Application (ISO 14229-1)

UDS

Unified Diagnostic Services — ISO 14229, the universal diagnostic protocol.

Overview

UDS defines a request/response protocol between a diagnostic tester and ECU. Each request starts with a Service Identifier (SID); responses echo SID+0x40 on success or 0x7F on negative response with a NRC. Sessions, security access, and routine controls enable diagnostics, coding and flashing.

Frame / message structure

Field	Bits	Description
SID	8	Service Identifier (e.g. 0x22 ReadDataByIdentifier)
Sub-function	8	Optional, e.g. session type for 0x10
Parameters	var	DID, RID, address+length, data record…

Byte structure — request & response

UDS — ISO 14229-1 (over CAN ISO-TP, CAN-FD or DoIP)

Frame template

[(transport header)] [SID:1B][Sub-fn:0–1B][Parameters:var]

Request

Off	Size	Field	Value	Description
0	0–2 B	Transport (CAN ISO-TP)	07 E0 02	Tester CAN ID 0x7E0 + Single-Frame PCI (length 2).
2	1 B	SID	0x22	ReadDataByIdentifier.
3–4	2 B	DID	F1 90	Data identifier — 0xF190 = VIN.
5…7	pad	ISO-TP padding	CC CC CC	Padded to 8 bytes per ISO 15765-2.

Response

Off	Size	Field	Value	Description
0	0–2 B	Transport (CAN ISO-TP)	07 E8 10 14	ECU CAN ID 0x7E8 + First-Frame PCI (length 0x014 = 20).
2	1 B	SID + 0x40	0x62	Positive response to 0x22.
3–4	2 B	DID echo	F1 90	Same DID echoed back.
5…21	17 B	Data	57 30 4C … 39	ASCII VIN 'W0L000123456789'.

Negative response = 0x7F <SID> <NRC>. NRC 0x78 (responsePending) lets the ECU ask for more time.

Use cases

· Workshop diagnostics
· ECU flashing
· End-of-line programming
· Coding & calibration

Pros

Standardized across OEMs
Rich service catalog
Works over CAN, CAN-FD, DoIP

Cons

Security access still vendor-specific
Complex state machines

Request / Response examples

Read VIN — ReadDataByIdentifier (0x22 F1 90)

Request

22F190

Response

62F19057304C30303030313233343536373839

Positive response = SID+0x40. Bytes after DID 0xF190 spell 'W0L000123456789'.

Switch to programming session (0x10 02)

Request

1002

Response

5002003201F4

ECU confirms session change, returning P2 (50 ms) and P2* (5000 ms) timing.

All UDS services (ISO 14229-1)

0x10DiagnosticSessionControl

Switches the ECU between diagnostic sessions (default, programming, extended).

Request: 10 

Response: 50 P2 P2*

Sub-functions:

0x01 defaultSession
0x02 programmingSession
0x03 extendedDiagnosticSession
0x04 safetySystemDiagnosticSession

0x11ECUReset

Resets the ECU (hard, key-off-on, soft).

Request: 11 

Response: 51 

Sub-functions:

0x01 hardReset
0x02 keyOffOnReset
0x03 softReset

0x14ClearDiagnosticInformation

Clears DTCs by group identifier (0xFFFFFF clears all).

Request: 14 <group:3>

Response: 54

0x19ReadDTCInformation

Reports stored DTCs and their status.

Request: 19 [mask]

Response: 59 <DTC list>

Sub-functions:

0x01 reportNumberOfDTCByStatusMask
0x02 reportDTCByStatusMask
0x06 reportDTCExtDataRecordByDTCNumber

0x22ReadDataByIdentifier

Reads data record(s) for one or more 16-bit DIDs.

Request: 22 <DID:2>

Response: 62 <DID:2> <data>

0x23ReadMemoryByAddress

Reads raw memory at a given address/length.

Request: 23 <ALFID> <addr> <len>

Response: 63 <data>

0x27SecurityAccess

Seed/key handshake to unlock protected services.

Request: 27 <level>

Response: 67 <level> <seed>

Sub-functions:

0x01 requestSeed (level 1)
0x02 sendKey (level 1)

0x28CommunicationControl

Enables/disables tx/rx of normal communication frames.

Request: 28 <ctrl> <commType>

Response: 68 <ctrl>

0x2EWriteDataByIdentifier

Writes a data record for a 16-bit DID.

Request: 2E <DID:2> <data>

Response: 6E <DID:2>

0x2FInputOutputControlByIdentifier

Forces an actuator/input value (e.g. force fan ON).

Request: 2F <DID:2> <ctrl> [value]

Response: 6F <DID:2> <ctrl> <state>

0x31RoutineControl

Starts, stops or queries a routine (RID).

Request: 31 <type> <RID:2> [params]

Response: 71 <type> <RID:2> [result]

Sub-functions:

0x01 startRoutine
0x02 stopRoutine
0x03 requestRoutineResults

0x34RequestDownload

Initiates an ECU download (flashing).

Request: 34 <DFI> <ALFID> <addr> <size>

Response: 74 <LFID> <maxBlockLen>

0x35RequestUpload

Initiates an ECU upload (read-out).

Request: 35 <DFI> <ALFID> <addr> <size>

Response: 75 <LFID> <maxBlockLen>

0x36TransferData

Transfers a block during download/upload.

Request: 36 <bsc> <data>

Response: 76 <bsc>

0x37RequestTransferExit

Terminates a download/upload sequence.

Request: 37

Response: 77

0x3DWriteMemoryByAddress

Writes raw memory at a given address.

Request: 3D <ALFID> <addr> <len> <data>

Response: 7D <ALFID> <addr> <len>

0x3ETesterPresent

Keep-alive to prevent session timeout (S3 timer).

Request: 3E 

Response: 7E 

Sub-functions:

0x00 zeroSubFunction (response required)
0x80 suppressPosRspMsgIndicationBit

0x85ControlDTCSetting

Enables/disables DTC storage during testing.

Request: 85 

Response: C5 

Sub-functions:

0x01 on
0x02 off

Negative Response Codes (NRCs)

Code	Meaning
0x10	generalReject
0x11	serviceNotSupported
0x12	subFunctionNotSupported
0x13	incorrectMessageLengthOrInvalidFormat
0x22	conditionsNotCorrect
0x24	requestSequenceError
0x31	requestOutOfRange
0x33	securityAccessDenied
0x35	invalidKey
0x36	exceedNumberOfAttempts
0x37	requiredTimeDelayNotExpired
0x72	generalProgrammingFailure
0x78	requestCorrectlyReceivedResponsePending
0x7E	subFunctionNotSupportedInActiveSession
0x7F	serviceNotSupportedInActiveSession