UDS Flashing ECU

[LtTlt]

     We are going to use ADCs toolkit to implement ECU program brushing, but there is no corresponding official example. At present, we simply program according to the UDS function provided, but there are always errors, and we don't know what the problem is? Sometimes 27 service can pass safely, but sometimes it can't. when sending 85 and 28 service, ECU doesn't respond at all. There is always - 8260 error.

     Here is my own code, you help to see, thank you very much！

                                                                                                                                                                                                    Yan

[kayfh]

Hi, is the CAN bus set up correctly and terminated? Are you using CAN-FD?

If the seed/key service sometimes work and sometimes not, is the seed/key algorithm result correct in the non-working case? Maybe you are already "logged in" and it returns a seed=0?

You could provide a bus log (e.g. created using NI-XNET Bus Monitor, and maybe censor out the seed/key message bytes, and enable logging error frames) so we can find out more...

[LtTlt]

Thank you very much for your reply. My can parameter settings are correct. CAN FD is not used, but CAN is used. The problem of secure access may be that I have logged in. I will follow your suggestions. There are still some problems. When I use physical addressing, 28 and 85 services can receive the response from the ECU. However, when I use functional addressing, the ECU does not respond at all and it will appear. The 8260 error, is there any problem to pay attention to when using functional addressing? Does functional addressing need to be sent all the time?

[StephenDavid]

I am also using ADCs toolkit to implement ECU program brushing.I would like to know how to use service 34 and 36, and what format should be used for the uploaded data .I have finished pre-programming and post-programming, but I don't know how to upload the data in the programming stage. Can I refer to your program, if that's convenient?

[Hooovahh]

You should make your own post, and stop reviving old threads. 

I've wanted to have a blog post on flashing ECUs, but one issue with this is that ECU flashing can be specific to an ECU, or even a revision of that ECU.  So I will share what I've learned about services 34 and 36 but they might not be applicable to you.

When flashing an ECU you are basically writing memory locations after preparing the ECU for flashing.  There may also be some routines ran for check summing, or erasing memory.  You will have a set of addresses, and a set of bytes that need to be stored at specific addresses.  This information comes from some kind of flash file.  If you are using Vector tools then vFlash will have a vFlashPack file which is a single file containing everything needed.  This file is just an archive, and can be opened like a zip file.  Inside that you should find some kind of file that has address and memory.  This is most often a .HEX, or S Record file.  If you have a low level programmer with a JTAG header, it is likely this same file can be used there too.  This file can be viewed in a text editor.  There can be a few formats for this file.  But for the most part each line will have an address, the bytes to be at the address, and then some kind of checksum.

If you have the ECU MC toolkit installed in the Help >> Find Examples you'll find an example called Program Hex or S file.  This flashes a virtual ECU using XCP which isn't what we want.  But the code shows how to parse HEX and S Record files.  I talk a little bit about this in Part 7 of my CAN blog.

So with all that out of the way how does service 34 and 36 work?  Well after reading your flash file you will have an array of address, each with an array of bytes program, starting at that address.  Your ECU will likely need to be put into Programming using the UDS Diagnostic Session Control.  Then you will likely need to request a seed, and provide the correct key.  Once that is done call UDS Request Download which is service 34.  Here you need to provide the address of where the data will start to be downloaded to, along with the size of the data you will be downloading.  Then you will call UDS Transfer data which is service 36 over and over again until all the data from that address is complete.  Then UDS Transfer Exit is called which is service 37.  Then this operation repeats for all addresses found in the flash file.  When calling the UDS Transfer Data you can only send over so much data at a time.  Some ECUs can probably handle more but I've seen it limited to around 0xF00 bytes at a time.  The Block Sequence Counter input for this operation will also increment with each call, and then reset back to 0 for the next address.

If you do have a working setup through some other tool like vFlash I recommend putting another CAN device on the bus just to log the whole flash process.  Then you can see what messages are going out and see what it takes to perform a proper flash.  Then just replicate those steps.