Actuating Unit Ehs4: Uds Protocol, Software Version: F.06.00X.00.Bdxxxx and F.07.001.00.Bd1060

Technical customer
documentation (TKU)
Actuating unit EHS4

UDS protocol, Software version:
F.06.00x.00.BDxxxx and
F.07.001.00.BD1060
RE 66157-06-B/2024-10-29, replaces: 2023-05-26, EN

© Bosch Rexroth AG 2023. All rights reserved,
also regarding any disposal, exploitation,
reproduction, editing, distribution, as well as in
the event of applications for industrial property
rights.
The data specified within only serve to describe

the product. As our products are constantly
being further developed, no statements
concerning a certain condition or suitability
for a certain application can be derived from
our information. The information given does
not release the user from the obligation of
own judgment and verification. It must be
remembered that our products are subject to a
natural process of wear and aging.
The products and configurations shown in this

document are examples. The supplied product
or configuration may therefore differ from the
figure.
The original manual was created in the English

language.
EHS_.1P____.F.06.00x.00.BDxxxx & EHS_.1P____.F.07.001.00.1060 | Actuating unit EHS4 3/174
EHS4 UDS Manual - EHS_.1P____.F.06.00x.00.BDxxxx + EHS_.1P____.F.07.001.00.BD1060
Table of Contents
1 About this documentation 8

1.1 Validity of the documentation 8
1.2 Required and supplementary documentation 8
1.3 Abbreviations 8
2 Safety 9
3 Functional Requirements 10
3.1 Layer Concept and Standards Implementation 10
3.1.1 CAN Network Layer 10
3.1.2 Application Layer 11
4 CAN-IDs, Baudrate 12
5 UDS Services 13
5.1 Diagnostic Session (DSC) 15
5.1.1 Request 15
5.1.2 Positive Response 15
5.1.3 Negative Response 16
5.2 ECUReset (ER) 17
5.2.1 Request 17
5.3 Security Access (SA) 19
5.3.1 Request Seed 20
5.3.2 Send Key 23
5.4 Routine Control (RC) 25
5.4.1 Request 25
5.5 Request Download (RD) 27
5.5.1 Request 27
5.6 TransferData (TD) 29
5.6.1 Request 29
5.7 RequestTransferExit (RTE) 31
© Bosch Rexroth, 2023 RE 66157-04-B/2023-05-23
RE 66157-06-B/2024-10-29, Bosch Rexroth AG

4/174 Actuating unit EHS4 | EHS_.1P____.F.06.00x.00.BDxxxx & EHS_.1P____.F.07.001.00.1060
5.7.1 Request 31
5.8 TesterPresent 32
5.8.1 Request 32
5.9 ReadDataByIdentifier (RDBI) 34
5.9.1 Request 34
5.10 WriteDataByIdentifier (WDBI) 35
5.10.1 Request 35
5.11 InputOutputControlByIdentifier (IOCBI) 36
5.11.1 Request 36
5.12 Read DTC Information (RDTC) 38
5.12.1 Report Number of DTC by Status MaskRequest Message 38
5.12.2 Report DTC by Status Mask 40
5.12.3 Report DTC Snapshot Record by DTC Number 41
5.12.4 Report DTC Extended Data Record by DTC Number 43
5.12.5 Report DTC Mirror Memory by DTC Number. 45
5.13 Communication Control (CC) 46
5.13.1 Request 46
5.14 ControlDTCSetting (CDS) 48
5.14.1 Request 48
5.15 ClearDiagnosticInformation (CDI) 50
5.15.1 Request 50
6 Supported Data Identifiers 52
6.1 0x0100 BatteryPotential (Read) 52
6.2 0x0116 AuxiliaryValveEstimatedFlow (Read) 53
6.3 0x0117 Auxiliary Valve Command (IO-Control) 56
6.4 0x1102 Auxiliary Main Valve Monitor (Read) 59
Bosch Rexroth AG, RE 66157-06-B/2024-10-29

6.5 0x1103 Auxiliary Pilot Valve Monitor (Read) 60

6.6 0x1104 Active Fault Code Bosch (Read) 62
6.7 0xCF01 SourceAddressCommandMessageTransmittingECU (Read/Write) 63
6.8 0xCF02 valve configuration (Read/Write) 64
6.9 0xCF03 ValveCalibration (Read/Write) 68
6.10 0xCF04 CanIf Parameters (Read/Write) 71
6.11 0xCF05 VcalParameter (Read/Write) 73
6.12 0xCF06 Position Control Parameters (Read/Write) 75
6.13 0xCF07 DitherParameters (Read/Write) 77
6.14 0xCF08 ValveAbstraction Parameters (Read/Write) 78
6.15 0xCF09 Current Control Parameters (Read/Write) 81
6.16 0xCF0A PositionControlParametersValveType_0x34 (Read/Write) 82
6.17 0xF013 Baud Rate for Autobaud settings (Read/Write) 85
6.18 0xF15A WriteFingerprint (Write) 86
6.19 0xF180 Boot Software Identification (Read) 88
6.20 0xF181 Application Software Identification (Read) 89
6.21 0xF182 Application Data Identification (Read) 90
6.22 0xF183 Boot Software Fingerprint (Read) 91
6.23 0xF184 Application Software Fingerprint (Read) 93
6.24 0xF185 Application Data Fingerprint (Read) 96
6.25 0xF186 Active Diagnostic Session (Read) 99
6.26 0xF187 VehicleManufacturerSparePartNumber (Read/Write) 100
6.27 0xF18A SystemSupplierIdentifier (Read/Write) 101
6.28 0xF18B ECU Manufacturing Date (Read/write) 102
6.29 0xF18C ECU Serial Number (Read/Write) 104
6.30 0xF18E VehicleManufacturerKitAssemblyPartNumber (Read/Write) 105
6.31 0xF190 VehicleIdentificationNumber (Read/Write) 106
6.32 0xF191 Vehicle Manufacturer ECU Hardware Number (Read/Write) 107
6.33 0xF192 System Supplier ECU Hardware Number (Read/Write) 108
6.34 0xF193 System Supplier ECU Hardware Version Number (Read/Write) 109
6.35 0xF195 BFL Software Identification (Read) 110
6.36 0xF197 System Name (Read) 111
6.37 0xF198 Software Assembly Part Number (Read/Write) 112
6.38 0xF199 Application Last Reprogrammed on (Read) 113
6.39 0xF19E ODX file Identifier (Read/Write) 115
6.40 0xF1A5 Commanded Address (Read/Write) 117

6.41 0xF1A7 VehicleModel (Read/Write) 118

6.42 0xF1A9 VehiclePlatform (Read/Write) 119
6.43 0xF1AA VehicleBrand (Read/Write) 120
6.44 0xF1F0 Boot Manager Software Identification (read) 121
6.45 0xFD01 PositionSensorCaliberation (Read/Write) 122
6.46 0xFD02 CAL BSW Identification (Read) 125
6.47 0xFD03 CBL BSW Identification (Read) 126
6.48 0xFD04 ExceptionReasonRecord (Read/Write) 127
6.49 0xFD05 Command Timeout (Read/Write) 128
6.50 0xFD06 Position Loop Control SB11 Valve (Read/Write) 129
6.51 0xFD07 Temperature Compensation (Read/Write) 132
6.52 0xFD08 VCAL Limitations (Read/Write) 133
6.53 0xFD0A ReadAdaptHoldCurrent (Read) 135
6.54 0xFD0B VCAL Temperature Correction (Read/Write) 136
6.55 0xFD0C Battery Voltage Limits (Read/Write) 139
6.56 0xFD0D Bus Off Parameters (Read/Write) 141
6.57 0xFD0E Security Algorithm (Read/Write) 143
6.58 0xFD0F Autobaud Enable/Disable (Read/Write) 145
6.59 0xFD10 Service Concept Implementation (Read/Write) 146
6.60 0xFD11 Appl_Reserved (Read/Write) 148
6.61 0xFD12 Debug Message (Testbench message) with flexible trigger options
(Read/Write) 153
6.62 0xFD13 Activate/Deactivate Temperature msg (Read/Write) 155
6.63 0xFD14 Security L6 Algorithm (Read/Write) 156
6.64 0xFE0B ECU-Age/Operating Hours (Read) 158
6.65 0xFE16 Read Temperature (Read) 159
7 Supported Routine Identifiers 161
7.1 0x0202 CheckMemoryRequest (StartRoutine-Request) 161
7.2 0x0202 CheckMemoryResponse (StartRoutine-Response) 162
7.3 0x0203 CheckProgrammingPreConditionsRequest (StartRoutine-
Request) 162
7.4 0x0203 CheckProgrammingPreConditionsResponse (StartRoutine-
Response) 163
7.5 0xFF00 EraseMemoryRequest (StartRoutine-Request) 164
7.6 0xFF00 EraseMemoryResponse (StartRoutine-Response) 164

7.7 0xFF01 CheckProgrammingDependenciesRequest (StartRoutine-

Request) 165
7.8 0xFF01 CheckProgrammingDependenciesResponse (StartRoutine-
Response) 166
7.9 0xF000 WriteAllParametersToNVM (StartRoutine - Request) 167
8 Error Management 168
8.1 Supported Fault Codes (DTC) 168
8.2 Snapshot Data Identifiers 172

8/172 EHS4 UDS Manual - EHS_.1P____.F.06.00x.00.BDxxxx +

EHS_.1P____.F.07.001.00.BD1060
1 About this documentation

This document describes the CAN communication between EHS4 and a tester using a UDS
diagnostic protocol acc. to ISO 14229.
This document is valid for EHS4 application software version F.06.001.00, F.06.002.00 and
F.07.001.00
1.1 Validity of the documentation

This documentation is valid for the following products:
• Pilot Module EHS4
This documentation is intended for machine/system manufacturers as well as authorized

specialists and dealers.
This documentation contains important information on the electronic interface to the pilot
module EHS4.
▶ Read this documentation completely and, in particular, the chapter 2

“Safety instructions” and the chapter 3 “General instructions on property and
product damage” in the related instruction manual 66170-B before using the product.
1.2 Required and supplementary documentation

▶ Only commission the Pilot Module if the documentation marked with the
book symbol is available to you and you have understood and observed it.
1.3 Abbreviations
BFL – Bosch Flash Loader
CBL – Customer Bootloader

EHS4 UDS Manual - EHS_.1P____.F.06.00x.00.BDxxxx + 9/172

EHS_.1P____.F.07.001.00.BD1060
2 Safety
Improper setting of the parameters marked as safety-relevant can result in unexpected oil flows
through the valve.
An actuator that may be connected, such as a cylinder or a motor, could then start moving
unintentionally and possibly cause dangerous situations on or in the vicinity of the machine.
When restarting after an update of the safety-relevant parameters, suitable safety checks relating
to the new setting must therefore be carried out so that safe operation of the machine is
guaranteed.


EHS_.1P____.F.07.001.00.BD1060
3 Functional Requirements
3.1 Layer Concept and Standards Implementation
The below diagram represents OSI layer along with the standards defined. According to ISO/OSI
model that characterizes and standardizes the internal functions of a communication system by
partitioning it into abstraction layers, the UDS protocol is separated into different layers.
3.1.1 CAN Network Layer

The ECU supports CAN diagnostic messages using the Unacknowledged Segmented Data Transfer
(USDT) mechanism as specified in ISO 15765. Accordingly the two types of CAN data streams are
supported. The CAN Transport protocol shall be implemented as per ISO 15765.
• Non-segmented data transfer


EHS_.1P____.F.07.001.00.BD1060
• Segmented Data transfer
For message structure on CAN, only frame format Type 2.0B for 29 bit identifiers is allowed.
It is required to use always the constant DLC (DataLengthCode) of eight. That means all CAN
frames shall be padded to their full length. It is required to use as filler byte the value
0x55 or 0xAA to avoid "stuff bits" on the CAN datalink.
The parameters STmin & Block Size (BS) as per ISO 15765 shall be configured separately in the
Network layer configuration of Boot-Software and Application-Software parts. All the timing
parameters shall remain as per the ISO 15765 standard.
3.1.2 Application Layer

The service request message is sent by the client to perform a specific action on server side.
The positive responses are per standard ISO 14229 and Negative response Codes shall be
supported as per standard and mandatory are listed in this specification.
The server shall support the SuppressPosRspMsgIndicationBit for each service with SubFunction.
The client is responsible to set the SuppressPosRspMsgIndicationBit in the request message.
If the server detects an S3Server timeout the server shall enter the default session server shall
reinitialise the protocol (reset all critical parameters changed in the non-default session, e.g.
reset securityAccess, etc.).
All the Timing requirements of application layer shall be as per ISO 14229


EHS_.1P____.F.07.001.00.BD1060
4 CAN-IDs, Baudrate
The UDS protocol uses the following CAN IDs for communication:
message name message ID direction comment

CanPhysReqId 0x18DAxxF9 Tester --> ECU
CanRespUSDTId 0x18DAF9xx ECU --> Tester
CanFuncReqId 0x18DBFFF9 Tester --> all ECUs
xx - source address of the connected EHS4 (default: 0x80)
Note: The EHS4 only accepts the tool source addresses 0xF0 to 0xFA.
The preferred baudrate is 250KB. Communication uses the active baudrate of the system.


EHS_.1P____.F.07.001.00.BD1060
5 UDS Services
The following UDS services are implemented in the EHS4 UDS interface. The availability of the
services depends on the active session and the active security access level.
table: diagnosis services
SID Diagnostic Session ID (s. table: Diagnostic Session IDs)

Diagnostic Service Name
0x01 0x02 0x03 0x04 0x40 0x41 0x60 0x61
DiagnosticSessionControl 0x10 ♦ ♦ ♦ ♦ ♦ ♦ ♦ ♦
ECUReset 0x11 - * * * * - * -
SecurityAccess 0x27 - ♦ ♦ ♦ ♦ - ♦ -
CommunicationControl 0x28 - - ♦ ♦ ♦ - - -
TesterPresent 0x3E ♦ ♦ ♦ ♦ ♦ ♦ ♦ ♦
ControlDTCSetting 0x85 - - ♦ ♦ - - - -
ReadDataByIdentifier 0x22 X X X X X - X X
WriteDataByIdentifier 0x2E - X X X X - X -
ClearDiagnosticInformation 0x14 ♦ - ♦ ♦ ♦ - - -
ReadDTCInformation 0x19 ♦ - ♦ ♦ ♦ - - -
InputOutputControlByIdentifier 0x2F - - X * X - - -
RoutineControl(startRoutine = 0x31 - X X X X - X -
0x01)
RequestDownload 0x34 - * - * * - * -
TransferData 0x36 - * * * * - * -
RequestTransferExit 0x37 - * * * * - * -


EHS_.1P____.F.07.001.00.BD1060
table: Diagnostic Session IDs
The EHS4 supports the following diagnostic sessions:
Diagnostic
Name Comment
Session ID
0x01 DEFAULT
0x02 PROGRAMMING
0x03 EXTENDED
0x04 SAFETY
0x40 EOL
0x41 DEFAULT CBL BOOT
0x60 BFL PROGRAMMING
0x61 DEFAULT BFL BOOT
table: symbols
Symbol Description
- Service / subFunction not supported
♦ Service / subFunction supported in the selected session without security access
* Service / subFunction supported in the selected session with security access
X Service / subFunction supported in the selected session. Restrictions should be

described in the project documentation (e.g. "ReadDataByIdentifier": identifiers are
spread to different security levels)


EHS_.1P____.F.07.001.00.BD1060
5.1 Diagnostic Session (DSC)

This service is used to control the UDS sessions.
After startup, the EHS4 automatically enters session 0x01 (default). The same session is active
after deactivation of any other session.
The accessible sessions and their pre-conditions are listed in table: DiagnosticSessionType.
Note:
The sessions 0x41 (DEFAULT_CBL_BOOT) and 0x61 (DEFAULT_BFL_BOOT) are not accessible
with DSC service and are only started by corresponding bootloader start up software when no
valid application software is available.
5.1.1 Request
Byte Pos Bit Pos Bit Length Value
RequestSID 0 0 8 0x10
SuppressPosRspMsgIndicationBit 1 7 1 0x00
DiagnosticSessionType 1 0 7 s. table:
DiagnosticSessionType
table: DiagnosticSessionType
Pre-Condition Security
DiagnosticSessionType Pre-Condition Session Value
Level
Default 0x01, 0x02, 0x03, 0x04, 0x40, 0x60, 0x01
0x41
CBL Programming 0x01, 0x02, 0x03, 0x04, 0x40, 0x60, 0x02

0x41
Extended 0x01, 0x03, 0x04, 0x40 0x03
Safety 0x01, 0x03, 0x04, 0x40 0x04
BFL Programming 0x60, 0x03 0x60
EOL 0x01, 0x03, 0x04, 0x40 0x40
5.1.2 Positive Response

ResponseSID 0 0 8 0x50
DiagnosticSessionType 1 0 7 requested session ID
P2CanServerMax 2 0 16 server specific


EHS_.1P____.F.07.001.00.BD1060

P2StarCanServerMax 4 0 16 server specific
5.1.3 Negative Response

NegativeResponseSID 0 0 8 0x7F
NegativeResponseCode 2 0 8 s. table: NRC
table: NEGATIVE RESPONSE CODES
NRC's Value
SUBFUNCTION_NOT_SUPPORTED 0x12
INCORRECT_MESSAGE_LENGTH_OR_INVALID_FORMAT 0x13
CONDITIONS_NOT_CORRECT 0x22
SUBFUNCTION_NOT_SUPPORTED_IN_ACTIVE_SESSION 0x7E


EHS_.1P____.F.07.001.00.BD1060
5.2 ECUReset (ER)

This service is used to send a reset request to EHS4.
The module will perform the desired request and send a J1939 address claim message after
successful restart.
5.2.1 Request
ResetType 1 0 7 s. table: ResetType
table: ResetType
ResetType Pre-Condition Session Pre-Condition Security Level Value

Soft Reset 0x02,0x03,0x04,0x40,0x60 0x01, 0x03, 0x04, 0x05 0x03
Hard Reset 0x03,0x04,0x40,0x60 0x01, 0x03, 0x04, 0x05 0x01

ResetType 1 0 7



EHS_.1P____.F.07.001.00.BD1060
table: NEGATIVE RESPONSE CODES
NRC's Value
SECURITY_ACCESS_DENIED 0x33
GENERAL_PROGRAMMING_FAILURE 0x72
SERVICE_NOT_SUPPORTED_IN_ACTIVE_SESSION 0x7F


EHS_.1P____.F.07.001.00.BD1060
5.3 Security Access (SA)

The EHS4 uses a seed and key algorithm to control the access rights of the current user.
The algorithm defines the following sequence:
send "request seed" for desired access level

positive response of the EHS4 contains the security access seed data
calculate corresponding key
send "send key" with calculated key
positive response confirms desired acces
The following security access levels are supported:
ID name comment
0x01 customer access level
0x05 manufacturer access level
0x06 service access level


EHS_.1P____.F.07.001.00.BD1060
5.3.1 Request Seed

Request
SecurityAccessType 1 0 7 s. following tables
table: SecurityAccessType - BFL Security Access
SecurityAccessType Pre-Condition Session Pre-Condition Security Level Value

REQUEST_SEED_SECURITY_LEVEL_1 0x60 0x01
table: SecurityAccessType - Application and CBL security access
SecurityAccessType Pre-Condition Session Pre-Condition Security Level Value

REQUEST_SEED_SECURITY_LEVEL_1 0x02, 0x03, 0x04, 0x40 0x01
REQUEST_SEED_SECURITY_LEVEL_2 0x02, 0x03 ,0x04, 0x40 0x03
REQUEST_SEED_SECURITY_LEVEL_6 0x02, 0x03, 0x04, 0x40 0x0B
Positive Response for Level 1-4 (Customer Defined)

SecurityAccessType 1 0 7
SecurityAccessAlgorithmVersionInfo 2 0 8
SecurityAccessSeedData 3 0 32
Positive Response for Level 5 (Bosch Access), 6 (Service)



EHS_.1P____.F.07.001.00.BD1060

SecurityAccessAlgorithmVersionInfo 2 0 8
SecurityAccessSeedData 3 0 128


EHS_.1P____.F.07.001.00.BD1060
Negative Response
table: NEGATIVE RESPONSE CODE
NRC's Value
REQUEST_SEQUENCE_ERROR 0x24
REQUEST_OUT_OF_RANGE 0x31
INVALID_KEY 0x35
EXCEED_NUMBER_OF_ATTEMPTS 0x36
REQUIRED_TIME_DELAY_NOT_EXPIRED 0x37


EHS_.1P____.F.07.001.00.BD1060
5.3.2 Send Key

Request
Security Level 1-4(Customer Defined)

SecurityAccessKeyData 2 0 32
Security Level 5(Bosch Access)

BFL Security Access

Application and CBL security access
SendKey Pre-Condition Session Pre-Condition Security Level Value

SEND_KEY _SECURITY_LEVEL_10x02, 0x03, 0x04, 0x40 0x02
SEND_KEY _SECURITY_LEVEL_2 0x02 ,0x03, 0x04, 0x40 0x04
SEND_KEY _SECURITY_LEVEL_3 0x02, 0x03, 0x04, 0x40 0x06
SEND_KEY _SECURITY_LEVEL_4 0x02, 0x03, 0x04, 0x40 0x08
SEND_KEY _SECURITY_LEVEL_5 0x02, 0x03, 0x04, 0x40 0x0A


EHS_.1P____.F.07.001.00.BD1060
SendKey Pre-Condition Session Pre-Condition Security Level Value

SEND_KEY _SECURITY_LEVEL_6 0x02, 0x03, 0x04, 0x40 0x0C
Positive Response

SecurityAccessType1 0 7
Negative Response

NegativeResponseS 0 0 8 0x7F
ID
NegativeResponse 2 0 8 s. table: NRC

Code
NRC's Value
INVALID_KEY 0x35
EXCEED_NUMBER_OF_ATTEMPTS 0x36


EHS_.1P____.F.07.001.00.BD1060
5.4 Routine Control (RC)

This service is used for flashing Application/ Customer bootloader and Bosch flash loader in
EHS4.
This service is also used in writing service-related parameters.
5.4.1 Request
RoutineControlType 1 0 7 s. table
RoutineControlType
RoutineIdentifier 2 0 16
RoutineControlOptionRecord 4 0 dynamic
table: RoutineControlType
RoutineControlType Pre-Condition Session Pre-Condition Security Level Value

START_ROUTINE 0x02, 0x03, 0x40 0x01

RoutineControlType 1 0 7
RoutineIdentifier 2 0 16
RoutineStatusRecord 4


EHS_.1P____.F.07.001.00.BD1060

NRC's Value


EHS_.1P____.F.07.001.00.BD1060
5.5 Request Download (RD)

EHS4.
5.5.1 Request
EncryptionMethod 1 0 4 0x0
CompressionMethod 1 4 4 0x0
NumberOfBytesOfMemoryAddressParameter 2 0 4 0x4
NumberOfBytesOfMemorySizeParameter 2 4 4 0x4
Memory Address 3 0 32
Memory Size 7 0 32

NumberOfBytesMaxNumberOfBlockLengthParameter 1 4 4
MaxNumberOfBlockLength 2 0 Dynamic


EHS_.1P____.F.07.001.00.BD1060

NRC's Value
UPLOAD_DOWNLOAD_NOT_ACCEPTED 0x70


EHS_.1P____.F.07.001.00.BD1060
5.6 TransferData (TD)

EHS4.
5.6.1 Request
BlockSequenceCounter 1 0 8 0x00
TransferRequestParameterRecord 2 0 Dynamic

BlockSequenceCounter 1 0 8 Dynamic


EHS_.1P____.F.07.001.00.BD1060

NRC's Value
TRANSFER_DATA_SUSPENDED 0x71
WRONG_BLOCK_SEQUENCE_COUNTER 0x73


EHS_.1P____.F.07.001.00.BD1060
5.7 RequestTransferExit (RTE)

EHS4.
5.7.1 Request


NRC's Value


EHS_.1P____.F.07.001.00.BD1060
5.8 TesterPresent
This service must be sent cyclically after a positive session change to keep the activated service
alive. Otherwise, EHS4 will switch to default session.
Tester present request is sent via physicial/functional request ID.
Recommended cycle time: 4000 ms
Timeout limit: 5000 ms
The request contains an information whether the EHS4 shall suppress a positive response or not.
See signal SuppressPosRspMsgIndicationBit
5.8.1 Request
RequestSID 0 0 8 0x3E
SuppressPosRspMsgIndicationBit 1 7 1 0x0 - with pos response
0x1 - no pos response
TesterPresentType 1 0 7 s. table: TesterPresentType
table: TesterPresentType
TesterPresentType Pre-Condition Session Pre-Condition Security Level Value

ZERO_SUB_FUNCTION 0x01, 0x02, 0x03, 0x04, 0x40, 0x00
0x60, 0x41

ResponseSID 0 0 8 0x7E
1 0 8 0x00


EHS_.1P____.F.07.001.00.BD1060

NRC's Value


EHS_.1P____.F.07.001.00.BD1060
5.9 ReadDataByIdentifier (RDBI)

This service is used to read application parameters from EHS4. The list of supported DIDs is
shown in section 5 supported data identifiers
Note: EHS4 supports 1 DID in one request.
5.9.1 Request
DataIdentifier 1 0 16

DataRecord 3 dynamic

NRC's Value
RESPONSE_TOO_LONG 0x14


EHS_.1P____.F.07.001.00.BD1060
5.10 WriteDataByIdentifier (WDBI)

This service is used to write application parameters from EHS4. The list of supported DIDs is
shown in section "supported data identifier"
Note: The possibility to write data depends on the active access level and session. For details see
section "supported data identifier".
5.10.1 Request
DataRecord 3 0 Dynamic

ResponseSID 0 0 8 0x6E

NRC's Value


EHS_.1P____.F.07.001.00.BD1060
5.11 InputOutputControlByIdentifier (IOCBI)

This service is used to control/actuate EHS4 through diagnostic request in safety session.
5.11.1 Request
Pre-Condition Session: 0x04 Security Level: 0x03, 0x04, 0x05 Pre-Condition Vehicle: C1

RequestSID 0 0 8 0x2F
InputOutputControlParameter 3 0 8 s. table:
InputOutputControlParamete
r
ControlState 4 0 DYNAMIC
ControlEnableMask – DYNAMIC
table: InputOutputControlParameter
InputOutputControlParameter Value
RETURN_CONTORL_TO_ECU 0x00
SHORT_TERM_ADJUSTMENT 0x03

InputOutputControlParameter 3 0 8
ControlState 4 0 DYNAMIC


EHS_.1P____.F.07.001.00.BD1060

NRC's Value


EHS_.1P____.F.07.001.00.BD1060
5.12 Read DTC Information (RDTC)

5.12.1 Report Number of DTC by Status MaskRequest Message
This service with sub function 01 is used to read number of active/passive DTC.
Request
Byte Pos Bit Pos Bit Length Signal Type Value
Request SID 0 0 8 UNIT 0x19
Report Type 1 0 8 UNIT 0x01
DTCStatusMask 2 0 8 UNIT s. table:

DTCStatusMask
table: DTCStatusMask
DTC Status Mask Value

NO_FAULT 0x00
FLOATING_AND_ACTIVE 0x01
PASSIVE_AND_ACTIVE 0x08
FLOATING_AND_ACTIVE_AND_PASSIVE 0x09
Positive Response
Response SID 0 0 8 UINT 0x59
Report Type 1 0 8 UINT 0x01
DTC Status Availability Mask 2 0 8 UINT
DTC Format Identifier 3 0 8 UINT
DTC Count 4 0 16 UNIT
Negative Response
Byte Pos Bit Pos Bit Length SignalType Value
Negative Response SID 0 0 8 UINT 0x7F
Request SID 1 0 8 UINT 0x19
Negative Response Code 2 0 8 UINT s. table: NRC


EHS_.1P____.F.07.001.00.BD1060
Text Value


EHS_.1P____.F.07.001.00.BD1060
5.12.2 Report DTC by Status Mask

This service with sub function 02 is used to read list of active/passive DTC's
Request
DTCStatusMask 2 0 — —
Positive Response
DTC Status Availability Mask 2 0 — —
DTC And Status Record 3 0 — —
Negative Response
Byte Pos . Bit Pos Bit Length Signal Type Value
Text Value


EHS_.1P____.F.07.001.00.BD1060
5.12.3 Report DTC Snapshot Record by DTC Number

This service with sub function 04 is used to read snapshot data for active/passive DTC.
Note: Refer chapter 7.2 for DID's as part of snapshot data.
Request
DTC 2 0 24 UNIT
DTC Snapshot Record Number 5 0 8 UNIT 0xFF
Positive Response
DTC And Status Record
DTC High Byte 2 8
DTC Middle Byte 3 8
DTC Lower Byte 4 8
Status of DTC 5 8
DTC Snapshot Record
Snapshot Record Number (1-n) 6 8
Number of Identifiers (1-n) 7 8
Data Identifier 1 MSB 8 8
Data Identifier 2 LSB 9 8
Snapshot Data Byte 1 10 8
Snapshot Data Byte (1-n)
Data Identifier n . . .


EHS_.1P____.F.07.001.00.BD1060
Negative Response
Text Value


EHS_.1P____.F.07.001.00.BD1060
5.12.4 Report DTC Extended Data Record by DTC Number

This service with sub function 06 is used to read occurrence count for a DTC.
Request
DTC 2 0 24 UNIT
DTCExtDataRecordNumber 5 0 8 UNIT
Positive Response
DTC High Byte 2 8
DTC Middle Byte 3 8
DTC Lower Byte 4 8
DTCExtDataRecordNumber(1-n) 5 0 8 —
DTCExtDataRecord(1-n) 6 0 8 —


EHS_.1P____.F.07.001.00.BD1060
Negative Response
Text Value


EHS_.1P____.F.07.001.00.BD1060
5.12.5 Report DTC Mirror Memory by DTC Number.

This service with sub function 0x0F is used to read total number of DTC active/passive occurred
till date.
Request
Report Type 1 0 8 UNIT 0x0F
DTCStatusMask 2 0
Positive Response
Report Type 1 0 8 UINT 0x0F
DTCAvailabilityMask 2 0
DTCAndStatusRecord 3 0
Negative Response
Text Value


EHS_.1P____.F.07.001.00.BD1060
5.13 Communication Control (CC)

This service is used to stop the periodic CAN communication.
Note: Before flashing, it is recommended to stop unneeded CAN communication.
5.13.1 Request
SuppressPosRspMsgIndicationBit 1 7 1 UNIT 0x00
CommunicationControlType 1 0 7 UNIT s. table:

Communication
ControlType
CommunicationType 2 0 8 UNIT s. table:

Communication
Type
table: CommunicationControlType
CommunicationControlType Pre-Condition Session Pre-Condition SecuLevel Vehicle-C. Value

ENABLE_RX_AND_TX 0x03, 0x04 ,0x40 C1 0x00
ENABLE_RX_AND_DISABLE_TX 0x03, 0x04, 0x40 C1 0x01
table: CommunicationType
CommunicationType Value
NORMAL_COMMUNICATION_MESSAGES 0x01


EHS_.1P____.F.07.001.00.BD1060

CommunicationControlType 1 0 7 UINT

Text Value


EHS_.1P____.F.07.001.00.BD1060
5.14 ControlDTCSetting (CDS)

This service is used to ON/OFF storing DTC's in EHS4 error memory.
Note: It is recommended to use this service (Control DTC-OFF setting) to avoid saving
unnecessary DTC in EHS4 error memory.
5.14.1 Request
SuppressPosRspMsg 1 7 1 UNIT 0x00

IndicationBit
DTCSettingType 1 0 7 UNIT s. table:

DTCSettingTy
pe
table: DTCSettingType
DTCSettingType Pre-Condition Session Pre-Condition SecuLevel Vehicle-C. Value

ON 0x03, 0x04 C1 0x01
OFF 0x03, 0x04 C1 0x02

Response SID 0 0 8 UINT 0xC5
DTCSettingType 1 0 7 UINT


EHS_.1P____.F.07.001.00.BD1060

Negative Response Code 2 0 8 UINT s, table: NRC
Text Value


EHS_.1P____.F.07.001.00.BD1060
5.15 ClearDiagnosticInformation (CDI)

This service is used to clear active/passive DTC's in EHS4 error memory.
Note: EHS4 does not allow to clear single DTC, only allows to clear group of DTC.
5.15.1 Request
GroupOfDTC 1 0 24 UNIT 0xFFFFFF



EHS_.1P____.F.07.001.00.BD1060

Text Value


EHS_.1P____.F.07.001.00.BD1060
6 Supported Data Identifiers

Note: for Signal type: ASCIISTRING, if min and max range is from 32- 126 decimal (0x20 - 0x7E).
For Ex. to write character 'A', decimal value is 65 and hex value is 0x41.
6.1 0x0100 BatteryPotential (Read)

Read Pre- Sessions: 0x01, 0x03, 0x04, 0x40 - Security Levels: No Restrictions
Conditions
Write Pre- NA
Conditions
Signal Name Signal Description Byte Pos Bit Pos Bit Length Byte Order Comments
BatteryPotential Battery voltage 0 0 16 Motorola s. signal description
Signal: BatteryPotential
This signal indicates the battery voltage measured internally by the module.
Note: The presented value is a snapshot of a dynamic parameter. Successive requests may show
deviating values. This parameter is not used for voltage diagnosis.
criteria value comment

signal type UINT linear
signal conversion identical
unit mV
min value 0
max value 65535


EHS_.1P____.F.07.001.00.BD1060
6.2 0x0116 AuxiliaryValveEstimatedFlow (Read)

Read Pre-Conditions Sessions: 0x01, 0x03, 0x04, 0x40 - Security Levels: No Restrictions
Write Pre-Conditions NA
Signal
Signal Name Byte Pos Bit Pos Bit Length Comments
Description
AuxValveExtendPortEstimate 0 0 8 s. signal
dFlow description
AuxValveRetractPortEstimate 1 0 8 s. signal
dFlow description
AuxValveValveState 2 0 4 s. signal
description
AuxValveFailSafeMode 2 6 2 s. signal
description
Reserved 0 2 4 2
AuxValveLimitStatus 3 5 3 s. signal
description
Reserved 1 3 0 5
Signal: AuxValveExtendPortEstimatedFlow, AuxValveRetractPortEstimatedFlow
These signals indicate the estimated flow calculated out of spool position by the module.
If extend is actuated, estimated flow shall be given back as extend flow (retract 0x7D -> no flow).
If retract is actuated, estimated flow shall be given back as retract flow (extend 0x7D -> no flow).
In Neutral extend and retract flow shall be 0x7D - no flow.
In valve state float, no oil flow can be calculated. Value 0xFF or 0x00 (depending on actuation
type) is displayed.
Note: The actual oil flow depends on many parameters of the system and may differ from the
displayed value.


EHS_.1P____.F.07.001.00.BD1060

signal conversion
unit
min value 125 estimated flow is calculated based on spool

position and other factors.
max value 225
Signal: AuxValveValveState
This signal indicates the active valve state. In normal operation, it mirrors the state requested
from the commanding device.
Note: valve state "error" (0xE) is not defined in I/O Control and leads to a negative response
(NRC 0x31).

signal type UINT
signal conversion
unit
value 0 = BLOCKED Optional valve state is set to

1 = EXTEND error if diagnosis detects and
2 = RETRACT error.
3 = FLOATING


EHS_.1P____.F.07.001.00.BD1060
Signal: AuxValveFailSafeMode
This signal indicates the active fail-safe mode.

signal type UINT
signal conversion
unit
value 0 = BLOCK Only Block possible

1 = FLOAT
2 = ERROR_INDICATION
3 = NOT_AVAILABLE
Signal: AuxValveLimitStatus
This signal indicates the active limit status.

signal type UINT
signal conversion
unit
value 0 = NOT_LIMITED not used.

1 = OPERATOR_LIMITED
2 = LIMITED_HIGH
3 = LIMITED_LOW
4 = RESERVED_0
5 = RESERVED_1
6 = NON_RECOVERABLE_FAULT
7 = NOT_AVAILABLE


EHS_.1P____.F.07.001.00.BD1060
6.3 0x0117 Auxiliary Valve Command (IO-Control)

This paramter can be used to actuate the EHS4 via UDS command.
Note: Keep in mind that it is not the recommended way to operate the actuator. Some safety
features are disabled.
Read Pre-Conditions Sessions: 0x01, 0x03, 0x04, 0x40 - Security Levels: 0x03, 0x04, 0x05
- Vehicle-Condition: no restriction
IO-Control Pre-Conditions Sessions: 0x04 - Security Levels: 0x03, 0x04, 0x05 - Vehicle-
Condition: C1
Signal
Description
AuxiliaryValvePortFlow 0 0 8
Reserved0 1 0 8
AuxiliaryValveStateCommand 2 0 4
Reserved1 2 4 2
AuxiliaryValveFailSafeMode 2 6 2
Reserved2 3 0 8


EHS_.1P____.F.07.001.00.BD1060
Signal: AuxiliaryValvePortFlow
This signal contains the relative oil flow request.

signal conversion
unit
min value 0 estimated flow is calculated

based on spool position.
((est. flow - 0x7D) *10u) \4u
max value 250
Signal: AuxiliaryValveStateCommand
This signal contain the the active limit status.

signal type
signal conversion N/A
unit N/A
value 0 = BLOCK
1 = EXTEND
2 = RETRACT
3 = FLOAT
15 = DONT_CARE


EHS_.1P____.F.07.001.00.BD1060
Signal: AuxiliaryValveFailSafeMode
This signal contains the fail safe mode.

signal type UINT
signal conversion
unit
value 0 = BLOCK
1 = FLOAT
2 = RESERVED
3 = DONT_CARE


EHS_.1P____.F.07.001.00.BD1060
6.4 0x1102 Auxiliary Main Valve Monitor (Read)

Read Pre-Conditions Sessions: 0x01,0x03,0x04,0x40 - Security Levels: No Restrictions
Signal Name Signal Description Byte- Pos Bit Pos Bit Length Byte Order Comments
MainSpoolSetpoint 0 0 16 Motorola
MainSpoolPosition 2 0 16 Motorola
Signal: MainSpoolSetpoint, MainSpoolPosition
This signal indicate the internal position setpoint and the actual position of the main spool.
Note: The presented values are snapshots of dynamic parameters. Successive requests may show
deviating values.

signal type UINT
unit µm
min value 0
max value 30000


EHS_.1P____.F.07.001.00.BD1060
6.5 0x1103 Auxiliary Pilot Valve Monitor (Read)

Read Pre-Conditions Sessions: 0x01, 0x03, 0x04, 0x40 - Security Levels: no restriction
Signal Name Signal Description Byte- Pos Bit Pos Bit Length Byte Order Comments
PilotValveCurrentsetp 0 0 16 Motorola
oint
PilotValveCurrentMea 2 0 16 Motorola
sured
TemperatureOBE 4 0 32 Motorola
Signal: PilotValveCurrentSetpoint, PilotValveCurrentMeasured
This signal indicate the internal setpoint and the actual measured current of the pilot valve
current control.
deviating values.

signal type UINT
unit mA
min value 0
max value 1100 maximum electric current


EHS_.1P____.F.07.001.00.BD1060
Signal: Temperature OBE
This signal indicates the temperature value measured with sensor on PCB.
deviating values.

signal type INT32
unit °C
min value -30
max value 150


EHS_.1P____.F.07.001.00.BD1060
6.6 0x1104 Active Fault Code Bosch (Read)

This parameter indicates the active error code in a special manufacturer format. For error
description details refer chapter 7.1
In case of several active error codes, one error code is retrieved with each read operation. 0 is
indicated if no error is active. Update cycle time is 10ms.
Read Pre-Conditions Sessions: 0x01 0x03, 0x04, 0x40 - Security Levels: no restriction
C
o
Signal m
Signal Name Byte Pos Bit Pos Bit Length Byte Order m
Description
e
n
ts
BoschFaultCode Internal Fault 0 0 8 NA
Code
Signal: BoschFaultCode
This signal contains the manufacturer-specific code of an active error. The link between this error
code and the "official" error codes is listed in section supported fault codes.

signal type UINT
unit NA
min value 0
max value 255


EHS_.1P____.F.07.001.00.BD1060
6.7 0xCF01 SourceAddressCommandMessageTransmittingECU (Read/

Write)
Write Pre-Conditions Sessions: 0x03, 0x04 ,0x40 - Security Levels: 0x01, 0x03, 0x04, 0x05
Signal
Signal Name Byte- Pos Bit Pos Bit Length Comments
Description
CommandSourceAddress 0 0 8 s. signal
description
Signal: CommandSourceAddress
This signal contains the source address of the commanding device or application. It is needed for
CAN communication acc. to J1939 standard.

signal type UINT
unit
min value 0
max value 253


EHS_.1P____.F.07.001.00.BD1060
6.8 0xCF02 valve configuration (Read/Write)

This DID contain the parameters to use ramp, scaling and curve features to optimize valve
behavior for the customers system. For detailed information see document J1939 process data
message.
Note: The modified values are stored in NVM and become active after reset of the module. If an
immediate reaction is desired, use the J1939 process data message. Here, the new values
become active after a neutral command but will not be stored in NVM.
Read Pre-Conditions Sessions: 0x03, 0x04, 0x40 - Security Levels: No Restrictions
Write Pre-Conditions Sessions: 0x03, 0x04, 0x40 - Security Levels: 0x01 ,0x03, 0x04, 0x05
Signal Name Signal Description Byte Pos Bit Pos Bit Length Comments
ScalingExtend 0 0 16 s. signal description
ScalingRetract 2 0 16 s. signal description
RampOnExtend 4 0 16 s. signal description
RampOffExtend 6 0 16 s. signal description
RampOnRetract 8 0 16 s. signal description
RampOffRetract 10 0 16 s. signal description
CurveExtend 12 0 4 s. signal description
CurveRetract 12 4 4 s. signal description
RampRoundingExtendBg 13 0 8 s. signal description

n
RampRoundingExtendEn 14 0 8 s. signal description

d
RampRoundingRetractB 15 0 8 s. signal description

gn
RampRoundingRetractE 16 0 8 s. signal description

nd
RampType 17 0 2 s. signal description


EHS_.1P____.F.07.001.00.BD1060
Signal: ScalingExtend, ScalingRetract
This signal contain the values to scale the received setpoint value for both actuation directions.
The received value is multiplied by the scaling factor/1000.

signal type UINT
unit
min value 0 = 0%
max value 1000 = 100%, the received setpoint value is not

changed
Signal: RampOnExtend, RampOffExtend, RampOnRetract, RampOffRetract
These signals contain the ramp times. The time can be set separately for the valve states 0x01
"extend" and 0x02 "retract". The ramp algorithm depends on the ramp type. For details s. Signal:
Ramp Type.

signal type UINT
unit ms
min value 0 no ramp time defined, valve spool moves

with maximum dynamics.
max value 4000 maximum adjustable ramp time


EHS_.1P____.F.07.001.00.BD1060
Signal: CurveExtend, CurveRetract
These signals contain the curve characteristic of the oil flow characteristic. For details see
document J1939 process date message

signal type UINT
unit
min value 0 no progression defined
max value 15 maximum progression defined
Signal: RampRoundingExtendBgn, RampRoundingExtendEnd, RampRoundingRetractBgn,

RampRoundingRetractEnd
These signals contain the values for rounding the discontinuity points within the ramp function. It
can smoothen the system reaction on a setpoint step. This feature increases the actual ramp
time.

signal type UINT
unit
min value 0 no ramp rounding defined
max value 3 maximum ramp rounding defined
Signal: RampType
This signal contains the type definition for the selected time ramps.

signal type UINT
unit
values 0 - speed-constant ramp s. illustration
1 - time-constant ramp max value is 0x01


EHS_.1P____.F.07.001.00.BD1060
Illustration: ramp types


EHS_.1P____.F.07.001.00.BD1060
6.9 0xCF03 ValveCalibration (Read/Write)

This DID contain the link between setpoint value and corresponding main spool position. The
characteristic is result of a calibration process and should not be changed.
Read Pre-Conditions Sessions: 0x40, 0x03 -Security Levels: 0x05
Write Pre-Conditions Sessions: 0x40 - Security Levels: 0x05, 0x06
Safety relevant yes

parameter
flow_q7a 0 0 16 s. signal description
flow_q7 2 0 16 s. signal description
pos_s7a 14 0 16 s. signal description
pos_s7 16 0 16 s. signal description
flow_q1a 28 0 16 s. signal description


EHS_.1P____.F.07.001.00.BD1060
pos_s1a 42 0 16 s. signal description
Signals: flow_q7a, flow_q7, flow_q8, flow_q9, flow_q10, flow_q11, flow_q12
These parameters contain the reference values of the oil flow characteristic. (actuation side 1)

signal type UINT16
signal conversion IDENTICAL
unit
min value 0
max value 65535
Signals: pos_s7a, pos_s7, pos_s8, pos_s9, pos_s10, pos_s11, pos_s12
These signals contain the corresponding spool positions associated with the above reference
values. (actuation side 1)

signal type UINT16
unit
min value 0
max value 65535


EHS_.1P____.F.07.001.00.BD1060
Signals: flow_q1a, flow_q1, flow_q2, flow_q3, flow_q4, flow_q5, flow_q6
These parameters contain the reference values of the oil flow characteristic. (actuation side 2

signal type UINT
unit
min value 0
max value 65535
Signals: pos_s1a, pos_s1, pos_s2, pos_s3, pos_s4, pos_s5, pos_s6
These signals contain the corresponding spool positions associated with the above reference
values. (actuation side 2)

signal type UINT
unit
min value 0
max value 65535


EHS_.1P____.F.07.001.00.BD1060
6.10 0xCF04 CanIf Parameters (Read/Write)

This DID is used to set some CAN communication parameters, like Baud rate, additional diagnosis
CAN messages.
Read Pre- Sessions: 0x40, 0x60, 0x03 - Security Levels: 0x05, 0x06, Boot security Levels:
Conditions 0x01
Write Pre- Sessions: 0x40 - Security Levels: 0x05, 0x06

Conditions
Safety relevant no
parameter
Byte-
Signal Name Signal Description Bit Pos Bit Comments
Pos Length
Baudrate 0 0 8 s. signal description
rxCommCntrl 1 0 1 s. signal description
txCommCntrl Normal 2 0 1 Clear bit to enable Functionality and set to

Communication disable. s. signal description
Network 1 1 Clear bit to enable Functionality and set to

Diagnostic 2 1 Clear bit to enable Functionality and set to

Temperature 3 1 Clear bit to enable Functionality and set to

Message disable. s. signal description
Debug Test 4 1 Clear Bit to Enable Functionality, set

Messages automatically after reset or power cycle. s.
signal description
Reserved 5 3 Reserved Signal. s. signal description


EHS_.1P____.F.07.001.00.BD1060
Signal: Baudrate
This signal contains the baud rate of the device.

signal type UINT
unit bps
min value 0 0 --> 250kbps

1 --> 125kbps
max value 3 2 --> 500kbps
3 --> 1000kbps
Signal: rxCommCntrl
This signal is used for internal communication settings.

signal type UINT
unit
min value 0
max value 1
Signal: txCommCntrl
This signal is used for internal communication settings.

signal type UINT
unit
min value 0
max value 255


EHS_.1P____.F.07.001.00.BD1060
6.11 0xCF05 VcalParameter (Read/Write)

Read Pre- Sessions: 0x03, 0x40 - Security Level: 0x05, 0x06
Conditions
Write Pre- Sessions: 0x40 - Security Level: 0x05, 0x06

Conditions
Safety relevant yes

parameter
Signal Name Signal Description IO-Ctrl Byte- Pos Bit Pos Bit Length Comment
pos_neutral 0 0 32 s. signal description
pos_float 4 32 16 s. signal description
flow_opening 6 48 8 s. signal description
Signal: pos_neutral
This signal contains the neutral position of the calibrated oil flow characteristic. Nominal neutral
position is 15.000. The deviation is taken into account in the calculations of the position control.

signal type UINT32
signal conversion
unit
min value
max value
Signal: pos_float
This signal defines the spool position range for float mode.

signal type UINT16
signal conversion
unit
min value 0
max value 65535


EHS_.1P____.F.07.001.00.BD1060
Signal: flow_opening

signal type UINT8
signal conversion
unit
min value 0
max value 255


EHS_.1P____.F.07.001.00.BD1060
6.12 0xCF06 Position Control Parameters (Read/Write)

This DID contain the position control parameters for an attached SB24 valve.
Read Pre-Conditions Sessions: 0x40, 0x03 security Levels: 0x05, 0x06
Write Pre-Conditions Sessions: 0x40 security Levels: 0x05, 0x06
Safety relevant parameter yes
Signal Name Signal Description Byte- Pos Bit Pos Bit Length Comments
Gain Factor Extend 0 0 8 s. signal description
Gain Factor Retract 1 0 8 s. signal description
Integral Factor Extend 2 0 8 s. signal description
Integral Factor Retract 3 0 8 s. signal description
Derivative Factor Extend 4 0 8 s. signal description
Derivative Factor Retract 5 0 8 s. signal description
Temperature Adaptation 6 0 8 s. signal description

Limit
Gain Delta Factor Extend 7 0 8 s. signal description
Gain Delta Factor Retract 8 0 8 s. signal description
Integral Delta Factor 9 0 8 s. signal description

Extend
Integral Delta Factor 10 0 8 s. signal description

Retract
Derivative Delta Factor 11 0 8 s. signal description

Extend
Derivative Delta Factor 12 0 8 s. signal description

Retract
Isum Extend 13 0 16 s. signal description
Isum Retract 15 0 16 s. signal description
Pos Isum Max 17 0 16 s. signal description
Pos Isum Min 19 0 16 s. signal description
Isum Inhibit Time 21 0 16 s. signal description


EHS_.1P____.F.07.001.00.BD1060
Isum Inhibit SpeedLimit 23 0 16 s. signal description
Signal: Gain Factor Extend, Gain Factor Retract, Integral Factor Extend, Integral Factor
Retract, Derivative Factor Extend, Derivative Factor Retract, Temperature Adaptation Limit,
Gain Delta Factor Extend, Gain Delta Factor Retract, Integral Delta Factor Extend, Integral
Delta Factor Retract, Derivative Delta Factor Extend, Derivative Delta Factor Retract
These signals contain the values of the position controller parameters if the value for the
attached valve is set to SB24.

signal type UINT
unit
min value 0
max value 255
Signal: Isum Extend, Isum Retract, Pos Isum Max, Pos Isum Min, Isum Inhibit Time, Isum Inhibit
SpeedLimit

signal type UINT
unit
min value 0
max value 65535


EHS_.1P____.F.07.001.00.BD1060
6.13 0xCF07 DitherParameters (Read/Write)

Safety relevant no
parameter
DitherPeriod 0 0 16 s. signal description
DitherAmplitude Extend 2 0 16 s. signal description
DitherAmplitude Retract 4 0 16 s. signal description
Float High current 6 0 16 s. signal description
Float Low current 8 0 16 s. signal description
Main Spool Amplitude 10 0 16 s. signal description

Extend
Main Spool Amplitude 12 0 16 s. signal description

Retract
Signal: DitherPeriod, DitherAmplitude Extend, DitherAmplitude Retract, Float High current,

Float Low current, Main Spool Amplitude Extend, Main Spool Amplitude Retract
These signals contain the values of the dither control parameters.

signal type UINT16
unit
min value 0
max value 65535


EHS_.1P____.F.07.001.00.BD1060
6.14 0xCF08 ValveAbstraction Parameters (Read/Write)

Safety relevant yes

parameter
freqAside 0 0 16 s. signal description
freqBside 2 0 16 s. signal description
valveType 4 0 8 s. signal description
Direction Valve Control 5 0 1 s. signal description
Hitch Single Acting 5 1 1 s. signal description
Hitch Double Acting 5 2 1 s. signal description
Check Valve in Port B 5 3 1 s. signal description
Check Valve in Port A 5 4 1 s. signal description
Manual Operation 5 5 1 s. signal description
Calibration Mode 5 6 1 s. signal description
Position Sensor Raw 5 7 1 s. signal description

Value
addrToValveNumber0 6 0 8 s. signal description


EHS_.1P____.F.07.001.00.BD1060
valveAddressingFormat 22 0 8 s. signal description
Signals: freqAside, freqBside
These signals define the base frequency of the internal PWM calculation.

signal type UINT
unit Hz
min value 0
max value 65535
Signal: valveType
This signals sets the type of the attached valve (s. J1939 manual for details)

signal type UINT
unit
min value 0
max value 255
Signal: Direction Valve Control, Hitch Single Acting, Hitch Double Acting, Check Valve in Port
B, Check Valve in Port A, Manual Operation, Calibration Mode, Position Sensor Raw Value
These signals set some properties defining the attached valve (see J1939 manual for details)


EHS_.1P____.F.07.001.00.BD1060

signal type bits
unit
min value 0
max value 1
Signals: addrToValveNumber0 ... addrToValveNumber15
These signals contain the link between valve number and source address when actuation type
"AVC" is selected (see J1939 manual for details)

signal type UINT16
unit
min value 0
max value 65535
Signal: valveAddressingFormat
This signal defines the actuation type of the EHS4 (see J1939 manual for details)

signal type UINT8
unit
min value 0 1 - AVC

2 - GPVC
max value 2


EHS_.1P____.F.07.001.00.BD1060
6.15 0xCF09 Current Control Parameters (Read/Write)

Safety relevant yes

parameter
i_factor 0 0 16 s. signal description
p_factor 2 0 16 s. signal description
d_factor 4 0 16 s. signal description
cur_i_summ 6 0 16 s. signal description
control_err 8 0 16 s. signal description
i_part 10 0 16 s. signal description
p_part 12 0 16 s. signal description
duty_Cycle_limit 14 0 16 s. signal description
Signal: i_factor, p_factor, d_factor, cur_i_summ, control_err, i_part, p_part, duty_Cycle_limit
These signals contain the values of the current control parameters.

signal type UINT
unit
min value 0
max value 65535


EHS_.1P____.F.07.001.00.BD1060
6.16 0xCF0A PositionControlParametersValveType_0x34 (Read/Write)

Read Pre-Conditions Sessions: 0x40, 0x03- Security Levels: 0x05, 0x06
Gain Factor Extend 0 0 8 s. signal
description
Gain Factor Retract 1 0 8 s. signal

description
Integral Factor Extend 2 0 8 s. signal

description
Integral Factor Retract 3 0 8 s. signal

description
Derivative Factor Extend 4 0 8 s. signal

description
Derivative Factor Retract 5 0 8 s. signal

description
Temperature Adaptation 6 0 8 s. signal

Limit description
Gain Delta Factor Extend 7 0 8 s. signal

description
Gain Delta Factor Retract 8 0 8 s. signal

description
Integral Delta Factor 9 0 8 s. signal

Extend description

Retract description
Derivative Delta Factor 11 0 8 s. signal

Extend description

Retract description
Isum Extend 13 0 16 s. signal

description
Isum Retract 15 0 16 s. signal

description


EHS_.1P____.F.07.001.00.BD1060
Pos Isum Max 17 0 16 s. signal

description
Pos Isum Min 19 0 16 s. signal

description
Isum Inhibit Time 21 0 16 s. signal

description
Isum Inhibit SpeedLimit 23 0 16 s. signal

description
Retract, Derivative Factor Extend, Derivative Factor Retract,
Temperature Adaptation Limit, Gain Delta Factor Extend, Gain Delta Factor Retract, Integral
Delta Factor Extend, Integral Delta Factor Retract, Derivative Delta Factor Extend, Derivative
Delta Factor Retract

signal type UINT
unit
min value 0
max value 255


EHS_.1P____.F.07.001.00.BD1060
SpeedLimit

signal type UINT
unit
min value 0
max value 65535


EHS_.1P____.F.07.001.00.BD1060
6.17 0xF013 Baud Rate for Autobaud settings (Read/Write)

Alternate identifier to set the baud rate. If set along with autobaud-enable identifier (0xFD0F),
ECU will start scanning baud rate from the baud rate set here.
Read Pre-Conditions Sessions: 0x40, 0x41 - Security Levels: No restrictions
Write Pre-Conditions Sessions: 0x03, 0x04, 0x41 - Security Levels: No restrictions
Signal
Description
Baud Rate 0 0 8
Signal: Baud Rate
This signal contains the codes for pre-defined baud rate settings.

signal type UINT
unit
values 0x3C - 250 kBaud
0xC3 - 500 kBaud


EHS_.1P____.F.07.001.00.BD1060
6.18 0xF15A WriteFingerprint (Write)

This parameter is used to store the software information.
Read Pre-Conditions NA
Write Pre-Conditions Sessions: 0x02, 0x04, 0x40 - Security Level: 0x01, 0x03, 0x04, 0x05, 0x06,
Boot security Levels: 0x01
Safety relevant no
parameter
ProgrammingYear 0 0 8
ProgrammingMonth 1 0 8
ProgrammingDay 2 0 8
ProgrammingFingerp 3 0 128 per Byte

rint
Signal: ProgrammingYear
This signal indicates the year of flashing date of the application software version.
signal conversion y(x) = x + 1985
unit years
min value 1985
max value 2235
Signal: ProgrammingMonth
This signal indicates the month of flashing date of the application software version.
signal type UINT
unit months
min value 1
max value 12


EHS_.1P____.F.07.001.00.BD1060
Signal: ProgrammingDay
This signal indicates the day of flashing date of the application software version.
signal conversion y(x) = 0.25x + 0
unit days
min value 0.25
max value 31.75
Signal: ProgrammingFingerprint
This signal indicates the fingerprint of the application software version.
signal type ASCIISTRING
signal conversion
unit ASCII
min value 0 - 255 per Byte
max value


EHS_.1P____.F.07.001.00.BD1060
6.19 0xF180 Boot Software Identification (Read)

Read Pre-Conditions Sessions: 0x01, 0x02, 0x03, 0x04, 0x40, 0x41, 0x60, 0x61 - Security
Levels: No Restrictions
Software version 0 to 31 bytes 0 0 248 s. signal description
Information
Signal: SoftwareVersionInformation
This signals indicates the version of the flashed boot loader software

unit ASCII
max value


EHS_.1P____.F.07.001.00.BD1060
6.20 0xF181 Application Software Identification (Read)

Information
This signals indicates the version of the flashed application software.

unit ASCII
max value


EHS_.1P____.F.07.001.00.BD1060
6.21 0xF182 Application Data Identification (Read)

Software version 0 to 31 bytes 0 0 248 s. signal
Information description
This signals indicates the version of the flashed application data.

unit ASCII
max value


EHS_.1P____.F.07.001.00.BD1060
6.22 0xF183 Boot Software Fingerprint (Read)

Read Pre-Conditions Sessions: 0x01, 0x02, 0x03, 0x04, 0x40, 0x60 - Security Levels: No
Restrictions
Signal Name Signal Description Byte Pos Bit Pos Bit Length comments
Number Of Modules 0 0 8 s. signal description
CBL Software 1 0 152 s. signal description

Fingerprint
BFL Software 21 0 152 s. signal description

Fingerprint
Signal: number of modules
This signal indicates the number of flashed boot software variants. The default value is 2.

signal type UINT
unit
min value 0
max value 255
Signal: CBL Software Fingerprint
This signal indicates the version of the flashed customer bootloader (CBL = Customer Boot
Loader).

unit ASCII
max value


EHS_.1P____.F.07.001.00.BD1060
Signal: BFL Software Fingerprint
This signal indicates the version of the flashed manufacturer boot loader (BFL = Bosch Boot
Loader).

unit ASCII
max value


EHS_.1P____.F.07.001.00.BD1060
6.23 0xF184 Application Software Fingerprint (Read)

Read Pre-Conditions Sessions: 0x01, 0x02, 0x03, 0x04, 0x40 - Security Level: no restriction
Signal Name Signal Description Byte Pos Bit Pos Bit Length Bit Order Comments
NumberofFollowingFing 0 0 8
erPrints
END-OF-PDU-FIELD: The following signals can be repeated until the end of PDU
ProgrammingYear SPN 964 1-n 0 8
ProgrammingMonth 2-n 0 8
ProgrammingDay 3-n 0 8
ProgrammingFingerprint 4-n 0 128
Signal: number of following fingerprints
This signal indicates the number of flashed application data variants. The value is set to 0 if no
valid fingerprint is stored.

signal type UINT
unit
min value 1
max value 255


EHS_.1P____.F.07.001.00.BD1060
This signal indicates the year of flashing date of the corresponding application software version.

unit years
min value 1985
max value 2235
This signal indicates the month of flashing date of the corresponding application software
version.

signal type UINT
unit months
min value 1
max value 12
This signal indicates the day of flashing date of the corresponding application software version.

signal conversion y(x) = 0.25x
unit days
min value 0.25
max value 31.75


EHS_.1P____.F.07.001.00.BD1060
This signal indicates the fingerprint of the corresponding application software version.

signal conversion
unit ASCII
max value


EHS_.1P____.F.07.001.00.BD1060
6.24 0xF185 Application Data Fingerprint (Read)

Read Pre-Conditions Sessions: 0x01, 0x02, 0x03, 0x04, 0x40 - Security Level: no restriction
Signal Name Signal Description Byte Pos Bit Pos Bit Length Bit Order Comment
NumberofFollowingFing 0 0 8 s. signal
erPrints description
END-OF-PDU-FIELD: The following signals can be repeated until the end of PDU
ProgrammingYear SPN 964 1-n 0 8 s. signal

description
ProgrammingMonth 2-n 0 8 s. signal

description
ProgrammingDay 3-n 0 8 s. signal

description
ProgrammingFingerprint 4-n 0 128 s. signal

description
Signal: number of following fingerprints
This signal indicates the number of flashed application data variants. The value is set to 0 if no
valid fingerprint is stored.

signal type UINT
unit
min value 1
max value 255


EHS_.1P____.F.07.001.00.BD1060
This signal indicates the year of flashing date of the corresponding application data version.

unit years
min value 1985
max value 2235
This signal indicates the month of flashing date of the corresponding application data version.

unit months
min value 1
max value 12
This signal indicates the day of flashing date of the corresponding application data version.

unit days
min value 0.25
max value 31.75


EHS_.1P____.F.07.001.00.BD1060
This signal indicates the fingerprint of the corresponding application data version.

signal conversion
unit ASCII
max value


EHS_.1P____.F.07.001.00.BD1060
6.25 0xF186 Active Diagnostic Session (Read)

Signal
Description
SessionNumber ID of the 0 0 8 s. signal
active description
session
Signal: SessionNumber
This signal indicates the ID of the active UDS session.

signal type UINT
unit
value 0x01 - DEFAULT see chapter 4.1 for UDS sessions.
0x02 - PROGRAMMING
0x03 - EXTENDED
0x04 - SAFETY
0x40 - EOL
0x41 - DEFAULT CBL BOOT
0x60 - BFL PROGRAMMING
0x61 - DEFAULT BFL BOOT


EHS_.1P____.F.07.001.00.BD1060
6.26 0xF187 VehicleManufacturerSparePartNumber (Read/Write)

Conditions
Write Pre- Sessions: 0x40 - Security Levels: 0x05

Conditions
PartNumber 0 0 160 s. signal
description
Signal: PartNumber
This signal contains the order number of the vehicle manufacturer.

signal conversion
unit ASCII
max value


EHS_.1P____.F.07.001.00.BD1060
6.27 0xF18A SystemSupplierIdentifier (Read/Write)

Restrictions
Write Pre-Conditions Sessions: 0x40 - Security Levels: 0x05
SystemSupplierIdentif - 0 0 16 s. signal
ier description
Signal: SystemSupplierIdentifier
This signal contains the order number of the system supplier. It is limited to 2 digits.

signal conversion
unit ASCII
max value


EHS_.1P____.F.07.001.00.BD1060
6.28 0xF18B ECU Manufacturing Date (Read/write)

Signal
Description
ProgrammingYear 0 0 8 s. signal
description
ProgrammingMonth 1 0 8 s. signal
description
ProgrammingDay 2 0 8 s. signal
description
This signal contains the year of the manufacturing date.

unit years
min value 1985
max value 2235


EHS_.1P____.F.07.001.00.BD1060
This signal contains the month of the manufacturing date.

unit months
min value 1
max value 12
This signal contains the day of the manufacturing date.

unit days
min value 0.25
max value 31.75


EHS_.1P____.F.07.001.00.BD1060
6.29 0xF18C ECU Serial Number (Read/Write)

Signal
Signal Name Byte Pos Bit Pos Bit Length comments
Description
Serial Number 0 0 256 s. signal
description
Signal: SerialNumber
This signal contains the serial number of the valve.

signal conversion
unit ASCII
max value


EHS_.1P____.F.07.001.00.BD1060
6.30 0xF18E VehicleManufacturerKitAssemblyPartNumber (Read/

Write)
Write Pre-Conditions sessions: 0x40 - Security Levels: 0x05
Signal
Description
AssemblyPartNumber 0 0 160 s. signal
description
Signal: AssemblyPartNumber
This signal contains the assembly part number defined by the vehicle manufacturer.

signal conversion
unit ASCII
max value


EHS_.1P____.F.07.001.00.BD1060
6.31 0xF190 VehicleIdentificationNumber (Read/Write)

Read Pre- Sessions: 0x01, 0x02, 0x03, 0x04, 0x40 - Security Levels: No Restrictions
Conditions
Write Pre- Sessions: 0x02, 0x03, 0x04, 0x40 - Security Levels: 0x01, 0x03, 0x04, 0x05
Conditions
VinNumber 0-17 Bytes 0 0 136 s. signal
(MIN_MAX_LENGTH) description
Signal: VinNumber
This signal contains the vehicle identification number defined by the vehicle manufacturer.

signal conversion
unit ASCII
max value


EHS_.1P____.F.07.001.00.BD1060
6.32 0xF191 Vehicle Manufacturer ECU Hardware Number (Read/

Write)
Restrictions
Write Pre-ConditionsSessions: 0x40 - Security Levels: 0x05
VirtualPartNumber 0 0 32
Signal: VinNumber
This signal contains a mandatory unique identifier which is used for HW/SW compatibility check
at ECU programming.

signal type UINT
unit
min value 0x00
max value 0xFFFFFFFF


EHS_.1P____.F.07.001.00.BD1060
6.33 0xF192 System Supplier ECU Hardware Number (Read/Write)

Read Pre-ConditionsSessions: 0x01, 0x03, 0x04, 0x40, 0x60, 0x61 - Security Levels: No
Restrictions

Conditions
Bosch Hardware 0 0 16 not possible to change
number range because of Bodas
compatibility issues.
Signal: Bosch Hardware Number
This signal contains the manufacture-specific hardware code.

signal conversion
unit ASCII
min value 0x00
max value 0xFFFF


EHS_.1P____.F.07.001.00.BD1060
6.34 0xF193 System Supplier ECU Hardware Version Number (Read/

Write)
Restrictions
Signal Name Signal Description Byte Pos Bit Pos Bit Length comments
SystemSupplierHardwareVe- 0 0 256 s. signal
rsion description
Signal: SystemSupplierHardwareVersion
This signal contains the system supplier ECU hardware version number.

signal conversion
unit ASCII
min value 32 per Byte
max value 126 per Byte


EHS_.1P____.F.07.001.00.BD1060
6.35 0xF195 BFL Software Identification (Read)

Information
Signal: Software version information
This signal indicates the version of the flashed manufacturer boot loader.

signal conversion
unit ASCII
max value
sample output
Software Version Information

DID
Type Software Variation Module type Module Major Minor Version Revision
(ECU) Name Version
0xF182 E H S _ . 1 P B F L _ . B . 0 3 . 0 0 0 . 0 0


EHS_.1P____.F.07.001.00.BD1060
6.36 0xF197 System Name (Read)

Read Pre-Conditions Sessions: 0x01, 0x02, 0x03, 0x04, 0x40, 0x41, 0x60 - Security Levels: No
Restrictions
Device Name 1 to 32 bytes 0 0 64 s. signal description
allowed
Signal: Device Name
This signal indicates the device name.

signal conversion
unit ASCII
max value


EHS_.1P____.F.07.001.00.BD1060
6.37 0xF198 Software Assembly Part Number (Read/Write)

Read Pre- Sessions: 0x01, 0x02, 0x03, 0x04, 0x40, 0x41 - Security Levels: No
Conditions Restrictions
Write Pre- Sessions: 0x02, 0x03, 0x04 - Security Levels: 0x01, 0x03, 0x04
Conditions
AssemblyPartNumb 16 bytes fixed 0 0 128 s. signal description
er length
Signal: AssemblyPartNumber
This signal is optional written during flash process with customer bootloaders. This software
assembly part number is part of J1939 Software identification response as well as J1939 Memory
Access (Diagnostic Address 237, 238).
Default information is INVALID in ASCII.

signal conversion
unit ASCII
max value


EHS_.1P____.F.07.001.00.BD1060
6.38 0xF199 Application Last Reprogrammed on (Read)

Read Pre- Sessions: 0x01, 0x03, 0x04, 0x40, 0x60 - Security Levels: No Restrictions
Conditions
Write Pre- NA
Conditions
Programming Year 0 0 8 s. signal description
Programming Month 1 0 8 s. signal description
Programming Day 2 0 8 s. signal description
This signal contains the year of the flashing date of the application software.

unit years
min value 1985
max value 2235
This signal contains the month of the flashing date of the application software.

unit months
min value 1
max value 12


EHS_.1P____.F.07.001.00.BD1060
This signal contains the day of the flashing date of the application software.

unit days
min value 0.25
max value 31.75


EHS_.1P____.F.07.001.00.BD1060
6.39 0xF19E ODX file Identifier (Read/Write)

Read Pre-Conditions Sessions: 0x40, 0x01, 0x04, 0x02, 0x03, 0x61, 0x41 - Security
Levels: No restrictions
Write Pre-Conditions Sessions: 0x40, 0x01, 0x04, 0x02, 0x03 - Security Levels: 0x00,
0x01, 0x02, 0x03, 0x04, 0x05
Signal
Description
ODX- ID 0 0 128
Major Version 16 0 8
Minor Version 17 0 8
Signal: ODX-ID
This signal contains the ODX file ID.

signal type UINT
unit
min value 0x00
max value max


EHS_.1P____.F.07.001.00.BD1060
Signal: Major Version
This signal contains the major version of ODX file.

signal type UINT
unit
min value 0
max value 250
Signal: Minor Version
This signal contains the minor version of ODX file.

signal type UINT
unit
min value 0
max value 250


EHS_.1P____.F.07.001.00.BD1060
6.40 0xF1A5 Commanded Address (Read/Write)

Restrictions
Write Pre-ConditionsSessions: 0x03, 0x04, 0x40, 0x60 - Security Levels: No Restriction
NewSourceAddress 0 0 8
Signal: NewSourceAddress
This signal contains the source address of the device. This address is used for UDS and J1939
CAN communication.

signal type UINT
unit
min value 0
max value 254


EHS_.1P____.F.07.001.00.BD1060
6.41 0xF1A7 VehicleModel (Read/Write)

Read Pre- Sessions: 0x01, 0x02, 0x03, 0x04, 0x40, 0x60 - Security Levels: No
Conditions Restrictions
Write Pre- Sessions: 0x02, 0x03, 0x04, 0x40 - Security Levels: 0x01, 0x03, 0x04
Conditions
VehicleModel 0 0 80 s. signal description
Signal: VehicleModel
This signal contains the information about the vehicle model.

signal conversion
unit ASCII
max value


EHS_.1P____.F.07.001.00.BD1060
6.42 0xF1A9 VehiclePlatform (Read/Write)

Restrictions
Write Pre-Conditions Sessions: 0x02, 0x03, 0x04, 0x40 - Security Levels: 0x01, 0x03, 0x04
VehiclePlatform 0 0 40 s. signal
description
Signal: VehicleModel
This signal contains the information about the vehicle platform.

signal conversion
unit ASCII
max value


EHS_.1P____.F.07.001.00.BD1060
6.43 0xF1AA VehicleBrand (Read/Write)

Read Pre- Sessions: 0x01, 0x02, 0x03, 0x04, 0x40 - Security Level: no restriction -
Conditions Vehicle Condition: No restriction
Write Pre- Sessions: 0x02, 0x03, 0x04, 0x40 - Security Level: 0x01, 0x03, 0x04 - Vehicle
Conditions Condition: No restriction
Signal Name Signal Description Byte Pos Bit Pos Bit Length Byte-Order comment
VehicleBrand 0 0 8 s. signal
description
Signal: VehicleBrand
This signal contains the information about the vehicle brand.

signal type UINT
unit
min value 0
max value 255


EHS_.1P____.F.07.001.00.BD1060
6.44 0xF1F0 Boot Manager Software Identification (read)

Read Pre-Conditions Sessions: 0x01, 0x02, 0x03, 0x04, 0x40 - Security Levels: No
Restrictions
Software version 0 to 31 bytes 0 0 248 s. signal
Information description

signal conversion
unit ASCII
max value
table: sample output
DID Software Version Information
Type Software (ECU) Variation Module type
0 1 2 3 4 5 6 7 8 9 10 11
0xF1F0 E H S _ . 1 P B M G R .
table: sample output continued

Module
Major Version Minor Version Revision
Name
12 13 14 15 16 17 18 19 20 21 22
0xF1F0 B . 0 2 . 0 0 0 . 0 0


EHS_.1P____.F.07.001.00.BD1060
6.45 0xFD01 PositionSensorCaliberation (Read/Write)

This parameter contains the calibration points of the position sensor characteristic.
The characteristic consists of 11 supporting points. Linear interpolation is performed between

these points.
Read Pre- Sessions: 0x01, 0x04, 0x02, 0x03, 0x40 - Security Levels: No Restriction
Conditions

Conditions
measured_value_po 0 0 16
s1_u16
s2_u16
s3_u16
s4_u16
s7_u16
s5_u16
s6_u16
s8_u16
s9_u16
s10_u16
s11_u16
reference_pos1_u1 22 0 16
6
6


EHS_.1P____.F.07.001.00.BD1060
6
6
6
6
6
6
6
reference_pos10_u 40 0 16
16
reference_pos11_u 42 0 16
16


EHS_.1P____.F.07.001.00.BD1060
Signal: measured_value...
These 11 signals contain the internally measured position values of the position sensor
characteristic. Each value is connected to reference position (s. next signal)

signal type UINT
unit µm
min value 0
max value 65535
Signal: reference_pos...
These 11 signals contain the reference position of the position sensor characteristic.

signal type UINT
unit µm
min value 0
max value 65535


EHS_.1P____.F.07.001.00.BD1060
6.46 0xFD02 CAL BSW Identification (Read)

Read Pre-Conditions Sessions: 0x01, 0x02, 0x03, 0x04, 0x40, 0x41, security Levels: No
Restrictions
Information

signal conversion
unit ASCII
max value
sample output
Type Module Major

Software(ECU) Variation Module type Version Minor Version Revision
Name
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22
0xFD0 E H S _ . 1 P E A L _ . F . 0 1 . 0 0 0 . 0 0
2


EHS_.1P____.F.07.001.00.BD1060
6.47 0xFD03 CBL BSW Identification (Read)

Read Pre-Conditions Sessions: 0x01, 0x02, 0x03, 0x04, 0x40, 0x41, 0x60 - Security Levels: No
Restrictions
Information
This signal indicates the version of the flashed customer boot loader.

signal conversion
unit ASCII
min value 0x00
sample output
Software Version Information

DID
Type Software Module Major
Variation Module type Minor Version Revision
(ECU) Name Version
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22
0xFD0 E H S _ . 1 P E A L _ . B . 0 1 . 0 0 0 . 0 0
3


EHS_.1P____.F.07.001.00.BD1060
6.48 0xFD04 ExceptionReasonRecord (Read/Write)
Read Pre-Conditions Sessions: 0x01, 0x02, 0x03, 0x40, 0x04 - Security Level: no
restriction
Write Pre-Conditions Sessions: 0x01, 0x02, 0x03, 0x04, 0x40 - Security Level: No
Restriction
Bit Signa
Byte Bit
Signal Name Signal Description Leng l Signal Conversion Unit Min Max
Pos Pos
th Type
ExceptionSource 0 0 32 UINT
32
ExceptionType 4 32 32 UINT
32
ExceptionInstructionAddress 8 64 32 UINT
32
ExceptionDataAddress 12 96 32 UINT
32
ExceptionReserved 16 128 128 UINT

8


EHS_.1P____.F.07.001.00.BD1060
6.49 0xFD05 Command Timeout (Read/Write)
Conditions
Write Pre- Sessions: 0x03, 0x04, 0x40 - Security Levels: No Restrictions

Conditions
Command Timeout Command Message 0 0 16
Timeout
Signal: Command Timeout
This signal contains the command timeout. It defines the diagnosis time for the command timeout
error. Default value is 500 ms. For detailed information s. error description.

signal type UINT
unit ms
min value 10
max value 1000


EHS_.1P____.F.07.001.00.BD1060
6.50 0xFD06 Position Loop Control SB11 Valve (Read/Write)

Read Pre-Conditions Sessions: 0x03, 0x40 - Security Levels: 0x05, 0x06
Gain Factor Extend 0 0 8 s. signal
description
Gain Factor Retract 1 0 8 s. signal

description
Integral Factor Extend 2 0 8 s. signal

description
Integral Factor Retract 3 0 8 s. signal

description
Derivative Factor Extend 4 0 8 s. signal

description
Derivative Factor Retract 5 0 8 s. signal

description
Temperature Adoptation 6 0 8 s. signal

Limit description
Gain Delta Factor Extend 7 0 8 s. signal

description
Gain Delta Factor Retract 8 0 8 s. signal

description

Extend description

Retract description

Extend description

Retract description
Isum Extend 13 0 16 s. signal

description


EHS_.1P____.F.07.001.00.BD1060
Isum Retract 15 0 16 s. signal

description
Pos Isum Max 17 0 16 s. signal

description
Pos Isum Min 19 0 16 s. signal

description
Isum Inhibit Time 21 0 16 s. signal

description
Isum Inhibit SpeedLimit 23 0 16 s. signal

description
Retract, Derivative Factor Extend, Derivative Factor Retract,
Temperature Adaptation Limit, Gain Delta Factor Extend, Gain Delta Factor Retract, Integral
Delta Factor Extend, Integral Delta Factor Retract, Derivative Delta Factor Extend, Derivative
Delta Factor Retract
signal type UINT8
unit
min value 0
max value 255


EHS_.1P____.F.07.001.00.BD1060
SpeedLimit
signal type UINT16
unit
min value 0
max value 65535


EHS_.1P____.F.07.001.00.BD1060
6.51 0xFD07 Temperature Compensation (Read/Write)

Read Pre-Conditions Sessions: 0x03, 0x40 ,0x60 security Levels: 0x05, 0x06
Safety relevant yes

parameter
Factor A Extended 0 0 16 s. signal
description
Factor B Extended 2 0 16 s. signal

description
Offset Extended 4 0 16 s. signal

description
radiant Extended 6 0 16 s. signal

description
Factor A Retraction 8 0 16 s. signal

description
Factor B Retraction 10 0 16 s. signal

description
Offset Retraction 12 0 16 s. signal

description
Gradient Retraction 14 0 16 s. signal

description
Signal: Factor A Extended, Factor B Extended, Offset Extended, radiant Extended, Factor A
Retraction, Factor B Retraction, Offset Retraction, Gradient Retraction
These signals contain the parameter values for the temperature compensation algorithm.
signal type SINT16
unit
min value -32767
max value 32767


EHS_.1P____.F.07.001.00.BD1060
6.52 0xFD08 VCAL Limitations (Read/Write)

Safety relevant yes

parameter
Stop Position Extended 0 0 16 s. signal description
End Position Retract 2 0 16 s. signal description
Open point offset Extend 4 0 16 s. signal description
Open Point offset 6 0 16 s. signal description

Retract
VAL_Reserved 8 0 128 Reserved, s. signal

description
Hold Current Adapt 9 0 8 s. signal description

Delay

PosErr

PosAvg
ICL_Reserved 12 0 104 Reserved, s. signal

description
Signal: Stop Position Extended, End Position Retract, Open point offset Extend, Open Point
offset Retract
These signals contain some parameter for the optimization of the oil flow characteristic.
signal type UINT
unit
min value 0
max value 65535


EHS_.1P____.F.07.001.00.BD1060
Signal: VAL_Reserved, ICL_Reserved
Reserved range.
signal type UINT
unit
min value 0
max value 255
Signal: Hold Current Adapt Delay, Hold Current Adapt PosErr
These signals contain parameter values for the hold current adaption.
signal type UINT
unit
min value 0
max value 200
Hold Current Adapt PosAvg
This signal contains a parameter value for the hold current adaption.
signal type UINT
unit
min value 0
max value 60


EHS_.1P____.F.07.001.00.BD1060
6.53 0xFD0A ReadAdaptHoldCurrent (Read)

Parameter is used to present the current value of hold current. This value is used for calibration
processes.
Read Pre- Sessions: 0x01, 0x03, 0x04, 0x40, 0x60 - Ssecurity Levels: No Restrictions
Conditions
Write Pre- NA
Conditions
Isum Extend Isum Parameter - 0 0 16
Extend
Isum Retract Isum Parameter - 2 16 16

Retract
Signal: Isum Extend, Isum Retract
This signal indicate the current value of adapted hold current for the named actuation direction.

signal type UINT
unit mA
min value 0
max value 65535


EHS_.1P____.F.07.001.00.BD1060
6.54 0xFD0B VCAL Temperature Correction (Read/Write)

Summary: Parameter is used to correct the error in oil flow rate due to change in temperature.
Total number of parameter is 84.
Read Pre- Sessions: 0x03, 0x40 - Security Levels: 0x05, 0x06

Conditions

Conditions
Correction Extend VCAL Temperature 0 0 16 s. signal description
correction
Correction Retract VCAL Temperature 42 672 16 s. signal description

correction
Signal: Correction Extend
This signal consists of a set of 42 values used to correct the deviation of the calculated spool
position due to temperature changes. The meaning of the values is listed in table: correction
extend

signal type UINT
unit µm
min value -32767
max value 32767


EHS_.1P____.F.07.001.00.BD1060
table: Correction Extend -Table of 42 Elements, byte order
Temperature
Points 30°C 40°C 50°C 60°C 70°C 80°C 90°C
7
1 2 3 4 5 6 7
8
8 9 10 11 12 13 14
9
15 16 17 18 19 20 21
10
22 23 24 25 26 27 28
11
29 30 31 32 33 34 35
12
36 37 38 39 40 41 42
Signal: Correction Retract
This signal consists of a set of 42 values used to correct the deviation of the calculated spool
position due to temperature changes. The meaning of the values is listed in table: correction
retract

signal type UINT
unit µm
min value -32767
max value 32767
table: Correction Retract -Table of 42 Elements, byte order
Temperature
Points 30°C 40°C 50°C 60°C 70°C 80°C 90°C
1
1 2 3 4 5 6 7
2
8 9 10 11 12 13 14
3
15 16 17 18 19 20 21
4
22 23 24 25 26 27 28
5
29 30 31 32 33 34 35


EHS_.1P____.F.07.001.00.BD1060
6
36 37 38 39 40 41 42


EHS_.1P____.F.07.001.00.BD1060
6.55 0xFD0C Battery Voltage Limits (Read/Write)

This parameter controls the battery voltage diagnosis conditions.
Read Pre- Sessions: 0x03, 0x04, 0x40 - Security Levels: 0x01, 0x02, 0x03, 0x04, 0x05,
Conditions 0x06
Write Pre- Sessions: 0x03, 0x04, 0x40 - Security Levels: 0x01, 0x02, 0x03, 0x04, 0x05,
Conditions 0x06
Battery Volt Upper 0 0 16 s. signal description
Limit
Battery Volt Lower 2 16 16 s. signal description

Limit
Voltage Hysteresis 4 32 16 s. signal description

Limit
Voltage Diagnosis 6 48 16 s. signal description

Time
Signal: BatteryVoltageUpperLimit
This signal contains the upper voltage limit for battery voltage diagnosis. Default value is 16000
mV. For detailed information about voltage diagnosis s. error description.

signal type UINT
unit mV
min value 12000
max value 18000


EHS_.1P____.F.07.001.00.BD1060
Signal: BatteryVoltageLowerLimit
This signal contains the lower voltage limit for battery voltage diagnosis. Default value is 9500
mV. For detailed information about voltage diagnosis s. error description.

signal type UINT
unit mV
min value 9000
max value 11000
Signal: VoltageHysteresisLimit
This signal contains the hysteresis limit for battery voltage diagnosis. Default value is 500 mV. For
detailed information about voltage diagnosis s. error description.

signal type UINT
unit mV
min value 12000
max value 18000
Signal: VoltageDiagnosisTime
This signal contains the diagnosis time for battery voltage diagnosis. Default value is 500 ms. For
detailed information about voltage diagnosis s. error description.

signal type UINT
unit ms
min value 0
max value 1000


EHS_.1P____.F.07.001.00.BD1060
6.56 0xFD0D Bus Off Parameters (Read/Write)

This parameter contains the information used for a bus-off algorithm. The criteria for permanent
bus-off is the retry event after every defined time interval, until it reaches Bus off Retry count. If
Time interval or Retry count is set to zero then bus off logic is disabled.
For delay timer parameter, add note - It takes about 130ms for a chip to go bus off from receiving
constant error frames and recover from bus off.
Read Pre- Sessions: 0x03, 0x04, 0x40 - Security Levels: 0x01, 0x02, 0x03, 0x04, 0x05,
Conditions 0x06
Write Pre- Sessions: 0x03, 0x04, 0x40 - Security Levels: 0x01, 0x02, 0x03, 0x04, 0x05,
Conditions 0x06
Bus-off Retry count 0 0 8
Bus-off Time 1 16 16
interval
Signal: Bus-off Retry Count
This signal contains the maximum number of permitted retry events. Default value is 3.

signal type UINT
unit
min value 0
max value 7


EHS_.1P____.F.07.001.00.BD1060
Signal: Bus-off Time interval
This signal contains the time interval for the bus-off diagnosis. Default value is 1000 ms.

signal type UINT
unit ms
min value 0
max value 1024


EHS_.1P____.F.07.001.00.BD1060
6.57 0xFD0E Security Algorithm (Read/Write)

Used to select between internal 16bit algorithm and 128 bits configurable customer AES
algorithm and to give AES encryption key for 4 levels.
Read Pre- Sessions: 0x40 - Security Levels: 0x05, 0x06

Conditions
Write Pre- Sessions: 0x03, 0x04 - Security Levels: 0x05, 0x06

Conditions
Safety relevant yes

parameter
Security Algorithm 0 0 8
Type
Security key for 1 0 128

Level 1

Level 2

Level 3

Level 4
Signal: security algorithm type
This signals defines the type of the encryption algorithm.

signal type UINT
unit ms
min value 0 0 - 16 bit key

1 - 128 AES key
max value 1


EHS_.1P____.F.07.001.00.BD1060
Signal: Security key
This signals contain the 16 bit keys of AES128 algorithm for the corresponding security levels.
signal type UINT128
unit ms
min value
max value


EHS_.1P____.F.07.001.00.BD1060
6.58 0xFD0F Autobaud Enable/Disable (Read/Write)
Read Pre- Sessions: 0x40, 0x41 - Security Levels: 0x05

Conditions
Write Pre- Sessions: 0x03, 0x04, 0x41 - Security Levels: 0x05

Conditions
Autobaud control 1 byte 0 0 8
Signal: Autobaud control
This signal enables or disables the auto baud rate detection algorithm. If active, the EHS4 tries to
detect the current baud rate of the connected system.

signal type UINT
signal identical
conversion
unit
value 0x00 - auto baud rate detection

disabled
0x01 - auto baud rate detection

enabled


EHS_.1P____.F.07.001.00.BD1060
6.59 0xFD10 Service Concept Implementation (Read/Write)

Identifier for Service concept implementation. The parameter bundles a set of pre-defined
parameters for spare part process.
Read Sessions: 0x03, 0x40 security Levels: 5, 6

Pre-
Conditio
ns
Write sessions: 0x40 security Levels: 5, 6

Pre-
Conditio
ns
Signal Signal
Signal
Descriptio Byte Pos Bit Pos Bit Length Signal Conversati Unit Min Max Comments
Name n Type on
Service 636 0 0 5088 UINT Identical 0-255 per byte
concept bytes
impleme
ntation
Signal: service concept implementation
This signal contains the combined data of pre-defined DIDs.

signal type UINT
unit
value 0 ... 255 per byte see table "list of included DIDs"
table: list of included DIDs
Data Identifier Cluster Name Bytes per Cluster
0xCF01 Source Address command ECU 1
0xCF02 Valve configuration 18
0xCF03 Valve calibration parameters 56
0xCF04 CAN Parameters 3
- reserved 4
0xCF05 Valve calibra-tion info 7


EHS_.1P____.F.07.001.00.BD1060
0xCF06 Position Loop Control SB24 Valve 25
0xCF07 Dither Parameters 14
0xCF08 Valve Abstraction Parameters 23
0xCF09 Current control parameters 16
0xCF0A Position Loop Control SB34 Valve 25
0xF187 OEM spare part number 20
0xF18E OEM Kit assembly numer 20
0xF1A5 New source address 1
0xFD06 Position Loop Control SB11 Valve 25
0xFD07 Temp. Compensation 16
0xFD08 VCAL Limitations 40
0xFD09 Valve manufacturing 101
0xFD0B VCAL Temperature Correction 168
0xFD05 Command Timeout 2
0xFD0C Voltage limits 8
0xFD0D CAN Bus Off Parameters 3
- reserved 1
0xFD0F CAN Auto Baudrate Enable 1
- Application reserved 17
0xFD12 Debug Test message 3
0xFD14 Security access level 6 17
- checksum 1


EHS_.1P____.F.07.001.00.BD1060
6.60 0xFD11 Appl_Reserved (Read/Write)

Identifier to configure ECU as service ECU and to give Security Level 6 Access to all writable
DIDs.
Read Pre-Conditions Sessions: 0x03, 0x40 - Security Levels: 0x05
Safety relevant yes

parameter
Service Config 0 0 8 s. signal description
Reserved 1 8 32
Security L6 5 40 64 s. signal description
SWId Config Software Id 13 104 8 s. signal description

configuration bit
Command Msg Command message 14 112 8 s. signal description

Validation validation
Opr Time Resolution Operation Time 15 120 8 s. signal description

Sec Resolution Sec
Signal: Service Config
This signal enables/disables the level 6 write access.

signal type UINT
unit linear
min value 0x00 0 - disabled

1 - enabled
max value 0x01


EHS_.1P____.F.07.001.00.BD1060
Signal: Command Msg Validation
This signal enables/disables the checksum and message counter function of the command
message (see J1939 manual for details).

signal type UINT
unit linear
min value 0x00 0 - disabled

1 - enabled
max value 0x01
Signal: Security L6
This signal defines the DIDs that can be written with security level 6 access.
signal type UINT
unit linear
min value 0x00 s. table: bit configuration
table: Bit Configuration for parameter write access (setting each bit will enable L6 Access for
corresponding Parameter)
1 0xCF01 SourceAddressCommandMessageTransmittingE 0 no
CU
2 0xCF02 VCC Parameters 1 no
3 0xCF03 VcalCaliberationParameters 2 yes
4 0xCF04 CANIF Parameters 3 no
5 0xCF05 VcalParameter 4 yes
6 0xCF06 PclParametersValveTp0x24 5 yes
7 0xCF07 DthParameters 6 no
8 0xCF08 VapiParameters 7 yes


EHS_.1P____.F.07.001.00.BD1060
9 0xCF09 IclParameters 8 yes
10 0xCF0A PclParametersValveTp0x34 9 yes
11 0xF15A WriteFingerprint 10 no
12 0xF187 VehicleManufacturerSparePartNumber 11 no
13 0xF18A SystemSupplierIdentifier: 12 no
14 0xF18B EcuManufacturingDate 13 no
15 0xF18C EcuSerialNumber 14 no
16 0xF18E VehicleManufacturerKitAssemblyPartNumber 15 no
17 0xF190 VehicleIdentificationNumber 16 no
18 0xF191 VehicleManufacturerECUHardwareNumber 17 no
19 0xF192 SystemSupplierECUHardwareNumber 18 no
20 0xF193 SystemSupplierECUHardwareVersionNumber 19 no
21 0xF198 vehicleAssemblyPartNumber 20 no
22 0xF19E ODX_FileIdentifier 21 no
23 0xF1A5 CommandedAddress 22 no
24 0xF1A7 VehicleModel 23 no
25 0xF1A9 VehiclePlatform 24 no
26 0xF1AA VehicleBrand 25 no
27 0xFD01 Vcc_Pos_Sensor_Calparam 26 yes
28 0xFD04 ExceptionReasonRecord 27 no
29 0xFD05 CommandTimeout 28 yes
30 0xFD06 PclParametersValveTp0x11 29 yes
31 0xFD07 vcal_TempCompensation 30 yes
32 0xFD08 vcal_limitations 31 yes
33 0xFD09 valve_manufacturing 32 no
34 0xFD0B vcal_TempCorrection 33 yes
35 0xFD0C BatteryVoltageLimits 34 no


EHS_.1P____.F.07.001.00.BD1060
36 0xFD0D BusOff_Parametrs 35 no
37 0xFD0E Customer_Security 36 yes
38 0xFD0F CAN_AutoBaudEnable 37 no
39 0xFD10 Service concept implementation 38 yes
Signal: SWID config
This signal controls which software components are listed in J1939 PGN "SWID". Only if the
corresponding bit is set, the name of the software component is transmitted.

signal type UINT
unit N/A
min value 0x00 s. table "bit configuration SWID"
max value 0xFF
table: "bit configuration SWID"
Bit position SWID field name

0 Customer Bootloader (CBL)
1 Bosch Flash Loader (BFL)
2 Boot Manager (BMGR)
3 Application Software (AWS)
4 Data Version of NVM (DATA)
5 Reserved
6 Reserved
7 Reserved


EHS_.1P____.F.07.001.00.BD1060
Signal: command message validation
This signal controls if the checksum and message counter of the command message are checked
or not. See EHS4 manual for details.

signal type UINT
unit N/A
value 0x00 - disabled
0x01 - enabled
Signal: Opr Time Resolution Sec
This signal controls the behavior of the operating time counter.

signal type UINT
unit N/A
value 0x00: resolution "minute" the operating time counter is stored every 6 mins
0x01: resolution "seconds" after power-on, operating time is stored after 60,
180 and then every 360 secs if valve state is not
neutral


EHS_.1P____.F.07.001.00.BD1060
6.61 0xFD12 Debug Message (Testbench message) with flexible

trigger options (Read/Write)
Identifier to Enable/Disable the Debug message.
Read Pre- Sessions: 0x40, 0x41 - Security Levels: No restrictions

Conditions
Write Pre- Sessions: 0x03, 0x04, 0x41 - Security Levels: No restrictions

Conditions
DebugMsg_Active 0 0 8 s. signal description
Cycle
DebugMsg_Interva 1 8 16 s. signal description

l
Signal: DebugMsg_ActiveCycle
This signal contains the number of remaining power cycles with activated debug message.
If value > 0, the message is automatically activated for the next value-1 power cycles.
Note: The cyclic debug message is sent immediately after update of the parameter. The current
power cycle is counted as first activation.
If value = 0, the debug message is deactivated.
The value is reduced by 1 after every power cycle.

signal type UINT
signal conversionidentical
unit N/A
value 0x00: debug message disabled
0x01 .. 0xFF: debug message

enabled


EHS_.1P____.F.07.001.00.BD1060
Signal: DebugMsg_Interval
This signal contains the cycle time of the debug message.

signal type UINT
unit ms
min value 1
max value 1000


EHS_.1P____.F.07.001.00.BD1060
6.62 0xFD13 Activate/Deactivate Temperature msg (Read/Write)

This identifier activates or deactivates the optional temperature message (see EHS4 manual for
message details).
The temperature message is sent as soon as it activated. The current state is stored in NVM and is
valid for the next power cycle.
Read Pre-Conditions Sessions: 0x40, 0x41 - Security Levels: No restrictions
Write Pre-Conditions Sessions: 0x03, 0x04, 0x41 - Security Levels: No restrictions
txCommCntrl 0 0 8 s. signal description
Signal: txCommCntrl
This signal control the ouput of the temperature message. See EHS4 manual for details.

signal type UINT
unit ms
value 0x00 - temperature message enabled
0x01 - temperature message disabled


EHS_.1P____.F.07.001.00.BD1060
6.63 0xFD14 Security L6 Algorithm (Read/Write)

Used to select between internal 16bit algorithm and 128 bits configurable customer AES
algorithm and to give AES encryption key for security level 6.
NOTE: To write DID 0xFD14 with L6, DID FD14 must be assigned to L6 write access bit filed
(FD11) in NVM.
when its 4-byte system 00 and all are FF's and when its 1 so next 16 bytes we have to load secret
key.
Read Pre- Sessions: 0x03, 0x04, 0x40- Security Levels: 0x05, 0x06
Conditions
Write Pre- Sessions: 0x03, 0x04, 0x40 - Security Levels: 0x05

Conditions
Security Algorithm 1 byte 0 0 8
Type
Security key for 16 Byte 1 0 128

Level 6
Signal: Security Algorithm
This signal controls which security algorithm is used.

signal type UINT
unit n/A
values 0 - 16 bit default key
1 - 128 bit AES key


EHS_.1P____.F.07.001.00.BD1060
Signal: security key for Level 6
This signal contains the AES128 key for the security level 6.

signal type UINT
unit N/A
min value 0x00000000000000000000 128 bits key

000000000000
max value 0xFFFFFFFFFFFFFFFFFFFFF

FFFFFFFFFFF


EHS_.1P____.F.07.001.00.BD1060
6.64 0xFE0B ECU-Age/Operating Hours (Read)
Read Pre- Sessions: 0x03, 0x04 ,0x40, 0x41, 0x60 - Security Levels: No Restrictions
Conditions
Write Pre- NA
Conditions
Operating Hours 0 0 32
Signal: Operation Hours
This signal indicates the current operating hours of the device.

signal type UINT
signal conversion y(x) = x/60
unit hrs.
min value 0
max value 71582788


EHS_.1P____.F.07.001.00.BD1060
6.65 0xFE16 Read Temperature (Read)
Conditions
Write Pre- NA
Conditions
Signal Name Signal Description Byte Pos Bit Pos Bit Length Byte Order Comments
Number of signals 0 0 8
Oil Temp 1 0 32 Motorola
MCU Temp 5 0 32 Motorola
PCB Temp 9 0 32 Motorola
Signal: number of signals
This signal indicates number of temperature parameters presented in this DID.

signal type UINT8
unit
min value 0
max value 255
Signal: Oil Temp
This signal indicates estimated oil temperature measured on PCB.

signal type INT32
unit °C
min value -30
max value 150


EHS_.1P____.F.07.001.00.BD1060
Signal: MCU Temp
This signal indicates the temperature of the internal temperature sensor of the processor.

signal type INT32
unit °C
min value -30
max value 150
Signal: PCB Temp
This signal indicates the temperature of the HW temperature measured on PCB.

signal type INT32
unit °C
min value -30
max value 150


EHS_.1P____.F.07.001.00.BD1060
7 Supported Routine Identifiers

7.1 0x0202 CheckMemoryRequest (StartRoutine-Request)
This routine triggers the server to check that the download and programming into nonvolatile
memory of the last memory block (started with Erase Memory) was successful (e.g.
calculate a checksum).
Read Pre- Sessions: 0x02 security Levels: 0x01, 0x03, 0x04, 0x05
Conditions
Empty 0 0 0
Signal: Empty

signal type BYTEFIELD
signal conversion MIN_MAX_LENGTH
unit
min value 0 .. 255 per byte
max value


EHS_.1P____.F.07.001.00.BD1060
7.2 0x0202 CheckMemoryResponse (StartRoutine-Response)
Read Pre- Sessions: – security Levels: No Restrictions

Conditions
RoutineInfo 0 0 8
Signal: RoutineInfo

signal type UINT
signal conversion TEXTTABLE:

0 = PASSED
1 = FAILED
unit
min value
max value
7.3 0x0203 CheckProgrammingPreConditionsRequest (StartRoutine-

Request)
This RID is used to check preprogramming errors if any before start of flashing process.
Note: Refer response for different preprogramming error list for EHS4.
Read Sessions: 0x03 security Levels: No Restrictions

Pre-
Conditio
ns
Signal Signal
Signal Descriptio Byte Pos Bit Pos Bit Length Signal Conversati Unit Min Max Comments
Name Type
n on
0 0 0 BYTEFIE MIN_MA 0-255
LD X_LENG per Byte
TH


EHS_.1P____.F.07.001.00.BD1060
7.4 0x0203 CheckProgrammingPreConditionsResponse (StartRoutine-

Response)
Read Sessions: 0x03 security Levels: No Restrictions
Pre-
Conditio
ns
Signal Signal
Signal Signal
Descriptio Byte Pos Bit Pos Bit Length Conversati Unit Min Max Comments
Name n Type on
Program for each 0-n 0 8 UINT TEXTTABLE:
ming wrong 1 = ENGINE_SPEED_NOT_ZERO
PreCond conditio 2 = IMMOBILIZER_NOT_UNLOCKED
ition n 1 byte 3 = TRANSMISSION_SPEED_IN_NOT_ZERO
List is sent, 4 = TRANSMISSION_SPEED_OUT_NOT_ZERO
if all 5 = VEHICLE_SPEED_NOT_ZERO
conditio 6 = CONTROLLING_ACTIVE
ns are 7 = IGNITION_OFF_ON_NECESSARY
meet 0 8 = PROGRAMMING_VOLTAGE_TOO_LOW
bytes 9 = IGNITION_NOT_ON
are 10 = VEHICLE_VOLTAGE_TOO_LOW
transmit 11 = TEMPERATURE_TOO_HIGH
ted 12 = TEMPERATURE_TOO_LOW
13-127 = RESERVED_BY_HIS
128-191 = RESERVED_BY_MANUFACTURER
192-255 = RESERVED_BY_SUPPLIER


EHS_.1P____.F.07.001.00.BD1060
7.5 0xFF00 EraseMemoryRequest (StartRoutine-Request)

This RID is used to erase memory before flashing procedure.
Note: This RID is part of routine control 0x31 request.
Read Pre-Conditions: Sessions: 0x02 security Levels: 0x01, 0x03, 0x04, 0x05
Signal Signal
Signal Signal
Descriptio Byte Pos Bit Pos Bit Length Conversati Unit Min Max Comments
Name n Type on
Number 0 0 4 UINT IDENTIC 1-15
OfBytes AL
OfMemo
ryAddres
sParame
ter
Number 0 4 4 UINT IDENTIC 1-15

OfBytes AL
OfMemo
rySizePa
rameter
Memory 1 0 32 BYTEFIE STANDA 0-255

Address LD RD_LEN per Byte
GTH
Memory 5 0 32 BYTEFIE STANDA 0-255

Size LD RD_LEN per Byte
GTH
7.6 0xFF00 EraseMemoryResponse (StartRoutine-Response)
Signal
Signal Name Signal
Description Byte Pos
Bit Pos Bit Length Signal Type Conversatio Unit Min Max
n
RoutineIn 0 0 8 UINT TEXTTAB
fo LE:
0=
PASSED
1=
FAILED


EHS_.1P____.F.07.001.00.BD1060
7.7 0xFF01 CheckProgrammingDependenciesRequest (StartRoutine-

Request)
This RID triggers the server to check the compatibility/consistency of overall server between SW/
SW and SW/HW.
Note: This RID is part of routine control 0x31 request.
Routine sessions: 0x02 security Levels: 0x01, 0x03, 0x04, 0x05

Control
Pre-
Conditio
ns
Signal Signal
Signal
Name n Type on
Empty 0 0 0 BYTEFIE MIN_MA 0-255
LD X_LENG per Byte
TH


EHS_.1P____.F.07.001.00.BD1060
7.8 0xFF01 CheckProgrammingDependenciesResponse (StartRoutine-

Response)
Routine Sessions: -- security Levels: No Restrictions
Control
Pre-
Conditio
ns
Signal Signal
Signal
Name n Type on
RoutineI 0 0 8 UINT TEXTTAB
nfo LE:
0=
CORREC
T_RESUL
T
1=
INCORR
ECT_RES
ULT
2=
INCORR
ECT_RES
ULT_ERR
OR_SW_
HW
3=
INCORR
ECT_RES
ULT_ERR
OR_SW_
SW
4=
INCORR
ECT_RES
ULT_ON
E_OR_M
ORE_BL
OCKS_N
OT_PRO
GRAMM
ED


EHS_.1P____.F.07.001.00.BD1060
7.9 0xF000 WriteAllParametersToNVM (StartRoutine - Request)

This RID is used to write parameters/ service-related parameters to NVM for specific features.
Read Pre-Conditions: Sessions: 0x02 security Levels: 0x01, 0x03, 0x04, 0x05
Bit
Byte Bit Signal Signal
Signal Name Signal Description Leng Unit Min Max Comments
Pos Pos Type Conversation
th
UpdateParam w/o Update param to 0 0 8 UINT IDENTICAL 0x01 =
Powercycle NVM without Enable
power cycle
ServiceParamUpdat Update Service 1 8 8 UINT IDENTICAL 0x01 =

etoNVM Parameter data to Enable
NVM


EHS_.1P____.F.07.001.00.BD1060
8 Error Management
Tool must be able to read both passive and active errors as well as the DTC snapshot Record
using Read DTC information service.
8.1 Supported Fault Codes (DTC)

J1939 UDS error int. remarks
category error description
SPN FMI (dec) DTC code
0x07F2 0x09 2034.09 0x00FE49 command 1 default command Ex: If commanding

error message timeout source address =
(2000[0x7D0] + 0x24
Commanding Source
Address[0x22]) then the calculated
SPN is
0x7D0 + 0x24
=0x7F4
0x0FF5 0x0C 4085.12 0x01FEAC critical 2 EEPROM Fault

error
14 Position Transducers
Fault
13 Output stage Fault
15 Sticking Pilot valve,

only if pressure
information is available
51 abnormal current
18 checksum error
0x07F2 0x00 2034.00 0x00FE40 neutral 3 Waiting for neutral sometimes

command command considered as state
error information
49 DEM_WAIT_NEUTRAL_C
MD_UBAT_ERROR
0x009E 0x04 158.04 0x0013C4 undervolta 4 Under Voltage (Bosch

ge error Limit)
5 Under Voltage (Bosch

Limit)
0x009E 0x03 158.03 0x0013C3 overvoltag 6 Over Voltage

e error (Customer Limit)
7 Over Voltage (Bosch

Limit)
8 Over Voltage > 45V


EHS_.1P____.F.07.001.00.BD1060

0x0FF4 0x12 4084.18 0x01FE92 main 9 Main Spool too short

spool too
short
0x0FF4 0x10 4084.16 0x01FE90 main 10 Main Spool too far,

spool too
far, Manual Operation (If
Command = Neutral)
manual
operation
0x0FF4 0x07 4084.07 0x01FE87 float 11 Float Position not

position reached
error
0x0FF5 0x07 4085.07 0x01FEA7 neutral 16 Main spool can't return

position to neutral
error
17 Main spool not in
neutral at power up
0x106E 0x02 4206.02 msg cmd msg counter not

counter correct
error
0x106F 0x13 4207.19 checksum cmd msg checksum not

error correct
0x7E000 0x0C 516096.12 0xFC000C 19 Protocol Timeout While

Waiting for
Consecutive Frames.
0x7E001 0x0C 516097.12 0xFC002C 20 CAN Rx Buffer

Overflow or Rx
Message Lost.
0x7E002 0x0C 516098.12 0xFC004C 21 CAN Tx Buffer

Overflow or Tx
Message Lost.
0x7E003 0x0C 516099.12 0xFC006C 22 Single Frame Message

with an Invalid Data
Length Received.
0x7E004 0x0C 516100.12 0xFC008C 23 CAN Message with an

Invalid PCI Type Was
Received.
0x7E005 0x0C 516101.12 0xFC00AC 24 CANTP error

consecutive frame seq.


EHS_.1P____.F.07.001.00.BD1060

0x7E006 0x0C 516102.12 0xFC00CC 25 Protocol Timeout While

Waiting for Flow
Control.
0x7E007 0x0C 516103.12 0xFC00EC 26 Unknown Error In CAN-

TP
0x7E009 0x00 516105.00 0xFC0120 27 Exceptional Error
0x7E010 0x09 516112.09 0xFC0209 CAN 28 Can Rx Overflow

overflow
29 Can Tx Overflow
0x7E011 0x07 516113.07 0xFC0227 30 Can Bus Initialization

Error
0x7E012 0x02 516114.02 0xFC0242 CAN 31 Can RX Unknown

unknown signal
signal
32 Can TX Unknown signal
0x7E013 0x12 516115.18 0xFC0272 33 Can Bus Error
0x7E014 0x12 516116.18 0xFC0292 BSW 1 34 Bsw Memory Hw Error
35 Bsw Config Param

Error
36 Bsw Api Argument

Error
37 Bsw Communication
Hw Error
0x7E015 0x11 516117.17 0xFC02B1 BSW 2 38 Bsw Data

Inconsistency Error
39 Bsw Address
Inconsistency Error
40 Bsw Initialization Error
41 Bsw Busy Runtime switched off in

Error D1.3.2/CAL 6.2.1
42 Bsw Invalid State Error
43 Bsw Timeout Error
44 Bsw Sequential Error


EHS_.1P____.F.07.001.00.BD1060

45 Bsw Uncategorized
Error
0x7E016 0x0C 516118.12 0xFC02CC NVM 46 Vcc NVM Data Error e.g. indicates a
mismatch between
source address and
stored valveIDs in
AVC mode
from F,05.002.00:
no actuation
possible
47 Vai NVM Data Error
0x7E00A 0x0C 516106.12 0xFC014C 48 Ecum Parameter Load

Error
0x7E00B0x13 516107.19 0xFC0173 50 Bsw Input Output Error
0x7E020 0x10 516128.16 0xFC0410 Temperatu 52 Temperature High

re high
0x7E021 0x14 516129.20 0xFC0434 Temperatu 53 Temperature Low

re low


EHS_.1P____.F.07.001.00.BD1060
8.2 Snapshot Data Identifiers

DID Start Byte Bit Size Type Signal Definition
0xFE1A 1 16 UINT16 Internal Error Code
3 16 Reserved
0x0117 1 8 UINT8 AuxiliaryValvePortFlow
2 8 Reserved0
3 4 UINT8 AuxiliaryValveStateCommand
3 2 Reserved1
3 2 UINT8 AuxiliaryValveFailSafeMode
4 8 Reserved2
0x1102 1 16 UINT16 MainSpoolSetpoint
3 16 UINT16 MainSpoolPosition
0xFE17 1 32 SINT32 PCB Temperature
0xFE18 1 32 SINT32 Oil Temperature
0xFE0B 1 32 UINT32 OperatingHours
0x0115 1 8 UINT8 OccurrenceCount
2 24 reserved

Actuating Unit Ehs4: Uds Protocol, Software Version: F.06.00X.00.Bdxxxx and F.07.001.00.Bd1060

Uploaded by

Copyright:

Available Formats

Actuating Unit Ehs4: Uds Protocol, Software Version: F.06.00X.00.Bdxxxx and F.07.001.00.Bd1060

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Actuating Unit Ehs4: Uds Protocol, Software Version: F.06.00X.00.Bdxxxx and F.07.001.00.Bd1060

Uploaded by

Copyright:

Available Formats

Technical customer

Actuating unit EHS4

RE 66157-06-B/2024-10-29, replaces: 2023-05-26, EN

The data specified within only serve to describe

The products and configurations shown in this

The original manual was created in the English

EHS4 UDS Manual - EHS_.1P____.F.06.00x.00.BDxxxx + EHS_.1P____.F.07.001.00.BD1060

1 About this documentation 8

© Bosch Rexroth, 2023 RE 66157-04-B/2023-05-23

RE 66157-06-B/2024-10-29, Bosch Rexroth AG

EHS4 UDS Manual - EHS_.1P____.F.06.00x.00.BDxxxx + EHS_.1P____.F.07.001.00.BD1060

© Bosch Rexroth, 2023 RE 66157-04-B/2023-05-23

Bosch Rexroth AG, RE 66157-06-B/2024-10-29

EHS4 UDS Manual - EHS_.1P____.F.06.00x.00.BDxxxx + EHS_.1P____.F.07.001.00.BD1060

6.5 0x1103 Auxiliary Pilot Valve Monitor (Read) 60

© Bosch Rexroth, 2023 RE 66157-04-B/2023-05-23

RE 66157-06-B/2024-10-29, Bosch Rexroth AG

EHS4 UDS Manual - EHS_.1P____.F.06.00x.00.BDxxxx + EHS_.1P____.F.07.001.00.BD1060

6.41 0xF1A7 VehicleModel (Read/Write) 118

© Bosch Rexroth, 2023 RE 66157-04-B/2023-05-23

Bosch Rexroth AG, RE 66157-06-B/2024-10-29

EHS4 UDS Manual - EHS_.1P____.F.06.00x.00.BDxxxx + EHS_.1P____.F.07.001.00.BD1060

7.7 0xFF01 CheckProgrammingDependenciesRequest (StartRoutine-

© Bosch Rexroth, 2023 RE 66157-04-B/2023-05-23

RE 66157-06-B/2024-10-29, Bosch Rexroth AG

8/172 EHS4 UDS Manual - EHS_.1P____.F.06.00x.00.BDxxxx +

1 About this documentation

1.1 Validity of the documentation

This documentation is intended for machine/system manufacturers as well as authorized

▶ Read this documentation completely and, in particular, the chapter 2

1.2 Required and supplementary documentation

© Bosch Rexroth, 2023 RE 66157-04-B/2023-05-23

Bosch Rexroth AG, RE 66157-06-B/2024-10-29

EHS4 UDS Manual - EHS_.1P____.F.06.00x.00.BDxxxx + 9/172

© Bosch Rexroth, 2023 RE 66157-04-B/2023-05-23

RE 66157-06-B/2024-10-29, Bosch Rexroth AG

10/172 EHS4 UDS Manual - EHS_.1P____.F.06.00x.00.BDxxxx +

3.1.1 CAN Network Layer

• Non-segmented data transfer

© Bosch Rexroth, 2023 RE 66157-04-B/2023-05-23

Bosch Rexroth AG, RE 66157-06-B/2024-10-29

EHS4 UDS Manual - EHS_.1P____.F.06.00x.00.BDxxxx + 11/172

• Segmented Data transfer

3.1.2 Application Layer

© Bosch Rexroth, 2023 RE 66157-04-B/2023-05-23

RE 66157-06-B/2024-10-29, Bosch Rexroth AG

12/172 EHS4 UDS Manual - EHS_.1P____.F.06.00x.00.BDxxxx +

message name message ID direction comment

CanRespUSDTId 0x18DAF9xx ECU --> Tester

CanFuncReqId 0x18DBFFF9 Tester --> all ECUs

xx - source address of the connected EHS4 (default: 0x80)

© Bosch Rexroth, 2023 RE 66157-04-B/2023-05-23

Bosch Rexroth AG, RE 66157-06-B/2024-10-29

EHS4 UDS Manual - EHS_.1P____.F.06.00x.00.BDxxxx + 13/172

table: diagnosis services

SID Diagnostic Session ID (s. table: Diagnostic Session IDs)

© Bosch Rexroth, 2023 RE 66157-04-B/2023-05-23

RE 66157-06-B/2024-10-29, Bosch Rexroth AG

14/172 EHS4 UDS Manual - EHS_.1P____.F.06.00x.00.BDxxxx +