Know-how · Diagnostics
UDS (ISO 14229)
Every manufacturer diagnostic function an ECU exposes — reading faults, running routines, reprogramming — goes through a service identifier defined here.
In short
UDS (Unified Diagnostic Services) is the diagnostic communication protocol defined by ISO 14229. A tester sends a request whose first byte is a service identifier (SID); the ECU replies with a positive response of SID + 0x40, or a negative response (0x7F) carrying a response code. Services cover diagnostic session control, ECU reset, security access, reading and clearing fault memory, reading and writing data by identifier, routine control, and the request/transfer/exit sequence used for reprogramming. UDS is transport-independent: the same services run over CAN with ISO-TP segmentation, over CAN FD, over DoIP on Ethernet, or over LIN and FlexRay. It does not define which data identifiers an ECU supports — that is manufacturer-specific, and is why a UDS implementation is useless without the diagnostic description for the ECU in front of you.
01
What does a UDS request actually look like?
A request is a service identifier followed by parameters. Reading fault memory is service 0x19 (ReadDTCInformation) with a sub-function selecting which report you want. Reading a named value is 0x22 (ReadDataByIdentifier) followed by a two-byte data identifier. A positive response echoes the SID with bit 6 set — 0x22 becomes 0x62 — followed by the payload. A negative response is always 0x7F, the original SID, and a one-byte response code.
Those response codes carry more information than engineers often use. 0x33 (securityAccessDenied) means the request was understood but the session is not unlocked. 0x31 (requestOutOfRange) usually means the identifier does not exist on this ECU. 0x78 (responsePending) is not an error at all — it asks the tester to extend its timeout while the ECU works, and a tester that treats it as a failure will report phantom faults.
- 0x10DiagnosticSessionControl — move between default, programming and extended sessions.
- 0x19ReadDTCInformation — fault memory, status masks, snapshot and extended data.
- 0x22 / 0x2EReadDataByIdentifier / WriteDataByIdentifier — named values by two-byte DID.
- 0x27SecurityAccess — seed and key exchange that unlocks protected services.
- 0x31RoutineControl — start, stop and request results of a defined routine.
- 0x34–0x37RequestDownload, TransferData, RequestTransferExit — the reprogramming sequence.
02
Sessions and security access: why a request stops working
Most UDS services are only available in a particular session. An ECU boots in the default session, where a tester can read identification and fault memory but little else. An extended session unlocks manufacturer functions; a programming session is required before a flash sequence. Sessions time out, so a tester has to send a tester-present message (0x3E) to keep one alive — and a measurement that quietly stops is very often a session that expired.
Security access (0x27) is a seed-and-key exchange: the tester requests a seed, computes a key with an algorithm supplied by the manufacturer, and sends it back. Failed attempts are usually counted and followed by a lockout delay that survives a reset. This is deliberate, and it is why diagnostic work on a protected ECU cannot be done from the standard alone.
- Default sessionIdentification and fault memory; the safe baseline.
- Extended sessionManufacturer services, routines and actuator control.
- Programming sessionRequired before download and transfer services.
- TesterPresent (0x3E)Keeps a non-default session alive while work continues.
03
How is UDS different from OBD-II?
OBD-II is a regulated subset: a fixed set of services and standard PIDs that any compliant vehicle must answer, so that an independent workshop or a roadside inspection can read emissions-relevant data without manufacturer knowledge. UDS is the manufacturer protocol, far larger, and almost entirely manufacturer-defined above the service layer.
In practice both run on the same vehicle, often on the same bus, addressed differently. A diagnostic session that reads an emissions monitor through OBD-II mode 0x06 and reads the same underlying value through a UDS data identifier is reading two views of one ECU. The OBD figure is the one a regulator sees; the UDS figure is usually the one the calibration engineer trusts, because it is the internal quantity rather than the reported one.
04
Reading UDS traffic alongside measurement
A fault that only appears in a particular manoeuvre is a timing question, not a diagnostics question. The useful view puts the diagnostic exchange and the measured signals on one time base: the DTC set-event, the monitor input that triggered it, and the vehicle state at that moment.
DiagAI speaks UDS, OBD-II and J1939 and runs on-premise, so a protected diagnostic session stays inside the network it belongs to. MDX opens the MDF4 recording from the same test so the frame-level exchange and the signal trace can be read together. XHandbook resolves the ECU function behind the identifier when the question becomes why the threshold is what it is.
The instruments
What does what.
- NEURAL DIAGNOSTIC GRAPHDiagAIRun and interpret UDS, OBD-II and J1939 diagnostic sessions on-premise.→
- OSCILLOSCOPE LAB & MCPMDXRead the MDF4 recording with bus traffic and signals on one time base.→
- DOCUMENTATION & MODEL GRAPHXHandbookFind the documented ECU function behind a data identifier or routine.→
Standards & references
Check the source.
These primary sources define the formats and regulatory context discussed above. They do not certify or endorse VehicleLab products.
Questions
Frequently asked.
What does UDS stand for?
Unified Diagnostic Services. It is the diagnostic protocol specified in ISO 14229 and used by essentially every manufacturer for non-regulated diagnostic functions.
What is the difference between UDS and ISO 14229?
They refer to the same thing. ISO 14229 is the standard document; UDS is the protocol it defines. ISO 14229-1 covers the services themselves, with later parts covering the transport mappings.
Does UDS run over CAN only?
No. UDS is transport-independent. Over classical CAN it uses ISO-TP (ISO 15765-2) segmentation; it also runs over CAN FD, over Ethernet via DoIP (ISO 13400), and over LIN and FlexRay.
Why does an ECU answer 0x7F 0x78?
That is responsePending. The ECU understood the request and needs more time. A tester should extend its timeout and wait rather than treat it as a negative result; treating it as an error produces faults that are not there.
Can I read UDS data without a manufacturer description?
Only partly. Standard services and response codes are defined, but the data identifiers, routines and security algorithms are manufacturer-specific. Without the diagnostic description you can see that an identifier responded, not what the value means.
Next step
Open one of your own files with us.
Send a measurement, an A2L or an EHANDBOOK container. We will open it in the instruments on a call, with your engineers in the room.
