Service Interaction Protocol
Request Upload
0x35Protocol Identifier
The RequestUpload service initiates a data transfer sequence FROM the ECU TO the tester. This service prepares the ECU to send firmware, calibration data, or diagnostic logs that will be retrieved via subsequent TransferData (0x36) requests.
Overview
ISO 14229-1
RequestUpload is the counterpart to RequestDownload (0x34). It initiates reading data FROM the ECU. The sequence is: RequestUpload (0x35) → TransferData (0x36) → RequestTransferExit (0x37). The ECU responds with the maximum block size it will send per transfer.
Interactions with Other SIDs
Prerequisites & Dependencies
- 0x10Programming Session (0x02) or Extended Session (0x03)
- 0x27Security Access often required
- 0x36TransferData retrieves the actual data blocks
- 0x37RequestTransferExit completes the sequence
Message Format
Request Format
| Byte | Field | Value | Description |
|---|---|---|---|
| 0 | SID | 0x35 | Request Upload |
| 1 | dataFormatIdentifier | 0xNN | Compression/Encryption (usually 0x00) |
| 2 | addressAndLengthFormatId | 0xNN | ALFID (same as 0x34) |
| 3-N | memoryAddress | Variable | Source memory location |
| N+1-M | memorySize | Variable | Total bytes to upload |
Response Format
| Byte | Field | Value | Description |
|---|---|---|---|
| 0 | Response SID | 0x75 | Positive Response (SID + 0x40) |
| 1 | lengthFormatIdentifier | 0xN0 | Size of maxBlockLength field |
| 2-N | maxNumberOfBlockLength | Variable | Max bytes per TransferData response |
TX/RX Examples
Request Upload 4KB from 0x00100000
tx_packet
Request
35 00 44 00 10 00 00 00 00 10 00> Upload 4096 bytes from flash
rx_packet
Response
75 20 02 00> MaxBlockLength=512 bytes
✓
ECU ready to send data in 512-byte blocks
Read Calibration Data
tx_packet
Request
35 00 44 00 20 00 00 00 00 01 00> Upload 256 bytes of calibration
rx_packet
Response
75 20 01 00> MaxBlockLength=256 bytes
✓
Entire calibration fits in one block
UML Sequence Diagrams
Complete Upload Sequence
Read Firmware from ECU
12 stepsTester
ECU
Anticipated Behavior
info _entry
TransferData Direction: Unlike RequestDownload where the tester sends data in 0x36, with RequestUpload the ECU sends data in the 0x36 response.
warning _entry
Block Sequence: The tester sends sequential block numbers (01, 02, 03…) in TransferData requests. The ECU responds with the corresponding data block.
Negative Response Codes (NRCs)
| NRC | Name | Description |
|---|---|---|
| 0x13 | Incorrect Message Length | ALFID mismatch with address/size bytes |
| 0x22 | Conditions Not Correct | Upload already in progress |
| 0x31 | Request Out of Range | Invalid memory address or size |
| 0x33 | Security Access Denied | Protected memory, unlock required |
| 0x70 | Upload/Download Not Accepted | Wrong session type |