bosch GmbH, auch für den Fall von Schutzrechtsanmeldungen. Jede
6 Verfügungsbefugnis, wie Kopier- und Weitergaberecht, bei uns.
3
Communication System in the Vehicle

Position Lever Unit Porsche Cayman
Engine Control Unit
Brake Control Unit Display Unit
Transmission Control Unit
GS-TC/ENC-Bp | 2008-03-27 | © Alle Rechte bei Robert Bosch GmbH, auch für den Fall von Schutzrechtsanmeldungen. Jede
7 Verfügungsbefugnis, wie Kopier- und Weitergaberecht, bei uns.
4
K-Line Layer 1
Vehicle Tester
Battery (~14,4V)
K-Line
ECU1 ECU2 ECUn
GND
K-Line Layer 1
Î Logical 0:
z K-Line is under 20% of battery voltage at transmitter side
z K-Line is under 30% of battery voltage at receiver side
Î Logical 1:
z K-Line is above 80% of battery voltage at transmitter side
z K-Line is above 70% of battery voltage at receiver side
5
K-Line Layer 2: Overview

Î No continuous communication: must be initialized by tester (WUP or
5BaudInit)
Î No communication between the control units
Î Each host has one or more fix addresses; multicasting is also possible
Î Fixed Baud-rate at start of the communication (10.4 kBaud), it can be
changed (until 250kBaud)
Î Defined but configurable timeout values for communication session,
request – response, response – next request separation time
Î Initialization phase determines several format parameters of the further
communication
Î Arbitration: CSMA/CD
K-Line Layer 2: Initialization

WUP StartComm Communication
25ms
50ms
Client Server
WUP StartComm Communication
25ms
50ms
Client ServerX Server1 Server2 ServerN
6
K-Line Layer 2: Message Structure

Header Data bytes Checksum
Fmt Tgt1) Src1) Len1) SId2) Data

2)
CS
max. 4 bytes max. 255 bytes 1 byte
Checksum calculation
1) Byte is optional, depending on format byte.

2) Service identification, part of data bytes.
F F L L L L L L
KWP2000 – K-Line, Layer 5-7: Service IDs

Header Data bytes Checksum
Fmt Tgt1) Src1) Len1) SId2) Data

2)
CS
max. 4 bytes max. 255 bytes 1 byte
Checksum calculation
0x01 – 0x3E, 0x80 – 0xBF: Possible Service IDs

SID + 0x40: positive response
0x7F: negative response
7
KWP2000 – K-Line, Layer 5-7: Service IDs: Example
Tester C1 33 F1 81 CS
TCU 83 F1 18 C1 XX XX CS
Tester C2 33 F1 21 XX CS
TCU 8x F1 18 61 XX … XX CS
Motronic 8x F1 10 61 XX … XX CS
ECUx 83 F1 XX 7F 21 31 CS
K-Line CAN
Î Reserved for diagnostic Î Diagnostic & continuous
communication communication between ECUs
Î Longer data packets can be Î A CAN frame is max. 8 bytes:
transmitted encapsulation of request required
Î Configurable communication Î Fixed speed: because of the
speed continuous bus configuration
Î Arbitration must be implemented Î Bus arbitration, CAN-frame
by SW (UART) structure is handled by HW
Î Additional wire + HW Î Wire + required HW component
Component (Layer1) already exists
Î Additional SW Driver for Layer 2 Î SW Drivers already exist, only sw
of diagnostic communication
must be implemented
8
CAN Layer 1 and Layer2

Î Defined by ISO 11898
CAN Layer 3 and Layer4
CAN ID dlc Data

SF 0xXXX 2-8 N_PCI 0xXX 0xXX 0xXX 0xXX 0xXX 0xXX 0xXX
FF 0xXXX 8 N_PCI 0xXX 0xXX 0xXX 0xXX 0xXX 0xXX

FC 0xXXX 3-8 N_PCI -- -- -- -- --
CF 0xXXX 2-8 N_PCI 0xXX 0xXX 0xXX 0xXX 0xXX 0xXX 0xXX
0x0L : L=Length of Data (4 bit) 0x1L LL : L=Length of Data (12 bit)
0x3F BB SS
F: FlowControll Status 0x2N : N=SequenceNumber
B: BS: max number of CF without FC
S: STmin follow-up time of CFs
9
KWP2000 over CAN
CAN ID dlc Data
Tx 0x7DF 8 0x02 0x10 0x81 0xXX 0xXX 0xXX 0xXX 0xXX

Rx 0x7E9 8 0x02 0x50 0x81 0xXX 0xXX 0xXX 0xXX 0xXX
Tx 0x7DF 8 0x02 0x21 0x80 0xXX 0xXX 0xXX 0xXX 0xXX

Rx 0x7E9 8 0x10 0x0A 0x61 0x81 0x01 0x02 0x03 0x04
Tx 0x7E1 8 0x30 0x00 0x00 0xXX 0xXX 0xXX 0xXX 0xXX
Rx 0x7E9 8 0x21 0x05 0x06 0x07 0x08 0xXX 0xXX 0xXX
10
Purpose of the Services

Î Diagnostic and Communication Management
Î Data Transmission
Î Stored Data Transmission
Î Input / Output Control
Î Remote Activation of Routine
Î Upload / Download
Î CARB / OBD / EOBD / KOBD
KWP2000 UDS
StartDiagnosticSession (0x10) DiagnosticSessionControl (0x10)
Î Sets diagnostic session: this Î Sets diagnostic session: this
session determines the session determines the availability
availability of other services of other services
Î Prepares jump to other SW parts Î Prepares jump to other SW parts of
of the ECU the ECU
Î Over K-Line: change Baud-rate Î May change timing values (not
StopDiagnosticSession (0x20) configurable)
Î Enables or sets back
SecurityAccess
Î Can reactivate deactivated CAN
communication, deactivated error
storing
Î Resets responseOnEvent
11
KWP2000 UDS
ECUReset (0x11) ECUReset (0x11)
Î After checking preconditions Î After checking preconditions
restarts the ECU software restarts the ECU software
Î Reset type may be hard or key-on- Î Reset type may be hard, key-on-off,
off soft, enable / disable
rapidPowerDown
TesterPresent (0x3E) TesterPresent (0x3E)

Î Keeps communication alive: avoid Î Keeps communication alive: avoid
communication timeout communication timeout
KWP2000 UDS
SecurityAccess (0x27) SecurityAccess (0x27)
Î Authentication of the tester, restrict Î Authentication of the tester, restrict
access access
Î May define different security levels Î May define different security levels
Î Valid during the communication Î Valid only at the activated
period diagnostic session or
communication period
AccessTimingParameters (0x83) AccessTimingParameters (0x83)

Î Timeout values and message Î Timeout values and message
separation time can be read / written separation time can be read /
written
12
KWP2000
ReadECUIdentification (0x1A)
Î The tester requests only a LocalID
Î The ECU provides information about itself, e.g. SW and HW IDs,
versions, other logistic data
UDS
CommunicationControl (0x28)
Î Activate / Deactivate sending and receiving CAN Frames for/from other
ECUs (vehicle internal communication)
Î Increases bandwidth for flash programming; prevents CAN timeout errors
Î Does not deactivate diagnostic CAN channel
SecuredDataTransmission (0x84)
Î This service encapsulates another service
Î Security SubLayer of the transmitter encodes the encapsulated service
Î Security SubLayer of the receiver decodes the encapsulated service
13
UDS
ControlDTCSettings (0x85)
Î Activate / Deactivate storing of errors into error memory
Î Used at flash programming and development
ResponseOnEvent (0x86)
Î Configures the ECU to send a response without a request in case of a
defined event
Î Permanent and temporally configuration
LinkControl (0x87)
Î Configures communication speed, if the medium is configurable
Example: Starting of Flash Programming

Func: 0x10: ExtendedSess Phys: 0x10: ProgSess
Preconditions Phys: 0x27 RequestSeed

Yes
Func: 0x85
Phys: 0x27 RequestSeed
Preconditions
Yes Auth. OK
Func: 0x28 Yes
Yes Prog
Preconditions
14

KWP2000 and UDS

ReadMemoryByAddress (0x23)
Î The tester requests a memory address and number of bytes
Î The ECU – if authentification level allows – reads out the block
Î The format of the request is different at KWP2000 and UDS
WriteMemoryByAddress(0x3D)
Î The tester sends a memory address, and number of bytes and a data
string (according to the number of bytes )
Î The ECU writes the data string into its memory
Î The format of the request is different at KWP2000 and UDS
15
KWP2000
ReadDataByLocalIdentification (0x21)
Î The tester requests one or more LocalIDs (1 byte long ID)
Î A localID identifies a part of memory (not necessarily in one block)
Î The ECU – if authentification level allows – reads out the block
Î These IDs identifies mainly pre-defined memory parts, but dynamic
definition is also allowed
Î A localID must not be unique within a vehicle
Î LocalID can be read out periodically
WriteDataByLocalIdentification (0x3B)
Î The tester sends a localID (1 byte long ID) and a data string
Î The ECU writes the data string into its memory
KWP2000
SetDataRate (0x26)
Î If any data is requested periodically, the repetition of the response can be
fast, medium or slow
Î This message defines, what does “fast”, “medium” and “slow” means
16
KWP2000 UDS
ReadDataByCommonID (0x22) ReadDataByID (0x22)
Î Similar to readDataByLocalID ReadScaleingDataID (0x2D)
(0x21) Î Descendant of KWP2000 0x1A,
Î CommonID is 2 bytes long, but 0x21 and 0x22
unique or means the same for Î The same as KWP2000 0x22, but
more ECUs periodical read not supported
WriteDataByCommonID (0x2E)
Î Similar to writeDataByLocalID WriteDataByID (0x2E)
(0x3B)
Î The same as KWP2000 0x2E
Î CommonID is 2 bytes long, but
unique or means the same for
more ECUs
KWP2000 UDS
DynamicallyDefineLocalD (0x2D) DynamicallyDefineDataID (0x2D)
Î The tester requests one or more Î The tester requests one or more
memory addresses and length, memory addresses and length,
AND/OR LocalIDs, AND/OR AND/OR dataIDs
CommonIDs
Î The ECU orders the requested Î The ECU orders the requested
memory parts to a dynamic LocalID memory parts to a dynamic DataID
Î By requesting that dynamic ID Î By requesting that dynamic ID
internal data can be read out with internal data can be read out with
low CPU overload low CPU overload
Î dynamicallyDefinedLocalID can be Î dynamicallyDefinedLocalID can be
erased erased
17
UDS
ReadDataByPeriodicID (0x2D)
Î Similar to ReadDataByID
Î The response is periodical

18
Onboard Diagnostic
Start
Input Signal Signal is analog or digital
Yes
Signal Reliable? Fulfills filter criteria; open/short-
circuited, timeout
No
Inc. counter Dec. counter
No
Cnt. threshold reached?
Yes
Beside the error code the type of the error, the
Write error to actual status; and actual value of some related
error memory signals are also stored
KWP2000 UDS
ReadDiagnosticTroubleCode ReadDTCInformation (0x19)
(0x13) Î Error memory queries, by different
ReadDiagnosticTroubleCodeBy filtering criteria
Status (0x18) Î The filtering criteria is sent by the
sub-function of the service
ReadStatusOfDiagnosticCode
(0x17)
ReadFreezeFrameData (0x12)
Î Error memory queries, by different
filtering criteria
19
KWP2000 and UDS

ClearDiagnosticInformation (0x14)
Î Clears one, a group of, or all the stored errors from error memory

20
KWP2000 UDS
InputOutputControlByLocalID InputOutputControlByIdentifier
(0x30) (0x2F)
InputOutputControlByCommonI Î Can directly control the actuator
D (0x2F) signals
Î Can directly control the actuator Î Access to actuators is application-
signals specific
Î Access to actuators is application-
specific

21
KWP2000 UDS
StartRoutineByLocalID (0x31) RoutineControl (0x31)
StartRoutineByAddress (0x38) Î Controls routines, as erasing
memory, calculate checksum,
StopRoutineByLocalID (0x32)
testing routines, etc
StopRoutineByAddress (0x39)
Î Control option is at the sub-function
RequestRoutineResultByLocalI
D (0x33)
RequestRoutineResultByAddre
ss (0x3A)
Î Controls routines, as erasing
memory, calculate checksum,
testing routines, etc

22
KWP2000 and UDS

RequestDownload (0x34)
Î The tester specifies an address and a length (not one byte), but no data
Î Specifies compressing methods
Î The ECU starts a downloading session
RequestUpload (0x35)
Î The same as RequestDownload, but initializes uploading session
TransferData (0x36)
Î Transfers the data bytes, with a help of sequence number, until the required
amount of data is reached
RequestTransferExit (0x37)
Î Terminates downloading / uploading
Questions?
23

Presentation Debrecen en 2008 03 27 PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Presentation Debrecen en 2008 03 27 PDF

Uploaded by

Copyright:

Available Formats

Diagnostic Communication of Vehicles

Electronic Transmission Control

Debreceni Egyetem - Informatikai Napok

Main Functionality of an Automotive Control Unit

Goals of the Diagnostic Communication I.

Debreceni Egyetem - Informatikai Napok

Goals of the Diagnostic Communication II.

z Provide information to find the source of the error

Î After fixing error clear error memory

units or local law)

Goal of the Diagnostic Communication III.

Î Should fulfill international and local standards

z OBD (OnBoard Diagnostic)

z EOBD (European OnBoard Diagnostic)

z KOBD (Korean OnBoard Diagnostic)

Debreceni Egyetem - Informatikai Napok

Vehicle Network Architecture in a High End Car

Body Infotainment Vehicle Passive Power

Communication System in the Vehicle

Engine Control Unit

Brake Control Unit Display Unit

Transmission Control Unit

Debreceni Egyetem - Informatikai Napok

ECU1 ECU2 ECUn

Debreceni Egyetem - Informatikai Napok

K-Line Layer 2: Overview

Debreceni Egyetem - Informatikai Napok

K-Line Layer 2: Initialization

Client ServerX Server1 Server2 ServerN

K-Line Layer 2: Message Structure

Fmt Tgt1) Src1) Len1) SId2) Data

max. 4 bytes max. 255 bytes 1 byte

1) Byte is optional, depending on format byte.

Debreceni Egyetem - Informatikai Napok

KWP2000 – K-Line, Layer 5-7: Service IDs

Fmt Tgt1) Src1) Len1) SId2) Data

max. 4 bytes max. 255 bytes 1 byte

0x01 – 0x3E, 0x80 – 0xBF: Possible Service IDs

KWP2000 – K-Line, Layer 5-7: Service IDs: Example

Debreceni Egyetem - Informatikai Napok

CAN Layer 1 and Layer2

Debreceni Egyetem - Informatikai Napok

CAN Layer 3 and Layer4

CAN ID dlc Data

FF 0xXXX 8 N_PCI 0xXX 0xXX 0xXX 0xXX 0xXX 0xXX

0x0L : L=Length of Data (4 bit) 0x1L LL : L=Length of Data (12 bit)

KWP2000 over CAN

CAN ID dlc Data

Tx 0x7DF 8 0x02 0x10 0x81 0xXX 0xXX 0xXX 0xXX 0xXX

Tx 0x7DF 8 0x02 0x21 0x80 0xXX 0xXX 0xXX 0xXX 0xXX

Debreceni Egyetem - Informatikai Napok

Purpose of the Services

Debreceni Egyetem - Informatikai Napok

TesterPresent (0x3E) TesterPresent (0x3E)

Debreceni Egyetem - Informatikai Napok

AccessTimingParameters (0x83) AccessTimingParameters (0x83)

Debreceni Egyetem - Informatikai Napok

Debreceni Egyetem - Informatikai Napok

Example: Starting of Flash Programming

Preconditions Phys: 0x27 RequestSeed

Func: 0x28 Yes

Purpose of the Services

Debreceni Egyetem - Informatikai Napok