Service Interaction Protocol
Write Data By Identifier
High Risk: Writing incorrect configuration or calibration data can lead to permanent ECU malfunction (“bricking”).
SID 0x2E Quick Reference
17 ready-to-send commands across 4 categories. Click any byte string to copy.
Showing all 17 commands
Length must be exactly 17 bytes — fewer returns NRC 0x13.
Many ECUs treat serial as OTP — only one successful write per lifetime.
Useful during tuning — try values without committing to EEPROM.
May trigger 100–500 ms EEPROM commit. Send 0x3E during the wait.
Most ECUs require reset (0x11 0x01) afterward to apply new config.
Always pair every 0x2E with a 0x22 read-back. Trust nothing until confirmed.
A write that succeeds but doesn't survive reset means the EEPROM commit failed silently.
Conditional write pattern. EEPROM cells have finite write endurance (~100k cycles).
Response carries P2 / P2* timing — note for keepalive cadence.
PROGRAMMING is more permissive but more dangerous. Tool must keep voltage stable.
Pair with 27 02 [key]. Unlock survives until session change or re-lock.
Wrong key 3× often triggers a multi-minute delay timer — implement carefully.
EEPROM commits can take 500 ms — without 0x3E the session may time out mid-commit.
Response byte 4 = session ID: 0x01 DEFAULT, 0x02 PROGRAMMING, 0x03 EXTENDED.
Always re-read DIDs after reset to confirm persistence.
Common cause: session changed silently. Re-check session before re-unlocking.
Always end a write session explicitly. Don't rely on S3 timeout.
Write Best Practices
Overview
“The WriteDataByIdentifier service is used by the client to write a data record value to a server, specified by a data identifier.”
How UDS Write operations move data from the Tester into Permanent ECU Storage.
Service Dependencies
SID 0x2E sits in a small graph of co-dependent services. Click any orbital node to see what it does, the hex you’d send, and how it shapes a 0x2E flow.
Dependency Graph
Click any node to see the relationship, hex example, and where it fits in a 0x2E flow.
0x2EWriteDataByIdentifier
The service this page documents
Writes data to a specific DID. Positive response (0x6E) means "request accepted" — not "value persisted." Always pair with 0x22 to verify.
2E F1 90 …Write VIN (0xF190) with 17-byte ASCII payload
Interactions & Prerequisites
Required State
Critical Best Practices
- ✓ Always follow Write (0x2E) with Read (0x22) to verify
- ✓ Send TesterPresent (0x3E) every 2-3s for long operations
- ✓ Wait 100-500ms for EEPROM writes to complete
- ✓ Reset ECU after critical writes to persist changes
Write Permission Levels
Level 1: Public Write (Rare)
Session: EXTENDED | Security: NOT required | Risk: Low
Example: Diagnostic test counters, temporary flags
Level 2: Standard Security (Common)
Session: EXTENDED | Security: Level 1 | Risk: Medium
Example: Calibration parameters, network configuration
Level 3: High Security (Typical)
Session: EXTENDED or PROGRAMMING | Security: High Level | Risk: High
Example: VIN, serial numbers, critical parameters
Level 4: OTP (One-Time Programmable)
Session: PROGRAMMING | Security: Manufacturer key | Risk: Critical
Example: ECU serial number (write once only in lifetime)
Memory Write Types
Three storage classes, three very different timing profiles. The ECU’s response latency tells you nothing about whether the value persisted — only the storage class does.
Memory Write Timing
Pick a storage class to see the request-to-persistence timeline. Hover any phase for detail.
Timeline
~800 ms totalConfiguration and identity data (VIN, serial, calibration) that must survive ignition cycles.
- Wait the commit window before issuing read-back — early reads may return stale RAM mirror.
- Voltage must stay ≥11 V during commit. Sags cause NRC 0x72 generalProgrammingFailure.
- EEPROM cells have finite endurance (~100k cycles). Use conditional writes to extend life.
Writable DIDs
Writable DID Explorer
14 DIDs across 5 categories. Click any row to see length, session, security, storage class, and example bytes.
| DID | Name | Write |
|---|---|---|
| 0xF190 | VIN | Read / Write |
| 0xF18C | ECU Serial Number | One-time programmable |
| 0xF18A | Mfg Date | One-time programmable |
| 0xF110 | ECU Hardware Serial | One-time programmable |
| 0xFD00 | Calibration (RAM) | Read / Write |
| 0xFD01 | Calibration (EEPROM) | Read / Write |
| 0x0100 | Calibration Bank A | Read / Write |
| 0xF010 | Network Config | Read / Write |
| 0xF015 | Subnet Address | Read / Write |
| 0xF187 | ECU Part Number | Read-only |
| 0xF188 | Hardware Version | Read-only |
| 0xF195 | Software Version | Read-only |
| 0x0105 | Test Counter | Read / Write |
| 0x0200 | Diagnostic Flag | Read / Write |
14 of 14 DIDs shown. Click any row for the full spec + example hex.
Message Format
Tap any byte to see what it means, the valid value range, and the ISO 14229 clause that defines it. Switch presets to compare write requests, positive responses, and NRC shapes.
Reads as: SID 0x2E · DID 0xF190 (VIN) · 17 bytes "WBA1G001234567" (ASCII).
SID 0x2E vs SID 0x22 Comparison
Aspect | SID 0x22 (Read) | SID 0x2E (Write) |
|---|---|---|
| Operation | Read data from ECU | Write data to ECU |
| Session | DEFAULT (most) | EXTENDED/PROGRAMMING |
| Security | Rarely required | Usually required |
| Multiple DIDs | ✅ Supported | ❌ One DID only |
| Request SID | 0x22 | 0x2E |
| Response SID | 0x62 | 0x6E |
| Risk Level | Low (read-only) | High (modifies ECU) |
Session & Security Requirements
SID 0x2E has two independent prerequisites: an active diagnostic session AND, for most DIDs, a successful security unlock. The matrix below combines both. Click any cell to see the exact request, response, and NRC code; toggle security to watch protected and OTP cells flip.
Security state
Toggle the unlock state to watch protected and OTP cells flip between 🔒 and ✅.
| Session ↓ / DID class → | Public DIDs (rare) Diagnostic counters and temporary flags — no auth required | Protected (common) Calibration, network config, vehicle identifiers — Level 1 unlock | OTP / High security One-time programmable or manufacturer-locked — PROGRAMMING + high level |
|---|---|---|---|
0x01 DEFAULT Default Session | |||
0x03 EXTENDED Extended Session | |||
0x02 PROG Programming Session | |||
0x04 SAFETY Safety System |
Click any cell to see the exact request, response, and NRC code.
TX/RX Examples
Want to see these in motion? The Multi-Service Workflows section below plays through Write+Verify, Security Denied + Recovery, Batch Writes + Keepalive, and the NRC 0x72 voltage-failure scenario step-by-step on a ladder diagram.
Request Processing Pipeline
Nine steps inside the ECU between byte 0 of the request and the positive response. Each gate has a specific NRC if it fails — click any step to see which.
ECU Request Processing Pipeline
Nine steps from byte 0 to positive response. Each gate has a specific NRC if validation fails — click a step to see which.
Parse DID
Extract the 2-byte DID from request bytes [1:2]. Big-endian — high byte first.
Pure extraction — no failure mode at this step.
Bytes 1-2 → 0xF190Multi-Service Workflows
Four end-to-end scenarios played as a ladder diagram. Tester messages on the left, ECU on the right; verify steps are the cyan rows, system events are amber. Use the speed control to step through slowly or review at 2×.
UML Sequence Diagrams
Configuration Write & Verification
10 stepsISO 14229-1 Compliance
ISO 14229-1:2020 — Road vehicles — Unified diagnostic services (UDS) — Part 1: Application layer
Section 11.5: WriteDataByIdentifier (0x2E) — Mandatory requirements for all UDS-compliant ECUs
Mandatory Requirements
- ✓ Support at least one writable DID
- ✓ Validate message length matches DID specification
- ✓ Enforce session requirements (not in DEFAULT)
- ✓ Enforce security requirements for protected DIDs
- ✓ Return correct NRCs (0x13, 0x22, 0x31, 0x33, 0x72, 0x7F)
- ✓ Echo DID in positive response (0x6E)
- ✓ Do NOT include data record in response
Manufacturer-Specific (Optional)
- ○ Number and types of writable DIDs
- ○ DID-specific data validation rules
- ○ Write operation timing (immediate vs deferred)
- ○ Persistent storage mechanism (EEPROM, Flash)
- ○ Write verification procedures and retry logic
Negative Response Codes (NRCs)
EXCEPTION_MATRIX_V3
Data payload size does not match target DID definition. Example: VIN expects 17 bytes, but only 10 bytes sent.
This negative response indicates a failure in processing the WriteDataByIdentifier request. Ensure all pre-conditions and active sessions match the requirements defined by ISO 14229.
Troubleshooting Common Issues
Symptom Decision Tree
Two or three questions narrow you to a concrete fix. The full NRC reference is in the appendix below.
What's the symptom?
Reference appendix
Complete NRC-by-NRC catalogue. Use the decision tree above for guided diagnosis; come here for lookup.