北京新能源汽车整车控制器系统诊断规范

1、文件编号:“EV14 ”编制校对审核“业务高级经理”会签“控制系统集成主管”批准“部长”XXX年XXX月版本日期编制校对审核更新描述初始版本崔晓静崔晓静修改数据链路层描述；整车控制器系统诊断规范“EV16tf版本信息目录版本信息错误!未定义书签。.参考文献 网络拓扑 诊断接口 诊断需求 诊断协议 物理层错误！未定义书签。错误！未定义书签。错误！未定义书签。错误！未定义书签。错误！未定义书签。错误！未定义书签。错误！未定义书签。数据链路层 网络层 应用层时间参数Diag no Stic Services( ISO14229-1) 错误！未定义书签。 Supp orted Diag

2、no Stic Services 错误!未定义书签。 DiagnosticSessionControl ( 10H) ECUReset (11H)错误！未定义书签。错误！未定义书签。Commu nicatio nCon trol SecurityAccess( 27H)TesterPresent ( 3EH) Co ntrolDTCSett in g(85H)错误！未定义书签。 错误！未定义书签。(28H)错误！未定义书签。错误！未定义书签。 错误！未定义书签。 错误！未定义书签。删除31服务的02子服务；删除28服务的01、02子服务； 删除27 03、04子服务；27添加seed为四个字节

3、的随机数； seed和key在列表中定 4个字节； 删除2F 02子服务；删除19 06子服务；status改为仅 bit0、3支持10、 删除 NRC11;11、F184修改为9个字节；12、 添加故障码中英文对照表；ReadDataByIdentifier ( 22H)错误！未定义书签。 WriteDataByIdentifier (2EH) 错误！未定义书签。InputOutputControlByIdentifier (2FH)错误！未定义书签。ClearDiagnosticinformation (14H) 错误！未定义书签。 ReadDTCInformation (19H) 错误！

4、未定义书签。RoutineControl (31H)错误!未定义书签。RequestDownLoad(34H)错误！未定义书签。5.6.附录 附录版本信息参数列表： 数据流参数列表： 版本信息参数定义 数据流参数定义TransferData (36H) 错误!未定义书签。 RequestTransferExit (37H)错误！未定义书签。故障定义 错误！未定义书签。故障码DTC中英文对照表错误！未定义书签。A：冻结帧信息错误!未定义书签。B:错误!未定义书签。错误！未定义书签。错误！未定义书签。 错误！未定义书签。 错误！未定义书签。术语DTC故障诊断码BSBlock sizeSTmi nM

5、i ni mum Sep arati on TimeC有条件的M强制性执行U用户选用TBD待定义SID服务标识符DID数据标识符NRC负响应码UDS统一的诊断服务Server服务器Clie nt客户端ECU电控单元参考文献NO.参考文档题目1ISO11898-1: 2003Road vehicles - Con troller area n etwork (CAN) Part 1:Data link layer and p hysical sig nali ng2ISO11898-2: 2003Road vehicles - Con troller area n etwork (CAN)Par

6、t 2: High-s peed medium access unit3ISO11898-5: 2007Road vehicles - Con troller area n etwork (CAN)Part 5: High-s peed medium access unit with low -po wer mode4ISO15765-2: 2004Road Vehicle - Diag nostic on CAN Part 2: Network ing Layer Services5ISO15765-3: 2004Road Vehicle - Diag nostic on CAN Part

7、3: App licati on Layer Services6ISO14229-1: 2006Road Vehicle - Diag no stic Systems Diag no stic Services Sp ecificati on7ISO15031-6: 2005Road vehicles - Commu ni cati on betwee n vehicle and exter nal equ ipment for emissi on-related diag no sticPart 6: Diag no stic trouble code defi niti ons网络拓扑“由

8、网络工程师统一发布网络拓扑”I ccar ITer込 II I HOC I I 严 IfVBiiSfVBiiS MMbpsMMbpsISOISO仆网看- 一1 11 11 1 VBUSVBUS SOOktpiSOOktpiI I111Sd仆甌2-* DWH-DWH- AHUE&K.AHUE&K.BUS.BUS. isanisan揑B B沖I I _ _ _ _! ! MJTEM.MJTEM. * *超A4A4甩晅! k k VOJ.VOJ. B B乍需I*I* nxnxI*I*I*I* KTKT：* *EMZ,EMZ, CBGCBG： * ElEl寻 Un/lttAAft.Un/lttAAft

9、.* *MCE.MCE.电朝电即milmil I I辛 KMKM 號 I*I* KC.KC. t t干护A,A, p p EAEA乩 l+l+ CH5-5.CH5-5. C4nC4n忡r r isafiisafi即鼻.1：C4XraC5-C4XraC5- IP4AAAtt=IP4AAAtt= WU.WU. 半幷H H . . 呼 PE gdgd * * 4 4 r r人. 皿5AV5AV方EP.EP. 干H H丘* hlhl 昨n nE E3fS3fS口. KdAtLKdAtL!*!* fiCM.fiCM.I*I* nrnr口 1 1I*I* -KM*.-KM*.*忙显丄比早4i4i羽环 fr

10、士TBWttrTBWttr*E.E.电子WHtt*.WHtt*.A A 赵赵: :M4M4霍酝热!*!* TMTM 墨压!*!* SVASVA刑峙B B土訪CftCft：*胆匕R R和吒黑A A OftOft；电七色*忌W.W.既勺9 9亍貳ft.A A DMDM 弓*A A网!4444：!*!* T4fttBtid-T4fttBtid-izvjty.izvjty. uvBrtuvBrt： &CH.&CH.事A A再tHt:tHt: ftHKV.ftHKV.X.4V.X.4V.ABrCtKfalABrCtKfal、 AHL-KKU. jWl-jWl- 沁“血甲*員细R*SamR*Sam 特*；

11、I IMjndjryMjndjry I I k kCAoruiCAorui p p WodtfilFWodtfilF , , ourour - -CWCW EVBU5EVBU5 CAMCAM VOLTSVOLTS P PcjwausLHLH BUSBUSCMFCBUCMFCBUC70GB-2014整车网络拓扑结构 诊断接口口口口口”C7()GBC7()GB项目20142014年度型整车网络拓扑结构KBUSKBUSSAESAE 加M9M9OBD诊断接口管脚描述1EVBUS CAN H2/3/4接地5接地6/7/8/9EVBUS CAN L10/11/ESP05IM値血声口口口口口口口 8CAN1

12、2/13/14/15/16电源OBD诊断接口针脚定义“由线束工程师统一发布 OBD接口定义”诊断需求 诊断协议 物理层 物理层应满足ISO11898-2要求及北京新能源汽车股份有限公司企业标准新能源汽车高速 网络节点级电子控制单元(ECU技术要求要求。数据链路层数据链路层应满足ISO11898-1要求。所有诊断请求和应答帧的数据长度应为8字节，否则电控单元将忽略该诊断请求帧。当诊断响应长度不足8字节时，空余的字节应用OxAA填充。网络层网络层应满足ISO15765-2要求和下述要求： 寻址方式可以支持物理寻址和功能寻址。 诊断消息ID描述见下表：控制器名称简称物理寻址诊断请求ID(Hex)诊断

13、响应ID(Hex)功能寻址诊断请求ID(Hex)实施网段驱动电机控制器MCU0 x7E00 x7E80 x7DFEVBUS诊断ID列表“由网络工程师统一发布所有诊断ID分配，各系统填写各自的诊断ID至上表”网络层时间参数P arameterValueUn itBS8-STmi n20msP arameterTimeoutP erforma nee Requireme ntUn itN As/N Ar70n/amsN Brn/a70msN Bs150n/amsN Csn/aV36Tran sferDataVVV37RequestTra nsferExitVVV说明：访问权限1表示需要扩展安全级权

14、限，“3表示需要编程安全级权限。The services n eed to support supp ress Po sitveRes pon seBit (S PRS) are showed in follow ing table. Services supp orted SPRS bitDiag no stic Services ListSID (Hex)Service NameSupport SPRS bit10Diag no sticSessi onCon trolV11EcuResetV27SecurityAccess28Communi cati onCon trolV3ETeste

15、rPrese ntV85Con trolDTCSetti ngV22ReadDataByIde ntifier2EWriteDataByIde ntifierDiag no stic Services ListSID(Hex)Service NameSupport SPRS bit14ClearDiag no stic In formatio n19ReadDTCI nformatio n2FInp utOut pu tCo ntorlBylde ntifier31Routi neCo ntrol34RequestDow nl oad36Tran sferData37RequestTra ns

16、ferExitThe n egativeRes pon seCodes (NRC) used by ECU are defi ned as follows: Negative Response CodesNRC(Hex)Descri pti on11HserviceNotS upported12HsubF unctionN otS upp orted13Hin correctMessageLe ngthOrl nvalidFormat22Hcon diti on sNotCorrect24HrequestSeque nceEiror36HexceededNumberOfAtte mpts31H

17、requestOutOfRa nge33HsecurityAccessDe nied37HrequiredTimeDelayNotEx pired35HIn validKey72HgeneralProgramming Failure78HresponsePending7FHserviceNotS uppo rtedI nActiveSessi on92H/93HVoltageTooHigh / voltageTooLow7EHsubF unctionN otSupportedl nActiveSessi onIf two or more NRCs are reas on able, the E

18、CU could send the n egative response message accord ing to the followi ng p riority rules :The 7Fh NRC have the highest priority;For others, the NRC with smaller n umber has higher p riority.Diag no sticSessio nCon trol (10H)This service is used by the clie nt to en able differe nt diag no stic sess

19、i ons in the server(s). A diag no stic sessi on en ables a sp ecific set of diag no stic services in the server(s).Message FormatRequest:ByteNameCvtValue(hex)#1RequestServiceIde ntifierM10Sub-fu nction =DefaultSessi on01#2P rogrammi ngSessio nM02Exte ndedDia gno sticSessi on 103Positive Response:Byt

20、eNameCvtValue#1PositiveRes pon seServiceIde ntifierM50#2Sub-F un cti on= DefaultSessi on Program min gSessi onExte ndedDiag no sticSessi on 1M010203P2server=#3byte#1M00-FF#4byte#2M00-FFP 2*server=#5byte#1M00-FF#6byte#2M00-FFTiming P2server value is p rovided in 1ms resoluti on. Timing P2*server valu

21、e is p rovided in 10ms resoluti on. Negative Response :ByteNameCvtValue#1NegativeRes pon seServiceIde ntifierM7F#2RequestServiceIde ntifierM10#3NegativeRes pon seCodeMNRCSub-fu ncti on Parameter Defin iti onNegative Response Codes (NRC)NRC(Hex)Descri pti onCvt12The sub-fu nction p arameter in the re

22、quest message is not suppo rted.M13The len gth of the message is wrong.M22The ECUcurrent conditions do not allow the change ofdiagnostic Sessi on.MImp leme ntati on RulesThis service is used by the diag no stic tool to en able differe nt types of diag no stic sessi ons in a server.In order to execut

23、e a diag no stic service the approp riate sessi on has to be startedshall be only onediag no stic sessi on active at a time.Normal/Default Sessi on (01h) shall be en abled automatically by the ECU if no diag no stic sessi on has bee n requested at po wer up.The ECU shall retur n to Normal/Default Se

24、ssi on (01h) after timeout of Exte ndedDiag no stic Sessi on.The ECU shall be cap able of p rovid ing all diag no stic fun cti on ality defi ned for the default diag no stic sessi on un der nor mal op erati ng con diti ons.The ECU shall first send a DiagnosticSessionControl Positive Response (50h xx

25、) message before the new sessi on becomes active in the ECU.A DiagnosticSessionControl Positive Response (50h xx) message shall be returned by an ECU if the diag no stic tool requests a sessi on that is already runnin g. If the ECU has already received the same request message previously and perform

26、ed the requested operation, the ECU shall continue to p erform the curre nt op erati on .it is not a cha nge of the sessi on).The ECU shall rema in in its curre nt diag no stic sessi on if it is not able to switch into the requested diag no stic sessi on.The Tester Prese nt (3Eh) service shall be us

27、ed to kee p thenon-default diag no stic sessi ons active byretriggeri ng S3server. Also any other service request shall retrigger S3server.A fun cti onal Tester Pr ese nt (3Eh) request without res ponse may be sent at any time, eve n regardlessHEXDescri pti onCvt01DefaultSessi onThis diagnostic sess

28、ion enables the default diagnostic session in the server(s)and does not support any diagnostic application timeout handling provisions. . no TesterPresent service is n ecessary to kee p the sessi on active).M02Program min gSessi onThis diag no stic sessi on en ables all diag no stic services require

29、d to suppo rted the memory p rogram ming of a server.M03Exte ndedDiag no sticSessi onThis diagnostic session can . be used to enable all diagnostic services required to support the adjustme nt of functions likeSpeed, CO Value, etc.” in the server s memory. It catto enable diagnostic services, which

30、are not specifically tied to the adjustme nt of functions.M1 also be used“Idletran siti onrequests the effectively ECU resetof any other service in pr ogress.When receiv ing or tra nsmitti ng any diag no stic messages, in cludi ng 3Eh service, the S3servertimer will reset.Sessi ondiagramECUReset (11

31、H)This serviceservertop erform anbased on the content of the ResetType p arameter value (su pp ress PosRs pMsgl ndicati on Bit (bit 7) not show n).Message FormatRequest:ByteNameCvtValue(hex)#1RequestServicelde ntifierM11#2Sub-F un cti on=ResetT ype: HardResetSoftResetM0103Positive Response:ByteNameC

32、vtValue#1PositiveRes pon seServicelde ntifierM51#2Sub-F un cti on=ResetT ype: HardResetSoftResetM0103Negative Response :ByteNameCvtValue#1NegativeRes pon seServicelde ntifierM7F#2RequestServicelde ntifierM11#3NegativeRes pon seCodeMNRCSub-fu ncti on Parameter Defin iti onOp tio n (Hex)Descri ptio nC

33、vt01HardResetThis value identifies a “ hard reset condition which simulates the power-on / start-up seque nee typ ically p erformed after a server has bee n p reviously disc onn ected from its po wer supply . battery).M03SoftResetThis value ide ntifies a“ soft reset con diti on, which causes the ser

34、veimmediately restart the app licati on p rogram if app licable. The p erformed action is impiementation specific and not defined by the standard. A typical action is to restart the application without reinitializing of previously learned configurationdata, adaptive factors and otherIon g-term adjus

35、tme nts.M r toNegative Res ponse Codes (NRC)111111NRC (Hex)Con diti onsCvt12Sub-fu ncti on p arameter in the request message is not suppo rted.M13The len gth of the message is wrongM22The criteria for the ECUReset request are not met.MImp leme ntati on RulesThe p ositive response shall be sent befor

36、e p erform ing the ECU reset.The executi on of reset will take ms, which means the ECU can res pond to any new request sent within this time.Commu ni catio nCon trol (28H)The service is used to“ switch on/off ” the transmission and/or the reception of certain messages of (a)server(s).Message FormatR

37、equest:ByteNameCvtValue (hex)#1RequestServiceIde ntifierM28#2Sub-F unction = En ableRxA ndTx DisableRxA ndTx M0003#3Commun icati onType=NormalCom muni cati onM essagesNetworkMa nageme ntCom muni catio nM essagesNetworkMa nageme ntCom mun icati onM essagesA ndNormalCom munic ati onM essages M010203Po

38、sitive Response:ByteNameCvtValue#1PositiveRes pon seServiceIde ntifierM68Sub-F unction = En ableRxA ndTx00#2En ableRxA ndDisableTxM01DisableRxA ndE nableTx02DisableRxA ndTx 03Negative Response :ByteNameCvtValue#1NegativeRes pon seServiceIde ntifierM7F#2RequestServiceIde ntifierM28#3NegativeRes pon s

39、eCodeMNRCNegative Response Codes(NRC)NRC (Hex)Con diti onsCvt12Sub-fu ncti on p arameter in the request message is not suppo rted.M13The len gth of the message is wrongM22The operating conditions of the server are not met to perform the required action.M31None of the requested Communi cati onType va

40、lues are supp orted by the device.MSub-fu ncti on Parameter Defin iti onOp tio n( hex)Descri pti onCvt00En ableRxA ndTxThis value indicates that the reception and transmission of messages shall be en abled for the specified Communi catio nType.M03DisableRxA ndTxThis value indicates that the receptio

41、n and transmission ofMmessages shall be disabled for the sp ecified Communi cati onType.Data Parameter Definition :Op tio n( hex)Descri ptio nCvt01NormalCom mun icati onM essagesThis value references all application-related communication (i nter-a pp licatio n sig nal excha nge betwee n mult ip le i

42、n-vehicle servers).M02NetworkMa nageme ntCom muni cati onM essagesThis value referen ces all n etwork man ageme nt related com muni cati on.M03NetworkMa nageme ntCom muni cati onM essagesA ndNormalCommu ni cati onM essagesThis value refere nces all n etworkman ageme ntandapplication-related com muni

43、cationMImp leme ntati on RulesThere are no sp ecial gen eral impi eme ntati on rules for this service.SecurityAccess (27H)The purpose of this service is to provide a means to access data and/or diagnostic services, which have restricted access for security or safety reas ons. Diag no stic services f

44、or dow nl oad in g/u pl oadi ng routines or data into a server and reading specific memory locations from a server are situations where security access may be required. Improper routines or data downloaded into a server could potentially damage theelectronics or other vehicle components or risk the

45、vehicle s complianee tosafety, or security sta ndards. The security concept uses a seed and key relati onship.The client shall request the server to unlock by sending the service SecurityAccess-RequestSeed message. The server shall res pond by sending a seed. The seed is the input p arameter for the

46、 key calculati on algorithm. It is used by the clie nt to calculate the corres ponding key value.In a second step, the client shall request the key comparison by sending the calculated key to the server using the approp riate service SecurityAccess-Se ndKey. The server shall compare this key to one

47、intern ally stored/calculated. If the two n umbers match, the n the server shall en able (unl ock) the client s access to spe(services/data and indicate that with the service SecurityAccess-SendKey. If the two n umbers do not match, this shall be con sidered as a false access atte mp t. If access is

48、 rejected for any other reas on, it shall not be con sidered as a false access atte mpt. An in valid key requires the clie nt to start over from the beg inning with a SecurityAccess-RequestSeed message.If a server suppo rts security, but is already unl ocked whe n a SecurityAccess-RequestSeed messag

49、e is received, that server shall respond with a SecurityAccess-RequestSeed positive response message service with a seed value equal to zero (0). The clie nt shall use this method to determ ine if a server is locked by check ing for a non-zero seed.The Seed-Key algorithmfor SecurityAccess (Mandatory

50、 )：Key = (seed4) XOR seed)3) XOR seed。The Security Seed is4Bytes ran dom nu mbers.ECUTesterjxZ5 1Security Access p rocedureMessage FormatRequest SeedThis service requests a seed from the server. Based on this seed, the client is able to calculate the corres ponding key to be sent for uni ock ing the

51、 server.Request:ByteNameCvtValue(hex)#1RequestServicelde ntifierM27#2SecurityAccessT ype = RequestSeedM01, 11Positive Response:ByteNameCvtValueComputeKeyResponse _si t i ve亘匕亠一 P?昱一 .$67 $xx Vend Seed $6*cess$yyGen erateSeedComputeKeyComp areKey#1PositiveRes pon seServicelde ntifierM67#2SecurityAcce

52、ssT ype = RequestSeedM01, 11SecuritySeed =M#3seed#1 (high byte)M00-FF#6seed#m (low byte)M00-FFByteNameCvtValue#1NegativeRes pon seServicelde ntifierM7F#2RequestServicelde ntifierM27#3NegativeRes pon seCodeMNRCNegative Res ponse Codes(NRC)NRC (Hex)Con diti onsCvt12Sub-fu nction p arameter in the requ

53、est message is not suppo rted.M13The len gth of the message is wrong.M22The criteria for the SecurityAccess request are not met.M37requiredTimeDelayNotEx piredMSend KeyThis service sends a key calculated by the clie nt to the server. The server shall compare this key to one internally stored/calcula

54、ted. If the two numbers match, then the server shall enable ( “ unlock the ) client s access to specific services/data.Request:ByteNameCvtValue(hex)#1RequestServicelde ntifierM27#2SecurityAccessT ype = Sen dKeyM02, 12SecurityKey =M#3key#1 (high byte)M00-FF#6key#m (low byte)M00-FFPositive Response:By

55、teNameCvtValue#1PositiveRes pon seServicelde ntifierM67#2SecurityAccessT ype = Sen dKeyM02, 12Negative Response :ByteNameCvtValue#1NegativeRes pon seServicelde ntifierM7F#2RequestServicelde ntifierM27#3NegativeRes pon seCodeMNRCNegative Res ponse Codes(NRC)NRC (Hex)Con diti onsCvt12Sub-fu nction p a

56、rameter in the request message is not suppo rted.M13The len gth of the message is wrong.M22The criteria for the SecurityAccess request are not met.M24requestSeque nceErrorThe “ sendKey sub-functionis received without first receiving a“ requestSeed ” request message.M35in validKeyM36exceededNumberOfA

57、tte mptsSend if the delay timer is active due to exceedi ng the maximum nu mber of allowed falseaccess atte mp ts.MSub-fu ncti on Parameter Defin iti onHEXDescri pti onCvt01requestSeed (level 1)M02sendKey (level 1)M11requestSeed (level 3 flash)M12sendKey (level 3 flash)MImp leme ntati on RulesAfter

58、Po wer On/Reset the ECU is in locked state. The security access failure cou nter is set to 0.The ECU shall wait 10 s before acce pti ng the first RequestSeed message after EcuReset/ Po werO n.After the third failure attempt the ECU shall wait 10s before accepting the next “ RequestSeed” message. A f

59、lag is stored in the EEP ROM of the ECU. On every Po werO n/Reset, the ECU checks for this叭stSJcaTzTtrifstSJcaTzTtrif* *Feo，也1 1 七;tt LiqiiLiqii汕 1 1 -J JEwEwdfitydfity AA:EEuEEuSendSend KevKev *2*2： 1 1皓fufu旳上2020碎心* -轩F F髭F F茁- -SCci-nLySCci-nLy AccessAccessRequestRequest S S订d d $37$37 応 虫I I idi

60、d S S EdEd , , ,_ _*别卡KXKX5 5在LyitLyit、 AixgsmAixgsmsandsand KeyKey 占2727 轴y y空kiqijfMlkiqijfMl StedSted *37*37 而 二， San:!San:! EFPT -(AT(AT一 5 5叱L L it*it* 占 croMcroM _ _SendSend伽和7 7乔 invalinval d d S S _ SecurityAccessTester Preser This service shallIt (-i7Ft27i7Ft27 t35t35N-RCteauireraents)i)i I