Service Interaction Protocol
Request Upload
Read-only mirror of 0x34. RequestUpload reads data out of the ECU. Unlike RequestDownload it does not modify memory, so no prior erase (0x31) is needed — but it still requires the PROGRAMMING session and a security unlock.
RequestUpload
mirror of 0x34Transfer sequence
Request
Positive Response
- Service ID
- 0x35
- Positive Response
- 0x75
- Direction
- ECU → Tester (read)
- Required session
- PROGRAMMING (0x02) only
- Security
- Must be unlocked (0x27)
- Min request length
- 5 bytes (SID + DFI + ALFID + addr + size)
- Data format (this sim)
- DFI byte is ignored (not validated/applied)
- ISO ref
- ISO 14229-1:2020 §14.3
Overview
“The RequestUpload service is used by the client to initiate a data transfer from the server (ECU) to the client.”
The chain: 0x35 RequestUpload → 0x36 TransferData (repeated) → 0x37 RequestTransferExit. In each 0x36 the tester sends only a block counter; the ECU replies (0x76) with the data. The 0x75 response tells you the largest block the ECU will send.
Upload Sequence
Step through the read-from-ECU flow — session, security, request upload, transfer blocks, exit. Try the error scenarios too.
Upload Sequence Runner
Step through the read-from-ECU flow and watch the bytes on the wire.
Enter PROGRAMMING, unlock, request upload, pull blocks, exit.
Press Play or Step to begin the sequence.
Build a Request
Set the data-format and address/length nibbles, the address and size, and the ECU state. The builder assembles the exact request bytes and shows the simulator’s response — a 0x75 acceptance or the precise NRC.
Request Builder
Set the DFI, ALFID, address, size, and ECU state — see the assembled request and the simulator’s exact response.
ECU state
dataFormatIdentifier = 0x00
This simulator ignores the DFI — any value is accepted (none is applied).
addressAndLengthFormatId = 0x44
Assembled request (11 bytes)
Accepted. Source: Application. The DFI (0x00) is ignored by this simulator. Response carries maxNumberOfBlockLength = 0x1000.
ECU response
Message Structure
Inspect each byte of the request, the 0x75 response, and a negative response.
Message Frame Breakdown
Pick a frame, then focus a byte (click or Tab) to see its role.
RequestUpload service identifier.
Request (0x35)
The request parameters depend on the AddrAndLen byte which specifies how many bytes the Address and Size fields occupy.
Response (0x75)
Echoes a LengthFormat byte indicating the size of the MaxNumberOfBlockLength parameter, which dictates block sizing for subsequent 0x36 transfers.
Compression & encryption: the dataFormatIdentifier can encode compression (high nibble) and encryption (low nibble), but this simulator ignores the DFI byte entirely — any value is accepted and none is applied. (Note this differs from RequestDownload 0x34, which rejects a non-zero DFI with NRC 0x31.)
Memory Map
Memory Map
RequestUpload reads from a region. Readable regions return 0x75; protected/unknown ones return NRC 0x31. (Regions are ECU-configured; these are illustrative.)
Gaps between regions are unmapped — targeting them returns NRC 0x31 (no region found).
- Start
- 0x00100000
- End
- 0x00200000
- Size · Type
- 1 MB · Flash
- 0x35 here
- 75 (accepted)
Main application firmware. The usual upload source.
Block Transfer Math
Block Transfer Calculator
From the maxNumberOfBlockLength in the 0x75 response, work out how many 0x36 → 0x76 data blocks the ECU sends.
Why minus 2? maxNumberOfBlockLength counts the whole 0x76 response the ECU sends — the response SID and the block-sequence-counter — so usable data per block is maxBlock − 2. The final block is often partial. The 0x75 length-format-identifier for this maxBlock is 0x20 (value 0x200).
Service Dependencies
Service Dependencies
0x35 opens a read-only transfer. Select a node to see how it relates.
Must be in PROGRAMMING (0x02) before 0x35 — EXTENDED is rejected with NRC 0x70.
Session & Security
Requirement | Value | If not met |
|---|---|---|
| Session | PROGRAMMING (0x02) only | NRC 0x70 — EXTENDED and DEFAULT are both rejected |
| Security | Unlocked via SID 0x27 | NRC 0x33 (securityAccessDenied) |
| Transfer state | No active upload/download | NRC 0x22 (conditionsNotCorrect) |
Keep the session alive: send TesterPresent (3E 80) every 2–3 seconds during the transfer. If the S3 timer (≈5s) expires, the ECU drops the transfer state and the upload must restart from 0x35.
Upload vs Download
Property | RequestUpload (0x35) | RequestDownload (0x34) |
|---|---|---|
| Data direction | ECU → Tester (read) | Tester → ECU (write) |
| Positive response | 0x75 | 0x74 |
| 0x36 request | Block counter only | Block counter + data |
| 0x36 response | ECU sends data | ECU acks counter only |
| maxBlockLength | Max bytes ECU sends/block | Max bytes ECU receives/block |
| DFI handling (this sim) | Ignored (not validated) | Non-zero → NRC 0x31 |
| Prior erase (0x31) | Not needed (read-only) | Typically required |
| Typical use | Read firmware / logs | Flash firmware / calibration |
Complete Upload Sequence
Read Firmware from ECU
15 stepsNegative Response Codes
NRC Decoder — SID 0x35
Click any card for trace and recovery steps.
Order the simulator checks errors for 0x35 — first failing check wins (length → session → security → state → range).
Troubleshooting Guide
Troubleshooting Guide
Click any issue to expand diagnosis and resolution.
Timing Parameters
Parameter | Typical Value | Context |
|---|---|---|
| P2 (Response) | 50 ms | Standard response timeout |
| P2* (Enhanced) | 5000 ms | Session-dependent, set by 0x10 response |
| S3 (Session Timeout) | 5000 ms | Session inactivity limit — send 3E 80 to reset |
| Block read time | 10–50 ms/block | ECU dependent |
ISO 14229-1 References
Standard: ISO 14229-1:2020, Section 14.3 — RequestUpload. Related: §14.4 TransferData (0x36), §14.5 RequestTransferExit (0x37), §14.2 RequestDownload (0x34).
Key points
- dataFormatIdentifier: high nibble = compressionMethod, low nibble = encryptingMethod (this simulator ignores the byte)
- addressAndLengthFormatIdentifier: high nibble = memorySize length, low nibble = memoryAddress length (a 0 nibble → NRC 0x31)
- Positive response lengthFormatIdentifier high nibble = number of bytes in maxNumberOfBlockLength
- maxNumberOfBlockLength includes the 0x76 SID and block-sequence-counter byte