BigJimny Wiki - User contributions [en-gb]

Transmission gearing ratios

2026-11-07T15:53:39Z

Mlines: /* Jimny Gen4 (JB64, JB74,JC74 */

{{intro-notes}}

== Introduction ==

{{Gen1|}}{{Gen2|}}{{Gen3|}}{{Gen4|}}
This article provides information on transmission ratios of the gearbox, transfer box and the differentials

Note: For the tyre/road speed calculations, you can use your maths from school or a [https://www.4qd.co.uk/road-speed-calculator/ www.4qd.co.uk/road-speed-calculator/ web calculator];

== Jimny gen2 ==

{{Gen2|}}
''Add info if you know it ...''

== Jimny gen3 ==

{{Gen3|}}
{| class="wikitable" vertical-align:top;
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|1998
|UK/EU
|G13B
|Manual
|3.652
|1.947
|1.423
|1.000
|0.864
|Manual
|1.320
|2.145
|3.909
|-
|1998
|UK/EU
|G13B
|Auto
|2.962
|1.515
|1.000
|0.738
|N/A
|Manual
|1.320
|2.145
|4.090
|-
|2001
|UK/EU
|M13A
|Manual
|3.652?
|1.947?
|1.423?
|1.00
|0.864?
|Manual
|1.32
|2.145
|3.909
|-
|2001
|UK/EU
|M13A
|Auto
|2.962?
|1.515?
|1.000?
|0.738?
|N/A

|Manual
|1.32
|2.145
|4.090
|-
|2005+
|UK/EU
|M13AVVT
|Manual
|4.425
|2.304
|1.674
|1.190
|1.000
|Electric
|1.00
|2.002
|4.300
|-
|2005+
|UK/EU
|M13AVVT
|Auto
|2.875
|1.568
|1.000
|0.695
|N/A
|Electric
|1.32
|2.643
|4.090
|-
|2005+
|EU
|K9K
|Manual
|4.246
|2.357
|1.695
|1.242
|1.00
|Electric
|1.00
|2.002
|3.416
|-
|2000
|JP
|K6A
|Manual
|4.031
|2.391
|1.513
|1.00
|0.790
|Manual
|1.320
|2.145
|5.375
|-
|2000
|JP
|K6A
|Auto
|2.902
|1.515
|1.00
|0.736
|N/A
|Manual
|1.320
|2.145
|5.375
|-
|2010
|JP
|K6A
|Manual
|5.106
|3.107
|1.908
|1.254
|1.000
|Manual
|1.320
|2.643
|4.300
|-
|2010
|JP
|K6A
|Auto
|2.875
|1.568
|1.000
|0.696
|N/A
|Electric
|1.320
|2.643
|5.375
|}

=== Practical examples ===

See below for some practical examples.

'''2005 VVT manual gearbox Jimny, engine at 4000 RPM and in 5th gear High Ratio, standard wheels'''

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| --------
|'''4000 RPM'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''465 RPM'''
|-
|'''Ratio'''
| --------
|1.000
|1.000
|4.300
|28" Tyre
|-
|'''Output'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''465 RPM'''
|77.7 MPH

|}'''2001 M13A manual gearbox Jimny, engine at 3000 RPM and in 1st gear Low Ratio, 30" Tyres'''

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| ------
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''97.97 RPM'''
|-
|'''Ratio'''
| ------
|3.652
|2.145
|3.909
|30" Tyre
|-
|'''Output'''
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''97.97 RPM'''
|8.7 MPH
|}

'''2001 M13A manual gearbox Jimny, engine at 3000 RPM and in 1st gear Low Ratio, 30" Tyres with Differential from later VVT'''

This shows an example of a modified diff with an increase reduction ratio

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| ------
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''89 RPM'''
|-
|'''Ratio'''
| ------
|3.652
|2.145
|4.3000
|30" Tyre
|-
|'''Output'''
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''89 RPM'''
|7.9 MPH
|}

== Jimny Gen4 (JB64, JB74,JC74) ==
'''Jimny (JB64, 3-door, Japan kei car)'''

{| class="wikitable"
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|2018
|JP
|R06A
|Manual
|5.809
|3.433
|2.171
|1.354
|1.000
|Manual
|1.320
|2.643
|3.818
|-
|2018
|JP
|R06A
|Auto
|2.875
|1.568
|1.000
|0.696
|N/A
|Manual
|1.320
|2.643
|5.375
|}

Reverse gear: 5.861 (Manual), 2.300 (Auto).

Source: [https://www.suzuki.co.jp/car/jimny/asset/pdf/detail/detail.pdf Suzuki Japan Jimny specification sheet] (May 2026).

'''Jimny (Sierra) (JB74, 3-door)'''

{| class="wikitable" vertical-align:top;
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|2019
|UK
|1.5
|Manual
|4.425
|2.304
|1.674
|1.190
|1
|Manual
|1
|2.002
|4.09
|-
|2019
|UK
|1.5
|Auto
|2.875
|1.568
|1
|0.696
|
|Manual
|1.320
|2.643
|4.3
|-
|}

'''Jimny Nomade (JC74, 5-door)'''
{| class="wikitable"
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|2025
|JP
|K15B
|Manual
|4.425
|2.304
|1.674
|1.190
|1.000
|Manual
|1.000
|2.002
|4.090
|-
|2025
|JP
|K15B
|Auto
|2.875
|1.568
|1.000
|0.696
|N/A
|Manual
|1.320
|2.643
|4.300
|}
Reverse gear: 5.151 (Manual), 2.300 (Auto).
Source: [https://www.suzuki.co.jp/car/jimny_nomade/asset/pdf/detail/detail.pdf Suzuki Japan Jimny Nomade specification sheet] (May 2026).

{{Edited}}

[[Category:Drivechain - gen2]]
[[Category:Reference Data - gen2]]

[[Category:Drivechain - gen3]]
[[Category:Reference Data - gen3]]

[[Category:Drivechain - gen4]]
[[Category:Reference Data - gen4]]

Transmission gearing ratios

2026-11-07T15:52:05Z

Mlines: /* Introduction */

{{intro-notes}}

== Introduction ==

{{Gen1|}}{{Gen2|}}{{Gen3|}}{{Gen4|}}
This article provides information on transmission ratios of the gearbox, transfer box and the differentials

Note: For the tyre/road speed calculations, you can use your maths from school or a [https://www.4qd.co.uk/road-speed-calculator/ www.4qd.co.uk/road-speed-calculator/ web calculator];

== Jimny gen2 ==

{{Gen2|}}
''Add info if you know it ...''

== Jimny gen3 ==

{{Gen3|}}
{| class="wikitable" vertical-align:top;
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|1998
|UK/EU
|G13B
|Manual
|3.652
|1.947
|1.423
|1.000
|0.864
|Manual
|1.320
|2.145
|3.909
|-
|1998
|UK/EU
|G13B
|Auto
|2.962
|1.515
|1.000
|0.738
|N/A
|Manual
|1.320
|2.145
|4.090
|-
|2001
|UK/EU
|M13A
|Manual
|3.652?
|1.947?
|1.423?
|1.00
|0.864?
|Manual
|1.32
|2.145
|3.909
|-
|2001
|UK/EU
|M13A
|Auto
|2.962?
|1.515?
|1.000?
|0.738?
|N/A

|Manual
|1.32
|2.145
|4.090
|-
|2005+
|UK/EU
|M13AVVT
|Manual
|4.425
|2.304
|1.674
|1.190
|1.000
|Electric
|1.00
|2.002
|4.300
|-
|2005+
|UK/EU
|M13AVVT
|Auto
|2.875
|1.568
|1.000
|0.695
|N/A
|Electric
|1.32
|2.643
|4.090
|-
|2005+
|EU
|K9K
|Manual
|4.246
|2.357
|1.695
|1.242
|1.00
|Electric
|1.00
|2.002
|3.416
|-
|2000
|JP
|K6A
|Manual
|4.031
|2.391
|1.513
|1.00
|0.790
|Manual
|1.320
|2.145
|5.375
|-
|2000
|JP
|K6A
|Auto
|2.902
|1.515
|1.00
|0.736
|N/A
|Manual
|1.320
|2.145
|5.375
|-
|2010
|JP
|K6A
|Manual
|5.106
|3.107
|1.908
|1.254
|1.000
|Manual
|1.320
|2.643
|4.300
|-
|2010
|JP
|K6A
|Auto
|2.875
|1.568
|1.000
|0.696
|N/A
|Electric
|1.320
|2.643
|5.375
|}

=== Practical examples ===

See below for some practical examples.

'''2005 VVT manual gearbox Jimny, engine at 4000 RPM and in 5th gear High Ratio, standard wheels'''

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| --------
|'''4000 RPM'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''465 RPM'''
|-
|'''Ratio'''
| --------
|1.000
|1.000
|4.300
|28" Tyre
|-
|'''Output'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''465 RPM'''
|77.7 MPH

|}'''2001 M13A manual gearbox Jimny, engine at 3000 RPM and in 1st gear Low Ratio, 30" Tyres'''

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| ------
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''97.97 RPM'''
|-
|'''Ratio'''
| ------
|3.652
|2.145
|3.909
|30" Tyre
|-
|'''Output'''
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''97.97 RPM'''
|8.7 MPH
|}

'''2001 M13A manual gearbox Jimny, engine at 3000 RPM and in 1st gear Low Ratio, 30" Tyres with Differential from later VVT'''

This shows an example of a modified diff with an increase reduction ratio

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| ------
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''89 RPM'''
|-
|'''Ratio'''
| ------
|3.652
|2.145
|4.3000
|30" Tyre
|-
|'''Output'''
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''89 RPM'''
|7.9 MPH
|}

== Jimny Gen4 (JB64, JB74,JC74 ==
'''Jimny (JB64, 3-door, Japan kei car)'''

{| class="wikitable"
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|2018
|JP
|R06A
|Manual
|5.809
|3.433
|2.171
|1.354
|1.000
|Manual
|1.320
|2.643
|3.818
|-
|2018
|JP
|R06A
|Auto
|2.875
|1.568
|1.000
|0.696
|N/A
|Manual
|1.320
|2.643
|5.375
|}

Reverse gear: 5.861 (Manual), 2.300 (Auto).

Source: [https://www.suzuki.co.jp/car/jimny/asset/pdf/detail/detail.pdf Suzuki Japan Jimny specification sheet] (May 2026).

'''Jimny (Sierra) (JB74, 3-door)'''

{| class="wikitable" vertical-align:top;
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|2019
|UK
|1.5
|Manual
|4.425
|2.304
|1.674
|1.190
|1
|Manual
|1
|2.002
|4.09
|-
|2019
|UK
|1.5
|Auto
|2.875
|1.568
|1
|0.696
|
|Manual
|1.320
|2.643
|4.3
|-
|}

'''Jimny Nomade (JC74, 5-door)'''
{| class="wikitable"
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|2025
|JP
|K15B
|Manual
|4.425
|2.304
|1.674
|1.190
|1.000
|Manual
|1.000
|2.002
|4.090
|-
|2025
|JP
|K15B
|Auto
|2.875
|1.568
|1.000
|0.696
|N/A
|Manual
|1.320
|2.643
|4.300
|}
Reverse gear: 5.151 (Manual), 2.300 (Auto).
Source: [https://www.suzuki.co.jp/car/jimny_nomade/asset/pdf/detail/detail.pdf Suzuki Japan Jimny Nomade specification sheet] (May 2026).

{{Edited}}

[[Category:Drivechain - gen2]]
[[Category:Reference Data - gen2]]

[[Category:Drivechain - gen3]]
[[Category:Reference Data - gen3]]

[[Category:Drivechain - gen4]]
[[Category:Reference Data - gen4]]

Transmission gearing ratios

2026-11-07T15:51:49Z

Mlines: /* Jimny Gen4 (JB64, JB74,JC74 */

{{intro-notes}}

== Introduction ==

{{Gen1|}}{{Gen2|}}{{Gen3|}}{{Gen4|}}
This article provides information on transmission ratios of the gearbox, transfer box and the differentials

Note: For the tyre/road speed calculations, you can use your maths from school or a [https://www.4qd.co.uk/road-speed-calculator/ www.4qd.co.uk/road-speed-calculator/ web calculator];

== Jimny gen2 ==

{{Gen2|}}
''Add info if you know it ...''

== Jimny gen3 ==

{{Gen3|}}
{| class="wikitable" vertical-align:top;
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|1998
|UK/EU
|G13B
|Manual
|3.652
|1.947
|1.423
|1.000
|0.864
|Manual
|1.320
|2.145
|3.909
|-
|1998
|UK/EU
|G13B
|Auto
|2.962
|1.515
|1.000
|0.738
|N/A
|Manual
|1.320
|2.145
|4.090
|-
|2001
|UK/EU
|M13A
|Manual
|3.652?
|1.947?
|1.423?
|1.00
|0.864?
|Manual
|1.32
|2.145
|3.909
|-
|2001
|UK/EU
|M13A
|Auto
|2.962?
|1.515?
|1.000?
|0.738?
|N/A

|Manual
|1.32
|2.145
|4.090
|-
|2005+
|UK/EU
|M13AVVT
|Manual
|4.425
|2.304
|1.674
|1.190
|1.000
|Electric
|1.00
|2.002
|4.300
|-
|2005+
|UK/EU
|M13AVVT
|Auto
|2.875
|1.568
|1.000
|0.695
|N/A
|Electric
|1.32
|2.643
|4.090
|-
|2005+
|EU
|K9K
|Manual
|4.246
|2.357
|1.695
|1.242
|1.00
|Electric
|1.00
|2.002
|3.416
|-
|2000
|JP
|K6A
|Manual
|4.031
|2.391
|1.513
|1.00
|0.790
|Manual
|1.320
|2.145
|5.375
|-
|2000
|JP
|K6A
|Auto
|2.902
|1.515
|1.00
|0.736
|N/A
|Manual
|1.320
|2.145
|5.375
|-
|2010
|JP
|K6A
|Manual
|5.106
|3.107
|1.908
|1.254
|1.000
|Manual
|1.320
|2.643
|4.300
|-
|2010
|JP
|K6A
|Auto
|2.875
|1.568
|1.000
|0.696
|N/A
|Electric
|1.320
|2.643
|5.375
|}

=== Practical examples ===

See below for some practical examples.

'''2005 VVT manual gearbox Jimny, engine at 4000 RPM and in 5th gear High Ratio, standard wheels'''

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| --------
|'''4000 RPM'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''465 RPM'''
|-
|'''Ratio'''
| --------
|1.000
|1.000
|4.300
|28" Tyre
|-
|'''Output'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''465 RPM'''
|77.7 MPH

|}'''2001 M13A manual gearbox Jimny, engine at 3000 RPM and in 1st gear Low Ratio, 30" Tyres'''

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| ------
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''97.97 RPM'''
|-
|'''Ratio'''
| ------
|3.652
|2.145
|3.909
|30" Tyre
|-
|'''Output'''
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''97.97 RPM'''
|8.7 MPH
|}

'''2001 M13A manual gearbox Jimny, engine at 3000 RPM and in 1st gear Low Ratio, 30" Tyres with Differential from later VVT'''

This shows an example of a modified diff with an increase reduction ratio

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| ------
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''89 RPM'''
|-
|'''Ratio'''
| ------
|3.652
|2.145
|4.3000
|30" Tyre
|-
|'''Output'''
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''89 RPM'''
|7.9 MPH
|}

== Jimny Gen4 (JB64, JB74,JC74 ==
'''Jimny (JB64, 3-door, Japan kei car)'''

{| class="wikitable"
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|2018
|JP
|R06A
|Manual
|5.809
|3.433
|2.171
|1.354
|1.000
|Manual
|1.320
|2.643
|3.818
|-
|2018
|JP
|R06A
|Auto
|2.875
|1.568
|1.000
|0.696
|N/A
|Manual
|1.320
|2.643
|5.375
|}

Reverse gear: 5.861 (Manual), 2.300 (Auto).

Source: [https://www.suzuki.co.jp/car/jimny/asset/pdf/detail/detail.pdf Suzuki Japan Jimny specification sheet] (May 2026).

'''Jimny (Sierra) (JB74, 3-door)'''

{| class="wikitable" vertical-align:top;
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|2019
|UK
|1.5
|Manual
|4.425
|2.304
|1.674
|1.190
|1
|Manual
|1
|2.002
|4.09
|-
|2019
|UK
|1.5
|Auto
|2.875
|1.568
|1
|0.696
|
|Manual
|1.320
|2.643
|4.3
|-
|}

'''Jimny Nomade (JC74, 5-door)'''
{| class="wikitable"
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|2025
|JP
|K15B
|Manual
|4.425
|2.304
|1.674
|1.190
|1.000
|Manual
|1.000
|2.002
|4.090
|-
|2025
|JP
|K15B
|Auto
|2.875
|1.568
|1.000
|0.696
|N/A
|Manual
|1.320
|2.643
|4.300
|}
Reverse gear: 5.151 (Manual), 2.300 (Auto).
Source: [https://www.suzuki.co.jp/car/jimny_nomade/asset/pdf/detail/detail.pdf Suzuki Japan Jimny Nomade specification sheet] (May 2026).

{{Edited}}

[[Category:Drivechain - gen2]]
[[Category:Reference Data - gen2]]

[[Category:Drivechain - gen3]]
[[Category:Reference Data - gen3]]

[[Category:Drivechain - gen4]]
[[Category:Reference Data - gen4]]

Transmission gearing ratios

2026-11-07T15:51:04Z

Mlines: /* Jimny Gen4 (JB64, JB74,JC74 */

{{intro-notes}}

== Introduction ==

{{Gen1|}}{{Gen2|}}{{Gen3|}}{{Gen4|}}
This article provides information on transmission ratios of the gearbox, transfer box and the differentials

Note: For the tyre/road speed calculations, you can use your maths from school or a [https://www.4qd.co.uk/road-speed-calculator/ www.4qd.co.uk/road-speed-calculator/ web calculator];

== Jimny gen2 ==

{{Gen2|}}
''Add info if you know it ...''

== Jimny gen3 ==

{{Gen3|}}
{| class="wikitable" vertical-align:top;
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|1998
|UK/EU
|G13B
|Manual
|3.652
|1.947
|1.423
|1.000
|0.864
|Manual
|1.320
|2.145
|3.909
|-
|1998
|UK/EU
|G13B
|Auto
|2.962
|1.515
|1.000
|0.738
|N/A
|Manual
|1.320
|2.145
|4.090
|-
|2001
|UK/EU
|M13A
|Manual
|3.652?
|1.947?
|1.423?
|1.00
|0.864?
|Manual
|1.32
|2.145
|3.909
|-
|2001
|UK/EU
|M13A
|Auto
|2.962?
|1.515?
|1.000?
|0.738?
|N/A

|Manual
|1.32
|2.145
|4.090
|-
|2005+
|UK/EU
|M13AVVT
|Manual
|4.425
|2.304
|1.674
|1.190
|1.000
|Electric
|1.00
|2.002
|4.300
|-
|2005+
|UK/EU
|M13AVVT
|Auto
|2.875
|1.568
|1.000
|0.695
|N/A
|Electric
|1.32
|2.643
|4.090
|-
|2005+
|EU
|K9K
|Manual
|4.246
|2.357
|1.695
|1.242
|1.00
|Electric
|1.00
|2.002
|3.416
|-
|2000
|JP
|K6A
|Manual
|4.031
|2.391
|1.513
|1.00
|0.790
|Manual
|1.320
|2.145
|5.375
|-
|2000
|JP
|K6A
|Auto
|2.902
|1.515
|1.00
|0.736
|N/A
|Manual
|1.320
|2.145
|5.375
|-
|2010
|JP
|K6A
|Manual
|5.106
|3.107
|1.908
|1.254
|1.000
|Manual
|1.320
|2.643
|4.300
|-
|2010
|JP
|K6A
|Auto
|2.875
|1.568
|1.000
|0.696
|N/A
|Electric
|1.320
|2.643
|5.375
|}

=== Practical examples ===

See below for some practical examples.

'''2005 VVT manual gearbox Jimny, engine at 4000 RPM and in 5th gear High Ratio, standard wheels'''

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| --------
|'''4000 RPM'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''465 RPM'''
|-
|'''Ratio'''
| --------
|1.000
|1.000
|4.300
|28" Tyre
|-
|'''Output'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''465 RPM'''
|77.7 MPH

|}'''2001 M13A manual gearbox Jimny, engine at 3000 RPM and in 1st gear Low Ratio, 30" Tyres'''

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| ------
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''97.97 RPM'''
|-
|'''Ratio'''
| ------
|3.652
|2.145
|3.909
|30" Tyre
|-
|'''Output'''
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''97.97 RPM'''
|8.7 MPH
|}

'''2001 M13A manual gearbox Jimny, engine at 3000 RPM and in 1st gear Low Ratio, 30" Tyres with Differential from later VVT'''

This shows an example of a modified diff with an increase reduction ratio

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| ------
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''89 RPM'''
|-
|'''Ratio'''
| ------
|3.652
|2.145
|4.3000
|30" Tyre
|-
|'''Output'''
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''89 RPM'''
|7.9 MPH
|}

== Jimny Gen4 (JB64, JB74,JC74 ==
'''Jimny (JB64, 3-door, Japan kei car)'''

{| class="wikitable"
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|2018
|JP
|R06A
|Manual
|5.809
|3.433
|2.171
|1.354
|1.000
|Manual
|1.320
|2.643
|3.818
|-
|2018
|JP
|R06A
|Auto
|2.875
|1.568
|1.000
|0.696
|N/A
|Manual
|1.320
|2.643
|5.375
|}

Reverse gear: 5.861 (Manual), 2.300 (Auto).

Source: [https://www.suzuki.co.jp/car/jimny/asset/pdf/detail/detail.pdf Suzuki Japan Jimny specification sheet] (May 2026).
{{Gen4|}}
'''Jimny (Sierra) (JB74, 3-door)'''

{| class="wikitable" vertical-align:top;
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|2019
|UK
|1.5
|Manual
|4.425
|2.304
|1.674
|1.190
|1
|Manual
|1
|2.002
|4.09
|-
|2019
|UK
|1.5
|Auto
|2.875
|1.568
|1
|0.696
|
|Manual
|1.320
|2.643
|4.3
|-
|}

'''Jimny Nomade (JC74, 5-door)'''
{| class="wikitable"
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|2025
|JP
|K15B
|Manual
|4.425
|2.304
|1.674
|1.190
|1.000
|Manual
|1.000
|2.002
|4.090
|-
|2025
|JP
|K15B
|Auto
|2.875
|1.568
|1.000
|0.696
|N/A
|Manual
|1.320
|2.643
|4.300
|}
Reverse gear: 5.151 (Manual), 2.300 (Auto).
Source: [https://www.suzuki.co.jp/car/jimny_nomade/asset/pdf/detail/detail.pdf Suzuki Japan Jimny Nomade specification sheet] (May 2026).

{{Edited}}

[[Category:Drivechain - gen2]]
[[Category:Reference Data - gen2]]

[[Category:Drivechain - gen3]]
[[Category:Reference Data - gen3]]

[[Category:Drivechain - gen4]]
[[Category:Reference Data - gen4]]

Transmission gearing ratios

2026-11-07T15:50:26Z

Mlines: /* Jimny gen4 */

{{intro-notes}}

== Introduction ==

{{Gen1|}}{{Gen2|}}{{Gen3|}}{{Gen4|}}
This article provides information on transmission ratios of the gearbox, transfer box and the differentials

Note: For the tyre/road speed calculations, you can use your maths from school or a [https://www.4qd.co.uk/road-speed-calculator/ www.4qd.co.uk/road-speed-calculator/ web calculator];

== Jimny gen2 ==

{{Gen2|}}
''Add info if you know it ...''

== Jimny gen3 ==

{{Gen3|}}
{| class="wikitable" vertical-align:top;
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|1998
|UK/EU
|G13B
|Manual
|3.652
|1.947
|1.423
|1.000
|0.864
|Manual
|1.320
|2.145
|3.909
|-
|1998
|UK/EU
|G13B
|Auto
|2.962
|1.515
|1.000
|0.738
|N/A
|Manual
|1.320
|2.145
|4.090
|-
|2001
|UK/EU
|M13A
|Manual
|3.652?
|1.947?
|1.423?
|1.00
|0.864?
|Manual
|1.32
|2.145
|3.909
|-
|2001
|UK/EU
|M13A
|Auto
|2.962?
|1.515?
|1.000?
|0.738?
|N/A

|Manual
|1.32
|2.145
|4.090
|-
|2005+
|UK/EU
|M13AVVT
|Manual
|4.425
|2.304
|1.674
|1.190
|1.000
|Electric
|1.00
|2.002
|4.300
|-
|2005+
|UK/EU
|M13AVVT
|Auto
|2.875
|1.568
|1.000
|0.695
|N/A
|Electric
|1.32
|2.643
|4.090
|-
|2005+
|EU
|K9K
|Manual
|4.246
|2.357
|1.695
|1.242
|1.00
|Electric
|1.00
|2.002
|3.416
|-
|2000
|JP
|K6A
|Manual
|4.031
|2.391
|1.513
|1.00
|0.790
|Manual
|1.320
|2.145
|5.375
|-
|2000
|JP
|K6A
|Auto
|2.902
|1.515
|1.00
|0.736
|N/A
|Manual
|1.320
|2.145
|5.375
|-
|2010
|JP
|K6A
|Manual
|5.106
|3.107
|1.908
|1.254
|1.000
|Manual
|1.320
|2.643
|4.300
|-
|2010
|JP
|K6A
|Auto
|2.875
|1.568
|1.000
|0.696
|N/A
|Electric
|1.320
|2.643
|5.375
|}

=== Practical examples ===

See below for some practical examples.

'''2005 VVT manual gearbox Jimny, engine at 4000 RPM and in 5th gear High Ratio, standard wheels'''

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| --------
|'''4000 RPM'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''465 RPM'''
|-
|'''Ratio'''
| --------
|1.000
|1.000
|4.300
|28" Tyre
|-
|'''Output'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''465 RPM'''
|77.7 MPH

|}'''2001 M13A manual gearbox Jimny, engine at 3000 RPM and in 1st gear Low Ratio, 30" Tyres'''

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| ------
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''97.97 RPM'''
|-
|'''Ratio'''
| ------
|3.652
|2.145
|3.909
|30" Tyre
|-
|'''Output'''
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''97.97 RPM'''
|8.7 MPH
|}

'''2001 M13A manual gearbox Jimny, engine at 3000 RPM and in 1st gear Low Ratio, 30" Tyres with Differential from later VVT'''

This shows an example of a modified diff with an increase reduction ratio

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| ------
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''89 RPM'''
|-
|'''Ratio'''
| ------
|3.652
|2.145
|4.3000
|30" Tyre
|-
|'''Output'''
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''89 RPM'''
|7.9 MPH
|}

== Jimny Gen4 (JB64, JB74,JC74 ==
'''Jimny (JB64, 3-door, Japan kei car)'''

{| class="wikitable"
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|2018
|JP
|R06A
|Manual
|5.809
|3.433
|2.171
|1.354
|1.000
|Manual
|1.320
|2.643
|3.818
|-
|2018
|JP
|R06A
|Auto
|2.875
|1.568
|1.000
|0.696
|N/A
|Manual
|1.320
|2.643
|5.375
|}

Reverse gear: 5.861 (Manual), 2.300 (Auto).

Source: [https://www.suzuki.co.jp/car/jimny/asset/pdf/detail/detail.pdf Suzuki Japan Jimny specification sheet] (May 2026).
{{Gen4|}}
'''Jimny Sierra (JB74, 3-door)'''

{| class="wikitable" vertical-align:top;
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|2019
|UK
|1.5
|Manual
|4.425
|2.304
|1.674
|1.190
|1
|Manual
|1
|2.002
|4.09
|-
|2019
|UK
|1.5
|Auto
|2.875
|1.568
|1
|0.696
|
|Manual
|1.320
|2.643
|4.3
|-
|}

'''Jimny Nomade (JC74, 5-door)'''
{| class="wikitable"
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|2025
|JP
|K15B
|Manual
|4.425
|2.304
|1.674
|1.190
|1.000
|Manual
|1.000
|2.002
|4.090
|-
|2025
|JP
|K15B
|Auto
|2.875
|1.568
|1.000
|0.696
|N/A
|Manual
|1.320
|2.643
|4.300
|}
Reverse gear: 5.151 (Manual), 2.300 (Auto).
Source: [https://www.suzuki.co.jp/car/jimny_nomade/asset/pdf/detail/detail.pdf Suzuki Japan Jimny Nomade specification sheet] (May 2026).

{{Edited}}

[[Category:Drivechain - gen2]]
[[Category:Reference Data - gen2]]

[[Category:Drivechain - gen3]]
[[Category:Reference Data - gen3]]

[[Category:Drivechain - gen4]]
[[Category:Reference Data - gen4]]

Transmission gearing ratios

2026-11-07T15:49:43Z

Mlines: /* Jimny gen4 */

{{intro-notes}}

== Introduction ==

{{Gen1|}}{{Gen2|}}{{Gen3|}}{{Gen4|}}
This article provides information on transmission ratios of the gearbox, transfer box and the differentials

Note: For the tyre/road speed calculations, you can use your maths from school or a [https://www.4qd.co.uk/road-speed-calculator/ www.4qd.co.uk/road-speed-calculator/ web calculator];

== Jimny gen2 ==

{{Gen2|}}
''Add info if you know it ...''

== Jimny gen3 ==

{{Gen3|}}
{| class="wikitable" vertical-align:top;
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|1998
|UK/EU
|G13B
|Manual
|3.652
|1.947
|1.423
|1.000
|0.864
|Manual
|1.320
|2.145
|3.909
|-
|1998
|UK/EU
|G13B
|Auto
|2.962
|1.515
|1.000
|0.738
|N/A
|Manual
|1.320
|2.145
|4.090
|-
|2001
|UK/EU
|M13A
|Manual
|3.652?
|1.947?
|1.423?
|1.00
|0.864?
|Manual
|1.32
|2.145
|3.909
|-
|2001
|UK/EU
|M13A
|Auto
|2.962?
|1.515?
|1.000?
|0.738?
|N/A

|Manual
|1.32
|2.145
|4.090
|-
|2005+
|UK/EU
|M13AVVT
|Manual
|4.425
|2.304
|1.674
|1.190
|1.000
|Electric
|1.00
|2.002
|4.300
|-
|2005+
|UK/EU
|M13AVVT
|Auto
|2.875
|1.568
|1.000
|0.695
|N/A
|Electric
|1.32
|2.643
|4.090
|-
|2005+
|EU
|K9K
|Manual
|4.246
|2.357
|1.695
|1.242
|1.00
|Electric
|1.00
|2.002
|3.416
|-
|2000
|JP
|K6A
|Manual
|4.031
|2.391
|1.513
|1.00
|0.790
|Manual
|1.320
|2.145
|5.375
|-
|2000
|JP
|K6A
|Auto
|2.902
|1.515
|1.00
|0.736
|N/A
|Manual
|1.320
|2.145
|5.375
|-
|2010
|JP
|K6A
|Manual
|5.106
|3.107
|1.908
|1.254
|1.000
|Manual
|1.320
|2.643
|4.300
|-
|2010
|JP
|K6A
|Auto
|2.875
|1.568
|1.000
|0.696
|N/A
|Electric
|1.320
|2.643
|5.375
|}

=== Practical examples ===

See below for some practical examples.

'''2005 VVT manual gearbox Jimny, engine at 4000 RPM and in 5th gear High Ratio, standard wheels'''

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| --------
|'''4000 RPM'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''465 RPM'''
|-
|'''Ratio'''
| --------
|1.000
|1.000
|4.300
|28" Tyre
|-
|'''Output'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''465 RPM'''
|77.7 MPH

|}'''2001 M13A manual gearbox Jimny, engine at 3000 RPM and in 1st gear Low Ratio, 30" Tyres'''

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| ------
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''97.97 RPM'''
|-
|'''Ratio'''
| ------
|3.652
|2.145
|3.909
|30" Tyre
|-
|'''Output'''
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''97.97 RPM'''
|8.7 MPH
|}

'''2001 M13A manual gearbox Jimny, engine at 3000 RPM and in 1st gear Low Ratio, 30" Tyres with Differential from later VVT'''

This shows an example of a modified diff with an increase reduction ratio

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| ------
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''89 RPM'''
|-
|'''Ratio'''
| ------
|3.652
|2.145
|4.3000
|30" Tyre
|-
|'''Output'''
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''89 RPM'''
|7.9 MPH
|}

== Jimny gen4 ==
'''Jimny (JB64, 3-door, Japan kei car)'''

{| class="wikitable"
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|2018
|JP
|R06A
|Manual
|5.809
|3.433
|2.171
|1.354
|1.000
|Manual
|1.320
|2.643
|3.818
|-
|2018
|JP
|R06A
|Auto
|2.875
|1.568
|1.000
|0.696
|N/A
|Manual
|1.320
|2.643
|5.375
|}

Reverse gear: 5.861 (Manual), 2.300 (Auto).

Source: [https://www.suzuki.co.jp/car/jimny/asset/pdf/detail/detail.pdf Suzuki Japan Jimny specification sheet] (May 2026).
{{Gen4|}}
''Jimny Sierra (JB74, 3-door)''

{| class="wikitable" vertical-align:top;
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|2019
|UK
|1.5
|Manual
|4.425
|2.304
|1.674
|1.190
|1
|Manual
|1
|2.002
|4.09
|-
|2019
|UK
|1.5
|Auto
|2.875
|1.568
|1
|0.696
|
|Manual
|1.320
|2.643
|4.3
|-
|}

'''Jimny Nomade (JC74, 5-door)'''
{| class="wikitable"
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|2025
|JP
|K15B
|Manual
|4.425
|2.304
|1.674
|1.190
|1.000
|Manual
|1.000
|2.002
|4.090
|-
|2025
|JP
|K15B
|Auto
|2.875
|1.568
|1.000
|0.696
|N/A
|Manual
|1.320
|2.643
|4.300
|}
Reverse gear: 5.151 (Manual), 2.300 (Auto).
Source: [https://www.suzuki.co.jp/car/jimny_nomade/asset/pdf/detail/detail.pdf Suzuki Japan Jimny Nomade specification sheet] (May 2026).

{{Edited}}

[[Category:Drivechain - gen2]]
[[Category:Reference Data - gen2]]

[[Category:Drivechain - gen3]]
[[Category:Reference Data - gen3]]

[[Category:Drivechain - gen4]]
[[Category:Reference Data - gen4]]

Transmission gearing ratios

2026-11-07T15:46:28Z

Mlines: /* Jimny gen4 */

{{intro-notes}}

== Introduction ==

{{Gen1|}}{{Gen2|}}{{Gen3|}}{{Gen4|}}
This article provides information on transmission ratios of the gearbox, transfer box and the differentials

Note: For the tyre/road speed calculations, you can use your maths from school or a [https://www.4qd.co.uk/road-speed-calculator/ www.4qd.co.uk/road-speed-calculator/ web calculator];

== Jimny gen2 ==

{{Gen2|}}
''Add info if you know it ...''

== Jimny gen3 ==

{{Gen3|}}
{| class="wikitable" vertical-align:top;
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|1998
|UK/EU
|G13B
|Manual
|3.652
|1.947
|1.423
|1.000
|0.864
|Manual
|1.320
|2.145
|3.909
|-
|1998
|UK/EU
|G13B
|Auto
|2.962
|1.515
|1.000
|0.738
|N/A
|Manual
|1.320
|2.145
|4.090
|-
|2001
|UK/EU
|M13A
|Manual
|3.652?
|1.947?
|1.423?
|1.00
|0.864?
|Manual
|1.32
|2.145
|3.909
|-
|2001
|UK/EU
|M13A
|Auto
|2.962?
|1.515?
|1.000?
|0.738?
|N/A

|Manual
|1.32
|2.145
|4.090
|-
|2005+
|UK/EU
|M13AVVT
|Manual
|4.425
|2.304
|1.674
|1.190
|1.000
|Electric
|1.00
|2.002
|4.300
|-
|2005+
|UK/EU
|M13AVVT
|Auto
|2.875
|1.568
|1.000
|0.695
|N/A
|Electric
|1.32
|2.643
|4.090
|-
|2005+
|EU
|K9K
|Manual
|4.246
|2.357
|1.695
|1.242
|1.00
|Electric
|1.00
|2.002
|3.416
|-
|2000
|JP
|K6A
|Manual
|4.031
|2.391
|1.513
|1.00
|0.790
|Manual
|1.320
|2.145
|5.375
|-
|2000
|JP
|K6A
|Auto
|2.902
|1.515
|1.00
|0.736
|N/A
|Manual
|1.320
|2.145
|5.375
|-
|2010
|JP
|K6A
|Manual
|5.106
|3.107
|1.908
|1.254
|1.000
|Manual
|1.320
|2.643
|4.300
|-
|2010
|JP
|K6A
|Auto
|2.875
|1.568
|1.000
|0.696
|N/A
|Electric
|1.320
|2.643
|5.375
|}

=== Practical examples ===

See below for some practical examples.

'''2005 VVT manual gearbox Jimny, engine at 4000 RPM and in 5th gear High Ratio, standard wheels'''

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| --------
|'''4000 RPM'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''465 RPM'''
|-
|'''Ratio'''
| --------
|1.000
|1.000
|4.300
|28" Tyre
|-
|'''Output'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''465 RPM'''
|77.7 MPH

|}'''2001 M13A manual gearbox Jimny, engine at 3000 RPM and in 1st gear Low Ratio, 30" Tyres'''

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| ------
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''97.97 RPM'''
|-
|'''Ratio'''
| ------
|3.652
|2.145
|3.909
|30" Tyre
|-
|'''Output'''
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''97.97 RPM'''
|8.7 MPH
|}

'''2001 M13A manual gearbox Jimny, engine at 3000 RPM and in 1st gear Low Ratio, 30" Tyres with Differential from later VVT'''

This shows an example of a modified diff with an increase reduction ratio

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| ------
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''89 RPM'''
|-
|'''Ratio'''
| ------
|3.652
|2.145
|4.3000
|30" Tyre
|-
|'''Output'''
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''89 RPM'''
|7.9 MPH
|}

== Jimny gen4 ==

{{Gen4|}}
''Jimny Sierra (JB74, 3-door)''

{| class="wikitable" vertical-align:top;
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|2019
|UK
|1.5
|Manual
|4.425
|2.304
|1.674
|1.190
|1
|Manual
|1
|2.002
|4.09
|-
|2019
|UK
|1.5
|Auto
|2.875
|1.568
|1
|0.696
|
|Manual
|1.320
|2.643
|4.3
|-
|}

'''Jimny Nomade (JC74, 5-door)'''
{| class="wikitable"
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|2025
|JP
|K15B
|Manual
|4.425
|2.304
|1.674
|1.190
|1.000
|Manual
|1.000
|2.002
|4.090
|-
|2025
|JP
|K15B
|Auto
|2.875
|1.568
|1.000
|0.696
|N/A
|Manual
|1.320
|2.643
|4.300
|}
Reverse gear: 5.151 (Manual), 2.300 (Auto).
Source: [https://www.suzuki.co.jp/car/jimny_nomade/asset/pdf/detail/detail.pdf Suzuki Japan Jimny Nomade specification sheet] (May 2026).

{{Edited}}

[[Category:Drivechain - gen2]]
[[Category:Reference Data - gen2]]

[[Category:Drivechain - gen3]]
[[Category:Reference Data - gen3]]

[[Category:Drivechain - gen4]]
[[Category:Reference Data - gen4]]

Transmission gearing ratios

2026-11-07T15:44:33Z

Mlines: /* Jimny gen4 */

{{intro-notes}}

== Introduction ==

{{Gen1|}}{{Gen2|}}{{Gen3|}}{{Gen4|}}
This article provides information on transmission ratios of the gearbox, transfer box and the differentials

Note: For the tyre/road speed calculations, you can use your maths from school or a [https://www.4qd.co.uk/road-speed-calculator/ www.4qd.co.uk/road-speed-calculator/ web calculator];

== Jimny gen2 ==

{{Gen2|}}
''Add info if you know it ...''

== Jimny gen3 ==

{{Gen3|}}
{| class="wikitable" vertical-align:top;
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|1998
|UK/EU
|G13B
|Manual
|3.652
|1.947
|1.423
|1.000
|0.864
|Manual
|1.320
|2.145
|3.909
|-
|1998
|UK/EU
|G13B
|Auto
|2.962
|1.515
|1.000
|0.738
|N/A
|Manual
|1.320
|2.145
|4.090
|-
|2001
|UK/EU
|M13A
|Manual
|3.652?
|1.947?
|1.423?
|1.00
|0.864?
|Manual
|1.32
|2.145
|3.909
|-
|2001
|UK/EU
|M13A
|Auto
|2.962?
|1.515?
|1.000?
|0.738?
|N/A

|Manual
|1.32
|2.145
|4.090
|-
|2005+
|UK/EU
|M13AVVT
|Manual
|4.425
|2.304
|1.674
|1.190
|1.000
|Electric
|1.00
|2.002
|4.300
|-
|2005+
|UK/EU
|M13AVVT
|Auto
|2.875
|1.568
|1.000
|0.695
|N/A
|Electric
|1.32
|2.643
|4.090
|-
|2005+
|EU
|K9K
|Manual
|4.246
|2.357
|1.695
|1.242
|1.00
|Electric
|1.00
|2.002
|3.416
|-
|2000
|JP
|K6A
|Manual
|4.031
|2.391
|1.513
|1.00
|0.790
|Manual
|1.320
|2.145
|5.375
|-
|2000
|JP
|K6A
|Auto
|2.902
|1.515
|1.00
|0.736
|N/A
|Manual
|1.320
|2.145
|5.375
|-
|2010
|JP
|K6A
|Manual
|5.106
|3.107
|1.908
|1.254
|1.000
|Manual
|1.320
|2.643
|4.300
|-
|2010
|JP
|K6A
|Auto
|2.875
|1.568
|1.000
|0.696
|N/A
|Electric
|1.320
|2.643
|5.375
|}

=== Practical examples ===

See below for some practical examples.

'''2005 VVT manual gearbox Jimny, engine at 4000 RPM and in 5th gear High Ratio, standard wheels'''

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| --------
|'''4000 RPM'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''465 RPM'''
|-
|'''Ratio'''
| --------
|1.000
|1.000
|4.300
|28" Tyre
|-
|'''Output'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''4000 RPM'''
|'''465 RPM'''
|77.7 MPH

|}'''2001 M13A manual gearbox Jimny, engine at 3000 RPM and in 1st gear Low Ratio, 30" Tyres'''

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| ------
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''97.97 RPM'''
|-
|'''Ratio'''
| ------
|3.652
|2.145
|3.909
|30" Tyre
|-
|'''Output'''
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''97.97 RPM'''
|8.7 MPH
|}

'''2001 M13A manual gearbox Jimny, engine at 3000 RPM and in 1st gear Low Ratio, 30" Tyres with Differential from later VVT'''

This shows an example of a modified diff with an increase reduction ratio

{| class="wikitable"
!
!Engine
!Gearbox
!Transfer Box
!Diff
!Wheel
|-
|'''Input'''
| ------
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''89 RPM'''
|-
|'''Ratio'''
| ------
|3.652
|2.145
|4.3000
|30" Tyre
|-
|'''Output'''
|'''3000 RPM'''
|'''821.4 RPM'''
|'''382.9 RPM'''
|'''89 RPM'''
|7.9 MPH
|}

== Jimny gen4 ==

{{Gen4|}}
''Info needed ...''

{| class="wikitable" vertical-align:top;
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|2019
|UK
|1.5
|Manual
|4.425
|2.304
|1.674
|1.190
|1
|Manual
|1
|2.002
|4.09
|-
|2019
|UK
|1.5
|Auto
|2.875
|1.568
|1
|0.696
|
|Manual
|1.320
|2.643
|4.3
|-
|}

'''Jimny Nomade (JC74, 5-door)'''
{| class="wikitable"
!Date
!Country
!Engine
!Gearbox
!Gear 1
!Gear 2
!Gear 3
!Gear 4
!Gear 5
!Transfer Box
!High
!Low
!Final Drive
|-
|2025
|JP
|K15B
|Manual
|4.425
|2.304
|1.674
|1.190
|1.000
|Manual
|1.000
|2.002
|4.090
|-
|2025
|JP
|K15B
|Auto
|2.875
|1.568
|1.000
|0.696
|N/A
|Manual
|1.320
|2.643
|4.300
|}
Reverse gear: 5.151 (Manual), 2.300 (Auto).
Source: [https://www.suzuki.co.jp/car/jimny_nomade/asset/pdf/detail/detail.pdf Suzuki Japan Jimny Nomade specification sheet] (May 2026).

{{Edited}}

[[Category:Drivechain - gen2]]
[[Category:Reference Data - gen2]]

[[Category:Drivechain - gen3]]
[[Category:Reference Data - gen3]]

[[Category:Drivechain - gen4]]
[[Category:Reference Data - gen4]]

ECU diagnostic CAN addresses

2026-11-02T08:53:34Z

Mlines: /* Example usage */

<div style="border: 1px solid #c9a227; background-color: #fff8dc; padding: 0.6em 1em; margin: 0 0 1em 0; border-radius: 4px;">
'''Support this project:''' The information on this page is free, but it took a lot of work to gather, test and write up. If it has been useful to you, you can say thanks with a donation at [https://buymeacoffee.com/bigjimny buymeacoffee.com/bigjimny].
</div>

= Suzuki Jimny JB74 - CAN bus devices and the commands they answer =

'''Status:''' work in progress. This page lists every module that answered on the OBD socket (DLC) of one RHD UK-market 2021 Jimny, its request and reply CAN IDs, and the diagnostic commands seen so far. Many sections are short because only identification and fault-code requests have been captured. See [[OBD2 Diagnostics reading project]] for how the captures were made and for the TPMS data in detail.

== How to read this page ==
* All IDs are 11-bit CAN IDs on the OBD socket (pins 6 and 14, 500 kbit/s). The "request ID" is the header a tool sends to; the "reply ID" is where the module answers.
* Commands are shown as the payload bytes in hex, without the ISO-TP length byte. Replies longer than 7 bytes are sent as several frames; the tables show them reassembled.
* '''KWP-style''' modules use services such as <code>1A</code> (read ECU identification) and <code>18</code> (read DTCs by status). '''UDS-style''' modules use <code>22</code> (read data by identifier) and <code>19</code> (read DTCs).
* The reply ID is not always the request ID plus 8: the engine is +0x08, the 0x261 to 0x274 group is +0x400, and all others are +0x10.
* Identification strings are ASCII Suzuki part numbers. The first one in each module (<code>1A 8E</code> or <code>22 F1 01</code>) has no trailing character; the second (<code>1A 8A</code> or <code>22 F1 88</code>) ends in <code>*</code>. They do not always equal the number printed on the module's label.
* Commands marked ''captured'' were seen in a trace. Nothing here has been sent to a module by us except the TPMS requests.
=== Example usage ===
This example reads the TPMS controller (request ID 0x798) with an ELM327 adapter in a terminal app. Use a terminal that sends a carriage return (CR) at the end of each line, with the ignition on. Send the commands one at a time and wait for <code>OK</code> after each.

{| class="wikitable"
! Command !! Purpose
|-
| <code>ATZ</code> || Reset the adapter (prints the adapter version, not OK)
|-
| <code>ATSP6</code> || Use protocol 6: ISO 15765-4, 11-bit CAN, 500 kbit/s
|-
| <code>ATSH798</code> || Send requests to the TPMS controller ('''see device table above''')
|-
| <code>ATS0</code> || No spaces in the reply (stops one clone adapter overflowing its buffer)
|-
| <code>ATL0</code> || No line feeds in the reply
|-
| <code>ATFCSH798</code> || Send flow-control frames to 0x798 ('''see device table above''')
|-
| <code>ATFCSD300000</code> || Flow-control data <code>30 00 00</code>: continue, send all frames, no delay
|-
| <code>ATFCSM1</code> || Use the custom flow-control header and data above
|-
| <code>2100</code> || Request the sensor data block (service 0x21, identifier 0x00) ( '''see device specific tables below''')
|}

Example reply (generic ELM327 clone, ignition on, engine off):
<pre>
2100
066
0:610075010000
1:0000000000004E
2:AA094310397901
3:4900DD91B52520
4:3B880149004EAA
5:0319183C830249
6:004EAA09C9083C
7:83024900000000
8:004EAA09434EAA
9:09434EAA09434E
A:AA094373737373
B:7D7D7D7D000000
C:00000000000000
D:00000030222202
E:01801700000000
</pre>

Reading the reply:
* <code>066</code> is the total length in hex: 0x66 = 102 bytes. The lines <code>0:</code> to <code>E:</code> carry those bytes in order.
* The data starts <code>61 00</code> (positive reply to <code>21 00</code>). The next byte, <code>75</code> = 117, probably tracks system voltage (about 11.7 V, unconfirmed).
* Each wheel has a 10-byte record. Byte +6 of the record is the pressure; bar = raw x 0.01372.

{| class="wikitable"
! Wheel !! Record (hex) !! Byte +6 !! Raw !! Pressure
|-
| Front left || <code>4E AA 09 43 10 39 79 01 49 00</code> || <code>79</code> || 121 || 1.66 bar
|-
| Rear left || <code>DD 91 B5 25 20 3B 88 01 49 00</code> || <code>88</code> || 136 || 1.87 bar
|-
| Rear right || <code>4E AA 03 19 18 3C 83 02 49 00</code> || <code>83</code> || 131 || 1.80 bar
|-
| Front right || <code>4E AA 09 C9 08 3C 83 02 49 00</code> || <code>83</code> || 131 || 1.80 bar
|}

Notes:
* The sensor IDs, and the byte values, are from one car. Your IDs will differ, and the values change with pressure and temperature.
* <code>ATSH</code> and the <code>ATFC</code> settings last until the adapter is reset (<code>ATZ</code>) or loses power, so send them again after either.
* Without the <code>ATFC</code> lines, the clone adapter used here returned only the first line (<code>610075010000</code>).
* If the terminal prints <code>NO DATA</code>, check the ignition is on, that no other app is connected to the adapter, and that <code>ATSH798</code> was sent after the last reset.

== Device table ==
{| class="wikitable"
! Request ID !! Reply ID !! Style !! Module !! Identification reply (first / second) !! How the module was identified
|-
| [[#0x7E0 ECM|0x7E0]] || 0x7E8 || KWP || ECM || 33980-78R0 / 33980-78RC* || Standard engine address
|-
| [[#0x261 ABS (inferred)|0x261]] || 0x661 || KWP || ABS (inferred) || 56100-77RA / 56100-78RF* || Only brake module left by elimination
|-
| [[#0x263 EPS controller|0x263]] || 0x663 || KWP || EPS controller || 38720-77R0 / 38720-77R0* || Parts catalogue (38720-77R01)
|-
| [[#0x271 Body control module|0x271]] || 0x671 || KWP || Body control module || 36775-77R0 / 36775-77RC* || Parts catalogue (36775-77RC2 to RC4)
|-
| [[#0x274 Instrument cluster|0x274]] || 0x674 || KWP || Instrument cluster || 34100-78R0 / 34110-78RD* || Rev counter sweep test
|-
| [[#0x798 TPMS controller|0x798]] || 0x7A8 || KWP || TPMS controller || 37160-61M0 / 37120-78R0* || Label (Model No. P61M0) and parts catalogue
|-
| [[#0x79A Combination switch (lighting and turn)|0x79A]] || 0x7AA || KWP || Combination switch (lighting and turn) || 37210-74PA / 37210-74PE* || Parts catalogue (37210-74PE2)
|-
| [[#0x778 Dual sensor brake support (inferred)|0x778]] || 0x788 || KWP || Dual sensor brake support (inferred) || 33990-52R0 / 33990-78R8* || By elimination
|-
| [[#0x793 Airbag (SRS) controller|0x793]] || 0x7A3 || UDS || Airbag (SRS) controller || 38910-77R0 / 38910-78RC* || Parts catalogue (38910-78RC0)
|-
| [[#0x772 4WD shift controller|0x772]] || 0x782 || UDS || 4WD shift controller || 38885-77R0 / 38885-78R0* || Parts catalogue (38885-78R01)
|-
| [[#0x799 E-call controller|0x799]] || 0x7A9 || UDS || E-call controller || 38960-78RA / 38960-78RA* || Parts catalogue (38960-78RA0, RA1)
|-
| [[#0x751 Central gateway|0x751]] || 0x761 || UDS || Central gateway || 33580-79R0 / 33580-78R0* || Label (33580-79R01) and parts catalogue
|}

Two more addresses, [[#Addresses probed with no reply|0x273 and 0x262]], were probed by the scan tool and did not answer.

The names marked "inferred" are guesses from elimination and part-number series, not confirmed by a label or test.

== 0x7E0 ECM ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x7E0</code>, reply <code>0x7E8</code>. This is the standard OBD engine address, so standard mode 01 PIDs should be available here, but none were captured.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33980-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33980-78RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || Read DTCs by status: none stored (captured)
|}

== 0x261 ABS (inferred) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x261</code>, reply <code>0x661</code>. The name is inferred: this is the only brake module left in the scan report after the others were matched, and 56100 looks like a brake part-number series. Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>56100-77RA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>56100-78RF*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x263 EPS controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x263</code>, reply <code>0x663</code>. Matches parts catalogue entry 38720-77R01 (EPS controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>38720-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>38720-77R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x271 Body control module ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x271</code>, reply <code>0x671</code>. Matches parts catalogue entries 36775-77RC2 to RC4 (body control module, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>36775-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>36775-77RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x274 Instrument cluster ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x274</code>, reply <code>0x674</code>. Confirmed by the rev counter sweep test.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> or <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s during the sweep test (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>34100-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>34110-78RD*</code> (last byte of the reply is <code>06</code>) || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the rev counter sweep (service 0x30, local ID 01, "short-term adjustment"). The cluster then sweeps up and down by itself (captured)
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"). Possibly a stop request sent after the sweep had finished (captured)
|}
The meaning of the four control bytes (<code>80 40 00 00</code>) is not known. Other output tests (gauges, warning lights) have not been captured.

== 0x798 TPMS controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x798</code>, reply <code>0x7A8</code>. The label on the module reads 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0 (Continental A2C13930301, 433.92 MHz). The full data layout, calibration and app setups are on [[OBD2 Diagnostics reading project]].
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification; matches Model No. P61M0 on the label (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> (no codes) or <code>58 01 9A 31 20</code> (one code) || DTCs by status. The code <code>9A 31</code> is probably the left front low pressure warning (inferred). The status byte was <code>20</code> in the full scan and <code>E0</code> in earlier captures (captured)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block: four sensor records with ID, temperature-like value and pressure. The scan tool repeats it about twice a second (captured, decoded)
|}
ELM327 setup that works for <code>21 00</code>: <code>ATSH798</code>, <code>ATS0</code>, <code>ATL0</code>, <code>ATFCSH798</code>, <code>ATFCSD300000</code>, <code>ATFCSM1</code>, then <code>2100</code>.

== 0x79A Combination switch (lighting and turn) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x79A</code>, reply <code>0x7AA</code>. Matches parts catalogue entry 37210-74PE2 (switch assembly, lighting and turn, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37210-74PA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37210-74PE*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x778 Dual sensor brake support (inferred) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x778</code>, reply <code>0x788</code>. The name is inferred by elimination (the scan report's last unassigned module). Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33990-52R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33990-78R8*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x793 Airbag (SRS) controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x793</code>, reply <code>0x7A3</code>. Matches parts catalogue entry 38910-78RC0 (airbag controller, VAN).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38910-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38910-78RC*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}

== 0x772 4WD shift controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x772</code>, reply <code>0x782</code>. Matches parts catalogue entry 38885-78R01 (4WD shift controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times by the scan tool (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38885-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38885-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The scan tool tried the KWP-style <code>3E</code> first and fell back to the UDS form <code>3E 00</code>.

== 0x799 E-call controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x799</code>, reply <code>0x7A9</code>. Matches parts catalogue entries 38960-78RA0 and RA1 (E-call controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38960-78RA</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38960-78RA*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B 92 4E 00 02</code> || One stored code record: <code>92 4E 00</code>, status <code>02</code>. The Launch report does not list it and its meaning is not known (captured)
|}

== 0x751 Central gateway ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x751</code>, reply <code>0x761</code>. The label on the module reads 33580-79R01.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>33580-79R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>33580-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The gateway sits between the OBD socket and the vehicle CAN bus. Whether it forwards requests to the other modules unchanged is not confirmed.

== Addresses probed with no reply ==
The scan tool sent tester-present (<code>3E</code>) about eight times each to <code>0x273</code> and <code>0x262</code> and received nothing from the expected reply IDs (<code>0x673</code> and <code>0x662</code>). They are probably modules this car does not have, such as an automatic transmission or auto-levelling controller. This is a guess.

== ELM327 notes ==
* Only <code>0x798</code> has been tested with an ELM327. For other modules, set <code>ATSH</code> to the request ID and <code>ATFCSH</code> to the same ID, and you may need <code>ATCRA</code> with the reply ID, because the reply is not always the request ID plus 8. This is untested.
* Replies from the 0x7xx modules are multi-frame for the identification strings, so the flow-control settings from the TPMS section probably apply there too. Untested.
* Do not send output-control commands (service <code>30</code> and similar) from a head-unit app while driving.

== Sources ==
* Owner PCAN-View captures of a Launch X431 CRP919 full health-check scan and rev counter sweep test, October 2026.
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* Labels on the TPMS controller and central gateway of the test car.

[[Category:Electrical - gen4]]

ECU diagnostic CAN addresses

2026-11-02T08:53:14Z

Mlines: /* Example usage */

<div style="border: 1px solid #c9a227; background-color: #fff8dc; padding: 0.6em 1em; margin: 0 0 1em 0; border-radius: 4px;">
'''Support this project:''' The information on this page is free, but it took a lot of work to gather, test and write up. If it has been useful to you, you can say thanks with a donation at [https://buymeacoffee.com/bigjimny buymeacoffee.com/bigjimny].
</div>

= Suzuki Jimny JB74 - CAN bus devices and the commands they answer =

'''Status:''' work in progress. This page lists every module that answered on the OBD socket (DLC) of one RHD UK-market 2021 Jimny, its request and reply CAN IDs, and the diagnostic commands seen so far. Many sections are short because only identification and fault-code requests have been captured. See [[OBD2 Diagnostics reading project]] for how the captures were made and for the TPMS data in detail.

== How to read this page ==
* All IDs are 11-bit CAN IDs on the OBD socket (pins 6 and 14, 500 kbit/s). The "request ID" is the header a tool sends to; the "reply ID" is where the module answers.
* Commands are shown as the payload bytes in hex, without the ISO-TP length byte. Replies longer than 7 bytes are sent as several frames; the tables show them reassembled.
* '''KWP-style''' modules use services such as <code>1A</code> (read ECU identification) and <code>18</code> (read DTCs by status). '''UDS-style''' modules use <code>22</code> (read data by identifier) and <code>19</code> (read DTCs).
* The reply ID is not always the request ID plus 8: the engine is +0x08, the 0x261 to 0x274 group is +0x400, and all others are +0x10.
* Identification strings are ASCII Suzuki part numbers. The first one in each module (<code>1A 8E</code> or <code>22 F1 01</code>) has no trailing character; the second (<code>1A 8A</code> or <code>22 F1 88</code>) ends in <code>*</code>. They do not always equal the number printed on the module's label.
* Commands marked ''captured'' were seen in a trace. Nothing here has been sent to a module by us except the TPMS requests.
=== Example usage ===
This example reads the TPMS controller (request ID 0x798) with an ELM327 adapter in a terminal app. Use a terminal that sends a carriage return (CR) at the end of each line, with the ignition on. Send the commands one at a time and wait for <code>OK</code> after each.

{| class="wikitable"
! Command !! Purpose
|-
| <code>ATZ</code> || Reset the adapter (prints the adapter version, not OK)
|-
| <code>ATSP6</code> || Use protocol 6: ISO 15765-4, 11-bit CAN, 500 kbit/s
|-
| <code>ATSH798</code> || Send requests to the TPMS controller ('''see device table above''')
|-
| <code>ATS0</code> || No spaces in the reply (stops one clone adapter overflowing its buffer)
|-
| <code>ATL0</code> || No line feeds in the reply
|-
| <code>ATFCSH798</code> || Send flow-control frames to 0x798 ('''see device table above''')
|-
| <code>ATFCSD300000</code> || Flow-control data <code>30 00 00</code>: continue, send all frames, no delay
|-
| <code>ATFCSM1</code> || Use the custom flow-control header and data above
|-
| <code>2100</code> || Request the sensor data block (service 0x21, identifier 0x00, '''see device specific tables below''')
|}

Example reply (generic ELM327 clone, ignition on, engine off):
<pre>
2100
066
0:610075010000
1:0000000000004E
2:AA094310397901
3:4900DD91B52520
4:3B880149004EAA
5:0319183C830249
6:004EAA09C9083C
7:83024900000000
8:004EAA09434EAA
9:09434EAA09434E
A:AA094373737373
B:7D7D7D7D000000
C:00000000000000
D:00000030222202
E:01801700000000
</pre>

Reading the reply:
* <code>066</code> is the total length in hex: 0x66 = 102 bytes. The lines <code>0:</code> to <code>E:</code> carry those bytes in order.
* The data starts <code>61 00</code> (positive reply to <code>21 00</code>). The next byte, <code>75</code> = 117, probably tracks system voltage (about 11.7 V, unconfirmed).
* Each wheel has a 10-byte record. Byte +6 of the record is the pressure; bar = raw x 0.01372.

{| class="wikitable"
! Wheel !! Record (hex) !! Byte +6 !! Raw !! Pressure
|-
| Front left || <code>4E AA 09 43 10 39 79 01 49 00</code> || <code>79</code> || 121 || 1.66 bar
|-
| Rear left || <code>DD 91 B5 25 20 3B 88 01 49 00</code> || <code>88</code> || 136 || 1.87 bar
|-
| Rear right || <code>4E AA 03 19 18 3C 83 02 49 00</code> || <code>83</code> || 131 || 1.80 bar
|-
| Front right || <code>4E AA 09 C9 08 3C 83 02 49 00</code> || <code>83</code> || 131 || 1.80 bar
|}

Notes:
* The sensor IDs, and the byte values, are from one car. Your IDs will differ, and the values change with pressure and temperature.
* <code>ATSH</code> and the <code>ATFC</code> settings last until the adapter is reset (<code>ATZ</code>) or loses power, so send them again after either.
* Without the <code>ATFC</code> lines, the clone adapter used here returned only the first line (<code>610075010000</code>).
* If the terminal prints <code>NO DATA</code>, check the ignition is on, that no other app is connected to the adapter, and that <code>ATSH798</code> was sent after the last reset.

== Device table ==
{| class="wikitable"
! Request ID !! Reply ID !! Style !! Module !! Identification reply (first / second) !! How the module was identified
|-
| [[#0x7E0 ECM|0x7E0]] || 0x7E8 || KWP || ECM || 33980-78R0 / 33980-78RC* || Standard engine address
|-
| [[#0x261 ABS (inferred)|0x261]] || 0x661 || KWP || ABS (inferred) || 56100-77RA / 56100-78RF* || Only brake module left by elimination
|-
| [[#0x263 EPS controller|0x263]] || 0x663 || KWP || EPS controller || 38720-77R0 / 38720-77R0* || Parts catalogue (38720-77R01)
|-
| [[#0x271 Body control module|0x271]] || 0x671 || KWP || Body control module || 36775-77R0 / 36775-77RC* || Parts catalogue (36775-77RC2 to RC4)
|-
| [[#0x274 Instrument cluster|0x274]] || 0x674 || KWP || Instrument cluster || 34100-78R0 / 34110-78RD* || Rev counter sweep test
|-
| [[#0x798 TPMS controller|0x798]] || 0x7A8 || KWP || TPMS controller || 37160-61M0 / 37120-78R0* || Label (Model No. P61M0) and parts catalogue
|-
| [[#0x79A Combination switch (lighting and turn)|0x79A]] || 0x7AA || KWP || Combination switch (lighting and turn) || 37210-74PA / 37210-74PE* || Parts catalogue (37210-74PE2)
|-
| [[#0x778 Dual sensor brake support (inferred)|0x778]] || 0x788 || KWP || Dual sensor brake support (inferred) || 33990-52R0 / 33990-78R8* || By elimination
|-
| [[#0x793 Airbag (SRS) controller|0x793]] || 0x7A3 || UDS || Airbag (SRS) controller || 38910-77R0 / 38910-78RC* || Parts catalogue (38910-78RC0)
|-
| [[#0x772 4WD shift controller|0x772]] || 0x782 || UDS || 4WD shift controller || 38885-77R0 / 38885-78R0* || Parts catalogue (38885-78R01)
|-
| [[#0x799 E-call controller|0x799]] || 0x7A9 || UDS || E-call controller || 38960-78RA / 38960-78RA* || Parts catalogue (38960-78RA0, RA1)
|-
| [[#0x751 Central gateway|0x751]] || 0x761 || UDS || Central gateway || 33580-79R0 / 33580-78R0* || Label (33580-79R01) and parts catalogue
|}

Two more addresses, [[#Addresses probed with no reply|0x273 and 0x262]], were probed by the scan tool and did not answer.

The names marked "inferred" are guesses from elimination and part-number series, not confirmed by a label or test.

== 0x7E0 ECM ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x7E0</code>, reply <code>0x7E8</code>. This is the standard OBD engine address, so standard mode 01 PIDs should be available here, but none were captured.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33980-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33980-78RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || Read DTCs by status: none stored (captured)
|}

== 0x261 ABS (inferred) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x261</code>, reply <code>0x661</code>. The name is inferred: this is the only brake module left in the scan report after the others were matched, and 56100 looks like a brake part-number series. Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>56100-77RA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>56100-78RF*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x263 EPS controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x263</code>, reply <code>0x663</code>. Matches parts catalogue entry 38720-77R01 (EPS controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>38720-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>38720-77R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x271 Body control module ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x271</code>, reply <code>0x671</code>. Matches parts catalogue entries 36775-77RC2 to RC4 (body control module, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>36775-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>36775-77RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x274 Instrument cluster ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x274</code>, reply <code>0x674</code>. Confirmed by the rev counter sweep test.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> or <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s during the sweep test (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>34100-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>34110-78RD*</code> (last byte of the reply is <code>06</code>) || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the rev counter sweep (service 0x30, local ID 01, "short-term adjustment"). The cluster then sweeps up and down by itself (captured)
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"). Possibly a stop request sent after the sweep had finished (captured)
|}
The meaning of the four control bytes (<code>80 40 00 00</code>) is not known. Other output tests (gauges, warning lights) have not been captured.

== 0x798 TPMS controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x798</code>, reply <code>0x7A8</code>. The label on the module reads 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0 (Continental A2C13930301, 433.92 MHz). The full data layout, calibration and app setups are on [[OBD2 Diagnostics reading project]].
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification; matches Model No. P61M0 on the label (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> (no codes) or <code>58 01 9A 31 20</code> (one code) || DTCs by status. The code <code>9A 31</code> is probably the left front low pressure warning (inferred). The status byte was <code>20</code> in the full scan and <code>E0</code> in earlier captures (captured)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block: four sensor records with ID, temperature-like value and pressure. The scan tool repeats it about twice a second (captured, decoded)
|}
ELM327 setup that works for <code>21 00</code>: <code>ATSH798</code>, <code>ATS0</code>, <code>ATL0</code>, <code>ATFCSH798</code>, <code>ATFCSD300000</code>, <code>ATFCSM1</code>, then <code>2100</code>.

== 0x79A Combination switch (lighting and turn) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x79A</code>, reply <code>0x7AA</code>. Matches parts catalogue entry 37210-74PE2 (switch assembly, lighting and turn, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37210-74PA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37210-74PE*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x778 Dual sensor brake support (inferred) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x778</code>, reply <code>0x788</code>. The name is inferred by elimination (the scan report's last unassigned module). Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33990-52R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33990-78R8*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x793 Airbag (SRS) controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x793</code>, reply <code>0x7A3</code>. Matches parts catalogue entry 38910-78RC0 (airbag controller, VAN).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38910-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38910-78RC*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}

== 0x772 4WD shift controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x772</code>, reply <code>0x782</code>. Matches parts catalogue entry 38885-78R01 (4WD shift controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times by the scan tool (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38885-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38885-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The scan tool tried the KWP-style <code>3E</code> first and fell back to the UDS form <code>3E 00</code>.

== 0x799 E-call controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x799</code>, reply <code>0x7A9</code>. Matches parts catalogue entries 38960-78RA0 and RA1 (E-call controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38960-78RA</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38960-78RA*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B 92 4E 00 02</code> || One stored code record: <code>92 4E 00</code>, status <code>02</code>. The Launch report does not list it and its meaning is not known (captured)
|}

== 0x751 Central gateway ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x751</code>, reply <code>0x761</code>. The label on the module reads 33580-79R01.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>33580-79R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>33580-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The gateway sits between the OBD socket and the vehicle CAN bus. Whether it forwards requests to the other modules unchanged is not confirmed.

== Addresses probed with no reply ==
The scan tool sent tester-present (<code>3E</code>) about eight times each to <code>0x273</code> and <code>0x262</code> and received nothing from the expected reply IDs (<code>0x673</code> and <code>0x662</code>). They are probably modules this car does not have, such as an automatic transmission or auto-levelling controller. This is a guess.

== ELM327 notes ==
* Only <code>0x798</code> has been tested with an ELM327. For other modules, set <code>ATSH</code> to the request ID and <code>ATFCSH</code> to the same ID, and you may need <code>ATCRA</code> with the reply ID, because the reply is not always the request ID plus 8. This is untested.
* Replies from the 0x7xx modules are multi-frame for the identification strings, so the flow-control settings from the TPMS section probably apply there too. Untested.
* Do not send output-control commands (service <code>30</code> and similar) from a head-unit app while driving.

== Sources ==
* Owner PCAN-View captures of a Launch X431 CRP919 full health-check scan and rev counter sweep test, October 2026.
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* Labels on the TPMS controller and central gateway of the test car.

[[Category:Electrical - gen4]]

ECU diagnostic CAN addresses

2026-11-02T08:52:46Z

Mlines: /* How to read this page */

<div style="border: 1px solid #c9a227; background-color: #fff8dc; padding: 0.6em 1em; margin: 0 0 1em 0; border-radius: 4px;">
'''Support this project:''' The information on this page is free, but it took a lot of work to gather, test and write up. If it has been useful to you, you can say thanks with a donation at [https://buymeacoffee.com/bigjimny buymeacoffee.com/bigjimny].
</div>

= Suzuki Jimny JB74 - CAN bus devices and the commands they answer =

'''Status:''' work in progress. This page lists every module that answered on the OBD socket (DLC) of one RHD UK-market 2021 Jimny, its request and reply CAN IDs, and the diagnostic commands seen so far. Many sections are short because only identification and fault-code requests have been captured. See [[OBD2 Diagnostics reading project]] for how the captures were made and for the TPMS data in detail.

== How to read this page ==
* All IDs are 11-bit CAN IDs on the OBD socket (pins 6 and 14, 500 kbit/s). The "request ID" is the header a tool sends to; the "reply ID" is where the module answers.
* Commands are shown as the payload bytes in hex, without the ISO-TP length byte. Replies longer than 7 bytes are sent as several frames; the tables show them reassembled.
* '''KWP-style''' modules use services such as <code>1A</code> (read ECU identification) and <code>18</code> (read DTCs by status). '''UDS-style''' modules use <code>22</code> (read data by identifier) and <code>19</code> (read DTCs).
* The reply ID is not always the request ID plus 8: the engine is +0x08, the 0x261 to 0x274 group is +0x400, and all others are +0x10.
* Identification strings are ASCII Suzuki part numbers. The first one in each module (<code>1A 8E</code> or <code>22 F1 01</code>) has no trailing character; the second (<code>1A 8A</code> or <code>22 F1 88</code>) ends in <code>*</code>. They do not always equal the number printed on the module's label.
* Commands marked ''captured'' were seen in a trace. Nothing here has been sent to a module by us except the TPMS requests.
=== Example usage ===
This example reads the TPMS controller (request ID 0x798) with an ELM327 adapter in a terminal app. Use a terminal that sends a carriage return (CR) at the end of each line, with the ignition on. Send the commands one at a time and wait for <code>OK</code> after each.

{| class="wikitable"
! Command !! Purpose
|-
| <code>ATZ</code> || Reset the adapter (prints the adapter version, not OK)
|-
| <code>ATSP6</code> || Use protocol 6: ISO 15765-4, 11-bit CAN, 500 kbit/s
|-
| <code>ATSH798</code> || Send requests to the TPMS controller ('''see device table above''')
|-
| <code>ATS0</code> || No spaces in the reply (stops one clone adapter overflowing its buffer)
|-
| <code>ATL0</code> || No line feeds in the reply
|-
| <code>ATFCSH798</code> || Send flow-control frames to 0x798
|-
| <code>ATFCSD300000</code> || Flow-control data <code>30 00 00</code>: continue, send all frames, no delay
|-
| <code>ATFCSM1</code> || Use the custom flow-control header and data above
|-
| <code>2100</code> || Request the sensor data block (service 0x21, identifier 0x00, '''see device specific tables below''')
|}

Example reply (generic ELM327 clone, ignition on, engine off):
<pre>
2100
066
0:610075010000
1:0000000000004E
2:AA094310397901
3:4900DD91B52520
4:3B880149004EAA
5:0319183C830249
6:004EAA09C9083C
7:83024900000000
8:004EAA09434EAA
9:09434EAA09434E
A:AA094373737373
B:7D7D7D7D000000
C:00000000000000
D:00000030222202
E:01801700000000
</pre>

Reading the reply:
* <code>066</code> is the total length in hex: 0x66 = 102 bytes. The lines <code>0:</code> to <code>E:</code> carry those bytes in order.
* The data starts <code>61 00</code> (positive reply to <code>21 00</code>). The next byte, <code>75</code> = 117, probably tracks system voltage (about 11.7 V, unconfirmed).
* Each wheel has a 10-byte record. Byte +6 of the record is the pressure; bar = raw x 0.01372.

{| class="wikitable"
! Wheel !! Record (hex) !! Byte +6 !! Raw !! Pressure
|-
| Front left || <code>4E AA 09 43 10 39 79 01 49 00</code> || <code>79</code> || 121 || 1.66 bar
|-
| Rear left || <code>DD 91 B5 25 20 3B 88 01 49 00</code> || <code>88</code> || 136 || 1.87 bar
|-
| Rear right || <code>4E AA 03 19 18 3C 83 02 49 00</code> || <code>83</code> || 131 || 1.80 bar
|-
| Front right || <code>4E AA 09 C9 08 3C 83 02 49 00</code> || <code>83</code> || 131 || 1.80 bar
|}

Notes:
* The sensor IDs, and the byte values, are from one car. Your IDs will differ, and the values change with pressure and temperature.
* <code>ATSH</code> and the <code>ATFC</code> settings last until the adapter is reset (<code>ATZ</code>) or loses power, so send them again after either.
* Without the <code>ATFC</code> lines, the clone adapter used here returned only the first line (<code>610075010000</code>).
* If the terminal prints <code>NO DATA</code>, check the ignition is on, that no other app is connected to the adapter, and that <code>ATSH798</code> was sent after the last reset.

== Device table ==
{| class="wikitable"
! Request ID !! Reply ID !! Style !! Module !! Identification reply (first / second) !! How the module was identified
|-
| [[#0x7E0 ECM|0x7E0]] || 0x7E8 || KWP || ECM || 33980-78R0 / 33980-78RC* || Standard engine address
|-
| [[#0x261 ABS (inferred)|0x261]] || 0x661 || KWP || ABS (inferred) || 56100-77RA / 56100-78RF* || Only brake module left by elimination
|-
| [[#0x263 EPS controller|0x263]] || 0x663 || KWP || EPS controller || 38720-77R0 / 38720-77R0* || Parts catalogue (38720-77R01)
|-
| [[#0x271 Body control module|0x271]] || 0x671 || KWP || Body control module || 36775-77R0 / 36775-77RC* || Parts catalogue (36775-77RC2 to RC4)
|-
| [[#0x274 Instrument cluster|0x274]] || 0x674 || KWP || Instrument cluster || 34100-78R0 / 34110-78RD* || Rev counter sweep test
|-
| [[#0x798 TPMS controller|0x798]] || 0x7A8 || KWP || TPMS controller || 37160-61M0 / 37120-78R0* || Label (Model No. P61M0) and parts catalogue
|-
| [[#0x79A Combination switch (lighting and turn)|0x79A]] || 0x7AA || KWP || Combination switch (lighting and turn) || 37210-74PA / 37210-74PE* || Parts catalogue (37210-74PE2)
|-
| [[#0x778 Dual sensor brake support (inferred)|0x778]] || 0x788 || KWP || Dual sensor brake support (inferred) || 33990-52R0 / 33990-78R8* || By elimination
|-
| [[#0x793 Airbag (SRS) controller|0x793]] || 0x7A3 || UDS || Airbag (SRS) controller || 38910-77R0 / 38910-78RC* || Parts catalogue (38910-78RC0)
|-
| [[#0x772 4WD shift controller|0x772]] || 0x782 || UDS || 4WD shift controller || 38885-77R0 / 38885-78R0* || Parts catalogue (38885-78R01)
|-
| [[#0x799 E-call controller|0x799]] || 0x7A9 || UDS || E-call controller || 38960-78RA / 38960-78RA* || Parts catalogue (38960-78RA0, RA1)
|-
| [[#0x751 Central gateway|0x751]] || 0x761 || UDS || Central gateway || 33580-79R0 / 33580-78R0* || Label (33580-79R01) and parts catalogue
|}

Two more addresses, [[#Addresses probed with no reply|0x273 and 0x262]], were probed by the scan tool and did not answer.

The names marked "inferred" are guesses from elimination and part-number series, not confirmed by a label or test.

== 0x7E0 ECM ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x7E0</code>, reply <code>0x7E8</code>. This is the standard OBD engine address, so standard mode 01 PIDs should be available here, but none were captured.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33980-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33980-78RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || Read DTCs by status: none stored (captured)
|}

== 0x261 ABS (inferred) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x261</code>, reply <code>0x661</code>. The name is inferred: this is the only brake module left in the scan report after the others were matched, and 56100 looks like a brake part-number series. Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>56100-77RA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>56100-78RF*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x263 EPS controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x263</code>, reply <code>0x663</code>. Matches parts catalogue entry 38720-77R01 (EPS controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>38720-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>38720-77R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x271 Body control module ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x271</code>, reply <code>0x671</code>. Matches parts catalogue entries 36775-77RC2 to RC4 (body control module, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>36775-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>36775-77RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x274 Instrument cluster ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x274</code>, reply <code>0x674</code>. Confirmed by the rev counter sweep test.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> or <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s during the sweep test (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>34100-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>34110-78RD*</code> (last byte of the reply is <code>06</code>) || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the rev counter sweep (service 0x30, local ID 01, "short-term adjustment"). The cluster then sweeps up and down by itself (captured)
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"). Possibly a stop request sent after the sweep had finished (captured)
|}
The meaning of the four control bytes (<code>80 40 00 00</code>) is not known. Other output tests (gauges, warning lights) have not been captured.

== 0x798 TPMS controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x798</code>, reply <code>0x7A8</code>. The label on the module reads 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0 (Continental A2C13930301, 433.92 MHz). The full data layout, calibration and app setups are on [[OBD2 Diagnostics reading project]].
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification; matches Model No. P61M0 on the label (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> (no codes) or <code>58 01 9A 31 20</code> (one code) || DTCs by status. The code <code>9A 31</code> is probably the left front low pressure warning (inferred). The status byte was <code>20</code> in the full scan and <code>E0</code> in earlier captures (captured)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block: four sensor records with ID, temperature-like value and pressure. The scan tool repeats it about twice a second (captured, decoded)
|}
ELM327 setup that works for <code>21 00</code>: <code>ATSH798</code>, <code>ATS0</code>, <code>ATL0</code>, <code>ATFCSH798</code>, <code>ATFCSD300000</code>, <code>ATFCSM1</code>, then <code>2100</code>.

== 0x79A Combination switch (lighting and turn) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x79A</code>, reply <code>0x7AA</code>. Matches parts catalogue entry 37210-74PE2 (switch assembly, lighting and turn, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37210-74PA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37210-74PE*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x778 Dual sensor brake support (inferred) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x778</code>, reply <code>0x788</code>. The name is inferred by elimination (the scan report's last unassigned module). Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33990-52R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33990-78R8*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x793 Airbag (SRS) controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x793</code>, reply <code>0x7A3</code>. Matches parts catalogue entry 38910-78RC0 (airbag controller, VAN).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38910-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38910-78RC*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}

== 0x772 4WD shift controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x772</code>, reply <code>0x782</code>. Matches parts catalogue entry 38885-78R01 (4WD shift controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times by the scan tool (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38885-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38885-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The scan tool tried the KWP-style <code>3E</code> first and fell back to the UDS form <code>3E 00</code>.

== 0x799 E-call controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x799</code>, reply <code>0x7A9</code>. Matches parts catalogue entries 38960-78RA0 and RA1 (E-call controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38960-78RA</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38960-78RA*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B 92 4E 00 02</code> || One stored code record: <code>92 4E 00</code>, status <code>02</code>. The Launch report does not list it and its meaning is not known (captured)
|}

== 0x751 Central gateway ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x751</code>, reply <code>0x761</code>. The label on the module reads 33580-79R01.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>33580-79R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>33580-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The gateway sits between the OBD socket and the vehicle CAN bus. Whether it forwards requests to the other modules unchanged is not confirmed.

== Addresses probed with no reply ==
The scan tool sent tester-present (<code>3E</code>) about eight times each to <code>0x273</code> and <code>0x262</code> and received nothing from the expected reply IDs (<code>0x673</code> and <code>0x662</code>). They are probably modules this car does not have, such as an automatic transmission or auto-levelling controller. This is a guess.

== ELM327 notes ==
* Only <code>0x798</code> has been tested with an ELM327. For other modules, set <code>ATSH</code> to the request ID and <code>ATFCSH</code> to the same ID, and you may need <code>ATCRA</code> with the reply ID, because the reply is not always the request ID plus 8. This is untested.
* Replies from the 0x7xx modules are multi-frame for the identification strings, so the flow-control settings from the TPMS section probably apply there too. Untested.
* Do not send output-control commands (service <code>30</code> and similar) from a head-unit app while driving.

== Sources ==
* Owner PCAN-View captures of a Launch X431 CRP919 full health-check scan and rev counter sweep test, October 2026.
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* Labels on the TPMS controller and central gateway of the test car.

[[Category:Electrical - gen4]]

OBD2 Diagnostics reading project

2026-11-01T11:28:10Z

Mlines: /* Sources */

= Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link =

{{Donate}}
== Overview ==
Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

=== Equipment ===
{| class="wikitable"
! Role !! Item
|-
| Head unit || XTRONS PX90
|-
| OBD-II Bluetooth dongle 1 || Generic ELM-based (Chinese)
|-
| OBD-II Bluetooth dongle 2 || Veepeak OBDCheck BLE+ (BLE only; works on a Lenovo tablet, will not connect to the head unit)
|-
| CAN bus monitor (Windows) || PCAN-View (PEAK-System)
|-
| Diagnostic tool 1 || Launch X431 CRP919
|-
| Diagnostic tool 2 || SZ Viewer app
|-
| Apps tried || Torque Pro (fails past the first line; tested on a Lenovo tablet), Car Scanner Pro (works), RealDash (TPMS values seen in its debug view; gauges in progress)
|-
| Head-unit Bluetooth || xTRONS IP90 - Classic Bluetooth only, no BLE support
|}

=== Method ===
# The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
# PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
# The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.
'''Status:''' work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures (including a full Launch scan and an instrument cluster test), the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC) and the Suzuki parts catalogue. TPMS readings work in Car Scanner Pro; RealDash works in its debug view with gauges in progress. Items marked ''unconfirmed'' are not yet verified.

* The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
* Request ID '''0x798''', reply ID '''0x7A8''' (11-bit CAN, 500 kbit/s, ISO-TP framing) returns the TPMS data, including four sensor IDs and pressure readings. The module's identification reply (37160-61M0) matches the Model No. (P61M0) on the TPMS controller label. Whether the central gateway forwards or remaps the request is unconfirmed.
* Service '''0x21''' (read data by local identifier), identifier '''0x00''', returns 102 bytes containing all four sensor records.
* Pressure is byte +6 of each sensor record: bar = raw x 0.01372.
* The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.
* Working: Car Scanner Pro, and RealDash (values seen in its debug view). Not working: Torque Pro.

== DLC (OBD socket) wiring ==
The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal ''n'' matches standard pin ''17 - n''.

{| class="wikitable"
! Manual terminal !! Standard pin !! Function !! Wire / source on diagram
|-
| 1 || 16 || Battery +12 V || GRY, fuse No.49 "DOME2" (10 A)
|-
| 12 || 5 || Signal ground || BLK
|-
| 13 || 4 || Chassis ground || BLK
|-
| 11 || 6 || CAN-H (from standard assignment) || BLU, gateway pin 8
|-
| 3 || 14 || CAN-L (from standard assignment) || WHT, gateway pin 7
|}

Use pins '''6''' and '''14''' for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

=== Cross-check with other reports ===
A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

* The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
* No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
* On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

== Network layout ==
The DLC is not on the vehicle bus directly. The '''central gateway control module''' joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

== Diagnostic requests seen ==
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
|-
| <code>18 00 FF 00</code> || <code>58 00</code> or <code>58 01 9A 31 E0</code> || Read DTCs by status (second form = one code reported; not decoded)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block (repeated about twice a second by the scan tool)
|}
Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The <code>1A 8E</code> reply (37160-61M0) matches the TPMS controller's base number and model number; the <code>1A 8A</code> reply (37120-78R0*) shares "78R0" with the full part number, but its meaning is not confirmed.

A Launch full scan reported "Left Front Tire Pressure Low" for the TPMS module, and the module returned one stored code (<code>9A 31</code>) in the same scan. That code is probably the low-pressure warning (inferred; the report does not show the code itself).

== Reading it with an ELM327 ==
Terminal commands, one at a time (CR line ending):
<pre>
ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100
</pre>
* <code>ATSH798</code> sets the request address. The reply address (0x7A8) is worked out automatically.
* <code>ATFCSH798 / ATFCSD300000 / ATFCSM1</code> make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
* <code>ATS0</code> removes the spaces between bytes. Without it, the generic Chinese ELM327-based dongle (dongle 1) reported <code>BUFFER FULL</code> near byte 81.
* Expected output: a length line (<code>066</code> = 102 bytes) and numbered lines <code>0:</code> to <code>E:</code>.
* With default settings dongle 1 returned only the first line (<code>61 00 xx 01 00 00</code>).

== Reply layout (21 00) ==
Byte positions count the <code>61</code> as byte 0.
{| class="wikitable"
! Bytes !! Content
|-
| 0-1 || <code>61 00</code> (positive reply)
|-
| 2 || Varies 117-142. Looks like system voltage x 10 (''unconfirmed'')
|-
| 12-21 || Sensor record 1: front left
|-
| 22-31 || Sensor record 2: rear left
|-
| 32-41 || Sensor record 3: rear right
|-
| 42-51 || Sensor record 4: front right
|-
| 56-71 || Four 4-byte sensor-ID entries whose contents change (meaning unknown)
|-
| other || Not decoded
|}

=== Sensor record (10 bytes) ===
{| class="wikitable"
! Offset !! Content
|-
| +0 to +3 || Sensor ID
|-
| +4 || Position flag
|-
| +5 || Value 57-74. Behaves like temperature, possibly with an offset of 40 (''unconfirmed'')
|-
| +6 || Pressure, gauge: bar = raw x 0.01372 (see Calibration)
|-
| +7, +8 || Not understood
|-
| +9 || Always 0
|}

{| class="wikitable"
! Wheel !! Sensor ID !! Position flag
|-
| Front left || 4E AA 09 43 || 0x10
|-
| Rear left || DD 91 B5 25 || 0x20
|-
| Rear right || 4E AA 03 19 || 0x18
|-
| Front right || 4E AA 09 C9 || 0x08
|}
Sensor IDs are specific to one car. Yours will differ.

== Calibration ==
Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.
{| class="wikitable"
! Raw !! Gauge (bar) !! Raw x 0.01372
|-
| 136 (rear left) || 1.868 || 1.866
|-
| 131 (rear right) || 1.795 || 1.797
|-
| 131 (front right) || 1.795 || 1.797
|-
| 126 || 1.73 || 1.729
|-
| 119 || 1.63 || 1.633
|-
| 112 || 1.54 || 1.537
|-
| 101 || 1.39 || 1.386
|-
| 96 || 1.29 || 1.317
|}
The last five rows are from one tyre, the front left, during a slow deflation.
* bar = raw x 0.01372
* psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

== Torque Pro custom PIDs ==
Common fields for every wheel:
{| class="wikitable"
! Field !! Value
|-
| Header || 798
|-
| Mode and PID || 2100
|-
| Diagnostic start command || <code>ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1</code> (comma-separated)
|-
| Unit / min / max || bar, 0, 4 (or psi, 0, 60)
|}

Equation uses a letter for each data byte. <code>A</code> is the first byte after <code>61 00</code> (reply byte 2).
{| class="wikitable"
! Wheel !! Byte +5 (temperature?) !! Byte +6 (pressure candidate)” to “Byte +6 (pressure)”
|-
| Front left || P || Q
|-
| Front right || AT || AU
|-
| Rear left || Z || AA
|-
| Rear right || AJ || AK
|}
Example: <code>Q*0.01372</code>. Letters must be upper case. Whether Torque accepts two-letter variables is ''unconfirmed''.

=== Known problem ===
Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on a Lenovo tablet, Torque read bytes <code>A</code> to <code>D</code> (first line of the reply) correctly, but every byte from <code>E</code> onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding <code>ATH1</code> changed the output). Tried without success: turning off "Faster communication" and removing <code>ATS0</code>. Not tried: <code>ATAT0, ATSTFF</code> timeout settings.

Dongle 2 (Veepeak OBDCheck BLE+), also on the tablet, gave the same result. Car Scanner Pro reads every byte with both dongles and the same commands, so the limitation is in how Torque Pro handles this multi-line reply, not in the adapter or the Android device. Unresolved; a request has been posted on the Torque forum.

== Car Scanner Pro (working) ==
Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:
* Header: 798
* Request: 2100
* Start command (backslash-separated): <code>ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1</code>
* Equations use the same letters as the table above, for example <code>Q*0.01372</code> for front left (bar)

The start command has not yet been shortened. Both dongle 1 (generic ELM327-based) and dongle 2 (Veepeak OBDCheck BLE+) work with Car Scanner Pro on the Lenovo tablet. Dongle 2 will not connect to the XTRONS head unit.

== RealDash ==
RealDash describes its OBD2 communication in an XML file. With dongle 1, RealDash's default init plus the lines below works: the TPMS sensors reply, and the values appear in RealDash's debug view. Dashboard gauges are in progress.

Changes to RealDash's default file:
* Add the three flow-control commands to the init section, before the <code>0100</code> and <code>0120</code> checks.
* Every TPMS command sets <code>header="atsh798"</code>. The docs say to set the header on every command when the rotation uses more than one. Any standard command in the same rotation then needs <code>header="atsh7df"</code>, or it would be sent to 0x798.
* RealDash requires <code>ATE0</code>, <code>ATL0</code> and <code>ATS0</code> (already in its default init).

<pre>
<init>
... RealDash default init lines ...
<command send="atfcsh798"></command>
<command send="atfcsd300000"></command>
<command send="atfcsm1"></command>
<command send="0100"></command>
<command send="0120"></command>
</init>
<rotation>
<command send="2100" header="atsh798" skipCount="10" keepInRotation="true" name="TPMS: front left" units="bar" conversionABC="Q*0.01372"></command>
<command send="2100" header="atsh798" skipCount="11" keepInRotation="true" name="TPMS: front right" units="bar" conversionABC="AU*0.01372"></command>
<command send="2100" header="atsh798" skipCount="12" keepInRotation="true" name="TPMS: rear left" units="bar" conversionABC="AA*0.01372"></command>
<command send="2100" header="atsh798" skipCount="13" keepInRotation="true" name="TPMS: rear right" units="bar" conversionABC="AK*0.01372"></command>
</rotation>
</pre>

<code>conversionABC</code> uses the same letters as Torque and Car Scanner (A is the first byte after 61 00). The TPMS inputs appear in RealDash's ECU Specific category.

The Veepeak OBDCheck BLE+ (dongle 2) will not connect to the head unit because the head unit does not support BLE, so only dongle 1 was used.

== Other modules found by a full scan ==
A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

{| class="wikitable"
! Request !! Reply !! Protocol !! Identification replies !! Module !! How identified
|-
| 0x7E0 || 0x7E8 || KWP || 33980-78R0, 33980-78RC* || ECM || Standard engine address
|-
| 0x261 || 0x661 || KWP || 56100-77RA, 56100-78RF* || ABS (inferred) || Only brake module left by elimination
|-
| 0x263 || 0x663 || KWP || 38720-77R0, 38720-77R0* || EPS controller || Parts catalogue
|-
| 0x271 || 0x671 || KWP || 36775-77R0, 36775-77RC* || Body control module || Parts catalogue
|-
| 0x274 || 0x674 || KWP || 34100-78R0, 34110-78RD* || Instrument cluster || Rev counter sweep test
|-
| 0x798 || 0x7A8 || KWP || 37160-61M0, 37120-78R0* || TPMS controller || Label and parts catalogue
|-
| 0x79A || 0x7AA || KWP || 37210-74PA, 37210-74PE* || Lighting and turn switch || Parts catalogue
|-
| 0x778 || 0x788 || KWP || 33990-52R0, 33990-78R8* || Dual sensor brake support || Parts catalogue
|-
| 0x793 || 0x7A3 || UDS || 38910-77R0, 38910-78RC* || Airbag (SRS) controller || Parts catalogue
|-
| 0x772 || 0x782 || UDS || 38885-77R0, 38885-78R0* || 4WD shift controller || Parts catalogue
|-
| 0x799 || 0x7A9 || UDS || 38960-78RA, 38960-78RA* || E-call controller || Parts catalogue
|-
| 0x751 || 0x761 || UDS || 33580-79R0, 33580-78R0* || Central gateway || Label and parts catalogue
|}
Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

* KWP-style modules answer <code>1A 8E</code> and <code>1A 8A</code> (identification) and <code>18 00 FF 00</code> (DTCs). UDS-style modules answer <code>22 F1 01</code> and <code>22 F1 88</code> (identification) and <code>19 02 FF</code> (DTCs).
* Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
* One name is still inferred and not confirmed by a part label: 0x261 (ABS). All the others come from the parts catalogue, a label, or a test.
* The E-call controller (0x799) returned a stored code record (<code>92 4E 00</code>, status 02) that the Launch report does not list. Its meaning is not known.

=== Instrument cluster output test (0x274 / 0x674) ===
A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:
{| class="wikitable"
! Request !! Reply !! Notes
|-
| <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished
|}
The meaning of the four control bytes (80 40 00 00) is not known.

* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A more reliable pressure scale (more gauge readings at low and high pressure are needed; the lowest calibration point is 0.027 bar off).
* Whether the central gateway forwards the request to the TPMS controller or remaps the address.
* Why Torque Pro stops after the first line of the reply (the adapter is ruled out).
* The meaning of the control bytes (80 40 00 00) in the instrument cluster sweep command.
* The meaning of the stored code from the E-call controller.
* Confirming the ABS (0x261) and dual sensor brake support (0x778) names.

== Open Questions ==
* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A more reliable pressure scale (more gauge readings at low and high pressure are needed; the lowest calibration point is 0.027 bar off).
* Whether the central gateway forwards the request to the TPMS controller or remaps the address.
* Why Torque Pro stops after the first line of the reply (the adapter is ruled out).
* The meaning of the control bytes (80 40 00 00) in the instrument cluster sweep command.
* The meaning of the stored code from the E-call controller.
* Confirming the ABS (0x261) name.

== Sources ==
* Owner PCAN-View captures, October 2026.
* Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
* Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
* BigJimny forum thread "JB74 OBD2 connection" (December 2020).
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* RealDash-extras OBD2 documentation (OBD2 XML description file).
* Car Scanner ELM OBD2 custom PID documentation.

[[Category:Jimny technical]]
[[Category:JB74]]
[[Category:Electrical - gen3]]
[[Category:FAQ - gen3]]
[[Category:Howto - gen3]]

[[Category:Electrical - gen4]]
[[Category:FAQ - gen4]]
[[Category:Howto - gen4]]

OBD2 Diagnostics reading project

2026-11-01T11:24:50Z

Mlines: /* Other modules found by a full scan */

= Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link =

{{Donate}}
== Overview ==
Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

=== Equipment ===
{| class="wikitable"
! Role !! Item
|-
| Head unit || XTRONS PX90
|-
| OBD-II Bluetooth dongle 1 || Generic ELM-based (Chinese)
|-
| OBD-II Bluetooth dongle 2 || Veepeak OBDCheck BLE+ (BLE only; works on a Lenovo tablet, will not connect to the head unit)
|-
| CAN bus monitor (Windows) || PCAN-View (PEAK-System)
|-
| Diagnostic tool 1 || Launch X431 CRP919
|-
| Diagnostic tool 2 || SZ Viewer app
|-
| Apps tried || Torque Pro (fails past the first line; tested on a Lenovo tablet), Car Scanner Pro (works), RealDash (TPMS values seen in its debug view; gauges in progress)
|-
| Head-unit Bluetooth || xTRONS IP90 - Classic Bluetooth only, no BLE support
|}

=== Method ===
# The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
# PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
# The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.
'''Status:''' work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures (including a full Launch scan and an instrument cluster test), the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC) and the Suzuki parts catalogue. TPMS readings work in Car Scanner Pro; RealDash works in its debug view with gauges in progress. Items marked ''unconfirmed'' are not yet verified.

* The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
* Request ID '''0x798''', reply ID '''0x7A8''' (11-bit CAN, 500 kbit/s, ISO-TP framing) returns the TPMS data, including four sensor IDs and pressure readings. The module's identification reply (37160-61M0) matches the Model No. (P61M0) on the TPMS controller label. Whether the central gateway forwards or remaps the request is unconfirmed.
* Service '''0x21''' (read data by local identifier), identifier '''0x00''', returns 102 bytes containing all four sensor records.
* Pressure is byte +6 of each sensor record: bar = raw x 0.01372.
* The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.
* Working: Car Scanner Pro, and RealDash (values seen in its debug view). Not working: Torque Pro.

== DLC (OBD socket) wiring ==
The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal ''n'' matches standard pin ''17 - n''.

{| class="wikitable"
! Manual terminal !! Standard pin !! Function !! Wire / source on diagram
|-
| 1 || 16 || Battery +12 V || GRY, fuse No.49 "DOME2" (10 A)
|-
| 12 || 5 || Signal ground || BLK
|-
| 13 || 4 || Chassis ground || BLK
|-
| 11 || 6 || CAN-H (from standard assignment) || BLU, gateway pin 8
|-
| 3 || 14 || CAN-L (from standard assignment) || WHT, gateway pin 7
|}

Use pins '''6''' and '''14''' for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

=== Cross-check with other reports ===
A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

* The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
* No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
* On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

== Network layout ==
The DLC is not on the vehicle bus directly. The '''central gateway control module''' joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

== Diagnostic requests seen ==
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
|-
| <code>18 00 FF 00</code> || <code>58 00</code> or <code>58 01 9A 31 E0</code> || Read DTCs by status (second form = one code reported; not decoded)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block (repeated about twice a second by the scan tool)
|}
Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The <code>1A 8E</code> reply (37160-61M0) matches the TPMS controller's base number and model number; the <code>1A 8A</code> reply (37120-78R0*) shares "78R0" with the full part number, but its meaning is not confirmed.

A Launch full scan reported "Left Front Tire Pressure Low" for the TPMS module, and the module returned one stored code (<code>9A 31</code>) in the same scan. That code is probably the low-pressure warning (inferred; the report does not show the code itself).

== Reading it with an ELM327 ==
Terminal commands, one at a time (CR line ending):
<pre>
ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100
</pre>
* <code>ATSH798</code> sets the request address. The reply address (0x7A8) is worked out automatically.
* <code>ATFCSH798 / ATFCSD300000 / ATFCSM1</code> make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
* <code>ATS0</code> removes the spaces between bytes. Without it, the generic Chinese ELM327-based dongle (dongle 1) reported <code>BUFFER FULL</code> near byte 81.
* Expected output: a length line (<code>066</code> = 102 bytes) and numbered lines <code>0:</code> to <code>E:</code>.
* With default settings dongle 1 returned only the first line (<code>61 00 xx 01 00 00</code>).

== Reply layout (21 00) ==
Byte positions count the <code>61</code> as byte 0.
{| class="wikitable"
! Bytes !! Content
|-
| 0-1 || <code>61 00</code> (positive reply)
|-
| 2 || Varies 117-142. Looks like system voltage x 10 (''unconfirmed'')
|-
| 12-21 || Sensor record 1: front left
|-
| 22-31 || Sensor record 2: rear left
|-
| 32-41 || Sensor record 3: rear right
|-
| 42-51 || Sensor record 4: front right
|-
| 56-71 || Four 4-byte sensor-ID entries whose contents change (meaning unknown)
|-
| other || Not decoded
|}

=== Sensor record (10 bytes) ===
{| class="wikitable"
! Offset !! Content
|-
| +0 to +3 || Sensor ID
|-
| +4 || Position flag
|-
| +5 || Value 57-74. Behaves like temperature, possibly with an offset of 40 (''unconfirmed'')
|-
| +6 || Pressure, gauge: bar = raw x 0.01372 (see Calibration)
|-
| +7, +8 || Not understood
|-
| +9 || Always 0
|}

{| class="wikitable"
! Wheel !! Sensor ID !! Position flag
|-
| Front left || 4E AA 09 43 || 0x10
|-
| Rear left || DD 91 B5 25 || 0x20
|-
| Rear right || 4E AA 03 19 || 0x18
|-
| Front right || 4E AA 09 C9 || 0x08
|}
Sensor IDs are specific to one car. Yours will differ.

== Calibration ==
Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.
{| class="wikitable"
! Raw !! Gauge (bar) !! Raw x 0.01372
|-
| 136 (rear left) || 1.868 || 1.866
|-
| 131 (rear right) || 1.795 || 1.797
|-
| 131 (front right) || 1.795 || 1.797
|-
| 126 || 1.73 || 1.729
|-
| 119 || 1.63 || 1.633
|-
| 112 || 1.54 || 1.537
|-
| 101 || 1.39 || 1.386
|-
| 96 || 1.29 || 1.317
|}
The last five rows are from one tyre, the front left, during a slow deflation.
* bar = raw x 0.01372
* psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

== Torque Pro custom PIDs ==
Common fields for every wheel:
{| class="wikitable"
! Field !! Value
|-
| Header || 798
|-
| Mode and PID || 2100
|-
| Diagnostic start command || <code>ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1</code> (comma-separated)
|-
| Unit / min / max || bar, 0, 4 (or psi, 0, 60)
|}

Equation uses a letter for each data byte. <code>A</code> is the first byte after <code>61 00</code> (reply byte 2).
{| class="wikitable"
! Wheel !! Byte +5 (temperature?) !! Byte +6 (pressure candidate)” to “Byte +6 (pressure)”
|-
| Front left || P || Q
|-
| Front right || AT || AU
|-
| Rear left || Z || AA
|-
| Rear right || AJ || AK
|}
Example: <code>Q*0.01372</code>. Letters must be upper case. Whether Torque accepts two-letter variables is ''unconfirmed''.

=== Known problem ===
Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on a Lenovo tablet, Torque read bytes <code>A</code> to <code>D</code> (first line of the reply) correctly, but every byte from <code>E</code> onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding <code>ATH1</code> changed the output). Tried without success: turning off "Faster communication" and removing <code>ATS0</code>. Not tried: <code>ATAT0, ATSTFF</code> timeout settings.

Dongle 2 (Veepeak OBDCheck BLE+), also on the tablet, gave the same result. Car Scanner Pro reads every byte with both dongles and the same commands, so the limitation is in how Torque Pro handles this multi-line reply, not in the adapter or the Android device. Unresolved; a request has been posted on the Torque forum.

== Car Scanner Pro (working) ==
Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:
* Header: 798
* Request: 2100
* Start command (backslash-separated): <code>ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1</code>
* Equations use the same letters as the table above, for example <code>Q*0.01372</code> for front left (bar)

The start command has not yet been shortened. Both dongle 1 (generic ELM327-based) and dongle 2 (Veepeak OBDCheck BLE+) work with Car Scanner Pro on the Lenovo tablet. Dongle 2 will not connect to the XTRONS head unit.

== RealDash ==
RealDash describes its OBD2 communication in an XML file. With dongle 1, RealDash's default init plus the lines below works: the TPMS sensors reply, and the values appear in RealDash's debug view. Dashboard gauges are in progress.

Changes to RealDash's default file:
* Add the three flow-control commands to the init section, before the <code>0100</code> and <code>0120</code> checks.
* Every TPMS command sets <code>header="atsh798"</code>. The docs say to set the header on every command when the rotation uses more than one. Any standard command in the same rotation then needs <code>header="atsh7df"</code>, or it would be sent to 0x798.
* RealDash requires <code>ATE0</code>, <code>ATL0</code> and <code>ATS0</code> (already in its default init).

<pre>
<init>
... RealDash default init lines ...
<command send="atfcsh798"></command>
<command send="atfcsd300000"></command>
<command send="atfcsm1"></command>
<command send="0100"></command>
<command send="0120"></command>
</init>
<rotation>
<command send="2100" header="atsh798" skipCount="10" keepInRotation="true" name="TPMS: front left" units="bar" conversionABC="Q*0.01372"></command>
<command send="2100" header="atsh798" skipCount="11" keepInRotation="true" name="TPMS: front right" units="bar" conversionABC="AU*0.01372"></command>
<command send="2100" header="atsh798" skipCount="12" keepInRotation="true" name="TPMS: rear left" units="bar" conversionABC="AA*0.01372"></command>
<command send="2100" header="atsh798" skipCount="13" keepInRotation="true" name="TPMS: rear right" units="bar" conversionABC="AK*0.01372"></command>
</rotation>
</pre>

<code>conversionABC</code> uses the same letters as Torque and Car Scanner (A is the first byte after 61 00). The TPMS inputs appear in RealDash's ECU Specific category.

The Veepeak OBDCheck BLE+ (dongle 2) will not connect to the head unit because the head unit does not support BLE, so only dongle 1 was used.

== Other modules found by a full scan ==
A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

{| class="wikitable"
! Request !! Reply !! Protocol !! Identification replies !! Module !! How identified
|-
| 0x7E0 || 0x7E8 || KWP || 33980-78R0, 33980-78RC* || ECM || Standard engine address
|-
| 0x261 || 0x661 || KWP || 56100-77RA, 56100-78RF* || ABS (inferred) || Only brake module left by elimination
|-
| 0x263 || 0x663 || KWP || 38720-77R0, 38720-77R0* || EPS controller || Parts catalogue
|-
| 0x271 || 0x671 || KWP || 36775-77R0, 36775-77RC* || Body control module || Parts catalogue
|-
| 0x274 || 0x674 || KWP || 34100-78R0, 34110-78RD* || Instrument cluster || Rev counter sweep test
|-
| 0x798 || 0x7A8 || KWP || 37160-61M0, 37120-78R0* || TPMS controller || Label and parts catalogue
|-
| 0x79A || 0x7AA || KWP || 37210-74PA, 37210-74PE* || Lighting and turn switch || Parts catalogue
|-
| 0x778 || 0x788 || KWP || 33990-52R0, 33990-78R8* || Dual sensor brake support || Parts catalogue
|-
| 0x793 || 0x7A3 || UDS || 38910-77R0, 38910-78RC* || Airbag (SRS) controller || Parts catalogue
|-
| 0x772 || 0x782 || UDS || 38885-77R0, 38885-78R0* || 4WD shift controller || Parts catalogue
|-
| 0x799 || 0x7A9 || UDS || 38960-78RA, 38960-78RA* || E-call controller || Parts catalogue
|-
| 0x751 || 0x761 || UDS || 33580-79R0, 33580-78R0* || Central gateway || Label and parts catalogue
|}
Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

* KWP-style modules answer <code>1A 8E</code> and <code>1A 8A</code> (identification) and <code>18 00 FF 00</code> (DTCs). UDS-style modules answer <code>22 F1 01</code> and <code>22 F1 88</code> (identification) and <code>19 02 FF</code> (DTCs).
* Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
* One name is still inferred and not confirmed by a part label: 0x261 (ABS). All the others come from the parts catalogue, a label, or a test.
* The E-call controller (0x799) returned a stored code record (<code>92 4E 00</code>, status 02) that the Launch report does not list. Its meaning is not known.

=== Instrument cluster output test (0x274 / 0x674) ===
A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:
{| class="wikitable"
! Request !! Reply !! Notes
|-
| <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished
|}
The meaning of the four control bytes (80 40 00 00) is not known.

* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A more reliable pressure scale (more gauge readings at low and high pressure are needed; the lowest calibration point is 0.027 bar off).
* Whether the central gateway forwards the request to the TPMS controller or remaps the address.
* Why Torque Pro stops after the first line of the reply (the adapter is ruled out).
* The meaning of the control bytes (80 40 00 00) in the instrument cluster sweep command.
* The meaning of the stored code from the E-call controller.
* Confirming the ABS (0x261) and dual sensor brake support (0x778) names.

== Sources ==
* Owner PCAN-View captures, October 2026.
* Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
* Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
* BigJimny forum thread "JB74 OBD2 connection" (December 2020).
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* RealDash-extras OBD2 documentation (OBD2 XML description file).
* Car Scanner ELM OBD2 custom PID documentation.

[[Category:Jimny technical]]
[[Category:JB74]]
[[Category:Electrical - gen3]]
[[Category:FAQ - gen3]]
[[Category:Howto - gen3]]

[[Category:Electrical - gen4]]
[[Category:FAQ - gen4]]
[[Category:Howto - gen4]]

OBD2 Diagnostics reading project

2026-11-01T10:53:43Z

Mlines: /* Car Scanner Pro (working) */

= Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link =

{{Donate}}
== Overview ==
Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

=== Equipment ===
{| class="wikitable"
! Role !! Item
|-
| Head unit || XTRONS PX90
|-
| OBD-II Bluetooth dongle 1 || Generic ELM-based (Chinese)
|-
| OBD-II Bluetooth dongle 2 || Veepeak OBDCheck BLE+ (BLE only; works on a Lenovo tablet, will not connect to the head unit)
|-
| CAN bus monitor (Windows) || PCAN-View (PEAK-System)
|-
| Diagnostic tool 1 || Launch X431 CRP919
|-
| Diagnostic tool 2 || SZ Viewer app
|-
| Apps tried || Torque Pro (fails past the first line; tested on a Lenovo tablet), Car Scanner Pro (works), RealDash (TPMS values seen in its debug view; gauges in progress)
|-
| Head-unit Bluetooth || xTRONS IP90 - Classic Bluetooth only, no BLE support
|}

=== Method ===
# The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
# PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
# The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.
'''Status:''' work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures (including a full Launch scan and an instrument cluster test), the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC) and the Suzuki parts catalogue. TPMS readings work in Car Scanner Pro; RealDash works in its debug view with gauges in progress. Items marked ''unconfirmed'' are not yet verified.

* The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
* Request ID '''0x798''', reply ID '''0x7A8''' (11-bit CAN, 500 kbit/s, ISO-TP framing) returns the TPMS data, including four sensor IDs and pressure readings. The module's identification reply (37160-61M0) matches the Model No. (P61M0) on the TPMS controller label. Whether the central gateway forwards or remaps the request is unconfirmed.
* Service '''0x21''' (read data by local identifier), identifier '''0x00''', returns 102 bytes containing all four sensor records.
* Pressure is byte +6 of each sensor record: bar = raw x 0.01372.
* The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.
* Working: Car Scanner Pro, and RealDash (values seen in its debug view). Not working: Torque Pro.

== DLC (OBD socket) wiring ==
The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal ''n'' matches standard pin ''17 - n''.

{| class="wikitable"
! Manual terminal !! Standard pin !! Function !! Wire / source on diagram
|-
| 1 || 16 || Battery +12 V || GRY, fuse No.49 "DOME2" (10 A)
|-
| 12 || 5 || Signal ground || BLK
|-
| 13 || 4 || Chassis ground || BLK
|-
| 11 || 6 || CAN-H (from standard assignment) || BLU, gateway pin 8
|-
| 3 || 14 || CAN-L (from standard assignment) || WHT, gateway pin 7
|}

Use pins '''6''' and '''14''' for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

=== Cross-check with other reports ===
A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

* The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
* No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
* On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

== Network layout ==
The DLC is not on the vehicle bus directly. The '''central gateway control module''' joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

== Diagnostic requests seen ==
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
|-
| <code>18 00 FF 00</code> || <code>58 00</code> or <code>58 01 9A 31 E0</code> || Read DTCs by status (second form = one code reported; not decoded)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block (repeated about twice a second by the scan tool)
|}
Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The <code>1A 8E</code> reply (37160-61M0) matches the TPMS controller's base number and model number; the <code>1A 8A</code> reply (37120-78R0*) shares "78R0" with the full part number, but its meaning is not confirmed.

A Launch full scan reported "Left Front Tire Pressure Low" for the TPMS module, and the module returned one stored code (<code>9A 31</code>) in the same scan. That code is probably the low-pressure warning (inferred; the report does not show the code itself).

== Reading it with an ELM327 ==
Terminal commands, one at a time (CR line ending):
<pre>
ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100
</pre>
* <code>ATSH798</code> sets the request address. The reply address (0x7A8) is worked out automatically.
* <code>ATFCSH798 / ATFCSD300000 / ATFCSM1</code> make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
* <code>ATS0</code> removes the spaces between bytes. Without it, the generic Chinese ELM327-based dongle (dongle 1) reported <code>BUFFER FULL</code> near byte 81.
* Expected output: a length line (<code>066</code> = 102 bytes) and numbered lines <code>0:</code> to <code>E:</code>.
* With default settings dongle 1 returned only the first line (<code>61 00 xx 01 00 00</code>).

== Reply layout (21 00) ==
Byte positions count the <code>61</code> as byte 0.
{| class="wikitable"
! Bytes !! Content
|-
| 0-1 || <code>61 00</code> (positive reply)
|-
| 2 || Varies 117-142. Looks like system voltage x 10 (''unconfirmed'')
|-
| 12-21 || Sensor record 1: front left
|-
| 22-31 || Sensor record 2: rear left
|-
| 32-41 || Sensor record 3: rear right
|-
| 42-51 || Sensor record 4: front right
|-
| 56-71 || Four 4-byte sensor-ID entries whose contents change (meaning unknown)
|-
| other || Not decoded
|}

=== Sensor record (10 bytes) ===
{| class="wikitable"
! Offset !! Content
|-
| +0 to +3 || Sensor ID
|-
| +4 || Position flag
|-
| +5 || Value 57-74. Behaves like temperature, possibly with an offset of 40 (''unconfirmed'')
|-
| +6 || Pressure, gauge: bar = raw x 0.01372 (see Calibration)
|-
| +7, +8 || Not understood
|-
| +9 || Always 0
|}

{| class="wikitable"
! Wheel !! Sensor ID !! Position flag
|-
| Front left || 4E AA 09 43 || 0x10
|-
| Rear left || DD 91 B5 25 || 0x20
|-
| Rear right || 4E AA 03 19 || 0x18
|-
| Front right || 4E AA 09 C9 || 0x08
|}
Sensor IDs are specific to one car. Yours will differ.

== Calibration ==
Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.
{| class="wikitable"
! Raw !! Gauge (bar) !! Raw x 0.01372
|-
| 136 (rear left) || 1.868 || 1.866
|-
| 131 (rear right) || 1.795 || 1.797
|-
| 131 (front right) || 1.795 || 1.797
|-
| 126 || 1.73 || 1.729
|-
| 119 || 1.63 || 1.633
|-
| 112 || 1.54 || 1.537
|-
| 101 || 1.39 || 1.386
|-
| 96 || 1.29 || 1.317
|}
The last five rows are from one tyre, the front left, during a slow deflation.
* bar = raw x 0.01372
* psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

== Torque Pro custom PIDs ==
Common fields for every wheel:
{| class="wikitable"
! Field !! Value
|-
| Header || 798
|-
| Mode and PID || 2100
|-
| Diagnostic start command || <code>ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1</code> (comma-separated)
|-
| Unit / min / max || bar, 0, 4 (or psi, 0, 60)
|}

Equation uses a letter for each data byte. <code>A</code> is the first byte after <code>61 00</code> (reply byte 2).
{| class="wikitable"
! Wheel !! Byte +5 (temperature?) !! Byte +6 (pressure candidate)” to “Byte +6 (pressure)”
|-
| Front left || P || Q
|-
| Front right || AT || AU
|-
| Rear left || Z || AA
|-
| Rear right || AJ || AK
|}
Example: <code>Q*0.01372</code>. Letters must be upper case. Whether Torque accepts two-letter variables is ''unconfirmed''.

=== Known problem ===
Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on a Lenovo tablet, Torque read bytes <code>A</code> to <code>D</code> (first line of the reply) correctly, but every byte from <code>E</code> onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding <code>ATH1</code> changed the output). Tried without success: turning off "Faster communication" and removing <code>ATS0</code>. Not tried: <code>ATAT0, ATSTFF</code> timeout settings.

Dongle 2 (Veepeak OBDCheck BLE+), also on the tablet, gave the same result. Car Scanner Pro reads every byte with both dongles and the same commands, so the limitation is in how Torque Pro handles this multi-line reply, not in the adapter or the Android device. Unresolved; a request has been posted on the Torque forum.

== Car Scanner Pro (working) ==
Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:
* Header: 798
* Request: 2100
* Start command (backslash-separated): <code>ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1</code>
* Equations use the same letters as the table above, for example <code>Q*0.01372</code> for front left (bar)

The start command has not yet been shortened. Both dongle 1 (generic ELM327-based) and dongle 2 (Veepeak OBDCheck BLE+) work with Car Scanner Pro on the Lenovo tablet. Dongle 2 will not connect to the XTRONS head unit.

== RealDash ==
RealDash describes its OBD2 communication in an XML file. With dongle 1, RealDash's default init plus the lines below works: the TPMS sensors reply, and the values appear in RealDash's debug view. Dashboard gauges are in progress.

Changes to RealDash's default file:
* Add the three flow-control commands to the init section, before the <code>0100</code> and <code>0120</code> checks.
* Every TPMS command sets <code>header="atsh798"</code>. The docs say to set the header on every command when the rotation uses more than one. Any standard command in the same rotation then needs <code>header="atsh7df"</code>, or it would be sent to 0x798.
* RealDash requires <code>ATE0</code>, <code>ATL0</code> and <code>ATS0</code> (already in its default init).

<pre>
<init>
... RealDash default init lines ...
<command send="atfcsh798"></command>
<command send="atfcsd300000"></command>
<command send="atfcsm1"></command>
<command send="0100"></command>
<command send="0120"></command>
</init>
<rotation>
<command send="2100" header="atsh798" skipCount="10" keepInRotation="true" name="TPMS: front left" units="bar" conversionABC="Q*0.01372"></command>
<command send="2100" header="atsh798" skipCount="11" keepInRotation="true" name="TPMS: front right" units="bar" conversionABC="AU*0.01372"></command>
<command send="2100" header="atsh798" skipCount="12" keepInRotation="true" name="TPMS: rear left" units="bar" conversionABC="AA*0.01372"></command>
<command send="2100" header="atsh798" skipCount="13" keepInRotation="true" name="TPMS: rear right" units="bar" conversionABC="AK*0.01372"></command>
</rotation>
</pre>

<code>conversionABC</code> uses the same letters as Torque and Car Scanner (A is the first byte after 61 00). The TPMS inputs appear in RealDash's ECU Specific category.

The Veepeak OBDCheck BLE+ (dongle 2) will not connect to the head unit because the head unit does not support BLE, so only dongle 1 was used.

== Other modules found by a full scan ==
A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

{| class="wikitable"
! Request !! Reply !! Protocol !! Identification replies !! Module !! How identified
|-
| 0x7E0 || 0x7E8 || KWP || 33980-78R0, 33980-78RC* || ECM || Standard engine address
|-
| 0x261 || 0x661 || KWP || 56100-77RA, 56100-78RF* || ABS (inferred) || Only brake module left by elimination
|-
| 0x263 || 0x663 || KWP || 38720-77R0, 38720-77R0* || EPS controller || Parts catalogue
|-
| 0x271 || 0x671 || KWP || 36775-77R0, 36775-77RC* || Body control module || Parts catalogue
|-
| 0x274 || 0x674 || KWP || 34100-78R0, 34110-78RD* || Instrument cluster || Rev counter sweep test
|-
| 0x798 || 0x7A8 || KWP || 37160-61M0, 37120-78R0* || TPMS controller || Label and parts catalogue
|-
| 0x79A || 0x7AA || KWP || 37210-74PA, 37210-74PE* || Lighting and turn switch || Parts catalogue
|-
| 0x778 || 0x788 || KWP || 33990-52R0, 33990-78R8* || Dual sensor brake support || Parts catalogue
|-
| 0x793 || 0x7A3 || UDS || 38910-77R0, 38910-78RC* || Airbag (SRS) controller || Parts catalogue
|-
| 0x772 || 0x782 || UDS || 38885-77R0, 38885-78R0* || 4WD shift controller || Parts catalogue
|-
| 0x799 || 0x7A9 || UDS || 38960-78RA, 38960-78RA* || E-call controller || Parts catalogue
|-
| 0x751 || 0x761 || UDS || 33580-79R0, 33580-78R0* || Central gateway || Label and parts catalogue
|}
Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

* KWP-style modules answer <code>1A 8E</code> and <code>1A 8A</code> (identification) and <code>18 00 FF 00</code> (DTCs). UDS-style modules answer <code>22 F1 01</code> and <code>22 F1 88</code> (identification) and <code>19 02 FF</code> (DTCs).
* Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
* Two names are inferred and not confirmed by a part label: 0x261 (ABS) and 0x778 (dual sensor brake support). All the others come from the parts catalogue, a label, or a test.
* The E-call controller (0x799) returned a stored code record (<code>92 4E 00</code>, status 02) that the Launch report does not list. Its meaning is not known.

=== Instrument cluster output test (0x274 / 0x674) ===
A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:
{| class="wikitable"
! Request !! Reply !! Notes
|-
| <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished
|}
The meaning of the four control bytes (80 40 00 00) is not known.

* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A more reliable pressure scale (more gauge readings at low and high pressure are needed; the lowest calibration point is 0.027 bar off).
* Whether the central gateway forwards the request to the TPMS controller or remaps the address.
* Why Torque Pro stops after the first line of the reply (the adapter is ruled out).
* The meaning of the control bytes (80 40 00 00) in the instrument cluster sweep command.
* The meaning of the stored code from the E-call controller.
* Confirming the ABS (0x261) and dual sensor brake support (0x778) names.

== Sources ==
* Owner PCAN-View captures, October 2026.
* Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
* Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
* BigJimny forum thread "JB74 OBD2 connection" (December 2020).
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* RealDash-extras OBD2 documentation (OBD2 XML description file).
* Car Scanner ELM OBD2 custom PID documentation.

[[Category:Jimny technical]]
[[Category:JB74]]
[[Category:Electrical - gen3]]
[[Category:FAQ - gen3]]
[[Category:Howto - gen3]]

[[Category:Electrical - gen4]]
[[Category:FAQ - gen4]]
[[Category:Howto - gen4]]

OBD2 Diagnostics reading project

2026-11-01T10:53:08Z

Mlines: /* Equipment */

= Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link =

{{Donate}}
== Overview ==
Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

=== Equipment ===
{| class="wikitable"
! Role !! Item
|-
| Head unit || XTRONS PX90
|-
| OBD-II Bluetooth dongle 1 || Generic ELM-based (Chinese)
|-
| OBD-II Bluetooth dongle 2 || Veepeak OBDCheck BLE+ (BLE only; works on a Lenovo tablet, will not connect to the head unit)
|-
| CAN bus monitor (Windows) || PCAN-View (PEAK-System)
|-
| Diagnostic tool 1 || Launch X431 CRP919
|-
| Diagnostic tool 2 || SZ Viewer app
|-
| Apps tried || Torque Pro (fails past the first line; tested on a Lenovo tablet), Car Scanner Pro (works), RealDash (TPMS values seen in its debug view; gauges in progress)
|-
| Head-unit Bluetooth || xTRONS IP90 - Classic Bluetooth only, no BLE support
|}

=== Method ===
# The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
# PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
# The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.
'''Status:''' work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures (including a full Launch scan and an instrument cluster test), the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC) and the Suzuki parts catalogue. TPMS readings work in Car Scanner Pro; RealDash works in its debug view with gauges in progress. Items marked ''unconfirmed'' are not yet verified.

* The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
* Request ID '''0x798''', reply ID '''0x7A8''' (11-bit CAN, 500 kbit/s, ISO-TP framing) returns the TPMS data, including four sensor IDs and pressure readings. The module's identification reply (37160-61M0) matches the Model No. (P61M0) on the TPMS controller label. Whether the central gateway forwards or remaps the request is unconfirmed.
* Service '''0x21''' (read data by local identifier), identifier '''0x00''', returns 102 bytes containing all four sensor records.
* Pressure is byte +6 of each sensor record: bar = raw x 0.01372.
* The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.
* Working: Car Scanner Pro, and RealDash (values seen in its debug view). Not working: Torque Pro.

== DLC (OBD socket) wiring ==
The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal ''n'' matches standard pin ''17 - n''.

{| class="wikitable"
! Manual terminal !! Standard pin !! Function !! Wire / source on diagram
|-
| 1 || 16 || Battery +12 V || GRY, fuse No.49 "DOME2" (10 A)
|-
| 12 || 5 || Signal ground || BLK
|-
| 13 || 4 || Chassis ground || BLK
|-
| 11 || 6 || CAN-H (from standard assignment) || BLU, gateway pin 8
|-
| 3 || 14 || CAN-L (from standard assignment) || WHT, gateway pin 7
|}

Use pins '''6''' and '''14''' for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

=== Cross-check with other reports ===
A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

* The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
* No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
* On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

== Network layout ==
The DLC is not on the vehicle bus directly. The '''central gateway control module''' joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

== Diagnostic requests seen ==
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
|-
| <code>18 00 FF 00</code> || <code>58 00</code> or <code>58 01 9A 31 E0</code> || Read DTCs by status (second form = one code reported; not decoded)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block (repeated about twice a second by the scan tool)
|}
Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The <code>1A 8E</code> reply (37160-61M0) matches the TPMS controller's base number and model number; the <code>1A 8A</code> reply (37120-78R0*) shares "78R0" with the full part number, but its meaning is not confirmed.

A Launch full scan reported "Left Front Tire Pressure Low" for the TPMS module, and the module returned one stored code (<code>9A 31</code>) in the same scan. That code is probably the low-pressure warning (inferred; the report does not show the code itself).

== Reading it with an ELM327 ==
Terminal commands, one at a time (CR line ending):
<pre>
ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100
</pre>
* <code>ATSH798</code> sets the request address. The reply address (0x7A8) is worked out automatically.
* <code>ATFCSH798 / ATFCSD300000 / ATFCSM1</code> make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
* <code>ATS0</code> removes the spaces between bytes. Without it, the generic Chinese ELM327-based dongle (dongle 1) reported <code>BUFFER FULL</code> near byte 81.
* Expected output: a length line (<code>066</code> = 102 bytes) and numbered lines <code>0:</code> to <code>E:</code>.
* With default settings dongle 1 returned only the first line (<code>61 00 xx 01 00 00</code>).

== Reply layout (21 00) ==
Byte positions count the <code>61</code> as byte 0.
{| class="wikitable"
! Bytes !! Content
|-
| 0-1 || <code>61 00</code> (positive reply)
|-
| 2 || Varies 117-142. Looks like system voltage x 10 (''unconfirmed'')
|-
| 12-21 || Sensor record 1: front left
|-
| 22-31 || Sensor record 2: rear left
|-
| 32-41 || Sensor record 3: rear right
|-
| 42-51 || Sensor record 4: front right
|-
| 56-71 || Four 4-byte sensor-ID entries whose contents change (meaning unknown)
|-
| other || Not decoded
|}

=== Sensor record (10 bytes) ===
{| class="wikitable"
! Offset !! Content
|-
| +0 to +3 || Sensor ID
|-
| +4 || Position flag
|-
| +5 || Value 57-74. Behaves like temperature, possibly with an offset of 40 (''unconfirmed'')
|-
| +6 || Pressure, gauge: bar = raw x 0.01372 (see Calibration)
|-
| +7, +8 || Not understood
|-
| +9 || Always 0
|}

{| class="wikitable"
! Wheel !! Sensor ID !! Position flag
|-
| Front left || 4E AA 09 43 || 0x10
|-
| Rear left || DD 91 B5 25 || 0x20
|-
| Rear right || 4E AA 03 19 || 0x18
|-
| Front right || 4E AA 09 C9 || 0x08
|}
Sensor IDs are specific to one car. Yours will differ.

== Calibration ==
Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.
{| class="wikitable"
! Raw !! Gauge (bar) !! Raw x 0.01372
|-
| 136 (rear left) || 1.868 || 1.866
|-
| 131 (rear right) || 1.795 || 1.797
|-
| 131 (front right) || 1.795 || 1.797
|-
| 126 || 1.73 || 1.729
|-
| 119 || 1.63 || 1.633
|-
| 112 || 1.54 || 1.537
|-
| 101 || 1.39 || 1.386
|-
| 96 || 1.29 || 1.317
|}
The last five rows are from one tyre, the front left, during a slow deflation.
* bar = raw x 0.01372
* psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

== Torque Pro custom PIDs ==
Common fields for every wheel:
{| class="wikitable"
! Field !! Value
|-
| Header || 798
|-
| Mode and PID || 2100
|-
| Diagnostic start command || <code>ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1</code> (comma-separated)
|-
| Unit / min / max || bar, 0, 4 (or psi, 0, 60)
|}

Equation uses a letter for each data byte. <code>A</code> is the first byte after <code>61 00</code> (reply byte 2).
{| class="wikitable"
! Wheel !! Byte +5 (temperature?) !! Byte +6 (pressure candidate)” to “Byte +6 (pressure)”
|-
| Front left || P || Q
|-
| Front right || AT || AU
|-
| Rear left || Z || AA
|-
| Rear right || AJ || AK
|}
Example: <code>Q*0.01372</code>. Letters must be upper case. Whether Torque accepts two-letter variables is ''unconfirmed''.

=== Known problem ===
Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on a Lenovo tablet, Torque read bytes <code>A</code> to <code>D</code> (first line of the reply) correctly, but every byte from <code>E</code> onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding <code>ATH1</code> changed the output). Tried without success: turning off "Faster communication" and removing <code>ATS0</code>. Not tried: <code>ATAT0, ATSTFF</code> timeout settings.

Dongle 2 (Veepeak OBDCheck BLE+), also on the tablet, gave the same result. Car Scanner Pro reads every byte with both dongles and the same commands, so the limitation is in how Torque Pro handles this multi-line reply, not in the adapter or the Android device. Unresolved; a request has been posted on the Torque forum.

== Car Scanner Pro (working) ==
Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:
* Header: 798
* Request: 2100
* Start command (backslash-separated): <code>ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1</code>
* Equations use the same letters as the table above, for example <code>Q*0.01372</code> for front left (bar)

The start command has not yet been shortened. Tested with dongle 1 (generic ELM327-based) on the XTRONS PX90.

== RealDash ==
RealDash describes its OBD2 communication in an XML file. With dongle 1, RealDash's default init plus the lines below works: the TPMS sensors reply, and the values appear in RealDash's debug view. Dashboard gauges are in progress.

Changes to RealDash's default file:
* Add the three flow-control commands to the init section, before the <code>0100</code> and <code>0120</code> checks.
* Every TPMS command sets <code>header="atsh798"</code>. The docs say to set the header on every command when the rotation uses more than one. Any standard command in the same rotation then needs <code>header="atsh7df"</code>, or it would be sent to 0x798.
* RealDash requires <code>ATE0</code>, <code>ATL0</code> and <code>ATS0</code> (already in its default init).

<pre>
<init>
... RealDash default init lines ...
<command send="atfcsh798"></command>
<command send="atfcsd300000"></command>
<command send="atfcsm1"></command>
<command send="0100"></command>
<command send="0120"></command>
</init>
<rotation>
<command send="2100" header="atsh798" skipCount="10" keepInRotation="true" name="TPMS: front left" units="bar" conversionABC="Q*0.01372"></command>
<command send="2100" header="atsh798" skipCount="11" keepInRotation="true" name="TPMS: front right" units="bar" conversionABC="AU*0.01372"></command>
<command send="2100" header="atsh798" skipCount="12" keepInRotation="true" name="TPMS: rear left" units="bar" conversionABC="AA*0.01372"></command>
<command send="2100" header="atsh798" skipCount="13" keepInRotation="true" name="TPMS: rear right" units="bar" conversionABC="AK*0.01372"></command>
</rotation>
</pre>

<code>conversionABC</code> uses the same letters as Torque and Car Scanner (A is the first byte after 61 00). The TPMS inputs appear in RealDash's ECU Specific category.

The Veepeak OBDCheck BLE+ (dongle 2) will not connect to the head unit because the head unit does not support BLE, so only dongle 1 was used.

== Other modules found by a full scan ==
A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

{| class="wikitable"
! Request !! Reply !! Protocol !! Identification replies !! Module !! How identified
|-
| 0x7E0 || 0x7E8 || KWP || 33980-78R0, 33980-78RC* || ECM || Standard engine address
|-
| 0x261 || 0x661 || KWP || 56100-77RA, 56100-78RF* || ABS (inferred) || Only brake module left by elimination
|-
| 0x263 || 0x663 || KWP || 38720-77R0, 38720-77R0* || EPS controller || Parts catalogue
|-
| 0x271 || 0x671 || KWP || 36775-77R0, 36775-77RC* || Body control module || Parts catalogue
|-
| 0x274 || 0x674 || KWP || 34100-78R0, 34110-78RD* || Instrument cluster || Rev counter sweep test
|-
| 0x798 || 0x7A8 || KWP || 37160-61M0, 37120-78R0* || TPMS controller || Label and parts catalogue
|-
| 0x79A || 0x7AA || KWP || 37210-74PA, 37210-74PE* || Lighting and turn switch || Parts catalogue
|-
| 0x778 || 0x788 || KWP || 33990-52R0, 33990-78R8* || Dual sensor brake support || Parts catalogue
|-
| 0x793 || 0x7A3 || UDS || 38910-77R0, 38910-78RC* || Airbag (SRS) controller || Parts catalogue
|-
| 0x772 || 0x782 || UDS || 38885-77R0, 38885-78R0* || 4WD shift controller || Parts catalogue
|-
| 0x799 || 0x7A9 || UDS || 38960-78RA, 38960-78RA* || E-call controller || Parts catalogue
|-
| 0x751 || 0x761 || UDS || 33580-79R0, 33580-78R0* || Central gateway || Label and parts catalogue
|}
Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

* KWP-style modules answer <code>1A 8E</code> and <code>1A 8A</code> (identification) and <code>18 00 FF 00</code> (DTCs). UDS-style modules answer <code>22 F1 01</code> and <code>22 F1 88</code> (identification) and <code>19 02 FF</code> (DTCs).
* Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
* Two names are inferred and not confirmed by a part label: 0x261 (ABS) and 0x778 (dual sensor brake support). All the others come from the parts catalogue, a label, or a test.
* The E-call controller (0x799) returned a stored code record (<code>92 4E 00</code>, status 02) that the Launch report does not list. Its meaning is not known.

=== Instrument cluster output test (0x274 / 0x674) ===
A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:
{| class="wikitable"
! Request !! Reply !! Notes
|-
| <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished
|}
The meaning of the four control bytes (80 40 00 00) is not known.

* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A more reliable pressure scale (more gauge readings at low and high pressure are needed; the lowest calibration point is 0.027 bar off).
* Whether the central gateway forwards the request to the TPMS controller or remaps the address.
* Why Torque Pro stops after the first line of the reply (the adapter is ruled out).
* The meaning of the control bytes (80 40 00 00) in the instrument cluster sweep command.
* The meaning of the stored code from the E-call controller.
* Confirming the ABS (0x261) and dual sensor brake support (0x778) names.

== Sources ==
* Owner PCAN-View captures, October 2026.
* Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
* Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
* BigJimny forum thread "JB74 OBD2 connection" (December 2020).
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* RealDash-extras OBD2 documentation (OBD2 XML description file).
* Car Scanner ELM OBD2 custom PID documentation.

[[Category:Jimny technical]]
[[Category:JB74]]
[[Category:Electrical - gen3]]
[[Category:FAQ - gen3]]
[[Category:Howto - gen3]]

[[Category:Electrical - gen4]]
[[Category:FAQ - gen4]]
[[Category:Howto - gen4]]

OBD2 Diagnostics reading project

2026-11-01T10:52:38Z

Mlines: /* Known problem */

= Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link =

{{Donate}}
== Overview ==
Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

=== Equipment ===
{| class="wikitable"
! Role !! Item
|-
| Head unit || XTRONS PX90
|-
| OBD-II Bluetooth dongle 1 || Generic ELM-based (Chinese)
|-
| OBD-II Bluetooth dongle 2 || Veepeak OBDCheck BLE+ (BLE only; works on a Lenovo tablet, will not connect to the head unit)
|-
| CAN bus monitor (Windows) || PCAN-View (PEAK-System)
|-
| Diagnostic tool 1 || Launch X431 CRP919
|-
| Diagnostic tool 2 || SZ Viewer app
|-
| Head-unit apps tried || Torque Pro (fails past the first line), RealDash (TPMS values seen in its debug view; gauges in progress), Car Scanner Pro (works)
|-
| Head-unit Bluetooth || xTRONS IP90 - Classic Bluetooth only, no BLE support
|}

=== Method ===
# The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
# PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
# The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.
'''Status:''' work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures (including a full Launch scan and an instrument cluster test), the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC) and the Suzuki parts catalogue. TPMS readings work in Car Scanner Pro; RealDash works in its debug view with gauges in progress. Items marked ''unconfirmed'' are not yet verified.

* The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
* Request ID '''0x798''', reply ID '''0x7A8''' (11-bit CAN, 500 kbit/s, ISO-TP framing) returns the TPMS data, including four sensor IDs and pressure readings. The module's identification reply (37160-61M0) matches the Model No. (P61M0) on the TPMS controller label. Whether the central gateway forwards or remaps the request is unconfirmed.
* Service '''0x21''' (read data by local identifier), identifier '''0x00''', returns 102 bytes containing all four sensor records.
* Pressure is byte +6 of each sensor record: bar = raw x 0.01372.
* The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.
* Working: Car Scanner Pro, and RealDash (values seen in its debug view). Not working: Torque Pro.

== DLC (OBD socket) wiring ==
The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal ''n'' matches standard pin ''17 - n''.

{| class="wikitable"
! Manual terminal !! Standard pin !! Function !! Wire / source on diagram
|-
| 1 || 16 || Battery +12 V || GRY, fuse No.49 "DOME2" (10 A)
|-
| 12 || 5 || Signal ground || BLK
|-
| 13 || 4 || Chassis ground || BLK
|-
| 11 || 6 || CAN-H (from standard assignment) || BLU, gateway pin 8
|-
| 3 || 14 || CAN-L (from standard assignment) || WHT, gateway pin 7
|}

Use pins '''6''' and '''14''' for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

=== Cross-check with other reports ===
A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

* The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
* No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
* On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

== Network layout ==
The DLC is not on the vehicle bus directly. The '''central gateway control module''' joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

== Diagnostic requests seen ==
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
|-
| <code>18 00 FF 00</code> || <code>58 00</code> or <code>58 01 9A 31 E0</code> || Read DTCs by status (second form = one code reported; not decoded)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block (repeated about twice a second by the scan tool)
|}
Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The <code>1A 8E</code> reply (37160-61M0) matches the TPMS controller's base number and model number; the <code>1A 8A</code> reply (37120-78R0*) shares "78R0" with the full part number, but its meaning is not confirmed.

A Launch full scan reported "Left Front Tire Pressure Low" for the TPMS module, and the module returned one stored code (<code>9A 31</code>) in the same scan. That code is probably the low-pressure warning (inferred; the report does not show the code itself).

== Reading it with an ELM327 ==
Terminal commands, one at a time (CR line ending):
<pre>
ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100
</pre>
* <code>ATSH798</code> sets the request address. The reply address (0x7A8) is worked out automatically.
* <code>ATFCSH798 / ATFCSD300000 / ATFCSM1</code> make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
* <code>ATS0</code> removes the spaces between bytes. Without it, the generic Chinese ELM327-based dongle (dongle 1) reported <code>BUFFER FULL</code> near byte 81.
* Expected output: a length line (<code>066</code> = 102 bytes) and numbered lines <code>0:</code> to <code>E:</code>.
* With default settings dongle 1 returned only the first line (<code>61 00 xx 01 00 00</code>).

== Reply layout (21 00) ==
Byte positions count the <code>61</code> as byte 0.
{| class="wikitable"
! Bytes !! Content
|-
| 0-1 || <code>61 00</code> (positive reply)
|-
| 2 || Varies 117-142. Looks like system voltage x 10 (''unconfirmed'')
|-
| 12-21 || Sensor record 1: front left
|-
| 22-31 || Sensor record 2: rear left
|-
| 32-41 || Sensor record 3: rear right
|-
| 42-51 || Sensor record 4: front right
|-
| 56-71 || Four 4-byte sensor-ID entries whose contents change (meaning unknown)
|-
| other || Not decoded
|}

=== Sensor record (10 bytes) ===
{| class="wikitable"
! Offset !! Content
|-
| +0 to +3 || Sensor ID
|-
| +4 || Position flag
|-
| +5 || Value 57-74. Behaves like temperature, possibly with an offset of 40 (''unconfirmed'')
|-
| +6 || Pressure, gauge: bar = raw x 0.01372 (see Calibration)
|-
| +7, +8 || Not understood
|-
| +9 || Always 0
|}

{| class="wikitable"
! Wheel !! Sensor ID !! Position flag
|-
| Front left || 4E AA 09 43 || 0x10
|-
| Rear left || DD 91 B5 25 || 0x20
|-
| Rear right || 4E AA 03 19 || 0x18
|-
| Front right || 4E AA 09 C9 || 0x08
|}
Sensor IDs are specific to one car. Yours will differ.

== Calibration ==
Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.
{| class="wikitable"
! Raw !! Gauge (bar) !! Raw x 0.01372
|-
| 136 (rear left) || 1.868 || 1.866
|-
| 131 (rear right) || 1.795 || 1.797
|-
| 131 (front right) || 1.795 || 1.797
|-
| 126 || 1.73 || 1.729
|-
| 119 || 1.63 || 1.633
|-
| 112 || 1.54 || 1.537
|-
| 101 || 1.39 || 1.386
|-
| 96 || 1.29 || 1.317
|}
The last five rows are from one tyre, the front left, during a slow deflation.
* bar = raw x 0.01372
* psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

== Torque Pro custom PIDs ==
Common fields for every wheel:
{| class="wikitable"
! Field !! Value
|-
| Header || 798
|-
| Mode and PID || 2100
|-
| Diagnostic start command || <code>ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1</code> (comma-separated)
|-
| Unit / min / max || bar, 0, 4 (or psi, 0, 60)
|}

Equation uses a letter for each data byte. <code>A</code> is the first byte after <code>61 00</code> (reply byte 2).
{| class="wikitable"
! Wheel !! Byte +5 (temperature?) !! Byte +6 (pressure candidate)” to “Byte +6 (pressure)”
|-
| Front left || P || Q
|-
| Front right || AT || AU
|-
| Rear left || Z || AA
|-
| Rear right || AJ || AK
|}
Example: <code>Q*0.01372</code>. Letters must be upper case. Whether Torque accepts two-letter variables is ''unconfirmed''.

=== Known problem ===
Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on a Lenovo tablet, Torque read bytes <code>A</code> to <code>D</code> (first line of the reply) correctly, but every byte from <code>E</code> onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding <code>ATH1</code> changed the output). Tried without success: turning off "Faster communication" and removing <code>ATS0</code>. Not tried: <code>ATAT0, ATSTFF</code> timeout settings.

Dongle 2 (Veepeak OBDCheck BLE+), also on the tablet, gave the same result. Car Scanner Pro reads every byte with both dongles and the same commands, so the limitation is in how Torque Pro handles this multi-line reply, not in the adapter or the Android device. Unresolved; a request has been posted on the Torque forum.

== Car Scanner Pro (working) ==
Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:
* Header: 798
* Request: 2100
* Start command (backslash-separated): <code>ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1</code>
* Equations use the same letters as the table above, for example <code>Q*0.01372</code> for front left (bar)

The start command has not yet been shortened. Tested with dongle 1 (generic ELM327-based) on the XTRONS PX90.

== RealDash ==
RealDash describes its OBD2 communication in an XML file. With dongle 1, RealDash's default init plus the lines below works: the TPMS sensors reply, and the values appear in RealDash's debug view. Dashboard gauges are in progress.

Changes to RealDash's default file:
* Add the three flow-control commands to the init section, before the <code>0100</code> and <code>0120</code> checks.
* Every TPMS command sets <code>header="atsh798"</code>. The docs say to set the header on every command when the rotation uses more than one. Any standard command in the same rotation then needs <code>header="atsh7df"</code>, or it would be sent to 0x798.
* RealDash requires <code>ATE0</code>, <code>ATL0</code> and <code>ATS0</code> (already in its default init).

<pre>
<init>
... RealDash default init lines ...
<command send="atfcsh798"></command>
<command send="atfcsd300000"></command>
<command send="atfcsm1"></command>
<command send="0100"></command>
<command send="0120"></command>
</init>
<rotation>
<command send="2100" header="atsh798" skipCount="10" keepInRotation="true" name="TPMS: front left" units="bar" conversionABC="Q*0.01372"></command>
<command send="2100" header="atsh798" skipCount="11" keepInRotation="true" name="TPMS: front right" units="bar" conversionABC="AU*0.01372"></command>
<command send="2100" header="atsh798" skipCount="12" keepInRotation="true" name="TPMS: rear left" units="bar" conversionABC="AA*0.01372"></command>
<command send="2100" header="atsh798" skipCount="13" keepInRotation="true" name="TPMS: rear right" units="bar" conversionABC="AK*0.01372"></command>
</rotation>
</pre>

<code>conversionABC</code> uses the same letters as Torque and Car Scanner (A is the first byte after 61 00). The TPMS inputs appear in RealDash's ECU Specific category.

The Veepeak OBDCheck BLE+ (dongle 2) will not connect to the head unit because the head unit does not support BLE, so only dongle 1 was used.

== Other modules found by a full scan ==
A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

{| class="wikitable"
! Request !! Reply !! Protocol !! Identification replies !! Module !! How identified
|-
| 0x7E0 || 0x7E8 || KWP || 33980-78R0, 33980-78RC* || ECM || Standard engine address
|-
| 0x261 || 0x661 || KWP || 56100-77RA, 56100-78RF* || ABS (inferred) || Only brake module left by elimination
|-
| 0x263 || 0x663 || KWP || 38720-77R0, 38720-77R0* || EPS controller || Parts catalogue
|-
| 0x271 || 0x671 || KWP || 36775-77R0, 36775-77RC* || Body control module || Parts catalogue
|-
| 0x274 || 0x674 || KWP || 34100-78R0, 34110-78RD* || Instrument cluster || Rev counter sweep test
|-
| 0x798 || 0x7A8 || KWP || 37160-61M0, 37120-78R0* || TPMS controller || Label and parts catalogue
|-
| 0x79A || 0x7AA || KWP || 37210-74PA, 37210-74PE* || Lighting and turn switch || Parts catalogue
|-
| 0x778 || 0x788 || KWP || 33990-52R0, 33990-78R8* || Dual sensor brake support || Parts catalogue
|-
| 0x793 || 0x7A3 || UDS || 38910-77R0, 38910-78RC* || Airbag (SRS) controller || Parts catalogue
|-
| 0x772 || 0x782 || UDS || 38885-77R0, 38885-78R0* || 4WD shift controller || Parts catalogue
|-
| 0x799 || 0x7A9 || UDS || 38960-78RA, 38960-78RA* || E-call controller || Parts catalogue
|-
| 0x751 || 0x761 || UDS || 33580-79R0, 33580-78R0* || Central gateway || Label and parts catalogue
|}
Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

* KWP-style modules answer <code>1A 8E</code> and <code>1A 8A</code> (identification) and <code>18 00 FF 00</code> (DTCs). UDS-style modules answer <code>22 F1 01</code> and <code>22 F1 88</code> (identification) and <code>19 02 FF</code> (DTCs).
* Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
* Two names are inferred and not confirmed by a part label: 0x261 (ABS) and 0x778 (dual sensor brake support). All the others come from the parts catalogue, a label, or a test.
* The E-call controller (0x799) returned a stored code record (<code>92 4E 00</code>, status 02) that the Launch report does not list. Its meaning is not known.

=== Instrument cluster output test (0x274 / 0x674) ===
A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:
{| class="wikitable"
! Request !! Reply !! Notes
|-
| <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished
|}
The meaning of the four control bytes (80 40 00 00) is not known.

* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A more reliable pressure scale (more gauge readings at low and high pressure are needed; the lowest calibration point is 0.027 bar off).
* Whether the central gateway forwards the request to the TPMS controller or remaps the address.
* Why Torque Pro stops after the first line of the reply (the adapter is ruled out).
* The meaning of the control bytes (80 40 00 00) in the instrument cluster sweep command.
* The meaning of the stored code from the E-call controller.
* Confirming the ABS (0x261) and dual sensor brake support (0x778) names.

== Sources ==
* Owner PCAN-View captures, October 2026.
* Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
* Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
* BigJimny forum thread "JB74 OBD2 connection" (December 2020).
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* RealDash-extras OBD2 documentation (OBD2 XML description file).
* Car Scanner ELM OBD2 custom PID documentation.

[[Category:Jimny technical]]
[[Category:JB74]]
[[Category:Electrical - gen3]]
[[Category:FAQ - gen3]]
[[Category:Howto - gen3]]

[[Category:Electrical - gen4]]
[[Category:FAQ - gen4]]
[[Category:Howto - gen4]]

OBD2 Diagnostics reading project

2026-11-01T10:51:10Z

Mlines: /* RealDash */

= Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link =

{{Donate}}
== Overview ==
Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

=== Equipment ===
{| class="wikitable"
! Role !! Item
|-
| Head unit || XTRONS PX90
|-
| OBD-II Bluetooth dongle 1 || Generic ELM-based (Chinese)
|-
| OBD-II Bluetooth dongle 2 || Veepeak OBDCheck BLE+ (BLE only; works on a Lenovo tablet, will not connect to the head unit)
|-
| CAN bus monitor (Windows) || PCAN-View (PEAK-System)
|-
| Diagnostic tool 1 || Launch X431 CRP919
|-
| Diagnostic tool 2 || SZ Viewer app
|-
| Head-unit apps tried || Torque Pro (fails past the first line), RealDash (TPMS values seen in its debug view; gauges in progress), Car Scanner Pro (works)
|-
| Head-unit Bluetooth || xTRONS IP90 - Classic Bluetooth only, no BLE support
|}

=== Method ===
# The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
# PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
# The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.
'''Status:''' work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures (including a full Launch scan and an instrument cluster test), the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC) and the Suzuki parts catalogue. TPMS readings work in Car Scanner Pro; RealDash works in its debug view with gauges in progress. Items marked ''unconfirmed'' are not yet verified.

* The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
* Request ID '''0x798''', reply ID '''0x7A8''' (11-bit CAN, 500 kbit/s, ISO-TP framing) returns the TPMS data, including four sensor IDs and pressure readings. The module's identification reply (37160-61M0) matches the Model No. (P61M0) on the TPMS controller label. Whether the central gateway forwards or remaps the request is unconfirmed.
* Service '''0x21''' (read data by local identifier), identifier '''0x00''', returns 102 bytes containing all four sensor records.
* Pressure is byte +6 of each sensor record: bar = raw x 0.01372.
* The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.
* Working: Car Scanner Pro, and RealDash (values seen in its debug view). Not working: Torque Pro.

== DLC (OBD socket) wiring ==
The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal ''n'' matches standard pin ''17 - n''.

{| class="wikitable"
! Manual terminal !! Standard pin !! Function !! Wire / source on diagram
|-
| 1 || 16 || Battery +12 V || GRY, fuse No.49 "DOME2" (10 A)
|-
| 12 || 5 || Signal ground || BLK
|-
| 13 || 4 || Chassis ground || BLK
|-
| 11 || 6 || CAN-H (from standard assignment) || BLU, gateway pin 8
|-
| 3 || 14 || CAN-L (from standard assignment) || WHT, gateway pin 7
|}

Use pins '''6''' and '''14''' for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

=== Cross-check with other reports ===
A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

* The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
* No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
* On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

== Network layout ==
The DLC is not on the vehicle bus directly. The '''central gateway control module''' joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

== Diagnostic requests seen ==
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
|-
| <code>18 00 FF 00</code> || <code>58 00</code> or <code>58 01 9A 31 E0</code> || Read DTCs by status (second form = one code reported; not decoded)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block (repeated about twice a second by the scan tool)
|}
Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The <code>1A 8E</code> reply (37160-61M0) matches the TPMS controller's base number and model number; the <code>1A 8A</code> reply (37120-78R0*) shares "78R0" with the full part number, but its meaning is not confirmed.

A Launch full scan reported "Left Front Tire Pressure Low" for the TPMS module, and the module returned one stored code (<code>9A 31</code>) in the same scan. That code is probably the low-pressure warning (inferred; the report does not show the code itself).

== Reading it with an ELM327 ==
Terminal commands, one at a time (CR line ending):
<pre>
ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100
</pre>
* <code>ATSH798</code> sets the request address. The reply address (0x7A8) is worked out automatically.
* <code>ATFCSH798 / ATFCSD300000 / ATFCSM1</code> make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
* <code>ATS0</code> removes the spaces between bytes. Without it, the generic Chinese ELM327-based dongle (dongle 1) reported <code>BUFFER FULL</code> near byte 81.
* Expected output: a length line (<code>066</code> = 102 bytes) and numbered lines <code>0:</code> to <code>E:</code>.
* With default settings dongle 1 returned only the first line (<code>61 00 xx 01 00 00</code>).

== Reply layout (21 00) ==
Byte positions count the <code>61</code> as byte 0.
{| class="wikitable"
! Bytes !! Content
|-
| 0-1 || <code>61 00</code> (positive reply)
|-
| 2 || Varies 117-142. Looks like system voltage x 10 (''unconfirmed'')
|-
| 12-21 || Sensor record 1: front left
|-
| 22-31 || Sensor record 2: rear left
|-
| 32-41 || Sensor record 3: rear right
|-
| 42-51 || Sensor record 4: front right
|-
| 56-71 || Four 4-byte sensor-ID entries whose contents change (meaning unknown)
|-
| other || Not decoded
|}

=== Sensor record (10 bytes) ===
{| class="wikitable"
! Offset !! Content
|-
| +0 to +3 || Sensor ID
|-
| +4 || Position flag
|-
| +5 || Value 57-74. Behaves like temperature, possibly with an offset of 40 (''unconfirmed'')
|-
| +6 || Pressure, gauge: bar = raw x 0.01372 (see Calibration)
|-
| +7, +8 || Not understood
|-
| +9 || Always 0
|}

{| class="wikitable"
! Wheel !! Sensor ID !! Position flag
|-
| Front left || 4E AA 09 43 || 0x10
|-
| Rear left || DD 91 B5 25 || 0x20
|-
| Rear right || 4E AA 03 19 || 0x18
|-
| Front right || 4E AA 09 C9 || 0x08
|}
Sensor IDs are specific to one car. Yours will differ.

== Calibration ==
Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.
{| class="wikitable"
! Raw !! Gauge (bar) !! Raw x 0.01372
|-
| 136 (rear left) || 1.868 || 1.866
|-
| 131 (rear right) || 1.795 || 1.797
|-
| 131 (front right) || 1.795 || 1.797
|-
| 126 || 1.73 || 1.729
|-
| 119 || 1.63 || 1.633
|-
| 112 || 1.54 || 1.537
|-
| 101 || 1.39 || 1.386
|-
| 96 || 1.29 || 1.317
|}
The last five rows are from one tyre, the front left, during a slow deflation.
* bar = raw x 0.01372
* psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

== Torque Pro custom PIDs ==
Common fields for every wheel:
{| class="wikitable"
! Field !! Value
|-
| Header || 798
|-
| Mode and PID || 2100
|-
| Diagnostic start command || <code>ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1</code> (comma-separated)
|-
| Unit / min / max || bar, 0, 4 (or psi, 0, 60)
|}

Equation uses a letter for each data byte. <code>A</code> is the first byte after <code>61 00</code> (reply byte 2).
{| class="wikitable"
! Wheel !! Byte +5 (temperature?) !! Byte +6 (pressure candidate)” to “Byte +6 (pressure)”
|-
| Front left || P || Q
|-
| Front right || AT || AU
|-
| Rear left || Z || AA
|-
| Rear right || AJ || AK
|}
Example: <code>Q*0.01372</code>. Letters must be upper case. Whether Torque accepts two-letter variables is ''unconfirmed''.

=== Known problem ===
Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on the XTRONS PX90, Torque read bytes <code>A</code> to <code>D</code> (first line of the reply) correctly, but every byte from <code>E</code> onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding <code>ATH1</code> changed the output). Tried without success: turning off "Faster communication" and removing <code>ATS0</code>. Not tried: <code>ATAT0, ATSTFF</code> timeout settings.

Dongle 2 (Veepeak OBDCheck BLE+) gave the same result, but the head unit does not support BLE, so that test is not reliable. Car Scanner Pro reads every byte with dongle 1 and the same commands, so the limitation appears to be in how Torque Pro handles this multi-line reply, not in the adapter. Unresolved; a request has been posted on the Torque forum.

== Car Scanner Pro (working) ==
Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:
* Header: 798
* Request: 2100
* Start command (backslash-separated): <code>ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1</code>
* Equations use the same letters as the table above, for example <code>Q*0.01372</code> for front left (bar)

The start command has not yet been shortened. Tested with dongle 1 (generic ELM327-based) on the XTRONS PX90.

== RealDash ==
RealDash describes its OBD2 communication in an XML file. With dongle 1, RealDash's default init plus the lines below works: the TPMS sensors reply, and the values appear in RealDash's debug view. Dashboard gauges are in progress.

Changes to RealDash's default file:
* Add the three flow-control commands to the init section, before the <code>0100</code> and <code>0120</code> checks.
* Every TPMS command sets <code>header="atsh798"</code>. The docs say to set the header on every command when the rotation uses more than one. Any standard command in the same rotation then needs <code>header="atsh7df"</code>, or it would be sent to 0x798.
* RealDash requires <code>ATE0</code>, <code>ATL0</code> and <code>ATS0</code> (already in its default init).

<pre>
<init>
... RealDash default init lines ...
<command send="atfcsh798"></command>
<command send="atfcsd300000"></command>
<command send="atfcsm1"></command>
<command send="0100"></command>
<command send="0120"></command>
</init>
<rotation>
<command send="2100" header="atsh798" skipCount="10" keepInRotation="true" name="TPMS: front left" units="bar" conversionABC="Q*0.01372"></command>
<command send="2100" header="atsh798" skipCount="11" keepInRotation="true" name="TPMS: front right" units="bar" conversionABC="AU*0.01372"></command>
<command send="2100" header="atsh798" skipCount="12" keepInRotation="true" name="TPMS: rear left" units="bar" conversionABC="AA*0.01372"></command>
<command send="2100" header="atsh798" skipCount="13" keepInRotation="true" name="TPMS: rear right" units="bar" conversionABC="AK*0.01372"></command>
</rotation>
</pre>

<code>conversionABC</code> uses the same letters as Torque and Car Scanner (A is the first byte after 61 00). The TPMS inputs appear in RealDash's ECU Specific category.

The Veepeak OBDCheck BLE+ (dongle 2) will not connect to the head unit because the head unit does not support BLE, so only dongle 1 was used.

== Other modules found by a full scan ==
A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

{| class="wikitable"
! Request !! Reply !! Protocol !! Identification replies !! Module !! How identified
|-
| 0x7E0 || 0x7E8 || KWP || 33980-78R0, 33980-78RC* || ECM || Standard engine address
|-
| 0x261 || 0x661 || KWP || 56100-77RA, 56100-78RF* || ABS (inferred) || Only brake module left by elimination
|-
| 0x263 || 0x663 || KWP || 38720-77R0, 38720-77R0* || EPS controller || Parts catalogue
|-
| 0x271 || 0x671 || KWP || 36775-77R0, 36775-77RC* || Body control module || Parts catalogue
|-
| 0x274 || 0x674 || KWP || 34100-78R0, 34110-78RD* || Instrument cluster || Rev counter sweep test
|-
| 0x798 || 0x7A8 || KWP || 37160-61M0, 37120-78R0* || TPMS controller || Label and parts catalogue
|-
| 0x79A || 0x7AA || KWP || 37210-74PA, 37210-74PE* || Lighting and turn switch || Parts catalogue
|-
| 0x778 || 0x788 || KWP || 33990-52R0, 33990-78R8* || Dual sensor brake support || Parts catalogue
|-
| 0x793 || 0x7A3 || UDS || 38910-77R0, 38910-78RC* || Airbag (SRS) controller || Parts catalogue
|-
| 0x772 || 0x782 || UDS || 38885-77R0, 38885-78R0* || 4WD shift controller || Parts catalogue
|-
| 0x799 || 0x7A9 || UDS || 38960-78RA, 38960-78RA* || E-call controller || Parts catalogue
|-
| 0x751 || 0x761 || UDS || 33580-79R0, 33580-78R0* || Central gateway || Label and parts catalogue
|}
Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

* KWP-style modules answer <code>1A 8E</code> and <code>1A 8A</code> (identification) and <code>18 00 FF 00</code> (DTCs). UDS-style modules answer <code>22 F1 01</code> and <code>22 F1 88</code> (identification) and <code>19 02 FF</code> (DTCs).
* Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
* Two names are inferred and not confirmed by a part label: 0x261 (ABS) and 0x778 (dual sensor brake support). All the others come from the parts catalogue, a label, or a test.
* The E-call controller (0x799) returned a stored code record (<code>92 4E 00</code>, status 02) that the Launch report does not list. Its meaning is not known.

=== Instrument cluster output test (0x274 / 0x674) ===
A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:
{| class="wikitable"
! Request !! Reply !! Notes
|-
| <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished
|}
The meaning of the four control bytes (80 40 00 00) is not known.

* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A more reliable pressure scale (more gauge readings at low and high pressure are needed; the lowest calibration point is 0.027 bar off).
* Whether the central gateway forwards the request to the TPMS controller or remaps the address.
* Why Torque Pro stops after the first line of the reply (the adapter is ruled out).
* The meaning of the control bytes (80 40 00 00) in the instrument cluster sweep command.
* The meaning of the stored code from the E-call controller.
* Confirming the ABS (0x261) and dual sensor brake support (0x778) names.

== Sources ==
* Owner PCAN-View captures, October 2026.
* Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
* Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
* BigJimny forum thread "JB74 OBD2 connection" (December 2020).
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* RealDash-extras OBD2 documentation (OBD2 XML description file).
* Car Scanner ELM OBD2 custom PID documentation.

[[Category:Jimny technical]]
[[Category:JB74]]
[[Category:Electrical - gen3]]
[[Category:FAQ - gen3]]
[[Category:Howto - gen3]]

[[Category:Electrical - gen4]]
[[Category:FAQ - gen4]]
[[Category:Howto - gen4]]

OBD2 Diagnostics reading project

2026-11-01T10:50:09Z

Mlines: /* Equipment */

= Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link =

{{Donate}}
== Overview ==
Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

=== Equipment ===
{| class="wikitable"
! Role !! Item
|-
| Head unit || XTRONS PX90
|-
| OBD-II Bluetooth dongle 1 || Generic ELM-based (Chinese)
|-
| OBD-II Bluetooth dongle 2 || Veepeak OBDCheck BLE+ (BLE only; works on a Lenovo tablet, will not connect to the head unit)
|-
| CAN bus monitor (Windows) || PCAN-View (PEAK-System)
|-
| Diagnostic tool 1 || Launch X431 CRP919
|-
| Diagnostic tool 2 || SZ Viewer app
|-
| Head-unit apps tried || Torque Pro (fails past the first line), RealDash (TPMS values seen in its debug view; gauges in progress), Car Scanner Pro (works)
|-
| Head-unit Bluetooth || xTRONS IP90 - Classic Bluetooth only, no BLE support
|}

=== Method ===
# The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
# PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
# The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.
'''Status:''' work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures (including a full Launch scan and an instrument cluster test), the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC) and the Suzuki parts catalogue. TPMS readings work in Car Scanner Pro; RealDash works in its debug view with gauges in progress. Items marked ''unconfirmed'' are not yet verified.

* The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
* Request ID '''0x798''', reply ID '''0x7A8''' (11-bit CAN, 500 kbit/s, ISO-TP framing) returns the TPMS data, including four sensor IDs and pressure readings. The module's identification reply (37160-61M0) matches the Model No. (P61M0) on the TPMS controller label. Whether the central gateway forwards or remaps the request is unconfirmed.
* Service '''0x21''' (read data by local identifier), identifier '''0x00''', returns 102 bytes containing all four sensor records.
* Pressure is byte +6 of each sensor record: bar = raw x 0.01372.
* The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.
* Working: Car Scanner Pro, and RealDash (values seen in its debug view). Not working: Torque Pro.

== DLC (OBD socket) wiring ==
The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal ''n'' matches standard pin ''17 - n''.

{| class="wikitable"
! Manual terminal !! Standard pin !! Function !! Wire / source on diagram
|-
| 1 || 16 || Battery +12 V || GRY, fuse No.49 "DOME2" (10 A)
|-
| 12 || 5 || Signal ground || BLK
|-
| 13 || 4 || Chassis ground || BLK
|-
| 11 || 6 || CAN-H (from standard assignment) || BLU, gateway pin 8
|-
| 3 || 14 || CAN-L (from standard assignment) || WHT, gateway pin 7
|}

Use pins '''6''' and '''14''' for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

=== Cross-check with other reports ===
A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

* The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
* No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
* On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

== Network layout ==
The DLC is not on the vehicle bus directly. The '''central gateway control module''' joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

== Diagnostic requests seen ==
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
|-
| <code>18 00 FF 00</code> || <code>58 00</code> or <code>58 01 9A 31 E0</code> || Read DTCs by status (second form = one code reported; not decoded)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block (repeated about twice a second by the scan tool)
|}
Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The <code>1A 8E</code> reply (37160-61M0) matches the TPMS controller's base number and model number; the <code>1A 8A</code> reply (37120-78R0*) shares "78R0" with the full part number, but its meaning is not confirmed.

A Launch full scan reported "Left Front Tire Pressure Low" for the TPMS module, and the module returned one stored code (<code>9A 31</code>) in the same scan. That code is probably the low-pressure warning (inferred; the report does not show the code itself).

== Reading it with an ELM327 ==
Terminal commands, one at a time (CR line ending):
<pre>
ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100
</pre>
* <code>ATSH798</code> sets the request address. The reply address (0x7A8) is worked out automatically.
* <code>ATFCSH798 / ATFCSD300000 / ATFCSM1</code> make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
* <code>ATS0</code> removes the spaces between bytes. Without it, the generic Chinese ELM327-based dongle (dongle 1) reported <code>BUFFER FULL</code> near byte 81.
* Expected output: a length line (<code>066</code> = 102 bytes) and numbered lines <code>0:</code> to <code>E:</code>.
* With default settings dongle 1 returned only the first line (<code>61 00 xx 01 00 00</code>).

== Reply layout (21 00) ==
Byte positions count the <code>61</code> as byte 0.
{| class="wikitable"
! Bytes !! Content
|-
| 0-1 || <code>61 00</code> (positive reply)
|-
| 2 || Varies 117-142. Looks like system voltage x 10 (''unconfirmed'')
|-
| 12-21 || Sensor record 1: front left
|-
| 22-31 || Sensor record 2: rear left
|-
| 32-41 || Sensor record 3: rear right
|-
| 42-51 || Sensor record 4: front right
|-
| 56-71 || Four 4-byte sensor-ID entries whose contents change (meaning unknown)
|-
| other || Not decoded
|}

=== Sensor record (10 bytes) ===
{| class="wikitable"
! Offset !! Content
|-
| +0 to +3 || Sensor ID
|-
| +4 || Position flag
|-
| +5 || Value 57-74. Behaves like temperature, possibly with an offset of 40 (''unconfirmed'')
|-
| +6 || Pressure, gauge: bar = raw x 0.01372 (see Calibration)
|-
| +7, +8 || Not understood
|-
| +9 || Always 0
|}

{| class="wikitable"
! Wheel !! Sensor ID !! Position flag
|-
| Front left || 4E AA 09 43 || 0x10
|-
| Rear left || DD 91 B5 25 || 0x20
|-
| Rear right || 4E AA 03 19 || 0x18
|-
| Front right || 4E AA 09 C9 || 0x08
|}
Sensor IDs are specific to one car. Yours will differ.

== Calibration ==
Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.
{| class="wikitable"
! Raw !! Gauge (bar) !! Raw x 0.01372
|-
| 136 (rear left) || 1.868 || 1.866
|-
| 131 (rear right) || 1.795 || 1.797
|-
| 131 (front right) || 1.795 || 1.797
|-
| 126 || 1.73 || 1.729
|-
| 119 || 1.63 || 1.633
|-
| 112 || 1.54 || 1.537
|-
| 101 || 1.39 || 1.386
|-
| 96 || 1.29 || 1.317
|}
The last five rows are from one tyre, the front left, during a slow deflation.
* bar = raw x 0.01372
* psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

== Torque Pro custom PIDs ==
Common fields for every wheel:
{| class="wikitable"
! Field !! Value
|-
| Header || 798
|-
| Mode and PID || 2100
|-
| Diagnostic start command || <code>ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1</code> (comma-separated)
|-
| Unit / min / max || bar, 0, 4 (or psi, 0, 60)
|}

Equation uses a letter for each data byte. <code>A</code> is the first byte after <code>61 00</code> (reply byte 2).
{| class="wikitable"
! Wheel !! Byte +5 (temperature?) !! Byte +6 (pressure candidate)” to “Byte +6 (pressure)”
|-
| Front left || P || Q
|-
| Front right || AT || AU
|-
| Rear left || Z || AA
|-
| Rear right || AJ || AK
|}
Example: <code>Q*0.01372</code>. Letters must be upper case. Whether Torque accepts two-letter variables is ''unconfirmed''.

=== Known problem ===
Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on the XTRONS PX90, Torque read bytes <code>A</code> to <code>D</code> (first line of the reply) correctly, but every byte from <code>E</code> onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding <code>ATH1</code> changed the output). Tried without success: turning off "Faster communication" and removing <code>ATS0</code>. Not tried: <code>ATAT0, ATSTFF</code> timeout settings.

Dongle 2 (Veepeak OBDCheck BLE+) gave the same result, but the head unit does not support BLE, so that test is not reliable. Car Scanner Pro reads every byte with dongle 1 and the same commands, so the limitation appears to be in how Torque Pro handles this multi-line reply, not in the adapter. Unresolved; a request has been posted on the Torque forum.

== Car Scanner Pro (working) ==
Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:
* Header: 798
* Request: 2100
* Start command (backslash-separated): <code>ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1</code>
* Equations use the same letters as the table above, for example <code>Q*0.01372</code> for front left (bar)

The start command has not yet been shortened. Tested with dongle 1 (generic ELM327-based) on the XTRONS PX90.

== RealDash ==
RealDash describes its OBD2 communication in an XML file. With dongle 1, RealDash's default init plus the lines below works: the TPMS sensors reply, and the values appear in RealDash's debug view. Dashboard gauges are in progress.

Changes to RealDash's default file:
* Add the three flow-control commands to the init section, before the <code>0100</code> and <code>0120</code> checks.
* Every TPMS command sets <code>header="atsh798"</code>. The docs say to set the header on every command when the rotation uses more than one. Any standard command in the same rotation then needs <code>header="atsh7df"</code>, or it would be sent to 0x798.
* RealDash requires <code>ATE0</code>, <code>ATL0</code> and <code>ATS0</code> (already in its default init).

<pre>
<init>
... RealDash default init lines ...
<command send="atfcsh798"></command>
<command send="atfcsd300000"></command>
<command send="atfcsm1"></command>
<command send="0100"></command>
<command send="0120"></command>
</init>
<rotation>
<command send="2100" header="atsh798" skipCount="10" keepInRotation="true" name="TPMS: front left" units="bar" conversionABC="Q*0.01372"></command>
<command send="2100" header="atsh798" skipCount="11" keepInRotation="true" name="TPMS: front right" units="bar" conversionABC="AU*0.01372"></command>
<command send="2100" header="atsh798" skipCount="12" keepInRotation="true" name="TPMS: rear left" units="bar" conversionABC="AA*0.01372"></command>
<command send="2100" header="atsh798" skipCount="13" keepInRotation="true" name="TPMS: rear right" units="bar" conversionABC="AK*0.01372"></command>
</rotation>
</pre>

<code>conversionABC</code> uses the same letters as Torque and Car Scanner (A is the first byte after 61 00). The TPMS inputs appear in RealDash's ECU Specific category.

The Veepeak OBDCheck BLE+ (dongle 2) was intermittent with RealDash because the head unit does not support BLE. An earlier init that replaced RealDash's timing defaults with <code>ATAT0</code> and <code>ATSTFF</code> showed BUS ERROR and STOPPED messages; the dongle used was not recorded.

== Other modules found by a full scan ==
A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

{| class="wikitable"
! Request !! Reply !! Protocol !! Identification replies !! Module !! How identified
|-
| 0x7E0 || 0x7E8 || KWP || 33980-78R0, 33980-78RC* || ECM || Standard engine address
|-
| 0x261 || 0x661 || KWP || 56100-77RA, 56100-78RF* || ABS (inferred) || Only brake module left by elimination
|-
| 0x263 || 0x663 || KWP || 38720-77R0, 38720-77R0* || EPS controller || Parts catalogue
|-
| 0x271 || 0x671 || KWP || 36775-77R0, 36775-77RC* || Body control module || Parts catalogue
|-
| 0x274 || 0x674 || KWP || 34100-78R0, 34110-78RD* || Instrument cluster || Rev counter sweep test
|-
| 0x798 || 0x7A8 || KWP || 37160-61M0, 37120-78R0* || TPMS controller || Label and parts catalogue
|-
| 0x79A || 0x7AA || KWP || 37210-74PA, 37210-74PE* || Lighting and turn switch || Parts catalogue
|-
| 0x778 || 0x788 || KWP || 33990-52R0, 33990-78R8* || Dual sensor brake support || Parts catalogue
|-
| 0x793 || 0x7A3 || UDS || 38910-77R0, 38910-78RC* || Airbag (SRS) controller || Parts catalogue
|-
| 0x772 || 0x782 || UDS || 38885-77R0, 38885-78R0* || 4WD shift controller || Parts catalogue
|-
| 0x799 || 0x7A9 || UDS || 38960-78RA, 38960-78RA* || E-call controller || Parts catalogue
|-
| 0x751 || 0x761 || UDS || 33580-79R0, 33580-78R0* || Central gateway || Label and parts catalogue
|}
Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

* KWP-style modules answer <code>1A 8E</code> and <code>1A 8A</code> (identification) and <code>18 00 FF 00</code> (DTCs). UDS-style modules answer <code>22 F1 01</code> and <code>22 F1 88</code> (identification) and <code>19 02 FF</code> (DTCs).
* Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
* Two names are inferred and not confirmed by a part label: 0x261 (ABS) and 0x778 (dual sensor brake support). All the others come from the parts catalogue, a label, or a test.
* The E-call controller (0x799) returned a stored code record (<code>92 4E 00</code>, status 02) that the Launch report does not list. Its meaning is not known.

=== Instrument cluster output test (0x274 / 0x674) ===
A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:
{| class="wikitable"
! Request !! Reply !! Notes
|-
| <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished
|}
The meaning of the four control bytes (80 40 00 00) is not known.

* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A more reliable pressure scale (more gauge readings at low and high pressure are needed; the lowest calibration point is 0.027 bar off).
* Whether the central gateway forwards the request to the TPMS controller or remaps the address.
* Why Torque Pro stops after the first line of the reply (the adapter is ruled out).
* The meaning of the control bytes (80 40 00 00) in the instrument cluster sweep command.
* The meaning of the stored code from the E-call controller.
* Confirming the ABS (0x261) and dual sensor brake support (0x778) names.

== Sources ==
* Owner PCAN-View captures, October 2026.
* Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
* Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
* BigJimny forum thread "JB74 OBD2 connection" (December 2020).
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* RealDash-extras OBD2 documentation (OBD2 XML description file).
* Car Scanner ELM OBD2 custom PID documentation.

[[Category:Jimny technical]]
[[Category:JB74]]
[[Category:Electrical - gen3]]
[[Category:FAQ - gen3]]
[[Category:Howto - gen3]]

[[Category:Electrical - gen4]]
[[Category:FAQ - gen4]]
[[Category:Howto - gen4]]

OBD2 Diagnostics reading project

2026-11-01T10:48:34Z

Mlines: /* Calibration */

= Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link =

{{Donate}}
== Overview ==
Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

=== Equipment ===
{| class="wikitable"
! Role !! Item
|-
| Head unit || XTRONS PX90
|-
| OBD-II Bluetooth dongle 1 || Generic ELM-based (Chinese)
|-
| OBD-II Bluetooth dongle 2 || Veepeak OBDCheck BLE+ (BLE only; unreliable on this head unit)
|-
| CAN bus monitor (Windows) || PCAN-View (PEAK-System)
|-
| Diagnostic tool 1 || Launch X431 CRP919
|-
| Diagnostic tool 2 || SZ Viewer app
|-
| Head-unit apps tried || Torque Pro (fails past the first line), RealDash (TPMS values seen in its debug view; gauges in progress), Car Scanner Pro (works)
|-
| Head-unit Bluetooth || xTRONS IP90 - Classic Bluetooth only, no BLE support
|}

=== Method ===
# The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
# PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
# The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.
'''Status:''' work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures (including a full Launch scan and an instrument cluster test), the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC) and the Suzuki parts catalogue. TPMS readings work in Car Scanner Pro; RealDash works in its debug view with gauges in progress. Items marked ''unconfirmed'' are not yet verified.

* The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
* Request ID '''0x798''', reply ID '''0x7A8''' (11-bit CAN, 500 kbit/s, ISO-TP framing) returns the TPMS data, including four sensor IDs and pressure readings. The module's identification reply (37160-61M0) matches the Model No. (P61M0) on the TPMS controller label. Whether the central gateway forwards or remaps the request is unconfirmed.
* Service '''0x21''' (read data by local identifier), identifier '''0x00''', returns 102 bytes containing all four sensor records.
* Pressure is byte +6 of each sensor record: bar = raw x 0.01372.
* The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.
* Working: Car Scanner Pro, and RealDash (values seen in its debug view). Not working: Torque Pro.

== DLC (OBD socket) wiring ==
The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal ''n'' matches standard pin ''17 - n''.

{| class="wikitable"
! Manual terminal !! Standard pin !! Function !! Wire / source on diagram
|-
| 1 || 16 || Battery +12 V || GRY, fuse No.49 "DOME2" (10 A)
|-
| 12 || 5 || Signal ground || BLK
|-
| 13 || 4 || Chassis ground || BLK
|-
| 11 || 6 || CAN-H (from standard assignment) || BLU, gateway pin 8
|-
| 3 || 14 || CAN-L (from standard assignment) || WHT, gateway pin 7
|}

Use pins '''6''' and '''14''' for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

=== Cross-check with other reports ===
A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

* The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
* No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
* On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

== Network layout ==
The DLC is not on the vehicle bus directly. The '''central gateway control module''' joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

== Diagnostic requests seen ==
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
|-
| <code>18 00 FF 00</code> || <code>58 00</code> or <code>58 01 9A 31 E0</code> || Read DTCs by status (second form = one code reported; not decoded)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block (repeated about twice a second by the scan tool)
|}
Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The <code>1A 8E</code> reply (37160-61M0) matches the TPMS controller's base number and model number; the <code>1A 8A</code> reply (37120-78R0*) shares "78R0" with the full part number, but its meaning is not confirmed.

A Launch full scan reported "Left Front Tire Pressure Low" for the TPMS module, and the module returned one stored code (<code>9A 31</code>) in the same scan. That code is probably the low-pressure warning (inferred; the report does not show the code itself).

== Reading it with an ELM327 ==
Terminal commands, one at a time (CR line ending):
<pre>
ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100
</pre>
* <code>ATSH798</code> sets the request address. The reply address (0x7A8) is worked out automatically.
* <code>ATFCSH798 / ATFCSD300000 / ATFCSM1</code> make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
* <code>ATS0</code> removes the spaces between bytes. Without it, the generic Chinese ELM327-based dongle (dongle 1) reported <code>BUFFER FULL</code> near byte 81.
* Expected output: a length line (<code>066</code> = 102 bytes) and numbered lines <code>0:</code> to <code>E:</code>.
* With default settings dongle 1 returned only the first line (<code>61 00 xx 01 00 00</code>).

== Reply layout (21 00) ==
Byte positions count the <code>61</code> as byte 0.
{| class="wikitable"
! Bytes !! Content
|-
| 0-1 || <code>61 00</code> (positive reply)
|-
| 2 || Varies 117-142. Looks like system voltage x 10 (''unconfirmed'')
|-
| 12-21 || Sensor record 1: front left
|-
| 22-31 || Sensor record 2: rear left
|-
| 32-41 || Sensor record 3: rear right
|-
| 42-51 || Sensor record 4: front right
|-
| 56-71 || Four 4-byte sensor-ID entries whose contents change (meaning unknown)
|-
| other || Not decoded
|}

=== Sensor record (10 bytes) ===
{| class="wikitable"
! Offset !! Content
|-
| +0 to +3 || Sensor ID
|-
| +4 || Position flag
|-
| +5 || Value 57-74. Behaves like temperature, possibly with an offset of 40 (''unconfirmed'')
|-
| +6 || Pressure, gauge: bar = raw x 0.01372 (see Calibration)
|-
| +7, +8 || Not understood
|-
| +9 || Always 0
|}

{| class="wikitable"
! Wheel !! Sensor ID !! Position flag
|-
| Front left || 4E AA 09 43 || 0x10
|-
| Rear left || DD 91 B5 25 || 0x20
|-
| Rear right || 4E AA 03 19 || 0x18
|-
| Front right || 4E AA 09 C9 || 0x08
|}
Sensor IDs are specific to one car. Yours will differ.

== Calibration ==
Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.
{| class="wikitable"
! Raw !! Gauge (bar) !! Raw x 0.01372
|-
| 136 (rear left) || 1.868 || 1.866
|-
| 131 (rear right) || 1.795 || 1.797
|-
| 131 (front right) || 1.795 || 1.797
|-
| 126 || 1.73 || 1.729
|-
| 119 || 1.63 || 1.633
|-
| 112 || 1.54 || 1.537
|-
| 101 || 1.39 || 1.386
|-
| 96 || 1.29 || 1.317
|}
The last five rows are from one tyre, the front left, during a slow deflation.
* bar = raw x 0.01372
* psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

== Torque Pro custom PIDs ==
Common fields for every wheel:
{| class="wikitable"
! Field !! Value
|-
| Header || 798
|-
| Mode and PID || 2100
|-
| Diagnostic start command || <code>ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1</code> (comma-separated)
|-
| Unit / min / max || bar, 0, 4 (or psi, 0, 60)
|}

Equation uses a letter for each data byte. <code>A</code> is the first byte after <code>61 00</code> (reply byte 2).
{| class="wikitable"
! Wheel !! Byte +5 (temperature?) !! Byte +6 (pressure candidate)” to “Byte +6 (pressure)”
|-
| Front left || P || Q
|-
| Front right || AT || AU
|-
| Rear left || Z || AA
|-
| Rear right || AJ || AK
|}
Example: <code>Q*0.01372</code>. Letters must be upper case. Whether Torque accepts two-letter variables is ''unconfirmed''.

=== Known problem ===
Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on the XTRONS PX90, Torque read bytes <code>A</code> to <code>D</code> (first line of the reply) correctly, but every byte from <code>E</code> onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding <code>ATH1</code> changed the output). Tried without success: turning off "Faster communication" and removing <code>ATS0</code>. Not tried: <code>ATAT0, ATSTFF</code> timeout settings.

Dongle 2 (Veepeak OBDCheck BLE+) gave the same result, but the head unit does not support BLE, so that test is not reliable. Car Scanner Pro reads every byte with dongle 1 and the same commands, so the limitation appears to be in how Torque Pro handles this multi-line reply, not in the adapter. Unresolved; a request has been posted on the Torque forum.

== Car Scanner Pro (working) ==
Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:
* Header: 798
* Request: 2100
* Start command (backslash-separated): <code>ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1</code>
* Equations use the same letters as the table above, for example <code>Q*0.01372</code> for front left (bar)

The start command has not yet been shortened. Tested with dongle 1 (generic ELM327-based) on the XTRONS PX90.

== RealDash ==
RealDash describes its OBD2 communication in an XML file. With dongle 1, RealDash's default init plus the lines below works: the TPMS sensors reply, and the values appear in RealDash's debug view. Dashboard gauges are in progress.

Changes to RealDash's default file:
* Add the three flow-control commands to the init section, before the <code>0100</code> and <code>0120</code> checks.
* Every TPMS command sets <code>header="atsh798"</code>. The docs say to set the header on every command when the rotation uses more than one. Any standard command in the same rotation then needs <code>header="atsh7df"</code>, or it would be sent to 0x798.
* RealDash requires <code>ATE0</code>, <code>ATL0</code> and <code>ATS0</code> (already in its default init).

<pre>
<init>
... RealDash default init lines ...
<command send="atfcsh798"></command>
<command send="atfcsd300000"></command>
<command send="atfcsm1"></command>
<command send="0100"></command>
<command send="0120"></command>
</init>
<rotation>
<command send="2100" header="atsh798" skipCount="10" keepInRotation="true" name="TPMS: front left" units="bar" conversionABC="Q*0.01372"></command>
<command send="2100" header="atsh798" skipCount="11" keepInRotation="true" name="TPMS: front right" units="bar" conversionABC="AU*0.01372"></command>
<command send="2100" header="atsh798" skipCount="12" keepInRotation="true" name="TPMS: rear left" units="bar" conversionABC="AA*0.01372"></command>
<command send="2100" header="atsh798" skipCount="13" keepInRotation="true" name="TPMS: rear right" units="bar" conversionABC="AK*0.01372"></command>
</rotation>
</pre>

<code>conversionABC</code> uses the same letters as Torque and Car Scanner (A is the first byte after 61 00). The TPMS inputs appear in RealDash's ECU Specific category.

The Veepeak OBDCheck BLE+ (dongle 2) was intermittent with RealDash because the head unit does not support BLE. An earlier init that replaced RealDash's timing defaults with <code>ATAT0</code> and <code>ATSTFF</code> showed BUS ERROR and STOPPED messages; the dongle used was not recorded.

== Other modules found by a full scan ==
A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

{| class="wikitable"
! Request !! Reply !! Protocol !! Identification replies !! Module !! How identified
|-
| 0x7E0 || 0x7E8 || KWP || 33980-78R0, 33980-78RC* || ECM || Standard engine address
|-
| 0x261 || 0x661 || KWP || 56100-77RA, 56100-78RF* || ABS (inferred) || Only brake module left by elimination
|-
| 0x263 || 0x663 || KWP || 38720-77R0, 38720-77R0* || EPS controller || Parts catalogue
|-
| 0x271 || 0x671 || KWP || 36775-77R0, 36775-77RC* || Body control module || Parts catalogue
|-
| 0x274 || 0x674 || KWP || 34100-78R0, 34110-78RD* || Instrument cluster || Rev counter sweep test
|-
| 0x798 || 0x7A8 || KWP || 37160-61M0, 37120-78R0* || TPMS controller || Label and parts catalogue
|-
| 0x79A || 0x7AA || KWP || 37210-74PA, 37210-74PE* || Lighting and turn switch || Parts catalogue
|-
| 0x778 || 0x788 || KWP || 33990-52R0, 33990-78R8* || Dual sensor brake support || Parts catalogue
|-
| 0x793 || 0x7A3 || UDS || 38910-77R0, 38910-78RC* || Airbag (SRS) controller || Parts catalogue
|-
| 0x772 || 0x782 || UDS || 38885-77R0, 38885-78R0* || 4WD shift controller || Parts catalogue
|-
| 0x799 || 0x7A9 || UDS || 38960-78RA, 38960-78RA* || E-call controller || Parts catalogue
|-
| 0x751 || 0x761 || UDS || 33580-79R0, 33580-78R0* || Central gateway || Label and parts catalogue
|}
Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

* KWP-style modules answer <code>1A 8E</code> and <code>1A 8A</code> (identification) and <code>18 00 FF 00</code> (DTCs). UDS-style modules answer <code>22 F1 01</code> and <code>22 F1 88</code> (identification) and <code>19 02 FF</code> (DTCs).
* Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
* Two names are inferred and not confirmed by a part label: 0x261 (ABS) and 0x778 (dual sensor brake support). All the others come from the parts catalogue, a label, or a test.
* The E-call controller (0x799) returned a stored code record (<code>92 4E 00</code>, status 02) that the Launch report does not list. Its meaning is not known.

=== Instrument cluster output test (0x274 / 0x674) ===
A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:
{| class="wikitable"
! Request !! Reply !! Notes
|-
| <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished
|}
The meaning of the four control bytes (80 40 00 00) is not known.

* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A more reliable pressure scale (more gauge readings at low and high pressure are needed; the lowest calibration point is 0.027 bar off).
* Whether the central gateway forwards the request to the TPMS controller or remaps the address.
* Why Torque Pro stops after the first line of the reply (the adapter is ruled out).
* The meaning of the control bytes (80 40 00 00) in the instrument cluster sweep command.
* The meaning of the stored code from the E-call controller.
* Confirming the ABS (0x261) and dual sensor brake support (0x778) names.

== Sources ==
* Owner PCAN-View captures, October 2026.
* Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
* Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
* BigJimny forum thread "JB74 OBD2 connection" (December 2020).
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* RealDash-extras OBD2 documentation (OBD2 XML description file).
* Car Scanner ELM OBD2 custom PID documentation.

[[Category:Jimny technical]]
[[Category:JB74]]
[[Category:Electrical - gen3]]
[[Category:FAQ - gen3]]
[[Category:Howto - gen3]]

[[Category:Electrical - gen4]]
[[Category:FAQ - gen4]]
[[Category:Howto - gen4]]

OBD2 Diagnostics reading project

2026-11-01T10:45:07Z

Mlines: /* Sources */

= Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link =

{{Donate}}
== Overview ==
Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

=== Equipment ===
{| class="wikitable"
! Role !! Item
|-
| Head unit || XTRONS PX90
|-
| OBD-II Bluetooth dongle 1 || Generic ELM-based (Chinese)
|-
| OBD-II Bluetooth dongle 2 || Veepeak OBDCheck BLE+ (BLE only; unreliable on this head unit)
|-
| CAN bus monitor (Windows) || PCAN-View (PEAK-System)
|-
| Diagnostic tool 1 || Launch X431 CRP919
|-
| Diagnostic tool 2 || SZ Viewer app
|-
| Head-unit apps tried || Torque Pro (fails past the first line), RealDash (TPMS values seen in its debug view; gauges in progress), Car Scanner Pro (works)
|-
| Head-unit Bluetooth || xTRONS IP90 - Classic Bluetooth only, no BLE support
|}

=== Method ===
# The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
# PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
# The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.
'''Status:''' work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures (including a full Launch scan and an instrument cluster test), the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC) and the Suzuki parts catalogue. TPMS readings work in Car Scanner Pro; RealDash works in its debug view with gauges in progress. Items marked ''unconfirmed'' are not yet verified.

* The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
* Request ID '''0x798''', reply ID '''0x7A8''' (11-bit CAN, 500 kbit/s, ISO-TP framing) returns the TPMS data, including four sensor IDs and pressure readings. The module's identification reply (37160-61M0) matches the Model No. (P61M0) on the TPMS controller label. Whether the central gateway forwards or remaps the request is unconfirmed.
* Service '''0x21''' (read data by local identifier), identifier '''0x00''', returns 102 bytes containing all four sensor records.
* Pressure is byte +6 of each sensor record: bar = raw x 0.01372.
* The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.
* Working: Car Scanner Pro, and RealDash (values seen in its debug view). Not working: Torque Pro.

== DLC (OBD socket) wiring ==
The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal ''n'' matches standard pin ''17 - n''.

{| class="wikitable"
! Manual terminal !! Standard pin !! Function !! Wire / source on diagram
|-
| 1 || 16 || Battery +12 V || GRY, fuse No.49 "DOME2" (10 A)
|-
| 12 || 5 || Signal ground || BLK
|-
| 13 || 4 || Chassis ground || BLK
|-
| 11 || 6 || CAN-H (from standard assignment) || BLU, gateway pin 8
|-
| 3 || 14 || CAN-L (from standard assignment) || WHT, gateway pin 7
|}

Use pins '''6''' and '''14''' for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

=== Cross-check with other reports ===
A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

* The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
* No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
* On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

== Network layout ==
The DLC is not on the vehicle bus directly. The '''central gateway control module''' joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

== Diagnostic requests seen ==
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
|-
| <code>18 00 FF 00</code> || <code>58 00</code> or <code>58 01 9A 31 E0</code> || Read DTCs by status (second form = one code reported; not decoded)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block (repeated about twice a second by the scan tool)
|}
Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The <code>1A 8E</code> reply (37160-61M0) matches the TPMS controller's base number and model number; the <code>1A 8A</code> reply (37120-78R0*) shares "78R0" with the full part number, but its meaning is not confirmed.

A Launch full scan reported "Left Front Tire Pressure Low" for the TPMS module, and the module returned one stored code (<code>9A 31</code>) in the same scan. That code is probably the low-pressure warning (inferred; the report does not show the code itself).

== Reading it with an ELM327 ==
Terminal commands, one at a time (CR line ending):
<pre>
ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100
</pre>
* <code>ATSH798</code> sets the request address. The reply address (0x7A8) is worked out automatically.
* <code>ATFCSH798 / ATFCSD300000 / ATFCSM1</code> make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
* <code>ATS0</code> removes the spaces between bytes. Without it, the generic Chinese ELM327-based dongle (dongle 1) reported <code>BUFFER FULL</code> near byte 81.
* Expected output: a length line (<code>066</code> = 102 bytes) and numbered lines <code>0:</code> to <code>E:</code>.
* With default settings dongle 1 returned only the first line (<code>61 00 xx 01 00 00</code>).

== Reply layout (21 00) ==
Byte positions count the <code>61</code> as byte 0.
{| class="wikitable"
! Bytes !! Content
|-
| 0-1 || <code>61 00</code> (positive reply)
|-
| 2 || Varies 117-142. Looks like system voltage x 10 (''unconfirmed'')
|-
| 12-21 || Sensor record 1: front left
|-
| 22-31 || Sensor record 2: rear left
|-
| 32-41 || Sensor record 3: rear right
|-
| 42-51 || Sensor record 4: front right
|-
| 56-71 || Four 4-byte sensor-ID entries whose contents change (meaning unknown)
|-
| other || Not decoded
|}

=== Sensor record (10 bytes) ===
{| class="wikitable"
! Offset !! Content
|-
| +0 to +3 || Sensor ID
|-
| +4 || Position flag
|-
| +5 || Value 57-74. Behaves like temperature, possibly with an offset of 40 (''unconfirmed'')
|-
| +6 || Pressure, gauge: bar = raw x 0.01372 (see Calibration)
|-
| +7, +8 || Not understood
|-
| +9 || Always 0
|}

{| class="wikitable"
! Wheel !! Sensor ID !! Position flag
|-
| Front left || 4E AA 09 43 || 0x10
|-
| Rear left || DD 91 B5 25 || 0x20
|-
| Rear right || 4E AA 03 19 || 0x18
|-
| Front right || 4E AA 09 C9 || 0x08
|}
Sensor IDs are specific to one car. Yours will differ.

== Calibration ==
Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.
{| class="wikitable"
! Raw !! Gauge (bar) !! Raw x 0.01372
|-
| 136 (rear left) || 1.868 || 1.866
|-
| 131 (rear right) || 1.795 || 1.797
|-
| 131 (front right) || 1.795 || 1.797
|-
| 126 || 1.73 || 1.729
|-
| 119 || 1.63 || 1.633
|-
| 112 || 1.54 || 1.537
|-
| 101 || 1.39 || 1.386
|-
| 96 || 1.29 || 1.317
|}
The last five rows are from one tyre during a slow deflation (assumed front left).
* bar = raw x 0.01372
* psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

== Torque Pro custom PIDs ==
Common fields for every wheel:
{| class="wikitable"
! Field !! Value
|-
| Header || 798
|-
| Mode and PID || 2100
|-
| Diagnostic start command || <code>ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1</code> (comma-separated)
|-
| Unit / min / max || bar, 0, 4 (or psi, 0, 60)
|}

Equation uses a letter for each data byte. <code>A</code> is the first byte after <code>61 00</code> (reply byte 2).
{| class="wikitable"
! Wheel !! Byte +5 (temperature?) !! Byte +6 (pressure candidate)” to “Byte +6 (pressure)”
|-
| Front left || P || Q
|-
| Front right || AT || AU
|-
| Rear left || Z || AA
|-
| Rear right || AJ || AK
|}
Example: <code>Q*0.01372</code>. Letters must be upper case. Whether Torque accepts two-letter variables is ''unconfirmed''.

=== Known problem ===
Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on the XTRONS PX90, Torque read bytes <code>A</code> to <code>D</code> (first line of the reply) correctly, but every byte from <code>E</code> onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding <code>ATH1</code> changed the output). Tried without success: turning off "Faster communication" and removing <code>ATS0</code>. Not tried: <code>ATAT0, ATSTFF</code> timeout settings.

Dongle 2 (Veepeak OBDCheck BLE+) gave the same result, but the head unit does not support BLE, so that test is not reliable. Car Scanner Pro reads every byte with dongle 1 and the same commands, so the limitation appears to be in how Torque Pro handles this multi-line reply, not in the adapter. Unresolved; a request has been posted on the Torque forum.

== Car Scanner Pro (working) ==
Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:
* Header: 798
* Request: 2100
* Start command (backslash-separated): <code>ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1</code>
* Equations use the same letters as the table above, for example <code>Q*0.01372</code> for front left (bar)

The start command has not yet been shortened. Tested with dongle 1 (generic ELM327-based) on the XTRONS PX90.

== RealDash ==
RealDash describes its OBD2 communication in an XML file. With dongle 1, RealDash's default init plus the lines below works: the TPMS sensors reply, and the values appear in RealDash's debug view. Dashboard gauges are in progress.

Changes to RealDash's default file:
* Add the three flow-control commands to the init section, before the <code>0100</code> and <code>0120</code> checks.
* Every TPMS command sets <code>header="atsh798"</code>. The docs say to set the header on every command when the rotation uses more than one. Any standard command in the same rotation then needs <code>header="atsh7df"</code>, or it would be sent to 0x798.
* RealDash requires <code>ATE0</code>, <code>ATL0</code> and <code>ATS0</code> (already in its default init).

<pre>
<init>
... RealDash default init lines ...
<command send="atfcsh798"></command>
<command send="atfcsd300000"></command>
<command send="atfcsm1"></command>
<command send="0100"></command>
<command send="0120"></command>
</init>
<rotation>
<command send="2100" header="atsh798" skipCount="10" keepInRotation="true" name="TPMS: front left" units="bar" conversionABC="Q*0.01372"></command>
<command send="2100" header="atsh798" skipCount="11" keepInRotation="true" name="TPMS: front right" units="bar" conversionABC="AU*0.01372"></command>
<command send="2100" header="atsh798" skipCount="12" keepInRotation="true" name="TPMS: rear left" units="bar" conversionABC="AA*0.01372"></command>
<command send="2100" header="atsh798" skipCount="13" keepInRotation="true" name="TPMS: rear right" units="bar" conversionABC="AK*0.01372"></command>
</rotation>
</pre>

<code>conversionABC</code> uses the same letters as Torque and Car Scanner (A is the first byte after 61 00). The TPMS inputs appear in RealDash's ECU Specific category.

The Veepeak OBDCheck BLE+ (dongle 2) was intermittent with RealDash because the head unit does not support BLE. An earlier init that replaced RealDash's timing defaults with <code>ATAT0</code> and <code>ATSTFF</code> showed BUS ERROR and STOPPED messages; the dongle used was not recorded.

== Other modules found by a full scan ==
A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

{| class="wikitable"
! Request !! Reply !! Protocol !! Identification replies !! Module !! How identified
|-
| 0x7E0 || 0x7E8 || KWP || 33980-78R0, 33980-78RC* || ECM || Standard engine address
|-
| 0x261 || 0x661 || KWP || 56100-77RA, 56100-78RF* || ABS (inferred) || Only brake module left by elimination
|-
| 0x263 || 0x663 || KWP || 38720-77R0, 38720-77R0* || EPS controller || Parts catalogue
|-
| 0x271 || 0x671 || KWP || 36775-77R0, 36775-77RC* || Body control module || Parts catalogue
|-
| 0x274 || 0x674 || KWP || 34100-78R0, 34110-78RD* || Instrument cluster || Rev counter sweep test
|-
| 0x798 || 0x7A8 || KWP || 37160-61M0, 37120-78R0* || TPMS controller || Label and parts catalogue
|-
| 0x79A || 0x7AA || KWP || 37210-74PA, 37210-74PE* || Lighting and turn switch || Parts catalogue
|-
| 0x778 || 0x788 || KWP || 33990-52R0, 33990-78R8* || Dual sensor brake support || Parts catalogue
|-
| 0x793 || 0x7A3 || UDS || 38910-77R0, 38910-78RC* || Airbag (SRS) controller || Parts catalogue
|-
| 0x772 || 0x782 || UDS || 38885-77R0, 38885-78R0* || 4WD shift controller || Parts catalogue
|-
| 0x799 || 0x7A9 || UDS || 38960-78RA, 38960-78RA* || E-call controller || Parts catalogue
|-
| 0x751 || 0x761 || UDS || 33580-79R0, 33580-78R0* || Central gateway || Label and parts catalogue
|}
Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

* KWP-style modules answer <code>1A 8E</code> and <code>1A 8A</code> (identification) and <code>18 00 FF 00</code> (DTCs). UDS-style modules answer <code>22 F1 01</code> and <code>22 F1 88</code> (identification) and <code>19 02 FF</code> (DTCs).
* Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
* Two names are inferred and not confirmed by a part label: 0x261 (ABS) and 0x778 (dual sensor brake support). All the others come from the parts catalogue, a label, or a test.
* The E-call controller (0x799) returned a stored code record (<code>92 4E 00</code>, status 02) that the Launch report does not list. Its meaning is not known.

=== Instrument cluster output test (0x274 / 0x674) ===
A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:
{| class="wikitable"
! Request !! Reply !! Notes
|-
| <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished
|}
The meaning of the four control bytes (80 40 00 00) is not known.

* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A more reliable pressure scale (more gauge readings at low and high pressure are needed; the lowest calibration point is 0.027 bar off).
* Whether the central gateway forwards the request to the TPMS controller or remaps the address.
* Why Torque Pro stops after the first line of the reply (the adapter is ruled out).
* The meaning of the control bytes (80 40 00 00) in the instrument cluster sweep command.
* The meaning of the stored code from the E-call controller.
* Confirming the ABS (0x261) and dual sensor brake support (0x778) names.

== Sources ==
* Owner PCAN-View captures, October 2026.
* Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
* Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
* BigJimny forum thread "JB74 OBD2 connection" (December 2020).
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* RealDash-extras OBD2 documentation (OBD2 XML description file).
* Car Scanner ELM OBD2 custom PID documentation.

[[Category:Jimny technical]]
[[Category:JB74]]
[[Category:Electrical - gen3]]
[[Category:FAQ - gen3]]
[[Category:Howto - gen3]]

[[Category:Electrical - gen4]]
[[Category:FAQ - gen4]]
[[Category:Howto - gen4]]

OBD2 Diagnostics reading project

2026-11-01T10:44:11Z

Mlines: /* Open questions */

= Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link =

{{Donate}}
== Overview ==
Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

=== Equipment ===
{| class="wikitable"
! Role !! Item
|-
| Head unit || XTRONS PX90
|-
| OBD-II Bluetooth dongle 1 || Generic ELM-based (Chinese)
|-
| OBD-II Bluetooth dongle 2 || Veepeak OBDCheck BLE+ (BLE only; unreliable on this head unit)
|-
| CAN bus monitor (Windows) || PCAN-View (PEAK-System)
|-
| Diagnostic tool 1 || Launch X431 CRP919
|-
| Diagnostic tool 2 || SZ Viewer app
|-
| Head-unit apps tried || Torque Pro (fails past the first line), RealDash (TPMS values seen in its debug view; gauges in progress), Car Scanner Pro (works)
|-
| Head-unit Bluetooth || xTRONS IP90 - Classic Bluetooth only, no BLE support
|}

=== Method ===
# The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
# PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
# The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.
'''Status:''' work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures (including a full Launch scan and an instrument cluster test), the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC) and the Suzuki parts catalogue. TPMS readings work in Car Scanner Pro; RealDash works in its debug view with gauges in progress. Items marked ''unconfirmed'' are not yet verified.

* The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
* Request ID '''0x798''', reply ID '''0x7A8''' (11-bit CAN, 500 kbit/s, ISO-TP framing) returns the TPMS data, including four sensor IDs and pressure readings. The module's identification reply (37160-61M0) matches the Model No. (P61M0) on the TPMS controller label. Whether the central gateway forwards or remaps the request is unconfirmed.
* Service '''0x21''' (read data by local identifier), identifier '''0x00''', returns 102 bytes containing all four sensor records.
* Pressure is byte +6 of each sensor record: bar = raw x 0.01372.
* The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.
* Working: Car Scanner Pro, and RealDash (values seen in its debug view). Not working: Torque Pro.

== DLC (OBD socket) wiring ==
The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal ''n'' matches standard pin ''17 - n''.

{| class="wikitable"
! Manual terminal !! Standard pin !! Function !! Wire / source on diagram
|-
| 1 || 16 || Battery +12 V || GRY, fuse No.49 "DOME2" (10 A)
|-
| 12 || 5 || Signal ground || BLK
|-
| 13 || 4 || Chassis ground || BLK
|-
| 11 || 6 || CAN-H (from standard assignment) || BLU, gateway pin 8
|-
| 3 || 14 || CAN-L (from standard assignment) || WHT, gateway pin 7
|}

Use pins '''6''' and '''14''' for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

=== Cross-check with other reports ===
A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

* The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
* No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
* On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

== Network layout ==
The DLC is not on the vehicle bus directly. The '''central gateway control module''' joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

== Diagnostic requests seen ==
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
|-
| <code>18 00 FF 00</code> || <code>58 00</code> or <code>58 01 9A 31 E0</code> || Read DTCs by status (second form = one code reported; not decoded)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block (repeated about twice a second by the scan tool)
|}
Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The <code>1A 8E</code> reply (37160-61M0) matches the TPMS controller's base number and model number; the <code>1A 8A</code> reply (37120-78R0*) shares "78R0" with the full part number, but its meaning is not confirmed.

A Launch full scan reported "Left Front Tire Pressure Low" for the TPMS module, and the module returned one stored code (<code>9A 31</code>) in the same scan. That code is probably the low-pressure warning (inferred; the report does not show the code itself).

== Reading it with an ELM327 ==
Terminal commands, one at a time (CR line ending):
<pre>
ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100
</pre>
* <code>ATSH798</code> sets the request address. The reply address (0x7A8) is worked out automatically.
* <code>ATFCSH798 / ATFCSD300000 / ATFCSM1</code> make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
* <code>ATS0</code> removes the spaces between bytes. Without it, the generic Chinese ELM327-based dongle (dongle 1) reported <code>BUFFER FULL</code> near byte 81.
* Expected output: a length line (<code>066</code> = 102 bytes) and numbered lines <code>0:</code> to <code>E:</code>.
* With default settings dongle 1 returned only the first line (<code>61 00 xx 01 00 00</code>).

== Reply layout (21 00) ==
Byte positions count the <code>61</code> as byte 0.
{| class="wikitable"
! Bytes !! Content
|-
| 0-1 || <code>61 00</code> (positive reply)
|-
| 2 || Varies 117-142. Looks like system voltage x 10 (''unconfirmed'')
|-
| 12-21 || Sensor record 1: front left
|-
| 22-31 || Sensor record 2: rear left
|-
| 32-41 || Sensor record 3: rear right
|-
| 42-51 || Sensor record 4: front right
|-
| 56-71 || Four 4-byte sensor-ID entries whose contents change (meaning unknown)
|-
| other || Not decoded
|}

=== Sensor record (10 bytes) ===
{| class="wikitable"
! Offset !! Content
|-
| +0 to +3 || Sensor ID
|-
| +4 || Position flag
|-
| +5 || Value 57-74. Behaves like temperature, possibly with an offset of 40 (''unconfirmed'')
|-
| +6 || Pressure, gauge: bar = raw x 0.01372 (see Calibration)
|-
| +7, +8 || Not understood
|-
| +9 || Always 0
|}

{| class="wikitable"
! Wheel !! Sensor ID !! Position flag
|-
| Front left || 4E AA 09 43 || 0x10
|-
| Rear left || DD 91 B5 25 || 0x20
|-
| Rear right || 4E AA 03 19 || 0x18
|-
| Front right || 4E AA 09 C9 || 0x08
|}
Sensor IDs are specific to one car. Yours will differ.

== Calibration ==
Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.
{| class="wikitable"
! Raw !! Gauge (bar) !! Raw x 0.01372
|-
| 136 (rear left) || 1.868 || 1.866
|-
| 131 (rear right) || 1.795 || 1.797
|-
| 131 (front right) || 1.795 || 1.797
|-
| 126 || 1.73 || 1.729
|-
| 119 || 1.63 || 1.633
|-
| 112 || 1.54 || 1.537
|-
| 101 || 1.39 || 1.386
|-
| 96 || 1.29 || 1.317
|}
The last five rows are from one tyre during a slow deflation (assumed front left).
* bar = raw x 0.01372
* psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

== Torque Pro custom PIDs ==
Common fields for every wheel:
{| class="wikitable"
! Field !! Value
|-
| Header || 798
|-
| Mode and PID || 2100
|-
| Diagnostic start command || <code>ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1</code> (comma-separated)
|-
| Unit / min / max || bar, 0, 4 (or psi, 0, 60)
|}

Equation uses a letter for each data byte. <code>A</code> is the first byte after <code>61 00</code> (reply byte 2).
{| class="wikitable"
! Wheel !! Byte +5 (temperature?) !! Byte +6 (pressure candidate)” to “Byte +6 (pressure)”
|-
| Front left || P || Q
|-
| Front right || AT || AU
|-
| Rear left || Z || AA
|-
| Rear right || AJ || AK
|}
Example: <code>Q*0.01372</code>. Letters must be upper case. Whether Torque accepts two-letter variables is ''unconfirmed''.

=== Known problem ===
Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on the XTRONS PX90, Torque read bytes <code>A</code> to <code>D</code> (first line of the reply) correctly, but every byte from <code>E</code> onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding <code>ATH1</code> changed the output). Tried without success: turning off "Faster communication" and removing <code>ATS0</code>. Not tried: <code>ATAT0, ATSTFF</code> timeout settings.

Dongle 2 (Veepeak OBDCheck BLE+) gave the same result, but the head unit does not support BLE, so that test is not reliable. Car Scanner Pro reads every byte with dongle 1 and the same commands, so the limitation appears to be in how Torque Pro handles this multi-line reply, not in the adapter. Unresolved; a request has been posted on the Torque forum.

== Car Scanner Pro (working) ==
Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:
* Header: 798
* Request: 2100
* Start command (backslash-separated): <code>ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1</code>
* Equations use the same letters as the table above, for example <code>Q*0.01372</code> for front left (bar)

The start command has not yet been shortened. Tested with dongle 1 (generic ELM327-based) on the XTRONS PX90.

== RealDash ==
RealDash describes its OBD2 communication in an XML file. With dongle 1, RealDash's default init plus the lines below works: the TPMS sensors reply, and the values appear in RealDash's debug view. Dashboard gauges are in progress.

Changes to RealDash's default file:
* Add the three flow-control commands to the init section, before the <code>0100</code> and <code>0120</code> checks.
* Every TPMS command sets <code>header="atsh798"</code>. The docs say to set the header on every command when the rotation uses more than one. Any standard command in the same rotation then needs <code>header="atsh7df"</code>, or it would be sent to 0x798.
* RealDash requires <code>ATE0</code>, <code>ATL0</code> and <code>ATS0</code> (already in its default init).

<pre>
<init>
... RealDash default init lines ...
<command send="atfcsh798"></command>
<command send="atfcsd300000"></command>
<command send="atfcsm1"></command>
<command send="0100"></command>
<command send="0120"></command>
</init>
<rotation>
<command send="2100" header="atsh798" skipCount="10" keepInRotation="true" name="TPMS: front left" units="bar" conversionABC="Q*0.01372"></command>
<command send="2100" header="atsh798" skipCount="11" keepInRotation="true" name="TPMS: front right" units="bar" conversionABC="AU*0.01372"></command>
<command send="2100" header="atsh798" skipCount="12" keepInRotation="true" name="TPMS: rear left" units="bar" conversionABC="AA*0.01372"></command>
<command send="2100" header="atsh798" skipCount="13" keepInRotation="true" name="TPMS: rear right" units="bar" conversionABC="AK*0.01372"></command>
</rotation>
</pre>

<code>conversionABC</code> uses the same letters as Torque and Car Scanner (A is the first byte after 61 00). The TPMS inputs appear in RealDash's ECU Specific category.

The Veepeak OBDCheck BLE+ (dongle 2) was intermittent with RealDash because the head unit does not support BLE. An earlier init that replaced RealDash's timing defaults with <code>ATAT0</code> and <code>ATSTFF</code> showed BUS ERROR and STOPPED messages; the dongle used was not recorded.

== Other modules found by a full scan ==
A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

{| class="wikitable"
! Request !! Reply !! Protocol !! Identification replies !! Module !! How identified
|-
| 0x7E0 || 0x7E8 || KWP || 33980-78R0, 33980-78RC* || ECM || Standard engine address
|-
| 0x261 || 0x661 || KWP || 56100-77RA, 56100-78RF* || ABS (inferred) || Only brake module left by elimination
|-
| 0x263 || 0x663 || KWP || 38720-77R0, 38720-77R0* || EPS controller || Parts catalogue
|-
| 0x271 || 0x671 || KWP || 36775-77R0, 36775-77RC* || Body control module || Parts catalogue
|-
| 0x274 || 0x674 || KWP || 34100-78R0, 34110-78RD* || Instrument cluster || Rev counter sweep test
|-
| 0x798 || 0x7A8 || KWP || 37160-61M0, 37120-78R0* || TPMS controller || Label and parts catalogue
|-
| 0x79A || 0x7AA || KWP || 37210-74PA, 37210-74PE* || Lighting and turn switch || Parts catalogue
|-
| 0x778 || 0x788 || KWP || 33990-52R0, 33990-78R8* || Dual sensor brake support || Parts catalogue
|-
| 0x793 || 0x7A3 || UDS || 38910-77R0, 38910-78RC* || Airbag (SRS) controller || Parts catalogue
|-
| 0x772 || 0x782 || UDS || 38885-77R0, 38885-78R0* || 4WD shift controller || Parts catalogue
|-
| 0x799 || 0x7A9 || UDS || 38960-78RA, 38960-78RA* || E-call controller || Parts catalogue
|-
| 0x751 || 0x761 || UDS || 33580-79R0, 33580-78R0* || Central gateway || Label and parts catalogue
|}
Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

* KWP-style modules answer <code>1A 8E</code> and <code>1A 8A</code> (identification) and <code>18 00 FF 00</code> (DTCs). UDS-style modules answer <code>22 F1 01</code> and <code>22 F1 88</code> (identification) and <code>19 02 FF</code> (DTCs).
* Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
* Two names are inferred and not confirmed by a part label: 0x261 (ABS) and 0x778 (dual sensor brake support). All the others come from the parts catalogue, a label, or a test.
* The E-call controller (0x799) returned a stored code record (<code>92 4E 00</code>, status 02) that the Launch report does not list. Its meaning is not known.

=== Instrument cluster output test (0x274 / 0x674) ===
A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:
{| class="wikitable"
! Request !! Reply !! Notes
|-
| <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished
|}
The meaning of the four control bytes (80 40 00 00) is not known.

* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A more reliable pressure scale (more gauge readings at low and high pressure are needed; the lowest calibration point is 0.027 bar off).
* Whether the central gateway forwards the request to the TPMS controller or remaps the address.
* Why Torque Pro stops after the first line of the reply (the adapter is ruled out).
* The meaning of the control bytes (80 40 00 00) in the instrument cluster sweep command.
* The meaning of the stored code from the E-call controller.
* Confirming the ABS (0x261) and dual sensor brake support (0x778) names.

== Sources ==
* Owner PCAN-View captures, October 2026.
* Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
* Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
* BigJimny forum thread "JB74 OBD2 connection" (December 2020).

[[Category:Jimny technical]]
[[Category:JB74]]
[[Category:Electrical - gen3]]
[[Category:FAQ - gen3]]
[[Category:Howto - gen3]]

[[Category:Electrical - gen4]]
[[Category:FAQ - gen4]]
[[Category:Howto - gen4]]

OBD2 Diagnostics reading project

2026-11-01T10:43:51Z

Mlines: /* Other modules found by a full scan */

= Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link =

{{Donate}}
== Overview ==
Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

=== Equipment ===
{| class="wikitable"
! Role !! Item
|-
| Head unit || XTRONS PX90
|-
| OBD-II Bluetooth dongle 1 || Generic ELM-based (Chinese)
|-
| OBD-II Bluetooth dongle 2 || Veepeak OBDCheck BLE+ (BLE only; unreliable on this head unit)
|-
| CAN bus monitor (Windows) || PCAN-View (PEAK-System)
|-
| Diagnostic tool 1 || Launch X431 CRP919
|-
| Diagnostic tool 2 || SZ Viewer app
|-
| Head-unit apps tried || Torque Pro (fails past the first line), RealDash (TPMS values seen in its debug view; gauges in progress), Car Scanner Pro (works)
|-
| Head-unit Bluetooth || xTRONS IP90 - Classic Bluetooth only, no BLE support
|}

=== Method ===
# The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
# PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
# The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.
'''Status:''' work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures (including a full Launch scan and an instrument cluster test), the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC) and the Suzuki parts catalogue. TPMS readings work in Car Scanner Pro; RealDash works in its debug view with gauges in progress. Items marked ''unconfirmed'' are not yet verified.

* The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
* Request ID '''0x798''', reply ID '''0x7A8''' (11-bit CAN, 500 kbit/s, ISO-TP framing) returns the TPMS data, including four sensor IDs and pressure readings. The module's identification reply (37160-61M0) matches the Model No. (P61M0) on the TPMS controller label. Whether the central gateway forwards or remaps the request is unconfirmed.
* Service '''0x21''' (read data by local identifier), identifier '''0x00''', returns 102 bytes containing all four sensor records.
* Pressure is byte +6 of each sensor record: bar = raw x 0.01372.
* The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.
* Working: Car Scanner Pro, and RealDash (values seen in its debug view). Not working: Torque Pro.

== DLC (OBD socket) wiring ==
The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal ''n'' matches standard pin ''17 - n''.

{| class="wikitable"
! Manual terminal !! Standard pin !! Function !! Wire / source on diagram
|-
| 1 || 16 || Battery +12 V || GRY, fuse No.49 "DOME2" (10 A)
|-
| 12 || 5 || Signal ground || BLK
|-
| 13 || 4 || Chassis ground || BLK
|-
| 11 || 6 || CAN-H (from standard assignment) || BLU, gateway pin 8
|-
| 3 || 14 || CAN-L (from standard assignment) || WHT, gateway pin 7
|}

Use pins '''6''' and '''14''' for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

=== Cross-check with other reports ===
A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

* The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
* No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
* On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

== Network layout ==
The DLC is not on the vehicle bus directly. The '''central gateway control module''' joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

== Diagnostic requests seen ==
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
|-
| <code>18 00 FF 00</code> || <code>58 00</code> or <code>58 01 9A 31 E0</code> || Read DTCs by status (second form = one code reported; not decoded)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block (repeated about twice a second by the scan tool)
|}
Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The <code>1A 8E</code> reply (37160-61M0) matches the TPMS controller's base number and model number; the <code>1A 8A</code> reply (37120-78R0*) shares "78R0" with the full part number, but its meaning is not confirmed.

A Launch full scan reported "Left Front Tire Pressure Low" for the TPMS module, and the module returned one stored code (<code>9A 31</code>) in the same scan. That code is probably the low-pressure warning (inferred; the report does not show the code itself).

== Reading it with an ELM327 ==
Terminal commands, one at a time (CR line ending):
<pre>
ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100
</pre>
* <code>ATSH798</code> sets the request address. The reply address (0x7A8) is worked out automatically.
* <code>ATFCSH798 / ATFCSD300000 / ATFCSM1</code> make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
* <code>ATS0</code> removes the spaces between bytes. Without it, the generic Chinese ELM327-based dongle (dongle 1) reported <code>BUFFER FULL</code> near byte 81.
* Expected output: a length line (<code>066</code> = 102 bytes) and numbered lines <code>0:</code> to <code>E:</code>.
* With default settings dongle 1 returned only the first line (<code>61 00 xx 01 00 00</code>).

== Reply layout (21 00) ==
Byte positions count the <code>61</code> as byte 0.
{| class="wikitable"
! Bytes !! Content
|-
| 0-1 || <code>61 00</code> (positive reply)
|-
| 2 || Varies 117-142. Looks like system voltage x 10 (''unconfirmed'')
|-
| 12-21 || Sensor record 1: front left
|-
| 22-31 || Sensor record 2: rear left
|-
| 32-41 || Sensor record 3: rear right
|-
| 42-51 || Sensor record 4: front right
|-
| 56-71 || Four 4-byte sensor-ID entries whose contents change (meaning unknown)
|-
| other || Not decoded
|}

=== Sensor record (10 bytes) ===
{| class="wikitable"
! Offset !! Content
|-
| +0 to +3 || Sensor ID
|-
| +4 || Position flag
|-
| +5 || Value 57-74. Behaves like temperature, possibly with an offset of 40 (''unconfirmed'')
|-
| +6 || Pressure, gauge: bar = raw x 0.01372 (see Calibration)
|-
| +7, +8 || Not understood
|-
| +9 || Always 0
|}

{| class="wikitable"
! Wheel !! Sensor ID !! Position flag
|-
| Front left || 4E AA 09 43 || 0x10
|-
| Rear left || DD 91 B5 25 || 0x20
|-
| Rear right || 4E AA 03 19 || 0x18
|-
| Front right || 4E AA 09 C9 || 0x08
|}
Sensor IDs are specific to one car. Yours will differ.

== Calibration ==
Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.
{| class="wikitable"
! Raw !! Gauge (bar) !! Raw x 0.01372
|-
| 136 (rear left) || 1.868 || 1.866
|-
| 131 (rear right) || 1.795 || 1.797
|-
| 131 (front right) || 1.795 || 1.797
|-
| 126 || 1.73 || 1.729
|-
| 119 || 1.63 || 1.633
|-
| 112 || 1.54 || 1.537
|-
| 101 || 1.39 || 1.386
|-
| 96 || 1.29 || 1.317
|}
The last five rows are from one tyre during a slow deflation (assumed front left).
* bar = raw x 0.01372
* psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

== Torque Pro custom PIDs ==
Common fields for every wheel:
{| class="wikitable"
! Field !! Value
|-
| Header || 798
|-
| Mode and PID || 2100
|-
| Diagnostic start command || <code>ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1</code> (comma-separated)
|-
| Unit / min / max || bar, 0, 4 (or psi, 0, 60)
|}

Equation uses a letter for each data byte. <code>A</code> is the first byte after <code>61 00</code> (reply byte 2).
{| class="wikitable"
! Wheel !! Byte +5 (temperature?) !! Byte +6 (pressure candidate)” to “Byte +6 (pressure)”
|-
| Front left || P || Q
|-
| Front right || AT || AU
|-
| Rear left || Z || AA
|-
| Rear right || AJ || AK
|}
Example: <code>Q*0.01372</code>. Letters must be upper case. Whether Torque accepts two-letter variables is ''unconfirmed''.

=== Known problem ===
Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on the XTRONS PX90, Torque read bytes <code>A</code> to <code>D</code> (first line of the reply) correctly, but every byte from <code>E</code> onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding <code>ATH1</code> changed the output). Tried without success: turning off "Faster communication" and removing <code>ATS0</code>. Not tried: <code>ATAT0, ATSTFF</code> timeout settings.

Dongle 2 (Veepeak OBDCheck BLE+) gave the same result, but the head unit does not support BLE, so that test is not reliable. Car Scanner Pro reads every byte with dongle 1 and the same commands, so the limitation appears to be in how Torque Pro handles this multi-line reply, not in the adapter. Unresolved; a request has been posted on the Torque forum.

== Car Scanner Pro (working) ==
Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:
* Header: 798
* Request: 2100
* Start command (backslash-separated): <code>ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1</code>
* Equations use the same letters as the table above, for example <code>Q*0.01372</code> for front left (bar)

The start command has not yet been shortened. Tested with dongle 1 (generic ELM327-based) on the XTRONS PX90.

== RealDash ==
RealDash describes its OBD2 communication in an XML file. With dongle 1, RealDash's default init plus the lines below works: the TPMS sensors reply, and the values appear in RealDash's debug view. Dashboard gauges are in progress.

Changes to RealDash's default file:
* Add the three flow-control commands to the init section, before the <code>0100</code> and <code>0120</code> checks.
* Every TPMS command sets <code>header="atsh798"</code>. The docs say to set the header on every command when the rotation uses more than one. Any standard command in the same rotation then needs <code>header="atsh7df"</code>, or it would be sent to 0x798.
* RealDash requires <code>ATE0</code>, <code>ATL0</code> and <code>ATS0</code> (already in its default init).

<pre>
<init>
... RealDash default init lines ...
<command send="atfcsh798"></command>
<command send="atfcsd300000"></command>
<command send="atfcsm1"></command>
<command send="0100"></command>
<command send="0120"></command>
</init>
<rotation>
<command send="2100" header="atsh798" skipCount="10" keepInRotation="true" name="TPMS: front left" units="bar" conversionABC="Q*0.01372"></command>
<command send="2100" header="atsh798" skipCount="11" keepInRotation="true" name="TPMS: front right" units="bar" conversionABC="AU*0.01372"></command>
<command send="2100" header="atsh798" skipCount="12" keepInRotation="true" name="TPMS: rear left" units="bar" conversionABC="AA*0.01372"></command>
<command send="2100" header="atsh798" skipCount="13" keepInRotation="true" name="TPMS: rear right" units="bar" conversionABC="AK*0.01372"></command>
</rotation>
</pre>

<code>conversionABC</code> uses the same letters as Torque and Car Scanner (A is the first byte after 61 00). The TPMS inputs appear in RealDash's ECU Specific category.

The Veepeak OBDCheck BLE+ (dongle 2) was intermittent with RealDash because the head unit does not support BLE. An earlier init that replaced RealDash's timing defaults with <code>ATAT0</code> and <code>ATSTFF</code> showed BUS ERROR and STOPPED messages; the dongle used was not recorded.

== Other modules found by a full scan ==
A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

{| class="wikitable"
! Request !! Reply !! Protocol !! Identification replies !! Module !! How identified
|-
| 0x7E0 || 0x7E8 || KWP || 33980-78R0, 33980-78RC* || ECM || Standard engine address
|-
| 0x261 || 0x661 || KWP || 56100-77RA, 56100-78RF* || ABS (inferred) || Only brake module left by elimination
|-
| 0x263 || 0x663 || KWP || 38720-77R0, 38720-77R0* || EPS controller || Parts catalogue
|-
| 0x271 || 0x671 || KWP || 36775-77R0, 36775-77RC* || Body control module || Parts catalogue
|-
| 0x274 || 0x674 || KWP || 34100-78R0, 34110-78RD* || Instrument cluster || Rev counter sweep test
|-
| 0x798 || 0x7A8 || KWP || 37160-61M0, 37120-78R0* || TPMS controller || Label and parts catalogue
|-
| 0x79A || 0x7AA || KWP || 37210-74PA, 37210-74PE* || Lighting and turn switch || Parts catalogue
|-
| 0x778 || 0x788 || KWP || 33990-52R0, 33990-78R8* || Dual sensor brake support || Parts catalogue
|-
| 0x793 || 0x7A3 || UDS || 38910-77R0, 38910-78RC* || Airbag (SRS) controller || Parts catalogue
|-
| 0x772 || 0x782 || UDS || 38885-77R0, 38885-78R0* || 4WD shift controller || Parts catalogue
|-
| 0x799 || 0x7A9 || UDS || 38960-78RA, 38960-78RA* || E-call controller || Parts catalogue
|-
| 0x751 || 0x761 || UDS || 33580-79R0, 33580-78R0* || Central gateway || Label and parts catalogue
|}
Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

* KWP-style modules answer <code>1A 8E</code> and <code>1A 8A</code> (identification) and <code>18 00 FF 00</code> (DTCs). UDS-style modules answer <code>22 F1 01</code> and <code>22 F1 88</code> (identification) and <code>19 02 FF</code> (DTCs).
* Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
* Two names are inferred and not confirmed by a part label: 0x261 (ABS) and 0x778 (dual sensor brake support). All the others come from the parts catalogue, a label, or a test.
* The E-call controller (0x799) returned a stored code record (<code>92 4E 00</code>, status 02) that the Launch report does not list. Its meaning is not known.

=== Instrument cluster output test (0x274 / 0x674) ===
A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:
{| class="wikitable"
! Request !! Reply !! Notes
|-
| <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished
|}
The meaning of the four control bytes (80 40 00 00) is not known.

== Open questions ==
* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A reliable pressure scale and offset (more gauge readings needed).
* Whether other Suzuki modules use addresses near 0x798 (not checked).
* Why Torque stops after the first line.

== Sources ==
* Owner PCAN-View captures, October 2026.
* Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
* Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
* BigJimny forum thread "JB74 OBD2 connection" (December 2020).

[[Category:Jimny technical]]
[[Category:JB74]]
[[Category:Electrical - gen3]]
[[Category:FAQ - gen3]]
[[Category:Howto - gen3]]

[[Category:Electrical - gen4]]
[[Category:FAQ - gen4]]
[[Category:Howto - gen4]]

OBD2 Diagnostics reading project

2026-11-01T10:42:26Z

Mlines: /* Car Scanner Pro (working) */

= Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link =

{{Donate}}
== Overview ==
Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

=== Equipment ===
{| class="wikitable"
! Role !! Item
|-
| Head unit || XTRONS PX90
|-
| OBD-II Bluetooth dongle 1 || Generic ELM-based (Chinese)
|-
| OBD-II Bluetooth dongle 2 || Veepeak OBDCheck BLE+ (BLE only; unreliable on this head unit)
|-
| CAN bus monitor (Windows) || PCAN-View (PEAK-System)
|-
| Diagnostic tool 1 || Launch X431 CRP919
|-
| Diagnostic tool 2 || SZ Viewer app
|-
| Head-unit apps tried || Torque Pro (fails past the first line), RealDash (TPMS values seen in its debug view; gauges in progress), Car Scanner Pro (works)
|-
| Head-unit Bluetooth || xTRONS IP90 - Classic Bluetooth only, no BLE support
|}

=== Method ===
# The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
# PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
# The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.
'''Status:''' work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures (including a full Launch scan and an instrument cluster test), the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC) and the Suzuki parts catalogue. TPMS readings work in Car Scanner Pro; RealDash works in its debug view with gauges in progress. Items marked ''unconfirmed'' are not yet verified.

* The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
* Request ID '''0x798''', reply ID '''0x7A8''' (11-bit CAN, 500 kbit/s, ISO-TP framing) returns the TPMS data, including four sensor IDs and pressure readings. The module's identification reply (37160-61M0) matches the Model No. (P61M0) on the TPMS controller label. Whether the central gateway forwards or remaps the request is unconfirmed.
* Service '''0x21''' (read data by local identifier), identifier '''0x00''', returns 102 bytes containing all four sensor records.
* Pressure is byte +6 of each sensor record: bar = raw x 0.01372.
* The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.
* Working: Car Scanner Pro, and RealDash (values seen in its debug view). Not working: Torque Pro.

== DLC (OBD socket) wiring ==
The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal ''n'' matches standard pin ''17 - n''.

{| class="wikitable"
! Manual terminal !! Standard pin !! Function !! Wire / source on diagram
|-
| 1 || 16 || Battery +12 V || GRY, fuse No.49 "DOME2" (10 A)
|-
| 12 || 5 || Signal ground || BLK
|-
| 13 || 4 || Chassis ground || BLK
|-
| 11 || 6 || CAN-H (from standard assignment) || BLU, gateway pin 8
|-
| 3 || 14 || CAN-L (from standard assignment) || WHT, gateway pin 7
|}

Use pins '''6''' and '''14''' for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

=== Cross-check with other reports ===
A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

* The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
* No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
* On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

== Network layout ==
The DLC is not on the vehicle bus directly. The '''central gateway control module''' joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

== Diagnostic requests seen ==
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
|-
| <code>18 00 FF 00</code> || <code>58 00</code> or <code>58 01 9A 31 E0</code> || Read DTCs by status (second form = one code reported; not decoded)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block (repeated about twice a second by the scan tool)
|}
Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The <code>1A 8E</code> reply (37160-61M0) matches the TPMS controller's base number and model number; the <code>1A 8A</code> reply (37120-78R0*) shares "78R0" with the full part number, but its meaning is not confirmed.

A Launch full scan reported "Left Front Tire Pressure Low" for the TPMS module, and the module returned one stored code (<code>9A 31</code>) in the same scan. That code is probably the low-pressure warning (inferred; the report does not show the code itself).

== Reading it with an ELM327 ==
Terminal commands, one at a time (CR line ending):
<pre>
ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100
</pre>
* <code>ATSH798</code> sets the request address. The reply address (0x7A8) is worked out automatically.
* <code>ATFCSH798 / ATFCSD300000 / ATFCSM1</code> make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
* <code>ATS0</code> removes the spaces between bytes. Without it, the generic Chinese ELM327-based dongle (dongle 1) reported <code>BUFFER FULL</code> near byte 81.
* Expected output: a length line (<code>066</code> = 102 bytes) and numbered lines <code>0:</code> to <code>E:</code>.
* With default settings dongle 1 returned only the first line (<code>61 00 xx 01 00 00</code>).

== Reply layout (21 00) ==
Byte positions count the <code>61</code> as byte 0.
{| class="wikitable"
! Bytes !! Content
|-
| 0-1 || <code>61 00</code> (positive reply)
|-
| 2 || Varies 117-142. Looks like system voltage x 10 (''unconfirmed'')
|-
| 12-21 || Sensor record 1: front left
|-
| 22-31 || Sensor record 2: rear left
|-
| 32-41 || Sensor record 3: rear right
|-
| 42-51 || Sensor record 4: front right
|-
| 56-71 || Four 4-byte sensor-ID entries whose contents change (meaning unknown)
|-
| other || Not decoded
|}

=== Sensor record (10 bytes) ===
{| class="wikitable"
! Offset !! Content
|-
| +0 to +3 || Sensor ID
|-
| +4 || Position flag
|-
| +5 || Value 57-74. Behaves like temperature, possibly with an offset of 40 (''unconfirmed'')
|-
| +6 || Pressure, gauge: bar = raw x 0.01372 (see Calibration)
|-
| +7, +8 || Not understood
|-
| +9 || Always 0
|}

{| class="wikitable"
! Wheel !! Sensor ID !! Position flag
|-
| Front left || 4E AA 09 43 || 0x10
|-
| Rear left || DD 91 B5 25 || 0x20
|-
| Rear right || 4E AA 03 19 || 0x18
|-
| Front right || 4E AA 09 C9 || 0x08
|}
Sensor IDs are specific to one car. Yours will differ.

== Calibration ==
Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.
{| class="wikitable"
! Raw !! Gauge (bar) !! Raw x 0.01372
|-
| 136 (rear left) || 1.868 || 1.866
|-
| 131 (rear right) || 1.795 || 1.797
|-
| 131 (front right) || 1.795 || 1.797
|-
| 126 || 1.73 || 1.729
|-
| 119 || 1.63 || 1.633
|-
| 112 || 1.54 || 1.537
|-
| 101 || 1.39 || 1.386
|-
| 96 || 1.29 || 1.317
|}
The last five rows are from one tyre during a slow deflation (assumed front left).
* bar = raw x 0.01372
* psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

== Torque Pro custom PIDs ==
Common fields for every wheel:
{| class="wikitable"
! Field !! Value
|-
| Header || 798
|-
| Mode and PID || 2100
|-
| Diagnostic start command || <code>ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1</code> (comma-separated)
|-
| Unit / min / max || bar, 0, 4 (or psi, 0, 60)
|}

Equation uses a letter for each data byte. <code>A</code> is the first byte after <code>61 00</code> (reply byte 2).
{| class="wikitable"
! Wheel !! Byte +5 (temperature?) !! Byte +6 (pressure candidate)” to “Byte +6 (pressure)”
|-
| Front left || P || Q
|-
| Front right || AT || AU
|-
| Rear left || Z || AA
|-
| Rear right || AJ || AK
|}
Example: <code>Q*0.01372</code>. Letters must be upper case. Whether Torque accepts two-letter variables is ''unconfirmed''.

=== Known problem ===
Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on the XTRONS PX90, Torque read bytes <code>A</code> to <code>D</code> (first line of the reply) correctly, but every byte from <code>E</code> onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding <code>ATH1</code> changed the output). Tried without success: turning off "Faster communication" and removing <code>ATS0</code>. Not tried: <code>ATAT0, ATSTFF</code> timeout settings.

Dongle 2 (Veepeak OBDCheck BLE+) gave the same result, but the head unit does not support BLE, so that test is not reliable. Car Scanner Pro reads every byte with dongle 1 and the same commands, so the limitation appears to be in how Torque Pro handles this multi-line reply, not in the adapter. Unresolved; a request has been posted on the Torque forum.

== Car Scanner Pro (working) ==
Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:
* Header: 798
* Request: 2100
* Start command (backslash-separated): <code>ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1</code>
* Equations use the same letters as the table above, for example <code>Q*0.01372</code> for front left (bar)

The start command has not yet been shortened. Tested with dongle 1 (generic ELM327-based) on the XTRONS PX90.

== RealDash ==
RealDash describes its OBD2 communication in an XML file. With dongle 1, RealDash's default init plus the lines below works: the TPMS sensors reply, and the values appear in RealDash's debug view. Dashboard gauges are in progress.

Changes to RealDash's default file:
* Add the three flow-control commands to the init section, before the <code>0100</code> and <code>0120</code> checks.
* Every TPMS command sets <code>header="atsh798"</code>. The docs say to set the header on every command when the rotation uses more than one. Any standard command in the same rotation then needs <code>header="atsh7df"</code>, or it would be sent to 0x798.
* RealDash requires <code>ATE0</code>, <code>ATL0</code> and <code>ATS0</code> (already in its default init).

<pre>
<init>
... RealDash default init lines ...
<command send="atfcsh798"></command>
<command send="atfcsd300000"></command>
<command send="atfcsm1"></command>
<command send="0100"></command>
<command send="0120"></command>
</init>
<rotation>
<command send="2100" header="atsh798" skipCount="10" keepInRotation="true" name="TPMS: front left" units="bar" conversionABC="Q*0.01372"></command>
<command send="2100" header="atsh798" skipCount="11" keepInRotation="true" name="TPMS: front right" units="bar" conversionABC="AU*0.01372"></command>
<command send="2100" header="atsh798" skipCount="12" keepInRotation="true" name="TPMS: rear left" units="bar" conversionABC="AA*0.01372"></command>
<command send="2100" header="atsh798" skipCount="13" keepInRotation="true" name="TPMS: rear right" units="bar" conversionABC="AK*0.01372"></command>
</rotation>
</pre>

<code>conversionABC</code> uses the same letters as Torque and Car Scanner (A is the first byte after 61 00). The TPMS inputs appear in RealDash's ECU Specific category.

The Veepeak OBDCheck BLE+ (dongle 2) was intermittent with RealDash because the head unit does not support BLE. An earlier init that replaced RealDash's timing defaults with <code>ATAT0</code> and <code>ATSTFF</code> showed BUS ERROR and STOPPED messages; the dongle used was not recorded.

== Other modules found by a full scan ==
A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

{| class="wikitable"
! Request !! Reply !! Protocol !! Identification replies !! Module !! How identified
|-
| 0x7E0 || 0x7E8 || KWP || 33980-78R0, 33980-78RC* || ECM || Standard engine address
|-
| 0x261 || 0x661 || KWP || 56100-77RA, 56100-78RF* || ABS (inferred) || Only brake module left by elimination
|-
| 0x263 || 0x663 || KWP || 38720-77R0, 38720-77R0* || EPS controller || Parts catalogue
|-
| 0x271 || 0x671 || KWP || 36775-77R0, 36775-77RC* || Body control module || Parts catalogue
|-
| 0x274 || 0x674 || KWP || 34100-78R0, 34110-78RD* || Instrument cluster || Rev counter sweep test
|-
| 0x798 || 0x7A8 || KWP || 37160-61M0, 37120-78R0* || TPMS controller || Label and parts catalogue
|-
| 0x79A || 0x7AA || KWP || 37210-74PA, 37210-74PE* || Lighting and turn switch || Parts catalogue
|-
| 0x778 || 0x788 || KWP || 33990-52R0, 33990-78R8* || Dual sensor brake support || Parts catalogue
|-
| 0x793 || 0x7A3 || UDS || 38910-77R0, 38910-78RC* || Airbag (SRS) controller || Parts catalogue
|-
| 0x772 || 0x782 || UDS || 38885-77R0, 38885-78R0* || 4WD shift controller || Parts catalogue
|-
| 0x799 || 0x7A9 || UDS || 38960-78RA, 38960-78RA* || E-call controller || Parts catalogue
|-
| 0x751 || 0x761 || UDS || 33580-79R0, 33580-78R0* || Central gateway || Label and parts catalogue
|}
Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

* KWP-style modules answer <code>1A 8E</code> and <code>1A 8A</code> (identification) and <code>18 00 FF 00</code> (DTCs). UDS-style modules answer <code>22 F1 01</code> and <code>22 F1 88</code> (identification) and <code>19 02 FF</code> (DTCs).
* Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
* The "probable" and "possible" names are guesses from the part-number series and are not confirmed.

=== Instrument cluster output test (0x274 / 0x674) ===
A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:
{| class="wikitable"
! Request !! Reply !! Notes
|-
| <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished
|}
The meaning of the four control bytes (80 40 00 00) is not known.

== Open questions ==
* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A reliable pressure scale and offset (more gauge readings needed).
* Whether other Suzuki modules use addresses near 0x798 (not checked).
* Why Torque stops after the first line.

== Sources ==
* Owner PCAN-View captures, October 2026.
* Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
* Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
* BigJimny forum thread "JB74 OBD2 connection" (December 2020).

[[Category:Jimny technical]]
[[Category:JB74]]
[[Category:Electrical - gen3]]
[[Category:FAQ - gen3]]
[[Category:Howto - gen3]]

[[Category:Electrical - gen4]]
[[Category:FAQ - gen4]]
[[Category:Howto - gen4]]

OBD2 Diagnostics reading project

2026-11-01T10:41:59Z

Mlines: /* Car Scanner Pro (working) */

= Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link =

{{Donate}}
== Overview ==
Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

=== Equipment ===
{| class="wikitable"
! Role !! Item
|-
| Head unit || XTRONS PX90
|-
| OBD-II Bluetooth dongle 1 || Generic ELM-based (Chinese)
|-
| OBD-II Bluetooth dongle 2 || Veepeak OBDCheck BLE+ (BLE only; unreliable on this head unit)
|-
| CAN bus monitor (Windows) || PCAN-View (PEAK-System)
|-
| Diagnostic tool 1 || Launch X431 CRP919
|-
| Diagnostic tool 2 || SZ Viewer app
|-
| Head-unit apps tried || Torque Pro (fails past the first line), RealDash (TPMS values seen in its debug view; gauges in progress), Car Scanner Pro (works)
|-
| Head-unit Bluetooth || xTRONS IP90 - Classic Bluetooth only, no BLE support
|}

=== Method ===
# The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
# PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
# The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.
'''Status:''' work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures (including a full Launch scan and an instrument cluster test), the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC) and the Suzuki parts catalogue. TPMS readings work in Car Scanner Pro; RealDash works in its debug view with gauges in progress. Items marked ''unconfirmed'' are not yet verified.

* The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
* Request ID '''0x798''', reply ID '''0x7A8''' (11-bit CAN, 500 kbit/s, ISO-TP framing) returns the TPMS data, including four sensor IDs and pressure readings. The module's identification reply (37160-61M0) matches the Model No. (P61M0) on the TPMS controller label. Whether the central gateway forwards or remaps the request is unconfirmed.
* Service '''0x21''' (read data by local identifier), identifier '''0x00''', returns 102 bytes containing all four sensor records.
* Pressure is byte +6 of each sensor record: bar = raw x 0.01372.
* The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.
* Working: Car Scanner Pro, and RealDash (values seen in its debug view). Not working: Torque Pro.

== DLC (OBD socket) wiring ==
The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal ''n'' matches standard pin ''17 - n''.

{| class="wikitable"
! Manual terminal !! Standard pin !! Function !! Wire / source on diagram
|-
| 1 || 16 || Battery +12 V || GRY, fuse No.49 "DOME2" (10 A)
|-
| 12 || 5 || Signal ground || BLK
|-
| 13 || 4 || Chassis ground || BLK
|-
| 11 || 6 || CAN-H (from standard assignment) || BLU, gateway pin 8
|-
| 3 || 14 || CAN-L (from standard assignment) || WHT, gateway pin 7
|}

Use pins '''6''' and '''14''' for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

=== Cross-check with other reports ===
A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

* The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
* No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
* On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

== Network layout ==
The DLC is not on the vehicle bus directly. The '''central gateway control module''' joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

== Diagnostic requests seen ==
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
|-
| <code>18 00 FF 00</code> || <code>58 00</code> or <code>58 01 9A 31 E0</code> || Read DTCs by status (second form = one code reported; not decoded)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block (repeated about twice a second by the scan tool)
|}
Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The <code>1A 8E</code> reply (37160-61M0) matches the TPMS controller's base number and model number; the <code>1A 8A</code> reply (37120-78R0*) shares "78R0" with the full part number, but its meaning is not confirmed.

A Launch full scan reported "Left Front Tire Pressure Low" for the TPMS module, and the module returned one stored code (<code>9A 31</code>) in the same scan. That code is probably the low-pressure warning (inferred; the report does not show the code itself).

== Reading it with an ELM327 ==
Terminal commands, one at a time (CR line ending):
<pre>
ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100
</pre>
* <code>ATSH798</code> sets the request address. The reply address (0x7A8) is worked out automatically.
* <code>ATFCSH798 / ATFCSD300000 / ATFCSM1</code> make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
* <code>ATS0</code> removes the spaces between bytes. Without it, the generic Chinese ELM327-based dongle (dongle 1) reported <code>BUFFER FULL</code> near byte 81.
* Expected output: a length line (<code>066</code> = 102 bytes) and numbered lines <code>0:</code> to <code>E:</code>.
* With default settings dongle 1 returned only the first line (<code>61 00 xx 01 00 00</code>).

== Reply layout (21 00) ==
Byte positions count the <code>61</code> as byte 0.
{| class="wikitable"
! Bytes !! Content
|-
| 0-1 || <code>61 00</code> (positive reply)
|-
| 2 || Varies 117-142. Looks like system voltage x 10 (''unconfirmed'')
|-
| 12-21 || Sensor record 1: front left
|-
| 22-31 || Sensor record 2: rear left
|-
| 32-41 || Sensor record 3: rear right
|-
| 42-51 || Sensor record 4: front right
|-
| 56-71 || Four 4-byte sensor-ID entries whose contents change (meaning unknown)
|-
| other || Not decoded
|}

=== Sensor record (10 bytes) ===
{| class="wikitable"
! Offset !! Content
|-
| +0 to +3 || Sensor ID
|-
| +4 || Position flag
|-
| +5 || Value 57-74. Behaves like temperature, possibly with an offset of 40 (''unconfirmed'')
|-
| +6 || Pressure, gauge: bar = raw x 0.01372 (see Calibration)
|-
| +7, +8 || Not understood
|-
| +9 || Always 0
|}

{| class="wikitable"
! Wheel !! Sensor ID !! Position flag
|-
| Front left || 4E AA 09 43 || 0x10
|-
| Rear left || DD 91 B5 25 || 0x20
|-
| Rear right || 4E AA 03 19 || 0x18
|-
| Front right || 4E AA 09 C9 || 0x08
|}
Sensor IDs are specific to one car. Yours will differ.

== Calibration ==
Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.
{| class="wikitable"
! Raw !! Gauge (bar) !! Raw x 0.01372
|-
| 136 (rear left) || 1.868 || 1.866
|-
| 131 (rear right) || 1.795 || 1.797
|-
| 131 (front right) || 1.795 || 1.797
|-
| 126 || 1.73 || 1.729
|-
| 119 || 1.63 || 1.633
|-
| 112 || 1.54 || 1.537
|-
| 101 || 1.39 || 1.386
|-
| 96 || 1.29 || 1.317
|}
The last five rows are from one tyre during a slow deflation (assumed front left).
* bar = raw x 0.01372
* psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

== Torque Pro custom PIDs ==
Common fields for every wheel:
{| class="wikitable"
! Field !! Value
|-
| Header || 798
|-
| Mode and PID || 2100
|-
| Diagnostic start command || <code>ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1</code> (comma-separated)
|-
| Unit / min / max || bar, 0, 4 (or psi, 0, 60)
|}

Equation uses a letter for each data byte. <code>A</code> is the first byte after <code>61 00</code> (reply byte 2).
{| class="wikitable"
! Wheel !! Byte +5 (temperature?) !! Byte +6 (pressure candidate)” to “Byte +6 (pressure)”
|-
| Front left || P || Q
|-
| Front right || AT || AU
|-
| Rear left || Z || AA
|-
| Rear right || AJ || AK
|}
Example: <code>Q*0.01372</code>. Letters must be upper case. Whether Torque accepts two-letter variables is ''unconfirmed''.

=== Known problem ===
Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on the XTRONS PX90, Torque read bytes <code>A</code> to <code>D</code> (first line of the reply) correctly, but every byte from <code>E</code> onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding <code>ATH1</code> changed the output). Tried without success: turning off "Faster communication" and removing <code>ATS0</code>. Not tried: <code>ATAT0, ATSTFF</code> timeout settings.

Dongle 2 (Veepeak OBDCheck BLE+) gave the same result, but the head unit does not support BLE, so that test is not reliable. Car Scanner Pro reads every byte with dongle 1 and the same commands, so the limitation appears to be in how Torque Pro handles this multi-line reply, not in the adapter. Unresolved; a request has been posted on the Torque forum.

== Car Scanner Pro (working) ==
Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:
* Header: 798
* Request: 2100
* Start command (backslash-separated): <code>ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1</code>
* Equations use the same letters as the table above, for example <code>Q*0.01372</code> for front left (bar)

The start command has not yet been shortened. Tested with dongle 1 (generic ELM327-based) on the XTRONS PX90.

== Other modules found by a full scan ==
A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

{| class="wikitable"
! Request !! Reply !! Protocol !! Identification replies !! Module !! How identified
|-
| 0x7E0 || 0x7E8 || KWP || 33980-78R0, 33980-78RC* || ECM || Standard engine address
|-
| 0x261 || 0x661 || KWP || 56100-77RA, 56100-78RF* || ABS (inferred) || Only brake module left by elimination
|-
| 0x263 || 0x663 || KWP || 38720-77R0, 38720-77R0* || EPS controller || Parts catalogue
|-
| 0x271 || 0x671 || KWP || 36775-77R0, 36775-77RC* || Body control module || Parts catalogue
|-
| 0x274 || 0x674 || KWP || 34100-78R0, 34110-78RD* || Instrument cluster || Rev counter sweep test
|-
| 0x798 || 0x7A8 || KWP || 37160-61M0, 37120-78R0* || TPMS controller || Label and parts catalogue
|-
| 0x79A || 0x7AA || KWP || 37210-74PA, 37210-74PE* || Lighting and turn switch || Parts catalogue
|-
| 0x778 || 0x788 || KWP || 33990-52R0, 33990-78R8* || Dual sensor brake support || Parts catalogue
|-
| 0x793 || 0x7A3 || UDS || 38910-77R0, 38910-78RC* || Airbag (SRS) controller || Parts catalogue
|-
| 0x772 || 0x782 || UDS || 38885-77R0, 38885-78R0* || 4WD shift controller || Parts catalogue
|-
| 0x799 || 0x7A9 || UDS || 38960-78RA, 38960-78RA* || E-call controller || Parts catalogue
|-
| 0x751 || 0x761 || UDS || 33580-79R0, 33580-78R0* || Central gateway || Label and parts catalogue
|}
Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

* KWP-style modules answer <code>1A 8E</code> and <code>1A 8A</code> (identification) and <code>18 00 FF 00</code> (DTCs). UDS-style modules answer <code>22 F1 01</code> and <code>22 F1 88</code> (identification) and <code>19 02 FF</code> (DTCs).
* Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
* The "probable" and "possible" names are guesses from the part-number series and are not confirmed.

=== Instrument cluster output test (0x274 / 0x674) ===
A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:
{| class="wikitable"
! Request !! Reply !! Notes
|-
| <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished
|}
The meaning of the four control bytes (80 40 00 00) is not known.

== Open questions ==
* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A reliable pressure scale and offset (more gauge readings needed).
* Whether other Suzuki modules use addresses near 0x798 (not checked).
* Why Torque stops after the first line.

== Sources ==
* Owner PCAN-View captures, October 2026.
* Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
* Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
* BigJimny forum thread "JB74 OBD2 connection" (December 2020).

[[Category:Jimny technical]]
[[Category:JB74]]
[[Category:Electrical - gen3]]
[[Category:FAQ - gen3]]
[[Category:Howto - gen3]]

[[Category:Electrical - gen4]]
[[Category:FAQ - gen4]]
[[Category:Howto - gen4]]

OBD2 Diagnostics reading project

2026-11-01T10:41:30Z

Mlines: /* Known problem */

= Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link =

{{Donate}}
== Overview ==
Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

=== Equipment ===
{| class="wikitable"
! Role !! Item
|-
| Head unit || XTRONS PX90
|-
| OBD-II Bluetooth dongle 1 || Generic ELM-based (Chinese)
|-
| OBD-II Bluetooth dongle 2 || Veepeak OBDCheck BLE+ (BLE only; unreliable on this head unit)
|-
| CAN bus monitor (Windows) || PCAN-View (PEAK-System)
|-
| Diagnostic tool 1 || Launch X431 CRP919
|-
| Diagnostic tool 2 || SZ Viewer app
|-
| Head-unit apps tried || Torque Pro (fails past the first line), RealDash (TPMS values seen in its debug view; gauges in progress), Car Scanner Pro (works)
|-
| Head-unit Bluetooth || xTRONS IP90 - Classic Bluetooth only, no BLE support
|}

=== Method ===
# The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
# PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
# The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.
'''Status:''' work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures (including a full Launch scan and an instrument cluster test), the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC) and the Suzuki parts catalogue. TPMS readings work in Car Scanner Pro; RealDash works in its debug view with gauges in progress. Items marked ''unconfirmed'' are not yet verified.

* The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
* Request ID '''0x798''', reply ID '''0x7A8''' (11-bit CAN, 500 kbit/s, ISO-TP framing) returns the TPMS data, including four sensor IDs and pressure readings. The module's identification reply (37160-61M0) matches the Model No. (P61M0) on the TPMS controller label. Whether the central gateway forwards or remaps the request is unconfirmed.
* Service '''0x21''' (read data by local identifier), identifier '''0x00''', returns 102 bytes containing all four sensor records.
* Pressure is byte +6 of each sensor record: bar = raw x 0.01372.
* The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.
* Working: Car Scanner Pro, and RealDash (values seen in its debug view). Not working: Torque Pro.

== DLC (OBD socket) wiring ==
The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal ''n'' matches standard pin ''17 - n''.

{| class="wikitable"
! Manual terminal !! Standard pin !! Function !! Wire / source on diagram
|-
| 1 || 16 || Battery +12 V || GRY, fuse No.49 "DOME2" (10 A)
|-
| 12 || 5 || Signal ground || BLK
|-
| 13 || 4 || Chassis ground || BLK
|-
| 11 || 6 || CAN-H (from standard assignment) || BLU, gateway pin 8
|-
| 3 || 14 || CAN-L (from standard assignment) || WHT, gateway pin 7
|}

Use pins '''6''' and '''14''' for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

=== Cross-check with other reports ===
A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

* The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
* No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
* On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

== Network layout ==
The DLC is not on the vehicle bus directly. The '''central gateway control module''' joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

== Diagnostic requests seen ==
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
|-
| <code>18 00 FF 00</code> || <code>58 00</code> or <code>58 01 9A 31 E0</code> || Read DTCs by status (second form = one code reported; not decoded)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block (repeated about twice a second by the scan tool)
|}
Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The <code>1A 8E</code> reply (37160-61M0) matches the TPMS controller's base number and model number; the <code>1A 8A</code> reply (37120-78R0*) shares "78R0" with the full part number, but its meaning is not confirmed.

A Launch full scan reported "Left Front Tire Pressure Low" for the TPMS module, and the module returned one stored code (<code>9A 31</code>) in the same scan. That code is probably the low-pressure warning (inferred; the report does not show the code itself).

== Reading it with an ELM327 ==
Terminal commands, one at a time (CR line ending):
<pre>
ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100
</pre>
* <code>ATSH798</code> sets the request address. The reply address (0x7A8) is worked out automatically.
* <code>ATFCSH798 / ATFCSD300000 / ATFCSM1</code> make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
* <code>ATS0</code> removes the spaces between bytes. Without it, the generic Chinese ELM327-based dongle (dongle 1) reported <code>BUFFER FULL</code> near byte 81.
* Expected output: a length line (<code>066</code> = 102 bytes) and numbered lines <code>0:</code> to <code>E:</code>.
* With default settings dongle 1 returned only the first line (<code>61 00 xx 01 00 00</code>).

== Reply layout (21 00) ==
Byte positions count the <code>61</code> as byte 0.
{| class="wikitable"
! Bytes !! Content
|-
| 0-1 || <code>61 00</code> (positive reply)
|-
| 2 || Varies 117-142. Looks like system voltage x 10 (''unconfirmed'')
|-
| 12-21 || Sensor record 1: front left
|-
| 22-31 || Sensor record 2: rear left
|-
| 32-41 || Sensor record 3: rear right
|-
| 42-51 || Sensor record 4: front right
|-
| 56-71 || Four 4-byte sensor-ID entries whose contents change (meaning unknown)
|-
| other || Not decoded
|}

=== Sensor record (10 bytes) ===
{| class="wikitable"
! Offset !! Content
|-
| +0 to +3 || Sensor ID
|-
| +4 || Position flag
|-
| +5 || Value 57-74. Behaves like temperature, possibly with an offset of 40 (''unconfirmed'')
|-
| +6 || Pressure, gauge: bar = raw x 0.01372 (see Calibration)
|-
| +7, +8 || Not understood
|-
| +9 || Always 0
|}

{| class="wikitable"
! Wheel !! Sensor ID !! Position flag
|-
| Front left || 4E AA 09 43 || 0x10
|-
| Rear left || DD 91 B5 25 || 0x20
|-
| Rear right || 4E AA 03 19 || 0x18
|-
| Front right || 4E AA 09 C9 || 0x08
|}
Sensor IDs are specific to one car. Yours will differ.

== Calibration ==
Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.
{| class="wikitable"
! Raw !! Gauge (bar) !! Raw x 0.01372
|-
| 136 (rear left) || 1.868 || 1.866
|-
| 131 (rear right) || 1.795 || 1.797
|-
| 131 (front right) || 1.795 || 1.797
|-
| 126 || 1.73 || 1.729
|-
| 119 || 1.63 || 1.633
|-
| 112 || 1.54 || 1.537
|-
| 101 || 1.39 || 1.386
|-
| 96 || 1.29 || 1.317
|}
The last five rows are from one tyre during a slow deflation (assumed front left).
* bar = raw x 0.01372
* psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

== Torque Pro custom PIDs ==
Common fields for every wheel:
{| class="wikitable"
! Field !! Value
|-
| Header || 798
|-
| Mode and PID || 2100
|-
| Diagnostic start command || <code>ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1</code> (comma-separated)
|-
| Unit / min / max || bar, 0, 4 (or psi, 0, 60)
|}

Equation uses a letter for each data byte. <code>A</code> is the first byte after <code>61 00</code> (reply byte 2).
{| class="wikitable"
! Wheel !! Byte +5 (temperature?) !! Byte +6 (pressure candidate)” to “Byte +6 (pressure)”
|-
| Front left || P || Q
|-
| Front right || AT || AU
|-
| Rear left || Z || AA
|-
| Rear right || AJ || AK
|}
Example: <code>Q*0.01372</code>. Letters must be upper case. Whether Torque accepts two-letter variables is ''unconfirmed''.

=== Known problem ===
Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on the XTRONS PX90, Torque read bytes <code>A</code> to <code>D</code> (first line of the reply) correctly, but every byte from <code>E</code> onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding <code>ATH1</code> changed the output). Tried without success: turning off "Faster communication" and removing <code>ATS0</code>. Not tried: <code>ATAT0, ATSTFF</code> timeout settings.

Dongle 2 (Veepeak OBDCheck BLE+) gave the same result, but the head unit does not support BLE, so that test is not reliable. Car Scanner Pro reads every byte with dongle 1 and the same commands, so the limitation appears to be in how Torque Pro handles this multi-line reply, not in the adapter. Unresolved; a request has been posted on the Torque forum.

== Car Scanner Pro (working) ==
Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:
* Header: 798
* Request: 2100
* Start command (backslash-separated): <code>ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1</code>
* Equations use the same letters as the table above, for example <code>Q*0.01372</code> for front left (bar)

The start command has not yet been shortened. Adapter: Both dongle 1 (generic ELM327-based) and dongle 2 (Veepeak OBDCheck BLE+) work with Car Scanner Pro.
== Other modules found by a full scan ==
A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

{| class="wikitable"
! Request !! Reply !! Protocol !! Identification replies !! Module !! How identified
|-
| 0x7E0 || 0x7E8 || KWP || 33980-78R0, 33980-78RC* || ECM || Standard engine address
|-
| 0x261 || 0x661 || KWP || 56100-77RA, 56100-78RF* || ABS (inferred) || Only brake module left by elimination
|-
| 0x263 || 0x663 || KWP || 38720-77R0, 38720-77R0* || EPS controller || Parts catalogue
|-
| 0x271 || 0x671 || KWP || 36775-77R0, 36775-77RC* || Body control module || Parts catalogue
|-
| 0x274 || 0x674 || KWP || 34100-78R0, 34110-78RD* || Instrument cluster || Rev counter sweep test
|-
| 0x798 || 0x7A8 || KWP || 37160-61M0, 37120-78R0* || TPMS controller || Label and parts catalogue
|-
| 0x79A || 0x7AA || KWP || 37210-74PA, 37210-74PE* || Lighting and turn switch || Parts catalogue
|-
| 0x778 || 0x788 || KWP || 33990-52R0, 33990-78R8* || Dual sensor brake support || Parts catalogue
|-
| 0x793 || 0x7A3 || UDS || 38910-77R0, 38910-78RC* || Airbag (SRS) controller || Parts catalogue
|-
| 0x772 || 0x782 || UDS || 38885-77R0, 38885-78R0* || 4WD shift controller || Parts catalogue
|-
| 0x799 || 0x7A9 || UDS || 38960-78RA, 38960-78RA* || E-call controller || Parts catalogue
|-
| 0x751 || 0x761 || UDS || 33580-79R0, 33580-78R0* || Central gateway || Label and parts catalogue
|}
Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

* KWP-style modules answer <code>1A 8E</code> and <code>1A 8A</code> (identification) and <code>18 00 FF 00</code> (DTCs). UDS-style modules answer <code>22 F1 01</code> and <code>22 F1 88</code> (identification) and <code>19 02 FF</code> (DTCs).
* Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
* The "probable" and "possible" names are guesses from the part-number series and are not confirmed.

=== Instrument cluster output test (0x274 / 0x674) ===
A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:
{| class="wikitable"
! Request !! Reply !! Notes
|-
| <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished
|}
The meaning of the four control bytes (80 40 00 00) is not known.

== Open questions ==
* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A reliable pressure scale and offset (more gauge readings needed).
* Whether other Suzuki modules use addresses near 0x798 (not checked).
* Why Torque stops after the first line.

== Sources ==
* Owner PCAN-View captures, October 2026.
* Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
* Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
* BigJimny forum thread "JB74 OBD2 connection" (December 2020).

[[Category:Jimny technical]]
[[Category:JB74]]
[[Category:Electrical - gen3]]
[[Category:FAQ - gen3]]
[[Category:Howto - gen3]]

[[Category:Electrical - gen4]]
[[Category:FAQ - gen4]]
[[Category:Howto - gen4]]

OBD2 Diagnostics reading project

2026-11-01T10:40:48Z

Mlines: /* Torque Pro custom PIDs */

= Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link =

{{Donate}}
== Overview ==
Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

=== Equipment ===
{| class="wikitable"
! Role !! Item
|-
| Head unit || XTRONS PX90
|-
| OBD-II Bluetooth dongle 1 || Generic ELM-based (Chinese)
|-
| OBD-II Bluetooth dongle 2 || Veepeak OBDCheck BLE+ (BLE only; unreliable on this head unit)
|-
| CAN bus monitor (Windows) || PCAN-View (PEAK-System)
|-
| Diagnostic tool 1 || Launch X431 CRP919
|-
| Diagnostic tool 2 || SZ Viewer app
|-
| Head-unit apps tried || Torque Pro (fails past the first line), RealDash (TPMS values seen in its debug view; gauges in progress), Car Scanner Pro (works)
|-
| Head-unit Bluetooth || xTRONS IP90 - Classic Bluetooth only, no BLE support
|}

=== Method ===
# The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
# PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
# The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.
'''Status:''' work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures (including a full Launch scan and an instrument cluster test), the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC) and the Suzuki parts catalogue. TPMS readings work in Car Scanner Pro; RealDash works in its debug view with gauges in progress. Items marked ''unconfirmed'' are not yet verified.

* The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
* Request ID '''0x798''', reply ID '''0x7A8''' (11-bit CAN, 500 kbit/s, ISO-TP framing) returns the TPMS data, including four sensor IDs and pressure readings. The module's identification reply (37160-61M0) matches the Model No. (P61M0) on the TPMS controller label. Whether the central gateway forwards or remaps the request is unconfirmed.
* Service '''0x21''' (read data by local identifier), identifier '''0x00''', returns 102 bytes containing all four sensor records.
* Pressure is byte +6 of each sensor record: bar = raw x 0.01372.
* The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.
* Working: Car Scanner Pro, and RealDash (values seen in its debug view). Not working: Torque Pro.

== DLC (OBD socket) wiring ==
The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal ''n'' matches standard pin ''17 - n''.

{| class="wikitable"
! Manual terminal !! Standard pin !! Function !! Wire / source on diagram
|-
| 1 || 16 || Battery +12 V || GRY, fuse No.49 "DOME2" (10 A)
|-
| 12 || 5 || Signal ground || BLK
|-
| 13 || 4 || Chassis ground || BLK
|-
| 11 || 6 || CAN-H (from standard assignment) || BLU, gateway pin 8
|-
| 3 || 14 || CAN-L (from standard assignment) || WHT, gateway pin 7
|}

Use pins '''6''' and '''14''' for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

=== Cross-check with other reports ===
A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

* The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
* No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
* On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

== Network layout ==
The DLC is not on the vehicle bus directly. The '''central gateway control module''' joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

== Diagnostic requests seen ==
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
|-
| <code>18 00 FF 00</code> || <code>58 00</code> or <code>58 01 9A 31 E0</code> || Read DTCs by status (second form = one code reported; not decoded)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block (repeated about twice a second by the scan tool)
|}
Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The <code>1A 8E</code> reply (37160-61M0) matches the TPMS controller's base number and model number; the <code>1A 8A</code> reply (37120-78R0*) shares "78R0" with the full part number, but its meaning is not confirmed.

A Launch full scan reported "Left Front Tire Pressure Low" for the TPMS module, and the module returned one stored code (<code>9A 31</code>) in the same scan. That code is probably the low-pressure warning (inferred; the report does not show the code itself).

== Reading it with an ELM327 ==
Terminal commands, one at a time (CR line ending):
<pre>
ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100
</pre>
* <code>ATSH798</code> sets the request address. The reply address (0x7A8) is worked out automatically.
* <code>ATFCSH798 / ATFCSD300000 / ATFCSM1</code> make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
* <code>ATS0</code> removes the spaces between bytes. Without it, the generic Chinese ELM327-based dongle (dongle 1) reported <code>BUFFER FULL</code> near byte 81.
* Expected output: a length line (<code>066</code> = 102 bytes) and numbered lines <code>0:</code> to <code>E:</code>.
* With default settings dongle 1 returned only the first line (<code>61 00 xx 01 00 00</code>).

== Reply layout (21 00) ==
Byte positions count the <code>61</code> as byte 0.
{| class="wikitable"
! Bytes !! Content
|-
| 0-1 || <code>61 00</code> (positive reply)
|-
| 2 || Varies 117-142. Looks like system voltage x 10 (''unconfirmed'')
|-
| 12-21 || Sensor record 1: front left
|-
| 22-31 || Sensor record 2: rear left
|-
| 32-41 || Sensor record 3: rear right
|-
| 42-51 || Sensor record 4: front right
|-
| 56-71 || Four 4-byte sensor-ID entries whose contents change (meaning unknown)
|-
| other || Not decoded
|}

=== Sensor record (10 bytes) ===
{| class="wikitable"
! Offset !! Content
|-
| +0 to +3 || Sensor ID
|-
| +4 || Position flag
|-
| +5 || Value 57-74. Behaves like temperature, possibly with an offset of 40 (''unconfirmed'')
|-
| +6 || Pressure, gauge: bar = raw x 0.01372 (see Calibration)
|-
| +7, +8 || Not understood
|-
| +9 || Always 0
|}

{| class="wikitable"
! Wheel !! Sensor ID !! Position flag
|-
| Front left || 4E AA 09 43 || 0x10
|-
| Rear left || DD 91 B5 25 || 0x20
|-
| Rear right || 4E AA 03 19 || 0x18
|-
| Front right || 4E AA 09 C9 || 0x08
|}
Sensor IDs are specific to one car. Yours will differ.

== Calibration ==
Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.
{| class="wikitable"
! Raw !! Gauge (bar) !! Raw x 0.01372
|-
| 136 (rear left) || 1.868 || 1.866
|-
| 131 (rear right) || 1.795 || 1.797
|-
| 131 (front right) || 1.795 || 1.797
|-
| 126 || 1.73 || 1.729
|-
| 119 || 1.63 || 1.633
|-
| 112 || 1.54 || 1.537
|-
| 101 || 1.39 || 1.386
|-
| 96 || 1.29 || 1.317
|}
The last five rows are from one tyre during a slow deflation (assumed front left).
* bar = raw x 0.01372
* psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

== Torque Pro custom PIDs ==
Common fields for every wheel:
{| class="wikitable"
! Field !! Value
|-
| Header || 798
|-
| Mode and PID || 2100
|-
| Diagnostic start command || <code>ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1</code> (comma-separated)
|-
| Unit / min / max || bar, 0, 4 (or psi, 0, 60)
|}

Equation uses a letter for each data byte. <code>A</code> is the first byte after <code>61 00</code> (reply byte 2).
{| class="wikitable"
! Wheel !! Byte +5 (temperature?) !! Byte +6 (pressure candidate)” to “Byte +6 (pressure)”
|-
| Front left || P || Q
|-
| Front right || AT || AU
|-
| Rear left || Z || AA
|-
| Rear right || AJ || AK
|}
Example: <code>Q*0.01372</code>. Letters must be upper case. Whether Torque accepts two-letter variables is ''unconfirmed''.

=== Known problem ===
Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on the XTRONS PX90, Torque read bytes <code>A</code> to <code>D</code> (first line of the reply) correctly, but every byte from <code>E</code> onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding <code>ATH1</code> changed the output). Tried without success: turning off "Faster communication", removing <code>ATS0</code>. Not yet tried: <code>ATAT0, ATSTFF</code> timeout settings, other apps, and the Veepeak OBDCheck BLE+ (dongle 2).. Unresolved.
The same result occurred with the Veepeak OBDCheck BLE+ (dongle 2). Car Scanner Pro does not have this problem (see below).

== Car Scanner Pro (working) ==
Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:
* Header: 798
* Request: 2100
* Start command (backslash-separated): <code>ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1</code>
* Equations use the same letters as the table above, for example <code>Q*0.01372</code> for front left (bar)

The start command has not yet been shortened. Adapter: Both dongle 1 (generic ELM327-based) and dongle 2 (Veepeak OBDCheck BLE+) work with Car Scanner Pro.
== Other modules found by a full scan ==
A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

{| class="wikitable"
! Request !! Reply !! Protocol !! Identification replies !! Module !! How identified
|-
| 0x7E0 || 0x7E8 || KWP || 33980-78R0, 33980-78RC* || ECM || Standard engine address
|-
| 0x261 || 0x661 || KWP || 56100-77RA, 56100-78RF* || ABS (inferred) || Only brake module left by elimination
|-
| 0x263 || 0x663 || KWP || 38720-77R0, 38720-77R0* || EPS controller || Parts catalogue
|-
| 0x271 || 0x671 || KWP || 36775-77R0, 36775-77RC* || Body control module || Parts catalogue
|-
| 0x274 || 0x674 || KWP || 34100-78R0, 34110-78RD* || Instrument cluster || Rev counter sweep test
|-
| 0x798 || 0x7A8 || KWP || 37160-61M0, 37120-78R0* || TPMS controller || Label and parts catalogue
|-
| 0x79A || 0x7AA || KWP || 37210-74PA, 37210-74PE* || Lighting and turn switch || Parts catalogue
|-
| 0x778 || 0x788 || KWP || 33990-52R0, 33990-78R8* || Dual sensor brake support || Parts catalogue
|-
| 0x793 || 0x7A3 || UDS || 38910-77R0, 38910-78RC* || Airbag (SRS) controller || Parts catalogue
|-
| 0x772 || 0x782 || UDS || 38885-77R0, 38885-78R0* || 4WD shift controller || Parts catalogue
|-
| 0x799 || 0x7A9 || UDS || 38960-78RA, 38960-78RA* || E-call controller || Parts catalogue
|-
| 0x751 || 0x761 || UDS || 33580-79R0, 33580-78R0* || Central gateway || Label and parts catalogue
|}
Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

* KWP-style modules answer <code>1A 8E</code> and <code>1A 8A</code> (identification) and <code>18 00 FF 00</code> (DTCs). UDS-style modules answer <code>22 F1 01</code> and <code>22 F1 88</code> (identification) and <code>19 02 FF</code> (DTCs).
* Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
* The "probable" and "possible" names are guesses from the part-number series and are not confirmed.

=== Instrument cluster output test (0x274 / 0x674) ===
A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:
{| class="wikitable"
! Request !! Reply !! Notes
|-
| <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished
|}
The meaning of the four control bytes (80 40 00 00) is not known.

== Open questions ==
* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A reliable pressure scale and offset (more gauge readings needed).
* Whether other Suzuki modules use addresses near 0x798 (not checked).
* Why Torque stops after the first line.

== Sources ==
* Owner PCAN-View captures, October 2026.
* Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
* Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
* BigJimny forum thread "JB74 OBD2 connection" (December 2020).

[[Category:Jimny technical]]
[[Category:JB74]]
[[Category:Electrical - gen3]]
[[Category:FAQ - gen3]]
[[Category:Howto - gen3]]

[[Category:Electrical - gen4]]
[[Category:FAQ - gen4]]
[[Category:Howto - gen4]]

OBD2 Diagnostics reading project

2026-11-01T10:40:23Z

Mlines: /* Sensor record (10 bytes) */

= Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link =

{{Donate}}
== Overview ==
Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

=== Equipment ===
{| class="wikitable"
! Role !! Item
|-
| Head unit || XTRONS PX90
|-
| OBD-II Bluetooth dongle 1 || Generic ELM-based (Chinese)
|-
| OBD-II Bluetooth dongle 2 || Veepeak OBDCheck BLE+ (BLE only; unreliable on this head unit)
|-
| CAN bus monitor (Windows) || PCAN-View (PEAK-System)
|-
| Diagnostic tool 1 || Launch X431 CRP919
|-
| Diagnostic tool 2 || SZ Viewer app
|-
| Head-unit apps tried || Torque Pro (fails past the first line), RealDash (TPMS values seen in its debug view; gauges in progress), Car Scanner Pro (works)
|-
| Head-unit Bluetooth || xTRONS IP90 - Classic Bluetooth only, no BLE support
|}

=== Method ===
# The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
# PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
# The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.
'''Status:''' work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures (including a full Launch scan and an instrument cluster test), the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC) and the Suzuki parts catalogue. TPMS readings work in Car Scanner Pro; RealDash works in its debug view with gauges in progress. Items marked ''unconfirmed'' are not yet verified.

* The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
* Request ID '''0x798''', reply ID '''0x7A8''' (11-bit CAN, 500 kbit/s, ISO-TP framing) returns the TPMS data, including four sensor IDs and pressure readings. The module's identification reply (37160-61M0) matches the Model No. (P61M0) on the TPMS controller label. Whether the central gateway forwards or remaps the request is unconfirmed.
* Service '''0x21''' (read data by local identifier), identifier '''0x00''', returns 102 bytes containing all four sensor records.
* Pressure is byte +6 of each sensor record: bar = raw x 0.01372.
* The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.
* Working: Car Scanner Pro, and RealDash (values seen in its debug view). Not working: Torque Pro.

== DLC (OBD socket) wiring ==
The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal ''n'' matches standard pin ''17 - n''.

{| class="wikitable"
! Manual terminal !! Standard pin !! Function !! Wire / source on diagram
|-
| 1 || 16 || Battery +12 V || GRY, fuse No.49 "DOME2" (10 A)
|-
| 12 || 5 || Signal ground || BLK
|-
| 13 || 4 || Chassis ground || BLK
|-
| 11 || 6 || CAN-H (from standard assignment) || BLU, gateway pin 8
|-
| 3 || 14 || CAN-L (from standard assignment) || WHT, gateway pin 7
|}

Use pins '''6''' and '''14''' for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

=== Cross-check with other reports ===
A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

* The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
* No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
* On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

== Network layout ==
The DLC is not on the vehicle bus directly. The '''central gateway control module''' joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

== Diagnostic requests seen ==
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
|-
| <code>18 00 FF 00</code> || <code>58 00</code> or <code>58 01 9A 31 E0</code> || Read DTCs by status (second form = one code reported; not decoded)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block (repeated about twice a second by the scan tool)
|}
Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The <code>1A 8E</code> reply (37160-61M0) matches the TPMS controller's base number and model number; the <code>1A 8A</code> reply (37120-78R0*) shares "78R0" with the full part number, but its meaning is not confirmed.

A Launch full scan reported "Left Front Tire Pressure Low" for the TPMS module, and the module returned one stored code (<code>9A 31</code>) in the same scan. That code is probably the low-pressure warning (inferred; the report does not show the code itself).

== Reading it with an ELM327 ==
Terminal commands, one at a time (CR line ending):
<pre>
ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100
</pre>
* <code>ATSH798</code> sets the request address. The reply address (0x7A8) is worked out automatically.
* <code>ATFCSH798 / ATFCSD300000 / ATFCSM1</code> make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
* <code>ATS0</code> removes the spaces between bytes. Without it, the generic Chinese ELM327-based dongle (dongle 1) reported <code>BUFFER FULL</code> near byte 81.
* Expected output: a length line (<code>066</code> = 102 bytes) and numbered lines <code>0:</code> to <code>E:</code>.
* With default settings dongle 1 returned only the first line (<code>61 00 xx 01 00 00</code>).

== Reply layout (21 00) ==
Byte positions count the <code>61</code> as byte 0.
{| class="wikitable"
! Bytes !! Content
|-
| 0-1 || <code>61 00</code> (positive reply)
|-
| 2 || Varies 117-142. Looks like system voltage x 10 (''unconfirmed'')
|-
| 12-21 || Sensor record 1: front left
|-
| 22-31 || Sensor record 2: rear left
|-
| 32-41 || Sensor record 3: rear right
|-
| 42-51 || Sensor record 4: front right
|-
| 56-71 || Four 4-byte sensor-ID entries whose contents change (meaning unknown)
|-
| other || Not decoded
|}

=== Sensor record (10 bytes) ===
{| class="wikitable"
! Offset !! Content
|-
| +0 to +3 || Sensor ID
|-
| +4 || Position flag
|-
| +5 || Value 57-74. Behaves like temperature, possibly with an offset of 40 (''unconfirmed'')
|-
| +6 || Pressure, gauge: bar = raw x 0.01372 (see Calibration)
|-
| +7, +8 || Not understood
|-
| +9 || Always 0
|}

{| class="wikitable"
! Wheel !! Sensor ID !! Position flag
|-
| Front left || 4E AA 09 43 || 0x10
|-
| Rear left || DD 91 B5 25 || 0x20
|-
| Rear right || 4E AA 03 19 || 0x18
|-
| Front right || 4E AA 09 C9 || 0x08
|}
Sensor IDs are specific to one car. Yours will differ.

== Calibration ==
Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.
{| class="wikitable"
! Raw !! Gauge (bar) !! Raw x 0.01372
|-
| 136 (rear left) || 1.868 || 1.866
|-
| 131 (rear right) || 1.795 || 1.797
|-
| 131 (front right) || 1.795 || 1.797
|-
| 126 || 1.73 || 1.729
|-
| 119 || 1.63 || 1.633
|-
| 112 || 1.54 || 1.537
|-
| 101 || 1.39 || 1.386
|-
| 96 || 1.29 || 1.317
|}
The last five rows are from one tyre during a slow deflation (assumed front left).
* bar = raw x 0.01372
* psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

== Torque Pro custom PIDs ==
Common fields for every wheel:
{| class="wikitable"
! Field !! Value
|-
| Header || 798
|-
| Mode and PID || 2100
|-
| Diagnostic start command || <code>ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1</code> (comma-separated)
|-
| Unit / min / max || bar, 0, 4 (or psi, 0, 60)
|}

Equation uses a letter for each data byte. <code>A</code> is the first byte after <code>61 00</code> (reply byte 2).
{| class="wikitable"
! Wheel !! Byte +5 (temperature?) !! Byte +6 (pressure candidate)
|-
| Front left || P || Q
|-
| Front right || AT || AU
|-
| Rear left || Z || AA
|-
| Rear right || AJ || AK
|}
Example: <code>Q*0.01372</code>. Letters must be upper case. Whether Torque accepts two-letter variables is ''unconfirmed''.

=== Known problem ===
Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on the XTRONS PX90, Torque read bytes <code>A</code> to <code>D</code> (first line of the reply) correctly, but every byte from <code>E</code> onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding <code>ATH1</code> changed the output). Tried without success: turning off "Faster communication", removing <code>ATS0</code>. Not yet tried: <code>ATAT0, ATSTFF</code> timeout settings, other apps, and the Veepeak OBDCheck BLE+ (dongle 2).. Unresolved.
The same result occurred with the Veepeak OBDCheck BLE+ (dongle 2). Car Scanner Pro does not have this problem (see below).

== Car Scanner Pro (working) ==
Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:
* Header: 798
* Request: 2100
* Start command (backslash-separated): <code>ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1</code>
* Equations use the same letters as the table above, for example <code>Q*0.01372</code> for front left (bar)

The start command has not yet been shortened. Adapter: Both dongle 1 (generic ELM327-based) and dongle 2 (Veepeak OBDCheck BLE+) work with Car Scanner Pro.
== Other modules found by a full scan ==
A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

{| class="wikitable"
! Request !! Reply !! Protocol !! Identification replies !! Module !! How identified
|-
| 0x7E0 || 0x7E8 || KWP || 33980-78R0, 33980-78RC* || ECM || Standard engine address
|-
| 0x261 || 0x661 || KWP || 56100-77RA, 56100-78RF* || ABS (inferred) || Only brake module left by elimination
|-
| 0x263 || 0x663 || KWP || 38720-77R0, 38720-77R0* || EPS controller || Parts catalogue
|-
| 0x271 || 0x671 || KWP || 36775-77R0, 36775-77RC* || Body control module || Parts catalogue
|-
| 0x274 || 0x674 || KWP || 34100-78R0, 34110-78RD* || Instrument cluster || Rev counter sweep test
|-
| 0x798 || 0x7A8 || KWP || 37160-61M0, 37120-78R0* || TPMS controller || Label and parts catalogue
|-
| 0x79A || 0x7AA || KWP || 37210-74PA, 37210-74PE* || Lighting and turn switch || Parts catalogue
|-
| 0x778 || 0x788 || KWP || 33990-52R0, 33990-78R8* || Dual sensor brake support || Parts catalogue
|-
| 0x793 || 0x7A3 || UDS || 38910-77R0, 38910-78RC* || Airbag (SRS) controller || Parts catalogue
|-
| 0x772 || 0x782 || UDS || 38885-77R0, 38885-78R0* || 4WD shift controller || Parts catalogue
|-
| 0x799 || 0x7A9 || UDS || 38960-78RA, 38960-78RA* || E-call controller || Parts catalogue
|-
| 0x751 || 0x761 || UDS || 33580-79R0, 33580-78R0* || Central gateway || Label and parts catalogue
|}
Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

* KWP-style modules answer <code>1A 8E</code> and <code>1A 8A</code> (identification) and <code>18 00 FF 00</code> (DTCs). UDS-style modules answer <code>22 F1 01</code> and <code>22 F1 88</code> (identification) and <code>19 02 FF</code> (DTCs).
* Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
* The "probable" and "possible" names are guesses from the part-number series and are not confirmed.

=== Instrument cluster output test (0x274 / 0x674) ===
A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:
{| class="wikitable"
! Request !! Reply !! Notes
|-
| <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished
|}
The meaning of the four control bytes (80 40 00 00) is not known.

== Open questions ==
* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A reliable pressure scale and offset (more gauge readings needed).
* Whether other Suzuki modules use addresses near 0x798 (not checked).
* Why Torque stops after the first line.

== Sources ==
* Owner PCAN-View captures, October 2026.
* Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
* Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
* BigJimny forum thread "JB74 OBD2 connection" (December 2020).

[[Category:Jimny technical]]
[[Category:JB74]]
[[Category:Electrical - gen3]]
[[Category:FAQ - gen3]]
[[Category:Howto - gen3]]

[[Category:Electrical - gen4]]
[[Category:FAQ - gen4]]
[[Category:Howto - gen4]]

OBD2 Diagnostics reading project

2026-11-01T10:38:54Z

Mlines: /* Reading it with an ELM327 */

= Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link =

{{Donate}}
== Overview ==
Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

=== Equipment ===
{| class="wikitable"
! Role !! Item
|-
| Head unit || XTRONS PX90
|-
| OBD-II Bluetooth dongle 1 || Generic ELM-based (Chinese)
|-
| OBD-II Bluetooth dongle 2 || Veepeak OBDCheck BLE+ (BLE only; unreliable on this head unit)
|-
| CAN bus monitor (Windows) || PCAN-View (PEAK-System)
|-
| Diagnostic tool 1 || Launch X431 CRP919
|-
| Diagnostic tool 2 || SZ Viewer app
|-
| Head-unit apps tried || Torque Pro (fails past the first line), RealDash (TPMS values seen in its debug view; gauges in progress), Car Scanner Pro (works)
|-
| Head-unit Bluetooth || xTRONS IP90 - Classic Bluetooth only, no BLE support
|}

=== Method ===
# The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
# PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
# The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.
'''Status:''' work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures (including a full Launch scan and an instrument cluster test), the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC) and the Suzuki parts catalogue. TPMS readings work in Car Scanner Pro; RealDash works in its debug view with gauges in progress. Items marked ''unconfirmed'' are not yet verified.

* The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
* Request ID '''0x798''', reply ID '''0x7A8''' (11-bit CAN, 500 kbit/s, ISO-TP framing) returns the TPMS data, including four sensor IDs and pressure readings. The module's identification reply (37160-61M0) matches the Model No. (P61M0) on the TPMS controller label. Whether the central gateway forwards or remaps the request is unconfirmed.
* Service '''0x21''' (read data by local identifier), identifier '''0x00''', returns 102 bytes containing all four sensor records.
* Pressure is byte +6 of each sensor record: bar = raw x 0.01372.
* The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.
* Working: Car Scanner Pro, and RealDash (values seen in its debug view). Not working: Torque Pro.

== DLC (OBD socket) wiring ==
The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal ''n'' matches standard pin ''17 - n''.

{| class="wikitable"
! Manual terminal !! Standard pin !! Function !! Wire / source on diagram
|-
| 1 || 16 || Battery +12 V || GRY, fuse No.49 "DOME2" (10 A)
|-
| 12 || 5 || Signal ground || BLK
|-
| 13 || 4 || Chassis ground || BLK
|-
| 11 || 6 || CAN-H (from standard assignment) || BLU, gateway pin 8
|-
| 3 || 14 || CAN-L (from standard assignment) || WHT, gateway pin 7
|}

Use pins '''6''' and '''14''' for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

=== Cross-check with other reports ===
A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

* The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
* No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
* On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

== Network layout ==
The DLC is not on the vehicle bus directly. The '''central gateway control module''' joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

== Diagnostic requests seen ==
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
|-
| <code>18 00 FF 00</code> || <code>58 00</code> or <code>58 01 9A 31 E0</code> || Read DTCs by status (second form = one code reported; not decoded)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block (repeated about twice a second by the scan tool)
|}
Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The <code>1A 8E</code> reply (37160-61M0) matches the TPMS controller's base number and model number; the <code>1A 8A</code> reply (37120-78R0*) shares "78R0" with the full part number, but its meaning is not confirmed.

A Launch full scan reported "Left Front Tire Pressure Low" for the TPMS module, and the module returned one stored code (<code>9A 31</code>) in the same scan. That code is probably the low-pressure warning (inferred; the report does not show the code itself).

== Reading it with an ELM327 ==
Terminal commands, one at a time (CR line ending):
<pre>
ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100
</pre>
* <code>ATSH798</code> sets the request address. The reply address (0x7A8) is worked out automatically.
* <code>ATFCSH798 / ATFCSD300000 / ATFCSM1</code> make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
* <code>ATS0</code> removes the spaces between bytes. Without it, the generic Chinese ELM327-based dongle (dongle 1) reported <code>BUFFER FULL</code> near byte 81.
* Expected output: a length line (<code>066</code> = 102 bytes) and numbered lines <code>0:</code> to <code>E:</code>.
* With default settings dongle 1 returned only the first line (<code>61 00 xx 01 00 00</code>).

== Reply layout (21 00) ==
Byte positions count the <code>61</code> as byte 0.
{| class="wikitable"
! Bytes !! Content
|-
| 0-1 || <code>61 00</code> (positive reply)
|-
| 2 || Varies 117-142. Looks like system voltage x 10 (''unconfirmed'')
|-
| 12-21 || Sensor record 1: front left
|-
| 22-31 || Sensor record 2: rear left
|-
| 32-41 || Sensor record 3: rear right
|-
| 42-51 || Sensor record 4: front right
|-
| 56-71 || Four 4-byte sensor-ID entries whose contents change (meaning unknown)
|-
| other || Not decoded
|}

=== Sensor record (10 bytes) ===
{| class="wikitable"
! Offset !! Content
|-
| +0 to +3 || Sensor ID
|-
| +4 || Position flag
|-
| +5 || Value 57-74. Behaves like temperature, possibly with an offset of 40 (''unconfirmed'')
|-
| +6 || Pressure candidate (see calibration)
|-
| +7, +8 || Not understood
|-
| +9 || Always 0
|}

{| class="wikitable"
! Wheel !! Sensor ID !! Position flag
|-
| Front left || 4E AA 09 43 || 0x10
|-
| Rear left || DD 91 B5 25 || 0x20
|-
| Rear right || 4E AA 03 19 || 0x18
|-
| Front right || 4E AA 09 C9 || 0x08
|}
Sensor IDs are specific to one car. Yours will differ.

== Calibration ==
Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.
{| class="wikitable"
! Raw !! Gauge (bar) !! Raw x 0.01372
|-
| 136 (rear left) || 1.868 || 1.866
|-
| 131 (rear right) || 1.795 || 1.797
|-
| 131 (front right) || 1.795 || 1.797
|-
| 126 || 1.73 || 1.729
|-
| 119 || 1.63 || 1.633
|-
| 112 || 1.54 || 1.537
|-
| 101 || 1.39 || 1.386
|-
| 96 || 1.29 || 1.317
|}
The last five rows are from one tyre during a slow deflation (assumed front left).
* bar = raw x 0.01372
* psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

== Torque Pro custom PIDs ==
Common fields for every wheel:
{| class="wikitable"
! Field !! Value
|-
| Header || 798
|-
| Mode and PID || 2100
|-
| Diagnostic start command || <code>ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1</code> (comma-separated)
|-
| Unit / min / max || bar, 0, 4 (or psi, 0, 60)
|}

Equation uses a letter for each data byte. <code>A</code> is the first byte after <code>61 00</code> (reply byte 2).
{| class="wikitable"
! Wheel !! Byte +5 (temperature?) !! Byte +6 (pressure candidate)
|-
| Front left || P || Q
|-
| Front right || AT || AU
|-
| Rear left || Z || AA
|-
| Rear right || AJ || AK
|}
Example: <code>Q*0.01372</code>. Letters must be upper case. Whether Torque accepts two-letter variables is ''unconfirmed''.

=== Known problem ===
Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on the XTRONS PX90, Torque read bytes <code>A</code> to <code>D</code> (first line of the reply) correctly, but every byte from <code>E</code> onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding <code>ATH1</code> changed the output). Tried without success: turning off "Faster communication", removing <code>ATS0</code>. Not yet tried: <code>ATAT0, ATSTFF</code> timeout settings, other apps, and the Veepeak OBDCheck BLE+ (dongle 2).. Unresolved.
The same result occurred with the Veepeak OBDCheck BLE+ (dongle 2). Car Scanner Pro does not have this problem (see below).

== Car Scanner Pro (working) ==
Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:
* Header: 798
* Request: 2100
* Start command (backslash-separated): <code>ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1</code>
* Equations use the same letters as the table above, for example <code>Q*0.01372</code> for front left (bar)

The start command has not yet been shortened. Adapter: Both dongle 1 (generic ELM327-based) and dongle 2 (Veepeak OBDCheck BLE+) work with Car Scanner Pro.
== Other modules found by a full scan ==
A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

{| class="wikitable"
! Request !! Reply !! Protocol !! Identification replies !! Module !! How identified
|-
| 0x7E0 || 0x7E8 || KWP || 33980-78R0, 33980-78RC* || ECM || Standard engine address
|-
| 0x261 || 0x661 || KWP || 56100-77RA, 56100-78RF* || ABS (inferred) || Only brake module left by elimination
|-
| 0x263 || 0x663 || KWP || 38720-77R0, 38720-77R0* || EPS controller || Parts catalogue
|-
| 0x271 || 0x671 || KWP || 36775-77R0, 36775-77RC* || Body control module || Parts catalogue
|-
| 0x274 || 0x674 || KWP || 34100-78R0, 34110-78RD* || Instrument cluster || Rev counter sweep test
|-
| 0x798 || 0x7A8 || KWP || 37160-61M0, 37120-78R0* || TPMS controller || Label and parts catalogue
|-
| 0x79A || 0x7AA || KWP || 37210-74PA, 37210-74PE* || Lighting and turn switch || Parts catalogue
|-
| 0x778 || 0x788 || KWP || 33990-52R0, 33990-78R8* || Dual sensor brake support || Parts catalogue
|-
| 0x793 || 0x7A3 || UDS || 38910-77R0, 38910-78RC* || Airbag (SRS) controller || Parts catalogue
|-
| 0x772 || 0x782 || UDS || 38885-77R0, 38885-78R0* || 4WD shift controller || Parts catalogue
|-
| 0x799 || 0x7A9 || UDS || 38960-78RA, 38960-78RA* || E-call controller || Parts catalogue
|-
| 0x751 || 0x761 || UDS || 33580-79R0, 33580-78R0* || Central gateway || Label and parts catalogue
|}
Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

* KWP-style modules answer <code>1A 8E</code> and <code>1A 8A</code> (identification) and <code>18 00 FF 00</code> (DTCs). UDS-style modules answer <code>22 F1 01</code> and <code>22 F1 88</code> (identification) and <code>19 02 FF</code> (DTCs).
* Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
* The "probable" and "possible" names are guesses from the part-number series and are not confirmed.

=== Instrument cluster output test (0x274 / 0x674) ===
A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:
{| class="wikitable"
! Request !! Reply !! Notes
|-
| <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished
|}
The meaning of the four control bytes (80 40 00 00) is not known.

== Open questions ==
* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A reliable pressure scale and offset (more gauge readings needed).
* Whether other Suzuki modules use addresses near 0x798 (not checked).
* Why Torque stops after the first line.

== Sources ==
* Owner PCAN-View captures, October 2026.
* Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
* Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
* BigJimny forum thread "JB74 OBD2 connection" (December 2020).

[[Category:Jimny technical]]
[[Category:JB74]]
[[Category:Electrical - gen3]]
[[Category:FAQ - gen3]]
[[Category:Howto - gen3]]

[[Category:Electrical - gen4]]
[[Category:FAQ - gen4]]
[[Category:Howto - gen4]]

OBD2 Diagnostics reading project

2026-11-01T10:37:56Z

Mlines: /* Diagnostic requests seen */

= Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link =

{{Donate}}
== Overview ==
Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

=== Equipment ===
{| class="wikitable"
! Role !! Item
|-
| Head unit || XTRONS PX90
|-
| OBD-II Bluetooth dongle 1 || Generic ELM-based (Chinese)
|-
| OBD-II Bluetooth dongle 2 || Veepeak OBDCheck BLE+ (BLE only; unreliable on this head unit)
|-
| CAN bus monitor (Windows) || PCAN-View (PEAK-System)
|-
| Diagnostic tool 1 || Launch X431 CRP919
|-
| Diagnostic tool 2 || SZ Viewer app
|-
| Head-unit apps tried || Torque Pro (fails past the first line), RealDash (TPMS values seen in its debug view; gauges in progress), Car Scanner Pro (works)
|-
| Head-unit Bluetooth || xTRONS IP90 - Classic Bluetooth only, no BLE support
|}

=== Method ===
# The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
# PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
# The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.
'''Status:''' work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures (including a full Launch scan and an instrument cluster test), the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC) and the Suzuki parts catalogue. TPMS readings work in Car Scanner Pro; RealDash works in its debug view with gauges in progress. Items marked ''unconfirmed'' are not yet verified.

* The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
* Request ID '''0x798''', reply ID '''0x7A8''' (11-bit CAN, 500 kbit/s, ISO-TP framing) returns the TPMS data, including four sensor IDs and pressure readings. The module's identification reply (37160-61M0) matches the Model No. (P61M0) on the TPMS controller label. Whether the central gateway forwards or remaps the request is unconfirmed.
* Service '''0x21''' (read data by local identifier), identifier '''0x00''', returns 102 bytes containing all four sensor records.
* Pressure is byte +6 of each sensor record: bar = raw x 0.01372.
* The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.
* Working: Car Scanner Pro, and RealDash (values seen in its debug view). Not working: Torque Pro.

== DLC (OBD socket) wiring ==
The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal ''n'' matches standard pin ''17 - n''.

{| class="wikitable"
! Manual terminal !! Standard pin !! Function !! Wire / source on diagram
|-
| 1 || 16 || Battery +12 V || GRY, fuse No.49 "DOME2" (10 A)
|-
| 12 || 5 || Signal ground || BLK
|-
| 13 || 4 || Chassis ground || BLK
|-
| 11 || 6 || CAN-H (from standard assignment) || BLU, gateway pin 8
|-
| 3 || 14 || CAN-L (from standard assignment) || WHT, gateway pin 7
|}

Use pins '''6''' and '''14''' for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

=== Cross-check with other reports ===
A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

* The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
* No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
* On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

== Network layout ==
The DLC is not on the vehicle bus directly. The '''central gateway control module''' joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

== Diagnostic requests seen ==
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
|-
| <code>18 00 FF 00</code> || <code>58 00</code> or <code>58 01 9A 31 E0</code> || Read DTCs by status (second form = one code reported; not decoded)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block (repeated about twice a second by the scan tool)
|}
Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The <code>1A 8E</code> reply (37160-61M0) matches the TPMS controller's base number and model number; the <code>1A 8A</code> reply (37120-78R0*) shares "78R0" with the full part number, but its meaning is not confirmed.

A Launch full scan reported "Left Front Tire Pressure Low" for the TPMS module, and the module returned one stored code (<code>9A 31</code>) in the same scan. That code is probably the low-pressure warning (inferred; the report does not show the code itself).

== Reading it with an ELM327 ==
Terminal commands, one at a time (CR line ending):
<pre>
ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100
</pre>
* <code>ATSH798</code> sets the request address. The reply address (0x7A8) is worked out automatically.
* <code>ATFCSH798 / ATFCSD300000 / ATFCSM1</code> make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
* <code>ATS0</code> removes the spaces between bytes.Without it, the generic Chinese ELM327-based dongle (dongle 1) reported <code>BUFFER FULL</code> near byte 81.
* Expected output: a length line (<code>066</code> = 102 bytes) and numbered lines <code>0:</code> to <code>E:</code>.
* With default settings dongle 1 returned only the first line (<code>61 00 xx 01 00 00</code>).

== Reply layout (21 00) ==
Byte positions count the <code>61</code> as byte 0.
{| class="wikitable"
! Bytes !! Content
|-
| 0-1 || <code>61 00</code> (positive reply)
|-
| 2 || Varies 117-142. Looks like system voltage x 10 (''unconfirmed'')
|-
| 12-21 || Sensor record 1: front left
|-
| 22-31 || Sensor record 2: rear left
|-
| 32-41 || Sensor record 3: rear right
|-
| 42-51 || Sensor record 4: front right
|-
| 56-71 || Four 4-byte sensor-ID entries whose contents change (meaning unknown)
|-
| other || Not decoded
|}

=== Sensor record (10 bytes) ===
{| class="wikitable"
! Offset !! Content
|-
| +0 to +3 || Sensor ID
|-
| +4 || Position flag
|-
| +5 || Value 57-74. Behaves like temperature, possibly with an offset of 40 (''unconfirmed'')
|-
| +6 || Pressure candidate (see calibration)
|-
| +7, +8 || Not understood
|-
| +9 || Always 0
|}

{| class="wikitable"
! Wheel !! Sensor ID !! Position flag
|-
| Front left || 4E AA 09 43 || 0x10
|-
| Rear left || DD 91 B5 25 || 0x20
|-
| Rear right || 4E AA 03 19 || 0x18
|-
| Front right || 4E AA 09 C9 || 0x08
|}
Sensor IDs are specific to one car. Yours will differ.

== Calibration ==
Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.
{| class="wikitable"
! Raw !! Gauge (bar) !! Raw x 0.01372
|-
| 136 (rear left) || 1.868 || 1.866
|-
| 131 (rear right) || 1.795 || 1.797
|-
| 131 (front right) || 1.795 || 1.797
|-
| 126 || 1.73 || 1.729
|-
| 119 || 1.63 || 1.633
|-
| 112 || 1.54 || 1.537
|-
| 101 || 1.39 || 1.386
|-
| 96 || 1.29 || 1.317
|}
The last five rows are from one tyre during a slow deflation (assumed front left).
* bar = raw x 0.01372
* psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

== Torque Pro custom PIDs ==
Common fields for every wheel:
{| class="wikitable"
! Field !! Value
|-
| Header || 798
|-
| Mode and PID || 2100
|-
| Diagnostic start command || <code>ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1</code> (comma-separated)
|-
| Unit / min / max || bar, 0, 4 (or psi, 0, 60)
|}

Equation uses a letter for each data byte. <code>A</code> is the first byte after <code>61 00</code> (reply byte 2).
{| class="wikitable"
! Wheel !! Byte +5 (temperature?) !! Byte +6 (pressure candidate)
|-
| Front left || P || Q
|-
| Front right || AT || AU
|-
| Rear left || Z || AA
|-
| Rear right || AJ || AK
|}
Example: <code>Q*0.01372</code>. Letters must be upper case. Whether Torque accepts two-letter variables is ''unconfirmed''.

=== Known problem ===
Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on the XTRONS PX90, Torque read bytes <code>A</code> to <code>D</code> (first line of the reply) correctly, but every byte from <code>E</code> onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding <code>ATH1</code> changed the output). Tried without success: turning off "Faster communication", removing <code>ATS0</code>. Not yet tried: <code>ATAT0, ATSTFF</code> timeout settings, other apps, and the Veepeak OBDCheck BLE+ (dongle 2).. Unresolved.
The same result occurred with the Veepeak OBDCheck BLE+ (dongle 2). Car Scanner Pro does not have this problem (see below).

== Car Scanner Pro (working) ==
Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:
* Header: 798
* Request: 2100
* Start command (backslash-separated): <code>ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1</code>
* Equations use the same letters as the table above, for example <code>Q*0.01372</code> for front left (bar)

The start command has not yet been shortened. Adapter: Both dongle 1 (generic ELM327-based) and dongle 2 (Veepeak OBDCheck BLE+) work with Car Scanner Pro.
== Other modules found by a full scan ==
A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

{| class="wikitable"
! Request !! Reply !! Protocol !! Identification replies !! Module !! How identified
|-
| 0x7E0 || 0x7E8 || KWP || 33980-78R0, 33980-78RC* || ECM || Standard engine address
|-
| 0x261 || 0x661 || KWP || 56100-77RA, 56100-78RF* || ABS (inferred) || Only brake module left by elimination
|-
| 0x263 || 0x663 || KWP || 38720-77R0, 38720-77R0* || EPS controller || Parts catalogue
|-
| 0x271 || 0x671 || KWP || 36775-77R0, 36775-77RC* || Body control module || Parts catalogue
|-
| 0x274 || 0x674 || KWP || 34100-78R0, 34110-78RD* || Instrument cluster || Rev counter sweep test
|-
| 0x798 || 0x7A8 || KWP || 37160-61M0, 37120-78R0* || TPMS controller || Label and parts catalogue
|-
| 0x79A || 0x7AA || KWP || 37210-74PA, 37210-74PE* || Lighting and turn switch || Parts catalogue
|-
| 0x778 || 0x788 || KWP || 33990-52R0, 33990-78R8* || Dual sensor brake support || Parts catalogue
|-
| 0x793 || 0x7A3 || UDS || 38910-77R0, 38910-78RC* || Airbag (SRS) controller || Parts catalogue
|-
| 0x772 || 0x782 || UDS || 38885-77R0, 38885-78R0* || 4WD shift controller || Parts catalogue
|-
| 0x799 || 0x7A9 || UDS || 38960-78RA, 38960-78RA* || E-call controller || Parts catalogue
|-
| 0x751 || 0x761 || UDS || 33580-79R0, 33580-78R0* || Central gateway || Label and parts catalogue
|}
Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

* KWP-style modules answer <code>1A 8E</code> and <code>1A 8A</code> (identification) and <code>18 00 FF 00</code> (DTCs). UDS-style modules answer <code>22 F1 01</code> and <code>22 F1 88</code> (identification) and <code>19 02 FF</code> (DTCs).
* Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
* The "probable" and "possible" names are guesses from the part-number series and are not confirmed.

=== Instrument cluster output test (0x274 / 0x674) ===
A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:
{| class="wikitable"
! Request !! Reply !! Notes
|-
| <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished
|}
The meaning of the four control bytes (80 40 00 00) is not known.

== Open questions ==
* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A reliable pressure scale and offset (more gauge readings needed).
* Whether other Suzuki modules use addresses near 0x798 (not checked).
* Why Torque stops after the first line.

== Sources ==
* Owner PCAN-View captures, October 2026.
* Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
* Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
* BigJimny forum thread "JB74 OBD2 connection" (December 2020).

[[Category:Jimny technical]]
[[Category:JB74]]
[[Category:Electrical - gen3]]
[[Category:FAQ - gen3]]
[[Category:Howto - gen3]]

[[Category:Electrical - gen4]]
[[Category:FAQ - gen4]]
[[Category:Howto - gen4]]

OBD2 Diagnostics reading project

2026-11-01T10:37:20Z

Mlines: /* Summary */

= Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link =

{{Donate}}
== Overview ==
Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

=== Equipment ===
{| class="wikitable"
! Role !! Item
|-
| Head unit || XTRONS PX90
|-
| OBD-II Bluetooth dongle 1 || Generic ELM-based (Chinese)
|-
| OBD-II Bluetooth dongle 2 || Veepeak OBDCheck BLE+ (BLE only; unreliable on this head unit)
|-
| CAN bus monitor (Windows) || PCAN-View (PEAK-System)
|-
| Diagnostic tool 1 || Launch X431 CRP919
|-
| Diagnostic tool 2 || SZ Viewer app
|-
| Head-unit apps tried || Torque Pro (fails past the first line), RealDash (TPMS values seen in its debug view; gauges in progress), Car Scanner Pro (works)
|-
| Head-unit Bluetooth || xTRONS IP90 - Classic Bluetooth only, no BLE support
|}

=== Method ===
# The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
# PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
# The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.
'''Status:''' work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures (including a full Launch scan and an instrument cluster test), the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC) and the Suzuki parts catalogue. TPMS readings work in Car Scanner Pro; RealDash works in its debug view with gauges in progress. Items marked ''unconfirmed'' are not yet verified.

* The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
* Request ID '''0x798''', reply ID '''0x7A8''' (11-bit CAN, 500 kbit/s, ISO-TP framing) returns the TPMS data, including four sensor IDs and pressure readings. The module's identification reply (37160-61M0) matches the Model No. (P61M0) on the TPMS controller label. Whether the central gateway forwards or remaps the request is unconfirmed.
* Service '''0x21''' (read data by local identifier), identifier '''0x00''', returns 102 bytes containing all four sensor records.
* Pressure is byte +6 of each sensor record: bar = raw x 0.01372.
* The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.
* Working: Car Scanner Pro, and RealDash (values seen in its debug view). Not working: Torque Pro.

== DLC (OBD socket) wiring ==
The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal ''n'' matches standard pin ''17 - n''.

{| class="wikitable"
! Manual terminal !! Standard pin !! Function !! Wire / source on diagram
|-
| 1 || 16 || Battery +12 V || GRY, fuse No.49 "DOME2" (10 A)
|-
| 12 || 5 || Signal ground || BLK
|-
| 13 || 4 || Chassis ground || BLK
|-
| 11 || 6 || CAN-H (from standard assignment) || BLU, gateway pin 8
|-
| 3 || 14 || CAN-L (from standard assignment) || WHT, gateway pin 7
|}

Use pins '''6''' and '''14''' for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

=== Cross-check with other reports ===
A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

* The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
* No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
* On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

== Network layout ==
The DLC is not on the vehicle bus directly. The '''central gateway control module''' joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

== Diagnostic requests seen ==
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
|-
| <code>18 00 FF 00</code> || <code>58 00</code> or <code>58 01 9A 31 E0</code> || Read DTCs by status (second form = one code reported; not decoded)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block (repeated about twice a second by the scan tool)
|}

Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The <code>1A 8E</code> reply (37160-61M0) matches the TPMS controller's base number and model number; the <code>1A 8A</code> reply (37120-78R0*) shares "78R0" with its full part number but its meaning is not confirmed

== Reading it with an ELM327 ==
Terminal commands, one at a time (CR line ending):
<pre>
ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100
</pre>
* <code>ATSH798</code> sets the request address. The reply address (0x7A8) is worked out automatically.
* <code>ATFCSH798 / ATFCSD300000 / ATFCSM1</code> make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
* <code>ATS0</code> removes the spaces between bytes.Without it, the generic Chinese ELM327-based dongle (dongle 1) reported <code>BUFFER FULL</code> near byte 81.
* Expected output: a length line (<code>066</code> = 102 bytes) and numbered lines <code>0:</code> to <code>E:</code>.
* With default settings dongle 1 returned only the first line (<code>61 00 xx 01 00 00</code>).

== Reply layout (21 00) ==
Byte positions count the <code>61</code> as byte 0.
{| class="wikitable"
! Bytes !! Content
|-
| 0-1 || <code>61 00</code> (positive reply)
|-
| 2 || Varies 117-142. Looks like system voltage x 10 (''unconfirmed'')
|-
| 12-21 || Sensor record 1: front left
|-
| 22-31 || Sensor record 2: rear left
|-
| 32-41 || Sensor record 3: rear right
|-
| 42-51 || Sensor record 4: front right
|-
| 56-71 || Four 4-byte sensor-ID entries whose contents change (meaning unknown)
|-
| other || Not decoded
|}

=== Sensor record (10 bytes) ===
{| class="wikitable"
! Offset !! Content
|-
| +0 to +3 || Sensor ID
|-
| +4 || Position flag
|-
| +5 || Value 57-74. Behaves like temperature, possibly with an offset of 40 (''unconfirmed'')
|-
| +6 || Pressure candidate (see calibration)
|-
| +7, +8 || Not understood
|-
| +9 || Always 0
|}

{| class="wikitable"
! Wheel !! Sensor ID !! Position flag
|-
| Front left || 4E AA 09 43 || 0x10
|-
| Rear left || DD 91 B5 25 || 0x20
|-
| Rear right || 4E AA 03 19 || 0x18
|-
| Front right || 4E AA 09 C9 || 0x08
|}
Sensor IDs are specific to one car. Yours will differ.

== Calibration ==
Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.
{| class="wikitable"
! Raw !! Gauge (bar) !! Raw x 0.01372
|-
| 136 (rear left) || 1.868 || 1.866
|-
| 131 (rear right) || 1.795 || 1.797
|-
| 131 (front right) || 1.795 || 1.797
|-
| 126 || 1.73 || 1.729
|-
| 119 || 1.63 || 1.633
|-
| 112 || 1.54 || 1.537
|-
| 101 || 1.39 || 1.386
|-
| 96 || 1.29 || 1.317
|}
The last five rows are from one tyre during a slow deflation (assumed front left).
* bar = raw x 0.01372
* psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

== Torque Pro custom PIDs ==
Common fields for every wheel:
{| class="wikitable"
! Field !! Value
|-
| Header || 798
|-
| Mode and PID || 2100
|-
| Diagnostic start command || <code>ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1</code> (comma-separated)
|-
| Unit / min / max || bar, 0, 4 (or psi, 0, 60)
|}

Equation uses a letter for each data byte. <code>A</code> is the first byte after <code>61 00</code> (reply byte 2).
{| class="wikitable"
! Wheel !! Byte +5 (temperature?) !! Byte +6 (pressure candidate)
|-
| Front left || P || Q
|-
| Front right || AT || AU
|-
| Rear left || Z || AA
|-
| Rear right || AJ || AK
|}
Example: <code>Q*0.01372</code>. Letters must be upper case. Whether Torque accepts two-letter variables is ''unconfirmed''.

=== Known problem ===
Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on the XTRONS PX90, Torque read bytes <code>A</code> to <code>D</code> (first line of the reply) correctly, but every byte from <code>E</code> onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding <code>ATH1</code> changed the output). Tried without success: turning off "Faster communication", removing <code>ATS0</code>. Not yet tried: <code>ATAT0, ATSTFF</code> timeout settings, other apps, and the Veepeak OBDCheck BLE+ (dongle 2).. Unresolved.
The same result occurred with the Veepeak OBDCheck BLE+ (dongle 2). Car Scanner Pro does not have this problem (see below).

== Car Scanner Pro (working) ==
Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:
* Header: 798
* Request: 2100
* Start command (backslash-separated): <code>ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1</code>
* Equations use the same letters as the table above, for example <code>Q*0.01372</code> for front left (bar)

The start command has not yet been shortened. Adapter: Both dongle 1 (generic ELM327-based) and dongle 2 (Veepeak OBDCheck BLE+) work with Car Scanner Pro.
== Other modules found by a full scan ==
A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

{| class="wikitable"
! Request !! Reply !! Protocol !! Identification replies !! Module !! How identified
|-
| 0x7E0 || 0x7E8 || KWP || 33980-78R0, 33980-78RC* || ECM || Standard engine address
|-
| 0x261 || 0x661 || KWP || 56100-77RA, 56100-78RF* || ABS (inferred) || Only brake module left by elimination
|-
| 0x263 || 0x663 || KWP || 38720-77R0, 38720-77R0* || EPS controller || Parts catalogue
|-
| 0x271 || 0x671 || KWP || 36775-77R0, 36775-77RC* || Body control module || Parts catalogue
|-
| 0x274 || 0x674 || KWP || 34100-78R0, 34110-78RD* || Instrument cluster || Rev counter sweep test
|-
| 0x798 || 0x7A8 || KWP || 37160-61M0, 37120-78R0* || TPMS controller || Label and parts catalogue
|-
| 0x79A || 0x7AA || KWP || 37210-74PA, 37210-74PE* || Lighting and turn switch || Parts catalogue
|-
| 0x778 || 0x788 || KWP || 33990-52R0, 33990-78R8* || Dual sensor brake support || Parts catalogue
|-
| 0x793 || 0x7A3 || UDS || 38910-77R0, 38910-78RC* || Airbag (SRS) controller || Parts catalogue
|-
| 0x772 || 0x782 || UDS || 38885-77R0, 38885-78R0* || 4WD shift controller || Parts catalogue
|-
| 0x799 || 0x7A9 || UDS || 38960-78RA, 38960-78RA* || E-call controller || Parts catalogue
|-
| 0x751 || 0x761 || UDS || 33580-79R0, 33580-78R0* || Central gateway || Label and parts catalogue
|}
Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

* KWP-style modules answer <code>1A 8E</code> and <code>1A 8A</code> (identification) and <code>18 00 FF 00</code> (DTCs). UDS-style modules answer <code>22 F1 01</code> and <code>22 F1 88</code> (identification) and <code>19 02 FF</code> (DTCs).
* Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
* The "probable" and "possible" names are guesses from the part-number series and are not confirmed.

=== Instrument cluster output test (0x274 / 0x674) ===
A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:
{| class="wikitable"
! Request !! Reply !! Notes
|-
| <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished
|}
The meaning of the four control bytes (80 40 00 00) is not known.

== Open questions ==
* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A reliable pressure scale and offset (more gauge readings needed).
* Whether other Suzuki modules use addresses near 0x798 (not checked).
* Why Torque stops after the first line.

== Sources ==
* Owner PCAN-View captures, October 2026.
* Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
* Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
* BigJimny forum thread "JB74 OBD2 connection" (December 2020).

[[Category:Jimny technical]]
[[Category:JB74]]
[[Category:Electrical - gen3]]
[[Category:FAQ - gen3]]
[[Category:Howto - gen3]]

[[Category:Electrical - gen4]]
[[Category:FAQ - gen4]]
[[Category:Howto - gen4]]

OBD2 Diagnostics reading project

2026-11-01T10:36:45Z

Mlines: /* Method */

= Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link =

{{Donate}}
== Overview ==
Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

=== Equipment ===
{| class="wikitable"
! Role !! Item
|-
| Head unit || XTRONS PX90
|-
| OBD-II Bluetooth dongle 1 || Generic ELM-based (Chinese)
|-
| OBD-II Bluetooth dongle 2 || Veepeak OBDCheck BLE+ (BLE only; unreliable on this head unit)
|-
| CAN bus monitor (Windows) || PCAN-View (PEAK-System)
|-
| Diagnostic tool 1 || Launch X431 CRP919
|-
| Diagnostic tool 2 || SZ Viewer app
|-
| Head-unit apps tried || Torque Pro (fails past the first line), RealDash (TPMS values seen in its debug view; gauges in progress), Car Scanner Pro (works)
|-
| Head-unit Bluetooth || xTRONS IP90 - Classic Bluetooth only, no BLE support
|}

=== Method ===
# The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
# PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
# The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.
'''Status:''' work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures (including a full Launch scan and an instrument cluster test), the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC) and the Suzuki parts catalogue. TPMS readings work in Car Scanner Pro; RealDash works in its debug view with gauges in progress. Items marked ''unconfirmed'' are not yet verified.

== Summary ==
* The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
* Request ID '''0x798''', reply ID '''0x7A8''', 11-bit CAN, 500 kbit/s, ISO-TP framing.
* Service '''0x21''' (read data by local identifier), identifier '''0x00''', returns 102 bytes containing all four sensor records.
* The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.

== DLC (OBD socket) wiring ==
The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal ''n'' matches standard pin ''17 - n''.

{| class="wikitable"
! Manual terminal !! Standard pin !! Function !! Wire / source on diagram
|-
| 1 || 16 || Battery +12 V || GRY, fuse No.49 "DOME2" (10 A)
|-
| 12 || 5 || Signal ground || BLK
|-
| 13 || 4 || Chassis ground || BLK
|-
| 11 || 6 || CAN-H (from standard assignment) || BLU, gateway pin 8
|-
| 3 || 14 || CAN-L (from standard assignment) || WHT, gateway pin 7
|}

Use pins '''6''' and '''14''' for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

=== Cross-check with other reports ===
A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

* The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
* No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
* On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

== Network layout ==
The DLC is not on the vehicle bus directly. The '''central gateway control module''' joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

== Diagnostic requests seen ==
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
|-
| <code>18 00 FF 00</code> || <code>58 00</code> or <code>58 01 9A 31 E0</code> || Read DTCs by status (second form = one code reported; not decoded)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block (repeated about twice a second by the scan tool)
|}

Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The <code>1A 8E</code> reply (37160-61M0) matches the TPMS controller's base number and model number; the <code>1A 8A</code> reply (37120-78R0*) shares "78R0" with its full part number but its meaning is not confirmed

== Reading it with an ELM327 ==
Terminal commands, one at a time (CR line ending):
<pre>
ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100
</pre>
* <code>ATSH798</code> sets the request address. The reply address (0x7A8) is worked out automatically.
* <code>ATFCSH798 / ATFCSD300000 / ATFCSM1</code> make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
* <code>ATS0</code> removes the spaces between bytes.Without it, the generic Chinese ELM327-based dongle (dongle 1) reported <code>BUFFER FULL</code> near byte 81.
* Expected output: a length line (<code>066</code> = 102 bytes) and numbered lines <code>0:</code> to <code>E:</code>.
* With default settings dongle 1 returned only the first line (<code>61 00 xx 01 00 00</code>).

== Reply layout (21 00) ==
Byte positions count the <code>61</code> as byte 0.
{| class="wikitable"
! Bytes !! Content
|-
| 0-1 || <code>61 00</code> (positive reply)
|-
| 2 || Varies 117-142. Looks like system voltage x 10 (''unconfirmed'')
|-
| 12-21 || Sensor record 1: front left
|-
| 22-31 || Sensor record 2: rear left
|-
| 32-41 || Sensor record 3: rear right
|-
| 42-51 || Sensor record 4: front right
|-
| 56-71 || Four 4-byte sensor-ID entries whose contents change (meaning unknown)
|-
| other || Not decoded
|}

=== Sensor record (10 bytes) ===
{| class="wikitable"
! Offset !! Content
|-
| +0 to +3 || Sensor ID
|-
| +4 || Position flag
|-
| +5 || Value 57-74. Behaves like temperature, possibly with an offset of 40 (''unconfirmed'')
|-
| +6 || Pressure candidate (see calibration)
|-
| +7, +8 || Not understood
|-
| +9 || Always 0
|}

{| class="wikitable"
! Wheel !! Sensor ID !! Position flag
|-
| Front left || 4E AA 09 43 || 0x10
|-
| Rear left || DD 91 B5 25 || 0x20
|-
| Rear right || 4E AA 03 19 || 0x18
|-
| Front right || 4E AA 09 C9 || 0x08
|}
Sensor IDs are specific to one car. Yours will differ.

== Calibration ==
Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.
{| class="wikitable"
! Raw !! Gauge (bar) !! Raw x 0.01372
|-
| 136 (rear left) || 1.868 || 1.866
|-
| 131 (rear right) || 1.795 || 1.797
|-
| 131 (front right) || 1.795 || 1.797
|-
| 126 || 1.73 || 1.729
|-
| 119 || 1.63 || 1.633
|-
| 112 || 1.54 || 1.537
|-
| 101 || 1.39 || 1.386
|-
| 96 || 1.29 || 1.317
|}
The last five rows are from one tyre during a slow deflation (assumed front left).
* bar = raw x 0.01372
* psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

== Torque Pro custom PIDs ==
Common fields for every wheel:
{| class="wikitable"
! Field !! Value
|-
| Header || 798
|-
| Mode and PID || 2100
|-
| Diagnostic start command || <code>ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1</code> (comma-separated)
|-
| Unit / min / max || bar, 0, 4 (or psi, 0, 60)
|}

Equation uses a letter for each data byte. <code>A</code> is the first byte after <code>61 00</code> (reply byte 2).
{| class="wikitable"
! Wheel !! Byte +5 (temperature?) !! Byte +6 (pressure candidate)
|-
| Front left || P || Q
|-
| Front right || AT || AU
|-
| Rear left || Z || AA
|-
| Rear right || AJ || AK
|}
Example: <code>Q*0.01372</code>. Letters must be upper case. Whether Torque accepts two-letter variables is ''unconfirmed''.

=== Known problem ===
Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on the XTRONS PX90, Torque read bytes <code>A</code> to <code>D</code> (first line of the reply) correctly, but every byte from <code>E</code> onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding <code>ATH1</code> changed the output). Tried without success: turning off "Faster communication", removing <code>ATS0</code>. Not yet tried: <code>ATAT0, ATSTFF</code> timeout settings, other apps, and the Veepeak OBDCheck BLE+ (dongle 2).. Unresolved.
The same result occurred with the Veepeak OBDCheck BLE+ (dongle 2). Car Scanner Pro does not have this problem (see below).

== Car Scanner Pro (working) ==
Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:
* Header: 798
* Request: 2100
* Start command (backslash-separated): <code>ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1</code>
* Equations use the same letters as the table above, for example <code>Q*0.01372</code> for front left (bar)

The start command has not yet been shortened. Adapter: Both dongle 1 (generic ELM327-based) and dongle 2 (Veepeak OBDCheck BLE+) work with Car Scanner Pro.
== Other modules found by a full scan ==
A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

{| class="wikitable"
! Request !! Reply !! Protocol !! Identification replies !! Module !! How identified
|-
| 0x7E0 || 0x7E8 || KWP || 33980-78R0, 33980-78RC* || ECM || Standard engine address
|-
| 0x261 || 0x661 || KWP || 56100-77RA, 56100-78RF* || ABS (inferred) || Only brake module left by elimination
|-
| 0x263 || 0x663 || KWP || 38720-77R0, 38720-77R0* || EPS controller || Parts catalogue
|-
| 0x271 || 0x671 || KWP || 36775-77R0, 36775-77RC* || Body control module || Parts catalogue
|-
| 0x274 || 0x674 || KWP || 34100-78R0, 34110-78RD* || Instrument cluster || Rev counter sweep test
|-
| 0x798 || 0x7A8 || KWP || 37160-61M0, 37120-78R0* || TPMS controller || Label and parts catalogue
|-
| 0x79A || 0x7AA || KWP || 37210-74PA, 37210-74PE* || Lighting and turn switch || Parts catalogue
|-
| 0x778 || 0x788 || KWP || 33990-52R0, 33990-78R8* || Dual sensor brake support || Parts catalogue
|-
| 0x793 || 0x7A3 || UDS || 38910-77R0, 38910-78RC* || Airbag (SRS) controller || Parts catalogue
|-
| 0x772 || 0x782 || UDS || 38885-77R0, 38885-78R0* || 4WD shift controller || Parts catalogue
|-
| 0x799 || 0x7A9 || UDS || 38960-78RA, 38960-78RA* || E-call controller || Parts catalogue
|-
| 0x751 || 0x761 || UDS || 33580-79R0, 33580-78R0* || Central gateway || Label and parts catalogue
|}
Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

* KWP-style modules answer <code>1A 8E</code> and <code>1A 8A</code> (identification) and <code>18 00 FF 00</code> (DTCs). UDS-style modules answer <code>22 F1 01</code> and <code>22 F1 88</code> (identification) and <code>19 02 FF</code> (DTCs).
* Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
* The "probable" and "possible" names are guesses from the part-number series and are not confirmed.

=== Instrument cluster output test (0x274 / 0x674) ===
A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:
{| class="wikitable"
! Request !! Reply !! Notes
|-
| <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished
|}
The meaning of the four control bytes (80 40 00 00) is not known.

== Open questions ==
* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A reliable pressure scale and offset (more gauge readings needed).
* Whether other Suzuki modules use addresses near 0x798 (not checked).
* Why Torque stops after the first line.

== Sources ==
* Owner PCAN-View captures, October 2026.
* Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
* Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
* BigJimny forum thread "JB74 OBD2 connection" (December 2020).

[[Category:Jimny technical]]
[[Category:JB74]]
[[Category:Electrical - gen3]]
[[Category:FAQ - gen3]]
[[Category:Howto - gen3]]

[[Category:Electrical - gen4]]
[[Category:FAQ - gen4]]
[[Category:Howto - gen4]]

OBD2 Diagnostics reading project

2026-11-01T10:35:58Z

Mlines: /* Equipment */

= Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link =

{{Donate}}
== Overview ==
Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

=== Equipment ===
{| class="wikitable"
! Role !! Item
|-
| Head unit || XTRONS PX90
|-
| OBD-II Bluetooth dongle 1 || Generic ELM-based (Chinese)
|-
| OBD-II Bluetooth dongle 2 || Veepeak OBDCheck BLE+ (BLE only; unreliable on this head unit)
|-
| CAN bus monitor (Windows) || PCAN-View (PEAK-System)
|-
| Diagnostic tool 1 || Launch X431 CRP919
|-
| Diagnostic tool 2 || SZ Viewer app
|-
| Head-unit apps tried || Torque Pro (fails past the first line), RealDash (TPMS values seen in its debug view; gauges in progress), Car Scanner Pro (works)
|-
| Head-unit Bluetooth || xTRONS IP90 - Classic Bluetooth only, no BLE support
|}

=== Method ===
# The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
# PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
# The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.
'''Status:''' work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures, and the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC). Items marked ''unconfirmed'' are not yet verified.

== Summary ==
* The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
* Request ID '''0x798''', reply ID '''0x7A8''', 11-bit CAN, 500 kbit/s, ISO-TP framing.
* Service '''0x21''' (read data by local identifier), identifier '''0x00''', returns 102 bytes containing all four sensor records.
* The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.

== DLC (OBD socket) wiring ==
The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal ''n'' matches standard pin ''17 - n''.

{| class="wikitable"
! Manual terminal !! Standard pin !! Function !! Wire / source on diagram
|-
| 1 || 16 || Battery +12 V || GRY, fuse No.49 "DOME2" (10 A)
|-
| 12 || 5 || Signal ground || BLK
|-
| 13 || 4 || Chassis ground || BLK
|-
| 11 || 6 || CAN-H (from standard assignment) || BLU, gateway pin 8
|-
| 3 || 14 || CAN-L (from standard assignment) || WHT, gateway pin 7
|}

Use pins '''6''' and '''14''' for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

=== Cross-check with other reports ===
A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

* The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
* No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
* On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

== Network layout ==
The DLC is not on the vehicle bus directly. The '''central gateway control module''' joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

== Diagnostic requests seen ==
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
|-
| <code>18 00 FF 00</code> || <code>58 00</code> or <code>58 01 9A 31 E0</code> || Read DTCs by status (second form = one code reported; not decoded)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block (repeated about twice a second by the scan tool)
|}

Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The <code>1A 8E</code> reply (37160-61M0) matches the TPMS controller's base number and model number; the <code>1A 8A</code> reply (37120-78R0*) shares "78R0" with its full part number but its meaning is not confirmed

== Reading it with an ELM327 ==
Terminal commands, one at a time (CR line ending):
<pre>
ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100
</pre>
* <code>ATSH798</code> sets the request address. The reply address (0x7A8) is worked out automatically.
* <code>ATFCSH798 / ATFCSD300000 / ATFCSM1</code> make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
* <code>ATS0</code> removes the spaces between bytes.Without it, the generic Chinese ELM327-based dongle (dongle 1) reported <code>BUFFER FULL</code> near byte 81.
* Expected output: a length line (<code>066</code> = 102 bytes) and numbered lines <code>0:</code> to <code>E:</code>.
* With default settings dongle 1 returned only the first line (<code>61 00 xx 01 00 00</code>).

== Reply layout (21 00) ==
Byte positions count the <code>61</code> as byte 0.
{| class="wikitable"
! Bytes !! Content
|-
| 0-1 || <code>61 00</code> (positive reply)
|-
| 2 || Varies 117-142. Looks like system voltage x 10 (''unconfirmed'')
|-
| 12-21 || Sensor record 1: front left
|-
| 22-31 || Sensor record 2: rear left
|-
| 32-41 || Sensor record 3: rear right
|-
| 42-51 || Sensor record 4: front right
|-
| 56-71 || Four 4-byte sensor-ID entries whose contents change (meaning unknown)
|-
| other || Not decoded
|}

=== Sensor record (10 bytes) ===
{| class="wikitable"
! Offset !! Content
|-
| +0 to +3 || Sensor ID
|-
| +4 || Position flag
|-
| +5 || Value 57-74. Behaves like temperature, possibly with an offset of 40 (''unconfirmed'')
|-
| +6 || Pressure candidate (see calibration)
|-
| +7, +8 || Not understood
|-
| +9 || Always 0
|}

{| class="wikitable"
! Wheel !! Sensor ID !! Position flag
|-
| Front left || 4E AA 09 43 || 0x10
|-
| Rear left || DD 91 B5 25 || 0x20
|-
| Rear right || 4E AA 03 19 || 0x18
|-
| Front right || 4E AA 09 C9 || 0x08
|}
Sensor IDs are specific to one car. Yours will differ.

== Calibration ==
Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.
{| class="wikitable"
! Raw !! Gauge (bar) !! Raw x 0.01372
|-
| 136 (rear left) || 1.868 || 1.866
|-
| 131 (rear right) || 1.795 || 1.797
|-
| 131 (front right) || 1.795 || 1.797
|-
| 126 || 1.73 || 1.729
|-
| 119 || 1.63 || 1.633
|-
| 112 || 1.54 || 1.537
|-
| 101 || 1.39 || 1.386
|-
| 96 || 1.29 || 1.317
|}
The last five rows are from one tyre during a slow deflation (assumed front left).
* bar = raw x 0.01372
* psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

== Torque Pro custom PIDs ==
Common fields for every wheel:
{| class="wikitable"
! Field !! Value
|-
| Header || 798
|-
| Mode and PID || 2100
|-
| Diagnostic start command || <code>ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1</code> (comma-separated)
|-
| Unit / min / max || bar, 0, 4 (or psi, 0, 60)
|}

Equation uses a letter for each data byte. <code>A</code> is the first byte after <code>61 00</code> (reply byte 2).
{| class="wikitable"
! Wheel !! Byte +5 (temperature?) !! Byte +6 (pressure candidate)
|-
| Front left || P || Q
|-
| Front right || AT || AU
|-
| Rear left || Z || AA
|-
| Rear right || AJ || AK
|}
Example: <code>Q*0.01372</code>. Letters must be upper case. Whether Torque accepts two-letter variables is ''unconfirmed''.

=== Known problem ===
Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on the XTRONS PX90, Torque read bytes <code>A</code> to <code>D</code> (first line of the reply) correctly, but every byte from <code>E</code> onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding <code>ATH1</code> changed the output). Tried without success: turning off "Faster communication", removing <code>ATS0</code>. Not yet tried: <code>ATAT0, ATSTFF</code> timeout settings, other apps, and the Veepeak OBDCheck BLE+ (dongle 2).. Unresolved.
The same result occurred with the Veepeak OBDCheck BLE+ (dongle 2). Car Scanner Pro does not have this problem (see below).

== Car Scanner Pro (working) ==
Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:
* Header: 798
* Request: 2100
* Start command (backslash-separated): <code>ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1</code>
* Equations use the same letters as the table above, for example <code>Q*0.01372</code> for front left (bar)

The start command has not yet been shortened. Adapter: Both dongle 1 (generic ELM327-based) and dongle 2 (Veepeak OBDCheck BLE+) work with Car Scanner Pro.
== Other modules found by a full scan ==
A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

{| class="wikitable"
! Request !! Reply !! Protocol !! Identification replies !! Module !! How identified
|-
| 0x7E0 || 0x7E8 || KWP || 33980-78R0, 33980-78RC* || ECM || Standard engine address
|-
| 0x261 || 0x661 || KWP || 56100-77RA, 56100-78RF* || ABS (inferred) || Only brake module left by elimination
|-
| 0x263 || 0x663 || KWP || 38720-77R0, 38720-77R0* || EPS controller || Parts catalogue
|-
| 0x271 || 0x671 || KWP || 36775-77R0, 36775-77RC* || Body control module || Parts catalogue
|-
| 0x274 || 0x674 || KWP || 34100-78R0, 34110-78RD* || Instrument cluster || Rev counter sweep test
|-
| 0x798 || 0x7A8 || KWP || 37160-61M0, 37120-78R0* || TPMS controller || Label and parts catalogue
|-
| 0x79A || 0x7AA || KWP || 37210-74PA, 37210-74PE* || Lighting and turn switch || Parts catalogue
|-
| 0x778 || 0x788 || KWP || 33990-52R0, 33990-78R8* || Dual sensor brake support || Parts catalogue
|-
| 0x793 || 0x7A3 || UDS || 38910-77R0, 38910-78RC* || Airbag (SRS) controller || Parts catalogue
|-
| 0x772 || 0x782 || UDS || 38885-77R0, 38885-78R0* || 4WD shift controller || Parts catalogue
|-
| 0x799 || 0x7A9 || UDS || 38960-78RA, 38960-78RA* || E-call controller || Parts catalogue
|-
| 0x751 || 0x761 || UDS || 33580-79R0, 33580-78R0* || Central gateway || Label and parts catalogue
|}
Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

* KWP-style modules answer <code>1A 8E</code> and <code>1A 8A</code> (identification) and <code>18 00 FF 00</code> (DTCs). UDS-style modules answer <code>22 F1 01</code> and <code>22 F1 88</code> (identification) and <code>19 02 FF</code> (DTCs).
* Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
* The "probable" and "possible" names are guesses from the part-number series and are not confirmed.

=== Instrument cluster output test (0x274 / 0x674) ===
A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:
{| class="wikitable"
! Request !! Reply !! Notes
|-
| <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished
|}
The meaning of the four control bytes (80 40 00 00) is not known.

== Open questions ==
* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A reliable pressure scale and offset (more gauge readings needed).
* Whether other Suzuki modules use addresses near 0x798 (not checked).
* Why Torque stops after the first line.

== Sources ==
* Owner PCAN-View captures, October 2026.
* Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
* Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
* BigJimny forum thread "JB74 OBD2 connection" (December 2020).

[[Category:Jimny technical]]
[[Category:JB74]]
[[Category:Electrical - gen3]]
[[Category:FAQ - gen3]]
[[Category:Howto - gen3]]

[[Category:Electrical - gen4]]
[[Category:FAQ - gen4]]
[[Category:Howto - gen4]]

ECU diagnostic CAN addresses

2026-11-01T10:30:11Z

Mlines: /* 0x751 Central gateway */

<div style="border: 1px solid #c9a227; background-color: #fff8dc; padding: 0.6em 1em; margin: 0 0 1em 0; border-radius: 4px;">
'''Support this project:''' The information on this page is free, but it took a lot of work to gather, test and write up. If it has been useful to you, you can say thanks with a donation at [https://buymeacoffee.com/bigjimny buymeacoffee.com/bigjimny].
</div>

= Suzuki Jimny JB74 - CAN bus devices and the commands they answer =

'''Status:''' work in progress. This page lists every module that answered on the OBD socket (DLC) of one RHD UK-market 2021 Jimny, its request and reply CAN IDs, and the diagnostic commands seen so far. Many sections are short because only identification and fault-code requests have been captured. See [[OBD2 Diagnostics reading project]] for how the captures were made and for the TPMS data in detail.

== How to read this page ==
* All IDs are 11-bit CAN IDs on the OBD socket (pins 6 and 14, 500 kbit/s). The "request ID" is the header a tool sends to; the "reply ID" is where the module answers.
* Commands are shown as the payload bytes in hex, without the ISO-TP length byte. Replies longer than 7 bytes are sent as several frames; the tables show them reassembled.
* '''KWP-style''' modules use services such as <code>1A</code> (read ECU identification) and <code>18</code> (read DTCs by status). '''UDS-style''' modules use <code>22</code> (read data by identifier) and <code>19</code> (read DTCs).
* The reply ID is not always the request ID plus 8: the engine is +0x08, the 0x261 to 0x274 group is +0x400, and all others are +0x10.
* Identification strings are ASCII Suzuki part numbers. The first one in each module (<code>1A 8E</code> or <code>22 F1 01</code>) has no trailing character; the second (<code>1A 8A</code> or <code>22 F1 88</code>) ends in <code>*</code>. They do not always equal the number printed on the module's label.
* Commands marked ''captured'' were seen in a trace. Nothing here has been sent to a module by us except the TPMS requests.

== Device table ==
{| class="wikitable"
! Request ID !! Reply ID !! Style !! Module !! Identification reply (first / second) !! How the module was identified
|-
| [[#0x7E0 ECM|0x7E0]] || 0x7E8 || KWP || ECM || 33980-78R0 / 33980-78RC* || Standard engine address
|-
| [[#0x261 ABS (inferred)|0x261]] || 0x661 || KWP || ABS (inferred) || 56100-77RA / 56100-78RF* || Only brake module left by elimination
|-
| [[#0x263 EPS controller|0x263]] || 0x663 || KWP || EPS controller || 38720-77R0 / 38720-77R0* || Parts catalogue (38720-77R01)
|-
| [[#0x271 Body control module|0x271]] || 0x671 || KWP || Body control module || 36775-77R0 / 36775-77RC* || Parts catalogue (36775-77RC2 to RC4)
|-
| [[#0x274 Instrument cluster|0x274]] || 0x674 || KWP || Instrument cluster || 34100-78R0 / 34110-78RD* || Rev counter sweep test
|-
| [[#0x798 TPMS controller|0x798]] || 0x7A8 || KWP || TPMS controller || 37160-61M0 / 37120-78R0* || Label (Model No. P61M0) and parts catalogue
|-
| [[#0x79A Combination switch (lighting and turn)|0x79A]] || 0x7AA || KWP || Combination switch (lighting and turn) || 37210-74PA / 37210-74PE* || Parts catalogue (37210-74PE2)
|-
| [[#0x778 Dual sensor brake support (inferred)|0x778]] || 0x788 || KWP || Dual sensor brake support (inferred) || 33990-52R0 / 33990-78R8* || By elimination
|-
| [[#0x793 Airbag (SRS) controller|0x793]] || 0x7A3 || UDS || Airbag (SRS) controller || 38910-77R0 / 38910-78RC* || Parts catalogue (38910-78RC0)
|-
| [[#0x772 4WD shift controller|0x772]] || 0x782 || UDS || 4WD shift controller || 38885-77R0 / 38885-78R0* || Parts catalogue (38885-78R01)
|-
| [[#0x799 E-call controller|0x799]] || 0x7A9 || UDS || E-call controller || 38960-78RA / 38960-78RA* || Parts catalogue (38960-78RA0, RA1)
|-
| [[#0x751 Central gateway|0x751]] || 0x761 || UDS || Central gateway || 33580-79R0 / 33580-78R0* || Label (33580-79R01) and parts catalogue
|}

Two more addresses, [[#Addresses probed with no reply|0x273 and 0x262]], were probed by the scan tool and did not answer.

The names marked "inferred" are guesses from elimination and part-number series, not confirmed by a label or test.

== 0x7E0 ECM ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x7E0</code>, reply <code>0x7E8</code>. This is the standard OBD engine address, so standard mode 01 PIDs should be available here, but none were captured.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33980-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33980-78RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || Read DTCs by status: none stored (captured)
|}

== 0x261 ABS (inferred) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x261</code>, reply <code>0x661</code>. The name is inferred: this is the only brake module left in the scan report after the others were matched, and 56100 looks like a brake part-number series. Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>56100-77RA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>56100-78RF*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x263 EPS controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x263</code>, reply <code>0x663</code>. Matches parts catalogue entry 38720-77R01 (EPS controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>38720-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>38720-77R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x271 Body control module ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x271</code>, reply <code>0x671</code>. Matches parts catalogue entries 36775-77RC2 to RC4 (body control module, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>36775-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>36775-77RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x274 Instrument cluster ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x274</code>, reply <code>0x674</code>. Confirmed by the rev counter sweep test.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> or <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s during the sweep test (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>34100-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>34110-78RD*</code> (last byte of the reply is <code>06</code>) || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the rev counter sweep (service 0x30, local ID 01, "short-term adjustment"). The cluster then sweeps up and down by itself (captured)
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"). Possibly a stop request sent after the sweep had finished (captured)
|}
The meaning of the four control bytes (<code>80 40 00 00</code>) is not known. Other output tests (gauges, warning lights) have not been captured.

== 0x798 TPMS controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x798</code>, reply <code>0x7A8</code>. The label on the module reads 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0 (Continental A2C13930301, 433.92 MHz). The full data layout, calibration and app setups are on [[OBD2 Diagnostics reading project]].
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification; matches Model No. P61M0 on the label (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> (no codes) or <code>58 01 9A 31 20</code> (one code) || DTCs by status. The code <code>9A 31</code> is probably the left front low pressure warning (inferred). The status byte was <code>20</code> in the full scan and <code>E0</code> in earlier captures (captured)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block: four sensor records with ID, temperature-like value and pressure. The scan tool repeats it about twice a second (captured, decoded)
|}
ELM327 setup that works for <code>21 00</code>: <code>ATSH798</code>, <code>ATS0</code>, <code>ATL0</code>, <code>ATFCSH798</code>, <code>ATFCSD300000</code>, <code>ATFCSM1</code>, then <code>2100</code>.

== 0x79A Combination switch (lighting and turn) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x79A</code>, reply <code>0x7AA</code>. Matches parts catalogue entry 37210-74PE2 (switch assembly, lighting and turn, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37210-74PA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37210-74PE*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x778 Dual sensor brake support (inferred) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x778</code>, reply <code>0x788</code>. The name is inferred by elimination (the scan report's last unassigned module). Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33990-52R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33990-78R8*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x793 Airbag (SRS) controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x793</code>, reply <code>0x7A3</code>. Matches parts catalogue entry 38910-78RC0 (airbag controller, VAN).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38910-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38910-78RC*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}

== 0x772 4WD shift controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x772</code>, reply <code>0x782</code>. Matches parts catalogue entry 38885-78R01 (4WD shift controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times by the scan tool (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38885-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38885-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The scan tool tried the KWP-style <code>3E</code> first and fell back to the UDS form <code>3E 00</code>.

== 0x799 E-call controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x799</code>, reply <code>0x7A9</code>. Matches parts catalogue entries 38960-78RA0 and RA1 (E-call controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38960-78RA</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38960-78RA*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B 92 4E 00 02</code> || One stored code record: <code>92 4E 00</code>, status <code>02</code>. The Launch report does not list it and its meaning is not known (captured)
|}

== 0x751 Central gateway ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x751</code>, reply <code>0x761</code>. The label on the module reads 33580-79R01.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>33580-79R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>33580-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The gateway sits between the OBD socket and the vehicle CAN bus. Whether it forwards requests to the other modules unchanged is not confirmed.

== Addresses probed with no reply ==
The scan tool sent tester-present (<code>3E</code>) about eight times each to <code>0x273</code> and <code>0x262</code> and received nothing from the expected reply IDs (<code>0x673</code> and <code>0x662</code>). They are probably modules this car does not have, such as an automatic transmission or auto-levelling controller. This is a guess.

== ELM327 notes ==
* Only <code>0x798</code> has been tested with an ELM327. For other modules, set <code>ATSH</code> to the request ID and <code>ATFCSH</code> to the same ID, and you may need <code>ATCRA</code> with the reply ID, because the reply is not always the request ID plus 8. This is untested.
* Replies from the 0x7xx modules are multi-frame for the identification strings, so the flow-control settings from the TPMS section probably apply there too. Untested.
* Do not send output-control commands (service <code>30</code> and similar) from a head-unit app while driving.

== Sources ==
* Owner PCAN-View captures of a Launch X431 CRP919 full health-check scan and rev counter sweep test, October 2026.
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* Labels on the TPMS controller and central gateway of the test car.

[[Category:Electrical - gen4]]

ECU diagnostic CAN addresses

2026-11-01T10:29:59Z

Mlines: /* 0x799 E-call controller */

<div style="border: 1px solid #c9a227; background-color: #fff8dc; padding: 0.6em 1em; margin: 0 0 1em 0; border-radius: 4px;">
'''Support this project:''' The information on this page is free, but it took a lot of work to gather, test and write up. If it has been useful to you, you can say thanks with a donation at [https://buymeacoffee.com/bigjimny buymeacoffee.com/bigjimny].
</div>

= Suzuki Jimny JB74 - CAN bus devices and the commands they answer =

'''Status:''' work in progress. This page lists every module that answered on the OBD socket (DLC) of one RHD UK-market 2021 Jimny, its request and reply CAN IDs, and the diagnostic commands seen so far. Many sections are short because only identification and fault-code requests have been captured. See [[OBD2 Diagnostics reading project]] for how the captures were made and for the TPMS data in detail.

== How to read this page ==
* All IDs are 11-bit CAN IDs on the OBD socket (pins 6 and 14, 500 kbit/s). The "request ID" is the header a tool sends to; the "reply ID" is where the module answers.
* Commands are shown as the payload bytes in hex, without the ISO-TP length byte. Replies longer than 7 bytes are sent as several frames; the tables show them reassembled.
* '''KWP-style''' modules use services such as <code>1A</code> (read ECU identification) and <code>18</code> (read DTCs by status). '''UDS-style''' modules use <code>22</code> (read data by identifier) and <code>19</code> (read DTCs).
* The reply ID is not always the request ID plus 8: the engine is +0x08, the 0x261 to 0x274 group is +0x400, and all others are +0x10.
* Identification strings are ASCII Suzuki part numbers. The first one in each module (<code>1A 8E</code> or <code>22 F1 01</code>) has no trailing character; the second (<code>1A 8A</code> or <code>22 F1 88</code>) ends in <code>*</code>. They do not always equal the number printed on the module's label.
* Commands marked ''captured'' were seen in a trace. Nothing here has been sent to a module by us except the TPMS requests.

== Device table ==
{| class="wikitable"
! Request ID !! Reply ID !! Style !! Module !! Identification reply (first / second) !! How the module was identified
|-
| [[#0x7E0 ECM|0x7E0]] || 0x7E8 || KWP || ECM || 33980-78R0 / 33980-78RC* || Standard engine address
|-
| [[#0x261 ABS (inferred)|0x261]] || 0x661 || KWP || ABS (inferred) || 56100-77RA / 56100-78RF* || Only brake module left by elimination
|-
| [[#0x263 EPS controller|0x263]] || 0x663 || KWP || EPS controller || 38720-77R0 / 38720-77R0* || Parts catalogue (38720-77R01)
|-
| [[#0x271 Body control module|0x271]] || 0x671 || KWP || Body control module || 36775-77R0 / 36775-77RC* || Parts catalogue (36775-77RC2 to RC4)
|-
| [[#0x274 Instrument cluster|0x274]] || 0x674 || KWP || Instrument cluster || 34100-78R0 / 34110-78RD* || Rev counter sweep test
|-
| [[#0x798 TPMS controller|0x798]] || 0x7A8 || KWP || TPMS controller || 37160-61M0 / 37120-78R0* || Label (Model No. P61M0) and parts catalogue
|-
| [[#0x79A Combination switch (lighting and turn)|0x79A]] || 0x7AA || KWP || Combination switch (lighting and turn) || 37210-74PA / 37210-74PE* || Parts catalogue (37210-74PE2)
|-
| [[#0x778 Dual sensor brake support (inferred)|0x778]] || 0x788 || KWP || Dual sensor brake support (inferred) || 33990-52R0 / 33990-78R8* || By elimination
|-
| [[#0x793 Airbag (SRS) controller|0x793]] || 0x7A3 || UDS || Airbag (SRS) controller || 38910-77R0 / 38910-78RC* || Parts catalogue (38910-78RC0)
|-
| [[#0x772 4WD shift controller|0x772]] || 0x782 || UDS || 4WD shift controller || 38885-77R0 / 38885-78R0* || Parts catalogue (38885-78R01)
|-
| [[#0x799 E-call controller|0x799]] || 0x7A9 || UDS || E-call controller || 38960-78RA / 38960-78RA* || Parts catalogue (38960-78RA0, RA1)
|-
| [[#0x751 Central gateway|0x751]] || 0x761 || UDS || Central gateway || 33580-79R0 / 33580-78R0* || Label (33580-79R01) and parts catalogue
|}

Two more addresses, [[#Addresses probed with no reply|0x273 and 0x262]], were probed by the scan tool and did not answer.

The names marked "inferred" are guesses from elimination and part-number series, not confirmed by a label or test.

== 0x7E0 ECM ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x7E0</code>, reply <code>0x7E8</code>. This is the standard OBD engine address, so standard mode 01 PIDs should be available here, but none were captured.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33980-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33980-78RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || Read DTCs by status: none stored (captured)
|}

== 0x261 ABS (inferred) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x261</code>, reply <code>0x661</code>. The name is inferred: this is the only brake module left in the scan report after the others were matched, and 56100 looks like a brake part-number series. Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>56100-77RA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>56100-78RF*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x263 EPS controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x263</code>, reply <code>0x663</code>. Matches parts catalogue entry 38720-77R01 (EPS controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>38720-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>38720-77R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x271 Body control module ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x271</code>, reply <code>0x671</code>. Matches parts catalogue entries 36775-77RC2 to RC4 (body control module, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>36775-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>36775-77RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x274 Instrument cluster ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x274</code>, reply <code>0x674</code>. Confirmed by the rev counter sweep test.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> or <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s during the sweep test (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>34100-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>34110-78RD*</code> (last byte of the reply is <code>06</code>) || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the rev counter sweep (service 0x30, local ID 01, "short-term adjustment"). The cluster then sweeps up and down by itself (captured)
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"). Possibly a stop request sent after the sweep had finished (captured)
|}
The meaning of the four control bytes (<code>80 40 00 00</code>) is not known. Other output tests (gauges, warning lights) have not been captured.

== 0x798 TPMS controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x798</code>, reply <code>0x7A8</code>. The label on the module reads 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0 (Continental A2C13930301, 433.92 MHz). The full data layout, calibration and app setups are on [[OBD2 Diagnostics reading project]].
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification; matches Model No. P61M0 on the label (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> (no codes) or <code>58 01 9A 31 20</code> (one code) || DTCs by status. The code <code>9A 31</code> is probably the left front low pressure warning (inferred). The status byte was <code>20</code> in the full scan and <code>E0</code> in earlier captures (captured)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block: four sensor records with ID, temperature-like value and pressure. The scan tool repeats it about twice a second (captured, decoded)
|}
ELM327 setup that works for <code>21 00</code>: <code>ATSH798</code>, <code>ATS0</code>, <code>ATL0</code>, <code>ATFCSH798</code>, <code>ATFCSD300000</code>, <code>ATFCSM1</code>, then <code>2100</code>.

== 0x79A Combination switch (lighting and turn) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x79A</code>, reply <code>0x7AA</code>. Matches parts catalogue entry 37210-74PE2 (switch assembly, lighting and turn, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37210-74PA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37210-74PE*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x778 Dual sensor brake support (inferred) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x778</code>, reply <code>0x788</code>. The name is inferred by elimination (the scan report's last unassigned module). Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33990-52R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33990-78R8*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x793 Airbag (SRS) controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x793</code>, reply <code>0x7A3</code>. Matches parts catalogue entry 38910-78RC0 (airbag controller, VAN).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38910-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38910-78RC*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}

== 0x772 4WD shift controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x772</code>, reply <code>0x782</code>. Matches parts catalogue entry 38885-78R01 (4WD shift controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times by the scan tool (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38885-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38885-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The scan tool tried the KWP-style <code>3E</code> first and fell back to the UDS form <code>3E 00</code>.

== 0x799 E-call controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x799</code>, reply <code>0x7A9</code>. Matches parts catalogue entries 38960-78RA0 and RA1 (E-call controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38960-78RA</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38960-78RA*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B 92 4E 00 02</code> || One stored code record: <code>92 4E 00</code>, status <code>02</code>. The Launch report does not list it and its meaning is not known (captured)
|}

== 0x751 Central gateway ==
Request <code>0x751</code>, reply <code>0x761</code>. The label on the module reads 33580-79R01.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>33580-79R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>33580-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The gateway sits between the OBD socket and the vehicle CAN bus. Whether it forwards requests to the other modules unchanged is not confirmed.

== Addresses probed with no reply ==
The scan tool sent tester-present (<code>3E</code>) about eight times each to <code>0x273</code> and <code>0x262</code> and received nothing from the expected reply IDs (<code>0x673</code> and <code>0x662</code>). They are probably modules this car does not have, such as an automatic transmission or auto-levelling controller. This is a guess.

== ELM327 notes ==
* Only <code>0x798</code> has been tested with an ELM327. For other modules, set <code>ATSH</code> to the request ID and <code>ATFCSH</code> to the same ID, and you may need <code>ATCRA</code> with the reply ID, because the reply is not always the request ID plus 8. This is untested.
* Replies from the 0x7xx modules are multi-frame for the identification strings, so the flow-control settings from the TPMS section probably apply there too. Untested.
* Do not send output-control commands (service <code>30</code> and similar) from a head-unit app while driving.

== Sources ==
* Owner PCAN-View captures of a Launch X431 CRP919 full health-check scan and rev counter sweep test, October 2026.
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* Labels on the TPMS controller and central gateway of the test car.

[[Category:Electrical - gen4]]

ECU diagnostic CAN addresses

2026-11-01T10:29:43Z

Mlines: /* 0x772 4WD shift controller */

<div style="border: 1px solid #c9a227; background-color: #fff8dc; padding: 0.6em 1em; margin: 0 0 1em 0; border-radius: 4px;">
'''Support this project:''' The information on this page is free, but it took a lot of work to gather, test and write up. If it has been useful to you, you can say thanks with a donation at [https://buymeacoffee.com/bigjimny buymeacoffee.com/bigjimny].
</div>

= Suzuki Jimny JB74 - CAN bus devices and the commands they answer =

'''Status:''' work in progress. This page lists every module that answered on the OBD socket (DLC) of one RHD UK-market 2021 Jimny, its request and reply CAN IDs, and the diagnostic commands seen so far. Many sections are short because only identification and fault-code requests have been captured. See [[OBD2 Diagnostics reading project]] for how the captures were made and for the TPMS data in detail.

== How to read this page ==
* All IDs are 11-bit CAN IDs on the OBD socket (pins 6 and 14, 500 kbit/s). The "request ID" is the header a tool sends to; the "reply ID" is where the module answers.
* Commands are shown as the payload bytes in hex, without the ISO-TP length byte. Replies longer than 7 bytes are sent as several frames; the tables show them reassembled.
* '''KWP-style''' modules use services such as <code>1A</code> (read ECU identification) and <code>18</code> (read DTCs by status). '''UDS-style''' modules use <code>22</code> (read data by identifier) and <code>19</code> (read DTCs).
* The reply ID is not always the request ID plus 8: the engine is +0x08, the 0x261 to 0x274 group is +0x400, and all others are +0x10.
* Identification strings are ASCII Suzuki part numbers. The first one in each module (<code>1A 8E</code> or <code>22 F1 01</code>) has no trailing character; the second (<code>1A 8A</code> or <code>22 F1 88</code>) ends in <code>*</code>. They do not always equal the number printed on the module's label.
* Commands marked ''captured'' were seen in a trace. Nothing here has been sent to a module by us except the TPMS requests.

== Device table ==
{| class="wikitable"
! Request ID !! Reply ID !! Style !! Module !! Identification reply (first / second) !! How the module was identified
|-
| [[#0x7E0 ECM|0x7E0]] || 0x7E8 || KWP || ECM || 33980-78R0 / 33980-78RC* || Standard engine address
|-
| [[#0x261 ABS (inferred)|0x261]] || 0x661 || KWP || ABS (inferred) || 56100-77RA / 56100-78RF* || Only brake module left by elimination
|-
| [[#0x263 EPS controller|0x263]] || 0x663 || KWP || EPS controller || 38720-77R0 / 38720-77R0* || Parts catalogue (38720-77R01)
|-
| [[#0x271 Body control module|0x271]] || 0x671 || KWP || Body control module || 36775-77R0 / 36775-77RC* || Parts catalogue (36775-77RC2 to RC4)
|-
| [[#0x274 Instrument cluster|0x274]] || 0x674 || KWP || Instrument cluster || 34100-78R0 / 34110-78RD* || Rev counter sweep test
|-
| [[#0x798 TPMS controller|0x798]] || 0x7A8 || KWP || TPMS controller || 37160-61M0 / 37120-78R0* || Label (Model No. P61M0) and parts catalogue
|-
| [[#0x79A Combination switch (lighting and turn)|0x79A]] || 0x7AA || KWP || Combination switch (lighting and turn) || 37210-74PA / 37210-74PE* || Parts catalogue (37210-74PE2)
|-
| [[#0x778 Dual sensor brake support (inferred)|0x778]] || 0x788 || KWP || Dual sensor brake support (inferred) || 33990-52R0 / 33990-78R8* || By elimination
|-
| [[#0x793 Airbag (SRS) controller|0x793]] || 0x7A3 || UDS || Airbag (SRS) controller || 38910-77R0 / 38910-78RC* || Parts catalogue (38910-78RC0)
|-
| [[#0x772 4WD shift controller|0x772]] || 0x782 || UDS || 4WD shift controller || 38885-77R0 / 38885-78R0* || Parts catalogue (38885-78R01)
|-
| [[#0x799 E-call controller|0x799]] || 0x7A9 || UDS || E-call controller || 38960-78RA / 38960-78RA* || Parts catalogue (38960-78RA0, RA1)
|-
| [[#0x751 Central gateway|0x751]] || 0x761 || UDS || Central gateway || 33580-79R0 / 33580-78R0* || Label (33580-79R01) and parts catalogue
|}

Two more addresses, [[#Addresses probed with no reply|0x273 and 0x262]], were probed by the scan tool and did not answer.

The names marked "inferred" are guesses from elimination and part-number series, not confirmed by a label or test.

== 0x7E0 ECM ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x7E0</code>, reply <code>0x7E8</code>. This is the standard OBD engine address, so standard mode 01 PIDs should be available here, but none were captured.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33980-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33980-78RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || Read DTCs by status: none stored (captured)
|}

== 0x261 ABS (inferred) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x261</code>, reply <code>0x661</code>. The name is inferred: this is the only brake module left in the scan report after the others were matched, and 56100 looks like a brake part-number series. Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>56100-77RA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>56100-78RF*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x263 EPS controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x263</code>, reply <code>0x663</code>. Matches parts catalogue entry 38720-77R01 (EPS controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>38720-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>38720-77R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x271 Body control module ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x271</code>, reply <code>0x671</code>. Matches parts catalogue entries 36775-77RC2 to RC4 (body control module, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>36775-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>36775-77RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x274 Instrument cluster ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x274</code>, reply <code>0x674</code>. Confirmed by the rev counter sweep test.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> or <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s during the sweep test (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>34100-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>34110-78RD*</code> (last byte of the reply is <code>06</code>) || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the rev counter sweep (service 0x30, local ID 01, "short-term adjustment"). The cluster then sweeps up and down by itself (captured)
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"). Possibly a stop request sent after the sweep had finished (captured)
|}
The meaning of the four control bytes (<code>80 40 00 00</code>) is not known. Other output tests (gauges, warning lights) have not been captured.

== 0x798 TPMS controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x798</code>, reply <code>0x7A8</code>. The label on the module reads 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0 (Continental A2C13930301, 433.92 MHz). The full data layout, calibration and app setups are on [[OBD2 Diagnostics reading project]].
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification; matches Model No. P61M0 on the label (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> (no codes) or <code>58 01 9A 31 20</code> (one code) || DTCs by status. The code <code>9A 31</code> is probably the left front low pressure warning (inferred). The status byte was <code>20</code> in the full scan and <code>E0</code> in earlier captures (captured)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block: four sensor records with ID, temperature-like value and pressure. The scan tool repeats it about twice a second (captured, decoded)
|}
ELM327 setup that works for <code>21 00</code>: <code>ATSH798</code>, <code>ATS0</code>, <code>ATL0</code>, <code>ATFCSH798</code>, <code>ATFCSD300000</code>, <code>ATFCSM1</code>, then <code>2100</code>.

== 0x79A Combination switch (lighting and turn) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x79A</code>, reply <code>0x7AA</code>. Matches parts catalogue entry 37210-74PE2 (switch assembly, lighting and turn, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37210-74PA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37210-74PE*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x778 Dual sensor brake support (inferred) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x778</code>, reply <code>0x788</code>. The name is inferred by elimination (the scan report's last unassigned module). Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33990-52R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33990-78R8*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x793 Airbag (SRS) controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x793</code>, reply <code>0x7A3</code>. Matches parts catalogue entry 38910-78RC0 (airbag controller, VAN).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38910-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38910-78RC*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}

== 0x772 4WD shift controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x772</code>, reply <code>0x782</code>. Matches parts catalogue entry 38885-78R01 (4WD shift controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times by the scan tool (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38885-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38885-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The scan tool tried the KWP-style <code>3E</code> first and fell back to the UDS form <code>3E 00</code>.

== 0x799 E-call controller ==
Request <code>0x799</code>, reply <code>0x7A9</code>. Matches parts catalogue entries 38960-78RA0 and RA1 (E-call controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38960-78RA</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38960-78RA*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B 92 4E 00 02</code> || One stored code record: <code>92 4E 00</code>, status <code>02</code>. The Launch report does not list it and its meaning is not known (captured)
|}

== 0x751 Central gateway ==
Request <code>0x751</code>, reply <code>0x761</code>. The label on the module reads 33580-79R01.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>33580-79R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>33580-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The gateway sits between the OBD socket and the vehicle CAN bus. Whether it forwards requests to the other modules unchanged is not confirmed.

== Addresses probed with no reply ==
The scan tool sent tester-present (<code>3E</code>) about eight times each to <code>0x273</code> and <code>0x262</code> and received nothing from the expected reply IDs (<code>0x673</code> and <code>0x662</code>). They are probably modules this car does not have, such as an automatic transmission or auto-levelling controller. This is a guess.

== ELM327 notes ==
* Only <code>0x798</code> has been tested with an ELM327. For other modules, set <code>ATSH</code> to the request ID and <code>ATFCSH</code> to the same ID, and you may need <code>ATCRA</code> with the reply ID, because the reply is not always the request ID plus 8. This is untested.
* Replies from the 0x7xx modules are multi-frame for the identification strings, so the flow-control settings from the TPMS section probably apply there too. Untested.
* Do not send output-control commands (service <code>30</code> and similar) from a head-unit app while driving.

== Sources ==
* Owner PCAN-View captures of a Launch X431 CRP919 full health-check scan and rev counter sweep test, October 2026.
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* Labels on the TPMS controller and central gateway of the test car.

[[Category:Electrical - gen4]]

ECU diagnostic CAN addresses

2026-11-01T10:29:27Z

Mlines: /* 0x793 Airbag (SRS) controller */

<div style="border: 1px solid #c9a227; background-color: #fff8dc; padding: 0.6em 1em; margin: 0 0 1em 0; border-radius: 4px;">
'''Support this project:''' The information on this page is free, but it took a lot of work to gather, test and write up. If it has been useful to you, you can say thanks with a donation at [https://buymeacoffee.com/bigjimny buymeacoffee.com/bigjimny].
</div>

= Suzuki Jimny JB74 - CAN bus devices and the commands they answer =

'''Status:''' work in progress. This page lists every module that answered on the OBD socket (DLC) of one RHD UK-market 2021 Jimny, its request and reply CAN IDs, and the diagnostic commands seen so far. Many sections are short because only identification and fault-code requests have been captured. See [[OBD2 Diagnostics reading project]] for how the captures were made and for the TPMS data in detail.

== How to read this page ==
* All IDs are 11-bit CAN IDs on the OBD socket (pins 6 and 14, 500 kbit/s). The "request ID" is the header a tool sends to; the "reply ID" is where the module answers.
* Commands are shown as the payload bytes in hex, without the ISO-TP length byte. Replies longer than 7 bytes are sent as several frames; the tables show them reassembled.
* '''KWP-style''' modules use services such as <code>1A</code> (read ECU identification) and <code>18</code> (read DTCs by status). '''UDS-style''' modules use <code>22</code> (read data by identifier) and <code>19</code> (read DTCs).
* The reply ID is not always the request ID plus 8: the engine is +0x08, the 0x261 to 0x274 group is +0x400, and all others are +0x10.
* Identification strings are ASCII Suzuki part numbers. The first one in each module (<code>1A 8E</code> or <code>22 F1 01</code>) has no trailing character; the second (<code>1A 8A</code> or <code>22 F1 88</code>) ends in <code>*</code>. They do not always equal the number printed on the module's label.
* Commands marked ''captured'' were seen in a trace. Nothing here has been sent to a module by us except the TPMS requests.

== Device table ==
{| class="wikitable"
! Request ID !! Reply ID !! Style !! Module !! Identification reply (first / second) !! How the module was identified
|-
| [[#0x7E0 ECM|0x7E0]] || 0x7E8 || KWP || ECM || 33980-78R0 / 33980-78RC* || Standard engine address
|-
| [[#0x261 ABS (inferred)|0x261]] || 0x661 || KWP || ABS (inferred) || 56100-77RA / 56100-78RF* || Only brake module left by elimination
|-
| [[#0x263 EPS controller|0x263]] || 0x663 || KWP || EPS controller || 38720-77R0 / 38720-77R0* || Parts catalogue (38720-77R01)
|-
| [[#0x271 Body control module|0x271]] || 0x671 || KWP || Body control module || 36775-77R0 / 36775-77RC* || Parts catalogue (36775-77RC2 to RC4)
|-
| [[#0x274 Instrument cluster|0x274]] || 0x674 || KWP || Instrument cluster || 34100-78R0 / 34110-78RD* || Rev counter sweep test
|-
| [[#0x798 TPMS controller|0x798]] || 0x7A8 || KWP || TPMS controller || 37160-61M0 / 37120-78R0* || Label (Model No. P61M0) and parts catalogue
|-
| [[#0x79A Combination switch (lighting and turn)|0x79A]] || 0x7AA || KWP || Combination switch (lighting and turn) || 37210-74PA / 37210-74PE* || Parts catalogue (37210-74PE2)
|-
| [[#0x778 Dual sensor brake support (inferred)|0x778]] || 0x788 || KWP || Dual sensor brake support (inferred) || 33990-52R0 / 33990-78R8* || By elimination
|-
| [[#0x793 Airbag (SRS) controller|0x793]] || 0x7A3 || UDS || Airbag (SRS) controller || 38910-77R0 / 38910-78RC* || Parts catalogue (38910-78RC0)
|-
| [[#0x772 4WD shift controller|0x772]] || 0x782 || UDS || 4WD shift controller || 38885-77R0 / 38885-78R0* || Parts catalogue (38885-78R01)
|-
| [[#0x799 E-call controller|0x799]] || 0x7A9 || UDS || E-call controller || 38960-78RA / 38960-78RA* || Parts catalogue (38960-78RA0, RA1)
|-
| [[#0x751 Central gateway|0x751]] || 0x761 || UDS || Central gateway || 33580-79R0 / 33580-78R0* || Label (33580-79R01) and parts catalogue
|}

Two more addresses, [[#Addresses probed with no reply|0x273 and 0x262]], were probed by the scan tool and did not answer.

The names marked "inferred" are guesses from elimination and part-number series, not confirmed by a label or test.

== 0x7E0 ECM ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x7E0</code>, reply <code>0x7E8</code>. This is the standard OBD engine address, so standard mode 01 PIDs should be available here, but none were captured.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33980-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33980-78RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || Read DTCs by status: none stored (captured)
|}

== 0x261 ABS (inferred) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x261</code>, reply <code>0x661</code>. The name is inferred: this is the only brake module left in the scan report after the others were matched, and 56100 looks like a brake part-number series. Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>56100-77RA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>56100-78RF*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x263 EPS controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x263</code>, reply <code>0x663</code>. Matches parts catalogue entry 38720-77R01 (EPS controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>38720-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>38720-77R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x271 Body control module ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x271</code>, reply <code>0x671</code>. Matches parts catalogue entries 36775-77RC2 to RC4 (body control module, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>36775-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>36775-77RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x274 Instrument cluster ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x274</code>, reply <code>0x674</code>. Confirmed by the rev counter sweep test.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> or <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s during the sweep test (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>34100-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>34110-78RD*</code> (last byte of the reply is <code>06</code>) || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the rev counter sweep (service 0x30, local ID 01, "short-term adjustment"). The cluster then sweeps up and down by itself (captured)
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"). Possibly a stop request sent after the sweep had finished (captured)
|}
The meaning of the four control bytes (<code>80 40 00 00</code>) is not known. Other output tests (gauges, warning lights) have not been captured.

== 0x798 TPMS controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x798</code>, reply <code>0x7A8</code>. The label on the module reads 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0 (Continental A2C13930301, 433.92 MHz). The full data layout, calibration and app setups are on [[OBD2 Diagnostics reading project]].
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification; matches Model No. P61M0 on the label (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> (no codes) or <code>58 01 9A 31 20</code> (one code) || DTCs by status. The code <code>9A 31</code> is probably the left front low pressure warning (inferred). The status byte was <code>20</code> in the full scan and <code>E0</code> in earlier captures (captured)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block: four sensor records with ID, temperature-like value and pressure. The scan tool repeats it about twice a second (captured, decoded)
|}
ELM327 setup that works for <code>21 00</code>: <code>ATSH798</code>, <code>ATS0</code>, <code>ATL0</code>, <code>ATFCSH798</code>, <code>ATFCSD300000</code>, <code>ATFCSM1</code>, then <code>2100</code>.

== 0x79A Combination switch (lighting and turn) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x79A</code>, reply <code>0x7AA</code>. Matches parts catalogue entry 37210-74PE2 (switch assembly, lighting and turn, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37210-74PA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37210-74PE*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x778 Dual sensor brake support (inferred) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x778</code>, reply <code>0x788</code>. The name is inferred by elimination (the scan report's last unassigned module). Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33990-52R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33990-78R8*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x793 Airbag (SRS) controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x793</code>, reply <code>0x7A3</code>. Matches parts catalogue entry 38910-78RC0 (airbag controller, VAN).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38910-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38910-78RC*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}

== 0x772 4WD shift controller ==
Request <code>0x772</code>, reply <code>0x782</code>. Matches parts catalogue entry 38885-78R01 (4WD shift controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times by the scan tool (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38885-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38885-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The scan tool tried the KWP-style <code>3E</code> first and fell back to the UDS form <code>3E 00</code>.

== 0x799 E-call controller ==
Request <code>0x799</code>, reply <code>0x7A9</code>. Matches parts catalogue entries 38960-78RA0 and RA1 (E-call controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38960-78RA</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38960-78RA*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B 92 4E 00 02</code> || One stored code record: <code>92 4E 00</code>, status <code>02</code>. The Launch report does not list it and its meaning is not known (captured)
|}

== 0x751 Central gateway ==
Request <code>0x751</code>, reply <code>0x761</code>. The label on the module reads 33580-79R01.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>33580-79R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>33580-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The gateway sits between the OBD socket and the vehicle CAN bus. Whether it forwards requests to the other modules unchanged is not confirmed.

== Addresses probed with no reply ==
The scan tool sent tester-present (<code>3E</code>) about eight times each to <code>0x273</code> and <code>0x262</code> and received nothing from the expected reply IDs (<code>0x673</code> and <code>0x662</code>). They are probably modules this car does not have, such as an automatic transmission or auto-levelling controller. This is a guess.

== ELM327 notes ==
* Only <code>0x798</code> has been tested with an ELM327. For other modules, set <code>ATSH</code> to the request ID and <code>ATFCSH</code> to the same ID, and you may need <code>ATCRA</code> with the reply ID, because the reply is not always the request ID plus 8. This is untested.
* Replies from the 0x7xx modules are multi-frame for the identification strings, so the flow-control settings from the TPMS section probably apply there too. Untested.
* Do not send output-control commands (service <code>30</code> and similar) from a head-unit app while driving.

== Sources ==
* Owner PCAN-View captures of a Launch X431 CRP919 full health-check scan and rev counter sweep test, October 2026.
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* Labels on the TPMS controller and central gateway of the test car.

[[Category:Electrical - gen4]]

ECU diagnostic CAN addresses

2026-11-01T10:29:13Z

Mlines: /* 0x778 Dual sensor brake support (inferred) */

<div style="border: 1px solid #c9a227; background-color: #fff8dc; padding: 0.6em 1em; margin: 0 0 1em 0; border-radius: 4px;">
'''Support this project:''' The information on this page is free, but it took a lot of work to gather, test and write up. If it has been useful to you, you can say thanks with a donation at [https://buymeacoffee.com/bigjimny buymeacoffee.com/bigjimny].
</div>

= Suzuki Jimny JB74 - CAN bus devices and the commands they answer =

'''Status:''' work in progress. This page lists every module that answered on the OBD socket (DLC) of one RHD UK-market 2021 Jimny, its request and reply CAN IDs, and the diagnostic commands seen so far. Many sections are short because only identification and fault-code requests have been captured. See [[OBD2 Diagnostics reading project]] for how the captures were made and for the TPMS data in detail.

== How to read this page ==
* All IDs are 11-bit CAN IDs on the OBD socket (pins 6 and 14, 500 kbit/s). The "request ID" is the header a tool sends to; the "reply ID" is where the module answers.
* Commands are shown as the payload bytes in hex, without the ISO-TP length byte. Replies longer than 7 bytes are sent as several frames; the tables show them reassembled.
* '''KWP-style''' modules use services such as <code>1A</code> (read ECU identification) and <code>18</code> (read DTCs by status). '''UDS-style''' modules use <code>22</code> (read data by identifier) and <code>19</code> (read DTCs).
* The reply ID is not always the request ID plus 8: the engine is +0x08, the 0x261 to 0x274 group is +0x400, and all others are +0x10.
* Identification strings are ASCII Suzuki part numbers. The first one in each module (<code>1A 8E</code> or <code>22 F1 01</code>) has no trailing character; the second (<code>1A 8A</code> or <code>22 F1 88</code>) ends in <code>*</code>. They do not always equal the number printed on the module's label.
* Commands marked ''captured'' were seen in a trace. Nothing here has been sent to a module by us except the TPMS requests.

== Device table ==
{| class="wikitable"
! Request ID !! Reply ID !! Style !! Module !! Identification reply (first / second) !! How the module was identified
|-
| [[#0x7E0 ECM|0x7E0]] || 0x7E8 || KWP || ECM || 33980-78R0 / 33980-78RC* || Standard engine address
|-
| [[#0x261 ABS (inferred)|0x261]] || 0x661 || KWP || ABS (inferred) || 56100-77RA / 56100-78RF* || Only brake module left by elimination
|-
| [[#0x263 EPS controller|0x263]] || 0x663 || KWP || EPS controller || 38720-77R0 / 38720-77R0* || Parts catalogue (38720-77R01)
|-
| [[#0x271 Body control module|0x271]] || 0x671 || KWP || Body control module || 36775-77R0 / 36775-77RC* || Parts catalogue (36775-77RC2 to RC4)
|-
| [[#0x274 Instrument cluster|0x274]] || 0x674 || KWP || Instrument cluster || 34100-78R0 / 34110-78RD* || Rev counter sweep test
|-
| [[#0x798 TPMS controller|0x798]] || 0x7A8 || KWP || TPMS controller || 37160-61M0 / 37120-78R0* || Label (Model No. P61M0) and parts catalogue
|-
| [[#0x79A Combination switch (lighting and turn)|0x79A]] || 0x7AA || KWP || Combination switch (lighting and turn) || 37210-74PA / 37210-74PE* || Parts catalogue (37210-74PE2)
|-
| [[#0x778 Dual sensor brake support (inferred)|0x778]] || 0x788 || KWP || Dual sensor brake support (inferred) || 33990-52R0 / 33990-78R8* || By elimination
|-
| [[#0x793 Airbag (SRS) controller|0x793]] || 0x7A3 || UDS || Airbag (SRS) controller || 38910-77R0 / 38910-78RC* || Parts catalogue (38910-78RC0)
|-
| [[#0x772 4WD shift controller|0x772]] || 0x782 || UDS || 4WD shift controller || 38885-77R0 / 38885-78R0* || Parts catalogue (38885-78R01)
|-
| [[#0x799 E-call controller|0x799]] || 0x7A9 || UDS || E-call controller || 38960-78RA / 38960-78RA* || Parts catalogue (38960-78RA0, RA1)
|-
| [[#0x751 Central gateway|0x751]] || 0x761 || UDS || Central gateway || 33580-79R0 / 33580-78R0* || Label (33580-79R01) and parts catalogue
|}

Two more addresses, [[#Addresses probed with no reply|0x273 and 0x262]], were probed by the scan tool and did not answer.

The names marked "inferred" are guesses from elimination and part-number series, not confirmed by a label or test.

== 0x7E0 ECM ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x7E0</code>, reply <code>0x7E8</code>. This is the standard OBD engine address, so standard mode 01 PIDs should be available here, but none were captured.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33980-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33980-78RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || Read DTCs by status: none stored (captured)
|}

== 0x261 ABS (inferred) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x261</code>, reply <code>0x661</code>. The name is inferred: this is the only brake module left in the scan report after the others were matched, and 56100 looks like a brake part-number series. Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>56100-77RA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>56100-78RF*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x263 EPS controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x263</code>, reply <code>0x663</code>. Matches parts catalogue entry 38720-77R01 (EPS controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>38720-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>38720-77R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x271 Body control module ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x271</code>, reply <code>0x671</code>. Matches parts catalogue entries 36775-77RC2 to RC4 (body control module, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>36775-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>36775-77RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x274 Instrument cluster ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x274</code>, reply <code>0x674</code>. Confirmed by the rev counter sweep test.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> or <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s during the sweep test (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>34100-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>34110-78RD*</code> (last byte of the reply is <code>06</code>) || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the rev counter sweep (service 0x30, local ID 01, "short-term adjustment"). The cluster then sweeps up and down by itself (captured)
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"). Possibly a stop request sent after the sweep had finished (captured)
|}
The meaning of the four control bytes (<code>80 40 00 00</code>) is not known. Other output tests (gauges, warning lights) have not been captured.

== 0x798 TPMS controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x798</code>, reply <code>0x7A8</code>. The label on the module reads 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0 (Continental A2C13930301, 433.92 MHz). The full data layout, calibration and app setups are on [[OBD2 Diagnostics reading project]].
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification; matches Model No. P61M0 on the label (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> (no codes) or <code>58 01 9A 31 20</code> (one code) || DTCs by status. The code <code>9A 31</code> is probably the left front low pressure warning (inferred). The status byte was <code>20</code> in the full scan and <code>E0</code> in earlier captures (captured)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block: four sensor records with ID, temperature-like value and pressure. The scan tool repeats it about twice a second (captured, decoded)
|}
ELM327 setup that works for <code>21 00</code>: <code>ATSH798</code>, <code>ATS0</code>, <code>ATL0</code>, <code>ATFCSH798</code>, <code>ATFCSD300000</code>, <code>ATFCSM1</code>, then <code>2100</code>.

== 0x79A Combination switch (lighting and turn) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x79A</code>, reply <code>0x7AA</code>. Matches parts catalogue entry 37210-74PE2 (switch assembly, lighting and turn, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37210-74PA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37210-74PE*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x778 Dual sensor brake support (inferred) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x778</code>, reply <code>0x788</code>. The name is inferred by elimination (the scan report's last unassigned module). Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33990-52R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33990-78R8*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x793 Airbag (SRS) controller ==
Request <code>0x793</code>, reply <code>0x7A3</code>. Matches parts catalogue entry 38910-78RC0 (airbag controller, VAN).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38910-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38910-78RC*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}

== 0x772 4WD shift controller ==
Request <code>0x772</code>, reply <code>0x782</code>. Matches parts catalogue entry 38885-78R01 (4WD shift controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times by the scan tool (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38885-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38885-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The scan tool tried the KWP-style <code>3E</code> first and fell back to the UDS form <code>3E 00</code>.

== 0x799 E-call controller ==
Request <code>0x799</code>, reply <code>0x7A9</code>. Matches parts catalogue entries 38960-78RA0 and RA1 (E-call controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38960-78RA</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38960-78RA*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B 92 4E 00 02</code> || One stored code record: <code>92 4E 00</code>, status <code>02</code>. The Launch report does not list it and its meaning is not known (captured)
|}

== 0x751 Central gateway ==
Request <code>0x751</code>, reply <code>0x761</code>. The label on the module reads 33580-79R01.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>33580-79R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>33580-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The gateway sits between the OBD socket and the vehicle CAN bus. Whether it forwards requests to the other modules unchanged is not confirmed.

== Addresses probed with no reply ==
The scan tool sent tester-present (<code>3E</code>) about eight times each to <code>0x273</code> and <code>0x262</code> and received nothing from the expected reply IDs (<code>0x673</code> and <code>0x662</code>). They are probably modules this car does not have, such as an automatic transmission or auto-levelling controller. This is a guess.

== ELM327 notes ==
* Only <code>0x798</code> has been tested with an ELM327. For other modules, set <code>ATSH</code> to the request ID and <code>ATFCSH</code> to the same ID, and you may need <code>ATCRA</code> with the reply ID, because the reply is not always the request ID plus 8. This is untested.
* Replies from the 0x7xx modules are multi-frame for the identification strings, so the flow-control settings from the TPMS section probably apply there too. Untested.
* Do not send output-control commands (service <code>30</code> and similar) from a head-unit app while driving.

== Sources ==
* Owner PCAN-View captures of a Launch X431 CRP919 full health-check scan and rev counter sweep test, October 2026.
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* Labels on the TPMS controller and central gateway of the test car.

[[Category:Electrical - gen4]]

ECU diagnostic CAN addresses

2026-11-01T10:28:53Z

Mlines: /* 0x79A Combination switch (lighting and turn) */

<div style="border: 1px solid #c9a227; background-color: #fff8dc; padding: 0.6em 1em; margin: 0 0 1em 0; border-radius: 4px;">
'''Support this project:''' The information on this page is free, but it took a lot of work to gather, test and write up. If it has been useful to you, you can say thanks with a donation at [https://buymeacoffee.com/bigjimny buymeacoffee.com/bigjimny].
</div>

= Suzuki Jimny JB74 - CAN bus devices and the commands they answer =

'''Status:''' work in progress. This page lists every module that answered on the OBD socket (DLC) of one RHD UK-market 2021 Jimny, its request and reply CAN IDs, and the diagnostic commands seen so far. Many sections are short because only identification and fault-code requests have been captured. See [[OBD2 Diagnostics reading project]] for how the captures were made and for the TPMS data in detail.

== How to read this page ==
* All IDs are 11-bit CAN IDs on the OBD socket (pins 6 and 14, 500 kbit/s). The "request ID" is the header a tool sends to; the "reply ID" is where the module answers.
* Commands are shown as the payload bytes in hex, without the ISO-TP length byte. Replies longer than 7 bytes are sent as several frames; the tables show them reassembled.
* '''KWP-style''' modules use services such as <code>1A</code> (read ECU identification) and <code>18</code> (read DTCs by status). '''UDS-style''' modules use <code>22</code> (read data by identifier) and <code>19</code> (read DTCs).
* The reply ID is not always the request ID plus 8: the engine is +0x08, the 0x261 to 0x274 group is +0x400, and all others are +0x10.
* Identification strings are ASCII Suzuki part numbers. The first one in each module (<code>1A 8E</code> or <code>22 F1 01</code>) has no trailing character; the second (<code>1A 8A</code> or <code>22 F1 88</code>) ends in <code>*</code>. They do not always equal the number printed on the module's label.
* Commands marked ''captured'' were seen in a trace. Nothing here has been sent to a module by us except the TPMS requests.

== Device table ==
{| class="wikitable"
! Request ID !! Reply ID !! Style !! Module !! Identification reply (first / second) !! How the module was identified
|-
| [[#0x7E0 ECM|0x7E0]] || 0x7E8 || KWP || ECM || 33980-78R0 / 33980-78RC* || Standard engine address
|-
| [[#0x261 ABS (inferred)|0x261]] || 0x661 || KWP || ABS (inferred) || 56100-77RA / 56100-78RF* || Only brake module left by elimination
|-
| [[#0x263 EPS controller|0x263]] || 0x663 || KWP || EPS controller || 38720-77R0 / 38720-77R0* || Parts catalogue (38720-77R01)
|-
| [[#0x271 Body control module|0x271]] || 0x671 || KWP || Body control module || 36775-77R0 / 36775-77RC* || Parts catalogue (36775-77RC2 to RC4)
|-
| [[#0x274 Instrument cluster|0x274]] || 0x674 || KWP || Instrument cluster || 34100-78R0 / 34110-78RD* || Rev counter sweep test
|-
| [[#0x798 TPMS controller|0x798]] || 0x7A8 || KWP || TPMS controller || 37160-61M0 / 37120-78R0* || Label (Model No. P61M0) and parts catalogue
|-
| [[#0x79A Combination switch (lighting and turn)|0x79A]] || 0x7AA || KWP || Combination switch (lighting and turn) || 37210-74PA / 37210-74PE* || Parts catalogue (37210-74PE2)
|-
| [[#0x778 Dual sensor brake support (inferred)|0x778]] || 0x788 || KWP || Dual sensor brake support (inferred) || 33990-52R0 / 33990-78R8* || By elimination
|-
| [[#0x793 Airbag (SRS) controller|0x793]] || 0x7A3 || UDS || Airbag (SRS) controller || 38910-77R0 / 38910-78RC* || Parts catalogue (38910-78RC0)
|-
| [[#0x772 4WD shift controller|0x772]] || 0x782 || UDS || 4WD shift controller || 38885-77R0 / 38885-78R0* || Parts catalogue (38885-78R01)
|-
| [[#0x799 E-call controller|0x799]] || 0x7A9 || UDS || E-call controller || 38960-78RA / 38960-78RA* || Parts catalogue (38960-78RA0, RA1)
|-
| [[#0x751 Central gateway|0x751]] || 0x761 || UDS || Central gateway || 33580-79R0 / 33580-78R0* || Label (33580-79R01) and parts catalogue
|}

Two more addresses, [[#Addresses probed with no reply|0x273 and 0x262]], were probed by the scan tool and did not answer.

The names marked "inferred" are guesses from elimination and part-number series, not confirmed by a label or test.

== 0x7E0 ECM ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x7E0</code>, reply <code>0x7E8</code>. This is the standard OBD engine address, so standard mode 01 PIDs should be available here, but none were captured.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33980-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33980-78RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || Read DTCs by status: none stored (captured)
|}

== 0x261 ABS (inferred) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x261</code>, reply <code>0x661</code>. The name is inferred: this is the only brake module left in the scan report after the others were matched, and 56100 looks like a brake part-number series. Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>56100-77RA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>56100-78RF*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x263 EPS controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x263</code>, reply <code>0x663</code>. Matches parts catalogue entry 38720-77R01 (EPS controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>38720-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>38720-77R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x271 Body control module ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x271</code>, reply <code>0x671</code>. Matches parts catalogue entries 36775-77RC2 to RC4 (body control module, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>36775-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>36775-77RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x274 Instrument cluster ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x274</code>, reply <code>0x674</code>. Confirmed by the rev counter sweep test.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> or <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s during the sweep test (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>34100-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>34110-78RD*</code> (last byte of the reply is <code>06</code>) || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the rev counter sweep (service 0x30, local ID 01, "short-term adjustment"). The cluster then sweeps up and down by itself (captured)
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"). Possibly a stop request sent after the sweep had finished (captured)
|}
The meaning of the four control bytes (<code>80 40 00 00</code>) is not known. Other output tests (gauges, warning lights) have not been captured.

== 0x798 TPMS controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x798</code>, reply <code>0x7A8</code>. The label on the module reads 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0 (Continental A2C13930301, 433.92 MHz). The full data layout, calibration and app setups are on [[OBD2 Diagnostics reading project]].
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification; matches Model No. P61M0 on the label (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> (no codes) or <code>58 01 9A 31 20</code> (one code) || DTCs by status. The code <code>9A 31</code> is probably the left front low pressure warning (inferred). The status byte was <code>20</code> in the full scan and <code>E0</code> in earlier captures (captured)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block: four sensor records with ID, temperature-like value and pressure. The scan tool repeats it about twice a second (captured, decoded)
|}
ELM327 setup that works for <code>21 00</code>: <code>ATSH798</code>, <code>ATS0</code>, <code>ATL0</code>, <code>ATFCSH798</code>, <code>ATFCSD300000</code>, <code>ATFCSM1</code>, then <code>2100</code>.

== 0x79A Combination switch (lighting and turn) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x79A</code>, reply <code>0x7AA</code>. Matches parts catalogue entry 37210-74PE2 (switch assembly, lighting and turn, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37210-74PA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37210-74PE*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x778 Dual sensor brake support (inferred) ==
Request <code>0x778</code>, reply <code>0x788</code>. The name is inferred by elimination (the scan report's last unassigned module). Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33990-52R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33990-78R8*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x793 Airbag (SRS) controller ==
Request <code>0x793</code>, reply <code>0x7A3</code>. Matches parts catalogue entry 38910-78RC0 (airbag controller, VAN).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38910-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38910-78RC*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}

== 0x772 4WD shift controller ==
Request <code>0x772</code>, reply <code>0x782</code>. Matches parts catalogue entry 38885-78R01 (4WD shift controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times by the scan tool (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38885-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38885-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The scan tool tried the KWP-style <code>3E</code> first and fell back to the UDS form <code>3E 00</code>.

== 0x799 E-call controller ==
Request <code>0x799</code>, reply <code>0x7A9</code>. Matches parts catalogue entries 38960-78RA0 and RA1 (E-call controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38960-78RA</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38960-78RA*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B 92 4E 00 02</code> || One stored code record: <code>92 4E 00</code>, status <code>02</code>. The Launch report does not list it and its meaning is not known (captured)
|}

== 0x751 Central gateway ==
Request <code>0x751</code>, reply <code>0x761</code>. The label on the module reads 33580-79R01.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>33580-79R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>33580-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The gateway sits between the OBD socket and the vehicle CAN bus. Whether it forwards requests to the other modules unchanged is not confirmed.

== Addresses probed with no reply ==
The scan tool sent tester-present (<code>3E</code>) about eight times each to <code>0x273</code> and <code>0x262</code> and received nothing from the expected reply IDs (<code>0x673</code> and <code>0x662</code>). They are probably modules this car does not have, such as an automatic transmission or auto-levelling controller. This is a guess.

== ELM327 notes ==
* Only <code>0x798</code> has been tested with an ELM327. For other modules, set <code>ATSH</code> to the request ID and <code>ATFCSH</code> to the same ID, and you may need <code>ATCRA</code> with the reply ID, because the reply is not always the request ID plus 8. This is untested.
* Replies from the 0x7xx modules are multi-frame for the identification strings, so the flow-control settings from the TPMS section probably apply there too. Untested.
* Do not send output-control commands (service <code>30</code> and similar) from a head-unit app while driving.

== Sources ==
* Owner PCAN-View captures of a Launch X431 CRP919 full health-check scan and rev counter sweep test, October 2026.
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* Labels on the TPMS controller and central gateway of the test car.

[[Category:Electrical - gen4]]

ECU diagnostic CAN addresses

2026-11-01T10:28:28Z

Mlines: /* 0x798 TPMS controller */

<div style="border: 1px solid #c9a227; background-color: #fff8dc; padding: 0.6em 1em; margin: 0 0 1em 0; border-radius: 4px;">
'''Support this project:''' The information on this page is free, but it took a lot of work to gather, test and write up. If it has been useful to you, you can say thanks with a donation at [https://buymeacoffee.com/bigjimny buymeacoffee.com/bigjimny].
</div>

= Suzuki Jimny JB74 - CAN bus devices and the commands they answer =

'''Status:''' work in progress. This page lists every module that answered on the OBD socket (DLC) of one RHD UK-market 2021 Jimny, its request and reply CAN IDs, and the diagnostic commands seen so far. Many sections are short because only identification and fault-code requests have been captured. See [[OBD2 Diagnostics reading project]] for how the captures were made and for the TPMS data in detail.

== How to read this page ==
* All IDs are 11-bit CAN IDs on the OBD socket (pins 6 and 14, 500 kbit/s). The "request ID" is the header a tool sends to; the "reply ID" is where the module answers.
* Commands are shown as the payload bytes in hex, without the ISO-TP length byte. Replies longer than 7 bytes are sent as several frames; the tables show them reassembled.
* '''KWP-style''' modules use services such as <code>1A</code> (read ECU identification) and <code>18</code> (read DTCs by status). '''UDS-style''' modules use <code>22</code> (read data by identifier) and <code>19</code> (read DTCs).
* The reply ID is not always the request ID plus 8: the engine is +0x08, the 0x261 to 0x274 group is +0x400, and all others are +0x10.
* Identification strings are ASCII Suzuki part numbers. The first one in each module (<code>1A 8E</code> or <code>22 F1 01</code>) has no trailing character; the second (<code>1A 8A</code> or <code>22 F1 88</code>) ends in <code>*</code>. They do not always equal the number printed on the module's label.
* Commands marked ''captured'' were seen in a trace. Nothing here has been sent to a module by us except the TPMS requests.

== Device table ==
{| class="wikitable"
! Request ID !! Reply ID !! Style !! Module !! Identification reply (first / second) !! How the module was identified
|-
| [[#0x7E0 ECM|0x7E0]] || 0x7E8 || KWP || ECM || 33980-78R0 / 33980-78RC* || Standard engine address
|-
| [[#0x261 ABS (inferred)|0x261]] || 0x661 || KWP || ABS (inferred) || 56100-77RA / 56100-78RF* || Only brake module left by elimination
|-
| [[#0x263 EPS controller|0x263]] || 0x663 || KWP || EPS controller || 38720-77R0 / 38720-77R0* || Parts catalogue (38720-77R01)
|-
| [[#0x271 Body control module|0x271]] || 0x671 || KWP || Body control module || 36775-77R0 / 36775-77RC* || Parts catalogue (36775-77RC2 to RC4)
|-
| [[#0x274 Instrument cluster|0x274]] || 0x674 || KWP || Instrument cluster || 34100-78R0 / 34110-78RD* || Rev counter sweep test
|-
| [[#0x798 TPMS controller|0x798]] || 0x7A8 || KWP || TPMS controller || 37160-61M0 / 37120-78R0* || Label (Model No. P61M0) and parts catalogue
|-
| [[#0x79A Combination switch (lighting and turn)|0x79A]] || 0x7AA || KWP || Combination switch (lighting and turn) || 37210-74PA / 37210-74PE* || Parts catalogue (37210-74PE2)
|-
| [[#0x778 Dual sensor brake support (inferred)|0x778]] || 0x788 || KWP || Dual sensor brake support (inferred) || 33990-52R0 / 33990-78R8* || By elimination
|-
| [[#0x793 Airbag (SRS) controller|0x793]] || 0x7A3 || UDS || Airbag (SRS) controller || 38910-77R0 / 38910-78RC* || Parts catalogue (38910-78RC0)
|-
| [[#0x772 4WD shift controller|0x772]] || 0x782 || UDS || 4WD shift controller || 38885-77R0 / 38885-78R0* || Parts catalogue (38885-78R01)
|-
| [[#0x799 E-call controller|0x799]] || 0x7A9 || UDS || E-call controller || 38960-78RA / 38960-78RA* || Parts catalogue (38960-78RA0, RA1)
|-
| [[#0x751 Central gateway|0x751]] || 0x761 || UDS || Central gateway || 33580-79R0 / 33580-78R0* || Label (33580-79R01) and parts catalogue
|}

Two more addresses, [[#Addresses probed with no reply|0x273 and 0x262]], were probed by the scan tool and did not answer.

The names marked "inferred" are guesses from elimination and part-number series, not confirmed by a label or test.

== 0x7E0 ECM ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x7E0</code>, reply <code>0x7E8</code>. This is the standard OBD engine address, so standard mode 01 PIDs should be available here, but none were captured.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33980-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33980-78RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || Read DTCs by status: none stored (captured)
|}

== 0x261 ABS (inferred) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x261</code>, reply <code>0x661</code>. The name is inferred: this is the only brake module left in the scan report after the others were matched, and 56100 looks like a brake part-number series. Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>56100-77RA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>56100-78RF*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x263 EPS controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x263</code>, reply <code>0x663</code>. Matches parts catalogue entry 38720-77R01 (EPS controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>38720-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>38720-77R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x271 Body control module ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x271</code>, reply <code>0x671</code>. Matches parts catalogue entries 36775-77RC2 to RC4 (body control module, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>36775-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>36775-77RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x274 Instrument cluster ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x274</code>, reply <code>0x674</code>. Confirmed by the rev counter sweep test.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> or <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s during the sweep test (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>34100-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>34110-78RD*</code> (last byte of the reply is <code>06</code>) || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the rev counter sweep (service 0x30, local ID 01, "short-term adjustment"). The cluster then sweeps up and down by itself (captured)
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"). Possibly a stop request sent after the sweep had finished (captured)
|}
The meaning of the four control bytes (<code>80 40 00 00</code>) is not known. Other output tests (gauges, warning lights) have not been captured.

== 0x798 TPMS controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x798</code>, reply <code>0x7A8</code>. The label on the module reads 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0 (Continental A2C13930301, 433.92 MHz). The full data layout, calibration and app setups are on [[OBD2 Diagnostics reading project]].
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification; matches Model No. P61M0 on the label (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> (no codes) or <code>58 01 9A 31 20</code> (one code) || DTCs by status. The code <code>9A 31</code> is probably the left front low pressure warning (inferred). The status byte was <code>20</code> in the full scan and <code>E0</code> in earlier captures (captured)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block: four sensor records with ID, temperature-like value and pressure. The scan tool repeats it about twice a second (captured, decoded)
|}
ELM327 setup that works for <code>21 00</code>: <code>ATSH798</code>, <code>ATS0</code>, <code>ATL0</code>, <code>ATFCSH798</code>, <code>ATFCSD300000</code>, <code>ATFCSM1</code>, then <code>2100</code>.

== 0x79A Combination switch (lighting and turn) ==
Request <code>0x79A</code>, reply <code>0x7AA</code>. Matches parts catalogue entry 37210-74PE2 (switch assembly, lighting and turn, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37210-74PA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37210-74PE*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x778 Dual sensor brake support (inferred) ==
Request <code>0x778</code>, reply <code>0x788</code>. The name is inferred by elimination (the scan report's last unassigned module). Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33990-52R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33990-78R8*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x793 Airbag (SRS) controller ==
Request <code>0x793</code>, reply <code>0x7A3</code>. Matches parts catalogue entry 38910-78RC0 (airbag controller, VAN).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38910-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38910-78RC*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}

== 0x772 4WD shift controller ==
Request <code>0x772</code>, reply <code>0x782</code>. Matches parts catalogue entry 38885-78R01 (4WD shift controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times by the scan tool (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38885-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38885-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The scan tool tried the KWP-style <code>3E</code> first and fell back to the UDS form <code>3E 00</code>.

== 0x799 E-call controller ==
Request <code>0x799</code>, reply <code>0x7A9</code>. Matches parts catalogue entries 38960-78RA0 and RA1 (E-call controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38960-78RA</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38960-78RA*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B 92 4E 00 02</code> || One stored code record: <code>92 4E 00</code>, status <code>02</code>. The Launch report does not list it and its meaning is not known (captured)
|}

== 0x751 Central gateway ==
Request <code>0x751</code>, reply <code>0x761</code>. The label on the module reads 33580-79R01.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>33580-79R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>33580-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The gateway sits between the OBD socket and the vehicle CAN bus. Whether it forwards requests to the other modules unchanged is not confirmed.

== Addresses probed with no reply ==
The scan tool sent tester-present (<code>3E</code>) about eight times each to <code>0x273</code> and <code>0x262</code> and received nothing from the expected reply IDs (<code>0x673</code> and <code>0x662</code>). They are probably modules this car does not have, such as an automatic transmission or auto-levelling controller. This is a guess.

== ELM327 notes ==
* Only <code>0x798</code> has been tested with an ELM327. For other modules, set <code>ATSH</code> to the request ID and <code>ATFCSH</code> to the same ID, and you may need <code>ATCRA</code> with the reply ID, because the reply is not always the request ID plus 8. This is untested.
* Replies from the 0x7xx modules are multi-frame for the identification strings, so the flow-control settings from the TPMS section probably apply there too. Untested.
* Do not send output-control commands (service <code>30</code> and similar) from a head-unit app while driving.

== Sources ==
* Owner PCAN-View captures of a Launch X431 CRP919 full health-check scan and rev counter sweep test, October 2026.
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* Labels on the TPMS controller and central gateway of the test car.

[[Category:Electrical - gen4]]

ECU diagnostic CAN addresses

2026-11-01T10:28:13Z

Mlines: /* 0x274 Instrument cluster */

<div style="border: 1px solid #c9a227; background-color: #fff8dc; padding: 0.6em 1em; margin: 0 0 1em 0; border-radius: 4px;">
'''Support this project:''' The information on this page is free, but it took a lot of work to gather, test and write up. If it has been useful to you, you can say thanks with a donation at [https://buymeacoffee.com/bigjimny buymeacoffee.com/bigjimny].
</div>

= Suzuki Jimny JB74 - CAN bus devices and the commands they answer =

'''Status:''' work in progress. This page lists every module that answered on the OBD socket (DLC) of one RHD UK-market 2021 Jimny, its request and reply CAN IDs, and the diagnostic commands seen so far. Many sections are short because only identification and fault-code requests have been captured. See [[OBD2 Diagnostics reading project]] for how the captures were made and for the TPMS data in detail.

== How to read this page ==
* All IDs are 11-bit CAN IDs on the OBD socket (pins 6 and 14, 500 kbit/s). The "request ID" is the header a tool sends to; the "reply ID" is where the module answers.
* Commands are shown as the payload bytes in hex, without the ISO-TP length byte. Replies longer than 7 bytes are sent as several frames; the tables show them reassembled.
* '''KWP-style''' modules use services such as <code>1A</code> (read ECU identification) and <code>18</code> (read DTCs by status). '''UDS-style''' modules use <code>22</code> (read data by identifier) and <code>19</code> (read DTCs).
* The reply ID is not always the request ID plus 8: the engine is +0x08, the 0x261 to 0x274 group is +0x400, and all others are +0x10.
* Identification strings are ASCII Suzuki part numbers. The first one in each module (<code>1A 8E</code> or <code>22 F1 01</code>) has no trailing character; the second (<code>1A 8A</code> or <code>22 F1 88</code>) ends in <code>*</code>. They do not always equal the number printed on the module's label.
* Commands marked ''captured'' were seen in a trace. Nothing here has been sent to a module by us except the TPMS requests.

== Device table ==
{| class="wikitable"
! Request ID !! Reply ID !! Style !! Module !! Identification reply (first / second) !! How the module was identified
|-
| [[#0x7E0 ECM|0x7E0]] || 0x7E8 || KWP || ECM || 33980-78R0 / 33980-78RC* || Standard engine address
|-
| [[#0x261 ABS (inferred)|0x261]] || 0x661 || KWP || ABS (inferred) || 56100-77RA / 56100-78RF* || Only brake module left by elimination
|-
| [[#0x263 EPS controller|0x263]] || 0x663 || KWP || EPS controller || 38720-77R0 / 38720-77R0* || Parts catalogue (38720-77R01)
|-
| [[#0x271 Body control module|0x271]] || 0x671 || KWP || Body control module || 36775-77R0 / 36775-77RC* || Parts catalogue (36775-77RC2 to RC4)
|-
| [[#0x274 Instrument cluster|0x274]] || 0x674 || KWP || Instrument cluster || 34100-78R0 / 34110-78RD* || Rev counter sweep test
|-
| [[#0x798 TPMS controller|0x798]] || 0x7A8 || KWP || TPMS controller || 37160-61M0 / 37120-78R0* || Label (Model No. P61M0) and parts catalogue
|-
| [[#0x79A Combination switch (lighting and turn)|0x79A]] || 0x7AA || KWP || Combination switch (lighting and turn) || 37210-74PA / 37210-74PE* || Parts catalogue (37210-74PE2)
|-
| [[#0x778 Dual sensor brake support (inferred)|0x778]] || 0x788 || KWP || Dual sensor brake support (inferred) || 33990-52R0 / 33990-78R8* || By elimination
|-
| [[#0x793 Airbag (SRS) controller|0x793]] || 0x7A3 || UDS || Airbag (SRS) controller || 38910-77R0 / 38910-78RC* || Parts catalogue (38910-78RC0)
|-
| [[#0x772 4WD shift controller|0x772]] || 0x782 || UDS || 4WD shift controller || 38885-77R0 / 38885-78R0* || Parts catalogue (38885-78R01)
|-
| [[#0x799 E-call controller|0x799]] || 0x7A9 || UDS || E-call controller || 38960-78RA / 38960-78RA* || Parts catalogue (38960-78RA0, RA1)
|-
| [[#0x751 Central gateway|0x751]] || 0x761 || UDS || Central gateway || 33580-79R0 / 33580-78R0* || Label (33580-79R01) and parts catalogue
|}

Two more addresses, [[#Addresses probed with no reply|0x273 and 0x262]], were probed by the scan tool and did not answer.

The names marked "inferred" are guesses from elimination and part-number series, not confirmed by a label or test.

== 0x7E0 ECM ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x7E0</code>, reply <code>0x7E8</code>. This is the standard OBD engine address, so standard mode 01 PIDs should be available here, but none were captured.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33980-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33980-78RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || Read DTCs by status: none stored (captured)
|}

== 0x261 ABS (inferred) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x261</code>, reply <code>0x661</code>. The name is inferred: this is the only brake module left in the scan report after the others were matched, and 56100 looks like a brake part-number series. Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>56100-77RA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>56100-78RF*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x263 EPS controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x263</code>, reply <code>0x663</code>. Matches parts catalogue entry 38720-77R01 (EPS controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>38720-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>38720-77R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x271 Body control module ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x271</code>, reply <code>0x671</code>. Matches parts catalogue entries 36775-77RC2 to RC4 (body control module, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>36775-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>36775-77RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x274 Instrument cluster ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x274</code>, reply <code>0x674</code>. Confirmed by the rev counter sweep test.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> or <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s during the sweep test (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>34100-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>34110-78RD*</code> (last byte of the reply is <code>06</code>) || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the rev counter sweep (service 0x30, local ID 01, "short-term adjustment"). The cluster then sweeps up and down by itself (captured)
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"). Possibly a stop request sent after the sweep had finished (captured)
|}
The meaning of the four control bytes (<code>80 40 00 00</code>) is not known. Other output tests (gauges, warning lights) have not been captured.

== 0x798 TPMS controller ==
Request <code>0x798</code>, reply <code>0x7A8</code>. The label on the module reads 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0 (Continental A2C13930301, 433.92 MHz). The full data layout, calibration and app setups are on [[OBD2 Diagnostics reading project]].
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification; matches Model No. P61M0 on the label (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> (no codes) or <code>58 01 9A 31 20</code> (one code) || DTCs by status. The code <code>9A 31</code> is probably the left front low pressure warning (inferred). The status byte was <code>20</code> in the full scan and <code>E0</code> in earlier captures (captured)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block: four sensor records with ID, temperature-like value and pressure. The scan tool repeats it about twice a second (captured, decoded)
|}
ELM327 setup that works for <code>21 00</code>: <code>ATSH798</code>, <code>ATS0</code>, <code>ATL0</code>, <code>ATFCSH798</code>, <code>ATFCSD300000</code>, <code>ATFCSM1</code>, then <code>2100</code>.

== 0x79A Combination switch (lighting and turn) ==
Request <code>0x79A</code>, reply <code>0x7AA</code>. Matches parts catalogue entry 37210-74PE2 (switch assembly, lighting and turn, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37210-74PA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37210-74PE*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x778 Dual sensor brake support (inferred) ==
Request <code>0x778</code>, reply <code>0x788</code>. The name is inferred by elimination (the scan report's last unassigned module). Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33990-52R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33990-78R8*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x793 Airbag (SRS) controller ==
Request <code>0x793</code>, reply <code>0x7A3</code>. Matches parts catalogue entry 38910-78RC0 (airbag controller, VAN).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38910-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38910-78RC*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}

== 0x772 4WD shift controller ==
Request <code>0x772</code>, reply <code>0x782</code>. Matches parts catalogue entry 38885-78R01 (4WD shift controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times by the scan tool (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38885-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38885-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The scan tool tried the KWP-style <code>3E</code> first and fell back to the UDS form <code>3E 00</code>.

== 0x799 E-call controller ==
Request <code>0x799</code>, reply <code>0x7A9</code>. Matches parts catalogue entries 38960-78RA0 and RA1 (E-call controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38960-78RA</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38960-78RA*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B 92 4E 00 02</code> || One stored code record: <code>92 4E 00</code>, status <code>02</code>. The Launch report does not list it and its meaning is not known (captured)
|}

== 0x751 Central gateway ==
Request <code>0x751</code>, reply <code>0x761</code>. The label on the module reads 33580-79R01.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>33580-79R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>33580-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The gateway sits between the OBD socket and the vehicle CAN bus. Whether it forwards requests to the other modules unchanged is not confirmed.

== Addresses probed with no reply ==
The scan tool sent tester-present (<code>3E</code>) about eight times each to <code>0x273</code> and <code>0x262</code> and received nothing from the expected reply IDs (<code>0x673</code> and <code>0x662</code>). They are probably modules this car does not have, such as an automatic transmission or auto-levelling controller. This is a guess.

== ELM327 notes ==
* Only <code>0x798</code> has been tested with an ELM327. For other modules, set <code>ATSH</code> to the request ID and <code>ATFCSH</code> to the same ID, and you may need <code>ATCRA</code> with the reply ID, because the reply is not always the request ID plus 8. This is untested.
* Replies from the 0x7xx modules are multi-frame for the identification strings, so the flow-control settings from the TPMS section probably apply there too. Untested.
* Do not send output-control commands (service <code>30</code> and similar) from a head-unit app while driving.

== Sources ==
* Owner PCAN-View captures of a Launch X431 CRP919 full health-check scan and rev counter sweep test, October 2026.
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* Labels on the TPMS controller and central gateway of the test car.

[[Category:Electrical - gen4]]

ECU diagnostic CAN addresses

2026-11-01T10:27:55Z

Mlines: /* 0x271 Body control module */

<div style="border: 1px solid #c9a227; background-color: #fff8dc; padding: 0.6em 1em; margin: 0 0 1em 0; border-radius: 4px;">
'''Support this project:''' The information on this page is free, but it took a lot of work to gather, test and write up. If it has been useful to you, you can say thanks with a donation at [https://buymeacoffee.com/bigjimny buymeacoffee.com/bigjimny].
</div>

= Suzuki Jimny JB74 - CAN bus devices and the commands they answer =

'''Status:''' work in progress. This page lists every module that answered on the OBD socket (DLC) of one RHD UK-market 2021 Jimny, its request and reply CAN IDs, and the diagnostic commands seen so far. Many sections are short because only identification and fault-code requests have been captured. See [[OBD2 Diagnostics reading project]] for how the captures were made and for the TPMS data in detail.

== How to read this page ==
* All IDs are 11-bit CAN IDs on the OBD socket (pins 6 and 14, 500 kbit/s). The "request ID" is the header a tool sends to; the "reply ID" is where the module answers.
* Commands are shown as the payload bytes in hex, without the ISO-TP length byte. Replies longer than 7 bytes are sent as several frames; the tables show them reassembled.
* '''KWP-style''' modules use services such as <code>1A</code> (read ECU identification) and <code>18</code> (read DTCs by status). '''UDS-style''' modules use <code>22</code> (read data by identifier) and <code>19</code> (read DTCs).
* The reply ID is not always the request ID plus 8: the engine is +0x08, the 0x261 to 0x274 group is +0x400, and all others are +0x10.
* Identification strings are ASCII Suzuki part numbers. The first one in each module (<code>1A 8E</code> or <code>22 F1 01</code>) has no trailing character; the second (<code>1A 8A</code> or <code>22 F1 88</code>) ends in <code>*</code>. They do not always equal the number printed on the module's label.
* Commands marked ''captured'' were seen in a trace. Nothing here has been sent to a module by us except the TPMS requests.

== Device table ==
{| class="wikitable"
! Request ID !! Reply ID !! Style !! Module !! Identification reply (first / second) !! How the module was identified
|-
| [[#0x7E0 ECM|0x7E0]] || 0x7E8 || KWP || ECM || 33980-78R0 / 33980-78RC* || Standard engine address
|-
| [[#0x261 ABS (inferred)|0x261]] || 0x661 || KWP || ABS (inferred) || 56100-77RA / 56100-78RF* || Only brake module left by elimination
|-
| [[#0x263 EPS controller|0x263]] || 0x663 || KWP || EPS controller || 38720-77R0 / 38720-77R0* || Parts catalogue (38720-77R01)
|-
| [[#0x271 Body control module|0x271]] || 0x671 || KWP || Body control module || 36775-77R0 / 36775-77RC* || Parts catalogue (36775-77RC2 to RC4)
|-
| [[#0x274 Instrument cluster|0x274]] || 0x674 || KWP || Instrument cluster || 34100-78R0 / 34110-78RD* || Rev counter sweep test
|-
| [[#0x798 TPMS controller|0x798]] || 0x7A8 || KWP || TPMS controller || 37160-61M0 / 37120-78R0* || Label (Model No. P61M0) and parts catalogue
|-
| [[#0x79A Combination switch (lighting and turn)|0x79A]] || 0x7AA || KWP || Combination switch (lighting and turn) || 37210-74PA / 37210-74PE* || Parts catalogue (37210-74PE2)
|-
| [[#0x778 Dual sensor brake support (inferred)|0x778]] || 0x788 || KWP || Dual sensor brake support (inferred) || 33990-52R0 / 33990-78R8* || By elimination
|-
| [[#0x793 Airbag (SRS) controller|0x793]] || 0x7A3 || UDS || Airbag (SRS) controller || 38910-77R0 / 38910-78RC* || Parts catalogue (38910-78RC0)
|-
| [[#0x772 4WD shift controller|0x772]] || 0x782 || UDS || 4WD shift controller || 38885-77R0 / 38885-78R0* || Parts catalogue (38885-78R01)
|-
| [[#0x799 E-call controller|0x799]] || 0x7A9 || UDS || E-call controller || 38960-78RA / 38960-78RA* || Parts catalogue (38960-78RA0, RA1)
|-
| [[#0x751 Central gateway|0x751]] || 0x761 || UDS || Central gateway || 33580-79R0 / 33580-78R0* || Label (33580-79R01) and parts catalogue
|}

Two more addresses, [[#Addresses probed with no reply|0x273 and 0x262]], were probed by the scan tool and did not answer.

The names marked "inferred" are guesses from elimination and part-number series, not confirmed by a label or test.

== 0x7E0 ECM ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x7E0</code>, reply <code>0x7E8</code>. This is the standard OBD engine address, so standard mode 01 PIDs should be available here, but none were captured.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33980-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33980-78RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || Read DTCs by status: none stored (captured)
|}

== 0x261 ABS (inferred) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x261</code>, reply <code>0x661</code>. The name is inferred: this is the only brake module left in the scan report after the others were matched, and 56100 looks like a brake part-number series. Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>56100-77RA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>56100-78RF*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x263 EPS controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x263</code>, reply <code>0x663</code>. Matches parts catalogue entry 38720-77R01 (EPS controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>38720-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>38720-77R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x271 Body control module ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x271</code>, reply <code>0x671</code>. Matches parts catalogue entries 36775-77RC2 to RC4 (body control module, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>36775-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>36775-77RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x274 Instrument cluster ==
Request <code>0x274</code>, reply <code>0x674</code>. Confirmed by the rev counter sweep test.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> or <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s during the sweep test (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>34100-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>34110-78RD*</code> (last byte of the reply is <code>06</code>) || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the rev counter sweep (service 0x30, local ID 01, "short-term adjustment"). The cluster then sweeps up and down by itself (captured)
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"). Possibly a stop request sent after the sweep had finished (captured)
|}
The meaning of the four control bytes (<code>80 40 00 00</code>) is not known. Other output tests (gauges, warning lights) have not been captured.

== 0x798 TPMS controller ==
Request <code>0x798</code>, reply <code>0x7A8</code>. The label on the module reads 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0 (Continental A2C13930301, 433.92 MHz). The full data layout, calibration and app setups are on [[OBD2 Diagnostics reading project]].
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification; matches Model No. P61M0 on the label (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> (no codes) or <code>58 01 9A 31 20</code> (one code) || DTCs by status. The code <code>9A 31</code> is probably the left front low pressure warning (inferred). The status byte was <code>20</code> in the full scan and <code>E0</code> in earlier captures (captured)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block: four sensor records with ID, temperature-like value and pressure. The scan tool repeats it about twice a second (captured, decoded)
|}
ELM327 setup that works for <code>21 00</code>: <code>ATSH798</code>, <code>ATS0</code>, <code>ATL0</code>, <code>ATFCSH798</code>, <code>ATFCSD300000</code>, <code>ATFCSM1</code>, then <code>2100</code>.

== 0x79A Combination switch (lighting and turn) ==
Request <code>0x79A</code>, reply <code>0x7AA</code>. Matches parts catalogue entry 37210-74PE2 (switch assembly, lighting and turn, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37210-74PA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37210-74PE*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x778 Dual sensor brake support (inferred) ==
Request <code>0x778</code>, reply <code>0x788</code>. The name is inferred by elimination (the scan report's last unassigned module). Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33990-52R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33990-78R8*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x793 Airbag (SRS) controller ==
Request <code>0x793</code>, reply <code>0x7A3</code>. Matches parts catalogue entry 38910-78RC0 (airbag controller, VAN).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38910-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38910-78RC*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}

== 0x772 4WD shift controller ==
Request <code>0x772</code>, reply <code>0x782</code>. Matches parts catalogue entry 38885-78R01 (4WD shift controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times by the scan tool (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38885-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38885-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The scan tool tried the KWP-style <code>3E</code> first and fell back to the UDS form <code>3E 00</code>.

== 0x799 E-call controller ==
Request <code>0x799</code>, reply <code>0x7A9</code>. Matches parts catalogue entries 38960-78RA0 and RA1 (E-call controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38960-78RA</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38960-78RA*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B 92 4E 00 02</code> || One stored code record: <code>92 4E 00</code>, status <code>02</code>. The Launch report does not list it and its meaning is not known (captured)
|}

== 0x751 Central gateway ==
Request <code>0x751</code>, reply <code>0x761</code>. The label on the module reads 33580-79R01.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>33580-79R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>33580-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The gateway sits between the OBD socket and the vehicle CAN bus. Whether it forwards requests to the other modules unchanged is not confirmed.

== Addresses probed with no reply ==
The scan tool sent tester-present (<code>3E</code>) about eight times each to <code>0x273</code> and <code>0x262</code> and received nothing from the expected reply IDs (<code>0x673</code> and <code>0x662</code>). They are probably modules this car does not have, such as an automatic transmission or auto-levelling controller. This is a guess.

== ELM327 notes ==
* Only <code>0x798</code> has been tested with an ELM327. For other modules, set <code>ATSH</code> to the request ID and <code>ATFCSH</code> to the same ID, and you may need <code>ATCRA</code> with the reply ID, because the reply is not always the request ID plus 8. This is untested.
* Replies from the 0x7xx modules are multi-frame for the identification strings, so the flow-control settings from the TPMS section probably apply there too. Untested.
* Do not send output-control commands (service <code>30</code> and similar) from a head-unit app while driving.

== Sources ==
* Owner PCAN-View captures of a Launch X431 CRP919 full health-check scan and rev counter sweep test, October 2026.
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* Labels on the TPMS controller and central gateway of the test car.

[[Category:Electrical - gen4]]

ECU diagnostic CAN addresses

2026-11-01T10:27:13Z

Mlines: /* 0x263 EPS controller */

<div style="border: 1px solid #c9a227; background-color: #fff8dc; padding: 0.6em 1em; margin: 0 0 1em 0; border-radius: 4px;">
'''Support this project:''' The information on this page is free, but it took a lot of work to gather, test and write up. If it has been useful to you, you can say thanks with a donation at [https://buymeacoffee.com/bigjimny buymeacoffee.com/bigjimny].
</div>

= Suzuki Jimny JB74 - CAN bus devices and the commands they answer =

'''Status:''' work in progress. This page lists every module that answered on the OBD socket (DLC) of one RHD UK-market 2021 Jimny, its request and reply CAN IDs, and the diagnostic commands seen so far. Many sections are short because only identification and fault-code requests have been captured. See [[OBD2 Diagnostics reading project]] for how the captures were made and for the TPMS data in detail.

== How to read this page ==
* All IDs are 11-bit CAN IDs on the OBD socket (pins 6 and 14, 500 kbit/s). The "request ID" is the header a tool sends to; the "reply ID" is where the module answers.
* Commands are shown as the payload bytes in hex, without the ISO-TP length byte. Replies longer than 7 bytes are sent as several frames; the tables show them reassembled.
* '''KWP-style''' modules use services such as <code>1A</code> (read ECU identification) and <code>18</code> (read DTCs by status). '''UDS-style''' modules use <code>22</code> (read data by identifier) and <code>19</code> (read DTCs).
* The reply ID is not always the request ID plus 8: the engine is +0x08, the 0x261 to 0x274 group is +0x400, and all others are +0x10.
* Identification strings are ASCII Suzuki part numbers. The first one in each module (<code>1A 8E</code> or <code>22 F1 01</code>) has no trailing character; the second (<code>1A 8A</code> or <code>22 F1 88</code>) ends in <code>*</code>. They do not always equal the number printed on the module's label.
* Commands marked ''captured'' were seen in a trace. Nothing here has been sent to a module by us except the TPMS requests.

== Device table ==
{| class="wikitable"
! Request ID !! Reply ID !! Style !! Module !! Identification reply (first / second) !! How the module was identified
|-
| [[#0x7E0 ECM|0x7E0]] || 0x7E8 || KWP || ECM || 33980-78R0 / 33980-78RC* || Standard engine address
|-
| [[#0x261 ABS (inferred)|0x261]] || 0x661 || KWP || ABS (inferred) || 56100-77RA / 56100-78RF* || Only brake module left by elimination
|-
| [[#0x263 EPS controller|0x263]] || 0x663 || KWP || EPS controller || 38720-77R0 / 38720-77R0* || Parts catalogue (38720-77R01)
|-
| [[#0x271 Body control module|0x271]] || 0x671 || KWP || Body control module || 36775-77R0 / 36775-77RC* || Parts catalogue (36775-77RC2 to RC4)
|-
| [[#0x274 Instrument cluster|0x274]] || 0x674 || KWP || Instrument cluster || 34100-78R0 / 34110-78RD* || Rev counter sweep test
|-
| [[#0x798 TPMS controller|0x798]] || 0x7A8 || KWP || TPMS controller || 37160-61M0 / 37120-78R0* || Label (Model No. P61M0) and parts catalogue
|-
| [[#0x79A Combination switch (lighting and turn)|0x79A]] || 0x7AA || KWP || Combination switch (lighting and turn) || 37210-74PA / 37210-74PE* || Parts catalogue (37210-74PE2)
|-
| [[#0x778 Dual sensor brake support (inferred)|0x778]] || 0x788 || KWP || Dual sensor brake support (inferred) || 33990-52R0 / 33990-78R8* || By elimination
|-
| [[#0x793 Airbag (SRS) controller|0x793]] || 0x7A3 || UDS || Airbag (SRS) controller || 38910-77R0 / 38910-78RC* || Parts catalogue (38910-78RC0)
|-
| [[#0x772 4WD shift controller|0x772]] || 0x782 || UDS || 4WD shift controller || 38885-77R0 / 38885-78R0* || Parts catalogue (38885-78R01)
|-
| [[#0x799 E-call controller|0x799]] || 0x7A9 || UDS || E-call controller || 38960-78RA / 38960-78RA* || Parts catalogue (38960-78RA0, RA1)
|-
| [[#0x751 Central gateway|0x751]] || 0x761 || UDS || Central gateway || 33580-79R0 / 33580-78R0* || Label (33580-79R01) and parts catalogue
|}

Two more addresses, [[#Addresses probed with no reply|0x273 and 0x262]], were probed by the scan tool and did not answer.

The names marked "inferred" are guesses from elimination and part-number series, not confirmed by a label or test.

== 0x7E0 ECM ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x7E0</code>, reply <code>0x7E8</code>. This is the standard OBD engine address, so standard mode 01 PIDs should be available here, but none were captured.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33980-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33980-78RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || Read DTCs by status: none stored (captured)
|}

== 0x261 ABS (inferred) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x261</code>, reply <code>0x661</code>. The name is inferred: this is the only brake module left in the scan report after the others were matched, and 56100 looks like a brake part-number series. Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>56100-77RA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>56100-78RF*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x263 EPS controller ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x263</code>, reply <code>0x663</code>. Matches parts catalogue entry 38720-77R01 (EPS controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>38720-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>38720-77R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x271 Body control module ==
Request <code>0x271</code>, reply <code>0x671</code>. Matches parts catalogue entries 36775-77RC2 to RC4 (body control module, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>36775-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>36775-77RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x274 Instrument cluster ==
Request <code>0x274</code>, reply <code>0x674</code>. Confirmed by the rev counter sweep test.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> or <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s during the sweep test (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>34100-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>34110-78RD*</code> (last byte of the reply is <code>06</code>) || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the rev counter sweep (service 0x30, local ID 01, "short-term adjustment"). The cluster then sweeps up and down by itself (captured)
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"). Possibly a stop request sent after the sweep had finished (captured)
|}
The meaning of the four control bytes (<code>80 40 00 00</code>) is not known. Other output tests (gauges, warning lights) have not been captured.

== 0x798 TPMS controller ==
Request <code>0x798</code>, reply <code>0x7A8</code>. The label on the module reads 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0 (Continental A2C13930301, 433.92 MHz). The full data layout, calibration and app setups are on [[OBD2 Diagnostics reading project]].
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification; matches Model No. P61M0 on the label (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> (no codes) or <code>58 01 9A 31 20</code> (one code) || DTCs by status. The code <code>9A 31</code> is probably the left front low pressure warning (inferred). The status byte was <code>20</code> in the full scan and <code>E0</code> in earlier captures (captured)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block: four sensor records with ID, temperature-like value and pressure. The scan tool repeats it about twice a second (captured, decoded)
|}
ELM327 setup that works for <code>21 00</code>: <code>ATSH798</code>, <code>ATS0</code>, <code>ATL0</code>, <code>ATFCSH798</code>, <code>ATFCSD300000</code>, <code>ATFCSM1</code>, then <code>2100</code>.

== 0x79A Combination switch (lighting and turn) ==
Request <code>0x79A</code>, reply <code>0x7AA</code>. Matches parts catalogue entry 37210-74PE2 (switch assembly, lighting and turn, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37210-74PA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37210-74PE*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x778 Dual sensor brake support (inferred) ==
Request <code>0x778</code>, reply <code>0x788</code>. The name is inferred by elimination (the scan report's last unassigned module). Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33990-52R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33990-78R8*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x793 Airbag (SRS) controller ==
Request <code>0x793</code>, reply <code>0x7A3</code>. Matches parts catalogue entry 38910-78RC0 (airbag controller, VAN).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38910-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38910-78RC*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}

== 0x772 4WD shift controller ==
Request <code>0x772</code>, reply <code>0x782</code>. Matches parts catalogue entry 38885-78R01 (4WD shift controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times by the scan tool (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38885-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38885-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The scan tool tried the KWP-style <code>3E</code> first and fell back to the UDS form <code>3E 00</code>.

== 0x799 E-call controller ==
Request <code>0x799</code>, reply <code>0x7A9</code>. Matches parts catalogue entries 38960-78RA0 and RA1 (E-call controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38960-78RA</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38960-78RA*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B 92 4E 00 02</code> || One stored code record: <code>92 4E 00</code>, status <code>02</code>. The Launch report does not list it and its meaning is not known (captured)
|}

== 0x751 Central gateway ==
Request <code>0x751</code>, reply <code>0x761</code>. The label on the module reads 33580-79R01.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>33580-79R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>33580-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The gateway sits between the OBD socket and the vehicle CAN bus. Whether it forwards requests to the other modules unchanged is not confirmed.

== Addresses probed with no reply ==
The scan tool sent tester-present (<code>3E</code>) about eight times each to <code>0x273</code> and <code>0x262</code> and received nothing from the expected reply IDs (<code>0x673</code> and <code>0x662</code>). They are probably modules this car does not have, such as an automatic transmission or auto-levelling controller. This is a guess.

== ELM327 notes ==
* Only <code>0x798</code> has been tested with an ELM327. For other modules, set <code>ATSH</code> to the request ID and <code>ATFCSH</code> to the same ID, and you may need <code>ATCRA</code> with the reply ID, because the reply is not always the request ID plus 8. This is untested.
* Replies from the 0x7xx modules are multi-frame for the identification strings, so the flow-control settings from the TPMS section probably apply there too. Untested.
* Do not send output-control commands (service <code>30</code> and similar) from a head-unit app while driving.

== Sources ==
* Owner PCAN-View captures of a Launch X431 CRP919 full health-check scan and rev counter sweep test, October 2026.
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* Labels on the TPMS controller and central gateway of the test car.

[[Category:Electrical - gen4]]

ECU diagnostic CAN addresses

2026-11-01T10:27:00Z

Mlines: /* 0x261 ABS (inferred) */

<div style="border: 1px solid #c9a227; background-color: #fff8dc; padding: 0.6em 1em; margin: 0 0 1em 0; border-radius: 4px;">
'''Support this project:''' The information on this page is free, but it took a lot of work to gather, test and write up. If it has been useful to you, you can say thanks with a donation at [https://buymeacoffee.com/bigjimny buymeacoffee.com/bigjimny].
</div>

= Suzuki Jimny JB74 - CAN bus devices and the commands they answer =

'''Status:''' work in progress. This page lists every module that answered on the OBD socket (DLC) of one RHD UK-market 2021 Jimny, its request and reply CAN IDs, and the diagnostic commands seen so far. Many sections are short because only identification and fault-code requests have been captured. See [[OBD2 Diagnostics reading project]] for how the captures were made and for the TPMS data in detail.

== How to read this page ==
* All IDs are 11-bit CAN IDs on the OBD socket (pins 6 and 14, 500 kbit/s). The "request ID" is the header a tool sends to; the "reply ID" is where the module answers.
* Commands are shown as the payload bytes in hex, without the ISO-TP length byte. Replies longer than 7 bytes are sent as several frames; the tables show them reassembled.
* '''KWP-style''' modules use services such as <code>1A</code> (read ECU identification) and <code>18</code> (read DTCs by status). '''UDS-style''' modules use <code>22</code> (read data by identifier) and <code>19</code> (read DTCs).
* The reply ID is not always the request ID plus 8: the engine is +0x08, the 0x261 to 0x274 group is +0x400, and all others are +0x10.
* Identification strings are ASCII Suzuki part numbers. The first one in each module (<code>1A 8E</code> or <code>22 F1 01</code>) has no trailing character; the second (<code>1A 8A</code> or <code>22 F1 88</code>) ends in <code>*</code>. They do not always equal the number printed on the module's label.
* Commands marked ''captured'' were seen in a trace. Nothing here has been sent to a module by us except the TPMS requests.

== Device table ==
{| class="wikitable"
! Request ID !! Reply ID !! Style !! Module !! Identification reply (first / second) !! How the module was identified
|-
| [[#0x7E0 ECM|0x7E0]] || 0x7E8 || KWP || ECM || 33980-78R0 / 33980-78RC* || Standard engine address
|-
| [[#0x261 ABS (inferred)|0x261]] || 0x661 || KWP || ABS (inferred) || 56100-77RA / 56100-78RF* || Only brake module left by elimination
|-
| [[#0x263 EPS controller|0x263]] || 0x663 || KWP || EPS controller || 38720-77R0 / 38720-77R0* || Parts catalogue (38720-77R01)
|-
| [[#0x271 Body control module|0x271]] || 0x671 || KWP || Body control module || 36775-77R0 / 36775-77RC* || Parts catalogue (36775-77RC2 to RC4)
|-
| [[#0x274 Instrument cluster|0x274]] || 0x674 || KWP || Instrument cluster || 34100-78R0 / 34110-78RD* || Rev counter sweep test
|-
| [[#0x798 TPMS controller|0x798]] || 0x7A8 || KWP || TPMS controller || 37160-61M0 / 37120-78R0* || Label (Model No. P61M0) and parts catalogue
|-
| [[#0x79A Combination switch (lighting and turn)|0x79A]] || 0x7AA || KWP || Combination switch (lighting and turn) || 37210-74PA / 37210-74PE* || Parts catalogue (37210-74PE2)
|-
| [[#0x778 Dual sensor brake support (inferred)|0x778]] || 0x788 || KWP || Dual sensor brake support (inferred) || 33990-52R0 / 33990-78R8* || By elimination
|-
| [[#0x793 Airbag (SRS) controller|0x793]] || 0x7A3 || UDS || Airbag (SRS) controller || 38910-77R0 / 38910-78RC* || Parts catalogue (38910-78RC0)
|-
| [[#0x772 4WD shift controller|0x772]] || 0x782 || UDS || 4WD shift controller || 38885-77R0 / 38885-78R0* || Parts catalogue (38885-78R01)
|-
| [[#0x799 E-call controller|0x799]] || 0x7A9 || UDS || E-call controller || 38960-78RA / 38960-78RA* || Parts catalogue (38960-78RA0, RA1)
|-
| [[#0x751 Central gateway|0x751]] || 0x761 || UDS || Central gateway || 33580-79R0 / 33580-78R0* || Label (33580-79R01) and parts catalogue
|}

Two more addresses, [[#Addresses probed with no reply|0x273 and 0x262]], were probed by the scan tool and did not answer.

The names marked "inferred" are guesses from elimination and part-number series, not confirmed by a label or test.

== 0x7E0 ECM ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x7E0</code>, reply <code>0x7E8</code>. This is the standard OBD engine address, so standard mode 01 PIDs should be available here, but none were captured.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33980-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33980-78RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || Read DTCs by status: none stored (captured)
|}

== 0x261 ABS (inferred) ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x261</code>, reply <code>0x661</code>. The name is inferred: this is the only brake module left in the scan report after the others were matched, and 56100 looks like a brake part-number series. Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>56100-77RA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>56100-78RF*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x263 EPS controller ==
Request <code>0x263</code>, reply <code>0x663</code>. Matches parts catalogue entry 38720-77R01 (EPS controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>38720-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>38720-77R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x271 Body control module ==
Request <code>0x271</code>, reply <code>0x671</code>. Matches parts catalogue entries 36775-77RC2 to RC4 (body control module, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>36775-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>36775-77RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x274 Instrument cluster ==
Request <code>0x274</code>, reply <code>0x674</code>. Confirmed by the rev counter sweep test.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> or <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s during the sweep test (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>34100-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>34110-78RD*</code> (last byte of the reply is <code>06</code>) || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the rev counter sweep (service 0x30, local ID 01, "short-term adjustment"). The cluster then sweeps up and down by itself (captured)
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"). Possibly a stop request sent after the sweep had finished (captured)
|}
The meaning of the four control bytes (<code>80 40 00 00</code>) is not known. Other output tests (gauges, warning lights) have not been captured.

== 0x798 TPMS controller ==
Request <code>0x798</code>, reply <code>0x7A8</code>. The label on the module reads 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0 (Continental A2C13930301, 433.92 MHz). The full data layout, calibration and app setups are on [[OBD2 Diagnostics reading project]].
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification; matches Model No. P61M0 on the label (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> (no codes) or <code>58 01 9A 31 20</code> (one code) || DTCs by status. The code <code>9A 31</code> is probably the left front low pressure warning (inferred). The status byte was <code>20</code> in the full scan and <code>E0</code> in earlier captures (captured)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block: four sensor records with ID, temperature-like value and pressure. The scan tool repeats it about twice a second (captured, decoded)
|}
ELM327 setup that works for <code>21 00</code>: <code>ATSH798</code>, <code>ATS0</code>, <code>ATL0</code>, <code>ATFCSH798</code>, <code>ATFCSD300000</code>, <code>ATFCSM1</code>, then <code>2100</code>.

== 0x79A Combination switch (lighting and turn) ==
Request <code>0x79A</code>, reply <code>0x7AA</code>. Matches parts catalogue entry 37210-74PE2 (switch assembly, lighting and turn, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37210-74PA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37210-74PE*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x778 Dual sensor brake support (inferred) ==
Request <code>0x778</code>, reply <code>0x788</code>. The name is inferred by elimination (the scan report's last unassigned module). Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33990-52R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33990-78R8*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x793 Airbag (SRS) controller ==
Request <code>0x793</code>, reply <code>0x7A3</code>. Matches parts catalogue entry 38910-78RC0 (airbag controller, VAN).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38910-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38910-78RC*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}

== 0x772 4WD shift controller ==
Request <code>0x772</code>, reply <code>0x782</code>. Matches parts catalogue entry 38885-78R01 (4WD shift controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times by the scan tool (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38885-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38885-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The scan tool tried the KWP-style <code>3E</code> first and fell back to the UDS form <code>3E 00</code>.

== 0x799 E-call controller ==
Request <code>0x799</code>, reply <code>0x7A9</code>. Matches parts catalogue entries 38960-78RA0 and RA1 (E-call controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38960-78RA</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38960-78RA*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B 92 4E 00 02</code> || One stored code record: <code>92 4E 00</code>, status <code>02</code>. The Launch report does not list it and its meaning is not known (captured)
|}

== 0x751 Central gateway ==
Request <code>0x751</code>, reply <code>0x761</code>. The label on the module reads 33580-79R01.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>33580-79R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>33580-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The gateway sits between the OBD socket and the vehicle CAN bus. Whether it forwards requests to the other modules unchanged is not confirmed.

== Addresses probed with no reply ==
The scan tool sent tester-present (<code>3E</code>) about eight times each to <code>0x273</code> and <code>0x262</code> and received nothing from the expected reply IDs (<code>0x673</code> and <code>0x662</code>). They are probably modules this car does not have, such as an automatic transmission or auto-levelling controller. This is a guess.

== ELM327 notes ==
* Only <code>0x798</code> has been tested with an ELM327. For other modules, set <code>ATSH</code> to the request ID and <code>ATFCSH</code> to the same ID, and you may need <code>ATCRA</code> with the reply ID, because the reply is not always the request ID plus 8. This is untested.
* Replies from the 0x7xx modules are multi-frame for the identification strings, so the flow-control settings from the TPMS section probably apply there too. Untested.
* Do not send output-control commands (service <code>30</code> and similar) from a head-unit app while driving.

== Sources ==
* Owner PCAN-View captures of a Launch X431 CRP919 full health-check scan and rev counter sweep test, October 2026.
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* Labels on the TPMS controller and central gateway of the test car.

[[Category:Electrical - gen4]]

ECU diagnostic CAN addresses

2026-11-01T10:26:34Z

Mlines: /* 0x7E0 ECM */

<div style="border: 1px solid #c9a227; background-color: #fff8dc; padding: 0.6em 1em; margin: 0 0 1em 0; border-radius: 4px;">
'''Support this project:''' The information on this page is free, but it took a lot of work to gather, test and write up. If it has been useful to you, you can say thanks with a donation at [https://buymeacoffee.com/bigjimny buymeacoffee.com/bigjimny].
</div>

= Suzuki Jimny JB74 - CAN bus devices and the commands they answer =

'''Status:''' work in progress. This page lists every module that answered on the OBD socket (DLC) of one RHD UK-market 2021 Jimny, its request and reply CAN IDs, and the diagnostic commands seen so far. Many sections are short because only identification and fault-code requests have been captured. See [[OBD2 Diagnostics reading project]] for how the captures were made and for the TPMS data in detail.

== How to read this page ==
* All IDs are 11-bit CAN IDs on the OBD socket (pins 6 and 14, 500 kbit/s). The "request ID" is the header a tool sends to; the "reply ID" is where the module answers.
* Commands are shown as the payload bytes in hex, without the ISO-TP length byte. Replies longer than 7 bytes are sent as several frames; the tables show them reassembled.
* '''KWP-style''' modules use services such as <code>1A</code> (read ECU identification) and <code>18</code> (read DTCs by status). '''UDS-style''' modules use <code>22</code> (read data by identifier) and <code>19</code> (read DTCs).
* The reply ID is not always the request ID plus 8: the engine is +0x08, the 0x261 to 0x274 group is +0x400, and all others are +0x10.
* Identification strings are ASCII Suzuki part numbers. The first one in each module (<code>1A 8E</code> or <code>22 F1 01</code>) has no trailing character; the second (<code>1A 8A</code> or <code>22 F1 88</code>) ends in <code>*</code>. They do not always equal the number printed on the module's label.
* Commands marked ''captured'' were seen in a trace. Nothing here has been sent to a module by us except the TPMS requests.

== Device table ==
{| class="wikitable"
! Request ID !! Reply ID !! Style !! Module !! Identification reply (first / second) !! How the module was identified
|-
| [[#0x7E0 ECM|0x7E0]] || 0x7E8 || KWP || ECM || 33980-78R0 / 33980-78RC* || Standard engine address
|-
| [[#0x261 ABS (inferred)|0x261]] || 0x661 || KWP || ABS (inferred) || 56100-77RA / 56100-78RF* || Only brake module left by elimination
|-
| [[#0x263 EPS controller|0x263]] || 0x663 || KWP || EPS controller || 38720-77R0 / 38720-77R0* || Parts catalogue (38720-77R01)
|-
| [[#0x271 Body control module|0x271]] || 0x671 || KWP || Body control module || 36775-77R0 / 36775-77RC* || Parts catalogue (36775-77RC2 to RC4)
|-
| [[#0x274 Instrument cluster|0x274]] || 0x674 || KWP || Instrument cluster || 34100-78R0 / 34110-78RD* || Rev counter sweep test
|-
| [[#0x798 TPMS controller|0x798]] || 0x7A8 || KWP || TPMS controller || 37160-61M0 / 37120-78R0* || Label (Model No. P61M0) and parts catalogue
|-
| [[#0x79A Combination switch (lighting and turn)|0x79A]] || 0x7AA || KWP || Combination switch (lighting and turn) || 37210-74PA / 37210-74PE* || Parts catalogue (37210-74PE2)
|-
| [[#0x778 Dual sensor brake support (inferred)|0x778]] || 0x788 || KWP || Dual sensor brake support (inferred) || 33990-52R0 / 33990-78R8* || By elimination
|-
| [[#0x793 Airbag (SRS) controller|0x793]] || 0x7A3 || UDS || Airbag (SRS) controller || 38910-77R0 / 38910-78RC* || Parts catalogue (38910-78RC0)
|-
| [[#0x772 4WD shift controller|0x772]] || 0x782 || UDS || 4WD shift controller || 38885-77R0 / 38885-78R0* || Parts catalogue (38885-78R01)
|-
| [[#0x799 E-call controller|0x799]] || 0x7A9 || UDS || E-call controller || 38960-78RA / 38960-78RA* || Parts catalogue (38960-78RA0, RA1)
|-
| [[#0x751 Central gateway|0x751]] || 0x761 || UDS || Central gateway || 33580-79R0 / 33580-78R0* || Label (33580-79R01) and parts catalogue
|}

Two more addresses, [[#Addresses probed with no reply|0x273 and 0x262]], were probed by the scan tool and did not answer.

The names marked "inferred" are guesses from elimination and part-number series, not confirmed by a label or test.

== 0x7E0 ECM ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74, JB43}}

Request <code>0x7E0</code>, reply <code>0x7E8</code>. This is the standard OBD engine address, so standard mode 01 PIDs should be available here, but none were captured.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33980-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33980-78RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || Read DTCs by status: none stored (captured)
|}

== 0x261 ABS (inferred) ==
Request <code>0x261</code>, reply <code>0x661</code>. The name is inferred: this is the only brake module left in the scan report after the others were matched, and 56100 looks like a brake part-number series. Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>56100-77RA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>56100-78RF*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x263 EPS controller ==
Request <code>0x263</code>, reply <code>0x663</code>. Matches parts catalogue entry 38720-77R01 (EPS controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>38720-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>38720-77R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x271 Body control module ==
Request <code>0x271</code>, reply <code>0x671</code>. Matches parts catalogue entries 36775-77RC2 to RC4 (body control module, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>36775-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>36775-77RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x274 Instrument cluster ==
Request <code>0x274</code>, reply <code>0x674</code>. Confirmed by the rev counter sweep test.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> or <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s during the sweep test (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>34100-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>34110-78RD*</code> (last byte of the reply is <code>06</code>) || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the rev counter sweep (service 0x30, local ID 01, "short-term adjustment"). The cluster then sweeps up and down by itself (captured)
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"). Possibly a stop request sent after the sweep had finished (captured)
|}
The meaning of the four control bytes (<code>80 40 00 00</code>) is not known. Other output tests (gauges, warning lights) have not been captured.

== 0x798 TPMS controller ==
Request <code>0x798</code>, reply <code>0x7A8</code>. The label on the module reads 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0 (Continental A2C13930301, 433.92 MHz). The full data layout, calibration and app setups are on [[OBD2 Diagnostics reading project]].
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification; matches Model No. P61M0 on the label (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> (no codes) or <code>58 01 9A 31 20</code> (one code) || DTCs by status. The code <code>9A 31</code> is probably the left front low pressure warning (inferred). The status byte was <code>20</code> in the full scan and <code>E0</code> in earlier captures (captured)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block: four sensor records with ID, temperature-like value and pressure. The scan tool repeats it about twice a second (captured, decoded)
|}
ELM327 setup that works for <code>21 00</code>: <code>ATSH798</code>, <code>ATS0</code>, <code>ATL0</code>, <code>ATFCSH798</code>, <code>ATFCSD300000</code>, <code>ATFCSM1</code>, then <code>2100</code>.

== 0x79A Combination switch (lighting and turn) ==
Request <code>0x79A</code>, reply <code>0x7AA</code>. Matches parts catalogue entry 37210-74PE2 (switch assembly, lighting and turn, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37210-74PA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37210-74PE*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x778 Dual sensor brake support (inferred) ==
Request <code>0x778</code>, reply <code>0x788</code>. The name is inferred by elimination (the scan report's last unassigned module). Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33990-52R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33990-78R8*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x793 Airbag (SRS) controller ==
Request <code>0x793</code>, reply <code>0x7A3</code>. Matches parts catalogue entry 38910-78RC0 (airbag controller, VAN).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38910-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38910-78RC*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}

== 0x772 4WD shift controller ==
Request <code>0x772</code>, reply <code>0x782</code>. Matches parts catalogue entry 38885-78R01 (4WD shift controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times by the scan tool (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38885-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38885-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The scan tool tried the KWP-style <code>3E</code> first and fell back to the UDS form <code>3E 00</code>.

== 0x799 E-call controller ==
Request <code>0x799</code>, reply <code>0x7A9</code>. Matches parts catalogue entries 38960-78RA0 and RA1 (E-call controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38960-78RA</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38960-78RA*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B 92 4E 00 02</code> || One stored code record: <code>92 4E 00</code>, status <code>02</code>. The Launch report does not list it and its meaning is not known (captured)
|}

== 0x751 Central gateway ==
Request <code>0x751</code>, reply <code>0x761</code>. The label on the module reads 33580-79R01.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>33580-79R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>33580-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The gateway sits between the OBD socket and the vehicle CAN bus. Whether it forwards requests to the other modules unchanged is not confirmed.

== Addresses probed with no reply ==
The scan tool sent tester-present (<code>3E</code>) about eight times each to <code>0x273</code> and <code>0x262</code> and received nothing from the expected reply IDs (<code>0x673</code> and <code>0x662</code>). They are probably modules this car does not have, such as an automatic transmission or auto-levelling controller. This is a guess.

== ELM327 notes ==
* Only <code>0x798</code> has been tested with an ELM327. For other modules, set <code>ATSH</code> to the request ID and <code>ATFCSH</code> to the same ID, and you may need <code>ATCRA</code> with the reply ID, because the reply is not always the request ID plus 8. This is untested.
* Replies from the 0x7xx modules are multi-frame for the identification strings, so the flow-control settings from the TPMS section probably apply there too. Untested.
* Do not send output-control commands (service <code>30</code> and similar) from a head-unit app while driving.

== Sources ==
* Owner PCAN-View captures of a Launch X431 CRP919 full health-check scan and rev counter sweep test, October 2026.
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* Labels on the TPMS controller and central gateway of the test car.

[[Category:Electrical - gen4]]

ECU diagnostic CAN addresses

2026-11-01T10:25:25Z

Mlines: /* 0x7E0 ECM */

<div style="border: 1px solid #c9a227; background-color: #fff8dc; padding: 0.6em 1em; margin: 0 0 1em 0; border-radius: 4px;">
'''Support this project:''' The information on this page is free, but it took a lot of work to gather, test and write up. If it has been useful to you, you can say thanks with a donation at [https://buymeacoffee.com/bigjimny buymeacoffee.com/bigjimny].
</div>

= Suzuki Jimny JB74 - CAN bus devices and the commands they answer =

'''Status:''' work in progress. This page lists every module that answered on the OBD socket (DLC) of one RHD UK-market 2021 Jimny, its request and reply CAN IDs, and the diagnostic commands seen so far. Many sections are short because only identification and fault-code requests have been captured. See [[OBD2 Diagnostics reading project]] for how the captures were made and for the TPMS data in detail.

== How to read this page ==
* All IDs are 11-bit CAN IDs on the OBD socket (pins 6 and 14, 500 kbit/s). The "request ID" is the header a tool sends to; the "reply ID" is where the module answers.
* Commands are shown as the payload bytes in hex, without the ISO-TP length byte. Replies longer than 7 bytes are sent as several frames; the tables show them reassembled.
* '''KWP-style''' modules use services such as <code>1A</code> (read ECU identification) and <code>18</code> (read DTCs by status). '''UDS-style''' modules use <code>22</code> (read data by identifier) and <code>19</code> (read DTCs).
* The reply ID is not always the request ID plus 8: the engine is +0x08, the 0x261 to 0x274 group is +0x400, and all others are +0x10.
* Identification strings are ASCII Suzuki part numbers. The first one in each module (<code>1A 8E</code> or <code>22 F1 01</code>) has no trailing character; the second (<code>1A 8A</code> or <code>22 F1 88</code>) ends in <code>*</code>. They do not always equal the number printed on the module's label.
* Commands marked ''captured'' were seen in a trace. Nothing here has been sent to a module by us except the TPMS requests.

== Device table ==
{| class="wikitable"
! Request ID !! Reply ID !! Style !! Module !! Identification reply (first / second) !! How the module was identified
|-
| [[#0x7E0 ECM|0x7E0]] || 0x7E8 || KWP || ECM || 33980-78R0 / 33980-78RC* || Standard engine address
|-
| [[#0x261 ABS (inferred)|0x261]] || 0x661 || KWP || ABS (inferred) || 56100-77RA / 56100-78RF* || Only brake module left by elimination
|-
| [[#0x263 EPS controller|0x263]] || 0x663 || KWP || EPS controller || 38720-77R0 / 38720-77R0* || Parts catalogue (38720-77R01)
|-
| [[#0x271 Body control module|0x271]] || 0x671 || KWP || Body control module || 36775-77R0 / 36775-77RC* || Parts catalogue (36775-77RC2 to RC4)
|-
| [[#0x274 Instrument cluster|0x274]] || 0x674 || KWP || Instrument cluster || 34100-78R0 / 34110-78RD* || Rev counter sweep test
|-
| [[#0x798 TPMS controller|0x798]] || 0x7A8 || KWP || TPMS controller || 37160-61M0 / 37120-78R0* || Label (Model No. P61M0) and parts catalogue
|-
| [[#0x79A Combination switch (lighting and turn)|0x79A]] || 0x7AA || KWP || Combination switch (lighting and turn) || 37210-74PA / 37210-74PE* || Parts catalogue (37210-74PE2)
|-
| [[#0x778 Dual sensor brake support (inferred)|0x778]] || 0x788 || KWP || Dual sensor brake support (inferred) || 33990-52R0 / 33990-78R8* || By elimination
|-
| [[#0x793 Airbag (SRS) controller|0x793]] || 0x7A3 || UDS || Airbag (SRS) controller || 38910-77R0 / 38910-78RC* || Parts catalogue (38910-78RC0)
|-
| [[#0x772 4WD shift controller|0x772]] || 0x782 || UDS || 4WD shift controller || 38885-77R0 / 38885-78R0* || Parts catalogue (38885-78R01)
|-
| [[#0x799 E-call controller|0x799]] || 0x7A9 || UDS || E-call controller || 38960-78RA / 38960-78RA* || Parts catalogue (38960-78RA0, RA1)
|-
| [[#0x751 Central gateway|0x751]] || 0x761 || UDS || Central gateway || 33580-79R0 / 33580-78R0* || Label (33580-79R01) and parts catalogue
|}

Two more addresses, [[#Addresses probed with no reply|0x273 and 0x262]], were probed by the scan tool and did not answer.

The names marked "inferred" are guesses from elimination and part-number series, not confirmed by a label or test.

== 0x7E0 ECM ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74}}

Request <code>0x7E0</code>, reply <code>0x7E8</code>. This is the standard OBD engine address, so standard mode 01 PIDs should be available here, but none were captured.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33980-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33980-78RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || Read DTCs by status: none stored (captured)
|}

== 0x261 ABS (inferred) ==
Request <code>0x261</code>, reply <code>0x661</code>. The name is inferred: this is the only brake module left in the scan report after the others were matched, and 56100 looks like a brake part-number series. Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>56100-77RA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>56100-78RF*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x263 EPS controller ==
Request <code>0x263</code>, reply <code>0x663</code>. Matches parts catalogue entry 38720-77R01 (EPS controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>38720-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>38720-77R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x271 Body control module ==
Request <code>0x271</code>, reply <code>0x671</code>. Matches parts catalogue entries 36775-77RC2 to RC4 (body control module, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>36775-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>36775-77RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x274 Instrument cluster ==
Request <code>0x274</code>, reply <code>0x674</code>. Confirmed by the rev counter sweep test.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> or <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s during the sweep test (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>34100-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>34110-78RD*</code> (last byte of the reply is <code>06</code>) || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the rev counter sweep (service 0x30, local ID 01, "short-term adjustment"). The cluster then sweeps up and down by itself (captured)
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"). Possibly a stop request sent after the sweep had finished (captured)
|}
The meaning of the four control bytes (<code>80 40 00 00</code>) is not known. Other output tests (gauges, warning lights) have not been captured.

== 0x798 TPMS controller ==
Request <code>0x798</code>, reply <code>0x7A8</code>. The label on the module reads 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0 (Continental A2C13930301, 433.92 MHz). The full data layout, calibration and app setups are on [[OBD2 Diagnostics reading project]].
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification; matches Model No. P61M0 on the label (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> (no codes) or <code>58 01 9A 31 20</code> (one code) || DTCs by status. The code <code>9A 31</code> is probably the left front low pressure warning (inferred). The status byte was <code>20</code> in the full scan and <code>E0</code> in earlier captures (captured)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block: four sensor records with ID, temperature-like value and pressure. The scan tool repeats it about twice a second (captured, decoded)
|}
ELM327 setup that works for <code>21 00</code>: <code>ATSH798</code>, <code>ATS0</code>, <code>ATL0</code>, <code>ATFCSH798</code>, <code>ATFCSD300000</code>, <code>ATFCSM1</code>, then <code>2100</code>.

== 0x79A Combination switch (lighting and turn) ==
Request <code>0x79A</code>, reply <code>0x7AA</code>. Matches parts catalogue entry 37210-74PE2 (switch assembly, lighting and turn, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37210-74PA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37210-74PE*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x778 Dual sensor brake support (inferred) ==
Request <code>0x778</code>, reply <code>0x788</code>. The name is inferred by elimination (the scan report's last unassigned module). Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33990-52R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33990-78R8*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x793 Airbag (SRS) controller ==
Request <code>0x793</code>, reply <code>0x7A3</code>. Matches parts catalogue entry 38910-78RC0 (airbag controller, VAN).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38910-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38910-78RC*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}

== 0x772 4WD shift controller ==
Request <code>0x772</code>, reply <code>0x782</code>. Matches parts catalogue entry 38885-78R01 (4WD shift controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times by the scan tool (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38885-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38885-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The scan tool tried the KWP-style <code>3E</code> first and fell back to the UDS form <code>3E 00</code>.

== 0x799 E-call controller ==
Request <code>0x799</code>, reply <code>0x7A9</code>. Matches parts catalogue entries 38960-78RA0 and RA1 (E-call controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38960-78RA</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38960-78RA*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B 92 4E 00 02</code> || One stored code record: <code>92 4E 00</code>, status <code>02</code>. The Launch report does not list it and its meaning is not known (captured)
|}

== 0x751 Central gateway ==
Request <code>0x751</code>, reply <code>0x761</code>. The label on the module reads 33580-79R01.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>33580-79R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>33580-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The gateway sits between the OBD socket and the vehicle CAN bus. Whether it forwards requests to the other modules unchanged is not confirmed.

== Addresses probed with no reply ==
The scan tool sent tester-present (<code>3E</code>) about eight times each to <code>0x273</code> and <code>0x262</code> and received nothing from the expected reply IDs (<code>0x673</code> and <code>0x662</code>). They are probably modules this car does not have, such as an automatic transmission or auto-levelling controller. This is a guess.

== ELM327 notes ==
* Only <code>0x798</code> has been tested with an ELM327. For other modules, set <code>ATSH</code> to the request ID and <code>ATFCSH</code> to the same ID, and you may need <code>ATCRA</code> with the reply ID, because the reply is not always the request ID plus 8. This is untested.
* Replies from the 0x7xx modules are multi-frame for the identification strings, so the flow-control settings from the TPMS section probably apply there too. Untested.
* Do not send output-control commands (service <code>30</code> and similar) from a head-unit app while driving.

== Sources ==
* Owner PCAN-View captures of a Launch X431 CRP919 full health-check scan and rev counter sweep test, October 2026.
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* Labels on the TPMS controller and central gateway of the test car.

[[Category:Electrical - gen4]]

ECU diagnostic CAN addresses

2026-11-01T10:16:24Z

Mlines: /* 0x7E0 ECM */

<div style="border: 1px solid #c9a227; background-color: #fff8dc; padding: 0.6em 1em; margin: 0 0 1em 0; border-radius: 4px;">
'''Support this project:''' The information on this page is free, but it took a lot of work to gather, test and write up. If it has been useful to you, you can say thanks with a donation at [https://buymeacoffee.com/bigjimny buymeacoffee.com/bigjimny].
</div>

= Suzuki Jimny JB74 - CAN bus devices and the commands they answer =

'''Status:''' work in progress. This page lists every module that answered on the OBD socket (DLC) of one RHD UK-market 2021 Jimny, its request and reply CAN IDs, and the diagnostic commands seen so far. Many sections are short because only identification and fault-code requests have been captured. See [[OBD2 Diagnostics reading project]] for how the captures were made and for the TPMS data in detail.

== How to read this page ==
* All IDs are 11-bit CAN IDs on the OBD socket (pins 6 and 14, 500 kbit/s). The "request ID" is the header a tool sends to; the "reply ID" is where the module answers.
* Commands are shown as the payload bytes in hex, without the ISO-TP length byte. Replies longer than 7 bytes are sent as several frames; the tables show them reassembled.
* '''KWP-style''' modules use services such as <code>1A</code> (read ECU identification) and <code>18</code> (read DTCs by status). '''UDS-style''' modules use <code>22</code> (read data by identifier) and <code>19</code> (read DTCs).
* The reply ID is not always the request ID plus 8: the engine is +0x08, the 0x261 to 0x274 group is +0x400, and all others are +0x10.
* Identification strings are ASCII Suzuki part numbers. The first one in each module (<code>1A 8E</code> or <code>22 F1 01</code>) has no trailing character; the second (<code>1A 8A</code> or <code>22 F1 88</code>) ends in <code>*</code>. They do not always equal the number printed on the module's label.
* Commands marked ''captured'' were seen in a trace. Nothing here has been sent to a module by us except the TPMS requests.

== Device table ==
{| class="wikitable"
! Request ID !! Reply ID !! Style !! Module !! Identification reply (first / second) !! How the module was identified
|-
| [[#0x7E0 ECM|0x7E0]] || 0x7E8 || KWP || ECM || 33980-78R0 / 33980-78RC* || Standard engine address
|-
| [[#0x261 ABS (inferred)|0x261]] || 0x661 || KWP || ABS (inferred) || 56100-77RA / 56100-78RF* || Only brake module left by elimination
|-
| [[#0x263 EPS controller|0x263]] || 0x663 || KWP || EPS controller || 38720-77R0 / 38720-77R0* || Parts catalogue (38720-77R01)
|-
| [[#0x271 Body control module|0x271]] || 0x671 || KWP || Body control module || 36775-77R0 / 36775-77RC* || Parts catalogue (36775-77RC2 to RC4)
|-
| [[#0x274 Instrument cluster|0x274]] || 0x674 || KWP || Instrument cluster || 34100-78R0 / 34110-78RD* || Rev counter sweep test
|-
| [[#0x798 TPMS controller|0x798]] || 0x7A8 || KWP || TPMS controller || 37160-61M0 / 37120-78R0* || Label (Model No. P61M0) and parts catalogue
|-
| [[#0x79A Combination switch (lighting and turn)|0x79A]] || 0x7AA || KWP || Combination switch (lighting and turn) || 37210-74PA / 37210-74PE* || Parts catalogue (37210-74PE2)
|-
| [[#0x778 Dual sensor brake support (inferred)|0x778]] || 0x788 || KWP || Dual sensor brake support (inferred) || 33990-52R0 / 33990-78R8* || By elimination
|-
| [[#0x793 Airbag (SRS) controller|0x793]] || 0x7A3 || UDS || Airbag (SRS) controller || 38910-77R0 / 38910-78RC* || Parts catalogue (38910-78RC0)
|-
| [[#0x772 4WD shift controller|0x772]] || 0x782 || UDS || 4WD shift controller || 38885-77R0 / 38885-78R0* || Parts catalogue (38885-78R01)
|-
| [[#0x799 E-call controller|0x799]] || 0x7A9 || UDS || E-call controller || 38960-78RA / 38960-78RA* || Parts catalogue (38960-78RA0, RA1)
|-
| [[#0x751 Central gateway|0x751]] || 0x761 || UDS || Central gateway || 33580-79R0 / 33580-78R0* || Label (33580-79R01) and parts catalogue
|}

Two more addresses, [[#Addresses probed with no reply|0x273 and 0x262]], were probed by the scan tool and did not answer.

The names marked "inferred" are guesses from elimination and part-number series, not confirmed by a label or test.

== 0x7E0 ECM ==
{{Models|JB74 (2018+, tested on 2021)|untested=JB64, JC74}}
Request <code>0x7E0</code>, reply <code>0x7E8</code>. This is the standard OBD engine address, so standard mode 01 PIDs should be available here, but none were captured.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33980-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33980-78RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || Read DTCs by status: none stored (captured)
|}

== 0x261 ABS (inferred) ==
Request <code>0x261</code>, reply <code>0x661</code>. The name is inferred: this is the only brake module left in the scan report after the others were matched, and 56100 looks like a brake part-number series. Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>56100-77RA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>56100-78RF*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x263 EPS controller ==
Request <code>0x263</code>, reply <code>0x663</code>. Matches parts catalogue entry 38720-77R01 (EPS controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>38720-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>38720-77R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x271 Body control module ==
Request <code>0x271</code>, reply <code>0x671</code>. Matches parts catalogue entries 36775-77RC2 to RC4 (body control module, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>36775-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>36775-77RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x274 Instrument cluster ==
Request <code>0x274</code>, reply <code>0x674</code>. Confirmed by the rev counter sweep test.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> or <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s during the sweep test (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>34100-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>34110-78RD*</code> (last byte of the reply is <code>06</code>) || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the rev counter sweep (service 0x30, local ID 01, "short-term adjustment"). The cluster then sweeps up and down by itself (captured)
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"). Possibly a stop request sent after the sweep had finished (captured)
|}
The meaning of the four control bytes (<code>80 40 00 00</code>) is not known. Other output tests (gauges, warning lights) have not been captured.

== 0x798 TPMS controller ==
Request <code>0x798</code>, reply <code>0x7A8</code>. The label on the module reads 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0 (Continental A2C13930301, 433.92 MHz). The full data layout, calibration and app setups are on [[OBD2 Diagnostics reading project]].
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification; matches Model No. P61M0 on the label (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> (no codes) or <code>58 01 9A 31 20</code> (one code) || DTCs by status. The code <code>9A 31</code> is probably the left front low pressure warning (inferred). The status byte was <code>20</code> in the full scan and <code>E0</code> in earlier captures (captured)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block: four sensor records with ID, temperature-like value and pressure. The scan tool repeats it about twice a second (captured, decoded)
|}
ELM327 setup that works for <code>21 00</code>: <code>ATSH798</code>, <code>ATS0</code>, <code>ATL0</code>, <code>ATFCSH798</code>, <code>ATFCSD300000</code>, <code>ATFCSM1</code>, then <code>2100</code>.

== 0x79A Combination switch (lighting and turn) ==
Request <code>0x79A</code>, reply <code>0x7AA</code>. Matches parts catalogue entry 37210-74PE2 (switch assembly, lighting and turn, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37210-74PA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37210-74PE*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x778 Dual sensor brake support (inferred) ==
Request <code>0x778</code>, reply <code>0x788</code>. The name is inferred by elimination (the scan report's last unassigned module). Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33990-52R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33990-78R8*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x793 Airbag (SRS) controller ==
Request <code>0x793</code>, reply <code>0x7A3</code>. Matches parts catalogue entry 38910-78RC0 (airbag controller, VAN).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38910-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38910-78RC*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}

== 0x772 4WD shift controller ==
Request <code>0x772</code>, reply <code>0x782</code>. Matches parts catalogue entry 38885-78R01 (4WD shift controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times by the scan tool (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38885-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38885-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The scan tool tried the KWP-style <code>3E</code> first and fell back to the UDS form <code>3E 00</code>.

== 0x799 E-call controller ==
Request <code>0x799</code>, reply <code>0x7A9</code>. Matches parts catalogue entries 38960-78RA0 and RA1 (E-call controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38960-78RA</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38960-78RA*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B 92 4E 00 02</code> || One stored code record: <code>92 4E 00</code>, status <code>02</code>. The Launch report does not list it and its meaning is not known (captured)
|}

== 0x751 Central gateway ==
Request <code>0x751</code>, reply <code>0x761</code>. The label on the module reads 33580-79R01.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>33580-79R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>33580-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The gateway sits between the OBD socket and the vehicle CAN bus. Whether it forwards requests to the other modules unchanged is not confirmed.

== Addresses probed with no reply ==
The scan tool sent tester-present (<code>3E</code>) about eight times each to <code>0x273</code> and <code>0x262</code> and received nothing from the expected reply IDs (<code>0x673</code> and <code>0x662</code>). They are probably modules this car does not have, such as an automatic transmission or auto-levelling controller. This is a guess.

== ELM327 notes ==
* Only <code>0x798</code> has been tested with an ELM327. For other modules, set <code>ATSH</code> to the request ID and <code>ATFCSH</code> to the same ID, and you may need <code>ATCRA</code> with the reply ID, because the reply is not always the request ID plus 8. This is untested.
* Replies from the 0x7xx modules are multi-frame for the identification strings, so the flow-control settings from the TPMS section probably apply there too. Untested.
* Do not send output-control commands (service <code>30</code> and similar) from a head-unit app while driving.

== Sources ==
* Owner PCAN-View captures of a Launch X431 CRP919 full health-check scan and rev counter sweep test, October 2026.
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* Labels on the TPMS controller and central gateway of the test car.

[[Category:Electrical - gen4]]

ECU diagnostic CAN addresses

2026-11-01T10:14:31Z

Mlines: Created page with "<div style="border: 1px solid #c9a227; background-color: #fff8dc; padding: 0.6em 1em; margin: 0 0 1em 0; border-radius: 4px;"> '''Support this project:''' The information on t..."

<div style="border: 1px solid #c9a227; background-color: #fff8dc; padding: 0.6em 1em; margin: 0 0 1em 0; border-radius: 4px;">
'''Support this project:''' The information on this page is free, but it took a lot of work to gather, test and write up. If it has been useful to you, you can say thanks with a donation at [https://buymeacoffee.com/bigjimny buymeacoffee.com/bigjimny].
</div>

= Suzuki Jimny JB74 - CAN bus devices and the commands they answer =

'''Status:''' work in progress. This page lists every module that answered on the OBD socket (DLC) of one RHD UK-market 2021 Jimny, its request and reply CAN IDs, and the diagnostic commands seen so far. Many sections are short because only identification and fault-code requests have been captured. See [[OBD2 Diagnostics reading project]] for how the captures were made and for the TPMS data in detail.

== How to read this page ==
* All IDs are 11-bit CAN IDs on the OBD socket (pins 6 and 14, 500 kbit/s). The "request ID" is the header a tool sends to; the "reply ID" is where the module answers.
* Commands are shown as the payload bytes in hex, without the ISO-TP length byte. Replies longer than 7 bytes are sent as several frames; the tables show them reassembled.
* '''KWP-style''' modules use services such as <code>1A</code> (read ECU identification) and <code>18</code> (read DTCs by status). '''UDS-style''' modules use <code>22</code> (read data by identifier) and <code>19</code> (read DTCs).
* The reply ID is not always the request ID plus 8: the engine is +0x08, the 0x261 to 0x274 group is +0x400, and all others are +0x10.
* Identification strings are ASCII Suzuki part numbers. The first one in each module (<code>1A 8E</code> or <code>22 F1 01</code>) has no trailing character; the second (<code>1A 8A</code> or <code>22 F1 88</code>) ends in <code>*</code>. They do not always equal the number printed on the module's label.
* Commands marked ''captured'' were seen in a trace. Nothing here has been sent to a module by us except the TPMS requests.

== Device table ==
{| class="wikitable"
! Request ID !! Reply ID !! Style !! Module !! Identification reply (first / second) !! How the module was identified
|-
| [[#0x7E0 ECM|0x7E0]] || 0x7E8 || KWP || ECM || 33980-78R0 / 33980-78RC* || Standard engine address
|-
| [[#0x261 ABS (inferred)|0x261]] || 0x661 || KWP || ABS (inferred) || 56100-77RA / 56100-78RF* || Only brake module left by elimination
|-
| [[#0x263 EPS controller|0x263]] || 0x663 || KWP || EPS controller || 38720-77R0 / 38720-77R0* || Parts catalogue (38720-77R01)
|-
| [[#0x271 Body control module|0x271]] || 0x671 || KWP || Body control module || 36775-77R0 / 36775-77RC* || Parts catalogue (36775-77RC2 to RC4)
|-
| [[#0x274 Instrument cluster|0x274]] || 0x674 || KWP || Instrument cluster || 34100-78R0 / 34110-78RD* || Rev counter sweep test
|-
| [[#0x798 TPMS controller|0x798]] || 0x7A8 || KWP || TPMS controller || 37160-61M0 / 37120-78R0* || Label (Model No. P61M0) and parts catalogue
|-
| [[#0x79A Combination switch (lighting and turn)|0x79A]] || 0x7AA || KWP || Combination switch (lighting and turn) || 37210-74PA / 37210-74PE* || Parts catalogue (37210-74PE2)
|-
| [[#0x778 Dual sensor brake support (inferred)|0x778]] || 0x788 || KWP || Dual sensor brake support (inferred) || 33990-52R0 / 33990-78R8* || By elimination
|-
| [[#0x793 Airbag (SRS) controller|0x793]] || 0x7A3 || UDS || Airbag (SRS) controller || 38910-77R0 / 38910-78RC* || Parts catalogue (38910-78RC0)
|-
| [[#0x772 4WD shift controller|0x772]] || 0x782 || UDS || 4WD shift controller || 38885-77R0 / 38885-78R0* || Parts catalogue (38885-78R01)
|-
| [[#0x799 E-call controller|0x799]] || 0x7A9 || UDS || E-call controller || 38960-78RA / 38960-78RA* || Parts catalogue (38960-78RA0, RA1)
|-
| [[#0x751 Central gateway|0x751]] || 0x761 || UDS || Central gateway || 33580-79R0 / 33580-78R0* || Label (33580-79R01) and parts catalogue
|}

Two more addresses, [[#Addresses probed with no reply|0x273 and 0x262]], were probed by the scan tool and did not answer.

The names marked "inferred" are guesses from elimination and part-number series, not confirmed by a label or test.

== 0x7E0 ECM ==
Request <code>0x7E0</code>, reply <code>0x7E8</code>. This is the standard OBD engine address, so standard mode 01 PIDs should be available here, but none were captured.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33980-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33980-78RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || Read DTCs by status: none stored (captured)
|}

== 0x261 ABS (inferred) ==
Request <code>0x261</code>, reply <code>0x661</code>. The name is inferred: this is the only brake module left in the scan report after the others were matched, and 56100 looks like a brake part-number series. Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>56100-77RA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>56100-78RF*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x263 EPS controller ==
Request <code>0x263</code>, reply <code>0x663</code>. Matches parts catalogue entry 38720-77R01 (EPS controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>38720-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>38720-77R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x271 Body control module ==
Request <code>0x271</code>, reply <code>0x671</code>. Matches parts catalogue entries 36775-77RC2 to RC4 (body control module, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>36775-77R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>36775-77RC*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x274 Instrument cluster ==
Request <code>0x274</code>, reply <code>0x674</code>. Confirmed by the rev counter sweep test.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> or <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s during the sweep test (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>34100-78R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>34110-78RD*</code> (last byte of the reply is <code>06</code>) || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the rev counter sweep (service 0x30, local ID 01, "short-term adjustment"). The cluster then sweeps up and down by itself (captured)
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"). Possibly a stop request sent after the sweep had finished (captured)
|}
The meaning of the four control bytes (<code>80 40 00 00</code>) is not known. Other output tests (gauges, warning lights) have not been captured.

== 0x798 TPMS controller ==
Request <code>0x798</code>, reply <code>0x7A8</code>. The label on the module reads 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0 (Continental A2C13930301, 433.92 MHz). The full data layout, calibration and app setups are on [[OBD2 Diagnostics reading project]].
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification; matches Model No. P61M0 on the label (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> (no codes) or <code>58 01 9A 31 20</code> (one code) || DTCs by status. The code <code>9A 31</code> is probably the left front low pressure warning (inferred). The status byte was <code>20</code> in the full scan and <code>E0</code> in earlier captures (captured)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block: four sensor records with ID, temperature-like value and pressure. The scan tool repeats it about twice a second (captured, decoded)
|}
ELM327 setup that works for <code>21 00</code>: <code>ATSH798</code>, <code>ATS0</code>, <code>ATL0</code>, <code>ATFCSH798</code>, <code>ATFCSD300000</code>, <code>ATFCSM1</code>, then <code>2100</code>.

== 0x79A Combination switch (lighting and turn) ==
Request <code>0x79A</code>, reply <code>0x7AA</code>. Matches parts catalogue entry 37210-74PE2 (switch assembly, lighting and turn, RHD).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37210-74PA</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37210-74PE*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x778 Dual sensor brake support (inferred) ==
Request <code>0x778</code>, reply <code>0x788</code>. The name is inferred by elimination (the scan report's last unassigned module). Not confirmed.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present (captured)
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>33990-52R0</code> || ECU identification (captured)
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>33990-78R8*</code> || ECU identification (captured)
|-
| <code>18 00 FF 00</code> || <code>58 00</code> || DTCs: none stored (captured)
|}

== 0x793 Airbag (SRS) controller ==
Request <code>0x793</code>, reply <code>0x7A3</code>. Matches parts catalogue entry 38910-78RC0 (airbag controller, VAN).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38910-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38910-78RC*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}

== 0x772 4WD shift controller ==
Request <code>0x772</code>, reply <code>0x782</code>. Matches parts catalogue entry 38885-78R01 (4WD shift controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times by the scan tool (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38885-77R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38885-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The scan tool tried the KWP-style <code>3E</code> first and fell back to the UDS form <code>3E 00</code>.

== 0x799 E-call controller ==
Request <code>0x799</code>, reply <code>0x7A9</code>. Matches parts catalogue entries 38960-78RA0 and RA1 (E-call controller).
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7F 3E 13</code> || Refused: incorrect message length. Sent four times (captured)
|-
| <code>3E 01</code> || <code>7F 3E 12</code> || Refused: sub-function not supported. Sent four times (captured)
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>38960-78RA</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>38960-78RA*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B 92 4E 00 02</code> || One stored code record: <code>92 4E 00</code>, status <code>02</code>. The Launch report does not list it and its meaning is not known (captured)
|}

== 0x751 Central gateway ==
Request <code>0x751</code>, reply <code>0x761</code>. The label on the module reads 33580-79R01.
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E 00</code> || <code>7E 00</code> || Tester present (captured)
|-
| <code>22 F1 01</code> || <code>62 F1 01</code> + ASCII <code>33580-79R0</code> || Identification (captured)
|-
| <code>22 F1 88</code> || <code>62 F1 88</code> + ASCII <code>33580-78R0*</code> || Identification (captured)
|-
| <code>19 02 FF</code> || <code>59 02 4B</code> || DTCs by status mask: none stored (captured)
|}
The gateway sits between the OBD socket and the vehicle CAN bus. Whether it forwards requests to the other modules unchanged is not confirmed.

== Addresses probed with no reply ==
The scan tool sent tester-present (<code>3E</code>) about eight times each to <code>0x273</code> and <code>0x262</code> and received nothing from the expected reply IDs (<code>0x673</code> and <code>0x662</code>). They are probably modules this car does not have, such as an automatic transmission or auto-levelling controller. This is a guess.

== ELM327 notes ==
* Only <code>0x798</code> has been tested with an ELM327. For other modules, set <code>ATSH</code> to the request ID and <code>ATFCSH</code> to the same ID, and you may need <code>ATCRA</code> with the reply ID, because the reply is not always the request ID plus 8. This is untested.
* Replies from the 0x7xx modules are multi-frame for the identification strings, so the flow-control settings from the TPMS section probably apply there too. Untested.
* Do not send output-control commands (service <code>30</code> and similar) from a head-unit app while driving.

== Sources ==
* Owner PCAN-View captures of a Launch X431 CRP919 full health-check scan and rev counter sweep test, October 2026.
* Suzuki Jimny parts catalogue 9900B-40312-004 (type 1, October 2021), figures 350A, 351A and 351B.
* Labels on the TPMS controller and central gateway of the test car.

[[Category:Electrical - gen4]]

Template:Models

2026-11-01T10:12:31Z

Mlines: Created page with "'''Models:''' {{{1}}}{{#if:{{{untested|}}}| — ''untested on: {{{untested}}}''}}"

'''Models:''' {{{1}}}{{#if:{{{untested|}}}| — ''untested on: {{{untested}}}''}}

OBD2 Diagnostics reading project

2026-10-29T21:04:19Z

Mlines: /* Other modules found by a full scan */

= Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link =

{{Donate}}
== Overview ==
Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

=== Equipment ===
{| class="wikitable"
! Role !! Item
|-
| Head unit || XTRONS PX90
|-
| OBD-II Bluetooth dongle 1 || Generic ELM-based (Chinese)
|-
| OBD-II Bluetooth dongle 2 || Veepeak OBDCheck BLE+
|-
| CAN bus monitor (Windows) || PCAN-View (PEAK-System)
|-
| Diagnostic tool 1 || Launch X431 CRP919
|-
| Diagnostic tool 2 || SZ Viewer app
|-
| Head-unit apps being tried || Torque, RealDash
|}

=== Method ===
# The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
# PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
# The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.
'''Status:''' work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures, and the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC). Items marked ''unconfirmed'' are not yet verified.

== Summary ==
* The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
* Request ID '''0x798''', reply ID '''0x7A8''', 11-bit CAN, 500 kbit/s, ISO-TP framing.
* Service '''0x21''' (read data by local identifier), identifier '''0x00''', returns 102 bytes containing all four sensor records.
* The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.

== DLC (OBD socket) wiring ==
The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal ''n'' matches standard pin ''17 - n''.

{| class="wikitable"
! Manual terminal !! Standard pin !! Function !! Wire / source on diagram
|-
| 1 || 16 || Battery +12 V || GRY, fuse No.49 "DOME2" (10 A)
|-
| 12 || 5 || Signal ground || BLK
|-
| 13 || 4 || Chassis ground || BLK
|-
| 11 || 6 || CAN-H (from standard assignment) || BLU, gateway pin 8
|-
| 3 || 14 || CAN-L (from standard assignment) || WHT, gateway pin 7
|}

Use pins '''6''' and '''14''' for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

=== Cross-check with other reports ===
A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

* The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
* No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
* On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

== Network layout ==
The DLC is not on the vehicle bus directly. The '''central gateway control module''' joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

== Diagnostic requests seen ==
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
|-
| <code>18 00 FF 00</code> || <code>58 00</code> or <code>58 01 9A 31 E0</code> || Read DTCs by status (second form = one code reported; not decoded)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block (repeated about twice a second by the scan tool)
|}

Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The <code>1A 8E</code> reply (37160-61M0) matches the TPMS controller's base number and model number; the <code>1A 8A</code> reply (37120-78R0*) shares "78R0" with its full part number but its meaning is not confirmed

== Reading it with an ELM327 ==
Terminal commands, one at a time (CR line ending):
<pre>
ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100
</pre>
* <code>ATSH798</code> sets the request address. The reply address (0x7A8) is worked out automatically.
* <code>ATFCSH798 / ATFCSD300000 / ATFCSM1</code> make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
* <code>ATS0</code> removes the spaces between bytes.Without it, the generic Chinese ELM327-based dongle (dongle 1) reported <code>BUFFER FULL</code> near byte 81.
* Expected output: a length line (<code>066</code> = 102 bytes) and numbered lines <code>0:</code> to <code>E:</code>.
* With default settings dongle 1 returned only the first line (<code>61 00 xx 01 00 00</code>).

== Reply layout (21 00) ==
Byte positions count the <code>61</code> as byte 0.
{| class="wikitable"
! Bytes !! Content
|-
| 0-1 || <code>61 00</code> (positive reply)
|-
| 2 || Varies 117-142. Looks like system voltage x 10 (''unconfirmed'')
|-
| 12-21 || Sensor record 1: front left
|-
| 22-31 || Sensor record 2: rear left
|-
| 32-41 || Sensor record 3: rear right
|-
| 42-51 || Sensor record 4: front right
|-
| 56-71 || Four 4-byte sensor-ID entries whose contents change (meaning unknown)
|-
| other || Not decoded
|}

=== Sensor record (10 bytes) ===
{| class="wikitable"
! Offset !! Content
|-
| +0 to +3 || Sensor ID
|-
| +4 || Position flag
|-
| +5 || Value 57-74. Behaves like temperature, possibly with an offset of 40 (''unconfirmed'')
|-
| +6 || Pressure candidate (see calibration)
|-
| +7, +8 || Not understood
|-
| +9 || Always 0
|}

{| class="wikitable"
! Wheel !! Sensor ID !! Position flag
|-
| Front left || 4E AA 09 43 || 0x10
|-
| Rear left || DD 91 B5 25 || 0x20
|-
| Rear right || 4E AA 03 19 || 0x18
|-
| Front right || 4E AA 09 C9 || 0x08
|}
Sensor IDs are specific to one car. Yours will differ.

== Calibration ==
Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.
{| class="wikitable"
! Raw !! Gauge (bar) !! Raw x 0.01372
|-
| 136 (rear left) || 1.868 || 1.866
|-
| 131 (rear right) || 1.795 || 1.797
|-
| 131 (front right) || 1.795 || 1.797
|-
| 126 || 1.73 || 1.729
|-
| 119 || 1.63 || 1.633
|-
| 112 || 1.54 || 1.537
|-
| 101 || 1.39 || 1.386
|-
| 96 || 1.29 || 1.317
|}
The last five rows are from one tyre during a slow deflation (assumed front left).
* bar = raw x 0.01372
* psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

== Torque Pro custom PIDs ==
Common fields for every wheel:
{| class="wikitable"
! Field !! Value
|-
| Header || 798
|-
| Mode and PID || 2100
|-
| Diagnostic start command || <code>ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1</code> (comma-separated)
|-
| Unit / min / max || bar, 0, 4 (or psi, 0, 60)
|}

Equation uses a letter for each data byte. <code>A</code> is the first byte after <code>61 00</code> (reply byte 2).
{| class="wikitable"
! Wheel !! Byte +5 (temperature?) !! Byte +6 (pressure candidate)
|-
| Front left || P || Q
|-
| Front right || AT || AU
|-
| Rear left || Z || AA
|-
| Rear right || AJ || AK
|}
Example: <code>Q*0.01372</code>. Letters must be upper case. Whether Torque accepts two-letter variables is ''unconfirmed''.

=== Known problem ===
Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on the XTRONS PX90, Torque read bytes <code>A</code> to <code>D</code> (first line of the reply) correctly, but every byte from <code>E</code> onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding <code>ATH1</code> changed the output). Tried without success: turning off "Faster communication", removing <code>ATS0</code>. Not yet tried: <code>ATAT0, ATSTFF</code> timeout settings, other apps, and the Veepeak OBDCheck BLE+ (dongle 2).. Unresolved.
The same result occurred with the Veepeak OBDCheck BLE+ (dongle 2). Car Scanner Pro does not have this problem (see below).

== Car Scanner Pro (working) ==
Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:
* Header: 798
* Request: 2100
* Start command (backslash-separated): <code>ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1</code>
* Equations use the same letters as the table above, for example <code>Q*0.01372</code> for front left (bar)

The start command has not yet been shortened. Adapter: Both dongle 1 (generic ELM327-based) and dongle 2 (Veepeak OBDCheck BLE+) work with Car Scanner Pro.
== Other modules found by a full scan ==
A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

{| class="wikitable"
! Request !! Reply !! Protocol !! Identification replies !! Module !! How identified
|-
| 0x7E0 || 0x7E8 || KWP || 33980-78R0, 33980-78RC* || ECM || Standard engine address
|-
| 0x261 || 0x661 || KWP || 56100-77RA, 56100-78RF* || ABS (inferred) || Only brake module left by elimination
|-
| 0x263 || 0x663 || KWP || 38720-77R0, 38720-77R0* || EPS controller || Parts catalogue
|-
| 0x271 || 0x671 || KWP || 36775-77R0, 36775-77RC* || Body control module || Parts catalogue
|-
| 0x274 || 0x674 || KWP || 34100-78R0, 34110-78RD* || Instrument cluster || Rev counter sweep test
|-
| 0x798 || 0x7A8 || KWP || 37160-61M0, 37120-78R0* || TPMS controller || Label and parts catalogue
|-
| 0x79A || 0x7AA || KWP || 37210-74PA, 37210-74PE* || Lighting and turn switch || Parts catalogue
|-
| 0x778 || 0x788 || KWP || 33990-52R0, 33990-78R8* || Dual sensor brake support || Parts catalogue
|-
| 0x793 || 0x7A3 || UDS || 38910-77R0, 38910-78RC* || Airbag (SRS) controller || Parts catalogue
|-
| 0x772 || 0x782 || UDS || 38885-77R0, 38885-78R0* || 4WD shift controller || Parts catalogue
|-
| 0x799 || 0x7A9 || UDS || 38960-78RA, 38960-78RA* || E-call controller || Parts catalogue
|-
| 0x751 || 0x761 || UDS || 33580-79R0, 33580-78R0* || Central gateway || Label and parts catalogue
|}
Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

* KWP-style modules answer <code>1A 8E</code> and <code>1A 8A</code> (identification) and <code>18 00 FF 00</code> (DTCs). UDS-style modules answer <code>22 F1 01</code> and <code>22 F1 88</code> (identification) and <code>19 02 FF</code> (DTCs).
* Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
* The "probable" and "possible" names are guesses from the part-number series and are not confirmed.

=== Instrument cluster output test (0x274 / 0x674) ===
A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:
{| class="wikitable"
! Request !! Reply !! Notes
|-
| <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished
|}
The meaning of the four control bytes (80 40 00 00) is not known.

== Open questions ==
* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A reliable pressure scale and offset (more gauge readings needed).
* Whether other Suzuki modules use addresses near 0x798 (not checked).
* Why Torque stops after the first line.

== Sources ==
* Owner PCAN-View captures, October 2026.
* Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
* Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
* BigJimny forum thread "JB74 OBD2 connection" (December 2020).

[[Category:Jimny technical]]
[[Category:JB74]]
[[Category:Electrical - gen3]]
[[Category:FAQ - gen3]]
[[Category:Howto - gen3]]

[[Category:Electrical - gen4]]
[[Category:FAQ - gen4]]
[[Category:Howto - gen4]]

OBD2 Diagnostics reading project

2026-10-29T20:31:59Z

Mlines: /* Other modules found by a full scan */

= Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link =

{{Donate}}
== Overview ==
Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

=== Equipment ===
{| class="wikitable"
! Role !! Item
|-
| Head unit || XTRONS PX90
|-
| OBD-II Bluetooth dongle 1 || Generic ELM-based (Chinese)
|-
| OBD-II Bluetooth dongle 2 || Veepeak OBDCheck BLE+
|-
| CAN bus monitor (Windows) || PCAN-View (PEAK-System)
|-
| Diagnostic tool 1 || Launch X431 CRP919
|-
| Diagnostic tool 2 || SZ Viewer app
|-
| Head-unit apps being tried || Torque, RealDash
|}

=== Method ===
# The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
# PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
# The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.
'''Status:''' work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures, and the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC). Items marked ''unconfirmed'' are not yet verified.

== Summary ==
* The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
* Request ID '''0x798''', reply ID '''0x7A8''', 11-bit CAN, 500 kbit/s, ISO-TP framing.
* Service '''0x21''' (read data by local identifier), identifier '''0x00''', returns 102 bytes containing all four sensor records.
* The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.

== DLC (OBD socket) wiring ==
The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal ''n'' matches standard pin ''17 - n''.

{| class="wikitable"
! Manual terminal !! Standard pin !! Function !! Wire / source on diagram
|-
| 1 || 16 || Battery +12 V || GRY, fuse No.49 "DOME2" (10 A)
|-
| 12 || 5 || Signal ground || BLK
|-
| 13 || 4 || Chassis ground || BLK
|-
| 11 || 6 || CAN-H (from standard assignment) || BLU, gateway pin 8
|-
| 3 || 14 || CAN-L (from standard assignment) || WHT, gateway pin 7
|}

Use pins '''6''' and '''14''' for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

=== Cross-check with other reports ===
A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

* The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
* No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
* On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

== Network layout ==
The DLC is not on the vehicle bus directly. The '''central gateway control module''' joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

== Diagnostic requests seen ==
{| class="wikitable"
! Request !! Reply !! Meaning
|-
| <code>3E</code> || <code>7E</code> || Tester present
|-
| <code>1A 8A</code> || <code>5A 8A</code> + ASCII <code>37120-78R0*</code> || ECU identification
|-
| <code>1A 8E</code> || <code>5A 8E</code> + ASCII <code>37160-61M0</code> || ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
|-
| <code>18 00 FF 00</code> || <code>58 00</code> or <code>58 01 9A 31 E0</code> || Read DTCs by status (second form = one code reported; not decoded)
|-
| <code>21 00</code> || <code>61 00</code> + 100 bytes || Sensor data block (repeated about twice a second by the scan tool)
|}

Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The <code>1A 8E</code> reply (37160-61M0) matches the TPMS controller's base number and model number; the <code>1A 8A</code> reply (37120-78R0*) shares "78R0" with its full part number but its meaning is not confirmed

== Reading it with an ELM327 ==
Terminal commands, one at a time (CR line ending):
<pre>
ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100
</pre>
* <code>ATSH798</code> sets the request address. The reply address (0x7A8) is worked out automatically.
* <code>ATFCSH798 / ATFCSD300000 / ATFCSM1</code> make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
* <code>ATS0</code> removes the spaces between bytes.Without it, the generic Chinese ELM327-based dongle (dongle 1) reported <code>BUFFER FULL</code> near byte 81.
* Expected output: a length line (<code>066</code> = 102 bytes) and numbered lines <code>0:</code> to <code>E:</code>.
* With default settings dongle 1 returned only the first line (<code>61 00 xx 01 00 00</code>).

== Reply layout (21 00) ==
Byte positions count the <code>61</code> as byte 0.
{| class="wikitable"
! Bytes !! Content
|-
| 0-1 || <code>61 00</code> (positive reply)
|-
| 2 || Varies 117-142. Looks like system voltage x 10 (''unconfirmed'')
|-
| 12-21 || Sensor record 1: front left
|-
| 22-31 || Sensor record 2: rear left
|-
| 32-41 || Sensor record 3: rear right
|-
| 42-51 || Sensor record 4: front right
|-
| 56-71 || Four 4-byte sensor-ID entries whose contents change (meaning unknown)
|-
| other || Not decoded
|}

=== Sensor record (10 bytes) ===
{| class="wikitable"
! Offset !! Content
|-
| +0 to +3 || Sensor ID
|-
| +4 || Position flag
|-
| +5 || Value 57-74. Behaves like temperature, possibly with an offset of 40 (''unconfirmed'')
|-
| +6 || Pressure candidate (see calibration)
|-
| +7, +8 || Not understood
|-
| +9 || Always 0
|}

{| class="wikitable"
! Wheel !! Sensor ID !! Position flag
|-
| Front left || 4E AA 09 43 || 0x10
|-
| Rear left || DD 91 B5 25 || 0x20
|-
| Rear right || 4E AA 03 19 || 0x18
|-
| Front right || 4E AA 09 C9 || 0x08
|}
Sensor IDs are specific to one car. Yours will differ.

== Calibration ==
Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.
{| class="wikitable"
! Raw !! Gauge (bar) !! Raw x 0.01372
|-
| 136 (rear left) || 1.868 || 1.866
|-
| 131 (rear right) || 1.795 || 1.797
|-
| 131 (front right) || 1.795 || 1.797
|-
| 126 || 1.73 || 1.729
|-
| 119 || 1.63 || 1.633
|-
| 112 || 1.54 || 1.537
|-
| 101 || 1.39 || 1.386
|-
| 96 || 1.29 || 1.317
|}
The last five rows are from one tyre during a slow deflation (assumed front left).
* bar = raw x 0.01372
* psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

== Torque Pro custom PIDs ==
Common fields for every wheel:
{| class="wikitable"
! Field !! Value
|-
| Header || 798
|-
| Mode and PID || 2100
|-
| Diagnostic start command || <code>ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1</code> (comma-separated)
|-
| Unit / min / max || bar, 0, 4 (or psi, 0, 60)
|}

Equation uses a letter for each data byte. <code>A</code> is the first byte after <code>61 00</code> (reply byte 2).
{| class="wikitable"
! Wheel !! Byte +5 (temperature?) !! Byte +6 (pressure candidate)
|-
| Front left || P || Q
|-
| Front right || AT || AU
|-
| Rear left || Z || AA
|-
| Rear right || AJ || AK
|}
Example: <code>Q*0.01372</code>. Letters must be upper case. Whether Torque accepts two-letter variables is ''unconfirmed''.

=== Known problem ===
Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on the XTRONS PX90, Torque read bytes <code>A</code> to <code>D</code> (first line of the reply) correctly, but every byte from <code>E</code> onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding <code>ATH1</code> changed the output). Tried without success: turning off "Faster communication", removing <code>ATS0</code>. Not yet tried: <code>ATAT0, ATSTFF</code> timeout settings, other apps, and the Veepeak OBDCheck BLE+ (dongle 2).. Unresolved.
The same result occurred with the Veepeak OBDCheck BLE+ (dongle 2). Car Scanner Pro does not have this problem (see below).

== Car Scanner Pro (working) ==
Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:
* Header: 798
* Request: 2100
* Start command (backslash-separated): <code>ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1</code>
* Equations use the same letters as the table above, for example <code>Q*0.01372</code> for front left (bar)

The start command has not yet been shortened. Adapter: Both dongle 1 (generic ELM327-based) and dongle 2 (Veepeak OBDCheck BLE+) work with Car Scanner Pro.
== Other modules found by a full scan ==
A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

{| class="wikitable"
! Request !! Reply !! Protocol !! Identification replies !! Module !! How identified
|-
| 0x7E0 || 0x7E8 || KWP || 33980-78R0, 33980-78RC* || ECM || Standard engine address
|-
| 0x261 || 0x661 || KWP || 56100-77RA, 56100-78RF* || ABS (inferred) || Only brake module left by elimination
|-
| 0x263 || 0x663 || KWP || 38720-77R0, 38720-77R0* || EPS controller || Parts catalogue
|-
| 0x271 || 0x671 || KWP || 36775-77R0, 36775-77RC* || Body control module || Parts catalogue
|-
| 0x274 || 0x674 || KWP || 34100-78R0, 34110-78RD* || Instrument cluster || Rev counter sweep test
|-
| 0x798 || 0x7A8 || KWP || 37160-61M0, 37120-78R0* || TPMS controller || Label and parts catalogue
|-
| 0x79A || 0x7AA || KWP || 37210-74PA, 37210-74PE* || Lighting and turn switch || Parts catalogue
|-
| 0x778 || 0x788 || KWP || 33990-52R0, 33990-78R8* || Dual sensor brake support (inferred) || By elimination
|-
| 0x793 || 0x7A3 || UDS || 38910-77R0, 38910-78RC* || Airbag (SRS) controller || Parts catalogue
|-
| 0x772 || 0x782 || UDS || 38885-77R0, 38885-78R0* || 4WD shift controller || Parts catalogue
|-
| 0x799 || 0x7A9 || UDS || 38960-78RA, 38960-78RA* || E-call controller || Parts catalogue
|-
| 0x751 || 0x761 || UDS || 33580-79R0, 33580-78R0* || Central gateway || Label and parts catalogue
|}
Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

* KWP-style modules answer <code>1A 8E</code> and <code>1A 8A</code> (identification) and <code>18 00 FF 00</code> (DTCs). UDS-style modules answer <code>22 F1 01</code> and <code>22 F1 88</code> (identification) and <code>19 02 FF</code> (DTCs).
* Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
* The "probable" and "possible" names are guesses from the part-number series and are not confirmed.

=== Instrument cluster output test (0x274 / 0x674) ===
A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:
{| class="wikitable"
! Request !! Reply !! Notes
|-
| <code>3E 00</code> || <code>7E</code> || Tester present, about every 2.15 s
|-
| <code>30 01 07 80 40 00 00</code> || <code>70 01 07</code> || Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
|-
| <code>30 01 07 80 00 00 00</code> || <code>7F 30 22</code> || Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished
|}
The meaning of the four control bytes (80 40 00 00) is not known.

== Open questions ==
* Meaning of reply bytes +5, +7, +8 and the unexplained regions.
* A reliable pressure scale and offset (more gauge readings needed).
* Whether other Suzuki modules use addresses near 0x798 (not checked).
* Why Torque stops after the first line.

== Sources ==
* Owner PCAN-View captures, October 2026.
* Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
* Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
* BigJimny forum thread "JB74 OBD2 connection" (December 2020).

[[Category:Jimny technical]]
[[Category:JB74]]
[[Category:Electrical - gen3]]
[[Category:FAQ - gen3]]
[[Category:Howto - gen3]]

[[Category:Electrical - gen4]]
[[Category:FAQ - gen4]]
[[Category:Howto - gen4]]