Service Interaction Protocol
Routine Control
High Risk: Some routines perform irreversible operations — erasing flash, writing calibration, or driving actuators. Running the wrong routine, or running one with the vehicle in the wrong state, can damage the ECU or the vehicle.
Routine Execution & Result Polling Lifecycle (0x10 ➔ 0x27 ➔ 0x31 01 ➔ 0x31 03)
Automated Actuator Test & Self-Diagnostic Routine Orchestration
Overview
“The RoutineControl service is used by the client to start, stop, or request results for defined execution sequences within the ECU.”
The primary states and control sub-functions of the RoutineControl service.
Interactive Workflows
Step through complete RoutineControl flows — from session setup to result polling — and watch the exact bytes on the wire. Pick a scenario, then play or step through it.
Routine Lifecycle
A routine is a small state machine. Drive a single routine through Start → poll → Stop and see the state, status byte, and progress change live.
Routine Lifecycle Simulator
Pick a routine, then drive it through its FSM states with Start / Poll / Stop.
Routine
Duration: 2000 ms
State
Progress
0%Last Frame
Sub-Functions
| SubFunc | Name | Description |
|---|---|---|
| 0x01 | Start Routine | Begin executing the specified routine |
| 0x02 | Stop Routine | Abort a running routine (if stoppable) |
| 0x03 | Request Routine Results | Get the status/results of a routine |
Routine Identifiers
The Routine Identifier (RID) is a 16-bit value (0x0000–0xFFFF) sent big-endian. Search and filter the standard range conventions, and see the session/security each category needs.
Routine Identifier (RID) Ranges
RIDs are ECU-configured (config.routines); the ranges below are ISO conventions, not a fixed list.
9 ranges
OEM-specific
Network configuration
Programming prerequisites
Diagnostic-connector routines
OEM-specific
Message Structure
Select a frame and inspect each byte. The positive response echoes the sub-function and RID, then carries a routine-specific status record.
◆ PROTOCOL ANATOMY
0x31 ROUTINE CONTROL
0x31 RESPONSE
Response Suppression Logic (SPRMIB)
Setting bit 7 of the sub-function byte (0x81 = 0x01 | 0x80) starts the routine execution silently without transmitting a 0x71 positive response frame.
!Critical: NRC 0x7F bypasses suppression logic and will always broadcast.
Session & Security
Session & Security Matrix
Which routine categories run in each session, and which need a security unlock. Select a row for details.
| Routine type | DEFAULT 0x01 | EXTENDED 0x03 | PROGRAMMING 0x02 | Security |
|---|---|---|---|---|
| ✓ | ✓ | ✓ | — | |
| ✗ | ✓ | ✓ | — | |
| ✗ | ✓ | ✓ | required | |
| ✗ | ✓ | ✓ | required | |
| ✗ | ✗ | ✓ | required | |
| ✗ | ✗ | ✓ | required | |
| ✗ | ✗ | ✓ | required |
Session Timeout (S3): Extended and Programming sessions time out after 5 seconds with no tester activity. Send TesterPresent (0x3E) every 2–3 seconds during long-running routines to keep the session alive.
Security State Behavior
Safe self-diagnostic and read-only test routines can execute without security access. Actuator driver activations, memory erasure (RID 0xFF00), and calibration writes return NRC 0x33 (SecurityAccessDenied) when locked.
All routines mapped to the active security level can be initiated, stopped, or polled.
Triggered when this service or requested resource requires an active security unlock that has not been granted.
Triggered during unlock attempts if the calculated key fails ECU cryptographic verification.
Enforced delay lockout if the maximum number of failed key submissions (typically 3) has been exceeded.
Service Dependencies
0x31 starts, stops, and queries results for on-demand actuator tests, flash memory erase, and calibration routines. Select a node to inspect interactions.
TX/RX Examples
Successful: Start, then poll to completion
Start a self-test, then request results until it completes.
Routine Started
> Status 0x00 = Started / In Progress
Completed
> Status 0x01 = Completed (pass)
Successful: Long routine with result polling
A long-running erase that needs repeated polling.
Routine Started
> Status 0x00 = Started / In Progress
Still In Progress
> Status 0x00 = Still in progress
Completed
> Status 0x01 = Completed
Stop a running routine
Abort a running routine before it completes.
Stop Routine
Routine Stopped
> Status 0x00 — routine returns to idle
Error: Request Sequence Error
Requesting results for a routine that was never started.
Request Results (Not Started)
Negative Response
> NRC 0x24: Request Sequence Error
Error: Security Access Denied
A protected routine requires a security unlock.
Start Protected Routine
Negative Response
> NRC 0x33: Security Access Denied
Error: Request Out Of Range
Unknown routine identifier.
Unknown Routine
Negative Response
> NRC 0x31: Request Out Of Range
Workflow Diagrams
Workflow 1: Simple Actuator Test (No Security)
Extended Session → Start Test → Get Results
6 stepsWorkflow 2: Secured Calibration Routine (30s)
Extended → Unlock → Start → Keep Alive → Poll → Done
16 stepsWorkflow 3: Memory Erase Before Flash Programming
Programming → Unlock → Erase → Poll → Download
12 stepsWorkflow 4: Routine Cancellation
Start → User Stops → Routine Returns to Idle
8 stepsWorkflow 5: Failure → Read DTCs → Clear → Retry
Routine Fails, Diagnose, Clear, Retry
12 stepsRoutine Status Codes
| Status Byte | Meaning | Notes |
|---|---|---|
| 0x00 | In Progress / Started | Returned by Start, and by Request Results while still running |
| 0x01 | Completed | Returned by Request Results after the routine finishes |
This simulator’s conventions: Stop returns status 0x00 and leaves the routine idle (ready to start again). A routine that fails surfaces as NRC 0x72 (generalProgrammingFailure) on Request Results — not as a status byte. The routineStatusRecord format is manufacturer-specific in ISO 14229-1; real ECUs may define richer status records.
Timing Parameters
| Parameter | Value | Use |
|---|---|---|
| P2 (Normal Response) | 50 ms | Standard request-response timeout |
| P2* (Extended Response) | 5000 ms | Long-running operations (memory erase, calibration) |
| S3 (Session Timeout) | 5000 ms | Session expires without tester activity |
| Tester Present Interval | 2000–3000 ms | Keep-alive frequency during routines |
| Security Timeout | 10000 ms | Security access expires if not used |
ISO 14229-1 References
Standard: ISO 14229-1:2020, Section 9.5 — RoutineControl Service
The flash routines live here. RIDs 0xFF00 erase, 0xFF01 integrity, 0xFF02 verify-programming and 0xFF03 activate-flash-driver are manufacturer-defined routines this simulator uses during reprogramming. They share one option record and three of them answer with a deferred 0x78 — see ECU Flashing & Reprogramming.
Compliance Requirements
- Minimum request length: 4 bytes (SID + SubFunction + RID)
- Minimum positive response length: 4 bytes (Response SID + SF + RID)
- SubFunction parameter range: 0x01–0x03 (only three values defined)
- RID parameter range: 0x0000–0xFFFF (manufacturer-defined)
- Option record (request) is optional, routine-specific
- Status record (response) is optional, routine-specific
Related ISO Sections
| Section | Topic |
|---|---|
| 9.3 | DiagnosticSessionControl (prerequisite) |
| 9.4 | SecurityAccess (for protected routines) |
| 9.6 | CommunicationControl |
| 9.11 | TesterPresent (keep-alive) |
| 10.1 | NRC definitions (Annex B) |
| Annex A | Routine identifier ranges |
Negative Response Codes (NRCs)
EXCEPTION_MATRIX_V3
The routine sub-function is invalid. Only 0x01 (start), 0x02 (stop), and 0x03 (requestResults) are valid.
This negative response indicates a rejection while processing the Routine Control (SID 0x31) request. Verify preconditions, session levels, and message formatting per ISO 14229.
Troubleshooting Guide
Troubleshooting Guide
Click any issue to expand diagnosis steps and resolution.
Quick Reference & Best Practices
RoutineControl
Execute, stop, and query named ECU routines
Sub-functions
startRoutine
Begin executing the routine
stopRoutine
Abort a running routine (if stoppable)
requestRoutineResults
Poll status / get results
Key Facts
- Service ID
- 0x31
- Positive Response
- 0x71
- Min request length
- 4 bytes (SID + SF + 2-byte RID)
- RID
- 16-bit, big-endian (0x0000–0xFFFF)
- Typical session
- EXTENDED (0x03) / PROGRAMMING (0x02)
- ISO ref
- ISO 14229-1:2020 §9.5