Service Interaction Protocol
Transfer Data
The data mover. 0x36 is the middle of the transfer chain: it carries the actual bytes, one block at a time, each tagged with a block-sequence-counter. Direction depends on what opened the transfer — 0x34 (download) puts data in the request, 0x35 (upload) puts it in the response.
Block Streaming Transfer Pipeline (0x34 ➔ 0x36 ➔ 0x37)
Sequential Block Transfer with Automatic Counter Rollover
Overview
“The TransferData service is used by the client to transfer data to (download) or from (upload) the server.”
Each 0x36 request carries a blockSequenceCounter that must match what the ECU expects — that is how the ECU detects a lost or duplicated block. The block size is capped by the maxNumberOfBlockLength from the 0x34/0x35 response.
Transfer in Context
Step through blocks flowing in both directions, plus the errors you hit most: a wrong counter (0x73), no active transfer (0x24), and a voltage drop (0x93).
Transfer Runner
Watch blocks flow — both directions, plus the common errors and how to recover.
After 0x34, push the firmware in blocks and close with 0x37.
Press Play or Step to begin the sequence.
Block Sequence Counter
Drive the counter yourself. Watch it advance with each accepted block, wrap from 0xFF back to 0x01, and reject a wrong value with NRC 0x73.
Block Sequence Counter
The BSC is the heart of 0x36. Send blocks to watch it advance and wrap, and send a wrong one to see NRC 0x73. (Assumes an active transfer, PROGRAMMING + unlocked.)
Last Frame
Send a block to begin.
Wrap behavior: in this simulator the counter wraps 0xFF → 0x01 (it never uses 0x00). When retrying a failed block, resend the same counter — do not advance it.
Message Structure
The request and response shapes differ by direction. Pick a frame and inspect each byte.
◆ PROTOCOL ANATOMY
0x36 TRANSFER DATA
0x36 RESPONSE
Session & Security
SID 0x36 TransferData Stream Matrix
Permissions by stream type across diagnostic sessions. Select a row for details.
| Transfer Stream & BSC Phase | DEFAULT 0x01 | EXTENDED 0x03 | PROGRAMMING 0x02 | Security |
|---|---|---|---|---|
| ✗ | ~ | ✓ | Level 3 Flash | |
| ✗ | ✓ | ✓ | Level 1 | |
| ✗ | ✗ | ✓ | Level 3 Flash | |
| ✗ | ✓ | ✓ | — |
Keep the session alive: send TesterPresent (3E 80) every 2–3 seconds during a long transfer. If the S3 timer (≈5s) expires, the transfer state is lost and the next 0x36 returns 0x7F/0x24.
If security authorization lapses or is revoked during block streaming, subsequent 0x36 blocks are immediately rejected with NRC 0x33 (SecurityAccessDenied) or NRC 0x24 (RequestSequenceError).
Server processes sequential payload blocks, writes/reads data buffers, and validates consecutive blockSequenceCounter values.
| From Session | To Session | Transition Command | Security State Effect |
|---|---|---|---|
| 0x02 Programming | 0x01 Default | Security state drops to LOCKED. Active transfer terminates abruptly. | |
| Transfer Active | Session Timeout | S3 timer expires, security session drops, block counter state is wiped. | |
| Transfer In Progress | ECU Reset | Hard reset wipes all write buffers and re-locks ECU. |
Triggered when this service or requested resource requires an active security unlock that has not been granted.
Triggered during unlock attempts if the calculated key fails ECU cryptographic verification.
Enforced delay lockout if the maximum number of failed key submissions (typically 3) has been exceeded.
Service Dependencies
0x36 streams binary data blocks between tester and ECU during download and upload operations. Select a node to inspect interactions.
Multi-Block Sequences
Download — 2 KB in 512-byte blocks
Write Firmware to ECU
10 stepsUpload — ECU returns data in each response
Read Data from ECU
8 stepsNegative Response Codes
EXCEPTION_MATRIX_V3
Payload is empty (missing blockSequenceCounter) or exceeds the maxNumberOfBlockLength negotiated during 0x34/0x35.
This negative response indicates a rejection while processing the Transfer Data (SID 0x36) request. Verify preconditions, session levels, and message formatting per ISO 14229.
Troubleshooting Guide
Troubleshooting Guide
Click any issue to expand diagnosis and resolution.
Timing Parameters
| Parameter | Typical Value | Context |
|---|---|---|
| P2 (Response) | 50–150 ms | Per-block acknowledgement |
| P2* (Enhanced) | 5000 ms | Real ECUs use this during a flash write (may answer NRC 0x78) |
| S3 (Session Timeout) | 5000 ms | Hold with 3E 80 so the transfer state survives between blocks |
| Inter-block delay | 0–50 ms | Gap between consecutive blocks |
ISO 14229-1 References
Standard: ISO 14229-1:2020, Section 14.4 — TransferData. Related: §14.2 RequestDownload (0x34), §14.3 RequestUpload (0x35), §14.5 RequestTransferExit (0x37).
Key points
- Request: 36 + blockSequenceCounter + data (download only)
- Response: 76 + blockSequenceCounter + data (upload only)
- The BSC starts at 0x01 and, in this simulator, wraps 0xFF → 0x01
- This simulator emits NRC 0x7F, 0x33, 0x24, 0x13, 0x73, 0x31, and (when voltage is configured) 0x92/0x93
- 0x71 (suspend), 0x72 (programming failure) and 0x78 (response pending) are ISO-defined real-ECU behaviors, not emitted here
Quick Reference & Best Practices
TransferData
the middleTransfer sequence
Request
Positive Response
Tester puts data in the request; ECU acks with 76 BSC.
Tester sends only the BSC; ECU returns 76 BSC + data.
- Service ID
- 0x36
- Positive Response
- 0x76
- Role
- Moves the data blocks
- Required session
- PROGRAMMING or EXTENDED
- Security
- Must be unlocked (0x27)
- Precondition
- A 0x34/0x35 transfer must be active (else 0x24)
- Block counter
- Starts 0x01, wraps 0xFF → 0x01 (this sim)
- ISO ref
- ISO 14229-1:2020 §14.4