Service Interaction Protocol
Request Upload
Read-only mirror of 0x34. RequestUpload reads data out of the ECU. Unlike RequestDownload it does not modify memory, so no prior erase (0x31) is needed — but it still requires the PROGRAMMING session and a security unlock.
RequestUpload
mirror of 0x34Transfer sequence
Request
Positive Response
- Service ID
- 0x35
- Positive Response
- 0x75
- Direction
- ECU → Tester (read)
- Required session
- PROGRAMMING (0x02) only
- Security
- Must be unlocked (0x27)
- Min request length
- 5 bytes (SID + DFI + ALFID + addr + size)
- Data format (this sim)
- DFI byte is ignored (not validated/applied)
- ISO ref
- ISO 14229-1:2020 §14.3
Overview
“The RequestUpload service is used by the client to initiate a data transfer from the server (ECU) to the client.”
The chain: 0x35 RequestUpload → 0x36 TransferData (repeated) → 0x37 RequestTransferExit. In each 0x36 the tester sends only a block counter; the ECU replies (0x76) with the data. The 0x75 response tells you the largest block the ECU will send.
Upload Sequence
Step through the read-from-ECU flow — session, security, request upload, transfer blocks, exit. Try the error scenarios too.
Upload Sequence Runner
Step through the read-from-ECU flow and watch the bytes on the wire.
Enter PROGRAMMING, unlock, request upload, pull blocks, exit.
Press Play or Step to begin the sequence.
Build a Request
Set the data-format and address/length nibbles, the address and size, and the ECU state. The builder assembles the exact request bytes and shows the simulator’s response — a 0x75 acceptance or the precise NRC.
Request Builder
Set the DFI, ALFID, address, size, and ECU state — see the assembled request and the simulator’s exact response.
ECU state
dataFormatIdentifier = 0x00
This simulator ignores the DFI — any value is accepted (none is applied).
addressAndLengthFormatId = 0x44
Assembled request (11 bytes)
Accepted. Source: Application. The DFI (0x00) is ignored by this simulator. Response carries maxNumberOfBlockLength = 0x1000.
ECU response
Message Format
Inspect each byte of the request, the 0x75 response, and a negative response.
Message Frame Breakdown
Pick a frame, then focus a byte (click or Tab) to see its role.
RequestUpload service identifier.
Compression & encryption: the dataFormatIdentifier can encode compression (high nibble) and encryption (low nibble), but this simulator ignores the DFI byte entirely — any value is accepted and none is applied. (Note this differs from RequestDownload 0x34, which rejects a non-zero DFI with NRC 0x31.)
Memory Map
Memory Map
RequestUpload reads from a region. Readable regions return 0x75; protected/unknown ones return NRC 0x31. (Regions are ECU-configured; these are illustrative.)
Gaps between regions are unmapped — targeting them returns NRC 0x31 (no region found).
- Start
- 0x00100000
- End
- 0x00200000
- Size · Type
- 1 MB · Flash
- 0x35 here
- 75 (accepted)
Main application firmware. The usual upload source.
Block Transfer Math
Block Transfer Calculator
From the maxNumberOfBlockLength in the 0x75 response, work out how many 0x36 → 0x76 data blocks the ECU sends.
Why minus 2? maxNumberOfBlockLength counts the whole 0x76 response the ECU sends — the response SID and the block-sequence-counter — so usable data per block is maxBlock − 2. The final block is often partial. The 0x75 length-format-identifier for this maxBlock is 0x20 (value 0x200).
Service Dependencies
Service Dependencies
0x35 opens a read-only transfer. Select a node to see how it relates.
Must be in PROGRAMMING (0x02) before 0x35 — EXTENDED is rejected with NRC 0x70.
Session & Security
Requirement | Value | If not met |
|---|---|---|
| Session | PROGRAMMING (0x02) only | NRC 0x70 — EXTENDED and DEFAULT are both rejected |
| Security | Unlocked via SID 0x27 | NRC 0x33 (securityAccessDenied) |
| Transfer state | No active upload/download | NRC 0x22 (conditionsNotCorrect) |
Keep the session alive: send TesterPresent (3E 80) every 2–3 seconds during the transfer. If the S3 timer (≈5s) expires, the ECU drops the transfer state and the upload must restart from 0x35.
Upload vs Download
Property | RequestUpload (0x35) | RequestDownload (0x34) |
|---|---|---|
| Data direction | ECU → Tester (read) | Tester → ECU (write) |
| Positive response | 0x75 | 0x74 |
| 0x36 request | Block counter only | Block counter + data |
| 0x36 response | ECU sends data | ECU acks counter only |
| maxBlockLength | Max bytes ECU sends/block | Max bytes ECU receives/block |
| DFI handling (this sim) | Ignored (not validated) | Non-zero → NRC 0x31 |
| Prior erase (0x31) | Not needed (read-only) | Typically required |
| Typical use | Read firmware / logs | Flash firmware / calibration |
Complete Upload Sequence
Read Firmware from ECU
15 stepsNegative Response Codes
NRC Decoder — SID 0x35
Click any card for trace and recovery steps.
Order the simulator checks errors for 0x35 — first failing check wins (length → session → security → state → range).
Troubleshooting Guide
Troubleshooting Guide
Click any issue to expand diagnosis and resolution.
Timing Parameters
Parameter | Typical Value | Context |
|---|---|---|
| P2 (Response) | 50 ms | Standard response timeout |
| P2* (Enhanced) | 5000 ms | Session-dependent, set by 0x10 response |
| S3 (Session Timeout) | 5000 ms | Session inactivity limit — send 3E 80 to reset |
| Block read time | 10–50 ms/block | ECU dependent |
ISO 14229-1 References
Standard: ISO 14229-1:2020, Section 14.3 — RequestUpload. Related: §14.4 TransferData (0x36), §14.5 RequestTransferExit (0x37), §14.2 RequestDownload (0x34).
Key points
- dataFormatIdentifier: high nibble = compressionMethod, low nibble = encryptingMethod (this simulator ignores the byte)
- addressAndLengthFormatIdentifier: high nibble = memorySize length, low nibble = memoryAddress length (a 0 nibble → NRC 0x31)
- Positive response lengthFormatIdentifier high nibble = number of bytes in maxNumberOfBlockLength
- maxNumberOfBlockLength includes the 0x76 SID and block-sequence-counter byte