Service Interaction Protocol

Routine Control

0x31

Protocol Identifier

The RoutineControl service is used to execute defined sequences of instructions (routines) within the ECU. Used for memory erasure, self-tests, and complex calibration sequences.

A Service Identifier (SID) is a single-byte value (0x00–0xFF) in position 0 of every UDS request frame. It specifies which diagnostic operation the client wishes the ECU to execute. The positive response echoes the SID with the high bit set (SID + 0x40).

SERVICE_ACCESS

EXTENDED

Usually requires Extended Diagnostic Session (0x03) for critical routines like memory erase.

PROTOCOL_LAYER

APPLICATION

Complex state-dependent service. Requires active session maintenance via TesterPresent.

RID_SIZE

2 BYTES

Routine Identifiers are 16-bit values following the request sub-function byte.

Overview

ISO 14229-1

“The RoutineControl service is used by the client to start, stop, or request results for defined execution sequences within the ECU.”

Click to Enlarge

The primary states and control sub-functions of the RoutineControl service.

Default Behavior

By default, no routines are active or running within the ECU. Service 0x31 is primarily available in the Extended Diagnostic Session (0x03) or Programming Session (0x02). State transitions (like reset or session timeout) will automatically abort any running routines to ensure system safety.

Sub-Functions

SubFunc	Name	Description
0x01	Start Routine	Begin executing the specified routine
0x02	Stop Routine	Abort a running routine (if stoppable)
0x03	Request Routine Results	Get the status/results of a routine

Interactions & Common Routines

Prerequisites

DiagnosticSessionControl (0x10) - Most routines require Extended (0x03) session
SecurityAccess (0x27) - Protected routines require security unlock
TesterPresent (0x3E) - Maintain session during long-running routines

Common Routines

0xFF00 - Erase Flash Memory (Prerequisite for Download (0x34))
0x0203 - Check Programming Dependencies
0x0202 - Check Memory (Post-requisite for Transfer Data (0x36))
0x0301 - Actuator Self-Test

Message Format

Byte	Field	Value	Description
0	SID	0x31	RoutineControl
1	Sub-Function	0x01-0x03	Start, Stop, or Request Results
2-3	Routine ID	0xXXXX	2-byte Routine Identifier
4-N	Option Record	...	Optional routine parameters

◆ PROTOCOL ANATOMY

View

REQUEST_TX

0x31 ROUTINE CONTROL

RESPONSE_RX

0x31 RESPONSE

TX/RX Examples

Successful: Start and Complete Routine

Execute a self-test routine that completes immediately.

tx_packet

Start Routine

31 01 03 01

> Start Routine 0x0301 (Actuator Test)

rx_packet

Routine Started

71 01 03 01 00

> Status 0x00 = Completed Successfully

✓

Routine executed and completed. Result code 0x00 = Success.

Successful: Async Routine with Result Polling

Long-running routine that requires status polling.

tx_packet

Start Memory Erase

31 01 FF 00

> Start Routine 0xFF00 (Erase Memory)

rx_packet

Routine Running

71 01 FF 00 01

> Status 0x01 = Running

tx_packet

Request Results

31 03 FF 00

> Poll for completion

rx_packet

Still Running

71 03 FF 00 01

> Status 0x01 = Still Running

tx_packet

Request Results

31 03 FF 00

> Poll again...

rx_packet

Completed

71 03 FF 00 00

> Status 0x00 = Completed

✓

Routine completed. Use TesterPresent to maintain session during long operations.

Stop Running Routine

Abort a running routine before completion.

tx_packet

Stop Routine

31 02 FF 00

rx_packet

Routine Stopped

71 02 FF 00 02

Routine aborted. Some routines may not be stoppable.

Error: Request Sequence Error

Requesting results for a routine that wasn’t started.

tx_packet

Request Results (Not Started)

31 03 03 01

rx_packet

Negative Response

7F 31 24

> NRC 0x24: Request Sequence Error

Error

Must start routine (0x01) before requesting results (0x03).

Error: Security Access Denied

Protected routine requires security unlock.

tx_packet

Start Protected Routine

31 01 FF 00

rx_packet

Negative Response

7F 31 33

> NRC 0x33: Security Access Denied

Error

Must unlock security (0x27) before executing protected routines.

Error: Request Out Of Range

Unknown routine identifier.

tx_packet

Unknown Routine

31 01 99 99

rx_packet

Negative Response

7F 31 31

> NRC 0x31: Request Out Of Range

Error

Routine 0x9999 not implemented in ECU.

UML Sequence Diagrams

Memory Erase Before Flash Programming

Unlock → Erase Memory → Poll → Download

10 steps

Tester

ECU

Routine Status Codes

Code	Status	Description
0x00	Completed Successfully	Routine finished without errors
0x01	Running	Routine still executing
0x02	Stopped	Routine stopped by user
0x03	Failed	Routine completed with errors

warning _entry

Session Timeout: Long-running routines may exceed the S3 timer (5s). Use periodic TesterPresent (0x3E) to maintain the session during async routine execution.

Negative Response Codes (NRCs)

Error_Catalog

Negative Response Codes

THREAT_LEVEL6 HIGH2 MEDIUM8 NRCs TOTAL

ISO_14229_ANNEX_ANRC_ENGINE_V2