{"id":453,"date":"2010-05-15T21:16:00","date_gmt":"2010-05-15T21:16:00","guid":{"rendered":"http:\/\/3.68.38.87\/?p=453"},"modified":"2023-07-10T23:17:19","modified_gmt":"2023-07-10T23:17:19","slug":"scanning-for-diagnostic-data","status":"publish","type":"post","link":"https:\/\/canbushack.com\/web\/scanning-for-diagnostic-data\/","title":{"rendered":"SCANNING FOR DIAGNOSTIC DATA"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n

Because diagnostic data is built on top of a standard Transport Protocol (ISO 15765-2<\/span><\/a>), you can use this knowledge to see which diagnostic service a particular vehicle supports and which parameters or sub-functions it may support.<\/p>\n\n

Step 1. Finding Nodes\u2019 Diagnostic IDs.<\/strong>
We must first have all of the nodes enumerated with Physical IDs and their respective response IDs (Note: sometimes there may be an ID that is a Functional ID. That means more than one node will respond to request sent on this ID).\u00a0 To do this I usually send the Tester Present Request (Service 0x3E) to each CAN BUS ID.\u00a0 If you are working with a 29bit system this may be daunting simply because of how many possible IDs there are; you may have to find a shortcut instead of request each ID.\u00a0 However on 11bit systems this is quite easy.<\/p>\n\n

Start by sending tester present to ARB ID 0x001.\u00a0 This message would typically look like this:
0x001 01 3E 00 00 00 00 00 00\u00a0OR\u00a00x001 02 3E 01 00 00 00 00 00.\u00a0 Try them both and see which works.\u00a0 Next simply increment your arbitration ID by one: 0x001, 0x002, 0x003, \u2026 0x7FF.\u00a0 You will know that a node has diagnostics on it because you will see a response from the node after you send your request.\u00a0 You would typically see this:\u00a00x7E8 01 7E 00 00 00 00 00 00.\u00a0 The 0x7E is the positive response to your 0x3E request (tester present).\u00a0 Write down (or log) the request ID AND the response ID and save them for later.\u00a0 Essentially the request ID is how you query the controller and the response ID is data you will get back from that specific controller.\u00a0 Keep in mind that you may get some CAN BUS errors.\u00a0 This is to be expected, but should not cause concern. You may also have some strange affects on the car such as a windshield wiper move or blinker kick in.\u00a0 This is because you are sending data on the bus that is interpreted by other controllers and you may have inadvertently activated another command. Cool, huh?<\/p>\n\n

Step\u00a0 2. Finding Supported Services.
<\/strong>This can be a bit tricky only because some services may require a certain message length (i.e. you may have to have 0x04 in the first data byte in order to get a positive response from the controller), but this is usually not the case.\u00a0 In order to do this you must remember that the service ID for a diagnostic command is found in the second byte (ARBID, B1,\u00a0B2<\/strong>, B3, etc).\u00a0 So your first request might look like this:\u00a00x7E0 01 01 00 00 00 00 00 00, where byte 2 contains the service.\u00a0 In this case we are not sending any protocol data.\u00a0 Diagnostic services are broken into ranges.\u00a0 This is because the request IDs and positive response IDs don\u2019t over-lap, and since we are not interested sending the responses, we can remove the positive response IDs from the services we will request.\u00a0 Service request IDs are as follows: 0x01-0x3E, 0x80-0xBE.\u00a0 (0x3F is reserved, 0x7F is for negative responses and 0x40-0x7E and 0xC0-0xFE are reserved for positive responses coming back from the ECU).<\/p>\n\n

Now that we know what our range is, we can simply send a request and based on its response we will know if this is a service that is supported. We send\u00a00x7E0 01 01 00 00 00 00 00 00\u00a0and we get back\u00a00x7E8 03 7F 01 12 00 00 00 00.\u00a0 The response is a negative response because there is a 0x7F in the second data byte.\u00a0 This tells us that there was a problem with our request, but does NOT mean that the service is not supported.\u00a0 We have to look at byte 4 to see why our request failed.\u00a0 In this case we got a 0x12 Negative Response Code (NRC).\u00a0\u00a0 0x12 means Sub-Function not supported (please see list below for other NRCs).\u00a0 So it\u2019s telling that the service IS support but the sub-function (which we didn\u2019t send one in this case) is not supported.\u00a0 In fact we can ignore all NRCs except 0x11 and 0x78.\u00a0 NRC 0x11 means that the Service is Not Supported.\u00a0 This gives us a definitive NO that we cannot use this service on this controller.\u00a0 NRC 0x78 doesn\u2019t tell us anything, yet.\u00a0 In fact it means Response Pending.\u00a0 It may response later with another NRC or with a positive response.\u00a0 Other than a NRC 0x11, a simple No-Response will tell you that the controller does not support your service.\u00a0 Simply waiting around 100 milliseconds (ms) will be sufficient proof that the particular service is not supported on your controller.<\/p>\n\n

Step 3. Finding Parameters.
<\/strong>This is the most dynamic of steps.\u00a0 It requires some understanding of the service that you are working with.\u00a0 For example, you may be using a service that has a sub-function or a service that has a parameter and this parameter may be 1 byte, two bytes, three, etc.\u00a0 So you will have to prepare yourself for a lot of negative responses (I hope you don\u2019t fear rejection).
So here is what we do now, send our request but increment the bytes,
0x7E0 02 01 00 00 00 00 00 00,
0x7E0 02 01 01 00 00 00 00 00,
0x7E0 02 01 02 00 00 00 00 00,\u00a0etc..<\/p>\n\n

If you are getting positive responses back from the controller, then you have won.\u00a0 However if the controller is sending back negative responses then you\u2019ll have to adapt.\u00a0 For instance you may get a NRC 0x22, this means \u201cConditions Not Correct, Sequence Error\u201d.\u00a0 This NRC is particularly vague.\u00a0 It typically means that you must send a Start Diagnostic command first or that the key must be in the ignition, or that Venus and Mars must be in alignments.\u00a0 So you will just have to work with what you have.\u00a0 But if you get a NRC 0x12, you will know right away that this sub-function or this parameter ID is not supported by this controller and you can move on to the next one.<\/p>\n\n

As you can see the trick is to automate this process.\u00a0 To write each message and handle each repsonse can be difficult.<\/p>\n\n

\n\n\n\n\n\n\n\n\n\n\n\n
NRC<\/td>\nLong Name<\/td>\n<\/tr>\n
$11<\/td>\nService Not Supported<\/td>\n<\/tr>\n
$12<\/td>\nSub Function Not Supported \u2013 Invalid Format<\/td>\n<\/tr>\n
$22<\/td>\nConditions Not Correct Or Request Sequence Error<\/td>\n<\/tr>\n
$31<\/td>\nRequest Out Of Range<\/td>\n<\/tr>\n
$35<\/td>\nInvalid Key<\/td>\n<\/tr>\n
$36<\/td>\nExceed Number Of Attempts<\/td>\n<\/tr>\n
$37<\/td>\nRequired Time Delay Not Expired<\/td>\n<\/tr>\n
$78<\/td>\nRequest Correctly Received-Response Pending<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Because diagnostic data is built on top of a standard Transport Protocol (ISO 15765-2), you can use this knowledge to see which diagnostic service a particular vehicle supports and which parameters or sub-functions it may support. Step 1. Finding Nodes\u2019 Diagnostic IDs.We must first have all of the nodes enumerated with Physical IDs and their […]<\/p>\n","protected":false},"author":1,"featured_media":388,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[7],"tags":[],"class_list":["post-453","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"_links":{"self":[{"href":"https:\/\/canbushack.com\/web\/wp-json\/wp\/v2\/posts\/453","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/canbushack.com\/web\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/canbushack.com\/web\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/canbushack.com\/web\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/canbushack.com\/web\/wp-json\/wp\/v2\/comments?post=453"}],"version-history":[{"count":0,"href":"https:\/\/canbushack.com\/web\/wp-json\/wp\/v2\/posts\/453\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/canbushack.com\/web\/wp-json\/wp\/v2\/media\/388"}],"wp:attachment":[{"href":"https:\/\/canbushack.com\/web\/wp-json\/wp\/v2\/media?parent=453"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/canbushack.com\/web\/wp-json\/wp\/v2\/categories?post=453"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/canbushack.com\/web\/wp-json\/wp\/v2\/tags?post=453"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}