1 / 24 Page Ⅰ．Overview of diagnostic CAN functionality ECU-specific specified value Item Set value 18DA0BF9（TOOL→Brake） *Physical 18DBFFF9（TOOL→All any node） *Functional 18DAF90B（Brake→TOOL） 81.3% Fixed to 8byte 0 (Respond even if other value is received.) 2 (Respond even if other value is received.) (*3) If the value greater than or equal to 128 is received, that value will be processed as 127. CAN-ID Bit timing CAN message data length BS (Block size) Stmin（Separation Time） Maximum length of diagnostic message 受信：０固定、送信：可変 受信：2ms固定、送信：可変 127($7F) (*4) Request=$55 Response=$AA Others MSB first (*1)The value to be set to unused byte. (*2)Negative response will not be returned even if another value is received. (*3)In Boot, the value is zero(0). (*4)In Boot, the value is 1026. Padding value (*1)(*2) CANdelaFormat Value (MAX) Name Category Default Session Programming Session Extended Diag. Session Bus Type Transport Protocol Type Addressing Scheme CAN-ID Type Communication Communication Communication Communication CAN ISO15765 Normal 29-Bit Request CAN-ID Communication 0x18DA0BF9 Response CAN-ID Communication 0x18DAF90B P2Server Timing P2*Server Timing 5000 S3Server Timing 5000 Timing 2 *In Boot, the value is zero(0). STmin Blocksize Communication Timeout As Timeout Ar Timeout Bs Time Br Time Cs Timeout Cr Timing Timing Timing Timing Timing Timing Max Length of TP Message Communication Baudrate Communication Communication Functional CAN-ID Type Communication Functional Request CAN-ID Communication CANFrameFillerByte Communication Functional Addressing Scheme FillerByteHandling Protected Communication 50 4500 50 0 1000 1000 1000 10 10 1000 127 *In Boot, the value is 1026. 250000 or 500000 Normal 29-Bit 0x18DBFFF9 0xAA TRUE S1-2012-0456△10 Description Type of transport media Type of used Transport Protocol (e.g. ISO15765) Addressing Scheme used for physical requests and responses. Addressing Scheme used for physical requests and responses. The request CAN identifier for physical requests. The hex value not only describes the identifier but also the priority of the message. The higher the number, the lower the priority. The response CAN identifier for physical responses.The response for functional requests is sent via the physical path. Performance requirement for the server to start with the response message after the reception of a request message. In UDS this is the timeout for the default session.The tester will also require the P2Server timeout, since in UDS service "DiagnosticSessionControl"returns the P2Server and P2*Server timeouts – the tester has to calculate the offset manually and has to add it to the returned P2Server and P2*Server timeouts. Performance requirement for the server to start with the response message after the transmission of a negative response message with response code 78 hex (enhanced response timing). In UDS this is the timeout for the default session. Time for the server to keep a diagnostic session other than the defaultSession active while not receiving any diagnostic request message (Separation Time) defines the minimum time gap between consecutive frames.Values from 0x00 to 0x7F (0 – 127) are absolute milliseconds.Values from 0xF1 to 0xF9 are even 100 micro seconds.Every other value range is reserved and should not be used. The Blocksize parameter indicates, how many consecutive frames shall be sent in a transmission before a flow control frame is sent. The number 0 tells the sender, that no more flow controls should disrupt the sending of the remaining flow controls Time for transmission of frame, sender side Time for transmission of frame, receiver side Time until reception of next flow control Time for next transmission of flow control Time until next transmission of consecutive frame Time until reception of next consecutive frame Bus Speed of the used transport media. Caution, the Bus Speed has to be set identical in all ECUs connected to one subnet. Addressing Scheme used for functional requests. CAN-ID Type used for functional request The request CAN identifier for functional requests. Fill byte used for filling CAN frames to eight byte length. Enables use of fill bytes; if "true", fill bytes are used, otherwise DLC may be smaller than 8. ADVICS 2 / 24 Page Supported service ID Service ID $10 $11 $27 $28 $3E $84 $85 $86 $87 $83 $22 $23 $24 $2A $2C $2E $3D $19 $14 $2F $31 $34 $35 $36 $37 Service name Default Session Programming Session Extended Diag. Session Safety System Diag. Session ($01) ($02) ($03) ($04) Diagnostic and Communication Management Functional Unit ◆, ▲ (*2) DiagnosticSessionControl ◆, ▲ (*2) ◆, ▲ (*2) ECUReset ◆, ▲ (*2) ◆, ▲ (*2) SecurityAccess X X CommunicationControl X ◆, ▲ (*2) TesterPresent ◆, ▲ (*2) SecuredDataTransmission X X ControlDTCSetting X X ResponseOnEvent X X X LinkControl X X X AccessTimingParameter Data Transmission Functional Unit ◆, ▲ (*2) X ReadDataByIdentifier ReadMemoryByAddress X X ReadScalingDataByIdentifier (*1) X X ReadDataByPreriodicIdentifier X X DynamicallyDefineDataIdentifier X X WriteDataByIdentifier X X WriteMemoryByAddress X X Stored Data Transmission Functional Unit ReadDTCInformation X ◆, ▲ ◆, ▲ X ClearDiagnosticInformation Input/Output Control Functional Unit InputOutputControlByIdentifier X X Remote Activation Of Routine Functional Unit X ◇, ▲ (*2) RoutineControl Upload/Download Functional Unit RequestDownload X ◇, ▲ (*2) RequestUpload X X TransferData X ◇, ▲ (*2) RequestTransferExit X ◇, ▲ (*2) ◆, ▲ (*2) ◆, ▲ (*2) ◆, ▲ (*2) ◆, ▲ ◆, ▲ (*2) X ◆, ▲ X X X ◆, ▲ (*2) ◆, ▲ X X X ◇, ▲ X ◆, ▲ ◆, ▲ ◆, ▲ ◆, ▲ X X X X ◆ : Function possible in the selected diag. session without security access ◇ : Function possible in the selected diag. session with security access level 1 ○ : Specific sub-function possible in the selected diag.Mode (see each function descriptions) X : Function impossible in selected diag. session. ▲ : Response to Physical request message or Functional request message △ : Response to Physical request message not Functional request message (*1)Not supported, because SID$22 is substitutable. (*2)Supported in Boot. Any received request message (regardless of addressing mode physical or functional) will be ignored, during ECU self check time (1.5 sec (typical)). Note ・In Boot This means that 'In Flash reprogram procedure (when the ECU is in the Boot Area)'. ・Vehicle is not in the stopped state. This means that 'all wheel speed is more than 0km/h'. Protected S1-2012-0456△10 ADVICS 3 / 24 Page DiagnosticSessionControl ($10) ・Communication specification 3 4 5 6 Byte 1 2 Request $10 diagnosticSessionType * PosRsp $50 diagnosticSessionType P2CAN_SERVER_MAX (*1) P2 CAN_SERVER_MAX (*1) NegRsp $7F NRC $10 P2CAN_SERVER_MAX : 4500ms P2*CAN_SERVER_MAX : 5000ms (*1)These parameters can be used only in programmingSession ($02). ・Supported Sub-Function (= diagnosticSessionType) Hex Description (bit 6-0) $01 $02 $03 $04 Other Default Session defaultSession programmingSession extendedDiagnosticSession safetySystemDiagnosticSession - ◆ ◆ ◆ ◆ ◆ X X X X X ・Supported NRC Hex NegativeResponseCode subFunctionNotSupported $12 $13 incorrectMessageLengthOrInvalidFormat $22 Programmi Extended ng Diag. Session Session conditionNotCorrect Safety System Diag. Session ◆ ◆ ◆ X X Cause of Occurrence When Sub-Function is not supported. When request format is incorrect. If any of the followings is met, when transition to ProgrammingSession is requested in other than ProgrammingSession. ・Vehicle is not in the stopped state. ・Power supply voltage is reduced. ・Control in progress. ・Description of functionalities Transit to requested DiagnosticSession. Return to DefaultSession if S3 timeout occurs in other than DefaultSession. All states are initialized when returning to DefaultSession. (All states are initialized when transition to DefaultSession is requested while in DefaultSession as well.) Have the security locked when transitioning from ExtendedDiag.Session to ProgrammingSession. Functionalities not related to Flash Reprogramming cannot be used in ProgrammingSession. ECU reset will occur when returning to DefaultSession from ProgrammingSession (including S3 timeout), therefore, frequency during one IG is limited as same as SID$11. (ECU malfunction will occur at the 8th time of ECU reset.) s t m Dia g n os t icS e s s ion Power ON $10 $01 $11 $01 Def a ult S es s ion $11 $01 $11 $01 $10 $01 Prog ra mmin g S e s s ion $10 $02 Protected $10 $02 $10 $03 $10 $02 $10 $01 E x t e n de d Dia g . S es s ion $10 $03 S1-2012-0456△10 ADVICS 4 / 24 Page ECUReset ($11) ・Communication Byte 1 Request $11 PosRsp $51 NegRsp $7F specification 2 3 resetType resetType $11 NRC ・Supported Sub-Function (= resetType) Hex Description (bit 6-0) $01 Other hardReset - Default Session ◆ X ・Supported NRC Hex NegativeResponseCode $12 subFunctionNotSupported $13 incorrectMessageLengthOrInvalidFormat $22 conditionNotCorrect Programmi Extended Diag. ng Session Session ◆ X Safety System Diag. Session ◆ X Cause of Occurrence When Sub-Function is not supported. When request format is incorrect. If any of the followings is met, when not in ProgrammingSession. ・Vehicle is not in the stopped state. ・Power supply voltage is reduced. ・Control in progress. ・Description of functionalities Reset ECU. From the characteristics of ECU circuit, frequency of reset during one IG is limited. (ECU reset is allowed up to 7 times. ECU malfunction will occur at the 8th time of ECU reset.) Protected S1-2012-0456△10 ADVICS 5 / 24 Page SecurityAccess ($27) ・Communication specification ＜RequestSeed＞ Byte 1 2 3 Request $27 requestSeed PosRsp $67 requestSeed seed ＜SendKey＞ Byte 1 2 Request $27 sendKey PosRsp $67 sendKey Byte 1 NegRsp $7F 2 $27 3 key 4 4 3 NRC ・Supported Sub-Function (= securityAccessType [requestSeed / sendKey]) Hex Description (bit 6-0) $01 $02 Other RequestSeed SendKey - Default Session X X X ・Supported NRC Hex NegativeResponseCode $12 subFunctionNotSupported $13 incorrectMessageLengthOrInvalidFormat $22 conditionNotCorrect $24 requestSequenceError $31 requestOutRange $35 invalidKey $36 exceededNumberOfAttempts $37 requiredTimeDelayNotExpired Programmi Extended ng Diag. Session Session ◆ ◆ X Safety System Diag. Session ◆ ◆ X Cause of Occurrence When Sub-Function is not supported. When request format is incorrect. When not supported in active session. When sendKey is received before receiving requestSeed. When invalid key is received. When invalid key is received 3 times or more. When requestSeed is received within 10 seconds after sending the negative response $36. ・Description of functionalities Security is unlocked when the correct KEY is returned in response to SEED sent by ECU. See the calculation method of SEED and KEY below. KEY = ((SEED + P2) * P1) MOD $10000 P1 = $12371, P2 = $125 Protected S1-2012-0456△10 ADVICS 6 / 24 Page CommunicationControl ($28) ・Communication Byte 1 Request $28 PosRsp $68 NegRsp $7F specification 2 3 controlType $01 controlType $28 NRC ・Supported Sub-Function (= controlType) Hex Description (bit 6-0) $00 $01 $02 $03 Other enableRxAndTx EnableRxAndDisableTX DisableRxAndEnableTX disableRxAndTx - Default Session X X X X X ・Supported NRC Hex NegativeResponseCode $12 subFunctionNotSupported $13 incorrectMessageLengthOrInvalidFormat conditionNotCorrect $22 $31 requestOutOfRange Programmi Extended ng Diag. Session Session X X X X X Safety System Diag. Session ◆ X X ◆ X Cause of Occurrence When Sub-Function is not supported. When request format is incorrect. communicationType (3rd byte of request data) is other than $01. ・Description of functionalities Enable/Disable periodic communication. No malfunction detection conducted in communication system while periodic communication is disabled. Each control is also disabled while periodic communication is disabled. EnableRxAndDisableTX and DisableRxAndEnableTX are not supported, as they are same as disableRxAndTx. Protected S1-2012-0456△10 ADVICS 7 / 24 Page TesterPresent ($3E) ・Communication Byte 1 Request $3E PosRsp $7E NegRsp $7F specification 2 3 zeroSubFunction zeroSubFunction $3E NRC ・Supported Sub-Function (= zeroSubFunction) Hex Description (bit 6-0) $00 Other zeroSubFunction - Default Session ◆ X ・Supported NRC Hex NegativeResponseCode $12 subFunctionNotSupported $13 incorrectMessageLengthOrInvalidFormat Programmi Extended Diag. ng Session Session ◆ X Safety System Diag. Session ◆ X Cause of Occurrence When Sub-Function is not supported. When request format is incorrect. ・Description of functionalities Keep the active diagnostic service state. Protected S1-2012-0456△10 ADVICS 8 / 24 Page ControlDTCSetting ($85) ・Communication Byte 1 Request $85 PosRsp $C5 NegRsp $7F specification 2 3 DTCSettingType DTCSettingType $85 NRC ・Supported Sub-Function (= DTCSettingType) Hex Description (bit 6-0) $01 $02 Other ON OFF - Default Session X X X ・Supported NRC NegativeResponseCode Hex $12 subFunctionNotSupported $13 incorrectMessageLengthOrInvalidFormat $22 conditionNotCorrect $31 requestOutOfRange Programmi Extended Diag. ng Session Session X X X Safety System Diag. Session ◆ ◆ X Cause of Occurrence When Sub-Function is not supported. When request format is incorrect. - ・Description of functionalities Enable/Disable failure detection in communication system. Each control is disabled while failure detection is disabled. Not supported as no failure detection is conducted in ProgrammingSession. Protected S1-2012-0456△10 ADVICS 9 / 24 Page ReadDataByIdentifier ($22) ・Communication specification Byte 1 2 3 ・・・ Request $22 dataIdentifier#1 ・・・ Byte n-1 n dataIdentifier#m 1 n-(o-1)-2 n-(o-1)-1 n-(o-1) ・・・ (k-1)+4 ・・・ 2 4 ・・・ n 3 dataIdentifier#m dataRecord#m (*1) dataIdentifier#1 dataRecord#1 (*1) ・・・ $22 NRC (*1)Data length of dataRecord varies depending on dataIdentifier. PosRsp $62 NegRsp $7F ・Supported dataIdentifier See DID List (*)In Boot, DID$F189 only. ・Supported NRC Hex NegativeResponseCode $13 incorrectMessageLengthOrInvalidFormat $22 conditionNotCorrect $31 requestOutOfRange $33 securityAccessDenied Cause of Occurrence When request format is incorrect. In Boot, when the length of the request message is not equal to 3. Under any of the following case ・None of the requested dataIdentifier is supported. ・Depending on the combination of requested dataIdentifier, response will exceed the maximum length of diagnostic message. - ・Description of functionalities Retrieve data defined in dataIdentifier. Protected S1-2012-0456△10 ADVICS 10 / 24 Page WriteDataByIdentifier ($2E) ・Communication specification 4 ・・・ m+3 Byte 1 2 3 Request $2E dataIdentifier dataRecord (*1) (*1)Data length of dataRecord varies depending on dataIdentifier. Byte 1 PosRsp $6E NegRsp $7F 2 3 dataIdentifier $2E NRC ・Supported dataIdentifier See DID List. ・Supported NRC Hex NegativeResponseCode $13 incorrectMessageLengthOrInvalidFormat $22 conditionNotCorrect $31 requestOutOfRange $33 $72 securityAccessDenied generalProgrammingFailure Cause of Occurrence When request format is incorrect. Under any of the following case ・Vehicle information writing method of DID:"FE00" is performed when "Vehicle information writing complete=0b1" is written. ・When "1" is written at "Vehicle information writing complete" with DID:"FE00" initial value. Under any of the following case ・Requested dataIdentifier is not supported. ・dataRecord value is incorrect. Request is received when security is locked. When EEPROM was unwritable. ・Description of functionalities Write the data defined in dataIdentifier. Protected S1-2012-0456△10 ADVICS 11 / 24 Page ReadMemoryByAddress ($23) ・Communication specification Byte 1 2 3 4 5 Request $23 14 memoryAddress Byte 6 7 memorySize 1 2 ・・・ n dataRecord (*1) (*1)Data length of dataRecord varies depending on memorySize. PosRsp $63 Byte 1 NegRsp $7F 2 $23 3 NRC ・Supported NRC Hex NegativeResponseCode $13 incorrectMessageLengthOrInvalidFormat $22 conditionNotCorrect $31 requestOutOfRange $33 SecurityAccessDenied Cause of Occurrence When request format is incorrect. Under any of the following case ・Requested address range is not within 0x03FF6000 to 0x03FFBFFF. ・memorySize is 5 or more. ・addressAndLengthFormatIdentifier (2nd byte of request data) is other than $14. - ・Description of functionalities Retrieve data of requested address. Protected S1-2012-0456△10 ADVICS 12 / 24 Page ClearDiagnosticInformation ($14) ・Communication Byte 1 Request $14 PosRsp $54 NegRsp $7F specification 2 3 $FF $FF $14 4 $FF NRC ・Supported NRC NegativeResponseCode Hex $13 incorrectMessageLengthOrInvalidFormat $22 conditionNotCorrect $31 requestOutOfRange Cause of Occurrence When request format is incorrect. When groupOfDTC (2nd to 4th byte of request data) is other than $FFFFFF. ・Description of functionalities Delete past malfunction, Snapshot Data . Do not delete current malfunction and related information (flag, counter, timer, etc.). Protected S1-2012-0456△10 ADVICS 13 / 24 Page ReadDTCInformation ($19) ・Communication specification ＜ReportDTCByStatusMask＞ Byte 1 2 3 Request $19 reportType DTCStatusMask 7 ・・・ n-3 n-2 2 3 4 5 6 DTC#1 DTC#m reportType $09 statusOfDTC#1 ・・・ (*1)m = maximum 31. (When more than 31 DTCs, response sends only 31 DTCs.) Byte 1 n-1 PosRsp $59 n statusOfDTC#m (*1) ＜ReportDTCSnapshotIdentification＞ 2 Byte 1 Request $19 reportType Byte 1 PosRsp $59 4 2 3 reportType DTC#1 5 ＜ReportDTCSnapshotRecordByDTCNumber＞ 3 4 5 Byte 1 2 Request $19 reportType DTCMaskRecord Byte 6 $01 ・・・ ・・・ n-3 n-2 DTC#m 6 7 2 3 4 5 statusOfDTC $01 reportType DTC (*2)See DID List for dataIdentifier included in DTCSnapshotRecord. 1 1 NegRsp $7F 2 $19 n $01 6 $01 PosRsp $59 Byte n-1 8 9 DTCSnapshotRecordNumberOfIdentifiers (*1) DTCSnapshotRecord (*2) ・・・ n 3 NRC ・Supported Sub-Function (= reportType) Hex Description (bit 6-0) $02 $03 $04 $06 Other reportDTCByStatusMask reportDTCSnapshotIdentification reportDTCSnapshotRecordByDTCNumber reportDTCExtendedDataRecordByDTCNumber - Default Session ◆ ◆ ◆ X X Programmi Extended Diag. ng Session Session X X X X X Safety System Diag. Session ◆ ◆ ◆ X X ・Supported StatusOfDTC bit Support Bit Description Y 0 TestFailed N 1 TestFailedThisOperationCycle N PendingDTC 2 Y 3 ConfirmedDTC N 4 TestNotCompletedSinceLastClear N TestFailedSinceLastClear 5 N TestNotCompleteThisOperationCycle 6 N WarningIndicatorRequested 7 ・Supported NRC Hex NegativeResponseCode $12 subFunctionNotSupported $13 incorrectMessageLengthOrInvalidFormat $31 requestOutOfRange Cause of Occurrence When Sub-Function is not supported. When request format is incorrect. Under any of the following case ・DTCMaskRecord is not supported. ・DTCSnapshotRecordNumber(6th byte of request data of subfunction$04) is other than $01. ・Description of functionalities Retrieve failure information. WarningIndicatorRequested is not supported because it behaves as same as TestFailed. Only one Snapshot is stored per one DTC . If DTC which has already stored Snapshot is detected again, information of Snapshot will not be updated. Snapshot as many as 2DTCs can be stored simultaneously. If Snapshot as many as 2DTCs have been already stored, Snapshot of DTC newly detected will not be stored. Protected S1-2012-0456△10 ADVICS 14 / 24 Page InputOutputControlByIdentifier ($2F) ・Communication specification ＜ReturnControlToECU＞ Byte 1 3 2 Request $2F dataIdentifier PosRsp $6F dataIdentifier 4 $00 $00 ＜ShortTermAdjustment＞ 5+m+(r-1) 5+(m-1) 5+m ・・・ Byte 1 ・・・ 2 3 4 5 Request $2F dataIdentifier $03 controlState (*1) controlMask (*1) PosRsp $6F dataIdentifier $03 (*1)Data length of controlState/controlMask varies depending on dataIdentifier. Byte 1 NegRsp $7F 2 $2F 3 NRC ・Supported dataIdentifier See DID List ・Supported NRC Hex NegativeResponseCode incorrectMessageLengthOrInvalidFormat $13 $22 conditionNotCorrect $31 requestOutOfRange $33 securityAccessDenied Cause of Occurrence When request format is incorrect. Under any of the following case ・Vehicle is not in the stopped state. ・Power supply voltage is reduced. ・Power supply voltage rise. ・During routine control. ・Malfunction, which is related to target object, exists. (Malfunction of target object: - Solenoid Valve malfunction - Linear valve malfunction - Solenoid relay(Valve relay) malfunction - Motor malfunction - Motor relay malfunction） Under any of the following case ・Requested dataIdentifier is not supported. ・inputOutputControlParameter (4th byte of request data) is other than $00/$03. ・The value of controlState is incorrect (not supported). - ・Description of functionalities Activate as defined in dataIdentifier. Stop activation when the condition of conditionNotCorrect is met during activation. Automatically stops when a period of time of 5 seconds have elapsed since receiving the last activation request. Protected S1-2012-0456△10 ADVICS 15 / 24 Page RoutineControl ($31) ・Communication specification Byte 1 2 3 4 5 ・・・ n Request $31 routineControlOptionRecord (*1) routineControlType routineIdentifier PosRsp $71 routineControlType routineIdentifier routineStatusRecord (*1) NegRsp $7F NRC $31 (*1)Data length of routineControlOptionRecord/routineStatusRecord varies depending on routineControlType/routineIdentifier. ・Supported Sub-Function (= routineControlType) Hex Description (bit 6-0) $01 $02 $03 Other startRoutine stopRoutine requestRoutineResults - Default Session X X X X Programmi Extended Diag. ng Session Session ◇ X ◇ X Safety System Diag. Session ◆ ◆ ◆ X ・Supported routineIdentifier See RID List ・Supported NRC Hex NegativeResponseCode subFunctionNotSupported $12 $13 incorrectMessageLengthOrInvalidFormat $22 conditionNotCorrect $24 requestSequenceError $31 requestOutOfRange $33 $72 seurityAccessDenied GeneralProgrammingFailure Cause of Occurrence When Sub-Function is not supported When request format is incorrect. Under any of the following case ・startRoutine is received during download. ・startRoutine is received during routine control. ・Yaw/G sensor calculation is not authorized, when startRoutine of RID$0200 is received. ・Steering angle sensor calculation is not authorized, when startRoutine of RID$0201 is received. stopRoutine or requestRoutineResults is received before receiving startRoutine. Under any of the following case ・Requested routineIdentifier is not supported. ・The value of routineControlOptionRecord is incorrect. If requested routineIdentifier is protected when security is locked. When FlashMemory was unwritable. ・Description of functionalities Behave as defined in routineIdentifier. Protected S1-2012-0456△10 ADVICS 16 / 24 Page RequestDownload ($34) ・Communication specification Byte 1 2 3 Request $34 $00 $44 Byte 1 PosRsp $74 Byte 1 NegRsp $7F 4 5 6 memoryAddress 7 8 9 memorySize 10 11 ・・・ 2 3 n lengthFormatIdentifier maxNumberOfBlockLength 2 $34 3 NRC ・Supported NRC Hex NegativeResponseCode $13 incorrectMessageLengthOrInvalidFormat $22 conditionNotCorrect $31 requestOutOfRange $33 $70 securityAccessDenied uploadDownloadNotAccepted Cause of Occurrence When request format is incorrect. Under any of the following case ・Request is received during download. ・Request is received during routine control. ・Request is received before executing Erase Memory. Under any of the following case ・dataFormatIdentifier (2nd byte of request data) is other than $00. ・addressAndLengthFormatIdentifeir (3rd byte of request data) is other than $44. ・The value of memoryAddress/memorySize is incorrect. Request is received when security is locked. - ・Description of functionalities Go into wait state for data transfer (download) from client to server. Protected S1-2012-0456△10 ADVICS 17 / 24 Page TransferData ($36) ・Communication Byte 1 Request $36 PosRsp $76 NegRsp $7F specification 2 3 ・・・ n blockSequenceCounter transferRequestParameterRecord blockSequenceCounter $36 NRC ・Supported NRC Hex NegativeResponseCode $13 incorrectMessageLengthOrInvalidFormat $24 requestSequenceError $31 $71 $72 $73 $92 $93 requestOutOfRange transferDataSuspended generalProgrammingFailure wrongBlockSequenceCounter voltageTooHigh voltageTooLow Cause of Occurrence When request format is incorrect. ("transferRequestParameterRecord" length is not a multiple of 4.) Under any of the following case ・Request has been received before receiving RequestDownload. ・Deta as many as memorySize has already been received after receiving RequestDownload. When sum of received data does not match memorySize. When FlashMemory was unwritable. The value of blockSequenceCounter is incorrect. - ・Description of functionalities Data transfer. Protected S1-2012-0456△10 ADVICS 18 / 24 Page RequestTransferExit ($37) ・Communication specification Byte 1 2 3 Request $37 PosRsp $77 NegRsp $7F $37 NRC ・Supported NRC Hex NegativeResponseCode $13 incorrectMessageLengthOrInvalidFormat $24 requestSequenceError Cause of Occurrence When request format is incorrect. Under any of the following case ・Request has been received before data as many as memorySize is received. ・Request has been received before receiving RequestDownload. ・Description of functionalities Terminate the wait state for data transfer. Protected S1-2012-0456△10 ADVICS 19 / 24 Page Ⅱ．ＤＩＤ Ｌｉｓｔ Hex Protected R: ReadDataByIdentifier (SID $22) C: InputOutputControlByIdentifier (SID $2F) W: WriteDataByIdentifier (SID $2E) *: With SecurityAccess (SID $27) Description Size (bytes) Byte Bit(s) Unit Data Type LSB Offset Minimum Maximum value value Initial value Abnormal Default circumst Direction Session ance (*1) Safety Program Extended System Diag. ming Diag. Session Session Session SID $2F SID $19 DTCSnap control shotReco Mask rd F189 VehicleManufacturerECUSoftwareVersionNumberDataIdentifier 10 - - - ASCII - - - - - - - R - R - - F191 VehicleManufacturerECUHardwareNumberDataIdentifier 10 - - - ASCII - - - - - - - R - R - - Remarks Software Parts No OEM Parts No/HU Parts No The value is stored in EEPROM. (The value will not change after reprogramming.) Software Release Date F199 ProgrammingDateDataIdentifier 4 - - - BCD - - - - - - - R - R - - FD00 FR wheel speed 1 - - km/h Unsigned 1.0 0 0 255 - - - R - R - Y FD01 FL wheel speed 1 - - km/h Unsigned 1.0 0 0 255 - - - R - R - Y FD02 RR wheel speed 1 - - km/h Unsigned 1.0 0 0 255 - - - R - R - Y FD03 RL wheel speed 1 - - km/h Unsigned 1.0 0 0 255 - - - R - R - Y FD04 Stop SW information (BRK SW) 1 1 0 - - - - - - - - - R - R - Y 1:ON FD04 Diagnostic SW information 1 1 1 - - - - - - - - - R - R - Y FD04 TCS disable switch 1 1 2 - - - - - - - - - R - R - Y FD04 BRK SW2 1 1 3 - - - - - - - - - R - R - Y FD04 R RANGE 1 1 4 - - - - - - - 0 - R - R - Y FD04 N RANGE 1 1 5 - - - - - - - 0 - R - R - Y FD04 PARKING SW 1 1 6 - - - - - - - - - R - R - Y 1:ON 0:TCS/VDC permit 1:TCS/VDC prohibit 1:ON Always 0 for AT 1:ON Always 0 for AT 1:ON 1:ON FD05 FR holding solenoid output 2 1 0 - - - - - - - - - R - RC Y - 1:ON FD05 FR decompression solenoid output 2 1 1 - - - - - - - - - R - RC Y - 1:ON FD05 FL holding solenoid output 2 1 2 - - - - - - - - - R - RC Y - 1:ON FD05 FL decompression solenoid output 2 1 3 - - - - - - - - - R - RC Y - 1:ON FD05 RR holding solenoid output 2 1 4 - - - - - - - - - R - RC Y - 1:ON FD05 RR decompression solenoid output 2 1 5 - - - - - - - - - R - RC Y - 1:ON FD05 RL holding solenoid output 2 1 6 - - - - - - - - - R - RC Y - 1:ON FD05 RL decompression solenoid output 2 1 7 - - - - - - - - - R - RC Y - FD05 Front linear valve output 2 2 0 - - - - - - - - - R - RC Y - FD05 Rear linear valve output 2 2 1 - - - - - - - - - R - RC Y - FD05 Stop LAMP Relay output (BRK-LP) 2 2 3 - - - - - - - - - R - RC Y - FD05 ESS Relay output (BRK-LP2) 2 2 4 - - - - - - - - - R - RC Y - FD05 Solenoid relay output 2 2 5 - - - - - - - - - R - RC Y - FD05 Fail safe motor relay output 2 2 6 - - - - - - - - - R - R - - FD05 Motor relay output 2 2 7 - - - - - - - - - R - RC Y - FD07 ABS_W_LAMP 1 1 0 - - - - - - - - - R - RC Y - 1:ON 1:ON Equivalent to 3MPa of differential pressure requested value when requesting activation. 1:ON Equivalent to 3MPa of differential pressure requested value when requesting activation. 1:ON Only ON drive available 1:ON Only ON drive available 1:ON Only OFF drive available 1:ON 1:ON Only ON drive available 1:Request to turn on FD07 EBD_W_LAMP 1 1 1 - - - - - - - - - R - RC Y - FD07 TCS_LAMP 1 1 2-4 - - - - - - - - - R - RC Y - FD07 TCS_OFF_LAMP 1 1 5 - - - - - - - - - R - RC Y - FD08 ESS status 1 1 0-2 - - - - - - - - - R - R - - FD09 ABS control in progress 2 1 0 - - - - - - - - - R - R - - 1:Request to turn on 000:OFF 001:ON 010:Blinking 1:Request to turn on 000:OFF 001:ON 010:Addictional Function (not used) 1:Control in progress FD09 EBD control in progress 2 1 1 - - - - - - - - - R - R - - 1:Control in progress FD09 TCS engine control in progress 2 1 2 - - - - - - - - - R - R - - 1:Control in progress FD09 TCS brake control in progress 2 1 3 - - - - - - - - - R - R - - 1:Control in progress FD09 High G assists control in progress 2 1 4 - - - - - - - - - R - R - - 1:Control in progress FD09 Failure assist control in progress 2 1 5 - - - - - - - - - R - R - - 1:Control in progress S1-2012-0456△10 ADVICS 20 / 24 Page Hex Size (bytes) Byte Bit(s) Unit Data Type LSB Offset Minimum Maximum value value Initial value Abnormal circumst Default Direction ance Session (*1) Safety Program Extended System Diag. ming Diag. Session Session Session SID $2F SID $19 DTCSnap control shotReco Mask rd Remarks FD09 VDC control in progress 2 1 6 - - - - - - - - - R - R - - 1:Control in progress FD09 Requesting exhaust brake prohibition 2 1 7 - - - - - - - - - R - R - - 1:Requesting FD09 HSA control in progress 2 2 0 - - - - - - - - - R - R - - 1:Control in progress FD0A ABS failure state 2 1 0 - - - - - - - - - R - R - - 1:Failure state FD0A EBD failure state 2 1 1 - - - - - - - - - R - R - - FD0A TCS failure state 2 1 2 - - - - - - - - - R - R - - 1:Failure state FD0A High G assists control failure state 2 1 4 - - - - - - - - - R - R - - 1:Failure state FD0A Failure assist control failure state 2 1 5 - - - - - - - - - R - R - - 1:Failure state FD0A VDC failure state 2 1 6 - - - - - - - - - R - R - - 1:Failure state FD0A HSA failure state 2 2 0 - - - - - - - - - R - R - - 1:Failure state FD0B System voltage 1 - - V Unsigned 0.15 0 0 34.5 - - - R - R - Y FD0C M/C pressure sensor output (voltage value) 1 - - V Unsigned 5/256 0 0 4.98 - - - R - R - Y FD0D Engine speed 2 - - r/min Unsigned 0.125 0 0 8031.88 - 0 - R - R - Y FD0E Actual throttle opening angle 1 - - % Unsigned 0.4 0 0 100 - 0 - R - R - Y FD0F Engine output torque (ratio) 1 - - % Unsigned 1 -125 -125 125 - 0 - R - R - Y FD10 Driver request torque (ratio) 1 - - % Unsigned 1 -125 -125 125 - 0 - R - R - Y FD11 Vacuum sensor 1 output (voltage value) 1 - - V Unsigned 5/256 0 0 4.98 - - - R - R - Y FD13 Longitudinal G 1 - - G Signed 0.02 0 -2.56 2.54 - 0 - R - R - Y FD14 Lateral G 1 - - G Signed 0.02 0 -2.56 2.54 - 0 - R - R - Y FD15 ＧＬ１ 2 - - G Signed 0.00366 0 -1.5 1.5 - 0 - R - R - - FD16 ＧＬ２ 2 - - G Signed 0.00366 0 -1.5 1.5 - 0 - R - R - - FD17 Yaw rate value 1 - - 0.976 -124.93 -124.93 123.952 - 0 - R - R - Y FD18 Steering angle value (calibrated value) 2 - - Deg Signed 0.1 0 -3276.8 3276.7 - 0 - R - R - Y FD19 Gear Position 1 - - gear Unsigned 1 -125 -125 125 - 0 - R - R - Y FD1A Gate Position 1 - - gear Unsigned 1 -125 -125 126 - 0 - R - R - Y FD1B Steering angle value (uncalibrated value) 2 - - Deg Signed 0.1 0 -3276.8 3276.7 - 0 - R - R - - FD1C～ Protected Description Deg/sec Unsigned Reserved 1:Failure state Always 0 for MT 0x7C：reverse 0x7D：neutral positive value(0x7E～0xFA):forward 0x7D：park Always 0 for MT 0x7C：reverse 0x7D：neutral 0x7E:forward 0xFB：park The receiving value from "Steering Angle Sensor" is output when "Steering Angle Sensor" is failure. (The value in which the failure of "Steering Angle Sensor" is indicated is not output.) - - - FE00 Vehicle Type No. 10 1 0-3 - - 1 0 1 15 0 - - R - RW* - - FE00 Brake No. 10 1 4-7 - - 1 0 1 15 0 - - R - RW* - - FE00 Transmission No. 10 2 0-3 - - 1 0 1 15 0 - - R - RW* - - FE00 Wheelbase 10 3-4 - mm Unsigned 5 2000 2000 7115 2795 - - R - RW* - - FE00 MAX engine torque 10 5 0-4 Nm Unsigned 20 190 190 810 410 - - R - RW* - - FE00 Front tire diameter radius 10 6-7 - mm Unsigned 1 0 300 450 400 - - R - RW* - - FE00 Rear tire diameter radius 10 8-9 - mm Unsigned 1 0 300 450 400 - - R - RW* - - FE00 ESS 10 10 0 - - 1 0 0 1 0 - - R - RW* - - FE00 Cruise Control 10 10 1 - - 1 0 0 1 0 - - R - RW* - - Cruise Control of Vehicle information writing method(Variant coding) 0b0：with no Cruise Control 0b1：with Cruise Control FE01 Vehicle information writing complete 1 1 0 - - 1 0 0 1 0 - - R - RW* - - Completion of Vehicle information writing method (Variant coding) (*6) 0b0：Not completed 0b1：Completed S1-2012-0456△10 Vehicle Type No of Vehicle information writing method(Variant coding). (*2) Brake No of Vehicle information writing method (Variant coding). (*2)(*3) Transmission No of vehicle information writing method(Variant coding).(*2) Wheelbase of Vehicle information writing method (Variant coding).(*2) Set 279(DEC). ((3395－2000)/5 = 279) MAX engine torque of Vehicle information writing method (Variant coding) (*2) See (*4) for detail of the writing contents. Front tire diameter radius of Vehicle information writing method(Variant coding) (*5) Rear tire diameter radius of Vehicle information writing method(Variant coding). (*5) ESS of Vehicle information writing method(Variant coding) 0b0：with no ESS 0b1：with ESS ADVICS 21 / 24 Page (*1)The physical value describes abnormal circumstance. Abnormal circumstance is communication failure and function not available. (*2)Combination of Vehicle information writing method (Variant coding). The following items can only be written using the combination described in Table-(*2)-1, Table-(*2)-2 and Table-(*2)-3. ・Wheelbase ・MAX engine torque ・Brake No. ・Transmission No. Table- (*2)-1 Vehicle Type No. HD65 2 HD55 1 Type writing value (DEC) HD78 3 2800～4450 2800～4100 2800～4000 2800～4400 160～490 160～420 160～400 160～480 County Leaf 4 County Indp 5 3300～4100 3300～4100 260～420 260～420 380～620 380～620 380～620 600～620 0b01010～0b10101 0b01010～0b10101 0b01010～0b10101 0b10101 physical value (mm) 2500～3400 2700～3450 2800～4100 2800～4400 writing value (DEC) 100～280 140～290 160～420 160～480 Wheelbase physical value (Nm) MAX engine torque writing value (binary) Table- (*2)-2 <24V-500kbps software> <24V-250kbps software> 280～420 360～380 <24V-500kbps software> <24V-250kbps software> 0b00101～0b01011 0b01001 Type Fr：φ314 54x2 Rr：φ314 54x2 Type writing value (DEC) writing value (DEC) 0b01001～01010 0b01001～0b10000 writing value (DEC) writing value (DEC) writing value (DEC) writing value (DEC) writing value (DEC) writing value (DEC) ○ × ○ × × × ○ ○ × ○ ○ ○ ○ × ○ ○ ○ ○ × × × ○ ○ × × × × × ○ × × × × ○ × × × × ○ × × HD55 1 HD65 2 Vehicle Type No. HD78 3 County Leaf 4 County Indp 5 ○ ○ ○ ○ × × ○ ○ ○ ○ × ○ ○ ○ ○ ○ ○ < Only "12V-500kbps software"> < Only "12V-500kbps software"> × × 7 Fr：φ330 31.75 Rr：φ330 31.75 Type County Indp 5 6 Fr：φ314 57x2 Rr：φ330 31.75 Type County Leaf 4 5 Fr：φ314 57x2 Rr：φ314 57x2 Type Vehicle Type No. HD78 3 4 Fr：φ320 31.75 Rr：φ308 22.22 Type HD65 2 3 Fr：φ314 54x2 Rr：φ308 22.22 Type HD55 1 2 Fr：φ320 31.75 Rr：φ320 28.57 Type 8 ○ Writable × Not writable Type writing value (DEC) Type writing value (DEC) Type Transmission writing value (DEC) No. Type writing value (DEC) Type writing value (DEC) Protected <12V-500kbps software> 1 Fr：φ314 54x2 Rr：φ320 31.75 Type Table- (*2)-3 360～400 360～520 ○ Writable × Not writable writing value (DEC) Brake No. <12V-500kbps software> M035S5 （5MT） 1 T06S5 （5MT） 2 T06S6 （6MT） 3 T045S5 （5MT） 4 × S1-2012-0456△10 ADVICS 22 / 24 Page (*3)Number of teeth depends on Brake No. writing value (DEC) : 4 or 5 -> teeth number : 52 writing value (DEC) : other -> teeth number : 56 (Initial value) (*4)Details of MAX engine torque writing value 5bit (binary) 00000 MAX engine torque (Nm) 190±10 00001 210±10 00010 230±10 00011 250±10 00100 270±10 00101 290±10 00110 310±10 00111 330±10 01000 01001 350±10 370±10 01010 390±10 01011 01100 410±10 (Initial value) 430±10 01101 450±10 01110 470±10 01111 490±10 10000 510±10 10001 530±10 10010 550±10 10011 570±10 10100 590±10 10101 610±10 10110 630±10 10111 650±10 11000 670±10 11001 690±10 11010 710±10 11011 730±10 11100 750±10 11101 770±10 11110 790±10 11111 810±10 (*5)Details of front tire diameter radius and rear tire diameter radius Writable range ：300 ～ 450 mm writing value 16bit (DEC) Front tire diameter radius Rear tire diameter radius ○：Writable ×：Not writable 0 0 mm × 1 1 mm × ・ ・ ・ ・ ・ ・ ･ ･･ ･･ 299 299 mm ･ × 300 300 mm ○ 301 301 mm ○ ・ ・ ・ ・ ・ ・ ･ ･･ ･･ 399 399 mm ･ ○ 400 400 mm (Initial value) ○ 401 401 mm ○ ・ ・ ・ ・ ・ ・ ･ ･･ ･･ 449 449 mm ･ ○ 450 450 mm ○ 451 451 mm × ・ ・ ・ ・ ・ ・ ･ ･･ ･･ 65534 65534 mm ･ × 65535 65535 mm × Protected S1-2012-0456△10 ADVICS 23 / 24 Page (*6)Details of Vehicle information writing complete When "0b0：not completed" is written in Vehicle information writing complete, it will be "System non-selection". After "0b1：completed" is written in Vehicle information writing complete and IG OFF, it will return to normal. When "0b1：completed" is written in Vehicle information writing complete, Vehicle information writing of "FE00" cannot be performed. When performing vehicle type writing once again, before that, please rewrite vehicle type writing completion to "0". 【Vehicle information writing method flow】 1.When "0b0：not completed" is written in Vehicle information writing complete(DID[$FE01]). (In the extendedDiagnosticSession, security level $01 is already unlocked.) VDC ECU Tester SIDRQ[$2E], ID[$FE00] SIDPR[$6E], ID[$FE00] SIDRQ[$2E], ID[$FE01],Vehicle information writing completed=0b1 SIDPR[$6E], ID[$FE01] Vehicle information writing ended normally ※Please turn IG from OFF to ON or reset ECU after DID$FE01 positive response is received. Then diagnosis of System non-selection will return to normal. 2.When "0b1： completed" is written in Vehicle information writing complete(DID[$FE01]). (In the extendedDiagnosticSession, security level $01 is already unlocked.) VDC ECU Tester SIDRQ[$2E], ID[$FE00] SIDPR[$7F], WDBI[$2E]. NRC[$22] Vehicle information writing not completed SIDRQ[$2E], ID[$FE01],Vehicle information writing not completed=0b0 SIDPR[$6E], ID[$FE01] SIDRQ[$2E], ID[$FE00] SIDPR[$6E], ID[$FE00] SIDRQ[$2E], ID[$FE01],Vehicle information writing completed=0b1 SIDPR[$6E], ID[$FE01] Vehicle information writing ended normally ※Please turn IG from OFF to ON or reset ECU after DID$FE01 positive response is received. Then diagnosis of System non-selection will return to normal. Protected S1-2012-0456△10 ADVICS 24 / 24 Page Ⅲ．RＩＤ Ｌｉｓｔ Y: Supported N: Not supported *: With SecurityAccess (SID $27) Hex 0200 0201 Description Y/G Sensor zero position memorization Steering angle Sensor zero position memorization routineC Method ontrolTyp e B B FF00 Erase Memory B FF01 Check Programming Dependencies B Protected Minimum Maximum Default value Session value Type Record Description Size (bytes) Unit Data Type $01 - - - - - - - $02 - - - - - - - $03 Response Result 1 - - - - $01 - - - - - - - $02 - - - - - - - $03 Response Result 1 - - - - $01 - - - - - - - $03 Response Result 1 - - - - $01 - - - - - - - $03 Response Checksum 2 - HEX - - S1-2012-0456△10 N Safety Program Extended System ming Diag. Diag. Session Session Session N Remarks Y $0:Under control (Under Calbration) $1:Not under control (not Calibration or after Calibration) N N Y $0:Under control (Under Calbration) $1:Not under control (not Calibration or after Calibration) N Y* N N Y* N $0:Normal end $1:Executing $2:Abnormal end ADVICS