Suzuki Jimny JB74 (2021) - Reading TPMS data over the diagnostic CAN link

Status: work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures, and the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC). Items marked unconfirmed are not yet verified.

Summary

• The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
• Request ID 0x798, reply ID 0x7A8, 11-bit CAN, 500 kbit/s, ISO-TP framing.
• Service 0x21 (read data by local identifier), identifier 0x00, returns 102 bytes containing all four sensor records.
• The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.

DLC (OBD socket) wiring

The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal n matches standard pin 17 - n.

Manual terminal	Standard pin	Function	Wire / source on diagram
1	16	Battery +12 V	GRY, fuse No.49 "DOME2" (10 A)
12	5	Signal ground	BLK
13	4	Chassis ground	BLK
11	6	CAN-H (from standard assignment)	BLU, gateway pin 8
3	14	CAN-L (from standard assignment)	WHT, gateway pin 7

Use pins 6 and 14 for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

Network layout

The DLC is not on the vehicle bus directly. The central gateway control module joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

Diagnostic requests seen

Request	Reply	Meaning
3E	7E	Tester present
1A 8A	5A 8A + ASCII 37120-78R0*	ECU identification
1A 8E	5A 8E + ASCII 37160-61M0	ECU identification
18 00 FF 00	58 00 or 58 01 9A 31 E0	Read DTCs by status (second form = one code reported; not decoded)
21 00	61 00 + 100 bytes	Sensor data block (repeated about twice a second by the scan tool)

Reading it with an ELM327

Terminal commands, one at a time (CR line ending):

ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100

• ATSH798 sets the request address. The reply address (0x7A8) is worked out automatically.
• ATFCSH798 / ATFCSD300000 / ATFCSM1 make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
• ATS0 removes the spaces between bytes. Without it, one clone adapter reported BUFFER FULL near byte 81.
• Expected output: a length line (066 = 102 bytes) and numbered lines 0: to E:.
• With default settings the same adapter returned only the first line (61 00 xx 01 00 00).

Reply layout (21 00)

Byte positions count the 61 as byte 0.

Bytes	Content
0-1	61 00 (positive reply)
2	Varies 117-142. Looks like system voltage x 10 (unconfirmed)
12-21	Sensor record 1: front left
22-31	Sensor record 2: rear left
32-41	Sensor record 3: rear right
42-51	Sensor record 4: front right
56-71	Four 4-byte sensor-ID entries whose contents change (meaning unknown)
other	Not decoded

Sensor record (10 bytes)

Offset	Content
+0 to +3	Sensor ID
+4	Position flag
+5	Value 57-74. Behaves like temperature, possibly with an offset of 40 (unconfirmed)
+6	Pressure candidate (see calibration)
+7, +8	Not understood
+9	Always 0

Wheel	Sensor ID	Position flag
Front left	4E AA 09 43	0x10
Rear left	DD 91 B5 25	0x20
Rear right	4E AA 03 19	0x18
Front right	4E AA 09 C9	0x08

Sensor IDs are specific to one car. Yours will differ.

Calibration (provisional)

Byte +6 against gauge readings:

Raw	Gauge
136 (rear left)	1.868 bar
131 (rear right)	1.795 bar
131 (front right)	1.795 bar
128 (front left, start)	about 25 psi (from memory)
110 (front left, lowest)	about 21 psi (from memory)

Straight-line fit through these points:

• bar = raw x 0.01627 - 0.344
• psi = raw x 0.236 - 5

The two front-left gauge values were remembered, not recorded, and most of the fit comes from them. Treat the equations as an estimate to be replaced by better data.

Torque Pro custom PIDs

Common fields for every wheel:

Field	Value
Header	798
Mode and PID	2100
Diagnostic start command	ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1 (comma-separated)
Unit / min / max	bar, 0, 4 (or psi, 0, 60)

Equation uses a letter for each data byte. A is the first byte after 61 00 (reply byte 2).

Wheel	Byte +5 (temperature?)	Byte +6 (pressure candidate)
Front left	P	Q
Front right	AT	AU
Rear left	Z	AA
Rear right	AJ	AK

Example: Q*0.01627-0.344. Letters must be upper case. Whether Torque accepts two-letter variables is unconfirmed.

Known problem

On the test setup Torque read bytes A to D (first line of the reply) correctly, but every byte from E onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding ATH1 changed the output). Tried without success: turning off "Faster communication", removing ATS0. Not yet tried: ATAT0, ATSTFF timeout settings, other apps, other adapters. Unresolved.

Open questions

• Meaning of reply bytes +5, +7, +8 and the unexplained regions.
• A reliable pressure scale and offset (more gauge readings needed).
• Whether other Suzuki modules use addresses near 0x798 (not checked).
• Why Torque stops after the first line.

Sources

• Owner PCAN-View captures, October 2026.
• Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
• Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".