Appendix 7 DATA DOWNLOADING PROTOCOLSF1F2

This appendix specifies the procedures to follow in order to perform the different types of data download to an external storage medium, together with the protocols that must be implemented to assure the correct data transfer and the full compatibility of the downloaded data format to allow any controller to inspect these data and be able to control their authenticity and their integrity before analysing them.

Data may be downloaded to an ESM:

• from a vehicle unit by an intelligent dedicated equipment (IDE) connected to the VU,

• from a tachograph card by an IDE fitted with a card interface device (IFD),

• from a tachograph card via a vehicle unit by an IDE connected to the VU.

To give the possibility to verify the authenticity and integrity of downloaded data stored on an ESM, data is downloaded with a signature appended in accordance with Appendix 11 Common Security Mechanisms. The source equipment (VU or card) identification and its security certificates (Member State and equipment) are also downloaded. The verifier of the data must possess independently a trusted European public key.

DDP_001 Data downloaded during one download session must be stored in the ESM within one file.

The following acronyms are used in this appendix:

In order to carry on a VU data download, the operator must perform the following operations:

• insert his tachograph card inside a card slot of the VU ^f1 ,

• connect the IDE to the VU download connector,

• establish the connection between the IDE and the VU,

• select on the IDE the data to download and send the request to the VU,

• close the download session.

The protocol is structured on a master-slave basis, with the IDE playing the master role and the VU playing the slave role.

The message structure, types and flow are principally based on the Keyword Protocol 2000 (KWP) (ISO 14230-2 Road vehicles — Diagnostic systems — Keyword protocol 2000 — Part 2: Data link layer).

The application layer is principally based on the current draft to date of ISO 14229-1 (Road vehicles — Diagnostic systems — Part 1: Diagnostic services, version 6 of 22 February 2001 ).

DDP_002 All the messages exchanged between the IDE and the VU are formatted with a structure consisting of three parts:

• header composed by a format byte (FMT), a target byte (TGT), a source byte (SRC) and possibly a length byte (LEN),

• data field composed by a service identifier byte (SID) and a variable number of data bytes, which can include an optional diagnostic session byte (DS_) or an optional transfer parameter byte (TRTP or TREP).

• checksum composed by a checksum byte (CS).

The TGT and SRC byte represent the physical address of the recipient and originator of the message. Values are F0 Hex for the IDE and EE Hex for the VU.

The LEN byte is the length of the data field part.

The checksum byte is the 8 bit sum series modulo 256 of all the bytes of the message excluding the CS itself.

FMT, SID, DS_, TRTP and TREP bytes are defined later in this document.

DDP_003 In the case where the data to be carried by the message is longer than the space available in the data field part, the message is actually sent in several submessages. Each submessage bears a header, the same SID, TREP and a 2-byte submessage counter indicating the submessage number within the total message. To enable error checking and abort the IDE acknowledges every submessage. The IDE can accept the submessage, ask for it to be re-transmitted, request the VU to start again or abort the transmission.

DDP_004 If the last submessage contains exactly 255 bytes in the data field, a final submessage with an empty (except SID TREP and submessage counter) data field must be appended to show the end of the message.

Example:

Will be transmitted as:

…

or as:

…

The communication protocol for data download between the VU and the IDE requires the exchange of eight different message types.

The following table summarises these messages.

DDP_005 This message is issued by the IDE to establish the communication link with the VU. Initial communications are always performed at 9 600 baud (until baud rate is eventually changed using the appropriate Link control services).

DDP_006 This message is issued by the VU to answer positively to a start communication request. It includes the 2 key bytes ′EA′ ′8F′ indicating that the unit supports protocol with header including target source and length information.

DDP_007 The start diagnostic session request message is issued by the IDE in order to request a new diagnostic session with the VU. The sub function ’ default session ’ (81 Hex) indicates a standard diagnostic session is to be opened.

DDP_008 The positive response start diagnostic message is sent by the VU to answer positively to Diagnostic Session Request.

DDP_052 The link control service is used by the IDE to initiate a change in baud rate. This takes place in two steps. In step one the IDE proposes the baud rate change, indicating the new rate. On receipt of a positive message from the VU the IDE sends out confirmation of the baud rate change to the VU (step two). The IDE then changes to the new baud rate. After receipt of the confirmation the VU changes to the new baud rate

DDP_053 The link control positive response is issued by the VU to answer positively to Link Control Service request (step one). Note that no response is given to the confirmation request (step two).

DDP_009 The request upload message is issued by the IDE to specify to the VU that a download operation is requested. To meet the requirements of ISO14229 data is included covering address, the size and format details for the data requested. As these are not known to the IDE prior to a download, the memory address is set to 0, format is unencrypted and uncompressed and the memory size is set to the maximum.

DDP_010 The positive response request upload message is sent by the VU to indicate to the IDE that the VU is ready to download data. To meet the requirements of ISO 14229 data is included in this positive response message, indicating to the IDE that further positive response transfer data messages will include 00FF hex bytes maximum.

DDP_011 The transfer data request is sent by the IDE to specify to the VU the type of data that are to be downloaded. A one byte transfer request parameter (TRTP) indicates the type of transfer.

There are six types of data transfer:

• overview (TRTP 01),

• activities of a specified date (TRTP 02),

• events and faults (TRTP 03),

• detailed speed (TRTP 04),

• technical data (TRTP 05),

• card download (TRTP 06).

DDP_054 It is mandatory for the IDE to request the overview data transfer (TRTP 01) during a download session as this only will ensure that the VU certificates are recorded within the downloaded file (and allow for verification of digital signature).

In the second case (TRTP 02) the transfer data request message includes the indication of the calendar day TimeReal format) to be downloaded.

DDP_012 The positive response transfer data is sent by the VU in response to the transfer data request. The message contains the requested data, with a transfer response parameter (TREP) corresponding to the TRTP of the request.

DDP_055 In the first case (TREP 01), the VU will send data helping the IDE operator to choose the data he wants to download further. The information contained within this message is:

• security certificates,

• vehicle identification,

• VU current date and time,

• minimum and maximum downloadable date (VU data),

• indication of cards presence in the VU,

• previous download to a company,

• company locks,

• previous controls.

DDP_013 The request transfer exit message is sent by the IDE to inform the VU that the download session is terminated.

DDP_014 The positive response request transfer exit message is sent by the VU to acknowledge the Request Transfer Exit.

DDP_015 The stop communication request message is sent by the IDE to disconnect the communication link with the VU.

DDP_016 The positive response stop communication message is sent by the VU to acknowledge the stop communication request.

DDP_017 The acknowledge sub message is sent by the IDE to confirm receipt of each part of a message that is being transmitted as several submessages. The data field contains the SID received from the VU and a 2-byte code as follows:

• MsgC +1 Acknowledges correct receipt of submessage number MsgC.

  Request from the IDE to the VU to send next submessage,

• MsgC indicates a problem with the receipt of submessage number MsgC.

  Request from the IDE to the VU to send the submessage again,

• FFFF requests termination of the message.

  This can be used by the IDE to end the transmission of the VU message for any reason.

The last submessage of a message (LEN byte < 255) may be acknowledged using any of these codes or not acknowledged.

The VU responses that will consist of several sub messages are:

• positive response transfer Data (SID 76)

DDP_018 The negative response message is sent by the VU in response to the above request messages when the VU cannot satisfy the request. The data fields of the message contains the SID of the response (7F), the SID of the request, and a code specifying the reason of the negative response. The following codes are available:

• 10 general reject

  The action cannot be performed for a reason not covered below

• 11 service not supported

  The SID of the request is not understood

• 12 sub function not supported

  The DS_ or TRTP of the request is not understood, or there are no further sub messages to be transmitted

• 13 incorrect message length

  The length of the received message is wrong

• 22 conditions not correct or request sequence error

  The required service is not active or the sequence of request messages is not correct

• 31 request out of range

  The request parameter record (data field) is not valid

• 50 upload not accepted

  The request cannot be performed (VU in a non appropriate mode of operation or internal fault of the VU)

• 78 response pending

  The action requested cannot be completed in time and the VU is not ready to accept another request

• FA data not available

  The data object of a data transfer request are not available in the VU (e.g. no card is inserted, …)

A typical message flow during a normal data download procedure is the following:

DDP_019 During normal operation the timing parameters shown in the following figure are relevant:

Where:

The allowed values for the timing parameters are showed in the following table (KWP extended timing parameters set, used in case of physical addressing for faster communication).

If an error occurs during the message exchange, the message flow scheme is modified depending on which equipment has detected the error and on the message generating the error.

In Figure 2 and Figure 3 the error handling procedures for the VU and the IDE are respectively shown.

DDP_020 If the IDE detects an error during the Start Communication phase, either by timing or by the bit stream, then it will wait for a period P3 min before issuing again the request.

DDP_021 If the VU detects an error in the sequence coming from the IDE, it shall send no response and wait for another Start Communication Request message within a period P3 max.

Two different error handling areas can be defined:

1. 1..

   The VU detects an IDE transmission error.

   DDP_022 For every received message the VU shall detect timing errors, byte format errors (e.g. start and stop bit violations) and frame errors (wrong number of bytes received, wrong checksum byte).

   DDP_023 If the VU detects one of the above errors, then it sends no response and ignores the message received.

   DDP_024 The VU may detect other errors in the format or content of the received message (e.g. message not supported) even if the message satisfies the length and checksum requirements; in such a case, the VU shall respond to the IDE with a Negative Response message specifying the nature of the error.

   

2. 2..

   The IDE detects a VU transmission error.

   DDP_025 For every received message the IDE shall detect timing errors, byte format errors (e.g. start and stop bit violations) and frame errors (wrong number of bytes received, wrong checksum byte).

   DDP_026 The IDE shall detect sequence errors, e.g. incorrect sub message counter increments in successive received messages.

   DDP_027 If the IDE detects an error or there was no response from the VU within a P2max period, the request message will be sent again for a maximum of three transmissions in total. For the purposes of this error detection a submessage acknowledge will be considered as a request to the VU.

   DDP_028 The IDE shall wait at least for a period of P3min before beginning each transmission; the wait period shall be measured from the last calculated occurrence of a stop bit after the error was detected.

   

This paragraph specifies the content of the data fields of the various positive response messages.

Data elements are defined in Appendix 1 data dictionary.

DDP_029 The data field of the ‘ positive response transfer data overview ’ message shall provide the following data in the following order under the SID 76 Hex, the TREP 01 Hex and appropriate sub message splitting and counting:

DDP_030 The data field of the ‘ positive response transfer data activities ’ message shall provide the following data in the following order under the SID 76 Hex, the TREP 02 Hex and appropriate sub message splitting and counting:

DDP_031 The data field of the ‘ positive response transfer data events and faults ’ message shall provide the following data in the following order under the SID 76 Hex, the TREP 03 Hex and appropriate sub message splitting and counting:

DDP_032 The data field of the ‘ positive response transfer data detailed speed ’ message shall provide the following data in the following order under the SID 76 Hex, the TREP 04 Hex and appropriate sub message splitting and countering:

DDP_033 The data field of the ‘ positive response transfer data technical data ’ message shall provide the following data in the following order under the SID 76 Hex, the TREP 05 Hex and appropriate sub message splitting and counting:

DDP_034 When a download session has included a VU data transfer, the IDE shall store within one physical file all data received from the VU during the download session within positive response transfer data messages. Data stored excludes message headers, sub-message counters, empty sub-messages and checksums but include the SID and TREP (of the first sub-message only if several sub-messages).

This paragraph describes the direct card data downloading of a tachograph card to an IDE. The IDE is not part of the secure environment; therefore no authentication between the card and the IDE is performed.

DDP_035 The download of a tachograph card includes the following steps:

• download the common information of the card in the EFs ICC and IC . This information is optional and is not secured with a digital signature,

• Download the EFs Card_Certificate and CA_Certificate. This information is not secured with a digital signature,

  It is mandatory to download these files for each download session.

• download the other application data EFs (within Tachograph DF) except EF Card_Download. This information is secured with a digital signature,

  • it is mandatory to download at least the EFs Application_Identification and ID for each download session,

  • when downloading a driver card it is also mandatory to download the following EFs:

    • Events_Data,

    • Faults_Data,

    • Driver_Activity_Data,

    • Vehicles_Used,

    • Places,

    • Control_Activity_Data,

    • Specific_Conditions.

• When downloading a driver card, update the LastCardDownload date in EF Card_Download,

• When downloading a workshop card, reset the calibration counter in EF Card_Download.

DDP_036 The IDE shall initiate the sequence as follows:

It is optional to use PPS to switch to a higher baudrate as long as the ICC supports it.

DDP_037 The sequence to download the ICC , IC , Card_Certificate and CA_Certificate is as follows:

DDP_038 The following sequence shall be used for each of the following files that has to be downloaded with their signature:

DDP_039 The sequence to reset the NoOfCalibrationsSinceDownload counter in the EF Card_Download in a workshop card is the following:

DDP_040 The downloaded data has to be stored according to the following conditions:

• the data shall be stored transparent. This means that the order of the bytes as well as the order of the bits inside the byte that are transferred from the card has to be preserved during storage,

• all files of the card downloaded within a download session are stored in one file on the ESM.

DDP_041 The file format is a concatenation of several TLV objects.

DDP_042 The tag for an EF shall be the FID plus the appendix ‘ 00 ’ .

DDP_043 The tag of an EF's signature shall be the FID of the file plus the appendix ‘ 01 ’ .

DDP_044 The length is a two byte value. The value defines the number of bytes in the value field. The value ‘ FF FF ’ in the length field is reserved for future use.

DDP_045 When a file is not downloaded nothing related to the file shall be stored (no tag and no zero length).

DDP_046 A signature shall be stored as the next TLV object directly after the TLV object that contains the data of the file.

Example of data in a download file on an ESM:

DDP_047 The VU must allow for downloading the content of a driver card inserted to a connected IDE.

DDP_048 The IDE shall send a ‘ transfer data request card download ’ message to the VU to initiate this mode (see 2.2.2.9).

DDP_049 The VU shall then download the whole card, file by file, in accordance with the card downloading protocol defined in paragraph 3, and forward all data received from the card to the IDE within the appropriate TLV file format (see 3.4.2) and encapsulated within a ‘ positive response transfer data ’ message.

DDP_050 The IDE shall retrieve card data from the ‘ positive response transfer data ’ message (stripping all headers, SIDs, TREPs, submessage counters, and checksums) and store them within one physical file as described in paragraph 2.3.

DDP_051 The VU shall then, as applicable, update the Control_Activity_Data or the Card_Download file of the driver card.