Software Documentation Page 5-1

Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

5 Diagnostic Management

5.1 startDiagnosticSession (10h)

This message is used to enable different diagnostic modes in the ECU. A diagnostic mode (session) can
only be started if securityAccess service has been performed before (unless defaultMode-
StandardDiagnosticMode shall be enabled). If the ECU supports serial application, upon the
startDiagnosticSession service the flash memory data-set will - depending on the diagnostic mode selected -
automatically be set to the working page (for details refer to section "Serial Application"). As the copy
operation takes some time (about 1 second), the startDiagnosticSession request will be delayed responded
or possibly be negatively responded (negative response code "busy-RepeatRequest") until the working page
is active (refer to section "Negative Response Code Value Summary Table").

Byte Request Hex Value Mnemonic

#1 startDiagnosticSession Request Service Id 10 SDS
#2 diagnosticMode (refer to table below) xx DCM_...
#3 baudrateIdentifier xx BI

Byte Positive response Hex Value Mnemonic

#1 startDiagnosticSession Positive Response Service Id 50 SDSNR
#2 diagnosticMode xx RC_..
#3 baudrateIdentifier xx BI
Note: Parameter BI is optional (and only defined for K-Line, not for CAN)

Byte Negative response Hex Value Mnemonic

#1 negative Response Service Id 7F NR
#2 startDiagnosticSession Request Service Id 10 SDS
#3 responseCode = [ xx=[ RC_..
invalid length, 12,
diagnostic mode not supported,
busy-repeatRequest, 21,
conditionsNotCorrectOrRequestSequenceError 22,
invalid baudrate, 31,
securityAccessDenied] 33]

Upon the startDiagnosticSession request message with diagnosticMode "ECUProgrammingMode" the ECU
turns into the internal mode of operation (Bootblock software), where only programming functions are
available (refer to sections "EDC7 Modes of Operation" and "Flash Memory Programming"). Note: the
internal mode of operation can only be left by performing an ECU reset!
If the tester has already entered a diagnostic session and then requests another diagnostic session (with a
different parameter diagnosticMode), the previously active session will automatically be closed and the new
diagnostic mode becomes active immediately. The old session does not have to be stopped with the
stopDiagnosticSession request service. Nevertheless the tester has to take the following into account when
changing a diagnostic session:
• A diagnostic session can not be left or switched, if any local routine (started by
startRoutineByLocalIdentifier) is still running or if a "requestUpload/requestDownload - transferData -
requestTransferExit"-sequence or an EOL-write session is still in process.

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Diagnostic Management

 Software Documentation Page 5-2
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

• If serial application has been performed within a diagnostic session, the (adjusted) application-RAM
contents should be stored in the flash-EPROM (with a startRoutineByLocalIdentifier request message)
before leaving the session! Otherwise another startDiagnosticSession request would copy the data-set
from flash to RAM again and would therefore overwrite all adjustments!
The parameter diagnosticMode (DCM_) is used by the startDiagnosticSession service to select the desired
diagnostic mode. The following diagnostic modes are specified for EDC7:

Description Hex Mnemonic

value
defaultMode-StandardDiagnosticMode 81 DCM_
This diagnosticMode is active after the initialization has DTM-SDM
been successfully completed between tester and ECU. It
contains always available functions. Neither
securityAccess nor startDiagnosticSession with the
diagnosticMode set to "defaultMode-
StandardDiagnosticMode" is required after initialization.

EndOfLineProgrammingMode 83 DCM_
This diagnosticMode enables all keyword protocol 2000 EOL
services required for data programming. The EOL
programming services can be used with the Development,
Engine Manufacturer and Vehicle Manufacturer Factory
access. They differ in the EOL areas that might be
reprogrammed.

ECUProgrammingMode 85 DCM_
This diagnosticMode enables all keyword protocol 2000 ECUPM
services for memory programming of the ECU.

ECUDevelopmentMode 86 DCM_
This diagnosticMode enables all keyword protocol 2000 services ECUDM
supporting development and application/calibration of the ECU.

EngineManufacturerFactory ECUAdjustmentMode 87 DCM_

This diagnosticMode enables all keyword protocol 2000 EMFAM
services supporting the adjustment of functions/data like idle
speed, CO value, etc. in the ECU's memory. Additionally
services for serial application are enabled.
SystemSupplierSpecific FA DCM_
This value is reserved for system supplier specific use. SSS
VehicleManufacturerService ECUAdjustmentMode 89 DCM_
This diagnosticMode enables all keyword protocol 2000 VMSAM
services supporting the adjustment of functions/data like
idleVersion 1.4 speed, CO value, etc. in the ECU's memory. To
allow frequent change of some data the service for writing by
LocalID is enabled.

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Diagnostic Management

 Software Documentation Page 5-3
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

The baudrateIdentifier (BI_) causes the ECU to switch to a different communication baudrate. The ECU
("baudrateECU") tries to adapt to the tester baudrate ("baudratetester") as close as possible. The desired
baudrate becomes active after the positive response message is sent. If the baudrateIdentifier is not
transmitted, the baudrate will not be switched.
Note that the ECU baudrate is limited by the ECU specific hardware configuration (e. g. wiring harness) and
by the current operating conditions (CPU load). When the engine is out of action, higher baudrates may be
selected than in case the engine is running. For details refer to section "Timing". Using higher baudrates
than 10,4 kBaud is out of the keyword protocol 2000 standard.
A sample of possible baudrates (including all possible baudrates above 40 kbaud) is shown below:

Hex baudratetester in kbaud i k

Value
00 6,4 0 0
10 9,6 0 16
14 10,4 0 20
24 14,4 1 4
30 19,2 1 16
44 28,8 2 4
50 38,4 2 16
54 41,6 2 20
5C 48,0 2 28
5E 49,6 2 30
64 57,6 3 4
6A 67,2 3 10
6D 72,0 3 13
74 83,2 3 20
7E 99,2 3 30
84 115,2 4 4
87 124,8 4 7
94 166,4 4 20
A7 249,6 5 7

To calculate the baudrateIdentifier from the tester baudrate, the following equation must be satisfied:

k + 32
baudrate tester = 6,4 ⋅ 2 i⋅ kbaud
32

where i is represented by the baudrateIdentifier bits 5, 6 and 7 and k by bits 0 - 4 (xx = iiikkkkkh).
Example: Switching the baudrate to 115 kbaud requires baudrateIdentifier xx = 84h (i = 4, k = 4).

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Diagnostic Management

 Software Documentation Page 5-4
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

5.2 readEcuIdentification (1Ah)

The readEcuIdentification service requests identification data from the ECU. The type of identifcation data
requested by the tester is identified by the identifcationOption parameter. The ECU sends an identification
data record included in the readEcuIdentification positive response message. The format of the
identification data accords with section "Data Scaling". The first parameter of the positive response
message is always the repetition of the identificationOption of the request message. This is required
because the identificationOptions "EcuIdentificationDataTable" and "EcuIdentificationScalingTable" may
include multiple identificationOptions based on the definition of the vehicle manufacturer.

Byte Request block Hex Value Mnemonic

#1 readEcuIdentification Request Service Id 1A REI
#2 identification Option= (refer to table below) 80 - 9F IO_

Byte Positive response block Hex Value Mnemonic

#1 readEcuIdentification Positive Response Service Id 5A REIPR
#2 identificationOption = [ECUIdentificationDataTable] 80 IO_
#3 ECUIdentificationParameter#1.1 xx ECUIP
: : : :
: ECUIdentificationParameter#1.m xx ECUIP
: ECUIdentificationParameter#2.1 xx ECUIP
: : : :
: ECUIdentificationParameter#2.m xx ECUIP
: : : :

Byte Positive response block Hex Value Mnemonic

#1 readEcuIdentification Positive Response Service Id 5A REIPR
#2 identificationOption = [ECUIdentificationScalingTable] 81 IO_
#3 scalingOffset#1 xx ECUIP
: identificationOption#1 xx ECUIP
: scalingByte#1.1 xx ECUIP
: : : :
: scalingByte#1.m xx ECUIP
: scalingOffset#2 xx ECUIP
: identificationOption#2 xx ECUIP
: scalingByte#2.1 xx ECUIP
: : : :
: scalingByte#2.m xx ECUIP
: : : :
#n scalingOffset#EOT FF ECUIP_EO
T

Byte Positive response block Hex Value Mnemonic

#1 readEcuIdentification Positive Response Service Id 5A REIPR
#2 identificationOption = (refer to table below) 86 - 9F IO_
#3 ECUIdentificationParameter#1 xx ECUIP
: : : :
#n ECUIdentificationParameter#m xx ECUIP

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Diagnostic Management

 Software Documentation Page 5-5
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

Byte Negative response block Hex Value Mnemonic

#1 negative Response Service Id 7F NR
#2 readEcuIdentification Request Service Id 1A REI
#3 responseCode = [ xx=[ RC_...
subFunctionNotSupported-invalidFormat, invalid 12,
length,
identification option not supportet 31,
requestOutOfRange, acces temporarily not possible 33]
securityAccessDenied-securityAccessRequested]

The parameter identificationOption (IO_) is used by the readEcuIdentification request message to

describe the kind of identification data requested by the tester.
The identificationOption table below consists of the following columns:
1. Hex value assigned to the identificationOption
2. Description of the identificationOption
3. Who specifies the identification data
4. Scaling type (refer to section "Data Scaling")
5. Labels of which the identifier is compiled. For details (e. g. length information) refer to the respective
sections CUID and RBID.

Hex Description Source Scaling Label

of ID type
80 ECUIdentificationDataTable system
This value causes the ECU to report all supplier
available ECU identification data. The infor-
mation contained in this table is identified by
the identificationOption numbers 86h - 9Fh.
Note: As the number of bytes to be reported
may exceed the size of one single positive
response, the 'response data segmentation' is
used here. The response message content is
splitted into several response messages. Data
segmentation shall be detected by the tester
by comparing source address (if present) and
service IDs which are identical for all
response messages during segmentation.
P3min has to be > P2max!
81 ECUIdentificationScalingTable system
This value causes the ECU to report a table supplier
of scaling data for all available ECU identifi-
cations (identified by the identificationOption
numbers 86h - 9Fh). The format of the scaling
data is described in section "Data Scaling".
The data content of the ECUIdentificationSca-
lingTable depends on length and format of
the identification data being implemented in
the ECU identification data table. This table
can be requested with the identificationOption
set to "ECUIdentificationDataTable" (80h).
86 customerString0 vehicle ASCII CUID_D_VMS0_CUC
This value causes the ECU to report a manu-
freeform customer string. facturer

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Diagnostic Management

 Software Documentation Page 5-6
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

Hex Description Source Scaling Label

of ID type
87 vehicleManufacturerECUSoftwareVersion- vehicle ASCII CUID_D_SWVER_CUC
Number manu-
This value causes the ECU to report the soft- facturer
ware version string.
89 customerString1 vehicle ASCII CUID_D_VMS1_CUC
This value causes the ECU to report a free- manu-
form customer string. facturer

8A PA Label and Checksum ( 8 bytes ) system USN

supplier
8B PA ASCII Info ( 72 bytes ) system ASCII
supplier
8C Boot Systemstate ( 6 bytes ) system USN
supplier
8E epromDatasetIdentification system ASCII
This value causes the ECU to report the supplier
EPROM identification string for application
tool and the dataset identifier, both from the
non applicable area of the flash-EPROM.
8F factoryData system Packet rbid_d_pd1_uc +
This value causes the ECU to report from the supplier rbid_d_pd2_uc +
EEPROM: rbid_d_sn_uc +
rbid_d_fc_uc +
• Production date 1 (ASCII, 8 bytes)
rbid_d_hw_uc +
• Production date 2 (ASCII, 8 bytes)
rbid_d_pcb_uc +
• ECU serial number (BCD, 12 bytes) rbid_d_tsw_uc
• Flash container number (ASCII, 10 bytes)
• HW version (unsignedNumeric, 1 byte)
• PCB version (unsignedNumeric, 1 byte)
• Testsoftware container number (ASCII,
10 bytes)
90 vehicleIdentificationNumber vehicle ASCII CUID_D_VIN_CUC
This value causes the ECU to report the manu-
vehicle identification number. facturer

91 vehicleManufacturerECUHardwareNumber vehicle ASCII CUID_D_ECUNR_CUC

This value causes the ECU to report the manu-
vehicle manufacturer ECU hardware number. facturer

92 systemSupplierECUHardwareNumber system ASCII

This value causes the ECU to report the ECU supplier
type from the non applicable area of the
flash-EPROM and the order number from the
EEPROM.
93 systemSupplierECUHardwareVersionNum system ASCII rbid_d_mi_uc
ber supplier
This value causes the ECU to report the
hardware modification ID from the EEPROM.
94 systemSupplierECUSoftwareNumber system ASCII
This value causes the ECU to report the soft- supplier
ware identifier from the non applicable area of
the flash-EPROM.

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Diagnostic Management

 Software Documentation Page 5-7
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

Hex Description Source Scaling Label

of ID type
95 systemSupplierECUSoftwareVersionNum- system ASCII
ber supplier
This value causes the ECU to report the soft-
ware version from the non applicable area of
the flash-EPROM.
96 exhaust Regulation or Type Approval vehicle ASCII CUID_D_EROTAN_CUC
Number manu-
This value causes the ECU to report the facturer
system name or engine type.
97 systemNameOrEngineType vehicle ASCII CUID_D_SYS_CUC
This value causes the ECU to report the manu-
system name or engine type. facturer

98 repairShopCodeOrTesterSerialNumber vehicle ASCII CUID_D_TESTER_CUC

This value causes the ECU either to report manu-
the repair shop code or the testerís serial facturer
number.
1
99 programmingDate vehicle BCD CUID_D_PRGDAT_CUC
This value causes the ECU to report the manu-
programming date at what the facturer
software/calibration was programmed into the
ECU.
1
9A engineTestDate vehicle BCD CUID_D_ETD_CUC
This value causes the ECU to report the date manu-
of the latest completed engine test. facturer

9B dataSetIdentification vehicle ASCII CUID_D_DSID_CUC

This value causes the ECU to report the manu-
dataset identification string. facturer

9C customerString2 vehicle ASCII CUID_D_VMS2_CUC

This value causes the ECU to report a manu-
freeform customer string. facturer

9D customerString3 vehicle ASCII CUID_D_VMS3_CUC

This value causes the ECU to report a manu-
freeform customer string. facturer

9E customerString4 vehicle ASCII CUID_D_VMS4_CUC

This value causes the ECU to report a manu-
freeform customer string. facturer

9F customerString5 vehicle ASCII CUID_D_VMS5_CUC

This value causes the ECU to report a manu-
freeform customer string. facturer
1
Dates are of the format DDh MMh YYh (day, month, year)
2
Addresses are of the format HHh MMh LLh (high-, middle-, low-byte)

In case of external or internal programming e.g. DIA mode [83] the identifiers 81, 91, 92, 93, 9E can not be
read since this data are taken from the RAM which is already occupied by other data and code in this
mode.

Please don't try to read ECU-identification (1A-service) during EOL-upload/download or checksum

adustment.

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Diagnostic Management

 Software Documentation Page 5-8
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

The parameter ECUIdentificationParameter (ECUIP) is used by the readEcuIdentification positive

response message to provide the identification data and/or scaling data to the tester. An example of EDC7
identification data is shown below (refer also to section "Data Scaling"):

identificationOption identification data scaling data

Hex Description Hex as displ.Hex O. I. T. L.
90 vehicleIdentificatio 56 65 68 69 63 6C 65 20 49 Vehicle 04 90 6F 04 90 6 = F+2=
nNumber 64 65 6E 74 2E ... Ident... 62 ASCII 17
92 systemSupplierEC 45 44 43 37 ... EDC7 ... 04 92 6F 03 92 6 = F + 1=
UHardwareNumber 61 ASCII 16
94 systemSupplierEC 59 32 38 31 53 30 31 31 32 Y281S01 03 94 6C 03 94 6 = C=
USoftwareNumber 39 2D 56 129-V ASCII 12
99 programmingDate 21 09 03 21 09 03 03 99 43 03 99 4 = 3=
BCD 3
as displ. as displayed in the tester
O. Scaling Offset
I. IdentificationOption
T. Data Type (scalingByte high nibble)
L. Data Length (sum of scalingByte low nibbles)

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Diagnostic Management

 Software Documentation Page 5-9
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

5.3 testerPresent (3Eh)

This service shall be used to indicate to the ECU that the tester is present. This service is required in the
absence of other keyword protocol 2000 services to prevent ECUs from automatically returning to normal
operation and stopping communication. The following rules shall be followed:
• The presence of this service shall keep communication active between tester and ECU.
• The presence of this service shall indicate that the system should remain in a diagnostic mode of
operation.
The parameter responseRequired (RRD_) is user optional and has to be set to "yes" if transmitted.

Byte Request block Hex Value Mnemonic

#1 testerPresent Request Service Id 3E TP
#2 responseRequired = [yes] 01 RRD

Byte Positive response block Hex Value Mnemonic

#1 testerPresent Positive Response Service Id 7E TPPR

Byte Negative response block Hex Value Mnemonic

#1 negativeResponse Service Id 7F NR
#2 testerPresent Request Service Id 3E TP
#3 responseCode =[ xx=[ RC_..
subFunctionNotSupported-invalidFormat] 12]

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Diagnostic Management

 Software Documentation Page 5-10
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

5.4 ecuReset (11h)

This service requests the ECU to effectively perform an ECU reset.
The ECU reset will not be performed, if the engine is running.

Byte Request block Hex Value Mnemonic

#1 ecuReset Request Service Id 11 ER
#2 resetMode = [powerOn] 01 RM_...

Byte Positive response block Hex Value Mnemonic

#1 ecuReset PositiveResponse Service Id 51 ERPR

Byte Negative response block Hex Value Mnemonic

#1 negativeResponse Service Id 7F NR
#2 ecuReset Request Service Id 11 ER
#3 ResponseCode = [ xx=[ RC_...
SubFunctionNotSupported-invalidFormat 12
(parameter is not powerOn),
conditionsNotCorrectOrRequestSequenceError 22
(engine is running)] ]

The parameter resetMode (RM_) is used by the ecuReset request message to describe how the ECU has
to perform the reset. Refer to table below:

Hex Description Mnemonic

01 powerOn RM_PO
This value identifies the powerOn resetMode
which shall be a simulated powerOn reset
which the ECU performs after ignition OFF/ON
cycle. When the ECU performs the reset the
tester shall be prepared to re-establish
communication.

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Diagnostic Management