北京新能源汽车整车控制器系统诊断规范

1、整车控制器系统诊断规范 “ EV160 文件编号：“ EV160-20150002014 编制： 校对： 审核：“业务高级经理” 会签:“控制系统集成主管” 批准：“部长” XXX年XXX月 版本信息 版本 日期 编制 校对 审核 更新描述 V1.0 初始版本 V1.1 20151127 崔晓静 崔晓静 1、修改数据链路层描述； 2、删除31服务的02子服务； 3、删除28服务的01、02子服 务； 4、删除27 03、04子服务； 5、27添加seed为四个字节的随 机数； 6、seed和key在列表中疋 4个 字节； 7、删除2F 02子服务； 11、F184修改为9个字节； 12、添加故

2、障码中英文对照表； 目录 版本信息2. 1. 参考文献5. 2. 网络拓扑5. 3. 诊断接口 6. 4. 诊断需求7. 4.1. 诊断协议Z. 4.1.1. 物理层7. 4.1.2. 数据链路层 7. 4.1.3. 网络层7. 4.1.4. 应用层时间参数8 4.2. Diag no Stic Services (ISO14229-1) 8 4.2.1. Supported Diag no Stic Services9. 4.2.2. DiagnosticSessionControl(10H) 1 1 4.2.3. ECUReset (11H)13. 4.2.4. Communication

3、Control (28H) 1 4 4.2.5. SecurityAccess(27H) 1.5 4.2.6. TesterPresent(3EH) 21 4.2.7. ControlDTCSetting(85H)21 4.2.8. ReadDataByldentifier (22H)23 4.2.9. WriteDataByIdentifier (2EH)24 4.2.10. InputOutputControlByldentifier (2FH)26 4.2.11. ClearDiagnosticInformation (14H)27 4.2.12. ReadDTC In formatio

4、n (19H)28 4.2.13. Rout in eC on trol (31H)35 4.2.14. RequestDownLoad(34H)37 4.2.15. TransferData (36H)37 4.2.16. RequestTransferExit (37H).37. 5. 故障定义38 6. 故障码DTC中英文对照表 .38 附录A:冻结帧信息 .4.0 附录B:4.2 B.1版本信息参数列表：42 B.2数据流参数列表： 42 B.3版本信息参数定义 44 B.4数据流参数定义 46 术语 DTC 故障诊断码 BS Block size STmi n Minimum Sep

5、aration Time C 有条件的 M 强制性执行 U 用户选用 TBD 待定义 SID 服务标识符 DID 数据标识符 NRC 负响应码 UDS 统一的诊断服务 Server 服务器 Clie nt 客户端 ECU 电控单元 1. 参考文献 NO. 参考文档 题目 1 ISO11898-1: 2003 Road vehicles - Con troller area n etwork (CAN) Part 1:Data link layer and physical sig nali ng 2 ISO11898-2: 2003 Road vehicles - Con troller ar

6、ea n etwork (CAN) Part 2: High-speed medium access un it 3 ISO11898-5: 2007 Road vehicles - Con troller area n etwork (CAN) Part 5: High-speed medium access unit with low-power mode 4 ISO15765-2: 2004 Road Vehicle - Diagnostic on CAN Part 2: Networki ng Layer Services 5 ISO15765-3: 2004 Road Vehicle

7、 - Diagnostic on CAN Part 3: Applicati on Layer Services 6 ISO14229-1: 2006 Road Vehicle - Diag no stic Systems Diag no stic Services Specificati on 7 ISO15031-6: 2005 Road vehicles - Communi cati on betwee n vehicle and external equipment for emission-related diagnostic Part 6: Diagno stic trouble

8、code defi niti ons 2. 网络拓扑 由网络工程师统一发布网络拓扑” C70GB项目2014年度型整车网络拓扑结构 3AKE； MKU4h 5皿気 會:至鸟耳 一 - - - ei-vrats- 耳葛速胡 匕凶趣左豊匡电尊IL ! BM5： t VCD： g； 杯川. * . a M-OBL DLC. 4 BLC- HU- *3J：.口i 1* RMS：博聲虫沖 * 更制5 * BCM.耳書呼弹 A ?EP5： 口3 薑: 1 * PCI-.丽冃鼻1 AHJ * KM, * KW-氓科童出程 斗 SCM *更电和理啊 4 EP.电亍曲宅車Mi * Eg，电于 1 * EPSr

9、* nsE n售鶴”i ft EKG黑車碎珂 1 *皿，屯也屯 * TFM5岸胚HtlHI事抵口 1 * CCM-吆竄抬謝事址二 A SVAtPAS弓!罰聂虽中 i * Kt. H-FflFH?. *笑畢段1 i *却电U合週乍址E W MG自吐T第!片制薑86： CH ? For others, the NRC with smaller number has higher priority. 422. DiagnosticSessionControl (10H) This service is used by the clie nt to en able differe nt diag no

10、 stic sessi onsin the server(s). A diagnostic session enables a specific set of diagnostic services in the server(s). 4.2.2.1. Message Format Request Byte Name Cvt Value(hex) #1 RequestServiceIde ntifier M 10 #2 Sub-fu nction = DefaultSessi on Programmi ngSessi on Exte ndedDiag no sticSessi on M 01

11、02 03 Positive Resp onse Byte Name Cvt Value #1 PositiveResp on seServiceIde ntifier M 50 #2 Sub-F unction= DefaultSessi on Programmi ngSessi on Exte ndedDiag no sticSessi on M 01 02 03 P2server= #3 byte#1 M 00-FF #4 byte#2 M 00-FF P2*server= #5 byte#1 M 00-FF #6 byte#2 M 00-FF Timing P2server value

12、 is provided in 1ms resolution. Timing P2*server value is provided in 10ms resolution. Negative Resp onse Byte Name Cvt Value #1 NegativeResp on seServiceIde ntifier r m 7F #2 RequestServiceIde ntifier M 10 #3 NegativeResp on seCode M NRC Sub-function Parameter Definition HEX Descripti on Cvt 01 Def

13、aultSessi on This diag no stic sessi on en ables the default diag no stic sessi on in the server(s)and does not support any diagnostic application timeout handling provisions. (e.g. no TesterPresent service is M n ecessary to keep the sessi on active). 02 Programmi ngSessio n This diag no stic sessi

14、 on en ables all diag no stic services required to supported the memory program ming of a server. M 03 Exte ndedDiag no sticSessi on This diag no stic sessi on can e.g. be used to en able all diag no stic services required to support the adjustme nt of functions like Speed, CO Value, etc.” in the se

15、rver s memory. It car to enable diagnostic services, which are not specifically tied to the adjustme nt of fun cti ons. M i also be used Idle Negative Respo nse Codes (NRC) NRC(Hex) Descripti on Cvt 12 The sub-fu nction parameter in the request message is not supported. M 13 The len gth of the messa

16、ge is wrong. M 22 The ECUcurre nt con diti ons do not allow the cha nge ofdiag no stic Sessi on. M 4222 Implementation Rules This service is used by the diag no stic tool to en able differe nt types of diag no stic sessions in a server. In order to execute a diagnostic service the appropriate sessio

17、n has to be started first.There shall be only one diagnostic session active at a time. Normal/Default Session (01h) shall be en abled automatically by the ECU if no diag no stic sessi on has bee n requested at power up. The ECU shall return to Normal/Default Session (01h) after timeout of Exte ndedD

18、iag no stic Sessi on. The ECU shall be capable of providing all diagnostic functionality defined for the default diag no stic sessi on un der no rmal operati ng con diti ons. The ECU shall first send a Diag no sticSessio nCon trol Positive Resp onse (50h xx) message before the new sessi on becomes a

19、ctive in the ECU. A DiagnosticSessionControl Positive Response (50h xx) message shall be returned by an ECU if the diagnostic tool requests a session that is already running. If the ECU has already received the same request message previously and performed the requested operatio n, the ECU shall con

20、 ti nue to perform the curre nt operatio n (i.e. it is not a cha nge of the sessi on). The ECU shall rema in in its curre nt diag no stic sessi on if it is not able to switch into the requested diag no stic sessi on. The TesterPrese nt (3Eh) service shall be used to keep the non-default diag no stic

21、 sessi ons active by retriggeri ng S3server. Also any other service request shall retrigger S3server. A functional TesterPresent(3Eh) request without responsemay be sent at any time, eve n regardless of any other service in progress. Whe n recei ving or tran smitt ing any diag no stic messages, in c

22、ludi ng 3Eh service, the S3servertimer will reset. Default i. 01 1! Extended n Programming 10 01 Fig 3. Sessi on tran siti on diagram 423. ECUReset (11H) This service requests the server to effectively perform an ECU reset based on the content of the ResetType parameter value (suppressPosRspMsgIndic

23、ationBit(bit 7) not show n). 4.2.3.1. Message Format Request Byte Name Cvt Value(hex) #1 RequestServicelde ntifier Lm 11 #2 Sub-F un cti on= ResetType: HardReset SoftReset M 01 03 Positive Resp onse Byte Name Cvt Value #1 PositiveResp on seServicelde ntifier Lm 51 #2 Sub-F un cti on= ResetType: Hard

24、Reset SoftReset M 01 03 Negative Resp onse Byte Name Cvt Value #1 NegativeResp on seServicelde ntifier r m 7F #2 RequestServicelde ntifier Im 11 #3 NegativeResp on seCode m NRC Sub-function Parameter Definition Optio n (Hex) Descriptio n Cvt 01 HardReset This value identifies a “ hard reset ” condit

25、ion which simulate M s the power- on / start-up seque nee typically performed after a server has bee n previously disc onn ected from its power supply (i.e. battery). 03 SoftReset This value identifies a“ soiftdieoet which causes the server to immediately restart the application program if applicabl

26、e. The performed action is implementation specific and not defined by the standard. A typical action is to restart the applicati on without rein itializ ing of previously lear ned con figurati on data, adaptive factors and other Ion g-term adjustme nts. M Negative Respo nse Codes (NRC) NRC (Hex) Con

27、 diti ons Cvt 12 Sub-fu ncti on parameter in the request message is not supported. M 13 The len gth of the message is wrong M 22 The criteria for the ECUReset request are not met. M 4232 Implementation Rules The positive resp onse shall be sent before perform ing the ECU reset. The executi on of res

28、et will take ms, which means the ECU caresp ond to any new request sent with in this time. 4.2.4. CommunicationControl (28H) The service is used to “ switch on/off ” the transmission and/or the reception of certa in messages of (a) server(s). 4.2.4.1. Message Format Request Byte Name Cvt Value (hex)

29、 #1 RequestServicelde ntifier M 28 #2 Sub-F unction = En ableRxA ndTx DisableRxA ndTx M 00 03 #3 Commun icati on Type= NormalCom muni cati onM essagesNetworkMa nageme ntCom muni cati on Messages NetworkMa nageme ntCom muni cati onM essages An dNormalCom mun icatio nM essages M 01 02 03 Positive Resp

30、 onse Byte Name Cvt Value #1 PositiveResp on seServicelde ntifier M 68 Sub-F unction = En ableRxA ndTx 00 #2 En ableRxA ndDisableTx M 01 DisableRxA ndE nableTx 02 DisableRxA ndTx 03 Negative Resp onse Byte Name Cvt Value #1 NegativeResp on seServicelde ntifier M 7F #2 RequestServicelde ntifier M 28

31、#3 NegativeResp on seCode M NRC Negative Respo nse Codes(NRC) NRC (Hex) Con diti ons Cvt 12 Sub-fu ncti on parameter in the request message is not supported. M 13 The len gth of the message is wrong M 22 The operati ng con diti ons of the server are not met to perform the required action. M 31 None

32、of the requested Communi cati on Type values are supported by the device. M Sub-function Parameter Definition： Optio n( hex) Descripti on Cvt 00 En ableRxA ndTx This value in dicates that the recepti on and tran smissi on of messages shall be en abled for the specified Communi catio nType. M 03 Disa

33、bleRxA ndTx This value in dicates that the recepti on and tran smissi on of messages shall be disabled for the specified Communi cati on Type. M Data Parameter Defi nition： Optio n( hex) Descriptio n Cvt 01 NormalCom mun icati onM essages This value references all applicati on-related com muni cati

34、on (inter-application signal exchange between multiple in-vehicle servers). M 02 NetworkMa nageme ntCom muni cati onM essages This value references all n etwork man ageme nt related com muni cati on. M 03 NetworkMa nageme ntCom muni cati onM essagesA ndNormalCommu ni cati onM essages This value refe

35、rences all n etwork man ageme nt and application-related com munication M 4242 Implementation Rules There are no special general implementation rules for this service. 4.2.5. SecurityAccess (27H) The purpose of this service is to provide a means to access data an d/or diag no stic services, which ha

36、ve restricted access for security or safety reasons. Diagnostic services for dow nl oad in g/upload ing routi nes or data into a server and readi ng specific memory locati ons from a server are situati ons where security access may be required. Improper rout ines or data dow nl oaded in to a server

37、could pote ntially damage the electronics or other vehicle components or risk the vehicle s complianee to safety, o security sta ndards. The security con cept uses a seed and key relati on ship. The client shall request the server to uniock by sending the service SecurityAccess-RequestSeedmessage.Th

38、e server shall resp ond by sending a seed. The seed is the in put parameter for the key calculati on algorithm. It is used by the clie nt to calculate the corresp onding key value. In a second step, the client shall request the key comparison by sending the calculated key to the server using the app

39、ropriate service SecurityAccess-Se ndKey. The server shall compare this key to one internally stored/calculated. If the two nu mbers match, the n the server shall en able (uni ock) the clie nt acsessto specific services/dataand indicate that with the service SecurityAccess-SendKey.If the two nu mber

40、s do not match, this shall be con sidered as a false access attempt. If access is rejected for any other reas on, it shall not be con sidered as a false access attempt. An in valid key requires the clie nt to start over from the beg inning with a SecurityAccess-RequestSeed message. If a server suppo

41、rts security, but is already uni ocked whe n a SecurityAccess-RequestSeedmessageis received, that server shall respond with a SecurityAccess-RequestSeecpositive response messageservice with a seed value equal to zero (0). The clie nt shall use this method to determ ine if a server is locked by check

42、 ing for a non-zero seed. The Seed-Key algorithmfor SecurityAccess (Man datory)： Key = (seed4) XOR seed)3) XOR seed) The Security Seed is4Bytes ran dom nu mbers. Tester ECU Compute Key R -Secuity Acces， 間昨 Seed-$27； s $xx opspOnse cosi t i ve Res-p- 略一_d $67 $xx Y Send 沖 $6 Gen erate Seed Compute Ke

43、y Compare Key QPOnse/ 一一一一 $67 $yy/ Accept 矽$7尸 $27 $35 Rj ect Key $7 Fig 4. Security Access procedure 4.2.5.1. Message Format 4.2.5.1.1. Request Seed This service requests a seed from the server. Based on this seed, the client is able to calculate the corresponding key to be sent for uniocking the

44、server. Request Byte Name Cvt Value(hex) #1 RequestServicelde ntifier M 27 #2 SecurityAccessType = RequestSeed M 01, 11 Positive Resp onse Byte Name Cvt Value #1 PositiveResp on seServicelde ntifier M 67 #2 SecurityAccessType = RequestSeed M 01, 11 SecuritySeed = M #3 seed#1 (high byte) M 00-FF #6se

45、ed#m (low byte) M OO-FF Negative Resp onse Byte Name Cvt Value #1 NegativeResp on seServicelde ntifier M 7F #2 RequestServicelde ntifier M 27 #3 NegativeResp on seCode M NRC Negative Respo nse Codes(NRC) NRC (Hex) Con diti ons Cvt 12 Sub-fu nction parameter in the request message is not supported. M

46、 13 The len gth of the message is wrong. M 22 The criteria for the SecurityAccess request are not met. M 37 requiredTimeDelayNotExpired M 425.12Send Key This service sends a key calculated by the client to the server. The server shall compare this key to one in ternally stored/calculated. If the two

47、 nu mbers match, the n the server shall enable (“ uniock ” ) the client s access to specific services/data. Request Byte Name Cvt Value(hex) #1 RequestServicelde ntifier M 27 #2 SecurityAccessType = Sen dKey M 02, 12 SecurityKey = M #3 key#1 (high byte) M OO-FF #6 key#m (low byte) M OO-FF Positive R

48、esp onse Byte Name Cvt Value #1 PositiveResp on seServicelde ntifier M 67 #2 SecurityAccessType = Sen dKey M O2, 12 Negative Resp onse Byte Name Cvt Value #1 NegativeResp on seServicelde ntifier M 7F #2 RequestServicelde ntifier M 27 #3 NegativeResp on seCode M NRC Negative Respo nse Codes(NRC) NRC

49、(Hex) Con diti ons Cvt 12 Sub-fu nction parameter in the request message is not supported. M 13 The len gth of the message is wrong. r m 22 The criteria for the SecurityAccess request are not met. M 24 requestSeque nceError The “ sendKey ” -fuubction is received without first receiving a “ requestSe

50、ed ” request message. M 35 in validKey M 36 exceededNumberOfAttempts Send if the delay timer is active due to exceedi ng the maximum nu mber of M allowed falseaccess attempts. Sub-function Parameter Definition HEX Descripti on Cvt 01 requestSeed (level 1 ) M 02 sendKey (level 1 ) M 11 requestSeed (l

51、evel 3 flash ) M 12 sendKey (level 3 flash ) M 4252 Implementation Rules After PowerOn/Reset the ECU is in locked state. The security access failure coun ter is set to 0. The ECU shall wait 10 s before accepting the first RequestSeed message after EcuReset/Power On. After the third failure attempt t

52、he ECU shall wait 10s before accepting the next “ RequesSeed” message.A flag is stored in the EEPROM of the ECU. On every PowerO n/Reset, the ECU checks for this flag,the n waits aga in 10s before accept ing the next “ RequesSeed” message(It is allowed to implement the Security Access requireme nt w

53、ithout based on the Flag ) Any SecurityAccess request duri ng this time will be rejected with the n egative resp onse code“ Required time delay not expired” (37h). If the tester requests a seed, it has to send the corresp onding key to the ECU. This sequenee is mandatory. If the tester sends a conse

54、cutive “ RequesSeed” the request is accepted and the same seed is returned, but the security access failure coun ter is in creme nted. If the tester sends an inv alid key, the request is rejected with n egative resp onse code “In validKey ” , the seque nee shall be reset (any curre nt seed becomes i

55、n valid) and the security access failure coun ter is in creme nted. When the security counter reachesthe value of 3 (i.e. 3 failed tries), the ECU shall wait 10s before accepting another“ ReSeed” message. Any such request duri ng this time will be rejected with the n egative resp onse code “ Require

56、d time delay not expired (37h). When the 10s wait time is elapsed the security access failure coun ter is decreme nted by one and ano ther try is allowed. Whe n duri ng this try the security access failure coun ter is in creme nted aga in (due to an in valid key), the ECU shall wait again 10s before

57、 accepting another“ Request Seed ” message. When this tr is valid, the security access failure coun ter is not cha nged. BJEV uses four states (three different levels): Locked, Uniocked (Level 1), Un lock (Level 2) and Uni ocked (Flash). The ECU could support some of them accord ing to the requireme

58、 nt. Fig 5. SecurityAccess Tester ECU 建丫虻匸巧_ Rpquest 农曲 -Tima 血I岂 not uupi追疋 - 弘步“ A?EE5E Send Ky 阳 7 yy 他u总口色l呼 1 *” 11 rF Access Request SBi（f$27$x）r send sJ _. -吕理Lritr ppuosg Send Key 27 yy -rnvilid T _ L pF 样 7 F35 一_3eci0TY A 比殆壬 ted $27 f XX 坯pH EFF*n 一_* （67 JwK 日空ur it曾hgs； end Key 讯：$yy Tn

59、vaFd 阿 *7F f27 $35 seeuritY Access Pqw齐 Mrtd se#d SetzurM弭徑妙_ 盹nd k邙越7坍 T=aE_nLimbT_pf atlennptj $7F t27 J36 -Serijr址“沁 Raqf _Ti $7f tzi 轩？ Rjecuest equr :e 21 -u- k.ey n-?t epectfed Send invalid key, first alempt Sixl invalid key, gecond attempt Send invalid key, third attempt Fig 6. SecurityAccess

60、 NRC requireme nts 426. TesterPresent (3EH) This service shall be used to in dicate to a server that the clie nt is prese nt. This service is required in the absenee of other UDS services to prevent servers from automatically returni ng to no rmal operati on and stop com muni cati on. 4.2.6.1. Messa