Service Interaction Protocol

Transfer Data

0x36

Protocol Identifier

The TransferData service is used to transfer data blocks between the tester and ECU as part of a download or upload sequence.

A Service Identifier (SID) is a single-byte value (0x00–0xFF) in position 0 of every UDS request frame. It specifies which diagnostic operation the client wishes the ECU to execute. The positive response echoes the SID with the high bit set (SID + 0x40).

SEQ_CONTROL

BLOCK_COUNTER

Every frame includes a sequence ID (0x01-0xFF) to prevent data loss or duplication.

THROUGHPUT

512B_BLOCKS

Payload size is strictly bound by the MaxBlockLength negotiated in the initiation phase.

STATE

VOLATILE

Requires an active Download/Upload context. Rejects requests if sequence is broken.

Overview

ISO 14229-1

TransferData is the middle step in the download/upload sequence. Each request contains a block sequence counter that ensures data integrity. The maximum block size is determined by the preceding RequestDownload or RequestUpload response.

Click to Enlarge

Block-by-block data movement with sequence counter validation.

Default Behavior

By default, the ECU will reject any TransferData request with NRC 0x24 (Request Sequence Error) unless a valid download or upload sequence is already in progress. The ECU maintains an internal Block Sequence Counter (starting at 0x01) and ignores or rejects any blocks received out of order. During flash writing, the ECU may issue NRC 0x78 (Response Pending) if the NVM operation takes longer than the P2 timeout.

Interactions with Other SIDs

Prerequisites & Dependencies

0x34RequestDownload must be active for tester→ECU transfers
0x35RequestUpload must be active for ECU→tester transfers
0x37RequestTransferExit completes the sequence

Data Direction

After 0x34 (Download)

Tester sends data IN request

After 0x35 (Upload)

ECU sends data IN response

Protocol Anatomy (Transfer Block)

◆ PROTOCOL ANATOMY

View

REQUEST_TX

0x36 TRANSFER DATA

RESPONSE_RX

0x36 RESPONSE

Block Sequence Counter

Counter Behavior

Start: First block is always 0x01
Increment: Each subsequent block increments by 1
Wrap: After 0xFF, wraps to 0x00 (not 0x01)
Validation: ECU rejects out-of-sequence blocks

Sequence: 01 → 02 → 03 → … → FE → FF → 00 → 01 → 02 → …

TX/RX Examples

Download Data Blocks

tx_packet

Block 1

36 01 [512 bytes of firmware]

> First data block

rx_packet

Response

76 01

> Block 1 received

tx_packet

Block 2

36 02 [512 bytes of firmware]

> Second data block

rx_packet

Response

76 02

> Block 2 received

✓

Continue until all data transferred

Upload Data Blocks

tx_packet

Request Block 1

36 01

> Request first block

rx_packet

Response

76 01 [512 bytes from ECU]

> Block 1 data

tx_packet

Request Block 2

36 02

> Request second block

rx_packet

Response

76 02 [512 bytes from ECU]

> Block 2 data

✓

ECU sends data in response

Wrong Block Sequence

tx_packet

Block 3 (skipped 2)

36 03 [data]

> Out of sequence

rx_packet

Error Response

7F 36 73

> Wrong block sequence counter

Error

Blocks must be sent in order

No Active Transfer

tx_packet

Request

36 01 [data]

> Without 0x34/0x35 first

rx_packet

Error Response

7F 36 24

> Request sequence error

Error

Must call RequestDownload or RequestUpload first

UML Sequence Diagrams

Multiple Block Download

Download 2KB in 512-byte Blocks

12 steps

Tester

ECU

Anticipated Behavior

warning _entry

Block Size Limit: Never exceed the maxNumberOfBlockLength returned by 0x34/0x35. The last block may be smaller if the total size doesn’t divide evenly.

info _entry

Response Pending: Flash programming may take time. The ECU may send NRC 0x78 (Response Pending) while writing data to flash memory.

Negative Response Codes (NRCs)

Error_Catalog

Negative Response Codes

THREAT_LEVEL6 HIGH4 MEDIUM10 NRCs TOTAL

ISO_14229_ANNEX_ANRC_ENGINE_V2

info _entry

Note on NRC 0x78: The ECU may send 7F 36 78 (Response Pending) while writing data to flash memory. This is not an error and indicates the tester should wait.