Switch from Default to Programming session. Enables flash services (34/36/37) and routine control for memory erase.
Seed-key challenge. Server sends random seed, client computes key using OEM algorithm. Here: Key = Seed XOR 0x5A5A
Verify ECU is ready for programming. Checks: battery voltage, vehicle speed = 0, engine off, communication OK.
Erase the application flash memory sector. ECU enters bootloader mode. Cannot be interrupted - power loss here = bricked ECU.
Negotiate download parameters: compression, address range, memory size. ECU responds with max block length for TransferData.
Send firmware in sequential blocks. Each block has a counter (01-FF, wraps). ECU writes to flash as data arrives.
Signal all data sent. ECU verifies CRC/checksum of received data against expected value.
Verify all programming dependencies: SW compatibility, calibration match, bootloader version. Critical safety check.
Hard reset. ECU boots with new firmware. If dependency check passed, application starts. Otherwise, stays in bootloader.