Service Interaction Protocol
Security Access
What is SID 0x27 Security Access?
“The client uses this service to unlock and access secured functions and data on the server by passing a security challenge.”
Many critical UDS services (like Write Data (0x2E), Routine Control (0x31), and Download (0x34)) are restricted until a specific security level is unlocked.
Security Authentication & Protected Execution Sequence
Standard ISO 14229-1 Seed-Key Challenge & Write Pipeline
Which sub-functions and security levels does 0x27 define?
Security levels are defined by Sub-Functions. Odd numbers are used to Request Seeds, while the following even number is used to Send Keys. Use the explorer below to understand the available levels and their sub-function byte encoding.
SID 0x27 SubFunction Explorer
Click on a security level to explore its seed-request and key-submit subfunctions. Standard levels use odd/even pairing (0x01/0x02 for Level 1, 0x03/0x04 for Level 2, etc.).
💡 Odd subfunctions (0x01, 0x03, 0x05) request seeds. Even subfunctions (0x02, 0x04, 0x06) submit keys. OEM levels follow the same pattern with higher values (0x05/0x06, 0x07/0x08, 0x09/0x0A).
SID 0x27 (SecurityAccess) uses subfunctions to request seeds and submit keys. The odd/even pairing is fundamental: odd subfunctions always request a seed, even subfunctions always submit a key for the corresponding level.
How does the seed and key exchange work?
What do 0x27 request and response messages look like?
Security Access messages follow a strict byte-level structure. Use the explorer below to understand the exact format of seed requests, key submissions, and responses.
◆ PROTOCOL ANATOMY
0x27 SECURITY ACCESS
0x27 RESPONSE
Which diagnostic session does Security Access require?
Security Access (0x27) is only available in specific diagnostic sessions. Changing sessions automatically resets all security levels to LOCKED.
Session & Security Matrix
Which Security Access levels can be unlocked in each session. Select a row for details.
| Security Level & Sub-functions | DEFAULT 0x01 | EXTENDED 0x03 | PROGRAMMING 0x02 | SAFETY 0x04 | Security |
|---|---|---|---|---|---|
| ✗ | ✓ | ✓ | ✗ | — | |
| ✗ | ✗ | ✓ | ✗ | — | |
| ✗ | ✓ | ✗ | ✓ | — | |
| ✗ | ✗ | ✓ | ✗ | — |
Live Simulation
Try the full seed-key exchange mechanism interactively. Select a security level, request a seed, compute the key, and see how the ECU validates your response.
How does the ECU security state machine transition?
The security subsystem transitions through four discrete states: LOCKED → SEED_REQUESTED → UNLOCKED, with a LOCKED_OUT state for brute-force protection. Try the interactive simulator below to explore all state transitions.
What happens after too many failed key attempts?
Security Access uses three independent timers to prevent brute-force attacks and manage session state. Explore the interactive simulators below to understand how they work.
Timing Constraints
Security Access respects the standard UDS timing parameters. Responses must arrive within specific windows.
NRC 0x78 (Response Pending): If processing takes longer than P2, the ECU sends 0x7F 0x27 0x78 to signal continued processing. The client should wait up to P2* for the actual response.
Which UDS services require Security Access?
Many critical UDS services require Security Access to be unlocked first. Use the filter controls to discover restrictions.
| SID | Service Name | Extended Session | Programming Session | Min Security | |
|---|---|---|---|---|---|
| 0x11 | ECUReset | Allowed (Unlocked) | Allowed (Unlocked) | Level 1+ | i |
| 0x14 | ClearDiagnosticInformation | Allowed (Unlocked) | Allowed (Unlocked) | Level 1+ | i |
| 0x28 | CommunicationControl | Allowed (Unlocked) | Allowed (Unlocked) | Level 1+ | i |
| 0x2E | WriteDataByIdentifier | Allowed (Unlocked) | Allowed (Unlocked) | Level 1+ | i |
| 0x2F | InputOutputControlByIdentifier | Allowed (Unlocked) | Allowed (Unlocked) | Level 1+ | i |
| 0x31 | RoutineControl | Allowed (Unlocked) | Allowed (Unlocked) | Level 1+ | i |
| 0x34 | RequestDownload | Denied | Allowed (Unlocked) | Level 2+ | i |
| 0x35 | RequestUpload | Allowed (Unlocked) | Allowed (Unlocked) | Level 2+ | i |
| 0x3D | WriteMemoryByAddress | Denied | Allowed (Unlocked) | Level 3+ | i |
| 0x85 | ControlDTCSetting | Allowed (Unlocked) | Allowed (Unlocked) | Level 1+ | i |
Security State Behavior
When locked, the ECU denies protected services (e.g. 0x2E, 0x34, 0x35, 0x3D) with NRC 0x33 (SecurityAccessDenied). Submitting a key without requesting seed returns NRC 0x24 (RequestSequenceError).
All authorized protected services mapped to the unlocked level are enabled until a session transition, timeout, or ECU reset.
Triggered when this service or requested resource requires an active security unlock that has not been granted.
Triggered during unlock attempts if the calculated key fails ECU cryptographic verification.
Enforced delay lockout if the maximum number of failed key submissions (typically 3) has been exceeded.
Service Dependencies
0x27 governs cryptographic seed-key exchange and gates privileged write, routine, and flashing services. Select a node to inspect interactions.
Negative Response Codes
EXCEPTION_MATRIX_V3
Security level sub-function is invalid or undefined (e.g. even number for seed or odd number for key).
This negative response indicates a rejection while processing the Security Access (SID 0x27) request. Verify preconditions, session levels, and message formatting per ISO 14229.
How do you unlock an ECU in practice?
Security Access workflows vary by use case. Use the interactive explorer below to walk through three real-world scenarios: standard L1 unlock, L3 flash programming, and error recovery.
Unlock Level 1 security to write DIDs or clear DTCs.
Write & Clear · 6 frames10 03DiagnosticSessionControl50 03 00 19 01 F4SessionResponse27 01RequestSeed (L1)67 01 4A 2B 9C 1DSeedResponse27 02 5F 58 CB 68SendKey (L1)67 02SecurityGrantedPress Simulate to animate the full message sequence.