Software Documentation Page 11-1

Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

11 Measuring and data transmission

Serial application is intended to be used in conjunction with measuring, which allows to access to ECU data
(analog measurement values, digital inputs, internal software values and application data) with high baud
rates via serial link.
To realize high speed measurement and serial on-line adjustment the following procedure is recommended.
After initialization, the tester should care to enable optimum timing parameters (minimum inter byte and
inter block times) by means of the accessTimingParameters service. To force a higher communication
baudrate, the tester has to perform a startDiagnosticSession request message. Note that the baudrate is
limited by the current operating conditions (e. g. engine speed) and by the ECU specific hardware
configuration.
The following services are provided by the ECU for performing measurments and data transmission: dyna-
micallyDefineLocalIdentifier (2Ch), readDataByLocalIdentifier (21h), writeDataByLocalIdentifier
(3Bh), readMemoryByAddress (23h) and writeMemoryByAddress (3Dh) (this service is introduced in
chapter ìSerial Applicationî). These services can be made available in the "defaultMode-Standard-
DiagnosticMode", that is active after start of communication. Working page data can be read only in those
diagnostic modes where serial application is available.
readDataByLocalIdentifier requests shall not be performed until the record has been established with the
dynamicallyDefineLocalIdentifier service. Before building up a new record the old table should be erased
by sending the dynamicallyDefineLocalIdentifier - clearDynamicallyDefinedLocalIdentifier request
message. While building up the record with dynamicallyDefineLocalIdentifier - defineByMemory-
Address, the tester should take care, that all record positions of the readDataByLocalIdentifier positive
response message are filled with defined values.
Note that all read/write operations are restricted to particular memory areas. For calibration data the
restrictions are laid down in the respective EOL area headers. For RAM data restrictions have to be defined
in agreement of vehicle manufacturer and system supplier. High level access protection is given by the
preceding seed and key procedure (securityAccess).

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Measuring and Data Transmission

 Software Documentation Page 11-2
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

The message flow of measuring is shown below:

engine running

accessTiming
Parameters

securityAccess

startDiagnostic-
Session

dynamically
DefineLocalId
clear

dynamically
DefineLocalId
define

ECU checks
access rights

whole
record defined no
?
yes
measuring

readDataBy
LocalIdentifier

measu-
ring finished no
?
yes

Figure Measuring message flow

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Measuring and Data Transmission

 Software Documentation Page 11-3
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

11.1 dynamicallyDefineLocalIdentifier (2Ch)

This message is used by the tester to dynamically define or to reset a local identifier in the request
message.

Byte Request block Hex Value Mnemonic

#1 dynamicallyDefineLocalIdentifier Request Service Id 2C DDLI
#2 dynamicallyDefinedLocalIdentifier F0 DDLI_...
#3 definitionMode = [defineByMemoryAddress]#1 03 DBMA
#4 positionInDynamicallyDefinedLocalIdentifier#1 xx PIDDLI_...
#5 memorySize#1 xx MS_...
#6 memoryAddress#1 (High Byte) xx MA_...
#7 memoryAddress#1 (Middle Byte) xx
#8 memoryAddress#1 (Low Byte) xx
#9 definitionMode = [defineByMemoryAddress]#2 03 DBMA
#10 positionInDynamicallyDefinedLocalIdentifier#2 xx PIDDLI_...
#11 memorySize#2 xx MS_...
#12 memoryAddress#2 (High Byte) xx MA_...
#13 memoryAddress#2 (Middle Byte) xx
#14 memoryAddress#2 (Low Byte) xx
: : : :
#n-5 definitionMode = [defineByMemoryAddress]#m 03 DBMA
#n-4 positionInDynamicallyDefinedLocalIdentifier#m xx PIDDLI_...
#n-3 memorySize#m xx MS_...
#n-2 memoryAddress#m (High Byte) xx MA_...
#n-1 memoryAddress#m (Middle Byte) xx
#n memoryAddress#m (Low Byte) xx

Byte Positive response block Hex Value Mnemonic

#1 dynamicallyDefineLocalIdentifier Positive Response SId 6C DDLIPR
#2 dynamicallyDefinedLocalIdentifier F0 DDLI_...

Byte Negative response block Hex Value Mnemonic

#1 negativeResponse Service Id 7F NR
#2 dynamicallyDefineLocalIdentifierRequest Service Id 2C DDLI
Once the record is defined in a certain diagnostic mode, it can be used in the respective diagnostic mode as
often as needed, even if the diagnostic session was left and reentered (e. g. to change baudrate). The
record can not be used within other diagnostic modes.
The dynamicallyDefineLocalIdentifier request message consists of the following parameters:
• The record is identified by the parameter dynamicallyDefinedLocalIdentifier (DDLI_) = F0h.
• The parameter positionInDynamicallyDefinedLocalIdentifier (PIDDLI_) identifies the position of data
(in bytes) in the readDataByLocalIdentifier positive response message. PIDDLI = 1 indicates
recordValue#1 in the positive response message.
• The parameter memoryAddress (MA_) identifies the start address of a data record in the ECU's
memory.
• The parameter memorySize (MS_) specifies the number of data bytes starting at the specified
memoryAddress in the ECU's memory.

The parameter definitionMode (DNM_) in the dynamicallyDefineLocalIdentifier request message specifies

the dynamicallyDefineLocalIdentifier mode. Values are defined in the table below:

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Measuring and Data Transmission

 Software Documentation Page 11-4
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

Hex Description Mnemonic

03 defineByMemoryAddress DNM_
The purpose of a memory address as an DBMA
identifier is to reference a unique parameter of
the ECU.
04 clearDynamicallyDefinedLocalIdentifier DNM_
The purpose of this definition mode is to clear a CDDLI
dynamicallyDefinedLocalIdentifier which has
been defined within the current diagnostic
session (diagnosticMode) of the ECU. The
dynamicallyDefineLocalIdentifier service is only
used with physically addressed messages
(point to point communication).

If the definitionMode parameter is set to defineByMemoryAddress (03h), the tester may build up a
temporarily (for the duration the communication is active) stored record, which contains the addresses and
sizes of those areas in the ECU's memory (RAM, flash etc.), the tester likes to read by means of the
readDataByLocalIdentifier service. This allows the tester to take snapshots of analog measurement values
and digital inputs at short intervals. In order to save time in the measurement period, the memory access
rights are checked as soon as the record is defined. The following procedure shall be performed:
At first the tester should make sure, that the record to be (re-)defined is cleared before. The record can be
cleared by setting its size to zero with the dynamicallyDefineLocalIdentifier request message including the
definitionMode set to "clearDynamicallyDefinedLocalIdentifier" (see below).

The tester may send further dynamicallyDefineLocalIdentifier request messages in order to change certaine
record elements or to extend the record. The highest position number is decisive of the size of the
dynamically defined record! Note that the tester is responsible for the size and structure of the positive
response message of the readDataByLocalIdentifier service. The tester should care that areas of
measurement values do not overlap in the readDataByLocalIdentifier positive response message. If
positions are defined multiply, the latest definition is valid.

If one single dynamicallyDefineLocalIdentifier request message is not sufficient to define the whole record,
the tester may use more than one request message. The record definition is limited by:
• maximum 20 memory areas and
• maximum 253 positions (bytes) in the readDataByLocalIdentifier positive response message.

If the definitionMode parameter is set to clearDynamicallyDefinedLocalIdentifier (04h), the tester causes

the ECU to clear the dynamicallyDefinedLocalIdentifier (= F0h). This request message sets the record size
to zero and enables the tester to redefine the dynamicallyDefinedLocalIdentifier data record.

Byte Request block Hex Value Mnemonic

#1 dynamicallyDefineLocalIdentifier Request Service Id 2C DDLI
#2 dynamicallyDefinedLocalIdentifier F0 DDLI_...
#3 definitionMode = [clearDynamicallyDefinedLocalIdentifier] 04 CDDLI

Byte Positive response block Hex Value Mnemonic

#1 dynamicallyDefineLocalIdentifier Positive Response SId 6C DDLIPR
#2 dynamicallyDefinedLocalIdentifier F0 DDLI_...

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Measuring and Data Transmission

 Software Documentation Page 11-5
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

Byte Negative response block Hex Value Mnemonic

#1 negativeResponse Service Id 7F NR
#2 dynamicallyDefineLocalIdentifierRequest Service Id 2C DDLI
#3 responseCode = [ xx=[ RC_...
subFunctionNotSupported-invalidFormat 12,
(definition mode or local identifier not supported),
busy-repeatRequest, 21,
conditionsNotCorrectOrRequestSequenceError 22,
(record was defined in another diagnostic mode;
record is full up),
securityAccessDenied-securityAccessRequested ] 33]

Vehicle manufacturer and system supplier have to agree on the conferment of memory access rights. With
this software version the following memory parts are suitable to be defined by the
dynamicallyDefineLocalIdentifier service. Note that each memory area defined by the parameters
memoryAddress and memorySize has to lie completely inside one of the below defined memory areas:

Range of Memory Bank Access in Diagnostic Modes

Addresses
Hex
3F9800 ñ 3FFFFF RAM Standard Diagnosis Mode
ECU Development Mode
Engine Manufacturer Mode
Vehicle Manufacturer Mode
ECU System Supplier Mode
60000 ñ 67FFF Data Section ECU Development Mode
1: Engine Manufacturer Mode
(Flash/RAM) Vehicle Manufacturer Mode
ECU System Supplier Mode
68000 ñ 6FFFF Data Section ECU Development Mode
2: Engine Manufacturer Mode
(Flash/RAM) Vehicle Manufacturer Mode
ECU System Supplier Mode
1)
whatever is currently activated

If the record defined by the tester is huge big, the ECU needs some time to check whether the tester has got
the right to access to all requested memory cells. In this case the ECU might answer with the negative
response code "busy-repeatRequest". The tester has now to repeat the request (but without parameters,
only with SID) as often as the ECU responses with "busy-repeatRequest". When the ECU answers
positively, the ECU has finished the memory check and is no longer busy (see section "Negative Response
Code Value Summary Table").

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Measuring and Data Transmission

 Software Documentation Page 11-6
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

11.2 readDataByLocalIdentifier (21h)

The readDataByLocalIdentifier service requests data record values from the ECU identified by the
RecordLocalIdentifier. The measurement values of the data record defined by the RecordLocalIdentifier $F0
are set by the service DynamicallyDefineLocalIdentifier. The other data records which can be read by the
readDataByLocalIdentifier service are set in the ECU dataset. A list of already defined data records is given
in chapter Local Identifier.
The ECU sends the actual measurement values via the readDataByLocalIdentifier positive response
message.
Note that the request message with the recordLocalIdentifier $F0 has to be sent in that diagnostic mode in
which the respective local identifier was dynamically defined.
The parameter recordLocalIdentifier (RELI_) in the readDataByLocalIdentifier request message identifies
the RecordLocalIdentifier.
The parameter recordValue (RV_) is used by the readDataByLocalIdentifier positive response message to
provide the data record identified by the recordLocalIdentifier to the tester. The user optional recordValues
shall include ECU specific input, internal and output data.

Request
Byte Request block Hex Value Mnemonic
#1 readDataByLocalIdentifier Request Service Id 21 RDBLI
#2 recordLocalIdentifier xx RELI_...

Positive Response
Byte Positive response block Hex Value Mnemonic
#1 readDataByLocalIdentifier Positive Response Service Id 61 RDBLIPR
#2 recordLocalIdentifier xx RELI_...
#3 recordValue#1 xx RV_...
: : : :
#n recordValue#m xx RV_...

Negative Response
Byte Negative response block Hex Value Mnemonic
#1 negativeResponse Service Id 7F NR
#2 readDataByLocalIdentifier Request Service Id 21 RDBLI
#3 responseCode = [ xx=[ RC_...
generalReject 10,
serviceNotSupported (wrong diagnostic mode) 11,
subFunctionNotSupported-invalidFormat 12,
(recordLocalIdentifier not supported),
conditionsNotCorrectOrRequestSequenceError, 22,
securityAccessDenied-securityAccessRequested 33
(record was defined in a different diagnostic mode) ] ]

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Measuring and Data Transmission

 Software Documentation Page 11-7
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

11.2.1 Read Data by Local Identifier List

11.2.1.1 Local Identifier (recordLocalIdentifier (RELI_)): 0x02

Position Name of variable Description
Length of Conversion
variable formula
1 eapp_pv_filt_w Accelerator pedal position 2 PW_01U
2 eapp_s_def_uc Defect state of APP sensor 1 DEZ_UC
3 eaps_p_w Atmospheric pressure 2 P_01U
4 eaps_s_def_uc Defect state of APS sensor 1 DEZ_UC
5 eaux_u_w Voltage of reserve analog input 2 U_01U
6 ebat_u_avg_w Average battery voltage 2 U_02U
7 ebat_s_def_uc Defect state of battery voltage 1 DEZ_UC
8 ebov_u_c1_w Booster voltage C1 2 U_CR
9 ebov_s_def_c1_uc Defect status C1 1 DEZ_UC
10 ebov_u_c2_w Booster voltage C2 2 U_CR
11 ebov_s_def_c2_uc Defect status C2 1 DEZ_UC
12 ebps_p_w Boost pressure 2 P_01U
13 ebps_s_def_uc Defect state of BPS sensor 1 DEZ_UC
14 eclu_s_b State of clutch 1 BOOL_UC
15 eclu_s_def_uc Defect state of clutch 1 DEZ_UC
16 ects_t_w Coolant temperature 2 T_01U
17 ects_s_def_uc Defect state of CTS sensor 1 DEZ_UC
18 eebs_s_b State of engine brake switch 1 BOOL_UC
19 eess_n_sys_w System speed (engine speed) 2 N_01U
20 eess_s_mode_uc Working mode engine speed 1 DEZ_UC
sensing
21 efps_p_w Fuel pressure 2 PF_01U
22 efps_s_def_uc Defect state of FPS sensor 1 DEZ_UC
23 efts_t_w Fuel temperature 2 T_01U
24 efts_s_def_uc Defect state of FTS sensor 1 DEZ_UC
25 eign_s_b State of Terminal 15 1 BOOL_UC
26 ekid_s_b State of kick down switch 1 BOOL_UC
27 emss_u_w Voltage of MSS switch 2 U_01U
28 emss_s_def_uc Defect state of MSS switch 1 DEZ_UC
29 eops_p_w Oil pressure value 2 P_01U
30 eops_s_def_uc Defect state of OPS sensor 1 DEZ_UC
31 epbs_s_b State of park. brake switch 1 BOOL_UC
32 esbr_s_b State of service brake switch 1 BOOL_UC
33 esbr_s_def_uc Defect state of service brake switch 1 DEZ_UC
34 evss_v_filt_w Vehicle speed 2 V_01U
35 evss_s_def_uc Defect state of VSS sensor 1 DEZ_UC
36 ebts_t_w Boost temperature 2 T_01U
37 ebts_s_def_uc Defect state of BTS sensor 1 DEZ_UC
38 eots_t_w Oil temperature 2 T_01U
39 eots_s_def_uc Defect state of OTS sensor 1 DEZ_UC
40 ecls_s_b Engine coolant level state 1 BOOL_UC
41 ecls_s_def_uc Defect state of CLS sensor 1 DEZ_UC
42 ewfs_s_b Water in fuel switch state 1 BOOL_UC
43 ewfs_s_def_uc Defect state of WFS switch 1 DEZ_UC
44 ecmp_s_state_uc Polarity check state of camshaft 1 DEZ_UC
sensor
45 eckp_s_state_uc Polarity check state of crankshaft 1 DEZ_UC
sensor

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Measuring and Data Transmission

 Software Documentation Page 11-8
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

46 liad_n_corr_w Offset added to Base value of low 2 N_01U

idle speed
47 bimi_phi_w Begin of main injection 2 PHI_W
48 ccsp_v_endsp_w Target setpoint value of CC 2 V_01U
49 cmol_d_dis_ul Distance counter 4 DISTANCE
50 cmol_dt_enghrs_ul Total engine working hours 4 TI_HOUR
51 cmol_dt_edchrs_ul Total EDC working hours 4 TI_HOUR
52 cmol_ct_starts_ul Number of ECU starts 4 DEZ_UL
53 vlsp_v_w Vehicle speed limit 2 V_01U
54 feof_n_limit_w Actually engine speed allowed by 2 N_01U
fuel economy function
55 feof_fbf_gov_w Feedback factor for hisp limit 2 FK_01U
56 feof_d_gear_uc Gear detected from fuel economy 2 DEZ_UC
optimation logic

11.2.1.2 Local Identifier (recordLocalIdentifier (RELI_)): 0x03

Position Name of data Length of Description Conversion formula
variable
1 ISCS_N_MAX_CW Upper limit 2 N_01U
value of
rotation speed
of PTO
2 HISP_ISM_CSTR.SOLLWER Max. value of 2 N_01U
T rotation speed
of PTO
3 LISC_N_BAS_CW Base value of 2 N_01U
low idle engine
speed
4 CCSP_V_MAX_CW Maximum 2 V_01U
vehicle speed
of Cruise
Control
5 CCLO_V_MIN_CW Minimum 2 V_01U
vehicle speed
to activate Cr.
Control
6 VLSP_V_CW Vehicle speed 2 V_01U
limitation
setpoint
7 VLSP_V_MAXTHR_CW Maximum 2 V_01U
threshold of
vehicle speed
8 cuid_d_vms5_uc[] Customer 10 A_S_C_I_I
string nr.5
located in
EEPROM
9 FEOF_N_MAX_CW Maximum limit 2 N_01U
of fuel
economy
function
10 FEOF_N_MIN_CW Minimum limit 2 N_01U
of fuel
economy
function

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Measuring and Data Transmission

 Software Documentation Page 11-9
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

11.2.1.3 Reading of EEPROM blocks with local Identifier

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Measuring and Data Transmission

 Software Documentation Page 11-10
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

11.2.1.4 Maximum vehicle speed

Local Identifier Name of EEPROM block Length of block in byte
0x17 Customer block 1 2

Contents:
Byte Descrition of byte Conversi Remarks
on
Formula
1 vlsp_v_w (max. veh. speed) high byte V_01U Customer specific and
changeable data
2 vlsp_v_w (max. veh. speed) low byte V_01U Customer specific and
changeable data

Description: The maximum vehicle speed can be read with this service. This value is limitated with the
VLSP_V_MAXTHR_CW label. In case of an EEPROM failure VLSP_V_CW is taken as replacement value.

11.2.1.5 Fuel economy optimisation function

Local Identifier Name of EEPROM block Length of block in byte
0x18 Customer block 1 30

Contents:
Byte Descrition of byte Conversio Remarks
n
formula
1 feof_s_clu_b (activate clutch BOOL_UC Customer specific and
conditions) changeable data
2 feof_s_act_b (activation flag of BOOL_UC Customer specific and
function) changeable data
3 ñ 14 feof_gr_gear_w (calculated gear ratio FZN_01U Customer specific and
for every gear) changeable data (ratio
frequency of impulses (VSS)/
engine speed)
15 ñ 26 feof_gr_geardev_w (allowed deviations FZN_01U Customer specific and
of calculated gear ratio value for every changeable data
gear)
27 ñ 28 feof_gr_deb_w gear ratio to debounce FZN_01U Customer specific and
switching in the next gear ) changeable data
29 - 30 feof_fbf_gov_w feedback factor of FK_01U Customer specific and
governor changeable data

Description: adjustable datas of the optimisation function can be read with this service.

11.2.1.6 Access protection byte

Local Identifier Name of EEPROM block Length of block in byte
0x19 Customer block 2 4

Contents:
Byte Descrition of byte Conversi Remarks
on
Formula
1 Access protection byte DEZ_UC Customer specific and
changeable data
2 Counter of block - For internal EEPROM handling
needed
3 Checksum of block - For internal EEPROM handling
needed

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Measuring and Data Transmission

 Software Documentation Page 11-11
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

4 Checksum of block - For internal EEPROM handling

needed

Description: This byte should be read by the tester to activate or deactivate services in the tester.
(e.g. programming of the fuel economy parameters, speed limits)

11.2.1.7 Fuel economy function speed limits

Local Identifier Name of EEPROM block Length of block in byte

0x20 Customer block 3 15

Contents:
Byte Descrition of byte Conversi Remarks
on
formula
1-2 Engine speed limit gear 1 N_01U Customer specific and
changeable data
3-4 Engine speed limit gear 2 N_01U Customer specific and
changeable data
5-6 Engine speed limit gear 3 N_01U Customer specific and
changeable data
7-8 Engine speed limit gear 4 N_01U Customer specific and
changeable data
9-10 Engine speed limit gear 5 N_01U Customer specific and
changeable data
11-12 Engine speed limit gear 6 N_01U Customer specific and
changeable data
13 Counter of block - For internal EEPROM handling
needed
14 Checksum of block - For internal EEPROM handling
needed
15 Checksum of block - For internal EEPROM handling
needed

Description: Reading of the engine speed limits for every gear.

11.2.1.8 Customer String VMS5

Local Identifier Name of EEPROM block Length of block in byte
0x21 CUID_VMS5 string 13

Contents:
Byte Descrition of byte Conversi Remarks
on
formula
1-10 Customer string in EEPROM (10 ASCII Customer specific and
bytes length) changeable data
11 Counter of block - For internal EEPROM handling
needed
12 Checksum of block - For internal EEPROM handling
needed
13 Checksum of block - For internal EEPROM handling
needed

Description: Reading of customer specific string located in EEPROM.

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Measuring and Data Transmission

 Software Documentation Page 11-12
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

11.2.1.9 Low idle adjustment

Local Identifier Name of EEPROM block Length of block in byte
0x22 Low idle adjustment variable 2

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Measuring and Data Transmission

 Software Documentation Page 11-13
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

Contents:
Byte Descrition of byte Conversi Remarks
on
formula
1 Low idle correction value, high byte N_01 Customer specific and
(liad_n_corr_w) changeable data
2 Low idle correction value, low byte N_01 Customer specific and
(liad_n_corr_w) changeable data

Description: With this service the correction value of the low idle setpoint calculation can be read.

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Measuring and Data Transmission

 Software Documentation Page 11-14
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

11.3 writeDataByLocalIdentifier (3Bh)

This writeDataByLocalIdentifier service enables modifying values within the memory by a LocalIdentifier.
The values of the data record defined by the RecordLocalIdentifier $F0 are set by the service
DynamicallyDefineLocalIdentifier. The other data records which can be written by the
writeDataByLocalIdentifier service are set in the ECU dataset. A list of already defined data records is given
in chapter Local Identifier.
Note that the request message with the recordLocalIdentifier $F0 has to be sent in that diagnostic mode in
which the respective local identifier was dynamically defined.
The parameter recordLocalIdentifier (RELI_) in the writeDataByLocalIdentifier request message identifies
the RecordLocalIdentifier.
The user optional recordValues (RV_) shall include ECU specific input, internal and output data.

Request
Byte Request block Hex Value Mnemonic
#1 writeDataByLocalIdentifier Request Service Id 3B WDBLI
#2 recordLocalIdentifier xx RELI_...
#3 recordValue#1 xx RV_...
: : : :
#n recordValue#m xx RV_...

Positive Response
Byte Positive response block Hex Value Mnemonic
#1 writeDataByLocalIdentifier Positive Response Service Id 7B WDBLIPR
#2 recordLocalIdentifier xx RELI_...

Negative Response
Byte Negative response block Hex Value Mnemonic
#1 negativeResponse Service Id 7F NR
#2 writeDataByLocalIdentifier Request Service Id 3B WDBLI
#3 responseCode = [ xx=[ RC_...
general Reject (incorrect repetition of request after neg. 10,
response Ñbusy - repeat requestì),
serviceNotSupported (wrong diagnostic mode), 11,
subFunctionNotSupported-invalidFormat 12,
(recordLocalIdentifier not supported, wrong number of
data),
conditionsNotCorrectOrRequestSequenceError, 22,
securityAccessDenied-securityAccessRequested 33,
(record was defined in a different diagnostic mode,
no write access, no security access after
startDiagnostic-Session),
downloadNotAccepted (application RAM is not avaiable) 40]
]

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Measuring and Data Transmission

 Software Documentation Page 11-15
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

11.3.1 Supported recordLocalIdentifier for write function:

11.3.1.1 General Info to EEPROM writing with local ID

It is possible to shift datas in EEPROM and change the values of this datas with the KWP2000 service
ìWrite Data by Local Identifierî.
In case of a EEPROM defect or a new EEPROM the replacement values of the variables are taken (located
in flash area).
All datas of one local ID have to programmed in every programming cycle. It is not possible to program only
one value in the same local ID if there are more than one databytes in this service.

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Measuring and Data Transmission

 Software Documentation Page 11-16
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

11.3.1.2 Maximum vehicle speed

Local Identifier Name of EEPROM block Length of block in byte
0x17 Customer block 1 2

Contents:
Byte Descrition of byte Conversi Remarks
on
Formula
1 vlsp_v_w (max. veh. speed) high byte V_01U Customer specific and
changeable data
2 vlsp_v_w (max. veh. speed) low byte V_01U Customer specific and
changeable data

Description: The maximum vehicle speed can be changed with this service. This value is limited with the
VLSP_V_MAXTHR_CW label. In case of an EEPROM failure VLSP_V_CW is taken as replacement value.

11.3.1.3 Fuel economy optimisation function

Local Identifier Name of EEPROM block Length of block in byte
0x18 Customer block 1 30

Contents:
Byte Descrition of byte Conversio Remarks
n
formula
1 feof_s_clu_b (activate clutch BOOL_UC Customer specific and
conditions) changeable data
2 feof_s_act_b (activation flag of BOOL_UC Customer specific and
function) changeable data
3 ñ 14 feof_gr_gear_w (calculated gear ratio FZN_01U Customer specific and
for every gear) changeable data (ratio
frequency of impulses (VSS)/
engine speed)
15 ñ 26 feof_gr_geardev_w (allowed deviations FZN_01U Customer specific and
of calculated gear ratio value for every changeable data
gear)
27 ñ 28 feof_gr_deb_w gear ratio to debounce FZN_01U Customer specific and
switching in the next gear ) changeable data
29 - 30 feof_fbf_gov_w feedback factor of FK_01U Customer specific and
governor changeable data

Description: adjustable datas of the optimisation function can be changed with this service. (details to this
datas refer to feof documentation).

11.3.1.4 Access protection byte

Local Identifier Name of EEPROM block Length of block in byte
0x19 Customer block 2 4

Contents:
Byte Descrition of byte Conversi Remarks
on
formula
1 Access protection byte DEZ_UC Customer specific and
changeable data
2 Counter of block - For internal EEPROM handling
needed
3 Checksum of block - For internal EEPROM handling

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Measuring and Data Transmission

 Software Documentation Page 11-17
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

needed
4 Checksum of block For internal EEPROM handling -
needed
Description: This byte should be read by the tester to activate or deactivate services in the tester.(e.g.
programming of the fuel economy parameters, speed limits)

11.3.1.5 Fuel economy function speed limits

Local Identifier Name of EEPROM block Length of block in byte

0x20 Customer block 3 15

Contents:
Byte Descrition of byte Conversi Remarks
on
formula
1-2 Engine speed limit gear 1 N_01U Customer specific and
changeable data
3-4 Engine speed limit gear 2 N_01U Customer specific and
changeable data
5-6 Engine speed limit gear 3 N_01U Customer specific and
changeable data
7-8 Engine speed limit gear 4 N_01U Customer specific and
changeable data
9-10 Engine speed limit gear 5 N_01U Customer specific and
changeable data
11-12 Engine speed limit gear 6 N_01U Customer specific and
changeable data
13 Counter of block - For internal EEPROM handling
needed
14 Checksum of block - For internal EEPROM handling
needed
15 Checksum of block - For internal EEPROM handling
needed

Description: The engine speed limitation thresholds for every gear can be programmed with this service.

11.3.1.6 Customer String VMS5

Local Identifier Name of EEPROM block Length of block in byte
0x21 CUID_VMS5 string 13

Contents:
Byte Descrition of byte Conversi Remarks
on
formula
1-10 Customer string in EEPROM (10 ASCII Customer specific and
bytes length) changeable data
11 Counter of block - For internal EEPROM handling
needed
12 Checksum of block - For internal EEPROM handling
needed
13 Checksum of block - For internal EEPROM handling
needed

Description: Writing of the customer string VMS5 is possible with this service

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Measuring and Data Transmission

 Software Documentation Page 11-18
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

11.3.1.7 Low idle adjustment

Local Identifier Name of EEPROM block Length of block in byte

0x22 Low idle adjustment variable 2

Contents:
Byte Descrition of byte Conversi Remarks
on
formula
1 Low idle correction value, high byte N_01 Customer specific and
(liad_n_corr_w) changeable data
2 Low idle correction value, low byte N_01 Customer specific and
(liad_n_corr_w) changeable data

Description: With this service the correction value of the low idle setpoint calculation can be changed.

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Measuring and Data Transmission

 Software Documentation Page 11-19
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

11.4 readMemoryByAddress (23h)

The readMemoryByAddress request message requests memory data from the ECU identified by the
parameters memoryAddress and memorySize. The ECU sends data record values via the
readMemoryByAddress positive response message.
The parameter memoryAddress (MA_) in the readMemoryByAddress request message identifies the start
address in the ECU's memory.
The parameter memorySize (MS_) specifies the number of bytes to be read starting at a specified memory
address in the ECU's memory.

Byte Request block Hex Value Mnemonic

#1 readMemoryByAddress Request 23 RMBA
#2 memoryAddress (High Byte) xx MA_...
#3 memoryAddress (Middle Byte) xx
#4 memoryAddress (Low Byte) xx
#5 memorySize xx MS_...

Byte Positive response block Hex Value Mnemonic

#1 readMemoryByAddress Positive Response 63 RMBAPR
#2 recordValue#1 xx RV_...
: : : :
#n recordValue#m xx RV_...

Byte Negative response block Hex Value Mnemonic

#1 negativeResponse Service Id 7F NR
#2 readMemoryByAddressRequest Service Id 23 RMBA
#3 responseCode = [ xx=[ RC_...
requestOutOfRange (invalid memory size), 31,
securityAccessDenied-securityAccessRequested] 33]

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Measuring and Data Transmission

 Software Documentation Page 11-20
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

Vehicle manufacturer and system supplier have to agree on the conferment of memory access rights. With
this software version the following memory parts are suitable to be read by the readMemoryByAddress ser-
vice. Note that each memory area defined by the parameters memoryAddress and memorySize has to lie
completely inside one of the below defined memory areas:

Range of Memory Bank Access in Diagnostic Modes

Addresses
Hex
3F9800 ñ 3FFFFF RAM StandardDiagnosticMode
ECUDevelopmentMode
Engine Manufacturer Mode
ECU System Supplier Mode
Vehicle Manufacturer Mode
60000 ñ 67FFF Data Section
1: ECU Development Mode
Engine Manufacturer Mode
ECU System Supplier Mode
Vehicle Manufacturer Mode

68000 ñ 6FFFF Data Section

2: ECUDevelopmentMode
Engine Manufacturer Mode
ECU System Supplier Mode
Vehicle Manufacturer Service

1)
whatever is currently activated

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Measuring and Data Transmission