UDS

Unified Diagnostic Services (ISO 14229) is the standard language between testers and ECUs. Learn request/response structure, key services (0x10, 0x11, 0x14, 0x19, 0x22, 0x2E, 0x27, 0x28, 0x31, 0x34/36/37, 0x3E), negative response codes, sessions and security access, and ISO-TP transport over CAN.

Every workshop tester, end-of-line station and OTA manager talks to ECUs using UDS. A request is a service ID byte plus parameters; the ECU replies positively (SID + 0x40) or negatively (0x7F + SID + reason code).

Mastering UDS lets engineers read data, clear faults, run routines and reprogram ECUs.

An analogy

UDS is like a phone menu for ECUs: press 22 for data, 19 for fault codes, 31 to run a test — with some menus locked until you enter a PIN (security access).

Request/response model

A tester sends a request with a service ID; the ECU answers with SID + 0x40 on success or 7F SID NRC on failure. Addressing can be physical (one ECU) or functional (all ECUs, e.g. 0x7DF on CAN).

Key services

0x10 session control (default, programming, extended), 0x11 ECU reset, 0x3E tester present, 0x22/0x2E read/write data by identifier, 0x19/0x14 read/clear DTCs, 0x27 security access, 0x28 communication control, 0x31 routine control, 0x34/0x36/0x37 download, 0x85 control DTC setting.

Sessions, security and timing

Some services are only allowed in extended or programming sessions and after security access (seed–key). Sessions time out without 0x3E tester present. P2/P2* timers define response deadlines; 0x78 'response pending' extends them for long operations.

Transport and networks

On CAN, ISO-TP (ISO 15765-2) segments messages beyond one frame using first frames, flow control and consecutive frames. DoIP (ISO 13400) carries UDS over Ethernet. Authentication service 0x29 (UDS 2020) adds certificate-based access for cybersecurity.

Formulas

• Positive response: response SID = request SID + 0x40
• Negative response: 7F <SID> <NRC>
• ISO-TP frames (classic CAN): ≤ 7 bytes: 1 SF; else 1 FF (6 bytes) + ⌈(len − 6)/7⌉ CFs

Worked example: ISO-TP frame count

Given: 100-byte UDS message over classic CAN

Find: Number of CAN frames (excluding flow control).

• First frame carries 6 bytes
• Remaining 94 bytes → ⌈94/7⌉ = 14 consecutive frames
• Total 15 frames

Answer: 15 frames (+ 1 flow control from the receiver)

Worked example: Interpret a negative response

Given: Response 7F 31 22

Find: Meaning.

• 7F = negative; 31 = RoutineControl; 22 = conditionsNotCorrect

Answer: Routine refused — preconditions (e.g. engine off, speed 0) not met

Typical UDS exchanges (hex bytes)

Tester → ECU   22 F1 90             ReadDataByIdentifier: VIN (DID F190)
ECU → Tester   62 F1 90 57 56 57 ...  positive response (0x22 + 0x40) + 17 VIN bytes

Tester → ECU   10 03                 DiagnosticSessionControl: extended session
ECU → Tester   50 03 00 32 01 F4     P2 = 50 ms, P2* = 5000 ms

Tester → ECU   27 01                 SecurityAccess: request seed
ECU → Tester   67 01 3A 91 C4 07     seed
Tester → ECU   27 02 8F 12 55 E0     send key computed from seed
ECU → Tester   67 02                 unlocked

Tester → ECU   2E F1 99 20 26 09 25  WriteDataByIdentifier (programming date)
ECU → Tester   7F 2E 33              negative: securityAccessDenied (if locked)

Tester → ECU   19 02 08              ReadDTCInformation: DTCs with status mask 0x08 (confirmed)
ECU → Tester   59 02 FF 04 20 00 08  DTC P0420 (0x042000), status 0x08

Always check for 7F responses: NRC 0x78 (response pending) means wait, 0x31 request out of range, 0x33 security denied, 0x22 conditions not correct.

Common mistakes

• Wrong: Ignoring NRC 0x78 and timing out. — Right: Treat 0x78 as 'still working' and extend waiting to P2*.
• Wrong: Forgetting tester present in extended sessions. — Right: Send 3E 80 periodically or the ECU returns to default session.

Applications

• Workshop diagnostics: Read/clear DTCs, live data, actuator tests, coding.
• Manufacturing: End-of-line flashing, calibration and configuration.
• OTA & remote diagnostics: UDS over DoIP via the telematics gateway.

Key takeaways

• Request SID → response SID + 0x40, or 7F SID NRC.
• Sessions, security access and tester present.
• Key services: 10, 11, 14, 19, 22, 2E, 27, 31, 34/36/37.
• ISO-TP on CAN, DoIP on Ethernet.

Going further

• ODX/PDX: Diagnostic data descriptions used by testers to decode DIDs and DTCs.
• Service 0x29 Authentication: Certificate-based access replaces weak seed–key schemes.
• Functional vs physical addressing: Broadcast requests to all ECUs vs targeted diagnostics.