Service Interaction Protocol
Read Data By Identifier
Overview
“The client uses this service to request data record values from the server by one or more data identifiers.”
Key Characteristics
- Multiple DIDs: Request 1–N identifiers in single message
- No Sub-Functions: Service behavior driven by DID content
- DID Echo: ECU repeats requested DIDs in response
- Session-Dependent: Access varies by diagnostic session
- Security-Protected: Some DIDs require unlock (SID 0x27)
- Condition-Aware: NRC 0x22 when vehicle conditions unmet
Common Use Cases
- Vehicle ID: Read VIN, serial numbers, hardware versions
- Live Data: Monitor sensors (temp, RPM, speed, voltage)
- Diagnostics: Collect fault codes and DTC metadata
- Calibration: Read and verify vehicle tuning parameters
- Status Check: Verify programming state and system health
- Compliance: Validate ECU configuration against regulatory rules
Message Structure
SID 0x22 frames are compact: one service byte followed by one or more 2-byte DID pairs. The positive response echoes each DID header before its data. Try toggling between request (TX), response (RX), and split views, filter by semantic type, inspect byte field definitions, explore alternative values, and export code snippets:
◆ PROTOCOL ANATOMY
0x22 READ DATA BY IDENTIFIER
0x22 RESPONSE
Data Identifier (DID) Ranges & Categories
DIDs are organized into ISO 14229-defined ranges. Search and filter the catalog below, then click any entry for session, security, and data-size details.
Multi-DID request: SID 0x22 supports multiple DIDs per frame — 22 F1 90 F1 8C F1 89 reads VIN + Serial + SW Version at once.
Note: 0xF200–0xF2FF (Periodic) is for SID 0x2A (Read Data By Periodic Identifier) only. SID 0x22 should NOT be used with periodic DIDs.
Session & Security Requirements
DID access is gated by both session type and security level. Use the filter buttons to explore which DID categories are reachable from each session, then click any row for the full requirement note.
Session & Security Matrix
Which DID categories can be read in each diagnostic session, and required security levels. Select a row for details.
| DID Category & Range | DEFAULT 0x01 | EXTENDED 0x03 | PROGRAMMING 0x02 | Security |
|---|---|---|---|---|
| ✓ | ✓ | ✓ | — | |
| ✓ | ✓ | ✓ | — | |
| ✓ | ✓ | ✓ | — | |
| ✓ | ✓ | ✗ | — | |
| ✗ | ✓ | ✗ | — | |
| ✗ | ✓ | ✓ | Level 1 | |
| ✗ | ✗ | ✓ | — | |
| ✗ | ✗ | ✓ | Level 3+ |
Security Unlock Flow: To access secured DIDs, first unlock using SID 0x27 (Security Access). Request seed → calculate key using proprietary algorithm → send key. Security auto-locks on session change or timeout (~5 seconds).
Security State Behavior
Public DIDs (e.g., 0xF190 VIN, 0xF186 Active Diagnostic Session) are readable without security access. Protected DIDs (e.g., calibration parameters, cryptographic keys, crash record details) return NRC 0x33 (SecurityAccessDenied).
All authorized DIDs mapped to the active security level become accessible in the current diagnostic session.
Triggered when this service or requested resource requires an active security unlock that has not been granted.
Triggered during unlock attempts if the calculated key fails ECU cryptographic verification.
Enforced delay lockout if the maximum number of failed key submissions (typically 3) has been exceeded.
Service Dependencies
0x22 queries standardized and proprietary diagnostic data identifiers. Select a node to inspect interactions.
Timing Parameters
The UDS protocol defines timing windows for request/response. Understanding these ensures reliable communication.
Default response timeout
50 ms
Maximum time ECU has to begin sending response after receiving request. Can be adjusted via SID 0x83 (AccessTimingParameter).
Extended timeout (Response Pending)
5000 ms
Used when ECU sends NRC 0x78 to indicate it needs more time. ECU will send final response within P2* after NRC 0x78.
Response Pending Flow (NRC 0x78)
3 stepsComplete Workflow Examples
Step through real-world diagnostic workflows showing how SID 0x22 interacts with session control, security access, and TesterPresent. Select a workflow and press Run.
Read VIN and ECU identification from DEFAULT session — no session change or security required.
Starter · 6 frames22 F1 90Request VIN62 F1 90 31 42 41 33 …VIN Response22 F1 8CRequest ECU Serial62 F1 8C 53 4E 31 32 …Serial Number Response22 F1 90 F1 8C F1 89Multi-DID Request62 F1 90 [VIN] F1 8C [SN] F1 89 [SW]Multi-DID ResponsePress Simulate to animate the full message sequence.
Negative Response Codes
EXCEPTION_MATRIX_V3
Request contains odd or incomplete DID bytes. DIDs must always be supplied in complete 2-byte pairs.
This negative response indicates a rejection while processing the Read Data By Identifier (SID 0x22) request. Verify preconditions, session levels, and message formatting per ISO 14229.
Best Practices & Troubleshooting
Implementation guidance organized by concern area. Each practice includes context, timing notes, related NRCs, and code examples. The troubleshooting table maps common failure symptoms to root causes and fixes.
Click any category to explore implementation details, when to apply each practice, and related error codes.
| Symptom | NRC | Root Cause | Fix |
|---|---|---|---|
| No response from ECU | — | ECU not powered, wrong CAN address, or wrong transport layer (ISO 15765 vs. ISO 14230) | Verify physical layer first; confirm target address in ODX; check bit-rate |
| 7F 22 13 received | 0x13 | Request byte count is not 1 + N×2 — DID truncated in last pair | Ensure each DID contributes exactly 2 bytes; check for off-by-one in loop |
| 7F 22 31 received | 0x31 | DID not present in ECU DID table — often a wrong ECU variant or typo | Cross-reference ODX/CDD for exact DID address; use 0xF186 to confirm ECU identity first |
| 7F 22 7E received | 0x7E | DID requires EXTENDED or PROGRAMMING session but tool is in DEFAULT | Send SID 0x10 0x03 (EXTENDED) or 0x10 0x02 (PROGRAMMING) before retrying |
| 7F 22 33 received | 0x33 | DID is security-locked; correct session is active but SID 0x27 has not been completed | Execute full SID 0x27 seed/key exchange at required security level before retry |
ISO 14229-1 Reference
Standard: ISO 14229-1:2020
Section: 9.2 - ReadDataByIdentifier (0x22) service
Related Sections:
• Section 6.2: Data Identifier Definition
• Section 8.2: Diagnostic Session Control (SID 0x10)
• Section 8.6: Security Access (SID 0x27)
• Annex A: Data Identifier Ranges
• Annex C: Negative Response Code Definitions