Protocol Basics (ISO 14229)#
Originated from KWP2000 (ISO 14230)
Application layer protocol
Transported by ISOTP (DoCAN) or TCP (DoIP or HSFZ)
Configuration of ECUs
Execution of test routines
Reading of DTCs
Vehicle acts as server
Computer / Tester can be treated as client
Communication is driven by the client
Communication is request / response driven
First byte is always the service identifier
Range of request service identifiers:
0x10 - 0x3e and 0x80 - 0xbf
Range of positive response service identifiers:
0x50 - 0x7e and 0xc0 - 0xff,
RequestServiceId | 0x40 == PositiveResponseServiceId
Negative response service identifier:
Official request service identifier ranges as defined in ISO14229 are smaller, but sometimes OEMs use unspecified identifiers for custom services
On some services bit 7 (MSB) of byte 2 has a special meaning:
On broadcasts, the positive response is often suppressed to save bandwidth
A negative response with response code
requestCorrectlyReceived-ResponsePending (0x78)delays a positive response. If this negative response is received, a positive response will follow.
0x10 DiagnosticSessionControl: Allows to change sessions. ProgrammingSession is often the bootloader. Some OEMs have proprietary sessions.
0x11 ECUReset: Critical, if this is possible while driving
0x22 ReadDataByIdentifier: Identifiers are OEM specific. If they are known, useful information can be gathered
0x23 ReadMemoryByAddress: Bingo! … if supported.
0x27 SecurityAccess: Necessary to access protected functions. Modern ECUs have different levels.
0x28 CommunicationControl: Critical, if this is accessible while driving. Allows you to silent an ECU.
0x2E WriteDataByIdentifier: If you know what your are doing, this service might be very useful. Identifiers are OEM specific and usually kept secret.
0x2F InputOutputControlByIdentifier: Allows to overwrite input signals or to control actuators.
0x31 RoutineControl: Used for arbitrary functions from OEMs. Can be safety critical actions, security access related functions, or necessary functions during software updates.
0x34 RequestDownload: Initiates a software update.
0x36 TransferData: Transports the software update data.
0x3E TesterPresent: Important. Needs to be send periodically (\(t < 5s\)), to keep ECU in a certain session / security access level.