how does a car work

8/21/2019 How does a car work

1/62

How does a car work?

When youre riding in a car, you may not necessarily think about whats making it go, aside from the grown -up inthe drivers seat. But in truth, cars get their power and their ability to move from their very special construction and

from energy-filled substances that fuel them.If youve ever been to the gas station, then you probably already know that cars need gasoline, or petroleum, to run.The cars engine runs on a mixture of gasoline and air. Just like a hot fire gives off energy when it burns, so does thegasoline! The spark that gets the whole thing going comes from the cars battery, which gets powered when the

driver turns the key in the ignition.Once the whole thing is going, the energy the car gets from the gas it burns moves the car forward! A special part ofthe car called the transmission passes all the energy from the engine to the wheels. The driver then uses the wheelto steer and guide the car in the direction in needs to go, and uses the cars brakesto slow the car down when at astoplight or when arriving at the destination!The TransmissionControls the power contained in thecrankshaftbefore it goes to the wheels and allows a driver to control thespeed/power of a car by providing different speed/power ratios known as gears.So first gear gives plenty of powerbut little speed whereas fifth gear provides little power but plenty of speed.The crankshaft only connects to thetransmission when the car is in gear and the clutch is engaged. If you press down on the clutch the crankshaft

disconnects from the transmission.The transmission is connected to the output shaft, which is connected to the axles,which are connected to the wheels. When the transmission rotates the output shaft this turns the axles, which in turnrotate the wheels.
http://automotivetechis.wordpress.com/2012/06/18/190/http://en.wikipedia.org/wiki/Crankshafthttp://en.wikipedia.org/wiki/Crankshafthttp://en.wikipedia.org/wiki/Crankshafthttp://automotivetechis.wordpress.com/2012/06/18/190/hughes-telematics-device-1/http://en.wikipedia.org/wiki/Crankshafthttp://automotivetechis.wordpress.com/2012/06/18/190/


2/62

How a Motor Engine WorksThe more you understand about your car, the more capacities you will have to keep it running the correct way and

to know where the trouble spots could be if it is not running as efficiently as you would like. If you want to ensure

that your car keeps going the right way, one of the first things you want to understand is the motor and how itconnects to everything in your vehicle. This will allow you to make adjustments needed and to have betterknowledge of the vehicle that you have.

The motorof a car is like the heart of your vehicle. It is the one thing that connects everything together and ensuresthat your car continues to move. Its main purpose is to transfer the gasoline that moves into the engine area andthen to move it back out so that your vehicle as fuel to run on. The motoris what will propel the gasoline into thevarious areas of the car, pushing it into the motion that keeps everything running effectively.Even further than this, everything that is connected to the engine also allows it to keep running at its best. The firstof these is the set of spark plugs that moves into the engine. When the engine pushes up, it will hit the sparkplugs. When this happens, it will cause the spark plugs to ignite and will turn on the engine. When this happens, thegasoline is then able to push up through the cylinder of the engine and releases into an exhaust pipe. This is the

cycle that the motor will follow in order to release the energy to move.

In order to keep the motor engine completely functioning, there are other components that also allow the engine tocontinue to run smoothly. The first of these is the connecting rod, which is used as a support area as thepiston rotates and releases the gas. The second is the crankshaft, which is used in order to keep the piston turning sothat it can release the necessary gasoline at the right time. The last of these is the sump, which will collect the oiland lubricate the engine piston and other parts of the motoras they are turning, allowing for a smoother ride.
http://automotivetechis.wordpress.com/2012/06/18/190/engine-inline-4/http://automotivetechis.wordpress.com/2012/06/18/190/engine-inline-4/


3/62

Take a close look of Internal combustion system:

1.Intake strokeintake valve opens and the piston moves down allowing the fuel-air mix to enter the open space.2. Compression stroke- the piston moves upwards. This compresses the fuel-air mix by forcing it into a smallerspace. Compression makes the fuel-air mix explode with greater force.3. Power cyclespark from a spark plug ignites the fuel-air mix. The explosion forces the piston down the cylinder.4. Exhaust cyclethe exhaust valve opens and the piston moves back to the top of the cylinder which forces theexhaust fumes out.As these all move together, the motoris able to continue turning and allowing for the car to move forward with thefuel that it is given. By the continuous turns and movements of the motoris the ability to push your car forwardwith some simple steps that allow for the wheels on your car to keep turning.The bottom of each piston is attached to the crankshaft.As the pistons are forced up and down they rotate thecrankshaft, which after sending the power through the transmission, turns wheels.Most cars have at least fourcylinders. More powerful cars have more. For example a V6 has six cylinders and a V8 has eight.The harder a driver

presses on the accelerator pedal the more fuel-air mix is passed into the cylinders and the more power isproduced.What Are Revolutions Per Minute?The four-stroke cycle repeats itself thousand of times a minute. These repetitions are more commonly known asRevs.A rev counter tells you how many thousand times per minute the cycle is repeated.
http://automotiveconceptsblog.files.wordpress.com/2012/06/4strokeengine_ortho_3d_small1.gifhttp://automotiveconceptsblog.files.wordpress.com/2012/06/4strokeengine_ortho_3d_small1.gifhttp://automotivetechis.wordpress.com/2012/06/18/190/4strokeengine_ortho_3d_small-2/http://automotiveconceptsblog.files.wordpress.com/2012/06/4strokeengine_ortho_3d_small1.gif


4/62

Two Stroke & Four Stroke EnginesStroke refers to the movement of piston in the engine. 2 stroke engines make piston move twice and 4 stroke enginespiston moves four times in all the directions. Each movement of the piston (stroke) is characterized by a uniqueactivity of compression of fuel and generation of power. So what exactly is the difference between 2 and 4 strokeengines? Let us find out:Piston moves only twice in a two stroke engine. The first movement is called the compression stroke and the secondstroke is called the power stroke.

1. Compression stroke: Compression stroke is an act of compressing fuel. During compression stroke pistongoes up compressing the fuel in to the engine.

2. Power stroke:Compression stroke is followed by power stroke. During a power stroke the fuel is ignited,which pushes the piston down producing a lot of power and torque. It also involves in taking new fuel andair to start compression again.

In a four stroke engine, the piston moves 4 times i.e. two sets of ups and downs. The movements are characterized asfollows:

1. Compression stroke:During this stroke fuel is compressed. The compressing is essential to generate powerat the later stages.

2. Power stroke:The fuel ignites and moves the piston down. The act of moving down produces power andtorque.

3. Exhaust Stroke:The piston again goes up and drives the power emitted and fuel out of the exhaust valve.4. Intake stroke:The piston again goes down and draws new amount of fuel and air ready to compress again.

Thus as you can notice that two stroke engines involves only two moves and 4 stroke moves 4 times.

Basic Features: As a 2 stroke engine receives power stroke twice than that of four stroke engines they generatemore power and torque. Also, 2 stroke engines are noisier when compared to four stroke engines.

2 stroke engines does all the act of exhausting and taking fuel in at a single stroke i.e. power stroke, it ismore polluting.

2 stroke engines want more lubrication when compared to four stroke engines. One will have to keep theengine lubricated frequently (oiling) for smooth riding experience.

2 stroke engines are not suitable for long term as they tend to produce more noise and pollutionsimultaneously.

4 stroke engines are fuel efficient, smoother riding experience, less polluting and least noisy.


5/62

4 stroke engines do not emit as much smoke as 2 stroke ones do. They also have a long term life.The Final Verdict: Though a two stroke engine emits more power and torque, they are not suited for the day to dayactivity. Moreover, they are not fuel efficient, have a short life, polluting agent and also noisier than 4 stroke ones.Therefore, 4 stoke engines should be preferred as they are more fuel efficient, less polluting, and affordable. 4 strokebikes are ideal for day to day activities.Anti-lock braking system (ABS)Anti-lock braking systemis an automotive safety system that allows the wheels on a motor vehicle to maintaintractive contact with the road surface according to driver inputs while braking preventing the wheels from lockingup (ceasing rotation) and avoiding uncontrolled skidding. It is an automated system that uses the principles ofthreshold braking and cadence braking which were practiced by skillful drivers with previous generation brakingsystems. It does this at a much faster rate and with better control than a driver could manage.

The theory behind anti-lock brakes is simple. A skidding wheel(where the tire contact patch is sliding relative to theroad) has less tractionthan a non-skidding wheel. If you have been stuck on ice, you know that if your wheels arespinning you have no traction. This is because the contact patch is sliding relative to the ice. By keeping the wheelsfrom skidding while you slow down, anti-lock brakes benefit you in two ways: Youll stop faster, and youll be ableto steer while you stop.There are four main components to an ABS system:

Speed sensors Pump Valves Controller

Speed Sensors

The anti-lock braking system needs some way of knowing when a wheel is about to lock up. The speed sensors,which are located at each wheel, or in some cases in the differential, provide this information.

Valves

There is a valve in the brake line of each brake controlled by the ABS. On some systems, the valve has threepositions:

In position one, the valve is open; pressure from the master cylinder is passed right through to the brake. In position two, the valve blocks the line, isolating that brake from the master cylinder. This prevents the

pressure from rising further should the driver push the brake pedal harder. In position three, the valve releases some of the pressure from the brake.

Pump

Since the valve is able to release pressure from the brakes, there has to be some way to put that pressure back. Thatis what the pump does; when a valve reduces the pressure in a line, the pump is there to get the pressure back up.

Controller

The controller is a computer in the car. It watches the speed sensors and controls the valves.

ABS at Work

There are many different variations and control algorithms for ABS systems. We will discuss how one of the simplersystems works.


6/62

The controller monitors the speed sensors at all times. It is looking for decelerations in the wheel that are out of theordinary. Right before a wheel locks up, it will experience a rapid deceleration. If left unchecked, the wheel wouldstop much more quickly than any car could. It might take a car five seconds to stop from 60 mph (96.6 kph) underideal conditions, but a wheel that locks up could stop spinning in less than a second.

The ABS controller knows that such a rapid deceleration is impossible, so it reduces the pressure to that brake until

it sees an acceleration, then it increases the pressure until it sees the deceleration again. It can do this very quickly,before the tire can actually significantly change speed. The result is that the tire slows down at the same rate as thecar, with the brakes keeping the tires very near the point at which they will start to lock up. This gives the systemmaximum braking power.

When the ABS system is in operation you will feel a pulsingin the brake pedal; this comes from the rapid openingand closing of the valves. Some ABS systems can cycle up to 15 times per second.

Car Engine working:Referred Documents:CAR COMPONENTS CIRCUITS

Share this:

Twitter

Facebook

Like this:

By sudhakarmaradana

JUN 122012

CAN Calibration Protocol (CCP)What is Calibration?

Calibration is a process of optimizing or tuning a control algorithm to get the desired responsefrom the system. A calibration tool is a combination of a hardware interface and a software
http://automotiveconceptsblog.files.wordpress.com/2012/06/car-components-circuits.pdfhttp://automotiveconceptsblog.files.wordpress.com/2012/06/car-components-circuits.pdfhttp://automotivetechis.wordpress.com/2012/06/18/190/?share=twitter&nb=1http://automotivetechis.wordpress.com/2012/06/18/190/?share=twitter&nb=1http://automotivetechis.wordpress.com/2012/06/18/190/?share=facebook&nb=1http://automotivetechis.wordpress.com/2012/06/18/190/?share=facebook&nb=1http://automotivetechis.wordpress.com/2012/06/12/can-calibration-protocolccp/http://automotivetechis.wordpress.com/2012/06/12/can-calibration-protocolccp/http://automotivetechis.wordpress.com/2012/06/12/can-calibration-protocolccp/http://automotivetechis.wordpress.com/2012/06/12/can-calibration-protocolccp/http://automotivetechis.wordpress.com/2012/06/12/can-calibration-protocolccp/http://automotivetechis.wordpress.com/2012/06/18/190/anti-lock-brake1/http://automotivetechis.wordpress.com/2012/06/12/can-calibration-protocolccp/http://automotivetechis.wordpress.com/2012/06/12/can-calibration-protocolccp/http://automotivetechis.wordpress.com/2012/06/18/190/?share=facebook&nb=1http://automotivetechis.wordpress.com/2012/06/18/190/?share=twitter&nb=1http://automotiveconceptsblog.files.wordpress.com/2012/06/car-components-circuits.pdf


7/62

application that enables the engineer to access the calibration variables in an ECU and changethem. Typical control algorithm components that need calibration are look-up tables, gains, andconstants.A powertrain control algorithm may have hundreds of calibrate-able parameters. The moreparameters that are used, the more difficult the task of finding an optimal calibration. The

calibration tool helps the engineer arrive at an acceptable calibration parameter set. All of thecalibrate-able parameters are grouped into a special section of ECU memory called thecalibration memory. Calibration tools give the user access to this memory to allow.A basic calibration system consists of an ECU interface, a link to the host PC, and a PCapplication. A more capable system will add a vehicle network link as well as analog dataacquisition modules. The ECU interface is typically a CAN interface when a CAN-basedcalibration method is used, or a Read-Only-Memory (ROM) emulator when a direct memoryaccess method is used. The link back to the host PC can be CAN, USB, Ethernet, or othermethod. The PC application is typically a MS-Windows application. Figure 1 shows a typicalcalibration system.

What is CCP?The CCP (CAN Calibration Protocol) is, just as the name indicates, a protocol for calibration of and data acquisitionfrom electronic control units (ECU). The protocol is defined byASAM (Association for Standarisation ofAutomation- and Measuring Systems),earlier known as ASAP (Arbeitskreis zur Standardisierung vonApplikationssystemen). This is an international organization consisting of a number of significant vehiclemanufacturers i.e. Audi, BMW, VW etc. Until now different technical solutions have been used for developing,calibration, production and service of ECU hardware and software. The aim with CCP is to create a common tool forall stages of ECU developing and which is compatible with different kinds of hardware and software.
http://www.asam.net/http://www.asam.net/http://www.asam.net/http://www.asam.net/http://automotivetechis.files.wordpress.com/2012/06/untitled.jpghttp://www.asam.net/http://www.asam.net/


8/62

The ASAM group defines a lot of standards. The CCP and XCP standards are found in subsection AE (AutomotiveElectronics) and are grouped into something called AE MCD 1. The current version of the CCP specification is 2.1,released in February, 1999.The CAN Calibration Protocol is basically used as a monitor program. Similar to many earlier serial RS232-typemonitors and bootstrap loaders that provide basic read and write memory capabilities, CCP provides the samefunctionality using a standard protocol rather than a company-specific proprietary protocol. However, when a high-speed CAN bus is used, CCP, unlike some previous 9600 baud UART-based monitors, provides the ability to accessdata at such a fast rate that it is possible to run an application at the same time.

Developers now have a significant advantage over the earlier monitoring methods.

In the dialog used by CCP and most monitor programs it is the tool or PC that is the Master that sends commandsinto the ECU. The ECU does not send information without the Master (Tool) initiating commands. A CCP-compliant tool can read data from the ECU and can write data into the ECU with the appropriate CCP messages.

With CCP, the software developer can read:

RAM

PORTS

ROM

FLASH

With CCP, the software developer can write to:

RAM

PORTS

FLASH

However, this is only CAN Calibration Protocols minimum capability. CCP includes several additional monitorcommands, and provides several new features including automatic data acquisition processing based on events orperiodic updating, flash programming and data security. Since there is no requirement to use all its features, CCP isa scalable protocol.

CCP users have access to online measurement data and can calibrate modules, so software

development can occur not only in a lab environment but also during an in-vehicle test.


9/62

What are the functions of CCP?CCP is a application layer for CAN 2.0B (11- or 29-bits CAN id). The Protocol is a top layer (layer 7) according tothe OSI model, which means that the protocol does not describe how bits and bytes are created but uses the CAN2.0B protocol physical, data link and network layer.

CCP supports the following functions:

Reads and writes to ECU memory. Synchronous cyclic data acquisition from a ECU. Simultaneous calibration and data acquisition. Handles multiple nods on the CAN bus. Flash programming. Plug and play. Protection of resources (data acquisition and calibration).

CCP in detailCCP is built on a master/slave application where CCP-master starts communication by sending commands to a slavenode. There can be several slave nodes connected on a CAN bus. CCP uses generic commands for data acquisitionand simple memory handling for calibration. These two resources are independent and can therefore be usedsimultaneously.

Figure 1: CCP bus connection.CCP has been designed to handle the restrictions and demands of both small 8-bits microcontrollers and ECUs withhigh performance. No extra hardware has to be connected to the ECU. The CCP driver is fully implemented in thesoftware. A simple implementation of CCP only needs a small part of the available RAM, ROM and CPU time forexecution. A simple implementation only need two CAN message identifiers, which can be set as low priority that
http://automotivetechis.files.wordpress.com/2012/06/ccp.jpghttp://automotivetechis.files.wordpress.com/2012/06/ccp.jpg


10/62

does not disturb the ordinary traffic. If CCP is to be used from an ordinary PC, the same simple and low cost CANinterface which is used in microcontrollers can be used.

Generic commandsCCP uses generic commands, which are not node specific, to perform different functions in a slave node. As thecommands are generic every node must have an individual station address. A logical connection between master and

slave has to be set up before any commands can be sent. This connection persists until the master decides to connectto another slave node or until the master sends a disconnect command. After the connection the master controls allcommunication between master and salve. Every message from the master is followed by a reply message from theslave containing data or error codes.

CCP-specific CAN messagesCCP is built on the CAN 2.0B protocol. All messages are 8 bytes long.

Only two types of CAN messages is needed, CRO and DTO, one for each direction. The CRO (Command RecieiveObject) messages are sent from master to slave and contain control commands. DTO (Data Transmission Object)messages are sent from slave to master. When a slave has received a CRO message it performs the giveninstructions and then answers with a DTO message containing a CRM (Command Return Message). The CRM code

tells the master if the corresponding control command has been performed as planned or not.

Figure 2: CRO and DTO messagesThe CAN identifiers used for the CRO and DTO messages are determined by a configuration file (A2L file,

defined by the ASAM MCD 2MC/ASAP2standard) which is used to configure the master. The configuration filemay also contain information about the slave memory organization, which is useful for data acquisition andcalibration. Since the CAN identifiers define the priority of the message it should be chosen in a way that does notdisturb the ordinary traffic on the bus. CCP does not determine which byte order to use (Motorola or Intel) ingeneral data transmission. There is an exception that states that the byte order for the station address used whenestablishing a connection between master and slave has to be Intel (LSB first).

Description of CRO messagesCRO messages are sent from master to slave and contain instructions. The first byte is a command code (CMD)which describes the purpose of the message. The second byte is a command counter (CTR) and is used for keepingtrack of the communication. The command counter is also expected to be sent in return in the DTO message fromthe slave. Bytes 2-7 are reserved for data parameters depending on the command code. A message is always 8 byteslong and bytes which are not defined are considered as do not care.

Figure 3: Organization of CRO message.

Description of DTO messages


11/62

The DTO message is sent by the slave as a receipt of a received CRO message and it is also used for data acquisition.The first byte in the message is called PID (Packet ID). The value of the PID describes the message type. There arethree types of messages:

0xFF, command return message (CRM), if the DTO is sent as a receipt of a CRO message. 0xFE, event message, if the DTO reports internal slave status changes in order to invoke error recovery or

other services. 00xFD, data acquisition message (DAQ). This PID has the value of an ODT (Object Descriptor Table),

which is described later.

Figure 4: Organization of DTO messageData acquisition (DAQ)The master device can initiate and start data acquisition from the slave device. Data is sent from the slave withspecial DAQ-DTOs. The data bytes are organized in DAQ lists which consists of a number of ODT lists. An ODTlist contains up to 7 pointers to memory addresses in the ECU where data is stored. Besides pointers to memoryaddresses a ODT-list can contain a address extension and the number of bytes to be sent. All slave devices donthandle data elements longer than one byte and it is up to the master to solve this task by splitting up the data into

single bytes.

Figure 5: Organization of ODT listDAQ-DTO consists of a PID and the data elements of which the memory pointers in the ODT list points at. The PID

number (usually the same as the ODT list) has a value between 0 and 253 which means that there can be only 254ODT lists simultaneously.


12/62

Figure 6: Organization of DAQ lists

The CCP specification allows several DAQ lists, which can be simultaneously active. Transmission of DAQ lists isinitiated by the master through a START_STOP command. Data bytes in the ODT lists are sampled in the slavedevice and then sent on the CAN bus in DAQ-DTOs. If a new START_STOP command is received by the slave

before the ongoing DAQ cycle is finished, there are two ways to react. The new DAQ command is started and theongoing is terminated or the ongoing cycle is finished and the new is ignored. There are advantages anddisadvantages with both methods and the CCP specification doesnt say which one to choose.

CommandsThe following commands are included in the CCP specification (Figure 7). All commands dont have to beimplemented if the ability for calibration isnt needed and are therefore marked as optional in the table below

(Figure 7). Also GET_DAQ_SIZE, SET_DAQ_PTR, WRITE_DAQ, START_STOP (and START_STOP_ALL) areDAQ specific and dont have to be implemented unless this resource is used. GET_SEED and UNLOCK are used tounlock CCP resources like data acquisition and calibration if they are protected by a key (password), which isoptional.


13/62

Figure 7: Commands.Error handlingDepending on the error code from the slave and how critical it is, the master take different actions that are describedin Figure 8.


14/62

Figure 8: Error handling.

Error C0 is a warning and no action is taken. If error C1 occurs there is an error in the communication or the nodesending it is busy. On error C1 the master should wait the ACK time, described in figure 7, and then try to resendthe message. This should be done two times. Error C2 might be a temporary power loss and can be solved by a re-initialization. Error C3 is irresolvable and the master should terminate the running session.

Cold Start means that a new logical connection between master and slave is established with a CONNECTcommand and some further initialization.

Example of sequencesThe examples describe commands to use, as master, for basic CCP communication.

Login session (Cold Start)A typical connection between master and slave starts with a CRO containing a CONNECT command from themaster. The slave should answer with a corresponding DTO. To make sure that both master and slave talks the samelanguage a GET_CCP_VERSION command is sent from the master with the expected version number. If theversion number sent in return from the slave matches, communication can proceed. For plug n play compatible

nodes EXCHANGE_ID command can be used for automatic session configuration, depending on station address.On command GET_SEED the slave node returns information about protection status (locked/unlocked) of resources(DAQ or Calibration). If, for some reason, a resource is locked it has to be unlocked before it can be used. To unlocka resource an UNLOCK command, with a key received in the GET_SEED DTO, has to be sent from the master.Before the login session is ended initialization of status bits are recommended, this is done with SET_S_STATUScommand.

Calibration init sessionThis session description assumes that a login procedure has been performed. The first thing then would be to set thesession status bit for calibration to off with SET_S_STATUS command. Thereafter the memory address

containing the data to exchange is selected with SET_MTA command. To ensure that this memory address isavailable a BUILD_CHKSUM command is sent and an answer from the slave node that confirms this is expected.Thereafter the data byte(s) can be downloaded to the selected address. First a DOWNLOAD command is sent withthe number of data bytes and the value of each byte. To actually perform the data exchange the


15/62

SELECT_CAL_PAGE is sent. To indicate that calibration has started session status bit for calibration is set to on

with SET_S_STATUS command.

DAQ init sessionThis session description assumes that a login procedure has been performed. The session status bit for DAQ is set tooff with SET_S_STATUS. A DAQ list is selected with GET_DAQ_SIZE and the slave answers with the number

of available ODTs. SET_DAQ_POINTER command selects which DAQ list, ODT table and element in ODT thatshould be written to. WRITE_DAQ command then assigns the memory address of the data parameter to theprevious selected element. When all DAQ lists are filled as wanted the session status bit for DAQ is set to onusing SET_S_STATUS. The transmission of a DAQ list is started with the START_STOP command. If severalDAQ lists should be started at the same time and sent synchronously START_STOP_ALL command is used.

Areas of useThe most common area of use is in the automotive industry, where CAN is often used, but also in other industrywhere CAN is used. Conceivable areas of use include -

ECU developing. Systems for function and environmental tests of ECUs. In a test bench for combustion engines, gear box or climate control. For measurements and calibration in pre-production vehicles. In a general CAN application outside vehicle industry.

Click to view the CCP documents:1. CCP_diag2. CCP Version 2.13. CANape_CCP_Communication4. Flash_Kernel__CCP__HC12_micro_controller5. Integration_of the_Vector_CCP_Driver_with_a_free_CAN_Driver

Share this:

Twitter

Facebook

Like this:

By sudhakarmaradana

JUN 82012

UDSGeneral vehicle diagnosticsUDS is defined (Unified Diagnostic Services) in the standards ISO 14229 contains (the bus system-independent part)and ISO 15765-3 (CAN describes the specific implementation). Unlike OBD writes the UDS standards applicable tothe general vehicle diagnostic no CAN identifier and no CAN baud rates. Here, then, any vehicle manufacturer isable to decide freely. be called The Standard, however, define how the SIDs and PIDs (hot at UDS Sub-levelparameters). Unlike the OBD content of the messages in UDS is not defined in practice. That is, everyone can

vehicle manufacturers specify how it defines data, under what parameters on the responsibility, as it codes etc.The message structure of the UDS diagnostic services consistent with the structure of OBD: The first byte is the SID.Then a detail of the service follows the so-called sub-level identifiers (essentially corresponds to the PID in OBD).

At UDS, there is the possibility to give positive response to messages. For this, the diagnostic tester must be in therequest, the top bit set of sub-level identifiers to 1. Negative responses on the other hand must always be sent. Thisabsence of positive response messages is useful for example, to reduce the bus load in flashing.
http://automotivetechis.files.wordpress.com/2012/06/ccp_diag.pdfhttp://automotivetechis.files.wordpress.com/2012/06/ccp_diag.pdfhttp://automotivetechis.files.wordpress.com/2012/06/ccp211.pdfhttp://automotivetechis.files.wordpress.com/2012/06/ccp211.pdfhttp://automotivetechis.files.wordpress.com/2012/06/an-amc-1-100_canape_ccp_communication.pdfhttp://automotivetechis.files.wordpress.com/2012/06/an-amc-1-100_canape_ccp_communication.pdfhttp://automotivetechis.files.wordpress.com/2012/06/an-imc-1-002_flash_kernel__ccp__hc12_micro_controller.pdfhttp://automotivetechis.files.wordpress.com/2012/06/an-imc-1-002_flash_kernel__ccp__hc12_micro_controller.pdfhttp://automotivetechis.files.wordpress.com/2012/06/an-imc-1-001_integration_of-the_vector_ccp_driver_with_a_free_can_driver.pdfhttp://automotivetechis.files.wordpress.com/2012/06/an-imc-1-001_integration_of-the_vector_ccp_driver_with_a_free_can_driver.pdfhttp://automotivetechis.wordpress.com/2012/06/12/can-calibration-protocolccp/?share=twitter&nb=1http://automotivetechis.wordpress.com/2012/06/12/can-calibration-protocolccp/?share=twitter&nb=1http://automotivetechis.wordpress.com/2012/06/12/can-calibration-protocolccp/?share=facebook&nb=1http://automotivetechis.wordpress.com/2012/06/12/can-calibration-protocolccp/?share=facebook&nb=1http://automotivetechis.wordpress.com/2012/06/08/uds-general-vehicle-diagnostics/http://automotivetechis.wordpress.com/2012/06/08/uds-general-vehicle-diagnostics/http://automotivetechis.wordpress.com/2012/06/08/uds-general-vehicle-diagnostics/http://automotivetechis.wordpress.com/2012/06/08/uds-general-vehicle-diagnostics/http://automotivetechis.wordpress.com/2012/06/08/uds-general-vehicle-diagnostics/http://automotivetechis.wordpress.com/2012/06/08/uds-general-vehicle-diagnostics/http://automotivetechis.wordpress.com/2012/06/08/uds-general-vehicle-diagnostics/http://automotivetechis.wordpress.com/2012/06/08/uds-general-vehicle-diagnostics/http://automotivetechis.wordpress.com/2012/06/08/uds-general-vehicle-diagnostics/http://automotivetechis.wordpress.com/2012/06/12/can-calibration-protocolccp/?share=facebook&nb=1http://automotivetechis.wordpress.com/2012/06/12/can-calibration-protocolccp/?share=twitter&nb=1http://automotivetechis.files.wordpress.com/2012/06/an-imc-1-001_integration_of-the_vector_ccp_driver_with_a_free_can_driver.pdfhttp://automotivetechis.files.wordpress.com/2012/06/an-imc-1-002_flash_kernel__ccp__hc12_micro_controller.pdfhttp://automotivetechis.files.wordpress.com/2012/06/an-amc-1-100_canape_ccp_communication.pdfhttp://automotivetechis.files.wordpress.com/2012/06/ccp211.pdfhttp://automotivetechis.files.wordpress.com/2012/06/ccp_diag.pdf


16/62

There are a large number of UDS diagnostic services. The following two tables show an extract of it here. In thetables for comparison, the respective services for the predecessor of UDS, KWP 2000 are shown.

Extract the diagnostic services of UDS and KWP 2000

UDS is defined (Unified Diagnostic Services) in the standards ISO 14229 contains (the bus system-independent part)and ISO 15765-3 (CAN describes the specific implementation). Unlike OBD writes the UDS standards applicable tothe general vehicle diagnostic no CAN identifier and no CAN baud rates. Here, then, any vehicle manufacturer isable to decide freely. be called The Standard, however, define how the SIDs and PIDs (hot at UDS Sub-levelparameters). Unlike the OBD content of the messages in UDS is not defined in practice. That is, everyone canvehicle manufacturers specify how it defines data, under what parameters on the responsibility, as it codes etc.
http://www.emotive.de/en/images/stories/Protocolls-UDS-ServicesII.pnghttp://www.emotive.de/en/images/stories/Protocolls-UDS-ServicesI.pnghttp://www.emotive.de/en/images/stories/Protocolls-UDS-ServicesII.pnghttp://www.emotive.de/en/images/stories/Protocolls-UDS-ServicesI.png


17/62

The message structure of the UDS diagnostic services consistent with the structure of OBD: The first byte is the SID.Then a detail of the service follows the so-called sub-level identifiers (essentially corresponds to the PID in OBD).

At UDS, there is the possibility to give positive response to messages. For this, the diagnostic tester must be in therequest, the top bit set of sub-level identifiers to 1. Negative responses on the other hand must always be sent. Thisabsence of positive response messages is useful for example, to reduce the bus load in flashing.

There are a large number of UDS diagnostic services. The following two tables show an extract of it here. In thetables for comparison, the respective services for the predecessor of UDS, KWP 2000 are shown.

Example: Flash Programming IAs a practical example of the UDS diagnostic services, let us consider the typical structure of a flash programming,as illustrated. The diagnostic tester sends a GrowlReadDataByIdentifier. With this request, it reads the hardware IDand software ID from the controller to see which device it exactly right. Then, the diagnostic tester, the control unitswitches to a special diagnostic session. Not the actual diagnosis session for the program, but a session in whichthere are a number of advanced services available. This is done with the diagnostic service diagnosticSession control.This advanced diagnostic session asks the diagnostic tester, the control unit whether the preconditions are met for

flash programming. This is typically that the programming can be done only when the vehicle that the engine mustbe made, etc.

Basic sequence of a flash programming

Then, the diagnostic tester usually with the service Communication Controlthe fault memory and off the buscommunication in other controllers. This advanced diagnostic session has served its purpose. Now the diagnostictester on the diagnostic service diagnosticSession controlto the programming session. At least now isa SecurityAccessnecessary. Thereafter, the diagnostic tester usually sends the so-called fingerprint of the controlunit. This is information that is stored in the ECU memory permanently, to indicate that programming. It typically
http://www.emotive.de/en/images/stories/Protocolls-UDS-FlashProgramming.png


18/62

has a workshop identifier in the memory of the controller is written, can be enacted so that afterwards who hasreprogrammed the ECU.Before the flash memory can be reprogrammed, it must be deleted. This is achieved by calling a routine in the ECUmemory of the diagnostic service routine controldone. Thereafter, the service request downloadthe actualprogramming operation is initiated. This service allows the controller will also be notified of which are loaded intomemory the data and how much data can be expected. Now starts the actual download of data in a loop with theservice transfer data. The storage area is transmitted here in blocks. At the end of the diagnostic tester says thecontrol device transfer exitNow that all data has been transferred. After examining the data transmitted in thecontrol unit now takes place, the actual flash process. Typically, the programming operation will take some time.During this time the controller is not able to process requests from the tester. Therefore, the control unit theservice transfer exitusually with a negative response and the error codeResponsePending. Reply Only when theprogramming is completed, the controller sends a positive confirmation transfer exit.Then examine the diagnostic tester, whether programming was successful, he routine controla routine in the controlunit is activated, which checks the memory. Thereafter, a further call to routine controldifferent n dependence of theflash programming examined, such as whether the software or the corresponding record must be programmed. Thedownload process is completed the controller, the controller is normallyECUResetreset. The controller will rebootand goes to normal operation, so back to the default diagnostic session.In order for the other ECUs in the vehicle also restore the status quo, will Communication Control the normal buscommunication again and the fault memory in the other control devices is turned on again. Hence the downloadprocess is complete.

Share this:

Twitter

Facebook

Like this:

By sudhakarmaradana1

JUN

72012

Memory Map in CA typical memory representation of C program consists of following sections.

1. Text segment2. Initialized data segment3. Uninitialized data segment4. Stack5. Heap

A typical memory layout of a running process

1. Text Segment:A text segment , also known as a code segment or simply as text, is one of the sections of a program in an object fileor in memory, which contains executable instructions.As a memory region, a text segment may be placed below the heap or stack in order to prevent heaps and stackoverflows from overwriting it.
http://automotivetechis.wordpress.com/2012/06/08/uds-general-vehicle-diagnostics/?share=twitter&nb=1http://automotivetechis.wordpress.com/2012/06/08/uds-general-vehicle-diagnostics/?share=twitter&nb=1http://automotivetechis.wordpress.com/2012/06/08/uds-general-vehicle-diagnostics/?share=facebook&nb=1http://automotivetechis.wordpress.com/2012/06/08/uds-general-vehicle-diagnostics/?share=facebook&nb=1http://automotivetechis.wordpress.com/2012/06/08/uds-general-vehicle-diagnostics/#commentshttp://automotivetechis.wordpress.com/2012/06/08/uds-general-vehicle-diagnostics/#commentshttp://automotivetechis.wordpress.com/2012/06/07/memory-map-in-c/http://automotivetechis.wordpress.com/2012/06/07/memory-map-in-c/http://automotivetechis.wordpress.com/2012/06/07/memory-map-in-c/http://automotivetechis.wordpress.com/2012/06/07/memory-map-in-c/http://automotivetechis.wordpress.com/2012/06/07/memory-map-in-c/http://automotivetechis.wordpress.com/2012/06/07/memory-map-in-c/http://automotivetechis.wordpress.com/2012/06/07/memory-map-in-c/http://automotivetechis.wordpress.com/2012/06/08/uds-general-vehicle-diagnostics/#commentshttp://automotivetechis.wordpress.com/2012/06/08/uds-general-vehicle-diagnostics/?share=facebook&nb=1http://automotivetechis.wordpress.com/2012/06/08/uds-general-vehicle-diagnostics/?share=twitter&nb=1


19/62

Usually, the text segment is sharable so that only a single copy needs to be in memory for frequently executedprograms, such as text editors, the C compiler, the shells, and so on. Also, the text segment is often read-only, toprevent a program from accidentally modifying its instructions.

2. Initialized Data Segment:Initialized data segment, usually called simply the Data Segment. A data segment is a portion of virtual address

space of a program, which contains the global variables and static variables that are initialized by the programmer.Note that, data segment is not read-only, since the values of the variables can be altered at run time.

This segment can be further classified into initialized read-only area and initialized read-write area.

For instance the global string defined by char s[] = hello world in C and a C statement like int debug=1 outside the

main (i.e. global) would be stored in initialized read-write area. And a global C statement like const char* string =hello world makes the string literal hello world to be stored in initialized read -only area and the characterpointer variable string in initialized read-write area.

Ex: static int i = 10 will be stored in data segment and global int i = 10 will also be stored in data segment

3. Uninitialized Data Segment:Uninitialized data segment, often called the bss (Block Started by Symbol) segment, named after an ancientassembler operator that stood for block started by symbol. Data in this segment is ini tialized by the kernel toarithmetic 0 before the program starts executinguninitialized data starts at the end of the data segment and contains all global variables and static variables that areinitialized to zero or do not have explicit initialization in source code.

For instance a variable declared static int i; would be contained in the BSS segment.For instance a global variable declared int j; would be contained in the BSS segment.

4. Stack:

The stack area traditionally adjoined the heap area and grew the opposite direction; when the stack pointer met theheap pointer, free memory was exhausted. (With modern large address spaces and virtual memory techniques theymay be placed almost anywhere, but they still typically grow opposite directions.)The stack area contains the program stack, a LIFO structure, typically located in the higher parts of memory. On thestandard PC x86 computer architecture it grows toward address zero; on some other architectures it grows theopposite direction. A stack pointer register tracks the top of the stack; it is adjusted each time a value is pushed

onto the stack. The set of values pushed for one function call is termed a stack frame; A stack frame consists at

minimum of a return address.

Stack, where automatic variables are stored, along with information that is saved each time a function is called. Eachtime a function is called, the address of where to return to and certain information about the callers environment,

such as some of the machine registers, are saved on the stack. The newly called function then allocates room on thestack for its automatic and temporary variables. This is how recursive functions in C can work. Each time a

recursive function calls itself, a new stack frame is used, so one set of variables doesnt interfere with the variablesfrom another instance of the function.

5. Heap:Heap is the segment where dynamic memory allocation usually takes place.The heap area begins at the end of the BSS segment and grows to larger addresses from there.The Heap area ismanaged by malloc, realloc, and free, which may use the brk and sbrk system calls to adjust its size (note that theuse of brk/sbrk and a single heap area is not required to fulfill the contract of malloc/realloc/free; they may also be


20/62

implemented using mmap to reserve potentially non-contiguous regions of virtual memory into the process virtualaddress space). The Heap area is shared by all shared libraries and dynamically loaded modules in a process.

Examples.

The size(1) command reports the sizes (in bytes) of the text, data, and bss segments. ( for more details please referman page of size(1) )

1. Check the following simple C program

#include int main(void){return 0;}[narendra@CentOS]$ gcc memory-layout.c -o memory-layout

[narendra@CentOS]$ size memory-layout

text data bss dec hex filename

960 248 8 1216 4c0 memory-layout

2. Let us add one global variable in program, now check the size of bss (highlighted in red color).

#include int global; /* Uninitialized variable stored in bss*/int main(void){return 0;}[narendra@CentOS]$ gcc memory-layout.c -o memory-layout



960 248 12 1220 4c4 memory-layout3. Let us add one static variable which is also stored in bss.

#include int global; /* Uninitialized variable stored in bss*/int main(void){static int i; /* Uninitializedstatic variable stored in bss */return 0;}[narendra@CentOS]$ gcc memory-layout.c -o memory-layout



960 248 16 1224 4c8 memory-layout4. Let us initialize the static variable which will then be stored in Data Segment (DS)

#include int global; /* Uninitialized variable stored in bss*/int main(void){static int i = 100; /*Initialized static variable stored in DS*/return 0;}[narendra@CentOS]$ gcc memory-layout.c -o memory-layout


21/62



960 252 12 1224 4c8 memory-layout

5. Let us initialize the global variable which will then be stored in Data Segment (DS)

#include int global = 10; /* initialized global variable stored in DS*/int main(void){static int i = 100;/* Initialized static variable stored in DS*/return 0;}[narendra@CentOS]$ gcc memory-layout.c -o memory-layout



960 256 8 1224 4c8 memory-layout

1. Where are global local static extern variables stored? Local Variables are stored in Stack. Register variables are stored in Register. Global & static variables are

stored in data segment (BSS). The memory created dynamically are stored in Heap and the C programinstructions get stored in code segment and the extern variables also stored in data segment

2. What does BSS Segment store? BSS segment stores the uninitialized global and static variables and initializes them to zero. I read that BSS

segment doesnt consume memory, then where those it store these variables? You probably read that theBSS segment doesnt consumespace in the executable file on disk. When the executable loaded, the BSSsegment certainly doesconsume space in memory. Space is allocated and initialized to zero by the OSloader

3. Global variable and Local variable- Global variables once declared they can be used anywhere in the program i.e. even in many functions. If

possible u can use the global variables in the different user defined header files as like in packages in java.On the other hand global variables values can be changed programmatically local variables are local to a

functional and cant be used beyond that function.

4. Static variable and Global variable? Static variables once declared they remain the same in the entire program and those values cant be

changed programmatically.global variables: check above description

ASSEMBLER, LINKER ANDLOADER:Normally the Csprogram building process involves four stages and utilizesdifferent toolssuch as a preprocessor, compiler, assembler, and linker.

At the end there should be a single executable file. Below are thestages that happen in order regardless of the operating system/compilerand graphically illustrated in Figure w.1.

1. Preprocessingis the first pass of any C compilation. It processesinclude-files, conditional compilation instructions and macros.


22/62

2. Compilationis the second pass. It takes the output of thepreprocessor, and the source code, and generates assemblersource code.

3. Assemblyis the third stage of compilation. It takes the assemblysource code and produces an assembly listing with offsets. The

assembler output is stored in an object file.4. Linkingis the final stage of compilation. It takes one or more object

files or libraries as input and combines them to produce a single(usually executable) file. In doing so, it resolves references toexternal symbols, assigns final addresses to procedures/functionsand variables, and revises code and data to reflect newaddresses (a process called relocation).

Bear in mind that if you use the IDE type compilers, these processesquite transparent.

Now we are going to examine more details about the process thathappen before and after the linking stage. For any given input file, thefile name suffix (file extension) determines what kind of compilation isdone and the example for GCC is listed in Table w.1.

In UNIX/Linux, the executable or binary file doesnthave extensionwhereas in Windows the executables for example mayhave .exe, .comand .dll.

File extension Description

file_name.cC source code which must bepreprocessed.

file_name.i C source code which should not bepreprocessed.

file_name.iiC++ source code which should not bepreprocessed.

file_name.h C header file (not to be compiled or lin

file_name.ccfile_name.cpfile_name.C

C++ source code which must bepreprocessed. For file_name.cxx, the xxmust both be literally

character xand file_name.C, is capital c.file_name.s Assembler code.

file_name.S Assembler code which must bepreprocessed.

file_name.o

Object file by default, the object filename for a source file is made byreplacing the extension .c,.i, .setc with .o

Table w.1


23/62

The following Figure shows the steps involved in the process of buildingthe C program starting from the compilation until the loading of theexecutable image into the memory for program running.

Figure w.1: Compile, link & execute stages for running programW.2 OBJECT FILES and EXECUTABLE

After the source code has been assembled, it will produce an Objectfiles(e.g..o, .obj) and then linked, producing an executable files.

An object and executable come in several formats suchas ELF(Executable and Linking Format) and COFF(Common Object-File Format). For example, ELF is used on Linux systems, while COFFis used on Windows systems.

Other object file formats are listed in the following Table.

Object FileFormat Description

a.out

The a.outformat is the original file format for Unix. It consists of threesections: text, data, and bss, which are for program code, initialized data,and uninitialized data, respectively. This format is so simple that itdoesnthave any reserved place for debugging information. The only

debugging format for a.outis stabs, which is encoded as a set of
http://automotivetechis.files.wordpress.com/2012/06/ccompilerlinker001.png


24/62

normal symbols with distinctive attributes.

COFF

The COFF (Common Object File Format) format wasintroduced with System V Release 3 (SVR3) Unix. COFF filesmay have multiple sections, each prefixed by a header. Thenumber of sections is limited. The COFF specification includes

support for debugging but the debugging information waslimited. There is no file extension for this format.

ECOFFA variant of COFF. ECOFF is an Extended COFF originallyintroduced for Mips and Alpha workstations.

XCOFF

The IBM RS/6000 running AIX uses an object file format calledXCOFF (eXtended COFF). The COFF sections, symbols, andline numbers are used, but debugging symbols are dbx-stylestabs whose strings are located in the .debugsection (rather than thestring table). The default name for an XCOFF executable file isa.out.

PE

Windows 9x and NT use the PE (Portable Executable) format fortheir executables. PE is basically COFF with additionalheaders. The extension normally .exe.

ELF

The ELF (Executable and Linking Format) format came withSystem V Release 4 (SVR4) Unix. ELF is similar to COFF inbeing organized into a number of sections, but it removesmany of COFFslimitations. ELF used on most modern Unixsystems, including GNU/Linux, Solaris and Irix. Also used onmany embedded systems.

SOM/ESOM

SOM (System Object Module) and ESOM (Extended SOM) isHPsobject file and debug format (not to be confused withIBMsSOM, which is a cross-language Application BinaryInterfaceABI).

Table w.2 When we examine the content of these object files there are areas

called sections. Sections can hold executable code, data, dynamiclinking information, debugging data, symbol tables, relocationinformation, comments, string tables, and notes.

Some sections are loaded into the process image and some provide

information needed in the building of a process image while still othersare used only in linking object files.

There are several sections that are common to all executable formats(may be named differently, depending on the compiler/linker) as listedbelow:

Section Description.text This section contains the executable instruction codes and


25/62

is shared among every process running the same binary.This section usually has READ and EXECUTE permissionsonly. This section is the one most affected by optimization.

.bss

BSS stands for BlockStarted by Symbol.It holds un-initialized global and static variables. Since the BSS only

holds variables that donthave any values yet, it doesntactually need to store the image of these variables. The sizethat BSS will require at runtime is recorded in the object file,but the BSS (unlike the data section) doesnttake up anyactual space in the object file.

.data

Contains the initialized global and static variables and theirvalues. It is usually the largest part of the executable. Itusually has READ/WRITE permissions.

.rdataAlso known as .rodata (read-only data) section. This containsconstants and string literals.

.relocStores the information required for relocating the imagewhile loading.

Symbol table

A symbol is basically a name and an address. Symbol tableholds information needed to locate and relocate a programssymbolic definitions and references. A symbol table index isa subscript into this array. Index 0 both designates the firstentry in the table and serves as the undefined symbolindex. The symbol table contains an array of symbolentries.

Relocation

records

Relocation is the process of connecting symbolic referenceswith symbolic definitions. For example, when a programcalls a function, the associated call instruction must transfercontrol to the proper destination address at execution. Re-locatable files must have relocation entrieswhich arenecessary because they contain information that describeshow to modify their section contents, thus allowingexecutable and shared object files to hold the rightinformation for a processsprogram image. Simply saidrelocation records are information used by the linker to

adjust section contents.Table w.3: Segments in executable file

The following is an example of the object file content dumping usingreadelf program. Other utility can be used is objdump.

/* testprog1.c */#include static void display(int i, int *ptr);


26/62

int main(void){

int x = 5;int *xptr = &x;

printf(Inmain() program:\n);printf(xvalue is %d and is stored at address %p.\n,x, &x);printf(xptrpointer points to address %p which holds a value of %d.\n,xptr,

*xptr);display(x, xptr);return 0;

}

void display(int y, int *yptr){

char var[7] = ABCDEF;printf(Indisplay() function:\n);printf(yvalue is %d and is stored at address %p.\n,y, &y);printf(yptrpointer points to address %p which holds a value of %d.\n,yptr,

*yptr);}[bodo@bakawali test]$ gcc -c testprog1.c[bodo@bakawali test]$ readelf -a testprog1.oELF Header:

Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00Class: ELF32Data: 2scomplement, little endianVersion: 1 (current)OS/ABI: UNIXSystem VABI Version: 0Type: REL (Relocatable file)Machine: Intel 80386Version: 01Entry point address: 00

Start of program headers: 0 (bytes into file)Start of section headers: 672 (bytes into file)Flags: 00Size of this header: 52 (bytes)Size of program headers: 0 (bytes)Number of program headers: 0Size of section headers: 40 (bytes)


27/62

Number of section headers: 11Section header string table index: 8

Section Headers:[Nr] Name Type Addr Off Size ES Flg Lk Inf Al

[ 0] NULL 00000000 000000 000000 00 0 0 0[ 1] .text PROGBITS 00000000 000034 0000de 00 AX 0 0 4[ 2] .rel.text REL 00000000 00052c 000068 08 9 1 4[ 3] .data PROGBIT 00000000 000114 000000 00 WA 0 0 4[ 4] .bss NOBIT 00000000 000114 000000 00 WA 0 0 4[ 5] .rodata PROGBITS 00000000 000114 00010a 00 A 0 0 4[ 6] .note.GNU-stack PROGBITS 00000000 00021e 000000 00 0 0 1[ 7] .comment PROGBITS 00000000 00021e 000031 00 0 0 1[ 8] .shstrtab STRTAB 00000000 00024f 000051 00 0 0 1[ 9] .symtab SYMTAB 00000000 000458 0000b0 10 10 9 4[10] .strtab STRTAB 00000000 000508 000021 00 0 0 1

Key to Flags:W (write), A (alloc), X (execute), M (merge), S (strings) I (info), L (link order), G (group), x (unknown)O (extra OS processing required) o (OS specific), p (processor specific)

There are no program headers in this file.

Relocation section .rel.textat offset 0x52c contains 13 entries:

Offset Info Type Sym.Value Sym. Name0000002d 00000501 R_386_32 00000000 .rodata00000032 00000a02 R_386_PC32 00000000 printf00000044 00000501 R_386_32 00000000 .rodata00000049 00000a02 R_386_PC32 00000000 printf0000005c 00000501 R_386_32 00000000 .rodata00000061 00000a02 R_386_PC32 00000000 printf0000008c 00000501 R_386_32 00000000 .rodata0000009c 00000501 R_386_32 00000000 .rodata000000a1 00000a02 R_386_PC32 00000000 printf

000000b3 00000501 R_386_32 00000000 .rodata000000b8 00000a02 R_386_PC32 00000000 printf000000cb 00000501 R_386_32 00000000 .rodata000000d0 00000a02 R_386_PC32 00000000 printf

There are no unwind sections in this file.


28/62

Symbol table .symtabcontains 11 entries:Num: Value Size Type Bind Vis Ndx Name

0: 00000000 0 NOTYPE LOCAL DEFAULT UND1: 00000000 0 FILE LOCAL DEFAULT ABS testprog1.c2: 00000000 0 SECTION LOCAL DEFAULT 1

3: 00000000 0 SECTION LOCAL DEFAULT 34: 00000000 0 SECTION LOCAL DEFAULT 45: 00000000 0 SECTION LOCAL DEFAULT 56: 00000080 94 FUNC LOCAL DEFAULT 1 display7: 00000000 0 SECTION LOCAL DEFAULT 68: 00000000 0 SECTION LOCAL DEFAULT 79: 00000000 128 FUNC GLOBAL DEFAULT 1 main10: 00000000 0 NOTYPE GLOBAL DEFAULT UND printf

No version information found in this file. When writing a program using the assembly language it should be

compatible with the sections in the assembler directives (x86) and thepartial list that is interested to us is listed below:

Section Description

1 Text (.section .text)Contain code (instructions).Containthe_startlabel.

2 Read-Only Data (.section .rodata) Contains pre-initialized constants.3 Read-Write Data (.section .data) Contains pre-initialized variables.4 BSS (.section .bss) Contains un-initialized data.

Table w.4 The assembler directives in assembly programming can be used to

identify code and data sections, allocate/initialize memory and makingsymbols externally visible or invisible.

An example of the assembly code with some of the assembler directives(Intel) is shown below:

;initializing data.section .data

x: .byte 128 ;one byte initialized to 128y: .long 1,1000,10000 ;3 long words

;initializing ascii data.ascii hello ;ascii without null characterasciz hello ;ascii with

;allocating memory in bss.section .bss.equ BUFFSIZE 1024 ;define a constant.comm z, 4, 4 ;allocate 4 bytes for x with;4-byte alignment


29/62

;making symbols externally visible.section .data.globl w ;declare externally visible;e.g: int w = 10.text.globl fool ;e.g: fool(void) {}

fool:

leavereturn

W.3 RELOCATION RECORDS

Because the various object files will include references to each otherscode and/or data, so various locations, these shall need to be combinedduring the link time.

For example in Figure w.2, the object file that has main()includes calls tofunctions funct()andprintf().

After linking all of the object files together, the linker uses the relocationrecords to find all of the addresses that need to be filled in.

W.4 SYMBOL TABLE

Since assembling to machine code removes all traces of labels from thecode, the object file format has to keep these around in different places.

It is accomplished by the symbol table that contains a list of names andtheir corresponding offsets in the text and data segments.

A disassembler provides support for translating back from an object fileor executable.

Figure w.2: The relocation recordW.5 LINKING


30/62

The linker actually enables separate compilation. As shown in Figurew.3, an executable can be made up of a number of source files whichcan be compiled and assembled into their object files respectively,

independently. Figure w.3: The object files linking process

W.5.1 SHARED OBJECTS

In a typical system, a number of programs will be running. Eachprogram relies on a number of functions, some of which will be standard

C library functions, likeprintf(), malloc(), strcpy(), etc. and some are non-standard or user defined functions.

If every program uses the standard C library, it means that eachprogram would normally have a unique copy of this particular librarypresent within it. Unfortunately, this result in wasted resources, degradethe efficiency and performance.

Since the C library is common, it is better to have each programreference the common, one instance of that library, instead of havingeach program contain a copy of the library.

This is implemented during the linking process where some of the

objects are linked during the link time whereas some done during therun time (deferred/dynamic linking).

W.5.2 STATICALLY LINKED

The term staticallylinkedmeans that the program and the particularlibrary that itslinked against are combined together by the linker at linktime.

This means that the binding between the program and the particularlibrary is fixed and known at link time before the program run. It alsomeans that we cantchange this binding, unless we re-link the programwith a new version of the library.

Programs that are linked statically are linked against archives of objects(libraries) that typically have the extension of .a. An example of such acollection of objects is the standard C library, libc.a.

You might consider linking a program statically for example, in caseswhere you werentsure whether the correct version of a library will beavailable at runtime, or if you were testing a new version of a library thatyou dontyet want to install as shared.


31/62

For gcc, thestaticoption can be used during the compilation/linking ofthe program.

gccstatic filename.co filename The drawback of this technique is that the executable is quite big in size,

all the needed information need to be brought together.W.5.3 DYNAMICALLY LINKED

The term dynamicallylinkedmeans that the program and the particularlibrary it references are not combined together by the linker at link time.

Instead, the linker places information into the executable that tells theloader which shared object module the code is in and which runtimelinker should be used to find and bind the references.

This means that the binding between the program and the shared objectis done at runtime that is before the program starts, the appropriateshared objects are found and bound.

This type of program is called a partially bound executable, because itisntfully resolved. The linker, at link time, didntcause all thereferenced symbols in the program to be associated with specific codefrom the library.

Instead, the linker simply said something like: Thisprogram calls somefunctions within a particular shared object, so Illjust make a note ofwhich shared object these functions are in, and continue on.

Symbols for the shared objects are only verified for their validity toensure that they do exist somewhere and are not yet combined into theprogram.

The linker stores in the executable program, the locations of theexternal libraries where it found the missing symbols. Effectively, thisdefers the binding until runtime.

Programs that are linked dynamically are linked against shared objectsthat have the extension .so. An example of such an object is the sharedobject version of the standard C library, libc.so.

The advantageous to defer some of the objects/modules during thestatic linking step until they are finally needed (during the run time)includes:

1. Program files (on disk) become much smaller because they need

not hold all necessary text and data segments information. It isvery useful for portability.

2. Standard libraries may be upgraded or patched without every oneprogram need to be re-linked. This clearly requires some agreedmodule-naming convention that enables the dynamic linker to findthe newest, installed module such as some versionspecification. Furthermore the distribution of the libraries is in


32/62

binary form (no source), including dynamically linked libraries(DLLs) and when you change your program you only have torecompile the file that was changed.

3. Software vendors need only provide the related libraries modulerequired. Additional runtime linking functions allow such

programs to programmatically-link the required modules only.4. In combination with virtual memory, dynamic linking permits two

or more processes to share read-only executable modules suchas standard C libraries. Using this technique, only one copy of amodule needs be resident in memory at any time, and multiple

processes, each can executes this shared code (read only). Thisresults in a considerable memory saving, although demands anefficient swapping policy.

W.6 HOW SHARED OBJECTS ARE USED

To understand how a program makes use of shared objects, letsfirstexamine the format of an executable and the steps that occur when theprogram starts.

W.6.1 SOME ELF FORMAT DETAILS

Executable and Linking Format (ELF) is binary format, which is used inSVR4 Unix and Linux systems.

It is a format for storing programs or fragments of programs on disk,created as a result of compiling and linking.

ELF not only simplifies the task of making shared libraries, but alsoenhances dynamic loading of modules at runtime.

W.6.2 ELF SECTIONS The Executable and Linking Format used by GNU/Linux and other

operating systems, defines a number of sectionsin an executableprogram.

These sections are used to provide instruction to the binary file andallowing inspection. Important function sections include the Global OffsetTable(GOT), which stores addresses of system functions, the ProcedureLinking Table(PLT), which stores indirect links to the GOT, .init/.fini, forinternal initialization and shutdown, .ctors/.dtors, for constructors anddestructors.

The data sections are .rodata, for read only data, .datafor initialized data,

and.bssfor uninitialized data. Partial list of the ELF sections are organized as follows (from low to

high):1. .init Startup2. .text String3. .fini Shutdown


33/62

4. .rodata Read Only5. .data Initialized Data6. .tdata Initialized Thread Data7. .tbss Uninitialized Thread Data8. .ctors Constructors9. .dtors Destructors10. .got Global Offset Table11. .bss Uninitialized Data

You can use the readelfor objdumpprogram against the object orexecutable files in order to view the sections.

In the following Figure, two views of an ELF file are shown: the linkingview and the execution view.

Figure w.4: Simplified object file format: linking view and execution view. Keep in mind that the full format of the ELF contains many more

items. As explained previously, the linking view, which is used when theprogram or library is linked, deals with sections within an object file.

Sections contain the bulk of the object file information: data, instructions,relocation information, symbols, debugging information, etc.

The execution view, which is used when the program runs, deals withsegments. Segments are a way of grouping related sections. For example, the text segment groups executable code, the data

segment groups the program data, and the dynamic segment groupsinformation relevant to dynamic loading.

Each segment consists of one or more sections. A process image iscreated by loading and interpreting segments.

The operating system logically copies a filessegment to a virtualmemory segment according to the information provided in the programheader table. The OS can also use segments to create a shared

memory resource. At link time, the program or library is built by merging together sections

with similar attributes into segments. Typically, all the executable and read-only data sections are combined

into a single text segment, while the data and BSS are combined intothe data segment.


34/62

These segments are normally called load segments, because they needto be loaded in memory at process creation. Other sections such assymbol information and debugging sections are merged into other, non-load segments.

W.7 PROCESS LOADING

In Linux processes loaded from a file system (using eitherthe execve()or spawn()system calls) are in ELF format.

If the file system is on a block-oriented device, the code and data areloaded into main memory.

If the file system is memory mapped (e.g. ROM/Flash image), the codeneedntbe loaded into RAM, but may be executed in place.

This approach makes all RAM available for data and stack, leaving thecode in ROM or Flash. In all cases, if the same process is loaded morethan once, its code will be shared.

Before we can run an executable, firstly we have to load it into memory. This is done by the loader, which is generally part of the operating

system. The loader does the following things (from other things):1. Memory and access validation Firstly, the OS system kernel

reads in the program filesheader information and does thevalidation for type, access permissions, memory requirement andits ability to run its instructions. It confirms that file is anexecutable image and calculates memory requirements.

2. Process setup includes:1. Allocates primary memory for the programsexecution.

2. Copies address space from secondary to primary memory.3. Copies the .text and .data sections from the executable intoprimary memory.

4. Copies program arguments (e.g., command line arguments)onto the stack.

5. Initializes registers: sets the esp (stack pointer) to point totop of stack, clears the rest.

6. Jumps to start routine, which: copies main()sarguments offof the stack, and jumps to main().

Address space is memory space that contains program code, stack, and

data segments or in other word, all data the program uses as it runs. The memory layout, consists of three segments (text, data, and stack), in

simplified form is shown in Figure w.5. The dynamic data segment is also referred to as the heap, the place

dynamically allocated memory (such as from malloc()and new) comesfrom. Dynamically allocated memory is memory allocated at run timeinstead of compile/link time.


35/62

This organization enables any division of the dynamically allocatedmemory between the heap (explicitly) and the stack (implicitly). Thisexplains why the stack grows downward and heap grows upward.

Figure w.4: Process memory layoutW.8 RUNTIME DATA STRUCTUREFrom Sections to Segments

A process is a running program. This means that the operating systemhas loaded the executable file for the program into memory, hasarranged it to have access to its command-line arguments andenvironment variables, and has started it running.

Typically a process has 5 different areas of memory allocatedto it as listed inTable w.5 (refer to Figure w.4):

Segment Description

Codetextsegment

Often referred to as the text segment, this isthe area in which the executable instructionsreside. For example, Linux/Unix arranges

things so that multiple running instances ofthe same program share their code ifpossible. Only one copy of the instructionsfor the same program resides in memory atany time. The portion of the executable filecontaining the text segment is the text section.

Initialized datadatasegment

Statically allocated and global data thatareinitialized with nonzero valueslive in the datasegment. Each process running the sameprogram has its own data segment. The

portion of the executable file containing thedata segment is the data section.

Uninitialized databsssegment

BSSstands for Block Started bySymbol. Global and statically allocated datathat initialized to zero by defaultare kept in whatis called the BSS area of the process. Eachprocess running the same program has its


36/62

own BSS area. When running, the BSS dataare placed in the data segment. In theexecutable file, they are stored in the BSSsection. For Linux/Unix the format of anexecutable, only variables that are initialized

to a nonzero value occupy space in theexecutablesdisk file.

Heap

The heap is where dynamic memory(obtained bymalloc(), calloc(), realloc()and newforC++) comes from. Everything on a heap isanonymous, thus you can only access parts of itthrough a pointer. As memory is allocated on theheap, the processsaddress spacegrows. Although it is possible to give memoryback to the system and shrink a processsaddress

space, this is almost never done because it will beallocated to other process again. Freed memory

(free()and delete) goes back to the heap, creatingwhat is called holes. It is typical for the heapto grow upward. This means that successiveitems that are added to the heap are added ataddresses that are numerically greater thanprevious items. It is also typical for the heap tostart immediately after the BSS area of the datasegment. The end of the heap is marked by apointer known as the break. You cannot reference

past the break. You can, however, move the breakpointer (viabrk()and sbrk() system calls) to anew position to increase the amount of heapmemory available.

Stack

The stack segment is where local (automatic)variables are allocated. In C program, localvariables are all variables declared inside theopening left curly brace of a function bodyincluding the main()or other left curly brace thatarentdefined as static. The data is popped up or

pushed into the stack following the Last In FirstOut(LIFO) rule. The stack holds local variables,temporary information, function parameters, returnaddress and the like. When a function is called,a stack frame(or a procedure activation record) is

created andPUSHed onto the top of the stack.This stack frame contains information such as theaddress from which the function was called and


37/62

where to jump back to when the function isfinished (return address), parameters, localvariables, and any other information needed bythe invoked function. The order of the informationmay vary by system and compiler. When a

function returns, the stack frame is POPped fromthe stack. Typically the stack grows downward,meaning that items deeper in the call chainare at numerically lower addresses andtoward the heap.

Table w.5 When a program is running, the initialized data, BSS and heap areas

are usually placed into a single contiguous area called a data segment. The stack segment and code segment are separate from the data

segment and from each other as illustrated in Figure w.4.

Although it is theoretically possible for the stack and heap to grow intoeach other, the operating system prevents that event.

The relationship among the different sections/segments is summarizedin Table w.6, executable program segments and their locations.

Executable file section

(disk file) Address space segment Program memory segment.text Text Code.data Data Initialized data.bss Data BSS- Data Heap

- Stack StackTable w.6

W.9 THE PROCESS (IMAGE)

The diagram below shows the memory layout of a typical Csprocess.The process load segments (corresponding to textand datain thediagram) at the processsbase address.

The main stack is located just below and grows downwards. Anyadditional threads or function calls that are created will have their ownstacks, located below the main stack.

Each of the stack frames is separated by a guard page to detect stack

overflows among stacks frame. The heap is located above the processand grows upwards.

In the middle of the processsaddress space, there is a region isreserved for shared objects. When a new process is created, theprocess manager first maps the two segments from the executable intomemory.


38/62

It then decodes the programsELF header. If the program headerindicates that the executable was linked against a shared library, theprocess manager will extract the name of the dynamic interpreter fromthe program header.

The dynamic interpreter points to a shared library that contains the

runtime linker code. The process manager will load this shared library inmemory and will then pass control to the runtime linker code in thislibrary.

Figure w.5: Csprocess memory layout on an x86.W.10 RUNTIME LINKER AND SHARED LIBRARY LOADING

The runtime linker is invoked when a program that was linked against ashared object is started or when a program requests that a sharedobject be dynamically loaded.

So the resolution of the symbols can be done at one of the followingtime:

1. Load-time dynamic linkingthe application program is read from thedisk (disk file) into memory and unresolved references arelocated. The load time loader finds all necessary externalsymbols and alters all references to each symbol (all previously


39/62

zeroed) to memory references relative to the beginning of theprogram.

2. Run-time dynamic linkingthe application program is read from disk(disk file) into memory and unresolved references are left asinvalid (typically zero). The first access of an invalid, unresolved,

reference results in a software trap. The run-time dynamic linkerdetermines why this trap occurred and seeks the necessaryexternal symbol. Only this symbol is loaded into memory andlinked into the calling program.

The runtime linker is contained within the C runtime library. The runtimelinker performs several tasks when loading a shared library (.so file).

The dynamic section provides information to the linker about otherlibraries that this library was linked against.

It also gives information about the relocations that need to be appliedand the external symbols that need to be resolved. The runtime linkerwill first load any other required shared libraries (which may themselvesreference other shared libraries).

It will then process the relocations for each library. Some of theserelocations are local to the library, while others require the runtime linkerto resolve a global symbol.

In the latter case, the runtime linker will search through the list oflibraries for this symbol. In ELF files, hash tables are used for thesymbol lookup, so theyrevery fast.

Once all relocations have been applied, any initialization functions that

have been registered in the shared librarysinit section are called. Thisis used in some implementations of C++ to call global constructors.W.11 SYMBOL NAME RESOLUTION

When the runtime linker loads a shared library, the symbols within thatlibrary have to be resolved. Here, the order and the scope of thesymbol resolution are important.

If a shared library calls a function that happens to exist by the samename in several libraries that the program has loaded, the order inwhich these libraries are searched for this symbol is critical. This is whythe OS defines several options that can be used when loading libraries.

All the objects (executables and libraries) that have global scope are

stored on an internal list (the global list). Any global-scope object, by default, makes available all of its symbols to

any shared library that gets loaded. The global list initially contains the executable and any libraries that are

loaded at the programsstartup.W.12 DYNAMIC ADDRESS TRANSLATION


40/62

In the view of the memory management, modern OS with multitasking,normally implement dynamic relocation instead of static.

All the program layout in the address space is virtually same. Thisdynamic relocation (in processor term it is called dynamic addresstranslation) provides the illusion that:

1. Each process can use addresses starting at 0, even if otherprocesses are running, or even if the same program is runningmore than one time.

2. Address spaces are protected.3. Can fool process further into thinking it has memory thatsmuch

larger than available physical memory (virtual memory). In dynamic relocation the address changed dynamically during every

reference. Virtual addressis generated by a process (also called logicaladdress) and the physical addressis the actual address in physical memoryat the run-time.

The address translation normally done by Memory Management Unit(MMU)that incorporated in the processor itself.

Virtual addresses are relative to the process. Each process believesthat its virtual addresses start from 0. The process does not even knowwhere it is located in physical memory; the code executes entirely interms of virtual addresses.

MMU can refuse to translate virtual addresses that are outside therange of memory for the process for example by generating thesegmentation faults. This provides the protection for each process.

During translation, one can even move parts of the address space of aprocess between disk and memory as needed (normally calledswapping or paging).

This allows the virtual address space of the process to be much largerthan the physical memory available to it.

Graphically, this dynamic relocation for a process is shown in Figure w.6


41/62

Figure w.6: Physical and virtual address: Address translation

Share this:

Twitter

Facebook

Like this:

By sudhakarmaradana2
http://automotivetechis.wordpress.com/2012/06/07/memory-map-in-c/?share=twitter&nb=1http://automotivetechis.wordpress.com/2012/06/07/memory-map-in-c/?share=twitter&nb=1http://automotivetechis.wordpress.com/2012/06/07/memory-map-in-c/?share=facebook&nb=1http://automotivetechis.wordpress.com/2012/06/07/memory-map-in-c/?share=facebook&nb=1http://automotivetechis.wordpress.com/2012/06/07/memory-map-in-c/#commentshttp://automotivetechis.wordpress.com/2012/06/07/memory-map-in-c/#commentshttp://automotivetechis.files.wordpress.com/2012/06/ccompilerlinker007.pnghttp://automotivetechis.wordpress.com/2012/06/07/memory-map-in-c/#commentshttp://automotivetechis.wordpress.com/2012/06/07/memory-map-in-c/?share=facebook&nb=1http://automotivetechis.wordpress.com/2012/06/07/memory-map-in-c/?share=twitter&nb=1


42/62

JUN 62012

KWP2000 and UDS DifferenceWhat are the difference between KWP2000 & UDS?1. Event triggering and periodic transmission are applicable only in UDS.

2. Positive response supression for tester present is not present in KWP2000.

3. Transfer of measurement values, only two-byte identifers are available in UDS. In KWP2000 one byterecordLocal Identifer and Two Byte Common Identifer4. Error memory management.

Differences between KWP 2000 and UDSThe classic diagnostic communication with KWP protocols has favored a symmetrical number of requests andresponses. In contrast, UDS provides event-driven and periodic services, for which the number of requests andresponses can differ greatly. The KWP 2000 principles to transfer measurement values and to manage the ECUserror memory were re-engineered for the UDS standard.

Transfer of measurement valuesFor the transfer of measurement values, only the two-byte dataIdentifiers are available with UDS. KWP 2000

specifies a one-byte recordLocalIdentifier and two-byte commonIdentifier.To increase data transmission efficiency, several measurement values can be requested with one UDS servicerequest, and there are two different response types. The specified data identifiers are more comprehensive (see ISO14229-1 annex C.1). Examples include:

$F100 $F19F: for example, KWP 2000 identifier, calibration data, and ODX file identifier$F2xx: Periodic data identifier

$F3xx: Dynamically defined data identifier$F4xx $F8xx: OBD according to ISO 15031-5Wh