Unified Diagnostic Services (UDS) — ISO 14229
Unified Diagnostic Services (UDS) is a communication protocol defined by the ISO 14229 standard, widely used in the automotive industry to enable diagnostic communication between an external test equipment (client) and the electronic control units (ECUs) embedded in a vehicle (server).
UDS operates on top of transport protocols such as CAN, DoIP (Diagnostics over IP), or FlexRay, and provides a standardized set of services for tasks like reading and clearing diagnostic trouble codes (DTCs), accessing ECU data by identifier, controlling I/O, uploading or downloading data, and managing diagnostic sessions and security access.
In the vast majority of cases, UDS is used over CAN (Controller Area Network). However, a standard CAN frame is limited to 8 bytes of payload, which is often insufficient for UDS messages. To overcome this limitation, the transport protocol is used as an intermediate layer between CAN and UDS. ISO-TP handles segmentation and reassembly of messages: when a UDS message exceeds 8 bytes, ISO-TP splits it into multiple CAN frames (First Frame, followed by Consecutive Frames), and uses Flow Control frames to manage the transmission rate between sender and receiver. For messages that fit within a single CAN frame, ISO-TP uses a Single Frame with a one-byte header indicating the payload length.
Communication follows a request-response model: the client sends a request message identified by a Service ID (SID), and the server replies with either a positive response (SID + 0x40) containing the requested data, or a negative response (0x7F) with a Negative Response Code (NRC) indicating the reason for failure.
The following section documents each UDS service with its request and response parameters, possible values, and supported NRCs.
Services
DiagnosticSessionControl (0x10)
The DiagnosticSessionControl service Used to change diagnostic sessions in the server(s). In each diagnostic session a different set of diagnostic services and/or functionalities is enabled in the server. The default session is always active after power-on or reset.
0x12
0x13
0x22
Request
DiagnosticSessionControl SID0x10 suppressPosRspMsgIndicationBitBit 7 of the sub-function byte. If set to 1, the server shall not send a positive response message. diagnosticSessionTypeSub-function parameter used to select the specific diagnostic session behavior of the server.Positive response
DiagnosticSessionControl SID0x50 suppressPosRspMsgIndicationBit diagnosticSessionType P2Server_maxMaximum time (in ms) the server requires to start with the response message after the reception of a request message.0x0000-0xFFFF P2StarServer_maxMaximum time (in ms, 10 ms resolution) the server requires to start with the response message after the transmission of a negative response with NRC 0x78 (requestCorrectlyReceivedResponsePending).0x0000-0xFFFFECUReset (0x11)
The ECUReset service Used by the client to request that the server perform a reset of the ECU. The server performs the specified type of reset after sending the positive response.
0x12
0x13
0x22
0x33
Request
ECUReset SID0x11 suppressPosRspMsgIndicationBitBit 7 of the sub-function byte. If set to 1, the server shall not send a positive response message. resetTypeSub-function parameter that defines the type of reset to be performed by the server.Positive response
ECUReset SID0x51 suppressPosRspMsgIndicationBit resetType powerDownTimeTime (in seconds) the server requires to complete the power down sequence. Only present when resetType is enableRapidPowerShutDown (0x04). Value 0xFF means the time is not available.Optional0x00-0xFFClearDiagnosticInformation (0x14)
The ClearDiagnosticInformation service Used by the client to clear Diagnostic Trouble Codes (DTCs) and all related diagnostic data stored in the server. This service has no sub-function parameter, so the suppressPosRspMsgIndicationBit is not available.
0x13
0x22
0x31
0x72
Request
ClearDiagnosticInformation SID0x14 groupOfDTCDefines the group of Diagnostic Trouble Codes that shall be cleared by the server. A 3-byte value identifying the DTC group (diagnostic domain) or all DTCs. MemorySelectionSelects a specific DTC memory from which diagnostic information shall be cleared. Optional parameter introduced in ISO 14229-1:2020.Optional0x00-0xFFPositive response
ClearDiagnosticInformation SID0x54ReadDTCInformation (0x19)
The ReadDTCInformation service Enables the client to retrieve Diagnostic Trouble Code (DTC) information from one or more servers. The reportType sub-function determines the type of DTC data returned.
0x12
0x13
0x31
Request
ReadDTCInformation SID0x19 suppressPosRspMsgIndicationBitBit 7 of the sub-function byte. When set to 1, the server will not send a positive response.0x01 DTCStatusMaskSpecifies which DTC status bits shall be used to filter matching DTCs.0x00-0xFFPositive response
ReadDTCInformation SID0x59 suppressPosRspMsgIndicationBit0x01 DTCStatusAvailabilityMaskIndicates which DTC status bits are supported by the server.0x00-0xFF DTCFormatIdentifierIdentifies the DTC format used by the server when encoding Diagnostic Trouble Codes. DTCCountNumber of stored DTCs that match the requested status mask criteria.0x0000-0xFFFFn = Number of DTC records
m = Number of DID/data pairs in snapshot record
ReadDataByIdentifier (0x22)
The ReadDataByIdentifier service Allows the client to retrieve data values associated with one or more Data Identifiers (DIDs) from the server.
0x12
0x13
0x31
Request
ReadDataByIdentifier SID0x22 dataIdentifierTwo-byte identifier specifying which data value to read from the server.0x0000-0xFFFFn = Number of data identifiers to read in a single request
Positive response
ReadDataByIdentifier SID0x62 dataIdentifierEchoed identifier indicating which data value follows.0x0000-0xFFFF dataRecordData value associated with the preceding data identifier.0x0000000000000000000000000-0x8000000000000000000000000n = Number of data identifier / data record pairs in the response
ReadMemoryByAddress (0x23)
The ReadMemoryByAddress service Allows the client to read a block of data from a specific memory location in the server.
0x13
0x22
0x31
Request
ReadMemoryByAddress SID0x23 memorySizeLengthSpecifies the byte length of the memory size field.0x0-0xF memoryAddressLengthSpecifies the byte length of the memory address field.0x0-0xF memoryAddressStarting address of the memory block to read.0x00-0xFF memorySizeNumber of bytes to read from the specified memory address.0x00-0xFFn = value of memoryAddressLength
m = value of memorySizeLength
Positive response
ReadMemoryByAddress SID0x63 dataRecordData bytes read from the specified memory location.0x00-0xFFm = Number of data bytes read from memory
SecurityAccess (0x27)
The SecurityAccess service Provides access to security-protected diagnostic services and data through a seed-and-key authentication mechanism.
0x12
0x13
0x22
0x24
0x31
0x35
0x36
0x37
Request
SecurityAccess SID0x27 suppressPosRspMsgIndicationBitBit 7 of the sub-function byte. When set to 1, the server will not send a positive response.0x01 securityAccessDataAdditional client identification data that the server verifies during the seed request.Optional0x00-0xFFn = Length of security access data (in bytes)
m = Length of security key (in bytes)
Positive response
SecurityAccess SID0x67 suppressPosRspMsgIndicationBit0x01 securitySeedChallenge value generated by the server, used by the client to compute the access key.0x00-0xFFn = Length of security seed (in bytes)
CommunicationControl (0x28)
The CommunicationControl service Allows the client to manage the communication behavior of the server by enabling or disabling specific message types on selected networks.
0x12
0x13
0x22
0x31
Request
CommunicationControl SID0x28 suppressPosRspMsgIndicationBitBit 7 of the sub-function byte. When set to 1, the server will not send a positive response.0x00 networksIdentifies the sub-networks on which the communication control applies. messageTypeIdentifies the category of messages to be controlled.Positive response
CommunicationControl SID0x68 suppressPosRspMsgIndicationBit0x00ReadDataByPeriodicIdentifier (0x2A)
The ReadDataByPeriodicIdentifier service Allows the client to schedule periodic transmission of data identified by one or more periodic identifiers. The server sends data at the requested rate until instructed to stop.
0x13
0x22
0x31
0x33
Request
ReadDataByPeriodicIdentifier SID0x2A0x01 periodicDataIdentifierSpecifies the identifier of the data to be periodically transmitted.0x00-0xFFn = Number of periodic data identifiers to schedule
Positive response
ReadDataByPeriodicIdentifier SID0x6ADynamicallyDefineDataIdentifier (0x2C)
The DynamicallyDefineDataIdentifier service Allows the client to create custom data identifiers by combining parts of existing identifiers or by referencing memory addresses.
0x12
0x13
0x22
0x31
0x33
Request
DynamicallyDefineDataIdentifier SID0x2C suppressPosRspMsgIndicationBitBit 7 of the sub-function byte. When set to 1, the server will not send a positive response.0x01 dynamicallyDefinedDataIdentifierSpecifies the 2-byte identifier to assign to the new dynamic data definition.0x0000-0xFFFF sourceDataIdentifierIdentifies the existing data source from which to extract data.0x0000-0xFFFF positionInSourceDataRecordByte position within the source data record where extraction begins.0x00-0xFF memorySizeNumber of bytes to extract from the source data record.0x00-0xFFn = Number of source DID groups to concatenate
m = value of memoryAddressLength
k = value of memorySizeLength
Positive response
DynamicallyDefineDataIdentifier SID0x6C suppressPosRspMsgIndicationBit0x01 dynamicallyDefinedDataIdentifier0x0000-0xFFFFWriteDataByIdentifier (0x2E)
The WriteDataByIdentifier service Allows the client to write a data value to a specific Data Identifier (DID) on the server.
0x13
0x21
0x31
0x33
0x72
Request
WriteDataByIdentifier SID0x2E dataIdentifierTwo-byte identifier specifying the target data record to write.0x0000-0xFFFF dataData bytes to write to the specified data identifier.0x00-0xFFn = Length of data to write (in bytes)
Positive response
WriteDataByIdentifier SID0x6E dataIdentifier0x0000-0xFFFFInputOutputControlByIdentifier (0x2F)
The InputOutputControlByIdentifier service Allows the client to control input/output signals of the server by specifying a Data Identifier and a control action.
0x13
0x22
0x31
0x33
Request
InputOutputControlByIdentifier SID0x2F dataIdentifierTwo-byte identifier of the I/O function to control.0x0000-0xFFFF0x00n = Number of control state bytes
m = Number of control enable mask bytes
Positive response
InputOutputControlByIdentifier SID0x6F dataIdentifier0x0000-0xFFFF0x00 controlStateCurrent state of the controlled I/O function.0x00-0xFFn = Number of control state bytes
RoutineControl (0x31)
The RoutineControl service Allows the client to start, stop, or request results of a server-side routine identified by a Routine Identifier (RID).
0x12
0x13
0x22
0x24
0x31
0x33
0x72
Request
RoutineControl SID0x31 suppressPosRspMsgIndicationBitBit 7 of the sub-function byte. When set to 1, the server will not send a positive response.0x01 routineIdentifierTwo-byte identifier of the routine to control.0x0000-0xFFFF routineControlOptionAdditional input parameters required by the routine.Optional0x00-0xFFn = Number of routine option bytes
Positive response
RoutineControl SID0x71 suppressPosRspMsgIndicationBit0x01 routineIdentifier0x0000-0xFFFF routineStatusOutput data or status information returned by the routine.Optional0x00-0xFFn = Number of routine status bytes
RequestDownload (0x34)
The RequestDownload service Initiates a data download sequence by requesting the server to prepare for receiving data at the specified memory location.
0x13
0x22
0x31
0x33
0x70
Request
RequestDownload SID0x34 compressionMethodSpecifies the compression algorithm applied to the data being transferred. encryptingMethodSpecifies the encryption algorithm applied to the data being transferred. memorySizeLengthSpecifies the byte length of the memory size field.0x0-0xF memoryAddressLengthSpecifies the byte length of the memory address field.0x0-0xF memoryAddressTarget memory address where the downloaded data will be stored.0x00-0xFF memorySizeTotal number of bytes to be downloaded.0x00-0xFFn = value of memoryAddressLength
m = value of memorySizeLength
Positive response
RequestDownload SID0x74 reserved0x0-0xF maxNumberOfBlockLengthBytesNumberNumber of bytes used to encode the maxNumberOfBlockLength value.0x0-0xF maxNumberOfBlockLengthMaximum number of data bytes the server can receive per TransferData request.0x00-0xFFm = value of maxNumberOfBlockLengthBytesNumber
RequestUpload (0x35)
The RequestUpload service Initiates a data upload sequence by requesting the server to prepare for sending data from the specified memory location.
0x13
0x22
0x31
0x33
0x70
Request
RequestUpload SID0x35 compressionMethodSpecifies the compression algorithm applied to the data being transferred. encryptingMethodSpecifies the encryption algorithm applied to the data being transferred. memorySizeLengthSpecifies the byte length of the memory size field.0x0-0xF memoryAddressLengthSpecifies the byte length of the memory address field.0x0-0xF memoryAddressSource memory address from which data will be uploaded.0x00-0xFF memorySizeTotal number of bytes to be uploaded.0x00-0xFFn = value of memoryAddressLength
m = value of memorySizeLength
Positive response
RequestUpload SID0x75 reserved0x0-0xF maxNumberOfBlockLengthBytesNumberNumber of bytes used to encode the maxNumberOfBlockLength value.0x0-0xF maxNumberOfBlockLengthMaximum number of data bytes the server can send per TransferData response.0x00-0xFFn = value of maxNumberOfBlockLengthBytesNumber
TransferData (0x36)
The TransferData service Transfers data blocks between client and server during an active download or upload sequence initiated by RequestDownload or RequestUpload.
0x13
0x24
0x31
0x71
0x72
0x73
0x92
0x93
Request
TransferData SID0x36 blockSequenceCounterSequence counter that increments with each TransferData message to ensure proper ordering.0x00-0xFF transferRequestParameterData bytes sent by the client during a download sequence.Optional0x00-0xFFn = Number of transfer data bytes
Positive response
TransferData SID0x76 blockSequenceCounter0x00-0xFF transferResponseParameterData bytes returned by the server during an upload sequence.Optional0x00-0xFFn = Number of transfer response bytes
RequestTransferExit (0x37)
The RequestTransferExit service Terminates an active download or upload sequence previously initiated by RequestDownload or RequestUpload.
0x13
0x24
0x31
0x72
Request
RequestTransferExit SID0x37 transferRequestParameterOptional completion data provided by the client (vehicle manufacturer specific).Optional0x00-0xFFn = Number of transfer request parameter bytes
Positive response
RequestTransferExit SID0x77 transferResponseParameterOptional status or result data returned by the server (vehicle manufacturer specific).Optional0x00-0xFFn = Number of transfer response parameter bytes
RequestFileTransfer (0x38)
The RequestFileTransfer service Allows the client to perform file system operations on the server, such as adding, deleting, replacing, reading, or resuming files and directories.
0x13
0x22
0x31
0x33
0x70
Request
RequestFileTransfer SID0x380x01 filePathAndNameLengthByte length of the filePathAndName field.0x0000-0xFFFF filePathAndNameUTF-8 encoded path and name of the target file or directory.0x00-0xFF compressionMethodCompression algorithm applied to the file data. encryptingMethodEncryption algorithm applied to the file data. fileSizeParameterLengthByte length of each file size field (fileSizeUnCompressed and fileSizeCompressed).0x00-0xFF fileSizeUnCompressedSize in bytes of the uncompressed file.0x00-0xFF fileSizeCompressedSize in bytes of the compressed file.0x00-0xFFn = value of filePathAndNameLength
m = value of fileSizeParameterLength
Positive response
RequestFileTransfer SID0x780x01 lengthFormatIdentifierByte length of the maxNumberOfBlockLength field.0x00-0xFF maxNumberOfBlockLengthMaximum number of data bytes per TransferData message.0x00-0xFF compressionMethodCompression algorithm selected by the server. encryptingMethodEncryption algorithm selected by the server.n = value of lengthFormatIdentifier
m = value of fileSizeOrDirInfoParameterLength
WriteMemoryByAddress (0x3D)
The WriteMemoryByAddress service Allows the client to write a block of data to a specific memory location in the server.
0x13
0x22
0x31
0x33
0x72
Request
WriteMemoryByAddress SID0x3D memorySizeLengthSpecifies the byte length of the memory size field.0x0-0xF memoryAddressLengthSpecifies the byte length of the memory address field.0x0-0xF memoryAddressTarget memory address where data will be written.0x00-0xFF memorySizeNumber of bytes to write at the specified address.0x00-0xFF dataData bytes to write to memory.0x00-0xFFn = value of memoryAddressLength
m = value of memorySizeLength
k = Number of data bytes to write
Positive response
WriteMemoryByAddress SID0x7D memorySizeLength0x0-0xF memoryAddressLength0x0-0xF memoryAddressTarget memory address where data will be written.0x00-0xFF memorySizeNumber of bytes to write at the specified address.0x00-0xFFTesterPresent (0x3E)
The TesterPresent service Signals to the server that the diagnostic client is still connected, preventing the current session from timing out.
0x13
0x22
0x31
0x33
0x72
Request
TesterPresent SID0x3E suppressPosRspMsgIndicationBitBit 7 of the sub-function byte. When set to 1, the server will not send a positive response. zeroSubFunctionSub-function value fixed to zero (no additional behavior).Positive response
TesterPresent SID0x7E suppressPosRspMsgIndicationBit zeroSubFunctionSecuredDataTransmission (0x84)
The SecuredDataTransmission service Wraps any UDS service request in a secured envelope, providing encryption, signing, and anti-replay protection for sensitive diagnostic operations.
0x13
Request
SecuredDataTransmission SID0x84 reservedReserved bits, fixed to zero. reservedReserved bits, fixed to zero. signatureRequestedIndicates whether the server should include a signature in the response. isSignedIndicates whether this message includes a digital signature. isEncryptedIndicates whether the payload of this message is encrypted. preEstablishedKeyUsedIndicates whether a previously established encryption key is reused for this message. reservedReserved bits, fixed to zero. isRequestMessageIndicates this is a request message (always set to 1 for requests). SignatureEncryptionCalculationIdentifies the cryptographic algorithms used for signing and encryption.0x00-0xFF signatureLengthByte length of the signature field appended to the message.0x0000-0xFFFF antiReplayCounterMonotonic counter value used to detect and prevent replay attacks.0x0000-0xFFFF internalMessageServiceRequestIDService Identifier (SID) of the UDS service being secured.0x00-0xFF serviceSpecificParametersPayload bytes of the secured UDS service request.Optional0x00-0xFF signatureDigital signature computed over the message content.Optional0x00-0xFFn = Number of service-specific parameter bytes
m = value of signatureLength
Positive response
SecuredDataTransmission SID0xC4 reservedReserved bits, fixed to zero. reservedReserved bits, fixed to zero. signatureRequestedIndicates whether a signature was requested. isSignedIndicates whether this response includes a digital signature. isEncryptedIndicates whether the response payload is encrypted. preEstablishedKeyUsedIndicates whether a previously established encryption key was used. reservedReserved bits, fixed to zero. isRequestMessageIndicates this is a response message (always set to 0 for responses). SignatureEncryptionCalculationIdentifies the cryptographic algorithms used for signing and encryption.0x00-0xFF signatureLengthByte length of the signature field appended to the response.0x0000-0xFFFF antiReplayCounterMonotonic counter value for replay attack prevention.0x0000-0xFFFF internalMessageServiceResponseIDService Identifier (SID + 0x40) of the secured UDS service response.0x00-0xFF serviceSpecificParametersPayload bytes of the secured UDS service response.Optional0x00-0xFF signatureDigital signature computed over the response content.Optional0x00-0xFFn = Number of service-specific parameter bytes
m = value of signatureLength
ControlDTCSetting (0x85)
The ControlDTCSetting service Allows the client to instruct the server to stop or resume updating DTC status bits in its memory.
0x12
0x13
0x22
Request
ControlDTCSetting SID0x85 suppressPosRspMsgIndicationBitBit 7 of the sub-function byte. When set to 1, the server will not send a positive response. DTCSettingTypeDetermines whether DTC status updating is enabled or disabled. DTCSettingControlOptionRecordOptional vehicle manufacturer specific control parameters.Optional0x00-0xFFn = Number of DTC setting control option bytes
Positive response
ControlDTCSetting SID0xC5 suppressPosRspMsgIndicationBit DTCSettingTypeLinkControl (0x87)
The LinkControl service Allows the client to verify and switch the communication link baudrate between the client and the server.
0x12
0x13
0x22
0x24
0x31
Request
LinkControl SID0x87 suppressPosRspMsgIndicationBitBit 7 of the sub-function byte. When set to 1, the server will not send a positive response.0x01 linkControlModeIdentifierPositive response
LinkControl SID0xC7 suppressPosRspMsgIndicationBit0x01