8 End of Line Programming: Software Documentation Page 8-1 EDC7 Keyword Protocol 2000

Software Documentation Page 8-1
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4
8 End of Line Programming

End of line programming allows to calibrate, in production or in service, applicationable data (values,
curves, maps), when engine is in OFF condition. In order to restrict access with different access levels,
the flash memory can be divided into several end of line (EOL) areas, which can be of any size (down to
one single label). The division of data into EOL areas has to be done in agreement with the vehicle
manufacturer and the system supplier. The EOL area structure can not subsequently be varied.
To perform EOL programming functions, it is necessary to enter a diagnostic mode to which the tester is
allowed to access to (by securityAccess service, seed and key). Program code and data have to be all right
and the engine must not run, otherwise upon a login request the ECU will respond negatively. The ECU
does not switch off the engine automatically.
Each EOL area is identified by a symbolic number (0 to 255, continuously numbered), which is independent
of the areas physical memory address. The tester can ask for the corresponding area start and end address
within a login request (escapeCode (80h)- loginRead or loginWrite). The tester can use this address
range to upload data from the requested EOL area or to download data into the requested EOL area. Note
that the number of defineable EOL areas is limited by the ECU's available memory.
If the tester requests to calibrate data, it shall report (with the escapeCode - loginWrite request message)
information regarding the current modification to be stored in the ECU (this information is available by the
escapeCode - loginRead service until it is overwritten by the next calibration session). Data can then be
uploaded from the EOL area to the tester, be modified by the tester and downloaded back to the ECU. The
downloaded data received by the ECU are written to the so called copy-page first. Only when the tester
initiates the checksumAdjustment routine, the modified data will be copied from the copy-page to the actual
EOL data (working) page and the checksum will be adjusted. This procedure guarantees, that there is
always a valid data-set available in the ECU, even if power breaks or is switched off in between. If power
supply breaks before the checksum adjustment was started or shortly afterwards, the calibrations get lost
and the old data-set is active again when the ECU will be restarted. If power supply breaks after checksum
adjustment was started, upon the next ECU power-on the ECU will rebuild the new data-set from the copy-
page. This takes some seconds time, in which communication can not be established. After successful
rebuilding the ECU resets and than returns into the normal mode of operation.
In the case the checksumAdjustment routine was properly completed and the tester has received the
requestRoutineResults positive response message, another login procedure may be performed. To get back
into normal mode the ECU has to be reset by switching off terminal 15 or sending an ecuReset request
message to the ECU.
Individual read and write access rights can be configured to each EOL area for the different diagnostic
modes. With this mechanism e.g. in development mode all data might be changed, in EOL programming
mode only some engine specific data and in repair shops only certain data might be read, but not
reprogrammed.
The message flow of EOL operation is shown below:
© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.
DS-NF/ESN2 15-JAN-2004 End Of Line Programming

engine stopped
securityAccess
startDiagnostic-
Session
EOL read EOL write
escapeCode escapeCode
loginRead loginWrite
request request
Upload Download
transferData transferData
(Read) (Write)
finished ? finished ?
no no
yes yes
request request
TransferExit TransferExit
further data
in same
yes, in
area ?
ascending
no order
startRoutine
CSAdjustment
requestRoutine
Results
response
negative
positive
yes
further areas
?
no
manual ecuReset
ECU reset
Figure End of line programming message flow

8.1 escapeCode (80h) - loginRead
This service can be used by the tester to read the content of the specified EOL header regarding the latest
EOL access. It is not required to perform the escapeCode - loginRead request in order to read the actual
calibration data of that EOL area. The engine must not run during an end of line session.
Byte Request block Hex Value Mnemonic

#1 escapeCode Request Service Id 80 EC
#2 ManufacturerSpecific Service Id = [loginRead] 80 MSSID_LR
#3 EolAreaNumber xx RV_AN
Byte Positive response block Hex Value Mnemonic

#1 escapeCode Positive Response Service Id C0 ECPR
#2 manufacturerSpecific Service Id = [loginRead] 80 MSSID_LR
#3 areaStartAddress (High Byte) xx RV_ASHB
#4 areaStartAddress (Middle Byte) xx RV_ASMB
#5 areaStartAddress (Low Byte) xx RV_ASLB
#6 areaEndAddress (High Byte) xx RV_AEHB
#7 areaEndAddress (Middle Byte) xx RV_AEMB
#8 areaEndAddress (Low Byte) xx RV_AELB
#9 infoLastModification#1 xx RV_INF1
#10 : xx RV_INF2
#11 : xx RV_INF3
#12 : xx RV_INF4
#13 : xx RV_INF5
#15 dateOfLastModification (day) xx RV_DAY
#16 DateOfLastModification (month) xx
RV_MONT
H
#17 DateOfLastModification (year) xx RV_YEAR
Byte Negative response block Hex Value Mnemonic

#1 negativeResponse Service Id 7F NR
#3 manufacturerSpecific Service Id = [loginRead] 80 MSSID_LR
#4 responseCode = [ xx=[ RC_...
serviceNotSupported (wrong diagnostic mode) 11,
subFunctionNotSupported-invalidFormat 12,
(invalid message length, invalid eolAreaNumber),
conditionsNotCorrectOrRequestSequenceError 22,
securityAccessDenied-securityAccessRequested 33
(tester is not allowed to access to requested EOL area) ] ]

The parameter eolAreaNumber in the escapeCode - loginRead request message specifies the EOL area
number the tester requests to login.
The parameter areaStartAddress in the positive response message gives the start address of the actual
calibration data of the specified EOL area.
The parameter areaEndAddress in the positive response message gives the end address of the EOL area
assigned to the requested eolAreaNumber.
The parameter infoLastModification is of type ASCII and used in the positive response message to report
information about the last calibration of the requested EOL area.
The parameter dateOfLastModification is binary coded decimal (DDh, MMh, YYh) and used in the positive
response message to report the date of the last calibration of the requested EOL area.

8.2 requestUpload (35h)- endOfLine

The requestUpload service is used by the tester to initiate data transfer from the ECU to the tester (upload).
After the ECU has received the requestUpload request message, the ECU takes all necessary actions to
transmit data within the transferData positive response message, before it sends the positive response
message.
The transferResponseParameter (TREP_) "maxNumberOfBlockLength (MNROBL)" is used by the
requestUpload positive response message to inform the tester how many data bytes shall be included in
each transferData positive response message from the ECU. This parameter is set to the ECU maximum
transmission buffer size = 255.

#1 requestUpload Request Service Id 35 RU
#2 startAddress (High Byte) xx SAH
#3 startAddress (Middle Byte) xx SAM
#4 startAddress (Low Byte) xx SAL
#5 dataFormatIdentifier = [uncompressed, not encoded] 00 DFI
#6 UncompressedMemorySize (High Byte) xx UMSH
#7 UncompressedMemorySize (Middle Byte) xx UMSM
#8 UncompressedMemorySize (Low Byte) xx UMSL
Byte Posititve response block Hex Value Mnemonic

#1 requestUpload Positive Response Service Id 75 RUPR
#2 transferResponseParameter = [maxNumberOfBlockLenght] FF TREP_
MNROBL

#1 negative Response Service Id 7F NR
#2 requestDownload Request Service Id 35 RU
(invalid length, dataFormatIdentifier not supported),
(data set is currently being changed; RAM -> flash,
CSAdjust),
securityAccessDenied-securityAccessRequested ] 33]

8.3 transferData (36h)- endOfLineRead

The transferData service is here used by the tester to transfer data from the ECU to the tester (upload). The
data transfer direction is defined by the preceding requestUpload service.
With each message exchange a maximum of 254 useful data bytes can be transferred. The transferData
request can be repeated as often as needed to read all data from the memory area initiated by the request-
Upload service. After the whole range of data is transferred, the ECU issues a negative response to indicate
the end of the upload.
The data transfer has to be terminated by the transferExit service.
The parameter transferResponseParameter (TREP_) in the transferData positive response message
contains data to upload from the ECU to the tester.

#1 transferData Request Service Id 36 TD

#1 transferData Positive Response Service Id 76 TDPR
#2 transferResponseParameter#1 xx TREP_...
: : : :
#n transferResponseParameter#m (m ≤ 254) xx TREP_...

subFunctionNotSupported-invalidFormat (invalid length) 12,
(there was no preceding requestUpload),
uploadNotAccepted (upload finished) ] 50]

8.4 requestTransferExit (37h)- endOfLineRead

This service is used by the tester to terminate data transfer between tester and ECU. The transferData
operation shall only be terminated by the requestTransferExit service.
The response will be positive even if the transfer of the whole area is not completed.

#1 requestTransferExit Request Service Id 37 RTE

#1 requestTransferExit Positive Response Service Id 77 RTEPR


(invalid length of request),
conditionsNotCorrectOrRequestSequenceError 22]
(there was no preceding requestUpload)

8.5 escapeCode (80h) - loginWrite
This service enables the tester to read, modify and write back calibration data into the flash-EPROM. The
engine must not run during an end of line session.

#2 manufacturerSpecific Service Id = [loginWrite] 81 MSSID_LW
#3 eolAreaNumber xx RV_AN
#4 infoCurrentModification#1 xx RV_INF1
#5 : xx RV_INF2
#6 : xx RV_INF3
#7 : xx RV_INF4
#8 : xx RV_INF5
#9 infoCurrentModification#6 xx RV_INF6
#10 dateOfCurrentModification (day) xx RV_DAY
#11 dateOfCurrentModification (month) xx RV_MONT
H
#12 dateOfCurrentModification (year) xx RV_YEAR

#1 escapeCode Positive Response Service Id C0 ECPR
#3 areaStartAddress (High Byte) xx RV_ASHB
#4 areaStartAddress (Middle Byte) xx RV_ASMB
#5 areaStartAddress (Low Byte) xx RV_ASLB
#6 areaEndAddress (High Byte) xx RV_AEHB
#7 areaEndAddress (Middle Byte) xx RV_AEMB
#8 areaEndAddress (Low Byte) xx RV_AELB
#10 : xx RV_INF2
#11 : xx RV_INF3
#12 : xx RV_INF4
#13 : xx RV_INF5
#15 dateOfLastModification (day) xx RV_DAY
#16 dateOfLastModification (month) xx RV_MONT
H
#17 dateOfLastModification (year) xx RV_YEAR


#1 negativeResponse Service Id 7F NR
generalReject 10*
serviceNotSupported (wrong diagnostic mode) 11*
subFunctionNotSupported-invalidFormat 12*,
(invalid length of message, invalid eolAreaNumber),
busy-repeatRequest, 21*,
conditionsNotCorrectOrRequestSequenceError 22*,
securityAccessDenied-securityAccessRequested 33*,
(no security access after startDiagnostic-Session,
tester is not allow to access to requested EOL area),
erasingError, FD,
programmingError ] FE]
*10, 11, 12, 21, 22, 33: old EOL area remains valid if old EOL LoginWrite was successful.
other neg. resp. codes: old and new EOL area are not valid
After the ECU has received the escapeCode - loginWrite request message, it starts erasing parts of the
flash-EPROM (copy-page). As this causes evaluation time, the ECU issues a response with the negative
response code "busy-repeatRequest", unless the timing parameter P2max is set to infinity. The ECU has to
react like this, because the duration of the flash erasure procedure depends on temperature conditions and
is therefore not determinable in advance. Refer to section "Negative Response Code Value Summary
Table". After the copy-page is erased, the tester identification data are programmed into the flash-EPROM
and the positive response message will be sent, if erasing and programming went right.
The parameter eolAreaNumber in the escapeCode - loginWrite request message specifies the EOL area
number the tester requests to login.
The parameter infoCurrentModification is of type ASCII and used in the request message to report
information about the current calibration, for example a tester identification to the ECU. This information will
be stored in the ECU after the EOL calibration session is finished.
The parameter dateOfCurrentModification is binary coded decimal (DDh, MMh, YYh) and used in the
request message to report the current date to the ECU. This date will be stored in the ECU as well.
The parameter areaStartAddress in the positive response message gives the start address of the actual
calibration data of the specified EOL area.
The parameter areaEndAddress in the positive response message gives the end address of the EOL area
assigned to the requested eolAreaNumber.
The parameter infoLastModification is of type ASCII and used in the positive response message to report
information about the last calibration of the requested EOL area.
The parameter dateOfLastModification is binary coded decimal (DDh, MMh, YYh) and used in the positive
response message to report the date of the last calibration of the requested EOL area.

8.6 requestDownload (34h)- endOfLine

The downloadRequest service is used to initiate data transfer from the tester to the ECU (download). After
the ECU has received the requestDownload request message, the ECU takes all necessary actions to
receive data within the transferData request message, before it sends the positive response message.
The transferResponseParameter (TREP_) "maxNumberOfBlockLength (MNROBL)" is used by the
requestDownload positive response message to inform the tester how many data bytes shall be included in
each transferData request message from the tester. This parameter is set to the EDC7 maximum reception
buffer size = 255.
The start address in the first requestDownload request message has to be the start address of the
corresponding EOL area, otherwise a negative response will be sent. The end address must be inside the
corresponding EOL area. The services requestDownload, transferData and transferExit may be repeated but
the data have to be transmitted in ascending order (start address in a following requestDownload message
must be higher than the end address in the last requestDownload message). If there is a gap between two
downloaded memory blocks, the ECU fills up the relevant memory areas with "old" data automatically. As
this procedure may take evaluation time, the ECU may issue the negative response code "busy-
repeatRequest".

#1 requestDownload Request Service Id 34 RD
#2 startAddress (High Byte) xx SAH
#3 startAddress (Middle Byte) xx SAM
#4 startAddress (Low Byte) xx SAL
#5 dataFormatIdentifier = [uncompressed, not encoded] 00 DFI
#6 uncompressedMemorySize (High Byte) xx UMSH
#7 uncompressedMemorySize (Middle Byte) xx UMSM
#8 uncompressedMemorySize (Low Byte) xx UMSL

#1 requestDownload Positive Response Service Id 74 RDPR
#2 transferResponseParameter = [maxNumberOfBlockLenght] FF TREP_
MNROBL

#2 requestDownload Request Service Id 34 RD
serviceNotSupported (wrong diagnostic mode), 11,
(invalid length of message, dataFormatIdentifier not
supported),
(checksum adjustment is active),
requestOutOfRange (memory-Size > 64 kB), 31,
securityAccessDenied-securityAccessRequested, 33,
downloadNotAccepted (download or upload already 40,
active),
cannotDownloadToSpecifiedAddress 42
(invalid address range, no ascending order) ] ]

8.7 transferData (36h)- endOfLineWrite

The transferData service is here used by the tester to transfer data from the tester to the ECU (download).
The data transfer direction is defined by the preceding requestDownload service.
With each message exchange a maximum of 254 useful data bytes can be transferred. The transferData
request can be repeated as often as needed to write all data to the memory area initiated by the
requestDownload service. After the whole range of data is transferred, the ECU issues a negative response
to indicate the end of the download.
The data transfer has to be terminated by the transferExit service.
The parameter transferRequestDataParameter (TRTD_) in the transferData request message contains
data to download to the ECU.

#2 transferRequestData#1 xx TRTD_...
: : : :
#n transferRequestData#m (m ≤ 254) xx TRTD_...

#1 transferData Positive Response Service Id 76 TDPR

generalReject 10,
busy-repeatRequest, 21,
(there was no preceding requestDownload),
downloadNotAccepted 40,
(download finished or aborted due to programming error),
cannotDownloadNumberOfBytesRequested 43,
(too many data transmitted),
programmingError ] FE]

8.8 requestTransferExit (37h)- endOfLineWrite

This service is used by the tester to terminate data transfer between tester and ECU. The transferData
operation shall only be terminated by the requestTransferExit service.
The response will be positive even if the transfer of the whole area is not completed.

Byte Positive response Hex Value Mnemonic

#1 requestTransferExit Positive Response Service Id 77 RTEPR

(invalid length of message),
conditionsNotCorrectOrRequestSequenceError ] 22

8.9 startRoutineByLocalIdentifier (31h) - checksumAdjustment

ChecksumAdjustment can take a few seconds. Therefore the checksum adjustment must be started by the
startRoutineByLocalIdentifier service. The results of this operation have to be polled by the requestRoutine-
ResultsByLocalIdentifier service. The requestRoutineResultsByLocalIdentifier positive response message
signifies the success of the preceding data transfer.

#1 startRoutineByLocalIdentifier Request Service Id 31 STRBLI
#2 routineLocalIdentifier = [checksumAdjustment] 80 RELI_CA

#1 startRoutineByLocalIdentifier Positive Response Service 71 STRBLIPR
Id

#2 startRoutineByLocalIdentifier Request Service Id 31 STRBLI
general Reject, 10,
serviceNotSupported (wrong diagnostic mode, invalid 11,
routineLocalIdentifier)
conditionsNotCorrectOrRequestSequenceError ] 22]

8.10 requestRoutineResultsByLocalIdentifier (33h) -

checksumAdjustment

#1 requestRoutineResultsByLocalIdentifier Request SId 33 RRRBLI

#1 requestRoutineResultsByLocalIdentifier Pos. Resp. SId 73 RRRBLIPR

#2 requestRoutineResultsByLocalIdentifier Request SId 33 RRRBLI
generalReject 10*,
serviceNotSupported (wrong diagnostic mode, invalid 11*,
routineLocalIdentifier),
subFunctionNotSupported-invalidFormat 12*,
conditionsNotCorrectOrRequestSequenceError 22*,
(routine was not yet started),
routineNotComplete, 23*,
ECUErasingFlash, FB*,
ECUProgrammingFlash, FC*,
erasingError, FD*,
programmingError ] FE*]
*10, 11,12,22: request is not executed
*FB, FC: routine ist still active
*FD,FE or pos. response: routine has been finished

8 End of Line Programming: Software Documentation Page 8-1 EDC7 Keyword Protocol 2000

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

8 End of Line Programming: Software Documentation Page 8-1 EDC7 Keyword Protocol 2000

Uploaded by

Copyright:

Available Formats

Software Documentation Page 8-1

Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

8 End of Line Programming

DS-NF/ESN2 15-JAN-2004 End Of Line Programming

EOL read EOL write

Figure End of line programming message flow

DS-NF/ESN2 15-JAN-2004 End Of Line Programming

8.1 escapeCode (80h) - loginRead

Byte Request block Hex Value Mnemonic

Byte Positive response block Hex Value Mnemonic

Byte Negative response block Hex Value Mnemonic

DS-NF/ESN2 15-JAN-2004 End Of Line Programming

DS-NF/ESN2 15-JAN-2004 End Of Line Programming

8.2 requestUpload (35h)- endOfLine

Byte Request block Hex Value Mnemonic

Byte Posititve response block Hex Value Mnemonic

Byte Negative response block Hex Value Mnemonic

DS-NF/ESN2 15-JAN-2004 End Of Line Programming

8.3 transferData (36h)- endOfLineRead

Byte Request block Hex Value Mnemonic

Byte Positive response block Hex Value Mnemonic

Byte Negative response block Hex Value Mnemonic

DS-NF/ESN2 15-JAN-2004 End Of Line Programming

8.4 requestTransferExit (37h)- endOfLineRead

Byte Request block Hex Value Mnemonic

Byte Positive response block Hex Value Mnemonic

Byte Negative response block Hex Value Mnemonic

#3 responseCode = [ xx=[ RC_...

DS-NF/ESN2 15-JAN-2004 End Of Line Programming

8.5 escapeCode (80h) - loginWrite

Byte Request block Hex Value Mnemonic

Byte Positive response block Hex Value Mnemonic

DS-NF/ESN2 15-JAN-2004 End Of Line Programming

Byte Negative response block Hex Value Mnemonic

DS-NF/ESN2 15-JAN-2004 End Of Line Programming

8.6 requestDownload (34h)- endOfLine

Byte Request block Hex Value Mnemonic

Byte Positive response block Hex Value Mnemonic

Byte Negative response block Hex Value Mnemonic

DS-NF/ESN2 15-JAN-2004 End Of Line Programming

8.7 transferData (36h)- endOfLineWrite

Byte Request block Hex Value Mnemonic

Byte Positive response block Hex Value Mnemonic

Byte Negative response block Hex Value Mnemonic

DS-NF/ESN2 15-JAN-2004 End Of Line Programming

8.8 requestTransferExit (37h)- endOfLineWrite

Byte Request block Hex Value Mnemonic

Byte Positive response Hex Value Mnemonic

Byte Negative response block Hex Value Mnemonic

DS-NF/ESN2 15-JAN-2004 End Of Line Programming

8.9 startRoutineByLocalIdentifier (31h) - checksumAdjustment

Byte Request block Hex Value Mnemonic

Byte Positive response block Hex Value Mnemonic

Byte Negative response block Hex Value Mnemonic

DS-NF/ESN2 15-JAN-2004 End Of Line Programming

8.10 requestRoutineResultsByLocalIdentifier (33h) -

Byte Request block Hex Value Mnemonic

Byte Positive response block Hex Value Mnemonic

Byte Negative response block Hex Value Mnemonic

DS-NF/ESN2 15-JAN-2004 End Of Line Programming

You might also like