Service Interaction Protocol
Request Download
High Risk: RequestDownload opens a flash-programming transfer. Writing a bad image, or to the wrong region, can render the ECU unbootable. It is gated behind PROGRAMMING session + security for exactly this reason.
RequestDownload
Transfer sequence
Request
Positive Response
- Service ID
- 0x34
- Positive Response
- 0x74
- Required session
- PROGRAMMING (0x02)
- Security
- Must be unlocked (0x27)
- Min request length
- 5 bytes (SID + DFI + ALFID + addr + size)
- Data format (this sim)
- DFI 0x00 only — no compression/encryption
- ISO ref
- ISO 14229-1:2020 §14.2
Overview
“The RequestDownload service is used by the client to initiate a data transfer from the client to the server (ECU).”
Never a single operation. RequestDownload is the gate of a three-part chain: 0x34 RequestDownload → 0x36 TransferData (repeated) → 0x37 RequestTransferExit. The 0x74 response tells you the largest block the ECU will accept.
Download Sequence
Step through the full flash flow — session, security, erase, download, transfer, exit, reset — and see each request and response. Try the error scenarios too.
Download Sequence Runner
Step through the full flash flow and watch the bytes on the wire.
Enter PROGRAMMING, unlock, erase, request download, send blocks, exit, reset.
Press Play or Step to begin the sequence.
Build a Request
Set the data-format and address/length nibbles, the address and size, and the ECU state. The builder assembles the exact request bytes and shows the simulator’s response — a 0x74 acceptance or the precise NRC.
Request Builder
Set the DFI, ALFID, address, size, and ECU state — see the assembled request and the simulator’s exact response.
ECU state
dataFormatIdentifier = 0x00
Simulator supports 0/0 only; anything else → NRC 0x31.
addressAndLengthFormatId = 0x44
Assembled request (11 bytes)
Accepted. Target: Application. Response carries maxNumberOfBlockLength = 0x1000.
ECU response
Message Format
Inspect each byte of the request, the 0x74 response, and a negative response.
Message Frame Breakdown
Pick a frame, then focus a byte (click or Tab) to see its role.
RequestDownload service identifier.
Compression & encryption: the dataFormatIdentifier can encode compression (high nibble) and encryption (low nibble), but this simulator supports 0x00 only — any non-zero nibble returns NRC 0x31. Real ECUs may support specific methods defined by the manufacturer.
Memory Map & Validation
Memory Map
RequestDownload only accepts addresses inside a writable region. Anything else returns NRC 0x31. (Regions are ECU-configured; these are illustrative.)
Gaps between regions are unmapped — targeting them returns NRC 0x31 (no region found).
- Start
- 0x00100000
- End
- 0x00200000
- Size
- 1 MB
- 0x34 here
- 74 (accepted)
Main application image. Writable — the normal flash target.
Block Transfer Math
Block Transfer Calculator
From the maxNumberOfBlockLength in the 0x74 response, work out how many 0x36 TransferData blocks the download takes.
Why minus 2? maxNumberOfBlockLength counts the whole 0x36 request — the service ID and the 1-byte block-sequence-counter — so usable payload per block is maxBlock − 2. The block-sequence-counter starts at 0x01 and wraps 0xFF → 0x00. The 0x74 length-format-identifier for this maxBlock is 0x20 (value 0x200).
Service Dependencies
Service Dependencies
0x34 is the gate of the flash sequence. Select a node to see how it relates.
Must be in PROGRAMMING (0x02) before 0x34 — otherwise NRC 0x70.
Session & Security
Requirement | Value | If not met |
|---|---|---|
| Session | PROGRAMMING (0x02) | NRC 0x70 (uploadDownloadNotAccepted) |
| Security | Unlocked via SID 0x27 | NRC 0x33 (securityAccessDenied) |
| Transfer state | No active download/upload | NRC 0x22 (conditionsNotCorrect) |
Keep the session alive: send TesterPresent (3E 80) every 2–3 seconds during the transfer. If the S3 timer (≈5s) expires, the ECU drops to DEFAULT and the download state is lost.
Flash Programming Sequence
Programming → Unlock → Download → Transfer → Exit
15 stepsNegative Response Codes
NRC Decoder — SID 0x34
Click any card for trace and recovery steps.
Order the simulator checks errors — first failing check wins (crude length → session → security → state → range/format).
Troubleshooting Guide
Troubleshooting Guide
Click any issue to expand diagnosis and resolution.
Timing Parameters
Parameter | Typical Value | Context |
|---|---|---|
| P2 (Response) | 50 ms | Standard response timeout |
| P2* (Enhanced) | 5000 ms | Session-dependent, set by 0x10 response |
| S3 (Session Timeout) | 5000 ms | Session inactivity limit — send 3E 80 to reset |
| Flash write | 10–100 ms/block | ECU dependent |
ISO 14229-1 References
Standard: ISO 14229-1:2020, Section 14.2 — RequestDownload. Related: §14.4 TransferData (0x36), §14.5 RequestTransferExit (0x37).
Key points
- dataFormatIdentifier: high nibble = compressionMethod, low nibble = encryptingMethod (this simulator: 0x00 only)
- addressAndLengthFormatIdentifier: high nibble = memorySize length, low nibble = memoryAddress length
- Positive response lengthFormatIdentifier high nibble = number of bytes in maxNumberOfBlockLength
- maxNumberOfBlockLength includes the 0x36 SID and block-sequence-counter byte