Service Interaction Protocol
Transfer Data
The data mover. 0x36 is the middle of the transfer chain: it carries the actual bytes, one block at a time, each tagged with a block-sequence-counter. Direction depends on what opened the transfer — 0x34 (download) puts data in the request, 0x35 (upload) puts it in the response.
TransferData
the middleTransfer sequence
Request
Positive Response
Tester puts data in the request; ECU acks with 76 BSC.
Tester sends only the BSC; ECU returns 76 BSC + data.
- Service ID
- 0x36
- Positive Response
- 0x76
- Role
- Moves the data blocks
- Required session
- PROGRAMMING or EXTENDED
- Security
- Must be unlocked (0x27)
- Precondition
- A 0x34/0x35 transfer must be active (else 0x24)
- Block counter
- Starts 0x01, wraps 0xFF → 0x01 (this sim)
- ISO ref
- ISO 14229-1:2020 §14.4
Overview
“The TransferData service is used by the client to transfer data to (download) or from (upload) the server.”
Each 0x36 request carries a blockSequenceCounter that must match what the ECU expects — that is how the ECU detects a lost or duplicated block. The block size is capped by the maxNumberOfBlockLength from the 0x34/0x35 response.
Transfer in Context
Step through blocks flowing in both directions, plus the errors you hit most: a wrong counter (0x73), no active transfer (0x24), and a voltage drop (0x93).
Transfer Runner
Watch blocks flow — both directions, plus the common errors and how to recover.
After 0x34, push the firmware in blocks and close with 0x37.
Press Play or Step to begin the sequence.
Block Sequence Counter
Drive the counter yourself. Watch it advance with each accepted block, wrap from 0xFF back to 0x01, and reject a wrong value with NRC 0x73.
Block Sequence Counter
The BSC is the heart of 0x36. Send blocks to watch it advance and wrap, and send a wrong one to see NRC 0x73. (Assumes an active transfer, PROGRAMMING + unlocked.)
Last Frame
Send a block to begin.
Wrap behavior: in this simulator the counter wraps 0xFF → 0x01 (it never uses 0x00). When retrying a failed block, resend the same counter — do not advance it.
Message Format
The request and response shapes differ by direction. Pick a frame and inspect each byte.
Message Frame Breakdown
Download puts data in the request; upload puts it in the response. Pick a frame, then focus a byte.
TransferData service identifier.
Session & Security
Requirement | Value | If not met |
|---|---|---|
| Session | PROGRAMMING (0x02) or EXTENDED (0x03) | NRC 0x7F (serviceNotSupportedInActiveSession) |
| Security | Unlocked, still valid | NRC 0x33 |
| Active transfer | A 0x34/0x35 must be open | NRC 0x24 (requestSequenceError) |
| Block counter | Matches the expected BSC | NRC 0x73 (wrongBlockSequenceCounter) |
| Block size | ≤ maxNumberOfBlockLength | NRC 0x13; download over total size → 0x31 |
Keep the session alive: send TesterPresent (3E 80) every 2–3 seconds during a long transfer. If the S3 timer (≈5s) expires, the transfer state is lost and the next 0x36 returns 0x7F/0x24.
Service Dependencies
Service Dependencies
0x36 carries the payload between 0x34/0x35 and 0x37. Select a node to see how it relates.
Opens a write transfer; sets the BSC to 0x01 and the maxBlockLength.
Multi-Block Sequences
Download — 2 KB in 512-byte blocks
Write Firmware to ECU
10 stepsUpload — ECU returns data in each response
Read Data from ECU
8 stepsNegative Response Codes
NRC Decoder — SID 0x36
This simulator emits 0x7F, 0x33, 0x24, 0x13, 0x73, 0x31, and (when voltage is configured) 0x92/0x93. Click any card for details.
Order the simulator checks errors — session → security → active-transfer → length → BSC → oversize → voltage.
Troubleshooting Guide
Troubleshooting Guide
Click any issue to expand diagnosis and resolution.
Timing Parameters
Parameter | Typical Value | Context |
|---|---|---|
| P2 (Response) | 50–150 ms | Per-block acknowledgement |
| P2* (Enhanced) | 5000 ms | Real ECUs use this during a flash write (may answer NRC 0x78) |
| S3 (Session Timeout) | 5000 ms | Hold with 3E 80 so the transfer state survives between blocks |
| Inter-block delay | 0–50 ms | Gap between consecutive blocks |
ISO 14229-1 References
Standard: ISO 14229-1:2020, Section 14.4 — TransferData. Related: §14.2 RequestDownload (0x34), §14.3 RequestUpload (0x35), §14.5 RequestTransferExit (0x37).
Key points
- Request: 36 + blockSequenceCounter + data (download only)
- Response: 76 + blockSequenceCounter + data (upload only)
- The BSC starts at 0x01 and, in this simulator, wraps 0xFF → 0x01
- This simulator emits NRC 0x7F, 0x33, 0x24, 0x13, 0x73, 0x31, and (when voltage is configured) 0x92/0x93
- 0x71 (suspend), 0x72 (programming failure) and 0x78 (response pending) are ISO-defined real-ECU behaviors, not emitted here