This article is the continuation of the UDS protocol tutorial and carries the discussion on the Unified Diagnostic Services Protocol. The aim of this series is to provide easy and practical examples that anyone can understand. In the last article, we have seen the Routine Control Functional unit in UDS Protocol. In this tutorial, we are going to see the Upload/Download functional unit in UDS Protocol.
Table of Contents
Upload Download Functional Unit in UDS Protocol
This Upload Download Functional Unit in UDS Protocol specifies the services of how the data upload and downloads take place between the Client (testing tool) and server(ECU) and vice versa. Mainly these services are used for flashing the new firmware in ECU and downloading data from the ECU. This functional unit supports the below service,
Request Download Service in UDS Protocol
The Request Download Service ID is 0x34 and the Response ID is 0x74.
Request Download service is one of the most important services among all services in the UDS protocol. This service is used to send the data to the ECU from the testing tool. This service needs the below parameter to download the data and it needs to be given from the client side. Those parameters are,
- Memory location where the data needs to be downloaded in the ECU
- Size of the data
The server shall perform all required actions to retrieve data before sending a positive message once it receives the request Download Request Message.
Request frame format
| PCI Length | SID | Data Format Identifier | Address &Length format Identifier | Memory Address field | Memory size field |
SID – Request Download Service Id is a 1-byte value. This is used to start the Request Download Service between the client and ECU.
Data Format Identifier – It is a 1-byte value. In the data format identifier, each nibble is encoded separately for safety purposes. The lower nibble (bit 0 -bit 3) indicates the type of encryption defined by the OEM and the Higher nibble (bit 4 – bit 7) indicates the type of compression defined by the OEM. If the Data Format Identifier value is 0x00 means it indicates no encryption and compression method is used in the data transfer.
Address and Length format identifier – It is also a 1-byte value again here also each nibble is encoded separately. This identifier specifies the size of the memory address and the size of bytes. The higher nibble (bit 4- bit 7) denotes the number of bytes of the memory size parameter and the lower nibble (bit 0- bit 3) denotes the number of bytes of the memory address parameter.
Memory Address Field – This parameter indicates the starting address of the memory where the data needs to be written.
Memory size field – This parameter indicates the number of bytes in the block that need to be downloaded in the server’s flash memory and also this parameter is used to compare the total memory size of the microcontroller and the size of data during transfer.
Response frame format
There are two types of response frames. That is a positive response and a negative response frame format.
Positive Response
| PCI Length | Response SID | Length format Identifier | Max number of block Length |
Response SID – This indicates a positive response to the request. As we positive response means SID+ 0x40, which means 0x74 for positive response.
Length format Identifier – This is a 1-byte value, and each nibble is encoded separately. The higher nibble (bit 7 – bit 4) denotes the number of bytes or length of the maximum Number of Block Lengths of the “maxNumberOfBlockLength” parameter. The lower nibble (bit 0-bit 3) is reserved bits, by default the value of this nibble is 0x00.
Max number of block Length – This parameter is used by the request download service while sending a positive response message to tell the client the number of data bytes to consider.
Negative Response
If the server is not able to execute the request sent by the client, then the ECU will send the negative response code.
| PCI Length | 7F | Request SID | NRC |
Example
Please check the below example for Request Download Transition,
Supported Negative Response codes
| NRC | NRC Name | Description | Mnemonics |
| 0x13 | Incorrect message Length or Invalid format | This NRC is used when the message length is wrong | IML |
| 0x22 | Condition Not Correct | This NRC is used in the below conditions, If the data format Identifier is not validIf Address and length format Identifier is not valid if memory address or memory size is not valid | CNC |
| 0x31 | Request Out of Range | This NRC is used When the service doesn’t have the right to access the data | ROOR |
| 0x33 | Security Access Denied | This NRC is used in the below conditions, If the data format Identifier is not valid, If the Address and length format Identifier is not valid, If the memory address or memory size is not valid | SAD |
| 0x70 | General programming Failure | This NRC is used When an attempt to download to a server’s memory cannot be accomplished due to some fault conditions. | GPF |
Request Upload in UDS Protocol
The Transfer data Service ID is 0x35 and the Response ID is 0x75
The Request Upload service is used by the client to initiate the transfer of data from the ECU to the client. Once the server receives the request upload service request message, the server takes any necessary action to send the data before sending a positive response message.
Request frame format
| PCI Length | SID | Data Format Identifier | Address &Length format Identifier | Memory Address field | Memory size field |
SID – Request Download Service Id is a 1-byte value. This is used to start the Request upload Service between the client and ECU.
Data Format Identifier – It is a 1-byte value. In the data format identifier, each nibble is encoded separately for safety purposes. The lower nibble (bit 0 -bit 3) indicates the type of encryption defined by the OEM and the Higher nibble (bit 4 – bit 7) indicates the type of compression defined by the OEM. If the Data Format Identifier value is 0x00 means it indicates no encryption and compression method is used in the data transfer.
Address and Length format identifier – It is also a 1-byte value again here also each nibble is encoded separately. This identifier specifies the size of the memory address and the size of bytes. The higher nibble (bit 4- bit 7) denotes the number of bytes of the memory size parameter and the lower nibble (bit 0- bit 3) denotes the number of bytes of the memory address parameter.
Memory Address Field – This parameter indicates the starting address of the memory from which data is to be retrieved.
Memory size field – This parameter indicates the number of bytes in the block that need to be uploaded in the server’s flash memory and also this parameter is used to compare the total memory size of the microcontroller and the size of data during transfer.
Response frame format
There are two types of response frames. That is a positive response and a negative response frame format.
Positive Response
| PCI Length | Response SID | Length format Identifier | Max number of block Length |
Response SID – This indicates a positive response to the request. As we positive response means SID+ 0x40, which means 0x74 for positive response.
Length format Identifier – This is a 1-byte value, and each nibble is encoded separately. The higher nibble (bit 7 – bit 4) denotes the number of bytes or lengths of the maximum Number of Block Lengths of the “maxNumberOfBlockLength” parameter. The lower nibble (bit 0-bit 3) is reserved bits, by default value of this nibble is 0x00.
Max number of block Length – This parameter is used by the request upload service while sending a positive response message to tell the client the number of data bytes to consider.
Negative Response
If the server is not able to execute the request sent by the client, then the ECU will send the negative response code
| PCI Length | 7F | Request SID | NRC |
Example
Please check the below example for Request Upload Transition,
Supported Negative Response codes
| NRC | NRC Name | Description | Mnemonics |
| 0x13 | Incorrect message Length or Invalid format | This NRC is used when the message length is wrong | IML |
| 0x22 | Condition Not Correct | This NRC is used when a server receives a request for request upload service while a request download is already active, but not yet completed. | CNC |
| 0x31 | Request Out of Range | This NRC is used in the below conditions, If the data format Identifier is not valid If the Address and length format Identifier is not valid If the memory address or memory size is not valid | ROOR |
| 0x33 | Security Access Denied | This NRC is used When the service doesn’t have the rights to access the data | SAD |
| 0x70 | General programming Failure | This NRC is used When an attempt to upload to a server’s memory cannot be accomplished due to some fault conditions. | GPF |
Transfer data Service
The Transfer data Service ID is 0x36 and the Response ID is 0x76.
Transfer data Service is used to transfer the data from the client to ECU and ECU to the client, which means this service is used for both uploading and downloading of data. This service is used together with either request upload or request download.
For example,
- If the client initiated a request upload service, the data to be uploaded is included in the parameters transfer response parameter in the Transfer Data response messages.
- If the client initiated a request download service, the data to be downloaded is included in the parameters transfer response parameter in the Transfer Data response messages.
To improve error handling in the transfer data service, the block sequence counter parameter is the request message, initial value of the block sequence counter will be set to 1 when receiving a request upload and request download request message.
Request frame format
| PCI Length | SID | Block sequence counter | Transfer request parameter record |
SID – Transfer data Service Id is a 1-byte value. This is used to start the data transfer from the client to ECU and ECU to the client.
Block sequence counter – The value of the block Sequence Counter parameter begins at 0x01 with the initial transfer data request that comes after the request download or request upload service. Its value is increased by 1 for every subsequent transfer data request. When the value reaches 0xFF, the block sequence counter resets to 0x00 with the following Transfer data request message.
Transfer request parameter record – This parameter includes parameters that are necessary for the server to help the transfer of data.
Response frame format
There are two types of response frames. That is a positive response and a negative response frame format.
Positive Response
| PCI Length | Response SID | Block sequence counter | Transfer request parameter record |
Response SID – This indicates a positive response to the request. As we positive response means SID+ 0x40, which means 0x76 for positive response.
Block sequence counter – This counter value is the same as the Block sequence counter value in the request message.
Transfer response parameter record – This parameter includes parameters that are necessary for the server to help the transfer of data.
Negative Response
If the server is not able to execute the request sent by the client, then the ECU will send the negative response code.
| PCI Length | 7F | Request SID | NRC |
Example
Please check the below example for the Request Transfer Data Transition,
Supported Negative Response codes
| NRC | NRC Name | Description | Mnemonics |
| 0x13 | Incorrect Message Length or Invalid Format | This NRC is used when the message length is wrong | IML |
| 0x24 | Request Sequence Error | This NRC is used in the below conditions,1.The transfer request parameter Record contains additional control parameters, and this control information is invalid.2.The transfer Request parameter record is not consistent with the request download or request upload service parameter max number of block length. 3. The transfer request parameter record is not consistent with the server’s memory alignment constraints. | RSE |
| 0x31 | Request Out of Range | This NRC is used in the below conditions, 1. The transfer request parameter Record contains additional control parameters, and this control information is invalid. 2. The transfer Request parameter record is not consistent with the request download or request upload service parameter max number of block length. 3. The transfer request parameter record is not consistent with the server’s memory alignment constraints. | ROOR |
| 0x71 | Transfer Data Suspended | This NRC is used when the download module length does not meet the requirements of the memory Size parameter sent in the request message of the request download service. | TDS |
| 0x72 | General Programming Failure | This NRC is used when the server detects an error when erasing or programming a memory location in the permanent memory device during the download of data. | GPF |
| 0x73 | Wrong Block sequence counter | This NRC is used when the server detects an error in the sequence of the block Sequence counter. | WBSC |
| 0x92/0x93 | Voltage too high/Voltage too low | This NRC is used when the power pin of the server is out of range of voltage | VTH/VTL |
Request transfer exit service
The Request Transfer Exit Service ID is 0x37 and the Response ID is 0x77.
This service is used to terminate the data transfer between the client and the server both request upload and request download.
Request frame format
| PCI Length | SID | Transfer request parameter record |
SID – Transfer data Service Id is a 1-byte value. This is used to stop the ongoing data transfer from the client to ECU and ECU to the client.
Transfer response parameter record – This parameter includes parameters that are necessary for the server to help the transfer of data.
Response frame format
There are two types of response frames. That is a positive response and a negative response frame format.
Positive Response
| PCI Length | Response SID | Transfer request parameter record |
Response SID – This indicates a positive response to the request. As we positive response means SID+ 0x40, which means 0x77 for positive response.
Transfer response parameter record – This parameter includes parameters that are necessary for the server to help the transfer of data.
Negative Response
If the server is not able to execute the request sent by the client, then the ECU will send the negative response code.
| PCI Length | 7F | Request SID | NRC |
Example
Please check the below example for the Request Transfer Exit Service Transition in Upload Download Functional Unit in UDS Protocol,
Supported Negative Response codes
| NRC | NRC Name | Description | Mnemonics |
| 0x13 | Incorrect Message Length or invalid format | This NRC is used when the message length is wrong | IML |
| 0x24 | Request sequence Error | This NRC is used in the below situations, 1. programming process is not completed when a request for this service is received 2. The Request Download or Request Upload service is not active | RSE |
| 0x31 | Request Out of Range | This NRC is used when the transfer request parameter record contains invalid data. | ROOR |
| 0x72 | General Programming Failure | This NRC is used when if the server detects an error when finalizing the data transfer between the client and server | GPF |
Request file Transfer service
The Request file Transfer Service ID is 0x38 and the Response ID is 0x78.
The Request File Transfer service is used by the client to initiate a file data transfer from the client to the server or from the server to the client. The ability to get file system data is another feature of this service.
If a server implements a file system for data storage, this request file transfer service is an alternate solution for the Request download and Request upload services. The Request File Transfer service should be used in place of request download or request upload when configuring a download or upload service to or from a file system. The actual data transfer and termination of the data transfer are implemented by using the Transfer data and Request Transfer Exit as used with the request download or request upload service.
Request frame format
| PCI Length | SID | Mode of operation | File path&Name length | File path&Name | Data format ID | File size parameter length | File size uncompressed | File size compressed |
SID – Transfer data Service Id is a 1-byte value. This is used to store the data transfer from the client to ECU and ECU to the client.
Mode of operation – This parameter defines which type of operation is going to happen like add file, delete file, read file, read directory and replace file.
File path and Name Length – This is a 2-byte value and this parameter defines the length in byte for the parameter file path.
File path and Name – This parameter defines the file system location of the server memory.
Data format Identifier- It is a 1-byte value. In the data format identifier, each nibble is encoded separately for safety purposes. The lower nibble (bit 0 -bit 3) indicates the type of encryption defined by the OEM and the Higher nibble (bit 4 – bit 7) indicates the type of compression defined by the OEM. If the Data Format Identifier value is 0x00 means it indicates no encryption and compression method is used in the data transfer.
File size parameter length – This parameter defines the length in bytes for both parameters file size uncompressed and file size compressed.
File size uncompressed – This parameter defines the size of the uncompressed file.
File size compressed – This parameter defines the size of the compressed file.
Response frame format
There are two types of response frames. That is a positive response and a negative response frame format.
Positive Response
| PCI Length | Response SID | Mode of operation | Length Data format ID | Max No of block length | Data format ID | File size Or Dir Info Parameter Length | File size uncompressed | File size compressed |
Response SID – This indicates a positive response to the request. As we positive response means SID+ 0x40, which means 0x78 for positive response.
Mode of operation – This parameter value is the same as the mode of operation value which we gave in the request message.
Length Data format Identifier – This parameter indicates the max number of block length parameters.
Max Number of block length – This parameter indicates the number of data bytes (max number of block length) to include in each Transfer Data request message from the client or how many data bytes the server will include in a transfer data positive response when uploading data.
Data format Identifier – This parameter value is the same as the data format Identifier value which we gave in the request message. If the mode of operation parameter is set to 0x02 (Delete file), the response message will not include this parameter.) If the mode of operation parameter is 0x05 (Read directory), the value of this parameter must be 0x00.
File Size or Directory Info Parameter Length – This parameter indicates the length in bytes for both file size uncompressed or directory info length and file size compressed. If the mode of operation parameter is 0x01 (Add file), 0x02 (Delete file), or 0x03 (Replace file), the response message will not include this parameter.
File size uncompressed or Directory Info Parameter Length – This parameter indicates the length in bytes of the uncompressed file to be uploaded or the length of the directory information to be read in bytes. If the mode of operation parameter is 0x01 (Add file), 0x02 (Delete file), or 0x03 (Replace file), the response message will not include this parameter.
File size compressed – This parameter indicates the size of the compressed file to be uploaded in bytes. If the mode of operation parameter is 0x01 (Add file), 0x02 (Delete file), or 0x03 (Replace file), the response message will not include this parameter.
Negative Response
If the server is not able to execute the request sent by the client, then the ECU will send the negative response code.
| PCI Length | 7F | Request SID | NRC |
Example
Please check the below example for the Request file transfer Service Transition in Upload Download Functional Unit in UDS Protocol,
Supported Negative Response codes
| NRC | NRC Name | Description | Mnemonics |
| 0x13 | Incorrect Message length or Invalid format | This NRC is used when the message length is wrong | IML |
| 0x22 | Condition Not correct | This NRC is used When downloading or uploading data, or when additional prerequisites for executing this service are not met. | CNC |
| 0x31 | Request Out of Range | This NRC is used in the below situations, If the data format identifier is not valid, If the mode of operation is not valid, If the file size parameter length is not valid, If the file path and name length are not valid, File size uncompressed is not valid. If the specified file size compressed is not valid, File path and name are not valid | ROOR |
| 0x33 | Security Access Denied | This NRC is used When the service doesn’t have the right to access the data | SAD |
| 0x70 | Upload Download not accepted | This NRC is used When the download or upload is not successfully done due to some uncertain condition | UDNA |
You can also read the below tutorials.
Embedded Software Developer who is passionate about Embedded Systems.
