Software Documentation Page 12-1

Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

12 Remote Control
12.1 Service of Remote Control
Remote control - in conjunction with measuring functions - is designed for operation on engine test stands to
simulate engine and vehicle by replacement values, which are transmitted from tester to ECU. Remote
control enables to override sensor inputs, actuator outputs and internal software values. As long as these
external values are active, e.g. missing sensors or even unusual conditions of operation, like defect
sensors, cable disconnection, short circuit a.s.o. can be simulated. Note that it is the testers responsibility
not to cause any dangerous working conditions or damages.

!!!WARNING!!!
If you activate remote control, there is danger for the engine, vehicle and human life, if you do not respect
the limits of the system. With some labels you can overwrite the timing, quantity and fuel pressure without
limiting by software or hardware.

Remote Control is a feature to overwrite EDC-internal values with external tools (ETK, ISO-Line, CAN).
Here some examples for Remote Control:
• Direct control of fuel quantity and timing without application and limits

• Replacement of missing sensors with plausible values

• Evaluation of strategies for controllers with external tools (ASCET)

• Override of setpoints for application purpose

• Test of outputs and actuators (diagnostic tests)

• Switch between different algorithms in application phases

• Force of unusual operation conditions (switch off a cylinder, etc.) to test the system

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Remote Control

 Software Documentation Page 12-2
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

12.2 Remote Control via KWP2000

It is possible to switch the EDC-internal calculated input/output values and to replace it with own values via
INCA or KWP2000 external tools. INCA has the highest remote control priority and switch off all other
Remote Control interfaces.
To start Remote Control via KWP2000 you need a communication Tool, DIAS for example.
To create a communication between ECU and Tester, you have to keep some conditions. One of the
conditions is the protocol witch have to transmit from tester in a timespace of 10ms - 200ms.
An other condition is the length of the protocol. The remote control software calculate the length of the
protocol with the maskinformation.
The order of the Mask have to be fixed. The following values have the same order like the activated
maskbits.

12.2.1 KWP2000 Remote Control Protocol:

The protocol mainly consist in two parts, the information witch covert the activated replacement values it
call mask and the information witch covert the accompanying value.
If you activate an mask bit, you have to sent the accompanying value in the same order like the activated
mask bits. The following protocol describe the order of the masks, details about the following value you see
in the tables.
For more information please see KWP2000 documentation:

12.2.2 EscapeCode - MaintainRemoteControl

Via keyword protocol 2000, remote control is started by sending an escapeCode - maintainRemoteControl
request message to the ECU. This message contains several bit coded masks that indicate which of the
signals shall be overridden. The respecting replacement values, intended to override the selected signals,
are included at the end of this message. The composition of remote control relevant signals and the
definition of masks are system specific and shall therefore be done in agreement of the vehicle
manufacturer and the system supplier. Refer to section "Remote Control" in the main software
documentation.
The parameter refreshTimeOut in the request message specifies the duration of how long the replacement
values shall be active from the time of request on. If the tester does not send another escapeCode -
maintainRemoteControl request message within the time refreshTimeOut, the ECU detects remote control
time-out, aborts the remote control mode and continues operation with the normal values respectively e. g.
the real sensor signals. The resolution of this parameter is: last significant bit = 4ms.
The following parameters in the request message are bit coded and specify the remote control masks:
• sensorInputs representing analog sensor signals (e. g. coolant temperature, boost pressure)
• switchInputs representing digital inputs (e. g. torque limit, engine brake)
• digitalOutputs representing digital outputs (e. g. diagnostic lamp)
• pwmOutputs representing pulse width modulated outputs (e. g. boost pressure actuator)
• forceAlgorithm representing specific EDC functions to be switched off (e. g. switch off cylinder 3, switch
off CAN, switch off multiplex output)
• switchAlgorithm representing a set of masks (there are 8 sets of masks defineable)
• setPoints representing internal software values that contain target setpoints (setpoints are normally
results of calculations or maps, e. g. begin of main injection, fuel pressure setpoint, low idle setpoint)
The parameters replacementValue#x are used by the escapeCode - maintainRemoteControl positive
response message to provide the replacement values as specified in the masks. The request message
contains only those replacement values, which are selected by the respective bits set to '1' within the masks.
The order of transmitted replacement values corresponds to the order of mask bits. The following table
specifies sizes of masks and replacement values:

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Remote Control

 Software Documentation Page 12-3
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

Remote control mask overview

Mask Size of mask = Size of Data length
number of replacementValues (number of replacementValues
replacementValues size of replacementValue)
sensorInputs 32 bit 2 bytes 64 bytes (32 ∑2 byte)
switchInputs 32 bit 1 bit 4 bytes (32 ∑1 bit)
digitalOutputs 32 bit 1 bit 4 bytes (32 ∑1 bit)
pwmOutputs 8 bit 2 bytes 16 bytes (8 ∑2 byte)
forceAlgorithm 16 bit - -
switchAlgorithm 8 bit 1 bit 1 byte (8 ∑1 bit)
setPoints 32 bit 2 bytes 64 bytes (32 ∑2 byte)
151 bytes maximum

Request
Data Byte Parameter Name Cvt Hex Value Mnemonic
#1 escapeCode Request Service Id M 80 EC
#2 manufacturerSpecificServiceId = [maintainRemoteControl] M 28 MSSID
#3 refreshTimeOut M xx RV_...
#4 sensorInputs (Highest Byte) M xx RV_...
#5 sensorInputs (Byte 2) M xx RV_...
#6 sensorInputs (Byte 3) M xx RV_...
#7 sensorInputs (Lowest Byte) M xx RV_...
#8 switchInputs (Highest Byte) M xx RV_...
#9 switchInputs (Byte 2) M xx RV_...
#10 switchInputs (Byte 3) M xx RV_...
#11 switchInputs (Lowest Byte) M xx RV_...
#12 digitalOutputs (Highest Byte) M xx RV_...
#13 digitalOutputs (Byte 2) M xx RV_...
#14 digitalOutputs (Byte 3) M xx RV_...
#15 digitalOutputs (Lowest Byte) M xx RV_...
#16 pwmOutputs M xx RV_...
#17 forceAlgorithm (High Byte) M xx RV_...
#18 forceAlgorithm (Low Byte) M xx RV_...
#19 switchAlgorithm M xx RV_...
#20 setPoints#1 (Highest Byte) M Xx RV_...
#21 setPoints#2 (Byte 2) M xx RV_...
#22 setPoints#3 (Byte 3) M xx RV_...
#23 setPoints#4 (Lowest Byte) M xx RV_...
#24 replacementValue#1 C xx RV_...
: : : : :
#n replacementValue#m (m ≤ 117) C xx RV_...
C: Included, if any mask bit set.

Positive Response
Data Byte Parameter Name Cvt Hex Value Mnemonic
#1 escapeCode Positive Response Service Id S C0 ECPR
#2 manufacturerSpecificServiceId = [maintainRemoteControl] M 28 MSSID

Negative Response
Data Byte Parameter Name Cvt Hex Value Mnemonic
#1 negativeResponse Service Id S 7F NR
#2 escapeCode Request Service Id M 80 EC
#3 manufacturerSpecificServiceId = [maintainRemoteControl] M 28 MSSID
#4 responseCode = [ M xx=[ RC_...
subFunctionNotSupported-invalidFormat 12,
(number of replacement values do not correspond to mask bits
set to '1'),
conditionsNotCorrectOrRequestSequenceError 22,
(remote control must not be started due to failure conditions)
requestOutOfRange (refreshTimeOut = 0) ] 31]

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Remote Control

 Software Documentation Page 12-4
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

12.2.3 EscapeCode - StopRemoteControl

To stop remote control before the refresh time is expired, the tester may send an escapeCode -
stopRemoteControl request message to the ECU.

Request
Data Byte Parameter Name Cvt Hex Value Mnemonic
#1 escapeCode Request Service Id M 80 EC
#2 manufacturerSpecificServiceId = [stopRemoteControl] M 29 MSSID

Positive Response
Data Byte Parameter Name Cvt Hex Value Mnemonic
#1 escapeCode Positive Response Service Id S C0 ECPR
#2 manufacturerSpecificServiceId = [stopRemoteControl] M 29 MSSID

Negative Response
Data Byte Parameter Name Cvt Hex Value Mnemonic
#1 negativeResponse Service Id S 7F NR
#2 escapeCode Request Service Id M 80 EC
#3 manufacturerSpecificServiceId = [stopRemoteControl] M 29 MSSID
#4 responseCode = [ M xx=[ RC_...
conditionsNotCorrectOrRequestSequenceError 22
(remote control is currently not active) ] ]

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Remote Control

 Software Documentation Page 12-5
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

INPUT VARIABLES:
rmtc_s_appl_on_b Remote control via INCA active flag
byps_s_act_b Status for bypass (0=inactive, 1=active)

INTERNAL VARIABLES:
k2rc_s_activ_b Remote Control on/off switch

DATA:
K2RC_DT_DEF_MAX_CUW KWP200 Remote Control upper timeout thresholt
K2RC_DT_DEF_MIN_CUW KWP200 Remote Control lower timeout thresholt

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Remote Control

 Software Documentation Page 12-6
Y281 S365_KWP_V14 EDC7 Keyword Protocol 2000 Version 1.4

This page intentionally left blank

© Robert Bosch GmbH (Germany) reserves all rights even in the event of industrial rights. We reserve all rights of disposal such as copying and passing to third parties.

DS-NF/ESN2 15-JAN-2004 Remote Control