Upload Download Function Unit in UDS Protocol – UDS Protocol Tutorial Part 6

This article is the continuation of the UDS protocol tutorial and carries the discussion on the Unified Diagnostic Services Protocol. The aim of this series is to provide easy and practical examples that anyone can understand. In the last article, we have seen the Routine Control Functional unit in UDS Protocol. In this tutorial, we are going to see the Upload/Download functional unit in UDS Protocol.

Upload Download Functional Unit in UDS Protocol

This Upload Download Functional Unit in UDS Protocol specifies the services of how the data upload and downloads take place between the Client (testing tool) and server(ECU) and vice versa. Mainly these services are used for flashing the new firmware in ECU and downloading data from the ECU. This functional unit supports the below service,

Request Download Service in UDS Protocol

The Request Download Service ID is 0x34 and the Response ID is 0x74.

Request Download service is one of the most important services among all services in the UDS protocol. This service is used to send the data to the ECU from the testing tool. This service needs the below parameter to download the data and it needs to be given from the client side. Those parameters are,

  • Memory location where the data needs to be downloaded in the ECU
  • Size of the data

The server shall perform all required actions to retrieve data before sending a positive message once it receives the request Download Request Message.

Request frame format

PCI Length      SIDData Format IdentifierAddress &Length format IdentifierMemory Address fieldMemory size field

SID – Request Download Service Id is a 1-byte value. This is used to start the Request Download Service between the client and ECU.

Data Format Identifier – It is a 1-byte value. In the data format identifier, each nibble is encoded separately for safety purposes. The lower nibble (bit 0 -bit 3) indicates the type of encryption defined by the OEM and the Higher nibble (bit 4 – bit 7) indicates the type of compression defined by the OEM. If the Data Format Identifier value is 0x00 means it indicates no encryption and compression method is used in the data transfer.

Address and Length format identifier – It is also a 1-byte value again here also each nibble is encoded separately. This identifier specifies the size of the memory address and the size of bytes. The higher nibble (bit 4- bit 7) denotes the number of bytes of the memory size parameter and the lower nibble (bit 0- bit 3) denotes the number of bytes of the memory address parameter.

Memory Address Field – This parameter indicates the starting address of the memory where the data needs to be written.

Memory size field – This parameter indicates the number of bytes in the block that need to be downloaded in the server’s flash memory and also this parameter is used to compare the total memory size of the microcontroller and the size of data during transfer.

Response frame format

There are two types of response frames. That is a positive response and a negative response frame format.

Positive Response
PCI LengthResponse SIDLength format
Identifier
Max number of block
Length

Response SID – This indicates a positive response to the request. As we positive response means SID+ 0x40, which means 0x74 for positive response.

Length format Identifier – This is a 1-byte value, and each nibble is encoded separately. The higher nibble (bit 7 – bit 4) denotes the number of bytes or length of the maximum Number of Block Lengths of the “maxNumberOfBlockLength” parameter. The lower nibble (bit 0-bit 3) is reserved bits, by default the value of this nibble is 0x00.

Max number of block Length – This parameter is used by the request download service while sending a positive response message to tell the client the number of data bytes to consider. 

Negative Response

If the server is not able to execute the request sent by the client, then the ECU will send the negative response code.

PCI Length            7FRequest SID      NRC

Example

Please check the below example for Request Download Transition,

Upload Download Functional Unit - Request for download

Supported Negative Response codes

NRCNRC NameDescriptionMnemonics
0x13Incorrect message Length or Invalid formatThis NRC is used when the message length is wrongIML
0x22Condition Not CorrectThis NRC is used in the below conditions, If the data format Identifier is not validIf Address and length format Identifier is not valid if memory address or memory size is not validCNC
0x31Request Out of RangeThis NRC is used When the service doesn’t have the right to access the dataROOR
0x33Security Access DeniedThis NRC is used in the below conditions,
If the data format Identifier is not valid,
If the Address and length format Identifier is not valid,
If the memory address or memory size is not valid
SAD
0x70General programming FailureThis NRC is used When an attempt to download to a server’s memory cannot be accomplished due to some fault conditions.GPF

Request Upload in UDS Protocol

The Transfer data Service ID is 0x35 and the Response ID is 0x75

The Request Upload service is used by the client to initiate the transfer of data from the ECU to the client. Once the server receives the request upload service request message, the server takes any necessary action to send the data before sending a positive response message.

Request frame format

PCI Length      SIDData Format IdentifierAddress &Length format IdentifierMemory Address fieldMemory size field

SID – Request Download Service Id is a 1-byte value. This is used to start the Request upload Service between the client and ECU.

Data Format Identifier – It is a 1-byte value. In the data format identifier, each nibble is encoded separately for safety purposes. The lower nibble (bit 0 -bit 3) indicates the type of encryption defined by the OEM and the Higher nibble (bit 4 – bit 7) indicates the type of compression defined by the OEM. If the Data Format Identifier value is 0x00 means it indicates no encryption and compression method is used in the data transfer.

Address and Length format identifier – It is also a 1-byte value again here also each nibble is encoded separately. This identifier specifies the size of the memory address and the size of bytes. The higher nibble (bit 4- bit 7) denotes the number of bytes of the memory size parameter and the lower nibble (bit 0- bit 3) denotes the number of bytes of the memory address parameter.

Memory Address Field – This parameter indicates the starting address of the memory from which data is to be retrieved.

Memory size field – This parameter indicates the number of bytes in the block that need to be uploaded in the server’s flash memory and also this parameter is used to compare the total memory size of the microcontroller and the size of data during transfer.

Response frame format

There are two types of response frames. That is a positive response and a negative response frame format.

Positive Response
PCI LengthResponse SIDLength format
Identifier
Max number of block
Length

Response SID – This indicates a positive response to the request. As we positive response means SID+ 0x40, which means 0x74 for positive response.

Length format Identifier – This is a 1-byte value, and each nibble is encoded separately. The higher nibble (bit 7 – bit 4) denotes the number of bytes or lengths of the maximum Number of Block Lengths of the “maxNumberOfBlockLength” parameter. The lower nibble (bit 0-bit 3) is reserved bits, by default value of this nibble is 0x00.

Max number of block Length – This parameter is used by the request upload service while sending a positive response message to tell the client the number of data bytes to consider.

Negative Response

If the server is not able to execute the request sent by the client, then the ECU will send the negative response code

PCI Length            7FRequest SID      NRC

Example

Please check the below example for Request Upload Transition,

Upload Download Functional Unit - Request for upload

Supported Negative Response codes

NRCNRC NameDescriptionMnemonics
0x13Incorrect message Length or Invalid formatThis NRC is used when the message length is wrongIML
0x22Condition Not CorrectThis NRC is used when a server receives a request for request upload service while a request download is already active, but not yet completed.CNC
0x31Request Out of RangeThis NRC is used in the below conditions,
If the data format Identifier is not valid
If the Address and length format Identifier is not valid
If the memory address or memory size is not valid
ROOR
0x33Security Access DeniedThis NRC is used When the service doesn’t have the rights to access the dataSAD
0x70General programming FailureThis NRC is used When an attempt to upload to a server’s memory cannot be accomplished due to some fault conditions.GPF

Transfer data Service

The Transfer data Service ID is 0x36 and the Response ID is 0x76.

Transfer data Service is used to transfer the data from the client to ECU and ECU to the client, which means this service is used for both uploading and downloading of data. This service is used together with either request upload or request download. 

For example,

  • If the client initiated a request upload service, the data to be uploaded is included in the parameters transfer response parameter in the Transfer Data response messages.
  • If the client initiated a request download service, the data to be downloaded is included in the parameters transfer response parameter in the Transfer Data response messages.

To improve error handling in the transfer data service, the block sequence counter parameter is the request message, initial value of the block sequence counter will be set to 1 when receiving a request upload and request download request message.

Request frame format

PCI Length      SIDBlock sequence counterTransfer request parameter record

SID – Transfer data Service Id is a 1-byte value. This is used to start the data transfer from the client to ECU and ECU to the client.

Block sequence counter – The value of the block Sequence Counter parameter begins at 0x01 with the initial transfer data request that comes after the request download or request upload service. Its value is increased by 1 for every subsequent transfer data request. When the value reaches 0xFF, the block sequence counter resets to 0x00 with the following Transfer data request message.

Transfer request parameter record – This parameter includes parameters that are necessary for the server to help the transfer of data.

Response frame format

There are two types of response frames. That is a positive response and a negative response frame format.

Positive Response
PCI LengthResponse SIDBlock sequence counterTransfer request parameter record

Response SID – This indicates a positive response to the request. As we positive response means SID+ 0x40, which means 0x76 for positive response.

Block sequence counter – This counter value is the same as the Block sequence counter value in the request message.

Transfer response parameter record – This parameter includes parameters that are necessary for the server to help the transfer of data.

Negative Response

If the server is not able to execute the request sent by the client, then the ECU will send the negative response code.

PCI Length            7FRequest SID      NRC

Example

Please check the below example for the Request Transfer Data Transition,

Upload Download Functional Unit -

Supported Negative Response codes

NRCNRC NameDescriptionMnemonics
0x13Incorrect Message Length or Invalid FormatThis NRC is used when the message length is wrongIML
0x24Request Sequence ErrorThis NRC is used in the below conditions,1.The transfer request parameter Record contains additional control parameters, and this control information is invalid.2.The transfer Request parameter record is not consistent with the request download or request upload service parameter max number of block length. 3. The transfer request parameter record is not consistent with the server’s memory alignment constraints.RSE
0x31Request Out of RangeThis NRC is used in the below conditions,
1. The transfer request parameter Record contains additional control parameters, and this control information is invalid.
2. The transfer Request parameter record is not consistent with the request download or request upload service parameter max number of block length. 
3. The transfer request parameter record is not consistent with the server’s memory alignment constraints.
ROOR
0x71Transfer Data SuspendedThis NRC is used when the download module length does not meet the requirements of the memory Size parameter sent in the request message of the request download service.TDS
0x72General Programming FailureThis NRC is used when the server detects an error when erasing or programming a memory location in the permanent memory device during the download of data.GPF
0x73Wrong Block sequence counterThis NRC is used when the server detects an error in the sequence of the block Sequence counter.WBSC
0x92/0x93Voltage too high/Voltage too lowThis NRC is used when the power pin of the server is out of range of voltageVTH/VTL

Request transfer exit service

The Request Transfer Exit Service ID is 0x37 and the Response ID is 0x77.

This service is used to terminate the data transfer between the client and the server both request upload and request download.

Request frame format

PCI Length      SIDTransfer request parameter record

SID – Transfer data Service Id is a 1-byte value. This is used to stop the ongoing data transfer from the client to ECU and ECU to the client.

Transfer response parameter record – This parameter includes parameters that are necessary for the server to help the transfer of data.

Response frame format

There are two types of response frames. That is a positive response and a negative response frame format.

Positive Response
PCI LengthResponse SIDTransfer request parameter record

Response SID – This indicates a positive response to the request. As we positive response means SID+ 0x40, which means 0x77 for positive response.

Transfer response parameter record – This parameter includes parameters that are necessary for the server to help the transfer of data.

Negative Response

If the server is not able to execute the request sent by the client, then the ECU will send the negative response code.

PCI Length            7FRequest SID      NRC

Example

Please check the below example for the Request Transfer Exit Service Transition in Upload Download Functional Unit in UDS Protocol,

Upload Download Functional Unit -

Supported Negative Response codes

NRCNRC NameDescriptionMnemonics
0x13Incorrect Message Length or invalid formatThis NRC is used when the message length is wrongIML
0x24Request sequence ErrorThis NRC is used in the below situations,
1. programming process is not completed when a request for this service is received
2. The Request Download or Request Upload service is not active
RSE
0x31Request Out of RangeThis NRC is used when the transfer request parameter record contains invalid data.ROOR
0x72General Programming FailureThis NRC is used when if the server detects an error when finalizing the data transfer between the client and serverGPF

Request file Transfer service

The Request file Transfer Service ID is 0x38 and the Response ID is 0x78.

The Request File Transfer service is used by the client to initiate a file data transfer from the client to the server or from the server to the client. The ability to get file system data is another feature of this service.

If a server implements a file system for data storage, this request file transfer service is an alternate solution for the Request download and Request upload services. The Request File Transfer service should be used in place of request download or request upload when configuring a download or upload service to or from a file system. The actual data transfer and termination of the data transfer are implemented by using the Transfer data and Request Transfer Exit as used with the request download or request upload service.

Request frame format

PCI LengthSIDMode of operationFile path&Name lengthFile path&NameData format IDFile size parameter lengthFile size uncompressedFile size compressed

SID – Transfer data Service Id is a 1-byte value. This is used to store the data transfer from the client to ECU and ECU to the client.

Mode of operation – This parameter defines which type of operation is going to happen like add file, delete file, read file, read directory and replace file.

File path and Name Length – This is a 2-byte value and this parameter defines the length in byte for the parameter file path.

File path and Name – This parameter defines the file system location of the server memory.

Data format Identifier- It is a 1-byte value. In the data format identifier, each nibble is encoded separately for safety purposes. The lower nibble (bit 0 -bit 3) indicates the type of encryption defined by the OEM and the Higher nibble (bit 4 – bit 7) indicates the type of compression defined by the OEM. If the Data Format Identifier value is 0x00 means it indicates no encryption and compression method is used in the data transfer.

File size parameter length – This parameter defines the length in bytes for both parameters file size uncompressed and file size compressed.

File size uncompressed – This parameter defines the size of the uncompressed file.

File size compressed – This parameter defines the size of the compressed file.

Response frame format

There are two types of response frames. That is a positive response and a negative response frame format.

Positive Response
PCI LengthResponse SIDMode of operationLength Data format IDMax No of block lengthData format IDFile size Or Dir Info Parameter LengthFile size uncompressedFile size compressed

Response SID – This indicates a positive response to the request. As we positive response means SID+ 0x40, which means 0x78 for positive response.

Mode of operation – This parameter value is the same as the mode of operation value which we gave in the request message.

Length Data format Identifier – This parameter indicates the max number of block length parameters.

Max Number of block length This parameter indicates the number of data bytes (max number of block length) to include in each Transfer Data request message from the client or how many data bytes the server will include in a transfer data positive response when uploading data.

Data format Identifier – This parameter value is the same as the data format Identifier value which we gave in the request message. If the mode of operation parameter is set to 0x02 (Delete file), the response message will not include this parameter.) If the mode of operation parameter is 0x05 (Read directory), the value of this parameter must be 0x00.

File Size or Directory Info Parameter Length – This parameter indicates the length in bytes for both file size uncompressed or directory info length and file size compressed. If the mode of operation parameter is 0x01 (Add file), 0x02 (Delete file), or 0x03 (Replace file), the response message will not include this parameter.

File size uncompressed or Directory Info Parameter Length – This parameter indicates the length in bytes of the uncompressed file to be uploaded or the length of the directory information to be read in bytes. If the mode of operation parameter is 0x01 (Add file), 0x02 (Delete file), or 0x03 (Replace file), the response message will not include this parameter.

File size compressed – This parameter indicates the size of the compressed file to be uploaded in bytes. If the mode of operation parameter is 0x01 (Add file), 0x02 (Delete file), or 0x03 (Replace file), the response message will not include this parameter.

Negative Response

If the server is not able to execute the request sent by the client, then the ECU will send the negative response code.

PCI Length            7FRequest SID      NRC

Example

Please check the below example for the Request file transfer Service Transition in Upload Download Functional Unit in UDS Protocol,

Supported Negative Response codes

NRCNRC NameDescriptionMnemonics
0x13Incorrect Message length or Invalid formatThis NRC is used when the message length is wrongIML
0x22Condition Not correctThis NRC is used When downloading or uploading data, or when additional prerequisites for executing this service are not met.CNC
0x31Request Out of RangeThis NRC is used in the below situations,
If the data format identifier is not valid,
If the mode of operation is not valid,
If the file size parameter length is not valid,
If the file path and name length are not valid,
File size uncompressed is not valid.
If the specified file size compressed is not valid,
File path and name are not valid
ROOR
0x33Security Access DeniedThis NRC is used When the service doesn’t have the right to access the data SAD
0x70Upload Download not acceptedThis NRC is used When the download or upload is not successfully done due to some uncertain conditionUDNA

You can also read the below tutorials.

Linux Device Driver TutorialsC Programming Tutorials
FreeRTOS TutorialsNuttX RTOS Tutorials
RTX RTOS TutorialsInterrupts Basics
I2C Protocol – Part 1 (Basics)I2C Protocol – Part 2 (Advanced Topics)
STM32 TutorialsLPC2148 (ARM7) Tutorials
PIC16F877A Tutorials8051 Tutorials
Unit Testing in C TutorialsESP32-IDF Tutorials
Raspberry Pi TutorialsEmbedded Interview Topics
Reset Sequence in ARM Cortex-M4BLE Basics
VIC and NVIC in ARMSPI – Serial Peripheral Interface Protocol
STM32F7 Bootloader TutorialsRaspberry PI Pico Tutorials
STM32F103 Bootloader TutorialsRT-Thread RTOS Tutorials
Zephyr RTOS Tutorials – STM32Zephyr RTOS Tutorials – ESP32
AUTOSAR TutorialsUDS Protocol Tutorials
Product ReviewsSTM32 MikroC Bootloader Tutorial
VHDL Tutorials
Subscribe
Notify of
guest

This site uses Akismet to reduce spam. Learn how your comment data is processed.

0 Comments
Inline Feedbacks
View all comments
Table of Contents
Change Privacy