PIRO04/SAM04

ISO14230 KW2000 PROTOCOL SUPPORTED SERVICES

TBD

Rev. R00 R01

Date 17/03/2006 13/04/2006 Initial revision

Description

Author G. Pirovano G. Pirovano

Inserted the Request freeze frame data service

REG PIRO04/SAM04 ISO14230 KW2000 PROTOCOL SUPPORTED SERVICES Written by: Giancarlo Pirovano April 2006, SIT la precisa s.p.a.

TBD

INDEX
CHAPTER 1: INTRODUCTION 1

CHAPTER 2: NORMATIVE REFERENCES

CHAPTER 3: DEFINITIONS

CHAPTER 4: KW2000 GENERAL INFORMATION 4.1 HEADER 4.1.1 FORMAT BYTE 4.1.2 TARGET ADDRESS BYTE 4.1.3 SOURCE ADDRESS BYTE 4.1.4 DATA LENGTH BYTE 4.2 DATA BYTES 4.3 CHECKSUM BYTES 4.4 TIMINGS CHAPTER 5: INITIALIZATION 5.1 CARB INITIALIZATION 5.2 5 BAUD INITIALIZATION (OR SLOW INIT) 5.3 FAST INIT INITIALIZATION 5.4 KEY BYTES 5.5 MULTIUSER BUS ISSUE CHAPTER 6: SERVICES SUPPRTED BY GAS ECU 6.1 START COMMUNICATION SERVICE 6.2 STOP COMMUNICATION SERVICE 6.3 REQUEST CURRENT POWERTRAIN DIAGNOSTIC DATA 6.4 REQUEST POWERTRAIN FREEZE FRAME DATA 6.5 REQUEST EMISSION RELATED DIAGNOSTIC TROBLE CODES 6.6 CLEAR EMISSION RELATED DTC 6.7 TESTER PRESENT 6.8 START DIAGNOSTIC SESSION 6.9 STOP DIAGNOSTIC SESSION i

2 3 3 4 4 4 4 4 5 5 6 6 7 7 8 10 11 13 14 16 18 19 19 19 20

TBD

6.10 SECURITY ACCESS 6.11 ECU RESET 6.12 READ ECU IDENTIFICATION 6.12.1 HARDWARE IDENTIFICATION 6.12.2 FIRMWARE IDENTIFICATION 6.12.3 CONFIGURATION IDENTIFICATION 6.13 REQUEST VEHICLE INFORMATION 6.13.1 REPORT SUPPORTED INFO TYPES REQUEST 6.13.2 MESSAGES TO REPORT THE VEHICLE IDENTIFICATION NUMBER REQUEST 6.13.3 VEHICLE IDENTIFICATION NUMBER 6.14 WRITE DATA BY LOCAL IDENTIFIER 6.14.1 VEHICLE IDENTIFICATION NUMBER 6.15 READ DATA BY LOCAL IDENTIFIER 6.15.1 VEHICLE IDENTIFICATION NUMBER 6.15.2 ECU MEASUREMENTS 6.16 READ DIAGNOSTIC TROBLE CODES 6.17 CLEAR DIAGNOSTIC INFORMATION 6.18 READ STATUS OF DIAGNOSTIC TROUBLE CODES 6.19 I/O CONTROL BY LOCAL IDENTIFIER 6.19.1 GAS VALVE CONTROL 6.19.2 GAS INJECTORS CONTROL 6.19.3 PETROL INJECTORS CONTROL 6.19.4 PETROL CONNECTION CONTROL 6.19.5 LAMBDA EMULATION CONTROL 6.19.6 TEST SWITCH LEDS 6.19.7 READ SWITCH BUTTON 6.19.8 SET LAMBDA EMULATION VOLTAGE 6.19.9 READ ANALOG VOLTAGE 6.19.10 READ STATUS OF RPM SIGNAL 6.19.11 READ PERIOD OF RPM SIGNAL 6.19.12 SET STATUS OF DIAGNOSTIC LIGHT

21 23 23 24 24 25 25 25 26 26 27 28 28 30 30 30 31 32 34 36 36 37 38 38 39 40 41 42 43 44 45

ii

TBD

TABLES
Tab. 1: KW200 message structure .......................................................................................................2 Tab. 2: Format byte structure...............................................................................................................3 Tab. 3: mode bits..................................................................................................................................3 Tab. 4: format byte structure required by ISO14230-4........................................................................4 Tab. 5: supported services..................................................................................................................11 Tab. 6: PIDs supported for service 0x01............................................................................................16 Tab. 7: Freeze frame data supported PIDs.........................................................................................18 Tab. 8: diagnostic modes ...................................................................................................................20 Tab. 9: access mode parameter values ...............................................................................................21 Tab. 10: identification options ...........................................................................................................24 Tab. 11: vehicle identification number transmission sequence .........................................................27 Tab. 12: write data by local identifier - record local identifiers ........................................................27 Tab. 13: read data by local identifier - record local identifiers..........................................................29 Tab. 14: DTC's status description ......................................................................................................34 Tab. 15: input output local identifiers................................................................................................35 Tab. 16: gas injectors status codification ...........................................................................................37 Tab. 17: output configurations for the test of the leds of the switch..................................................40 Tab. 18: analog channels codes..........................................................................................................43

PICTURES
Fig. 1: tester request and ECU responses.............................................................................................5 Fig. 2: normal timing set with default values ......................................................................................5 Fig. 3: 5 baud init general form............................................................................................................6 Fig. 4: fast init general form.................................................................................................................7 Fig. 5: key bytes ...................................................................................................................................8 Fig. 6: address ranges.........................................................................................................................13 Fig. 7: read status of DTC - multiple frame positive response ..........................................................33

iii

TBD

Safety symbols
Warning Caution Attention Calls attention to a procedure, practice, or condition, that could possibly cause bodily injury or death. Calls attention to a procedure,practice, or condition that could possibly cause damage to equipment or permanent loss of data. Calls attention to a procedure, practice or condition that requires special attetion from the operator to be fulfilled correctly.

iv

TBD

Chapter 1: Introduction
ISO 14230 has been established in order to define common requirements for diagnostic systems implemented on a serial data link. To achieve this, it is based on the Open Systems Interconnection (OSI) Basic Reference Model in accordance with ISO 7498 which structures communication systems into seven layers. When mapped on this model, the services used by a diagnostic tester and an Electronic Control Unit (ECU) are broken into diagnostic services (layer 7), communication services (layers 1 to 6). This documents deals with the diagnostic services supported by the PIRO04 and SAM04 gas fuel injection control units (form now on GAS ECU). The implementation of the physical and data communication layers is in accordance with the ISO14230 standard part 1 and 2. The vehicle environment to which this part of ISO 14230 applies may consist of a single tester that may be temporarily connected to the on-vehicle diagnostic data link and several on-vehicle Electronic Control Units connected directly or indirectly.

Chapter 2: Normative references

The following standards contain provisions which, through reference in this text, constitute provisions of this document. All standards are subject to revision, and parties to agreement based on this document are encouraged to investigate the possibility of applying the most recent editions of the standards listed below. Members of ISO maintain registers of currently valid International Standards.
ISO 14229: ISO 14230-1: ISO 14230-2: ISO 14230-3: ISO 14230-4: SAE J 1930: SAE J 1979: SAE J 2012: Road vehicles Diagnostic systems Diagnostic services specification. Road vehicles Diagnostic systems Keyword Protocol 2000 Part 1 : Physical layer. Road vehicles Diagnostic systems Keyword Protocol 2000 Part 2 : Data link layer. Road vehicles Diagnostic systems Keyword Protocol 2000 Part 3 : Application layer. Road vehicles Diagnostic systems Keyword Protocol 2000 Part 4 : Requirements for emission related systems. 1995, Electrical/electronic systems diagnostic Terms, definitions, abbreviations and acronyms. 1997, E/E diagnostic test modes Terms, definitions, abbreviations and acronyms. 2002, Diagnostic trouble codes definition

TBD

Chapter 3: Definitions
For the purposes of this document, the definitions given in ISO 14229 and SAE J 1930 apply. CARB Client DTC EPA GAS ECU LSB MSB OBD Server SID TBD TBV VIN California Air Resource Board The tester connected to the ECUs to request diagnostic parameters. Dignostic Trouble Codes Environment Protection Agency The controller of the gas injection. May refer to PIRO04 or SAM04. Least significant byte Most significant byte On Board Dignostic One of the ECUs connected to the tester that respond to the testers requests. Service IDentifier To Be Defined To Be Verified Vehicle Identiofication Number

Chapter 4: KW2000 general information

The KW2000 message has the following structure:
FORMAT BYTE TARGET ADDR SOURCE ADDR DATA BYTES SERVICE ID PAR 1 PAR 2 PAR 254 CHECKSUM Tab. 1: KW200 message structure

Format byte, target address byte, source address byte and data bytes compose the header section. Service identifier and its parameters compose the data section The checksum is the LSB of the sum of the bytes composing the header and the data section. The maximum length of the message is 260 bytes (255 data + 4 header + 1 checksum).

TBD

Target address, source address and data length are not mandatory and their use or not is specified by the format byte. The standard doesnt define the communication caractheristics of the byte but it was discovered that the bytes are sent as: 8 bit no parity 1 stop bit

4.1 Header
The header is composed by: format byte, target address byte, source address byte, data length. 4.1.1 Format byte The format byte has the following structure:
A1 A0 L5 L4 L3 L2 L1 L0

Tab. 2: Format byte structure

A1, A0 defines the use of the address bytes, according to the following table:
A1 0 0 1 1 A0 0 1 0 1 Mode No address information CARB mode (exception mode) Physical addressing mode Functional addressing mode Tab. 3: mode bits

If the mode bits are 00, the target and source address will not be present. A.1,A.0=01 (CARB mode) is an exception mode. The CARB mode is not specified in ISO 14230. CARB uses format bytes $68 (0110 1000) and $48 (0100 1000). For more details refer to ISO 9141-2 and SAE J1979. Physical addressing is used when the tester sends its request to one ECU at a time. Functional addressing is used when the tester sends its request to more than one ECU at the same time. L5..L0 defines the length of the data section if the data length byte is not used. The following cases can be encountered: 1) 2) L5..L0 = 0: L5..L0 >0: the data length byte is present the data length byte is not present

TBD

ISO14230-4 requires functional addressing for the tester requests; the functional target address must be 0x33. Physical addressing is used by the ECU for the response. The data length must be specified in the format byte. In this case the format byte has the following structure:
1 1 0 1 X X X X X X X X X X X X ECU response Tester request

Tab. 4: format byte structure required by ISO14230-4

4.1.2 Target address byte This is the address of the destination of the message. It can be physical or functional. Physical addrressing is used by the tester to address one single ECU. Functional addressing is used by the tester to send the same request to more than one ECU. The ECU will always respond to the tester requests using physical addressing. ISO14230-4 requires that the tester uses the functional address 0x33 in its requests. 4.1.3 Source address byte This is the physical address of the device that sends the message. ISO14230-4 requires that the tester uses the physical address 0xF1 as source address. This address will be used by the ECUs as target address in their responses. 4.1.4 Data length byte This byte is present only if the bits L5..L0 of the format byte are 0. ISO14230-4 requires that the length of the data bytes is indicated in the format byte. Moreover it requires a maximum of seven data bytes to be present in the message.

4.2 Data bytes

The data section is composed by the service identifier and its parameters. Its length could be upto 63 bytes if the data length byte is not present in the message or upto 255 bytes if the data length byte is present in the message. ISO14230 requires, anyway, a maximum of seven data bytes, one service identifier and upto six parameters.

4.3 Checksum bytes

The checksum byte has the function to let the destination of the message to check for errors in the transmission. It is the 8-bit sum of the bytes of the header and data sections.

TBD

4.4 Timings
The KW2000 protocol is timeout based. This means the the end of a message is detected when the bus remains in idle for a certain time. The protocol requires a interbyte time for the teser request and the ECU requests, a time between the tester request and the ECU response and a time from the end of the response of the ECU and a new request of the tester. If no request is detected on the bus, the communication is over, so the tester must continually send a presence signal or requests on the bus.

Fig. 1: tester request and ECU responses

The following table describes the minimum and maximum default values for the Px timings.
Timing P1 P2 P3 P4 Min (ms) 0 25 55 5 Max (ms) 20 50 5000 20 Description Interbyte time for ECU response Time between the end of a tester request or a ECU response and another ECU response Time between the end of the ECU responses and a new request from the tester Interbyte time for tester request

Fig. 2: normal timing set with default values

The KW2000 protocol has a service to modify the minimum and maximum timings, but in ISO 14230-4 it is required for the tester and the ECUs to use only the normal timing set with default values.

Chapter 5: Initialization
The KW2000 protocol requires that the comunication is initialized before the tester can send requests to the servers. 1) CARB initialization 2) 5 baud address initialization 3) fast initialization There are general facts that are common to all modes of initialization:

TBD

prior to any activity there shall be a bus-idle time; then the tester sends an initialization pattern; all information which is necessary to establish communication is contained in the response of the ECU.

ISO14230-4 requires that the tester must support both 5-baud and fast init initialization, instead the ECU shall support only one of the two initialization methods. The GAS ECU will suppoprt only the fast init initialization.

5.1 CARB initialization

For CARB purposes 5 Baud initialization is used only. It is a functional initialization.Messages are send to all emission related ECUs (see ISO 9141-2 and ISO 14230-4).

5.2 5 baud initialization (or slow init)

The general form of the 5-baud initialization is shown in the following pictures:

Fig. 3: 5 baud init general form

1) the bus must stay idle for at least 300ms 2) the tester sends the target address (0x33 as required by ISO14230-4) at 5 baud (200ms/bit) 6

TBD

3) the ECU sends the synchronization pattern 0x55, which is used by the tester to detect the actual baud rate used by the ECU. 4) the ECU sends the key bytes KB1 and KB2 5) the tester sends back KB2 inverted 6) the ECU sends back the address sent by the tester inverted ISO 14230-4 requires that the 5-baud address is 0x33 and the actual communication rate is 10400 baud.

5.3 Fast init initialization

The general form of the fast init initialization is described in the following picture:

Fig. 4: fast init general form

1) 2) 3) 4)

the bus must be idle the tester holds the bus in its dominant state (0) for 25ms the tester releases the bus and after 25 ms sends the startcommunication request the board responds with the startcommunication response (hopefully positive); in the response the key bytes KB1 and KB2 are sent to the tester

5.4 Key bytes

With these bytes an ECU informs the tester about the supported header, timing and length information. So an ECU does not necessarily have to support all possibilities. 7

TBD

The decoding of the key bytes is defined in ISO 9141. KB2 is fixed at 0x8F. KB1 reports the supported modes. ISO14230 requires that the keybytes are 8FE9, wich means: 1) 3 byte header 2) no additional length byte 3) normal timing

Fig. 5: key bytes

AL0 AL1 HB0 HB1 TP0 TP1

support of data length in format byte (0=NO, 1=YES) support of additional data length byte (0=NO, 1=YES) support of 1 byte header (0=NO, 1=YES) support of target/source addresses in header (0=NO, 1=YES) use of extended timing parameters (0=NO, 1=YES) use of normal timing parametrs (0=NO, 1=YES)

Obviously TP0 and TP1 are mutually exclusive so only TPO=0 TP1=1 or TP0=1 TP1=0 can be used.

5.5 Multiuser bus issue

This is extracted from the standard:
The physical layer may be used as a multiuser-bus, so a kind of arbitration or bus management is necessary. There are several proposals which are not part of this part of ISO 14230. The car manufacturers are responsible for the correct working of bus management. (ISO14230-2 clause 1).

The KW2000 protocol allows the ECU to be connected on the bus and the tester can address more than one ECU at a time using functional addressing. ISO14230 requires that the tester uses functional addressing. The GAS ECU will be installed in a unknown environment and will have to respond to many tester requests toghether with (at least) the petrol ECU.

TBD

Some form of general purpose bus management must be designed not to disturb the communication of the tester with the petrol ECU1.

11

The tester must be designed to manage multiple ECU responses: what happens when the tester receives two resposes to a functional request asking for data (f.i. engine coolant temperature)? Which one is showed? The first?, The last?, Both? The matter has to be investigated!

TBD

Chapter 6: Services supprted by GAS ECU

The supported services are described in the following table:
Service name Start communication Stop communication Access timing parameters Request powertrain diagnostic data Request powertrain freeze frame data Request emission related diagnostic troble codes Clear/Reset emission related diagnostic information Request oxygen sensor monitoring test result Request on-board monitoring test results for specific monitored systems Request emission related diagnostic troble codes detected during current or last completed driving cycle Request control of on-board system, test or component Request vehicle information Start diagnostic session ECU reset Read freeze frame data Read diagnostic troble codes Clear diagnostic information Read status of diagnostic troble codes Read diagnostic troble codes by status Read ECU identification Stop diagnostic session Read data by local identifier Read data by common identifier Read memory by address Set data rates Security access SID 0x81 0x82 0x83 0x01 0x02 0x03 0x04 0x05 0x06 0x07 Pending DTCs are not supported by the ECU SAE J1979 consider only the test of the evaporative system (PID=0x01). All of the other PIDs are reserved by the document Only VIN is supported Only PowerOn is supported Tester shall not support this service See details for supported PIDs Sup Note GAS ECU address 0x12

0x08 0x09 0x10 0x11 0x12 0x13 0x14 0x17 0x18 0x1A 0x20 0x21 0x22 0x23 0x26 0x27

10

TBD

Service name Dynamically define local identifier Write data by common identifier Input output control by common identifier Input output control by local identifier Start routine by local identifier Start routine by common identifier Request routine result by local identifier Request download Request upload Transfer data Request transfer exit Start routine by address Stop routine by address Request routine result by address Write data by local identifier Write memory by address Tester present Esc code

SID 0x2C 0x2E 0x2F 0x30 0x31 0x32 0x33 0x34 0x35 0x36 0x37 0x38 0x39 0x3A 0x3B 0x3D 0x3E 0x80

Sup

Note

Tab. 5: supported services

6.1 Start communication service

The GAS ECU recognizes the KW2000 fast-init initialization method. This requires that the tester sends the Start communication command by mean of this service. The GAS ECU address will be 0x12. Fig. 6 shows the address ranges defined by the protocol: we consider the GAS ECU to be a engine controller. The tester shall use the address 0xF1. No negative response from the GAS ECU is foreseen.

11

TBD

Request Data Byte #1 #2 #3 #4 #5 Format byte Target address byte Source address Start communication SID Checksum Description Byte Value (Hex) 81
1 2

Mnemonic FMT TGT SRC SCR CS

C1 33

123
4

F15 81 XX

Positive response Data Byte #1 #2 #3 #4 #5 #6 #7 Format byte Target address byte Source address byte Start communication SID Key byte #1 Key byte #2 Checksum Description Byte Value (Hex) 83 F1 12 81 E9
6

Mnemonic FMT TGT SRC SCRPR KB1 KB2 CS

8F XX

Though ISO14230 requires that the data length must be limited to 7 bytes, the gas ECU is able to manage upto 63 data bytes. The limitation refers only to the diagnostic services 0x00-0x0F defined in J1979 and referred by ISO14230-3. The StartCommunication service is used in the fast init initialization: before the request the wakeup pattern defined in ISO14230-2 must be sent to the gas ECU. The following figure shows the ranges of the possible physical addressing, as suggested by the KW2000 standard.

1 2

Physical addressing is used Functional addressing is used 3 Physical addressing is used. 4 Functional addressing is used. 5 Required by ISO14230-4, but other address numbers could be used. 6 KB1 and KB2 are required to be E9 and 8F (2025) by ISO14230-4

12

TBD

Fig. 6: address ranges

6.2 Stop communication service

Usally the communication between the client and the server is broken due to a communication timeout. If no tester request is received within P3max, the GAS ECU stops the communication. The client may also use the stop communication service to stop the communication with the server. No negative response is foreseen from the GAS ECU.

13

TBD

Request Data Byte #1 #2 #3 #4 #5 Format byte Target address byte Source address Stop communication SID Checksum Description Byte Value (Hex) 81
1 2

Mnemonic FMT TGT SRC SPR CS

C1 33

123
4

F15 82 XX

Positive response Data Byte #1 #2 #3 #4 #6 Format byte Target address byte Source address byte Stop communication SID positive response Checksum Description Byte Value (Hex) 81 F1 12 82 XX Mnemonic FMT TGT SRC SPRPR CS

From now on, format byte, source and target addresses and checksum will not be reported in the message examples/descriptions.

6.3 Request current powertrain diagnostic data

Request Data Byte #1 #2 PID Description Request current powertrain diagnostic data req. SID Byte Value (Hex) 01 XX Mnemonic SIDRQ PID

1 2

Physical addressing is used Functional addressing is used 3 Physical addressing is used. 4 Functional addressing is used. 5 Required by ISO14230-4, but other address numbers could be used.

14

TBD

Positive response (request supported PIDs) Data Byte #1 #2 #3 #4 #5 #6 Supported PID Data A Data B Data C Data D Description Request current powertrain diagnostic data resp. SID Byte Value (Hex) 41 XX XX XX XX XX Mnemonic SIDPR PID DATA_A DATA_B DATA_C DATA_D

The values for data A to D depends on the PID requested, please refer to appendix A and appendix B of J1979 for definition of PIDs and response values. The PID supported by GAS ECU are the following:
Parameter name Support for group 1 PIDs Monitor status and DTC number DTC that caused freeze frame data storage Engine coolant temperature PID 0x00 0x01 0x02 0x05 Only if an absolute pressure sensor (AEB 025 type) is installed. The standard requires that only one of Pid 0x0A, 0x22, 0x23 is supported Only if map signal is connected or an absolute pressure sensor (AEB 025 type) is installed The standard requires that only one of Pid 0x13, 0x1D is supported Pid 0x13 is used for sensor location. Short term fuel trim is always 0% Only if the GAS ECU is configured for 2 lambda probes (2 banks) Oxygen sensor Bank 2 Sensor A 0x18 Pid 0x13 is used for sensor location. Short term fuel trim is always 0% OBD requirement to which the ECU is designed Support for group 2 PIDs 0x1C 0x20 Mandatory Note

Fuel rail pressure (lower range)

0x0A

Intake manifold absolute pressure Engine RPM Location of oxigen sensor Oxygen sensor Bank 1 Sensor A

0x0B 0x0C 0x13 0x14

15

TBD

Parameter name Fuel rail pressure relative to manifold vacuum Fuel level input

PID

Note Only if a diffrential pressure sensor (AEB 013 type) is installed. The standard requires that only one of Pid 0x0A, 0x22, 0x23 is supported

0x22

0x2F Tab. 6: PIDs supported for service 0x01

Negative responses with rejection code subfunction not supported can be received from the GAS ECU if a non-supported PID is requested or the GAS ECU configuration doesnt allow the PID to be suported (f.i. requesting the bank 2 sensor A oxygen sensor voltage if the GAS ECU is configured for a single oxygen sensor).

6.4 Request powertrain freeze frame data

Every time a new error code is store, a picture of the system is taken and stored. This service let the user acquire the data stored in the ECU memory. Only one data frame can be stored by the ECU, so the parameter Frame # shall be set to 0.
Request Data Byte #1 #2 #3 PID Frame # Positive response (request supported PIDs) Data Byte #1 #2 #3 #4 #5 #6 #7 Description Request current powertrain freeze frame data req. SID positive response PID Frame # Supported PIDs: Data A (Mandatory) Supported PIDs: Data B (Mandatory) Supported PIDs: Data C (Mandatory) Supported PIDs: Data D(Mandatory) Byte Value (Hex) 42 XX XX XX XX XX XX Mnemonic SIDRQPR PID FRNO DATA_A DATA_B DATA_C DATA_D Description Request current powertrain diagnostic data req. SID Byte Value (Hex) 02 XX XX Mnemonic SIDRQ PID FRNO

16

TBD

Positive response (report freeze frame PID value) Data Byte #1 #2 #3 #4 #5 #6 #7 Description Request current powertrain freeze frame data req. SID positive response PID Frame # Supported PID: Data A (Mandatory) Supported PID: Data B (Conditional) Supported PID: Data C (Conditional) Supported PID: Data D (Conditional) Byte Value (Hex) 42 XX XX XX XX XX XX Mnemonic SIDRQPR PID FRNO DATA_A DATA_B DATA_C DATA_D

Negative response Data Byte #1 #2 #3 Description Negative response SID Request current powertrain freeze frame data req. SID Response code Byte Value (Hex) 7F 02 XX Mnemonic NACK SID RC

The parameter Frame # shall be set to 0. If a frame different from 0 is requested, a negative response message will be received by the client. The values for data A to D depends on the PID requested, please refer to appendix A and appendix B of J1979 for definition of PIDs and response values. In simple words PIDs 0x00, 0x20, 0x40 upto 0xE0 request information on supported PIDs; request supported PIDs positive response will be sent to the client by the server. PIDs in the range 0x01..0x1F (0x21..0x2F) (0x31..0x3F) (0xE1..0xFF) are used to request specific data to the server and shall be used by the client only if declared as supprted by the server. Support for PID 0x00 is mandatory; support for the other PIDs is optional. The PIDs supported by the OMVL gas ECU are the following:
Parameter name Support for group 1 PIDs DTC that caused freeze frame data storage Engine coolant temperature PID 0x00 0x02 0x05 Only if an absolute pressure sensor (AEB 025 type) is installed. The standard requires that only one of Pid 0x0A, 0x22, 0x23 is supported Only if map signal is connected or an absolute pressure sensor (AEB 025 type) is installed Mandatory Note

Fuel rail pressure (lower range)

0x0A

Intake manifold absolute pressure

0x0B

17

TBD

Parameter name Engine RPM Oxygen sensor Bank 1 Sensor A Oxygen sensor Bank 2 Sensor A Support for group 2 PIDs Fuel rail pressure relative to manifold vacuum Fuel level input

PID 0x0C 0x14 0x18 0x20

Note

Only if the GAS ECU is configured for 2 lambda probes (2 banks) Only if a diffrential pressure sensor (AEB 013 type) is installed. The standard requires that only one of Pid 0x0A, 0x22, 0x23 is supported

0x22

0x2F Tab. 7: Freeze frame data supported PIDs

6.5 Request emission related diagnostic troble codes

This service is used to get stored errors from the server. As upto 3 DTC can be transmitted in a single message, if more than 3 DTC are stored inside the server, more than one response message will be sent to the client. Please refer to SAE J1797 for detailed information about this service. The DTC detected and managed by the ECU are reported in PIRO/SAM04 Diagnostic Codes.
Request Data Byte #1 Description Request emission related DTC request SID Byte Value (Hex) 03 Mnemonic SIDRQ

Positive response Data Byte #1 #2 #3 #4 #5 #6 #7 DTC #1 (MSB) DTC #1 (LSB) DTC #2 (MSB) DTC #2 (LSB) DTC #3 (MSB) DTC #3 (LSB) Description Request emission related DTC positive response Byte Value (Hex) 43 XX XX XX XX XX XX Mnemonic SIDPR DTC1HI DTC1LO DTC2HI DTC2LO DTC3HI DTC3LO

Before sending this message, current powertrain diagnostic data should be requested (SID = 0x01) with PID Number of emission related DTC and MIL status (PID = 0x01). The code 0x0000 defines a void DTC and is sent by the server to fill the fields of the response message. 18

TBD

6.6 Clear emission related DTC

Use this service to delete all of the DTCs and Freeze frame data stored in the ECU memory. Only a positive response is foreseen.
Request Data Byte #1 Description Clear emission related diagnostic information SID Positive Response Data Byte #1 Description Clear emission related diagnostic information positive response Byte Value (Hex) 44 Mnemonic SIDPR Byte Value (Hex) 04 Mnemonic SIDRQ

6.7 Tester present

This service is used to keep the communication with the ECU alive. As required by ISO14230-4, no optional parameter shall be used by the teser and the ECU will always generate a positive response message. Please refer to ISO14230-3 and ISO14230-4 for details about this service.
Request Data Byte #1 Description Tester present request SID Positive response Data Byte #1 Description Tester present request positive response SID Byte Value (Hex) 7E Mnemonic TPPR Byte Value (Hex) 3E Mnemonic TP

6.8 Start diagnostic session

Use this service to enable different diagnostic modes in the server. After the communication between the client and the server has been established, a default diagnostic session is automatically enabled in the server. At the moment two different diagnostic session are managed by the server: Default diagnostic mode: the ECU continues its normal operation while it continues the communication with the tester

19

TBD

I/O control diagnostic mode: the ECU enters a special state, to let the tester control the I/Os of the ECU. The ECU enters the petrol mode and only the communication with the tester or the PC is kept alive. See paragraph 6.19 I/O control by local identifier for more information on the diagnostic mode.

The server will always answer with a positive response message.

Request Data Byte #1 #2 Diagnostic mode Positive response Data Byte #1 #2 Diagnostic mode Description Sart diagnostic session positive response SID Byte Value (Hex) 7E XX Mnemonic SDSPR DIAGMODE Description Sart diagnostic session SID Byte Value (Hex) 10 XX Mnemonic SDS DIAGMODE

Diagnostic Modes 00-7F 80 81-A4 A5 A6-FF

Description Reserved by ISO14230-3 Default diagnostic mode Reserved for future expansions I/O control diagnostic mode Reserved for future expansions Tab. 8: diagnostic modes

Notes Normal ECU operation

6.9 Stop diagnostic session

Use this service to stop the current diagnostic mode of the server and return to the default diagnostic mode. If the diagnostic mode of the ECU is the default diagnostic mode, the command has no effect. If the diagnostic mode of the ECU is I/O control mode, the ECU exit this diagnostic mode and returns to the default diagnostic mode.
Request Data Byte #1 Description Stop diagnostic session SID Byte Value (Hex) 20 Mnemonic SPDS

20

TBD

Positive response Data Byte #1 Description Stop diagnostic session positive response SID Byte Value (Hex) 60 Mnemonic SPDSPR

6.10 Security access

This service is used to unlock the server and allow access to specific diagnostic services to the client. The service is completed in two steps: 1. the client send the security access request and the servers respond with a seed number 2. the client compute the key number based on the seed number and sends it to the server The parameter AccessMode can assume values based on the following table
Access Mode 0x00 0x01 0x02 2n-1 n = 0x02..0x40 2n n = 0x02..0x40 0x81..0xFF Description Invalid Default seed request Default key transmission Seed request for different security levels Key transmission for different security levels Manufacturer specific

Tab. 9: access mode parameter values

The ECU supports only the default seed request and default key transmission. The seed is a 16 bit number the key is the 1-complement of the seed. For instance seed = 0xC75A, key = 0x38A5. If two unsuccessful access attempts are performed , no more access attempts are allowed for 10 seconds. The same timeout is set at the power-up or reset. The following table summarizes the negative responses of this service

21

TBD

Negative response code

Description

REQUIRED TIME DELAY NOT EXPIRED The 10 seconds timeout at power-up or after two access attempts has not expired. Retry later REQUEST OUT OF RANGE CONDITION NOT CORRECT The AccessMode parameter is out of allowed range. The value for the AccessMode parameter in a SendKey security access is not the one used in the RequestSeed increased by 1. Two access attempts were unsuccessfull. Restart the security access procedure.

EXCEED NUMBER OF ATTEMPTS

After a successfull security access the server enter the UNLOCKED status.
Request #1 Data Byte #1 #2 Security access SID Access mode : request seed Positive response #1 Data Byte #1 #2 #3 #4 #5 Description Security access positive response SID Access mode : request seed Seed LSB Seed MSB Security access status Negative response #1 Data Byte #1 #2 #3 Security access SID Response code Description Negative response #1 SID Byte Value (Hex) 7F 27 XX Mnemonic NACK SA RC Byte Value (Hex) 67 01 XX XX 34 SACCSTAT Mnemonic SA ACCMODE SEED Description Byte Value (Hex) 27 01 Mnemonic SA ACCMODE

22

TBD

Request #2 Data Byte #1 #2 #3 #4 Security access SID Access mode : send key Key LSB Key MSB Positive response #2 Data Byte #1 #2 #3 Description Security access positive response SID Access mode : send key Security access status Negative response #2 Data Byte #1 #2 #3 Security access SID Response code Description Negative response #2 SID Byte Value (Hex) 7F 27 XX Mnemonic NACK SA RC Byte Value (Hex) 67 02 34 Mnemonic SA ACCMODE SACCSTAT Description Byte Value (Hex) 27 02 XX XX Mnemonic SA ACCMODE KEY

6.11 ECU reset

Use this service to reset the ECU. The client must be prepared to re-establish the communication with the server. The ECU will perform a real hardware reset. Only the PowerOn value is allowed for the ResetMode parameter. The PowerOnWhileMaintainingCommunication value is not allowed and a negative response will be received by the client. If ResetMode = PowerOn the hardware and software watch dogs are stopped and the ECU halts wating for the reset signal. After the rest signal has arrived the ECU starts its operations like after a power-up. The client will receive no response and shall prepare itself to re-establish the communication with the server.

6.12 Read ECU identification

The Read ECU identification request message requests identification data from the server. The type of identification data requested by the client shall be identified by the IdentificationOption parameter. The server sends an identification data record included in the Read ECU identification positive response message. Identification options in the range 0x000xFF are reserved by ISO14230-3. 23

TBD

The identification options supported by the ECU are listed in the following Tab. 10.
Identification option HW IDENTIFICATION FW IDENTIFICATION CFG IDENTIFICATION Value 0x81 0x82 0x83 Identification record Hardware identification string Firmware identification string Configuration file identification

Tab. 10: identification options Request Data Byte #1 #2 Identification option Description Read ECU identification request SID Byte Value (Hex) 1A XX Mnemonic RECUID IDOPT

Positive Response Data Byte #1 #2 : #n Description Read ECU identification positive response SID Identification record byte #1 : Identification record byte #n-1 Byte Value (Hex) 5A XX : XX Mnemonic RECUIDPR IDRECVAL

If the parameter IdentificationOption has a value not supported by the server a negative response message is sent to the client with response code REQUEST OUT OF RANGE.
Negative Response Data Byte #1 #2 #3 Description Negative response SID Read ECU identification request SID Responsde code Byte Value (Hex) 7F 5A 31 Mnemonic NACK RECUID RC

6.12.1 Hardware identification The string identifying the electronic board of the ECU is transmitted as identification record. The string is terminated by a NULL character. 6.12.2 Firmware identification The string identifying the firmware version installed in the ECU is transmitted as identification record. The string is terminated by a NULL character.

24

TBD

6.12.3 Configuration identification The strings identifying the configuration file installed in the ECU are transmitted as identification record. Each string is terminated by a NULL character. The strings correspond to the three fields Make Model & Notes Configuration date

of the configuration file.

6.13 Request vehicle information

The purpose of this service is to enable the external test equipment to request specific vehile information such as Vehicle Identification Number. The implementation of this service is based on the infotypes techniques: the tester uses the 0x00 parameter to request the supported infotypes, and after that requets the value for the supported infotypes. The ECU supports the following infotypes: o 0x00 Report supported info types o 0x01 Number of messages to report the Vehicle Identification Number o 0x02 Vehicle Identification Number Shuld a non-supported infotype be requested, a negative response message with code SUBFUNCTION NOT SUPPORTED will be sent to the tester . 6.13.1 Report supported info types request
Request Data Byte #1 #2 Infotype group Description Request vehicle information request SID Byte Value (Hex) 09 00 Mnemonic SIDRQ INFTYP

25

TBD

Response Data Byte #1 #2 #3 #4 #5 #6 #7 Infotype group Number of data items Supported infotypes (0x01-0x08) Supported infotypes (0x09-0x10) Supported infotypes (0x11-0x18) Supported infotypes (0x19-0x20) Description Request vehicle information request SID Byte Value (Hex) 49 00 01 C0 00 00 00 Mnemonic SIDPR INFTYPREC NODI DATA_A DATA_B DATA_C DATA_D

6.13.2 Messages to report the Vehicle Identification Number request

Request Data Byte #1 #2 Message count VIN Response Data Byte #1 #2 #3 #4 Message count VIN Number of data items Number of messages to report VIN Description Request vehicle information request SID Byte Value (Hex) 49 01 01 05 Mnemonic SIDPR MC_VIN NODI DATA #1 Description Request vehicle information request SID Byte Value (Hex) 09 01 Mnemonic SIDRQ MC_VIN

6.13.3 Vehicle Identification Number

Request Data Byte #1 #2 Description Request vehicle information request SID Vehicle Identification Number Byte Value (Hex) 09 02 Mnemonic SIDRQ VIN

26

TBD

Response #n Data Byte #1 #2 #3 #4 #5 #6 #7 Description Request vehicle information request SID Vehicle Identification Number Number of data items Vin char # 4*(n-1) 2 Vin char # 4*(n-1) 1 Vin char # 4*(n-1) Vin char # 4*(n-1) +1 Byte Value (Hex) 49 02 01 XX XX XX XX Mnemonic SIDPR VIN NODI DATA #1 DATA #2 DATA #3 DATA #4

The reponse is given with 5 messages (n=1..5). In the first message (n=1) Data #1, #2, #3 is 0x00, Data #4 is the first VIN char. The subsequest messages report the subsequent VIN chars:
Response #1 DATA #1 DATA #2 DATA #3 DATA #4 00 00 00 VIN-1 Response #2 VIN-2 VIN-3 VIN-4 VIN-5 Response #3 VIN-6 VIN-7 VIN-8 VIN-9 Response #4 VIN-10 VIN-11 VIN-12 VIN-13 Response #5 VIN-14 VIN-15 VIN-16 VIN-17

Tab. 11: vehicle identification number transmission sequence

6.14 Write data by local identifier

The WriteDataByLocalIdentifier service is used by the client to write RecordValues (data values) to a server. The data are identified by a RecordLocalIdentifier. The following RecordLocalIdentifier are defined:
Record Local Identifier Vehicle Identification Number Value 0x01 Notes

Tab. 12: write data by local identifier - record local identifiers Request Data Byte #1 #2 #3 : #n Description Write data by local identifier request SID Record local identifier Record byte #1 Record byte #n Byte Value (Hex) 3B XX XX : XX Mnemonic WDBLID RECLID RECVAL

27

TBD

Positive Response Data Byte #1 #2 Description Write data by local identifier request SID Record local identifier Byte Value (Hex) 7B XX Mnemonic WDBLIDPR RECLID

If a record local identifier not included in Tab. 12 is received by the server a negative response message will be sent to the client with error code SubfunctionNotSupported.
Negative Response Data Byte #1 #2 #3 Description Negative response SID Write data by local identifier request SID Responsde code Byte Value (Hex) 7F 7B 12 Mnemonic NACK WDBLIDPR RC

6.14.1 Vehicle Identification Number Use this record local identifier to store the VIN into the server memory. Seventeen record bytes must be sent in the message. These record bytes will be stored as vehicle identification number.

6.15 Read data by local identifier

The ReadDataByLocalIdentifier request message requests data record values from the server identified by a RecordLocalIdentifier. The server sends data record values via the ReadDataByLocalIdentifier positive response message. If the server sends messages periodically and the client wants to stop the repeated positive response messages by a ReadDataByLocalIdentifier request message it shall send the request message after the P1 timing has expired and before the P2min timing becomes active. Refer to the message flow diagram and ISO 14230-2 more detail. In addition, the user optional/conditional MaximumNumberOfResponsesToSend parameter indicates to the server how many repetitions of positive response messages are requested by the client. The timing is not affected by this parameter. At the moment the slow, medium and fast data rates are not supported, if multiple samples are requested by the client they will be sent by the server after the P2 timeout has expired, as in normal communication requiring multiple response messages.

28

TBD

Request Data Byte #1 #2 #3 #4 Description Read data by local identifier request SID Record local identifier Transmission mode (single, slow, medium, fast, stop) Maximum number of responses to send Byte Value (Hex) 21 XX XX XX Mnemonic RDBLID RLOCID TXM MNORTS

The parameters Transmission mode and Maximum number of responses to send are optional. If Transmission mode is not specified, single is selected by default. If Maximum number of responses to send is not specified 1 is selected by default. The parameter Maximum number of responses to send can be specified only if Transmission mode has been specified. If single has been specified as Transmission mode, the parameter Maximum number of responses to send is set to 1.
Positive response Data Byte #1 #2 #3 : #n Record byte #n Negative response Data Byte #1 #2 #3 Description Negative response SID Read data by local identifier request SID Response code Byte Value (Hex) 7F XX XX Mnemonic NACK RDBLID RC XX Description Read data by local identifier positive response SID Record local identifier Record byte #1 Byte Value (Hex) 61 XX XX Mnemonic RDBLIDPR RLOCID RECVAL

If the transmission mode is set to an invalid value, or zero is selected as maximum number of responses to send, a negative response message is sent by the server with response code RequestOutOfRange. If a non supported RecordLocalIdentifier is requested, a a negative response message is sent by the server with response code SubfunctionNotSupported. Tab. 13 reports the supported record identifiers.
Record Local Identifier Vehicle Identification Number ECU Measurements Value 0x01 0x02 Notes

Tab. 13: read data by local identifier - record local identifiers

29

TBD

6.15.1 Vehicle Identification Number Use this record local identifier to get the vehicle identification number from the server. The response message will contain the seventeen bytes that compose the VIN. 6.15.2 ECU Measurements Use this record local identifier to acquire input and output parameters of the ECU. Each parameter is transmitted with two bytes in the order LSB / MSB (LSB first). The following parameters are transmitted to the tester: Engine speed: measured rpm of the engine with 1 rpm resolution Bank #1 petrol injection time: measured petrol injection time for cylinder #1 with 1 s resolution (ex. 3527 = 3.527 ms). Bank #2 petrol injection time: measured petrol injection time for cylinder #5 with 1 s resolution(ex. 3527 = 3.527 ms). Bank #1 computed gas injection time: computed gas injection time for cylinder #1 with 1 s resolution (ex. 11728 = 11.728 ms). Bank #2 computed gas injection time: computed gas injection time for cylinder #5 with 1 s resolution (ex. 11728 = 11.728 ms). Water temperature: measured water temperature with 1C resolution and 20C offset (ex. 70 = 50C) Gas temperature: measured gas temperature with 1C resolution and 20C offset (ex. 70 = 50C) Differential pressure: measured pressure between the gas rail and the manifold with 1 mBar resolution (ex. 2128 = 2.128 Bar) Bank #1 lambda signal percentage: measured lambda signal as percentage of sensor range with 1% resolution. (0% means lean, 100% means rich) (ex. 83 = 0.83V for a 0-1 lambda probe). Bank #2 lambda signal percentage: measured lambda signal as percentage of sensor range with 1% resolution. (0% means lean, 100% means rich) (ex. 83 = 0.83V for a 0-1 lambda probe). Battery voltage: battery voltage measured at the petrol injector coil with 10 mV resolution (ex 1321 = 13.21 V). Fuel state: code of the fuel powering the vehicle (0x0000 for gas, 0xFFFF for petrol).

6.16 Read diagnostic troble codes

The ReadDiagnosticTroubleCodes service is used by the client to read diagnostic trouble codes from the server's memory. If the server does not have any DTC stored it shall set the parameter NumberOfDTCStored to "0x00". This causes the server not to include DTC in the parameter ListOfDTC in the positive response message. The parameter GroupOfDTC is not supported by the ECU. Regardless of the inclusion of this parameters in the request message, the server will include all of the DTCs in its response message.

30

TBD

As the data bytes of the response message are limited to 63, due to the inclusion of the message length in the format byte, a maximum of 30 DTCs can be transmitted by the server.
Request Data Byte #1 Description Read diagnostic trouble codes SID Positive response Data Byte #1 #2 #3 #4 : #2n+1 #2n+2 Number of DTC DTC #1 MSB DTC #1 LSB : DTC #n MSB DTC #n LSB Description Read diagnostic trouble codes positive responseSID Byte Value (Hex) 53 XX XX XX : XX XX Mnemonic RDDTCPR #DTC LSTOFDTC Byte Value (Hex) 13 Mnemonic RDDTC

No negative response is foreseen by the server If the parameter NumberOfDTC is 0, the parameter ListOfDTC is invalid as no DTC is stored in the list. A maximum of 30 DTCs can be present in the response message.

6.17 Clear diagnostic information

The ClearDiagnosticInformation service is used by the client to clear diagnostic information in the server's memory. If the server does not have any DTC and/or diagnostic information stored the server shall send a positive response message after an appropriate request message has been received. The parameter GroupOfDiagnosticInformation is not supported by the server, even if it can be specifyed (reserved for future expansions). Regardless of the GroupOfDiagnosticInformation parameter, all of the DTCs and freeze frame data stored in the servers memory will be cleared. If one or more GroupOfDiagnosticInformation parameters are specifyed in the request message, the same parameters will be included in the response message. If no DTC is stored in the server memory, the positive response message is sent to the client after a valid request. The server will always send a positive response message to the client if a valid request has been received.

31

TBD

Request Data Byte #1 #2 : #m Description Clear diagnostic information SID Group of diagnostic information #1 : Group of diagnostic information #m-1 Positive response Data Byte #1 #2 : #m Description Clear diagnostic information positive responseSID Group of diagnostic information #1 : Group of diagnostic information #m-1 Byte Value (Hex) 54 XX : XX Mnemonic CLRDTCPR GODIN Byte Value (Hex) 14 XX : XX Mnemonic CLRDTC GODIN

6.18 Read status of diagnostic trouble codes

The Read Status Of Diagnostic Trobule Codes service is used by the client to read diagnostic troble codes with their associated status from the servers memory. The option parameter GroupOfDtc is not supported by the server and if specified will ignored. If the server has no DTC stored in its memory, it will set the NumberOfDtcStored to 0x00 and no DTC and status information will be included in the parameter ListOfDtc in the positive response message. No negative response message will be sent by the server.
Request Data Byte #1 #2 : #m Group of DTC : Group of DTC-1 Description Read status of diagnostic trouble codes SID Byte Value (Hex) 17 XX : XX Mnemonic RDSDTC GODTC

32

TBD

Positive response Data Byte #1 #2 #2 #3 #4 : #m-2 #n-1 #n Description Read status of diagnostic trouble codes positive responseSID Number of DTC DTC #1 MSB DTC #1 LSB DTC status #1 : DTC #mMSB DTC #m B DTC status #m Byte Value (Hex) 57 XX XX XX XX : XX XX XX Mnemonic RDSDTCPR #DTC LSTDTCST

If the transmission buffer size is not sufficient to transmit all of the DTCs and their status in a single frame, multiple frames will be transmitted separated by the P2 timeout. In Fig. 7 an example is given of a multiple frame positive response. The transmission buffer depth is set to 63 byte (message length specified in the format byte) and the numer of DTC stored is set to 23. The first 20 records (DTC + DTCs status) are transmitted in the first frame, the remaining 3 records are transmitted in the second frame. The number of DTC parameter is set to 23 in each frame.

Fig. 7: read status of DTC - multiple frame positive response

33

TBD

The Number of DTC output parameter indicates the number of DTCs stored in the ECU, so, in a multiple frame response, it will be the same in all of the frames. The DTCs status can have the value indicated in Tab. 14.
Description Not ready Present Stored Invalid Value 0x00 0x01 0x02 0xFF Notes The system is not ready to detec the DTC The DTC has been stored and the signal is in error condition The DTC has been stored and the signal is in normal condition Invalid information (an error was encountered)

Tab. 14: DTC's status description

6.19 I/O control by local identifier

The I/O control by local identifier service can be available only if previously, a Start diagnostic session request has been received with parameter I/O control diagnostic mode. This diagnostic mode is a special mode of the ECU: the vehicle is forced into the petrol mode, no measurement is performed on the input, no control is performed on the outputs. Only the communication with the PC or the tester continues to work. This allows for the tester to request for input signal of the ECU (eventually forcing them to a known state) or for control of output signals of the ECU to be measured.
Request Data Byte #1 #2 #3 : #n Description Input output control by local identifier request SID Input output local identifier Optional parameter #1 : Optional parameter #n-2 Positive response Data Byte #1 #2 #3 : #n Description Input output control by local identifier positive response SID Input output local identifier Control status #1 : Control status #n-2 Byte Value (Hex) 70 XX XX : XX Mnemonic IOCBLIDPR IOLID CRTLSTAT Byte Value (Hex) 30 XX XX : XX Mnemonic IOCBLID IOLID CRTLOPT

34

TBD

Negative response Data Byte #1 #2 #3 Description Negative response SID Input output control by local identifier request SID Response code Byte Value (Hex) 7F 30 XX Mnemonic NACK RDBLID RC

If the system is in a diagnostic mode different from I/O control diagnostic mode, a negative response is sent to the tester with response code Condition not correct. If a input output local identifier is used, such that it is not recognized by the server, a a negative response is sent to the tester with response code Subfunction not supported. The I/O control diagnostic mode must be activated with a Start diagnostic session request using the proper parameter. The server does not check for consistence of the parameters or that the number of parameters of the service is correct. Unpredictable results may result if the service is misused. To get back to the normal system operation the tester shall: send a Stop diagnostic session request to exit the diagnostic session send a Reset ECU request to reset the ECU
Input output local identifier Gas valve control Gas injectors control Petrol injectors control Petrol injectors disconnection control Lambda emulation control Test switch led Read switch button Set lambda emulation voltage Read analog voltage Read status of rpm signal Read rpm period Set status of diagnostic lights Value 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C Notes Controls the gas valve Controls the gas injectors Verify the status of the petrol injectors Disconnect the petrol injectors from the petrol ECU Connects / disconnects the oxygen sensor to / from the petrol ECU Set the leds of the switch Reads the status of the switch button Set the output voltage of the emulation circuit Read the analog voltage of a analog input channel Read if the rpm signal is active or not Read the period of the rpm signal Set on or off the diagnostic lights on the PCB

Tab. 15: input output local identifiers

35

TBD

6.19.1 Gas valve control Use this input output control local identifier to set the gas valve ON or OFF.
Request Data Byte #1 #2 #3 Gas valve control Gas valve status (ON = 0x01, OFF = 0x00) Positive response Data Byte #1 #2 #n Description Input output control by local identifier positive response SID Gas valve control Gas valve status (microcontroller pin status) (0 = OFF, 1 = ON) Byte Value (Hex) 70 01 XX Mnemonic IOCBLIDPR IOLID Description Input output control by local identifier request SID Byte Value (Hex) 30 01 XX Mnemonic IOCBLID IOLID

The gas valve status parameter in the request selects if the gas valve shall be turned on or off. The gas valve status parameter in the response sends the actual status of the microcontroller output line. Pay attention using this service as gas is likely to flow into the engine when the gas valve is turned on.

6.19.2 Gas injectors control Use this I/O control local identifier to set a gas injector ON (open) or OFF (closed).
Request Data Byte #1 #2 #3 #4 Gas injectors control Injector number (0x00-0x07) Gas injector status (ON = 0x01, OFF = 0x00) Description Input output control by local identifier request SID Byte Value (Hex) 30 02 XX XX Mnemonic IOCBLID IOLID

36

TBD

Positive response Data Byte #1 #2 #3 Description Input output control by local identifier positive response SID Gas injectors control Gas injectors status (microcontroller pin status). Byte Value (Hex) 70 02 XX Mnemonic IOCBLIDPR IOLID

The injector number parameter in the request selects which gas injector is affected by the request the parameter can range from 0 (Cil #1) to 7 (Cil #8) for the PIRO04, or from 0 (Cil #1) to 3 (Cil #4) for the SAM04. The injector status parameter specifyes if the gas injector shall be turned ON (open) or OFF (closed). In the response the gas injectors status output parameter reports the state of all of the gas injectors of the ECU. The information is coded in the bits (1 = ON, 0 = OFF), as explained in the following table:
bit cyclinder # b7 8 b6 7 b5 6 b4 5 b3 4 b2 3 b1 2 b0 1

Tab. 16: gas injectors status codification

The status is referred to the microcontroller pins. Pay attention using this service as gas is likely to flow into the engine when one or more gas injectors are turned on. 6.19.3 Petrol injectors control Use this I/O control local identifier to verify the status of the petrol injectors, as seen by the ECU. The output parameter gives a picture of all of the petrol injectors as indicated in Tab. 16. A bit set to 1 means that the corresponding petrol injector is driven (on, powered, open, etc..), a bit cleared to 0 means that the corresponding petrol injector is not driven (off, not powered, closed, etc.).

Request Data Byte #1 #2 Description Input output control by local identifier request SID Petrol injectors control Byte Value (Hex) 30 03 Mnemonic IOCBLID IOLID

37

TBD

Positive response Data Byte #1 #2 #3 Description Input output control by local identifier positive response SID Petrol injectors control Petrol injectors status (microcontroller pin status). Byte Value (Hex) 70 03 XX Mnemonic IOCBLIDPR IOLID

6.19.4 Petrol connection control This I/O local identifier allow the user to connect or disconnect the petrol injectors from the petrol ECU. The disconnection is actually performed inserting a resistance betwenn the cold terminal of the petrol injectors and the relevant input pin of the petrol ECU. At the moment, all of the petrol injectors are connected/disconnected at the same time but provision is made for the selection of a specific injector to be conneted/disconnected.
Request Data Byte #1 #2 #3 #4 Description Input output control by local identifier request SID Petrol injectors disconnection control Petrol injectors connection status (1 = connected, 0 = disconnected) Petrol injector number Positive response Data Byte #1 #2 #3 Description Input output control by local identifier positive response SID Petrol injectors connection control Petrol injectors connection status (microcontroller pin status). Byte Value (Hex) 70 04 XX Mnemonic IOCBLIDPR IOLID Byte Value (Hex) 30 04 XX Mnemonic IOCBLID IOLID

The petrol connection status return parameter indicates the status of the pin of the microcontroller relevant to the connection/disconnection of the petrol injectors. If equal to zero, the petrol injectors are disconnected from the petrol ECU, if non-zero, the the petrol injectors are connected to the petrol ECU. 6.19.5 Lambda emulation control Use this I/O local identifier to connect (emulation OFF) (disconnect (emulation ON)) the oxygen sensor of the vehicle to (from) the petrol ECU. If the emulation is turned on, the petrol ECU does not measure the oxygen sensor signal, but a signal generated by the gas ECU.

38

TBD

Request Data Byte #1 #2 #3 Description Input output control by local identifier request SID Lambda emulation control Lambda emulation status (1 = ON, 0 = OFF) Positive response Data Byte #1 #2 #3 Description Input output control by local identifier positive response SID Lambda emulation control Lambda emulation status (microcontroller pin status). Byte Value (Hex) 70 05 XX Mnemonic IOCBLIDPR IOLID Byte Value (Hex) 30 05 XX Mnemonic IOCBLID IOLID

The lambda emulation status return parameter indicates the status of the lambda emulation referred to the microcontroller pins. If zero, the lambda emulation is off and the oxygen sensor is connected to the petrol ECU, if non-zero, the emulation is on and the oxygen sensor is disconnected from the petrol ECU. If the emulation of the oxygen sensor is turned on and the engine is running in petrol mode, the petrol ECU can dected a failure in the sensor or affect the short and long term fuel trim as the combustion feedback is missing. 6.19.6 Test switch leds Use this I/O local identifier to sel the led indication on the switch. The parameter let the user test the different operating modes of the switch indications and the functioning of the led indicators:
Request Data Byte #1 #2 #3 Test switch leds Ouput configuration Positive response Data Byte #1 #2 Description Input output control by local identifier positive response SID Test switch leds Byte Value (Hex) 70 06 Mnemonic IOCBLIDPR IOLID Description Input output control by local identifier request SID Byte Value (Hex) 30 06 XX Mnemonic IOCBLID IOLID

39

TBD

Negative response Data Byte #1 #2 #3 Description Negative response SID Input output control by local identifier request SID Response code Byte Value (Hex) 7F 30 31 Mnemonic NACK RDBLID RC

The parameter output configuration can have the following values:

output configuration Off Petrol mode Wait mode Gas mode Reserve tank tank tank full tank low pressure alarm Value Petrol 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 OFF ON ON OFF OFF OFF OFF OFF OFF ON Gas OFF OFF FLASH ON ON ON ON ON ON OFF Level OFF OFF RES FULL FLASH (full / res) Buzzer OFF OFF OFF OFF OFF OFF OFF OFF OFF ON

Tab. 17: output configurations for the test of the leds of the switch

If the output configuration parameter has a value that is not within those indicated in Tab. 17, a negative response message will be received by the tester with response code Request Out Of Range. 6.19.7 Read switch button Use this I/O local indentifier to test the status of the switch button. The status will be acquired as it is, without filtering and without any care to polarizing voltages, etc.
Request Data Byte #1 #2 Read switch button Description Input output control by local identifier request SID Byte Value (Hex) 30 07 Mnemonic IOCBLID IOLID

40

TBD

Positive response Data Byte #1 #2 #3 Description Input output control by local identifier positive response SID Read switch button Button status (0 = RELEASED, 1 = PRESSED) Byte Value (Hex) 70 07 XX Mnemonic IOCBLIDPR IOLID

The button status output parameter is referred to the actual status of the input line to the microcontroller: this means that the status is how the system sees the switch button, regardless of its actual state. 6.19.8 Set lambda emulation voltage Use this I/O local identifier to set the output voltage of the oxygen sensor emulator circuit. To have this voltage connected to the output pin of the ECU, the emulation control must be set (see 6.19.5 ). The service let the user select the bank and the desired output voltage.
Request Data Byte #1 #2 #3 #4 Description Input output control by local identifier request SID Set lambda emulation voltage Bank number (0 == bank #1, 1 == bank #2) Output voltage (050 = 05.0V) Positive response Data Byte #1 #2 #3 Description Input output control by local identifier positive response SID Set lambda emulation voltage Lambda emulation voltage (040 = 04.0V) Negative response Data Byte #1 #2 #3 Description Negative response SID Input output control by local identifier request SID Response code Byte Value (Hex) 7F 30 31 Mnemonic NACK RDBLID RC Byte Value (Hex) 70 08 XX Mnemonic IOCBLIDPR IOLID Byte Value (Hex) 30 08 XX XX Mnemonic IOCBLID IOLID

The bank number parameter selects the emulation channel affected by the command. If a non supported value is specified, a negative response will be sent to the tester with response code Request Out Of Range.

41

TBD

The output voltage has a 0.1V resolution. If a value above 5.0V is required a negative response will be sent to the tester with response code Request Out Of Range. Due to circuit limitations, the maximum output voltage of the emulation circuit can be 4.1V. The lambda emulation voltage output parameter reports the actual voltage generated by the emulation circuit.

6.19.9 Read analog voltage Use this I/O local identifier to acquire the voltage present at a specific input of the ECU. The service will respond with the voltage value present at the input of the ECU. This voltage value is actually the voltage acquired by the microcontroller and referred to the input pin.
Request Data Byte #1 #2 #3 Read analog voltage Channel number (0-23) Positive response Data Byte #1 #2 #3 #4 #5 Description Input output control by local identifier positive response SID Read analog voltage Channel number (4-23) Measured voltage LSB Measured voltage MSB Negative response Data Byte #1 #2 #3 Description Negative response SID Input output control by local identifier request SID Response code Byte Value (Hex) 7F 30 31 Mnemonic NACK RDBLID RC Byte Value (Hex) 70 09 XX XX XX Mnemonic IOCBLIDPR IOLID Description Input output control by local identifier request SID Byte Value (Hex) 30 09 XX Mnemonic IOCBLID IOLID

The channel number parameter specify the analog channel affected by the service. If a invalid channel number is receiived by the server, a negative response message will be sent to tester with response code Request Out Of Range. The codes for the channel numbers are listed in Tab. 18. The measured voltage parameter in the response gives the measured voltage in V multiplied by 100 (0.01V resolution, ex.1376 means 13.76V).

42

TBD

Channels 16 to 23 in the PIRO04 and 16 to 19 in the SAM04 measure the current in the gas injectors; the measurement ranges from 0 to 1.7A (0,374V) if a higher current flows in the injector, the system return its full-scale value. The measured voltage parameter is a 16-bit value. It is transmitted in the LSB fisrt order: the lower byte is transmitted first and the higher byte after.

Channel 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

Piro04 Oxygen sensor bank #1 Oxygen sensor bank #2 Reserved Reserved Key signal (battery voltage) Sensors power Manifold pressure Rail pressure sensor / Differential pressure sensor Gas level sensor Rail temperature Water temperature Throttle position sensor Gas injector #1 current Gas injector #2 current Gas injector #3 current Gas injector #4 current Gas injector #5 current Gas injector #6 current Gas injector #7 current Gas injector #8 current

Sam04 Oxygen sensor bank #1 GND Switch power GND Key signal (battery voltage) Sensors power Throttle position sensor Manifold pressure sensor Gas level sensor Rail temperature Water temperature Differential pressure sensor Gas injector #1 current Gas injector #2 current Gas injector #3 current Gas injector #4 current GND GND GND GND

Note

Internal signal

Internal signal

Internal signal Internal signal Internal signal Internal signal Internal signal Internal signal Internal signal Internal signal

Tab. 18: analog channels codes

6.19.10 Read status of rpm signal Use this I/O local identifier do acquire the status of the rpm signal.

43

TBD

Request Data Byte #1 #2 Description Input output control by local identifier request SID Read status of rpm signal Positive response Data Byte #1 #2 #3 Description Input output control by local identifier positive response SID Read status of rpm signal Rpm signal status (1=ACTIVE, 0=NOT ACTIVE) Byte Value (Hex) 70 0A XX Mnemonic IOCBLIDPR IOLID Byte Value (Hex) 30 0A Mnemonic IOCBLID IOLID

The rpm signal status output parameter can have the following states: ACTIVE: the signal is driven low NOT ACTIVE: the signal is not driven low

6.19.11 Read period of rpm signal Use this I/O local identifier do acquire the period of the rpm signal.
Request Data Byte #1 #2 Description Input output control by local identifier request SID Read period of rpm signal Positive response Data Byte #1 #2 #3 #4 Description Input output control by local identifier positive response SID Read period of rpm signal Rpm signal period LSB Rpm signal period MSB Byte Value (Hex) 70 0B XX XX Mnemonic IOCBLIDPR IOLID Byte Value (Hex) 30 0B Mnemonic IOCBLID IOLID

The rpm signal period is measured with 10us resolution (ex. 4568 = 45.68ms). The measurement takes in account the Pulses per revolution configuration parameter, that is the period of the engine speed is returned by this service. Changes in the configuration parameters affect the measurement. The system coniders not valid and discard measurements below 8ms (the system is measuring rpms!) that correspond to 7500 rpm.

44

TBD

If the rpm signal is disconnected, the server just doesnt measure it anymore and the service will report the last available measurement (the period should be ).

6.19.12 Set status of diagnostic light This I/O local identifier to set the status of the diagnostic lights mounted on the board.
Request Data Byte #1 #2 #3 #4 Description Input output control by local identifier request SID Set status of diagnostic light Diagnostic light (1 = RED, 2 = GREEN) Status of diagnostic light (0=OFF, 1=ON) Positive response Data Byte #1 #2 Description Input output control by local identifier positive response SID Set status of diagnostic light Negative response Data Byte #1 #2 #3 Description Negative response SID Input output control by local identifier request SID Response code Byte Value (Hex) 7F 30 31 Mnemonic NACK RDBLID RC Byte Value (Hex) 70 0C Mnemonic IOCBLIDPR IOLID Byte Value (Hex) 30 0C XX XX Mnemonic IOCBLID IOLID

The diagnostic lights are not accessible to the user. This service is supplied in case an open board is being tested, for whatever reason. No user replaceable part is present on the electronic board. Do not even think to remove the covers to access the board inside. Permanent damage may ba caused to the board and the warranty will be void. The diagnostic light parameter selects which diagnostic light is affected by the command. If a non supported value is received by the server, a negative response message will be sent to the tester with response code Request Out Of Range. The status of diagnostic light parameter selects if the diagnostic light must be turned ON or OFF. Zero sets the light OFF, a non zero value sets the light ON.

45