9 Serial Application: Software Documentation Page 9-1 EDC7 Keyword Protocol 2000

Software Documentation Page 9-1
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4
9 Serial Application
Serial application is designed for development to adjust data, while the engine is running. The ECU is
capable of driving either the RAM data-set (as "working page") or the flash-EPROM data-set (as "reference
page"). After adjustment is finished, the modified application-RAM data-set may be transferred back to the
flash-EPROM.
To perform serial adjustment it is compulsary to enter an appropriate diagnostic mode preceded by security-
Access. Upon the startDiagnosticSession request message the ECU will initalize the working page. A higher
baudrate can be introduced by using the (optional) parameter "baudrateIdentifier". From now on ECU
software is driving the working page data.
In order to check, whether the current data-set of the ECU flash-EPROM data-set is available in the applica-
tion system (PC), there are one possibility:
1. Comparing the checksum of the ECU flash-EPROM data-set with the checksum of the PC data-set. This
can be done by means of the startRoutineByLocalIdentifier (31h) and requestRoutineResultsBy-
LocalIdentifier (33h) - compareChecksum request messages.
If one of the coherence checks have not been successful, the tester requires to perform an upload of either
parts of data or single data from the ECU to the PC before adjusting them (readMemoryByAddress (23h)
service).
After the ECU data-set has been available in the application system, the tester may now change data by
means of the writeMemoryByAddress (3Dh) service.
In order to compare "new" (calibrated) and "old" (original) data, the tester may select from either working
page to flash-EPROM data with the escapeCode (80h) - dataSetSelect service.
To reject the adjustments and reset the working page with the original data-set again, the tester has to send
another startDiagnosticSession service to the ECU.
To copy changed data back to flash-EPROM, the startRoutineByLocalIdentifier (31h) - copyToFlash
request has to be sent to the ECU. The ECU goes immediately into the afterrun procedure and then into the
internal mode of operation (programming mode), where the actual copy operation is performed. It is
compulsory to have stopped the vehicle (v = 0!) before, otherwise the copy operation will not take place.
The copy operation itself takes about one minute. During that time, the stage of progress can be polled with
the requestRoutineByLocalIdentifier (33h) - copyToFlash service. After copying is finished, the normal
mode of operation can be reentered by forcing an ECU reset (either manual or with the keyword protocol
2000 request message ecuReset (11h)).
The message flow of serial application and measuring is shown below (see also section "Measuring"):
© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.
DS-NF/ESN2 15-JAN-2004 Serial Application

engine running
securityAccess
Check coherence of
PC data-set and
Baudrate changed, ECU data-set
startDiagnostic-
Data-set copied to RAM,
Session
RAM-data-set selected
compare read data-set-ID

escCode Checksum read file names
dataSetSelect (.hex +
RAM startRoutine/ description file)
requestRoutine
Results readECUIdent./
readMemory
flash-EPROM application-RAM
no data-sets
coherent?
upload data-set
yes
readMemoryBy
Address
Measuring Measuring Adjusting

escCode
dynamically dataSetSelect dynamically writeMemoryBy
Define flash-EPROM Define Address
LocalIdentifier/ LocalIdentifier/
readDataBy escCode readDataBy
LocalIdentifier/ dataSetSelect LocalIdentifier/
readMemoryBy RAM readMemoryBy
Address Address
accept see on accept

adjustments? the left adjustments?
no, reject no, reject
adjustments yes, stay in current adjustments yes, stay in current
and restart diagnostic session and restart diagnostic session
application application
session stop vehicle! session stop vehicle!
startRoutine see on startRoutine

copyToFlash the left copyToFlash
engine stopped
by afterrun
Operating System: normal mode of operation
Operating System: programming mode
manual
ECU reset
requestRoutine positive
copyToFlash results response?
yes,
copying ecuReset
finished
no, still
copying
Figure Serial application message flow

9.1 Copying Data-Set From Flash To Application-RAM

Each time entering one of the diagnostic modes, where serial application is supported, the working page will
be reset to the reference page data. Then it is possible to adjust data in the working page and to read data
values from the working page. Another StartDiagnosticSession request is necessary in order to forget all
changes and to overwrite the working page with the old reference page.

9.2 startRoutineByLocalIdendifier (31h)- compareChecksum

(Serial Application)
This service enables the tester to ask from the ECU, whether a checksum previously calculated by the
tester corresponds to the checksum in the ECU's memory. The checksum is calculated by the 8 bit series
over the selected memory area with a 16 bit result.
Byte Request block Hex Value Mnemonic

#1 startRoutineByLocalIdentifier Request Service Id 31 STRBLI
#2 routineLocalIdentifier = [compareChecksum] 01 RELI_CC
#3 startAddress (High Byte) xx SADDR_H
#4 startAddress (Middle Byte) xx SADDR_M
#5 startAddress (Low Byte) xx SADDR_L
#6 endAddress (High Byte) xx EADDR_H
#7 endAddress (Middle Byte) xx EADDR_M
#8 endAddress (Low Byte) xx EADDR_L
#9 expectedChecksum (High Byte) xx EC_H
#10 expectedChecksum (Low Byte) xx EC_L
Byte Positive response block Hex Value Mnemonic

#1 startRoutineByLocalIdentifier Positive Response Service 71 STRBLIPR
Id
Byte Negative response block Hex Value Mnemonic

#1 negative Response Service Id 7F NR
#3 responseCode = [ xx=[ RC_...
serviceNotSupported (wrong diagnostic mode) 11,
subFunctionNotSupported-invalidFormat 12,
(invalid address range),
conditionsNotCorrectOrRequestSequenceError 22
(routine is already running) ]
securityAccessDenied-securityAccessRequested 33
(tester is not allowd to access to requested mem-area) ] ]

9.3 requestRoutineResultsByLocalIdentifier (33h) - compareChecksum

(Serial Application)

#1 requestRoutineResultsByLocalIdentifier Request Sid 33 RRRBLI

#1 requestRoutineResultsByLocalIdentifier Pos. resp. SId 73 RRRBLIPR

#2 requestRoutineResultsByLocalIdentifier Request SId 33 RRRBLI
(invalid address range),
conditionsNotCorrectOrRequestSequenceError 22,
(routine was not yet started),
routineNotComplete, 23,
checksumError] FA]

9.4 writeMemoryByAddress (3Dh)
The writeMemoryByAddress service is used by the tester to write recordValues (data values) to the ECU's
RAM. The data are identified by the ECU's memoryAddress and memorySize.

#1 writeMemoryByAddress Request 3D WMBA
#2 memoryAddress (High Byte) xx MA_...
#3 memoryAddress (Middle Byte) xx
#4 memoryAddress (Low Byte) xx
#5 memorySize xx MS_...
#6 recordValue#1 xx RV_...
: : : :
#n recordValue#m xx RV_...

#1 writeMemoryByAddress Positive Response 7D WMBAPR

#1 negativeResponse Service Id 7F NR
#2 writeMemoryByAddressRequest Service Id 3D WMBA
(writing on requested memory area not possible),
securityAccessDenied-securityAccessRequested ] 33]
Vehicle manufacturer and system supplier have to agree on the conferment of memory access rights. With
this software version the following memory parts are suitable to be written by the writeMemoryByAddress
service. Note that each memory area defined by the parameters memoryAddress and memorySize has to
lie completely inside one of the below defined memory areas:
Range of Memory Bank Access in Diagnostic Modes

Addresses
Hex
60000 ñ 67FFF Data (copied to ECUDevelopmentMode
RAM) Engine Manufacturer Mode
Vehicle Manufacturer Mode
ECU System Supplier Mode
68000 ñ 6FFFF Data (copied to ECUDevelopmentMode
RAM) Engine Manufacturer Mode
Vehicle Manufacturer Mode
ECU System Supplier Mode
1)
whatever is currently activated
It is the testers responsibility that the ECU's conditions are met when performing the writeMemoryByAddress
service.

9.5 escapeCode (80h) - dataSetSelect

After a startDiagnosticSession service was performed, from now on the ECU automatically accesses to the
data-set stored in the working page. To be able to compare working page data with flash-EPROM data
("reference page") the tester may select from any of the two memory chips by means of the escapeCode -
dataSetSelect service.
The parameter memoryPageToSelect in the request message specifies the memory page the tester likes
to select.
The parameter selectedMemoryPage in the positive response message returns the selected memory page.

#1 escapeCode Request Service Id 80 EC
#2 manufacturerSpecificServiceId = [dataSetSelect] 90 MSSID
#3 memoryPageToSelect = [ xx=[ RV_...
reference page, 00,
working page ] 01]

#1 escapeCode Positive Response Service Id C0 ECPR
#3 selectedMemoryPage = [ xx=[ RV_...
reference page, 00,
working page ] 01]

#1 negativeResponse Service Id 7F NR
#2 escapeCode Request Service Id 80 EC
generalReject 10,
(invalid memory type),
busyRepeat 21,
conditionsNotCorrectOrRequestSequenceError 22
(switching not allowed) ] ]

9.6 startRoutineByLocalIdentifier (31h) - copyToFlash

The process of copying the data-set back to the flash-EPROM is initiated by the keyword protocol 2000 Start
RoutineByLocalIdentifier - copyToFlash service. Note that all changes will get lost, if power loses or
communication aborts, without the startRoutineByLocalIdentifier - copyToFlash service was carried out
before!
If the vehicle has been stopped, upon the startRoutineByLocalIdentifier - copyToFlash request message the
ECU goes over to the afterrun and then to the internal mode of operation (programming mode) and
reprograms the flash-EPROM (reference page]. The old data-set will be copied to the so-called copy page
first. These data can be used as a back-up data-set for the case power aborts or is switched off during flash
erasure or programming. After that the data-set memory area will be erased and the working page will be
copied from the flash copy page to the actual flash data page. The whole transfer procedure takes some
seconds.
If power supply breaks before the copy page is written, the calibrations get lost and the original data-set is
active again when the ECU will be restarted. If power supply breaks after the copy page is written, upon the
next ECU power-on the ECU will rebuild the new data-set from the copy-page. This takes some seconds
time, in which communication can not be established. After successful rebuilding the ECU resets and than
returns into the normal mode of operation.

#2 routineLocalIdentifier = [copyToFlash] 03 RELI_...
#3 memorySouce = [working page] 01 REO_...

#1 startRoutineByLocalIdentifier Positive Response SId 71 STRBLIPR

generalReject, 10,
serviceNotSupported, 11,
subFunctionNotSupported-invalidFormat, 12,
conditionsNotCorrectOrRequestSequenceError ] 22]

9.7 requestRoutineResultsByLocalIdentifier (33h) - copyToFlash

The transfer process is controlled by the tester, which should permanently poll and ask the current status
from the ECU by sending the keyword protocol 2000 requestRoutineResultsByLocalIdentifier request
service. While the transfer (erasing, programming, copying a.s.o.) is in process, the ECU will negatively
respond, where the error code gives the current step in progress. After the transfer process is finished, the
ECU waits for the last requestRoutineResultsByLocalIdentifier request message to send a positive response
and informs the tester, that everything went all right during the transfer. The ECU may be restarted now.
Communication aborts and has to be established again. The changed (new) data are available in flash-
EPROM.
In the case, programming went wrong ('erasingError', 'programmingError', power down) the procedure will
be stopped automatically.


#1 requestRoutineResultsByLocalIdentifier pos. resp. sid 73 RRRBLIPR
#2 routineLocalIdentifier = [copyToFlash] 03 RR_...

#1 Negative Response Service Id 7F NR
serviceNotSupported (wrong diagnostic mode, invalid 11,
routineLocalIdentifier),
(invalid length of message),
conditionsNotCorrectOrRequestSequenceError 22,
(routine not yet running),
routineNotComplete, 23,
ECUErasingFlash, FB,
ECUProgrammingFlash, FC,
erasingError, FD,
programmingError ] FE]

This page intentionally left blank

9 Serial Application: Software Documentation Page 9-1 EDC7 Keyword Protocol 2000

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

9 Serial Application: Software Documentation Page 9-1 EDC7 Keyword Protocol 2000

Uploaded by

Copyright:

Available Formats

Software Documentation Page 9-1

Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

DS-NF/ESN2 15-JAN-2004 Serial Application

compare read data-set-ID

Measuring Measuring Adjusting

accept see on accept

startRoutine see on startRoutine

Figure Serial application message flow

DS-NF/ESN2 15-JAN-2004 Serial Application

9.1 Copying Data-Set From Flash To Application-RAM

DS-NF/ESN2 15-JAN-2004 Serial Application

9.2 startRoutineByLocalIdendifier (31h)- compareChecksum

Byte Request block Hex Value Mnemonic

Byte Positive response block Hex Value Mnemonic

Byte Negative response block Hex Value Mnemonic

DS-NF/ESN2 15-JAN-2004 Serial Application

9.3 requestRoutineResultsByLocalIdentifier (33h) - compareChecksum

Byte Request block Hex Value Mnemonic

Byte Positive response block Hex Value Mnemonic

Byte Negative response block Hex Value Mnemonic

DS-NF/ESN2 15-JAN-2004 Serial Application

9.4 writeMemoryByAddress (3Dh)

Byte Request block Hex Value Mnemonic

Byte Positive response block Hex Value Mnemonic

Byte Negative response block Hex Value Mnemonic

Range of Memory Bank Access in Diagnostic Modes

DS-NF/ESN2 15-JAN-2004 Serial Application

9.5 escapeCode (80h) - dataSetSelect

Byte Request block Hex Value Mnemonic

Byte Positive response block Hex Value Mnemonic

Byte Negative response block Hex Value Mnemonic

DS-NF/ESN2 15-JAN-2004 Serial Application

9.6 startRoutineByLocalIdentifier (31h) - copyToFlash

Byte Request block Hex Value Mnemonic

Byte Positive response block Hex Value Mnemonic

Byte Negative response block Hex Value Mnemonic

DS-NF/ESN2 15-JAN-2004 Serial Application

9.7 requestRoutineResultsByLocalIdentifier (33h) - copyToFlash

Byte Request block Hex Value Mnemonic

Byte Positive response block Hex Value Mnemonic

Byte Negative response block Hex Value Mnemonic

DS-NF/ESN2 15-JAN-2004 Serial Application

This page intentionally left blank

DS-NF/ESN2 15-JAN-2004 Serial Application

You might also like