Softwaredocumentation

Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

Electronic Diesel Control

EDC7 Keyword Protocol 2000

Software
Functional Description

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Title

 Softwaredocumentation
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

Transmittal agreement
The information in this document is confidential. Further transmission without the expressed written consent
of ROBERT BOSCH GmbH is not allowed.

Please send requests to:

ROBERT BOSCH GmbH
DS-NF/ESN2
Attn.: Ms. Monika G¸ nther

PO box: 30 02 20
D-70442 Stuttgart-Feuerbach
Phone: ++49 711 811 23675
Fax: ++49 711 811 264559

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Transmittal agreement

 Softwaredocumentation
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

Table of Contents

1 Introduction ..........................................................................................................................................1-1

2 Normative Reference ............................................................................................................................2-1

3 Implementation Layer...........................................................................................................................3-1
3.1 Service Description Convention ..................................................................................................3-1
3.1.1 Request Message .................................................................................................................3-1
3.1.2 Positive Response Message .................................................................................................3-2
3.1.3 Negative Response Message................................................................................................3-2
3.2 EDC7 modes of operation ............................................................................................................3-3
3.3 Diagnostic Modes .........................................................................................................................3-4
3.4 Service Identifier Value Summary Table......................................................................................3-5
3.4.1 Normal Mode........................................................................................................................3-5
3.4.2 PA-External Programming Mode ..........................................................................................3-6
3.4.3 PA-Internal Programming Mode............................................................................................3-8
3.4.4 Security Access Levels.........................................................................................................3-8

4 Communication Services .....................................................................................................................4-1

4.1 startCommunication (81h)............................................................................................................4-1
4.2 stopCommunication (82h)............................................................................................................4-2
4.3 accessTimingParameters (83h)....................................................................................................4-3

5 Diagnostic Management.......................................................................................................................5-1
5.1 startDiagnosticSession (10h) .......................................................................................................5-1
5.2 readEcuIdentification (1Ah)..........................................................................................................5-4
5.3 testerPresent (3Eh) .......................................................................................................................5-9
5.4 ecuReset (11h) ............................................................................................................................5-10

6 1 Multi Level Security Access ..............................................................................................................6-1

6.1 securityAccess (27h) ....................................................................................................................6-1

7 Flash Memory Programming................................................................................................................7-1

7.1 startRoutineByLocalIdentifier (31h) - eraseFlash........................................................................7-3
7.2 requestRoutineResultsByLocalIdentifier (33h) - eraseFlash ......................................................7-4
7.3 requestDownload (34h) - writeFlash ............................................................................................7-5
7.4 transferData (36h) - writeFlash .....................................................................................................7-6
7.5 requestTransferExit (37h) - writeFlash ........................................................................................7-7
7.6 startRoutineByLocalIdentifier (31h) ñ compareChecksum (Flash programming)...................7-8

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Contents

 Softwaredocumentation
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

7.7 requestRoutineResultsByLocalIdentifier (33h) - compareChecksum (Flash

programming)..............................................................................................................................7-9

8 End of Line Programming ....................................................................................................................8-1

8.1 escapeCode (80h) - loginRead .....................................................................................................8-3
8.2 requestUpload (35h)- endOfLine..................................................................................................8-5
8.3 transferData (36h)- endOfLineRead .............................................................................................8-6
8.4 requestTransferExit (37h)- endOfLineRead.................................................................................8-7
8.5 escapeCode (80h) - loginWrite.....................................................................................................8-8
8.6 requestDownload (34h)- endOfLine...........................................................................................8-10
8.7 transferData (36h)- endOfLineWrite ...........................................................................................8-11
8.8 requestTransferExit (37h)- endOfLineWrite ..............................................................................8-12
8.9 startRoutineByLocalIdentifier (31h) - checksumAdjustment....................................................8-13
8.10 requestRoutineResultsByLocalIdentifier (33h) - checksumAdjustment ................................8-14

9 Serial Application .................................................................................................................................9-1

9.1 Copying Data-Set From Flash To Application-RAM....................................................................9-3
9.2 startRoutineByLocalIdendifier (31h)- compareChecksum (Serial Application)........................9-4
9.3 requestRoutineResultsByLocalIdentifier (33h) - compareChecksum (Serial Application) ......9-5
9.4 writeMemoryByAddress (3Dh) .....................................................................................................9-6
9.5 escapeCode (80h) - dataSetSelect ...............................................................................................9-7
9.6 startRoutineByLocalIdentifier (31h) - copyToFlash ....................................................................9-8
9.7 requestRoutineResultsByLocalIdentifier (33h) - copyToFlash ..................................................9-9

10 Fault Memory and Engine Diagnosis...............................................................................................10-1

10.1 readDiagnosticTroubleCodesByStatus (18h)..........................................................................10-1
10.2 readStatusOfDiagnosticTroubleCodes (17h) ..........................................................................10-4
10.3 clearDiagnosticInformation (14h).............................................................................................10-5
10.4 startRoutineByLocalIdentifier (31h) - compressionTest .........................................................10-6
10.5 requestRoutineResultsByLocalIdentifier (33h) - compressionTest .......................................10-7
10.6 stopRoutineByLocalIdentifier (32h) - compressionTest .........................................................10-8
10.7 startRoutineByLocalIdentifier (31h) - runUpTest ....................................................................10-9
10.8 requestRoutineResultsByLocalIdentifier (33h) - runUpTest.................................................10-10
10.9 stopRoutineByLocalIdentifier (32h) - runUpTest ..................................................................10-11

11 Measuring and data transmission ...................................................................................................11-1

11.1 dynamicallyDefineLocalIdentifier (2Ch)...................................................................................11-3
11.2 readDataByLocalIdentifier (21h)...............................................................................................11-6
11.2.1 Read Data by Local Identifier List .....................................................................................11-7
11.3 writeDataByLocalIdentifier (3Bh) ...........................................................................................11-14

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Contents

 Softwaredocumentation
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

11.3.1 Supported recordLocalIdentifier for write function: ..........................................................11-15

11.4 readMemoryByAddress (23h) .................................................................................................11-19

12 Remote Control.................................................................................................................................12-1
12.1 Service of Remote Control .......................................................................................................12-1
12.2 Remote Control via KWP2000 ..................................................................................................12-2
12.2.1 KWP2000 Remote Control Protocol:.................................................................................12-2
12.2.2 EscapeCode - MaintainRemoteControl .............................................................................12-2
12.2.3 EscapeCode - StopRemoteControl ...................................................................................12-4

13 Physical Layer...................................................................................................................................13-1
13.1 Diagnostic on K line .................................................................................................................13-1
13.1.1 Configuration ....................................................................................................................13-1
13.1.2 Signal Specifications ........................................................................................................13-2
13.1.3 Communication Specification ...........................................................................................13-3
13.1.4 Requirements Of The Diagnostic Tester ...........................................................................13-3
13.2 Diagnostic on CAN....................................................................................................................13-5
13.2.1 Configuration ....................................................................................................................13-5
13.2.2 Signal specifications .........................................................................................................13-5
13.2.3 Electrical specifications.....................................................................................................13-8

14 Data Link Layer .................................................................................................................................14-1

14.1 Data Link Layer on K line .........................................................................................................14-1
14.1.1 Message structure ............................................................................................................14-1
14.1.2 Data Bytes........................................................................................................................14-3
14.1.3 Checksum Byte ................................................................................................................14-3
14.1.4 Message Interchange........................................................................................................14-3
14.1.5 Timing ..............................................................................................................................14-3
14.1.6 Initialization ......................................................................................................................14-4
14.1.7 Key Bytes .........................................................................................................................14-6
14.1.8 Information Frames ..........................................................................................................14-6
14.1.9 Error Handling ..................................................................................................................14-6
14.2 Data Link and Network Layer on CAN .....................................................................................14-8
14.2.1 Identifier for diagnostic CAN messages ............................................................................14-8
14.2.2 Network protocol information of diagnostic CAN messages...............................................14-8
14.2.3 Timing ............................................................................................................................14-13
14.1.4 Initialization ....................................................................................................................14-13

15 Appendix ...........................................................................................................................................15-1
15.1 Data scaling...............................................................................................................................15-1
15.2 Negative response code value summary table........................................................................15-3
16.1 Conversion Formulas of variables and dataís(K2FO)..................................................................1
16.1.1 Brief Description ....................................................................................................................1
16.1.2 Conversion formula of Variables and Dataís ..........................................................................1
16.1.3 Table of all conversion formulas and their coefficients...........................................................2

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Contents

 Softwaredocumentation
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Contents

 Softwaredocumentation
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

Index
EngineManufecturerFactory
A ECUAdjustmentMode 5-2
engineTestDate 5-7
access levels 3-4
eraseFlash 3-8, 7-1
accessTimingParameters 3-5, 3-6, 3-8, 4-3, 14-4,
error handling 14-6
14-13
escapeCode 3-5, 8-3, 8-8, 9-7
address operations 3-1
afterrun 9-8 extended timing parameter set 14-4
ASCII 8-9 external mode 3-3
ASCII 5-5, 5-6, 5-7, 15-2 F
B fast initialization 14-4
baudrate 5-3, 11-3, 14-4 fault memory 10-1, 10-4
binary coded decimal 8-9, 10-2, 15-2 flash memory programming 5-1
byps_s_act_b 12-5 flash memory programming 7-1
byte collision 14-6 format byte 14-1

C H
checksum 7-1, 14-3 header 14-1
checksum byte 14-3
checksum error 14-6
I
checksumAdjustment 3-6, 8-13 identification data 5-4
ChecksumAdjustment 8-13 implementation layer 3-1
clearDiagnosticInformation 3-5, 10-5 information frames 14-6
compareChecksum 7-1 inter-block-time 14-4, 14-13
compChecksum 3-5, 3-8 inter-byte-time 14-3, 14-6
compressionTest 10-6 internal mode 3-3, 5-1, 9-8
copyToFlash 3-5, 9-8 ISO 9141 14-6

D K
data bytes 14-3 K2RC_DT_DEF_MAX_CUW 12-5
data scaling 15-1 K2RC_DT_DEF_MIN_CUW 12-5
dataSetSelect 3-5, 9-7 k2rc_s_activ_b 12-5
defaultMode-StandardDiagnosticMode 3-4, 5-1, key bytes 14-6
5-2, 6-1
Development EOLProgrammingMode 6-2, 6-3 L
diagnostic modes 3-4, 5-1
length byte 14-3
diagnostic trouble codes 10-1
loginRead 3-6, 8-3
download 7-5, 7-6
loginWrite 8-8
dynamicallyDefineLocalIdentifier 3-5, 11-3
LoginWrite 3-6
E M
ECU reset 5-1, 6-1, 7-1, 9-8
maintainRemoteControl 3-5
ECUAdjustmentMode 3-4
message interchange 14-3
ECUDevelopmentMode 5-2, 6-2, 6-3
ECUProgrammingMode 3-3, 3-4, 5-1, 5-2, 6-2, 6- message structure 14-1, 14-8
3, 7-1, 14-4, 14-13
ecuReset 3-6, 3-8, 5-10, 7-1
N
EDC7 modes of operation 3-3 negative response code 15-3
endOfLineProgrammingMode 5-2 normal mode 3-3, 9-8
engine tests 3-5 Normal Mode 3-5
EngineManufacturerFactory
ECUAdjustmentMode 6-2, 6-3 P
EngineManufacturerFactory
EOLProgrammingMode 6-2, 6-3 PA-External Programming Mode 3-6
PA-Internal Programming Mode 3-8

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Index

 Softwaredocumentation
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

power-on 6-1 startRoutineByLocalIdentifier 3-5, 5-1, 7-1, 7-3,

powertrain 10-2 7-8, 8-13, 9-4, 9-8, 10-6, 10-9
programming mode 3-3, 9-8 startRoutineByLocalIdentifier 3-5, 3-8
programmingDate 5-7 stopCommunication 3-5, 3-6, 3-8, 4-2
stopRemoteControl 3-5
R stopRoutineByLocalIdentifier 3-5, 10-8, 10-11
readDataByLocalIdentifier 3-5, 11-4, 11-6 systemNameOrEngineType 5-7
readDiagnosticTroubleCodesByStatus 10-1 systemSupplierECUHardwareNumber 5-6
readDiagnosticTroubleCodesByStatus 3-5 systemSupplierECUHardwareVersionNumber 5-6
ReadDiagnosticTroubleCodesByStatus 10-5 systemSupplierECUSoftwareNumber 5-6
readEcuIdentification 3-5, 3-6, 3-8, 5-4 systemSupplierECUSoftwareVersionNumber 5-7
readECUIdentification 15-1 SystemSupplierSpecific 5-2
readMemoryByAddress 3-5, 11-19 T
readStatusOfDiagnosticTroubleCodes 3-5, 10-2,
10-4 target address byte 14-1
repairShopCodeOrTesterSerialNumber 5-7 temperature 8-9
requestDownload 5-1, 7-1, 7-5, 7-6, 8-10 tester identification 8-9
requestDownload 3-8 testerPresent 3-5, 3-6, 3-8, 5-9
requestRoutineResultsByLocalID 3-6 timing 5-3, 14-3, 14-13
requestRoutineResultsByLocalIdentifier 3-5, 3-8, transferData 3-6, 3-8, 5-1, 7-1, 7-5, 7-6, 7-7, 8-6,
7-1, 7-4, 7-9, 8-13, 8-14, 9-5, 9-9, 10-7, 10-10 8-11
requestTransferExit 3-6, 3-8, 5-1, 7-1, 7-6, 7-7,
8-7, 8-12 U
requestUpload 3-6, 5-1, 8-5
useless contents 14-6
rmtc_s_appl_on_b 12-5

S V
vehicleIdentificationNumber 5-5, 5-6
SAE J2012 10-2, 15-2
vehicleManufacturerECUHardwareNumber 5-6
SAE J2178 14-1
VehicleManufacturerFactoryMode 6-2, 6-3
SAE J2178 14-2
VehicleManufacturerService 5-2
SAE J2190 15-1
VehicleManufacturerSeviceMode 6-2, 6-3
securityAccess 3-4, 3-5, 3-6, 3-8, 5-1, 6-1, 7-1
seed & key 3-4, 6-1 W
serial application 5-1
service identifier value summary table 3-5 wake up pattern 14-4, 14-6
service type 3-2 writeDataByLocalIdentifier 3-5, 11-14
source address byte 14-2 writeFlash 3-8
startCommunication 3-5, 3-6, 3-8, 4-1, 14-1, 14- writeMemoryByAddress 3-5, 9-6
3, 14-4
startDiagnosticSession 3-4, 3-5, 3-6, 3-8, 5-1, 7-1

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Index