Services[edit]

SID (Service Identifier)

Function Request   Response  

Service Description
group SID SID

Diagnostic UDS uses different operating

and sessions, which can be
Communicati changed using the
ons "Diagnostic Session Control".
Management Depending on which session
is active, different services
are available. On start, the
control unit is by default in the
"Default Session". Other
sessions are defined, but are
not required to be
implemented depending on
the type of device:

Diagnostic  "Programming Session"

0x10 0x50 Session used to upload software.
Control  "Extended Diagnostic
Session" used to unlock
additional diagnostic
functions, such as the
adjustment of sensors.
 "Safety system diagnostic
session" used to test all
safety-critical diagnostic
functions, such as airbag
tests.
In addition, there are reserved
session identifiers that can be
defined for vehicle
manufacturers and vehicle
suppliers specific use.

0x11 0x51 ECU Reset The service "ECU reset" is

used to restart the control unit
(ECU). Depending on the
control unit hardware and
implementation, different
forms of reset can be used:

 "Hard Reset" simulates a

shutdown of the power
Function Request   Response  
Service Description
group SID SID

supply.
 "key off on Reset"
simulates the drain and
turn on the ignition with
the key.
 "Soft Reset" allows the
initialization of certain
program units and their
storage structures.
Again, there are reserved
values that can be defined for
vehicle manufacturers and
vehicle suppliers specific use.

Security check is available to

enable the most security-
critical services. For this
purpose a "Seed" is
generated and sent to the
Security
0x27 0x67 client by the control unit. From
Access
this "Seed" the client has to
compute a "Key" and send it
back to the control unit to
unlock the security-critical
services.
With this service, both the
Communicati sending and receiving of
0x28 0x68
on Control messages can be turned off in
the control unit.
An update (2020) of the
standard added this service to
provide a standardized
approach to more modern
methods of authentication
Authenticatio
0x29 0x69 than are permitted by the
n
Security Access (0x27)
service, including
bidirectional authentication wit
h PKI-based Certificate
Exchange.
0x3E 0x7E Tester If no communication is
Present exchanged with the client for
a long time, the control unit
automatically exits the current
session and returns to the
 Function Request   Response  
Service Description
group SID SID

"Default Session" back, and

might go to sleep mode.
Therefore, there is an extra
service which purpose is to
signal to the device that the
client is still present.
In the communication
between the controllers and
the client, certain times must
be observed. If these are
Access
exceeded, without a message
0x83 0xC3 Timing
being sent, it must be
Parameters
assumed that the connection
was interrupted. These times
can be called up and
changed.
Secured
Data
0x84 0xC4
Transmissio
n
Enable or disable the
detection of any or all errors.
This is important when
Control DTC
0x85 0xC5 diagnostic work is performed
Settings
in the car, which can cause
an anomalous behavior of
individual devices.
Response
0x86 0xC6
On Event
The Service Link Control is
used to set the baud rate of
0x87 0xC7 Link Control the diagnostic access. It is
usually implemented only at
the central gateway.
Data 0x22 0x62 Read Data With this service, it is possible
Transmission By Identifier to retrieve one or more values
of a control unit. This can be
information of all kinds and of
different lengths such as
Partnumber or the software
version. Dynamic values such
as the current state of the
sensor can be queried. Each
value is associated to a Data
Identifier (DID) between 0 and
Function Request   Response  
Service Description
group SID SID

65535. Normal CAN signals

are meant for information that
some ECU uses in its
functionality. DID data is sent
on request only, and is for
information that no ECU uses,
but a service tool or a
software tester can benefit
from.
Read data from the physical
memory at the provided
Read
address. This function can be
0x23 0x63 Memory By
used by a testing tool, in order
Address
to read the internal behaviour
of the software.
Read
0x24 0x64 Scaling Data
By Identifier
With this service, values are
sent periodically by a control
Read Data
unit. The values to be sent
0x2A 0x6A By Identifier
must be defined to only using
Periodic
the "Dynamically Define Data
Identifier".
0x2C 0x6C Dynamically This service offers the
Define Data possibility of a fix for a device
Identifier specified Data Identifier (DID)
pool to configure another
Data Identifier. This is usually
a combination of parts of
different DIDs or simply a
concatenation of complete
DIDs.
The requested data may be
configured or grouped in the
following manner:

 Source DID, position,

length (in bytes), Sub-
Function Byte:
defineByIdentifier
 Memory address length
(in bytes), Sub-Function
Byte:
defineByMemoryAddress
 Function Request   Response  
Service Description
group SID SID

 Combinations of the two

above methods through
multiple requests.
With the same Data Identifier
(DID), values can also be
Write Data
0x2E 0x6E changed. In addition to the
By Identifier
identifier, the new value is
sent along.
The “Write Memory By
Address” service allows the
Write
external diagnostic tool to
0x3D 0x7D Memory By
write information into the ECU
Address
at one or more contiguous
memory locations.
Clear
0x14 0x54 Diagnostic Delete all stored DTC
Information
DTC stands for "Diagnostic
Trouble Codes". Each DTC
Stored Data handled by the control unit
Transmission fault is stored with its own
Read DTC code in the error memory and
0x19 0x59
Information can be read at any time. In
addition to the error,
additional information will be
stored, which can also be
read.
Input / Output 0x2F 0x6F Input Output This service allows an
Control Control By external system intervention
Identifier on internal / external signals
via the diagnostic interface.
By specifying a so-called
option bytes additional
conditions for a request can
be specified, the following
values are specified:
ReturnControlToECU: The
device must get back controls
of the mentioned signals.
ResetToDefault: The tester
prompts to reset signals to the
system wide default value.
Freeze Current State: The
device shall freeze the current
 Function Request   Response  
Service Description
group SID SID

signal value.
ShortTermAdjustment: The
device shall use the provided
value for the signal

Control routine services of all

kinds can be performed.
There are three different
message types:

 With the start-message, a

service can be initiated. It
can be defined to confirm
the beginning of the
execution or to notify
when the service is
Remote
Routine completed.
Activation of 0x31 0x71
Control  With the Stop message, a
Routine
running service can be
interrupted at any time.
 The third option is a
message to query the
results of the service.
The start and stop message
parameters can be specified.
This makes it possible to
implement every possible
project-specific service.

Upload / Downloading new software or

Download other data into the control unit
is introduced using the
Request "Request Download". Here,
0x34 0x74
Download the location and size of the
data is specified. In turn, the
controller specifies how large
the data packets can be.
0x35 0x75 Request The service "request upload"
Upload is almost identical to the
service "Request Download".
With this service, the software
from the control unit is
transferred to the tester. The
location and size must be
specified. Again, the size of
the data blocks are specified
Function Request   Response  
Service Description
group SID SID

by the tester.
For the actual transmission of
data, the service "Transfer
Data" is used. This service is
used for both uploading and
downloading data. The
transfer direction is notified in
advance by the service
"Request Download" or
Transfer "Upload Request". This
0x36 0x76
Data service should try to send
packets at maximum length,
as specified in previous
services. If the data set is
larger than the maximum, the
"Transfer Data" service must
be used several times in
succession until all data has
arrived.
A data transmission can be
'completed' when using the
"Transfer Exit" service. This
service is used for
comparison between the
control unit and the tester.
When it is running, a control
Request
0x37 0x77 unit can answer negatively on
Transfer Exit
this request to stop a data
transfer request. This will be
used when the amount of
data (set in "Request
Download" or "Upload
Request") has not been
transferred.
This service is used to initiate
a file download from the client
to the server or upload from
Request File
0x38 0x78 the server to the client.
Transfer
Additionally information about
the file system are available
by this service.
0x7F Negative This response is given when
Response a service request could not be
performed, for example
having a not supported Data
Identifier. A Negative
Function Request   Response  
Service Description
group SID SID

Response Code will be

included.