Service Interaction Protocol
Routine Control
High Risk: Some routines perform irreversible operations — erasing flash, writing calibration, or driving actuators. Running the wrong routine, or running one with the vehicle in the wrong state, can damage the ECU or the vehicle.
RoutineControl
Execute, stop, and query named ECU routines
Sub-functions
startRoutine
Begin executing the routine
stopRoutine
Abort a running routine (if stoppable)
requestRoutineResults
Poll status / get results
Key Facts
- Service ID
- 0x31
- Positive Response
- 0x71
- Min request length
- 4 bytes (SID + SF + 2-byte RID)
- RID
- 16-bit, big-endian (0x0000–0xFFFF)
- Typical session
- EXTENDED (0x03) / PROGRAMMING (0x02)
- ISO ref
- ISO 14229-1:2020 §9.5
Routine Status Byte (Response Byte 4)
Overview
“The RoutineControl service is used by the client to start, stop, or request results for defined execution sequences within the ECU.”
The primary states and control sub-functions of the RoutineControl service.
Interactive Workflows
Step through complete RoutineControl flows — from session setup to result polling — and watch the exact bytes on the wire. Pick a scenario, then play or step through it.
Routine Lifecycle
A routine is a small state machine. Drive a single routine through Start → poll → Stop and see the state, status byte, and progress change live.
Routine Lifecycle Simulator
Pick a routine, then drive it through its FSM states with Start / Poll / Stop.
Routine
Duration: 2000 ms
State
Progress
0%Last Frame
Sub-Functions
SubFunc | Name | Description |
|---|---|---|
| 0x01 | Start Routine | Begin executing the specified routine |
| 0x02 | Stop Routine | Abort a running routine (if stoppable) |
| 0x03 | Request Routine Results | Get the status/results of a routine |
Routine Identifiers
The Routine Identifier (RID) is a 16-bit value (0x0000–0xFFFF) sent big-endian. Search and filter the standard range conventions, and see the session/security each category needs.
Routine Identifier (RID) Ranges
RIDs are ECU-configured (config.routines); the ranges below are ISO conventions, not a fixed list.
9 ranges
OEM-specific
Network configuration
Programming prerequisites
Examples
- 0x0202Memory check (checksum)
- 0x0203Check programming dependencies
OEM-specific
Examples
- 0x0301Actuator self-test
Diagnostic-connector routines
OEM-specific
Actuator & self-tests
Examples
- 0xF001Actuator test (range start)
Sensor tests
Examples
- 0xF156O2 sensor test
- 0xF178Lambda test
Supplier-specific / programming ops
Examples
- 0xFF00Erase memory
- 0xFF01Check programming dependencies
Message Format
Select a frame and inspect each byte. The positive response echoes the sub-function and RID, then carries a routine-specific status record.
SID 0x31
RoutineControl service identifier
Session & Security
Session & Security Matrix
Which routine categories run in each session, and which need a security unlock. Select a row for details.
| Routine type | DEFAULT 0x01 | EXTENDED 0x03 | PROGRAMMING 0x02 | Security |
|---|---|---|---|---|
| ✓ | ✓ | ✓ | — | |
| ✗ | ✓ | ✓ | — | |
| ✗ | ✓ | ✓ | required | |
| ✗ | ✓ | ✓ | required | |
| ✗ | ✗ | ✓ | required | |
| ✗ | ✗ | ✓ | required | |
| ✗ | ✗ | ✓ | required |
Check order: in this simulator the RID-range check (0x31 requestOutOfRange) runs before the session and security checks — an unknown RID returns 0x31 even when the session would also be wrong.
Session Timeout (S3): Extended and Programming sessions time out after 5 seconds with no tester activity. Send TesterPresent (0x3E) every 2–3 seconds during long-running routines to keep the session alive.
Service Dependencies
Service Dependencies
0x31 sits in a small graph of co-services. Select a node to see how it shapes a routine flow.
Most routines need EXTENDED (0x03) or PROGRAMMING (0x02) — else NRC 0x7F.
TX/RX Examples
Successful: Start, then poll to completion
Start a self-test, then request results until it completes.
Start Routine
31 01 03 01> Start Routine 0x0301 (Actuator Test)
Routine Started
71 01 03 01 00> Status 0x00 = Started / In Progress
Request Results
31 03 03 01> Poll for completion
Completed
71 03 03 01 01> Status 0x01 = Completed (pass)
Successful: Long routine with result polling
A long-running erase that needs repeated polling.
Start Memory Erase
31 01 FF 00> Start Routine 0xFF00 (Erase Memory)
Routine Started
71 01 FF 00 00> Status 0x00 = Started / In Progress
Request Results
31 03 FF 00> Poll for completion
Still In Progress
71 03 FF 00 00> Status 0x00 = Still in progress
Request Results
31 03 FF 00> Poll again...
Completed
71 03 FF 00 01> Status 0x01 = Completed
Stop a running routine
Abort a running routine before it completes.
Stop Routine
31 02 FF 00Routine Stopped
71 02 FF 00 00> Status 0x00 — routine returns to idle
Error: Request Sequence Error
Requesting results for a routine that was never started.
Request Results (Not Started)
31 03 03 01Negative Response
7F 31 24> NRC 0x24: Request Sequence Error
Error: Security Access Denied
A protected routine requires a security unlock.
Start Protected Routine
31 01 FF 00Negative Response
7F 31 33> NRC 0x33: Security Access Denied
Error: Request Out Of Range
Unknown routine identifier.
Unknown Routine
31 01 99 99Negative Response
7F 31 31> NRC 0x31: Request Out Of Range
Workflow Diagrams
Workflow 1: Simple Actuator Test (No Security)
Extended Session → Start Test → Get Results
6 stepsWorkflow 2: Secured Calibration Routine (30s)
Extended → Unlock → Start → Keep Alive → Poll → Done
16 stepsWorkflow 3: Memory Erase Before Flash Programming
Programming → Unlock → Erase → Poll → Download
12 stepsWorkflow 4: Routine Cancellation
Start → User Stops → Routine Returns to Idle
8 stepsWorkflow 5: Failure → Read DTCs → Clear → Retry
Routine Fails, Diagnose, Clear, Retry
12 stepsRoutine Status Codes
Status Byte | Meaning | Notes |
|---|---|---|
| 0x00 | In Progress / Started | Returned by Start, and by Request Results while still running |
| 0x01 | Completed | Returned by Request Results after the routine finishes |
This simulator’s conventions: Stop returns status 0x00 and leaves the routine idle (ready to start again). A routine that fails surfaces as NRC 0x72 (generalProgrammingFailure) on Request Results — not as a status byte. The routineStatusRecord format is manufacturer-specific in ISO 14229-1; real ECUs may define richer status records.
Negative Response Codes (NRCs)
NRC Decoder — SID 0x31
9 negative response codes. Click any card to see trace and recovery steps.
NRC Priority
Order the simulator checks errors — first failing check wins.
Troubleshooting Guide
Troubleshooting Guide
Click any issue to expand diagnosis steps and resolution.
Timing Parameters
Parameter | Value | Use |
|---|---|---|
| P2 (Normal Response) | 50 ms | Standard request-response timeout |
| P2* (Extended Response) | 5000 ms | Long-running operations (memory erase, calibration) |
| S3 (Session Timeout) | 5000 ms | Session expires without tester activity |
| Tester Present Interval | 2000–3000 ms | Keep-alive frequency during routines |
| Security Timeout | 10000 ms | Security access expires if not used |
ISO 14229-1 References
Standard: ISO 14229-1:2020, Section 9.5 — RoutineControl Service
Compliance Requirements
- Minimum request length: 4 bytes (SID + SubFunction + RID)
- Minimum positive response length: 4 bytes (Response SID + SF + RID)
- SubFunction parameter range: 0x01–0x03 (only three values defined)
- RID parameter range: 0x0000–0xFFFF (manufacturer-defined)
- Option record (request) is optional, routine-specific
- Status record (response) is optional, routine-specific
Related ISO Sections
Section | Topic |
|---|---|
| 9.3 | DiagnosticSessionControl (prerequisite) |
| 9.4 | SecurityAccess (for protected routines) |
| 9.6 | CommunicationControl |
| 9.11 | TesterPresent (keep-alive) |
| 10.1 | NRC definitions (Annex B) |
| Annex A | Routine identifier ranges |