Suzuki Jimny JB74 (2018+) - Reading TPMS data over the diagnostic CAN link

Support this project: The information on this page is free, but it took a lot of work to gather, test and write up. If it has been useful to you, you can say thanks with a donation at buymeacoffee.com/bigjimny.

Overview

Purpose-built diagnostic tools (Autel, Launch and similar) already support Suzuki comprehensively. There is also a trend towards replacing the factory head unit with an Android media unit that can run apps to read and display information from the car's electronics. These units are not Suzuki-specific, so this project aims to learn how to read vehicle data (starting with the factory TPMS) and show it on the head unit.

Equipment

Role	Item
Head unit	XTRONS PX90
OBD-II Bluetooth dongle 1	Generic ELM-based (Chinese)
OBD-II Bluetooth dongle 2	Veepeak OBDCheck BLE+
CAN bus monitor (Windows)	PCAN-View (PEAK-System)
Diagnostic tool 1	Launch X431 CRP919
Diagnostic tool 2	SZ Viewer app
Head-unit apps being tried	Torque, RealDash

Method

1. The diagnostic tools (Launch X431, SZ Viewer) have comprehensive Suzuki support, so they are used to generate the CAN bus requests.
2. PCAN-View is connected to the OBD socket to capture the requests and the module's replies, which are then decoded by hand.
3. The decoded requests are recreated in the head-unit apps so the head unit can ask the car for the same data directly.

Status: work in progress. Based on one RHD UK-market 2021 Jimny with factory TPMS, owner-made PCAN-View captures, and the Suzuki wiring diagrams (A-8 CAN communication and A-8 Central Gateway/DLC). Items marked unconfirmed are not yet verified.

Summary

• The TPMS control module answers an ordinary diagnostic request on the OBD socket. It does not broadcast tyre data.
• Request ID 0x798, reply ID 0x7A8, 11-bit CAN, 500 kbit/s, ISO-TP framing.
• Service 0x21 (read data by local identifier), identifier 0x00, returns 102 bytes containing all four sensor records.
• The OBD socket is fed by a central gateway, so only diagnostic traffic is visible on it.

DLC (OBD socket) wiring

The service-manual diagram numbers the DLC terminals differently from SAE J1962. In all five cases on the diagram, manual terminal n matches standard pin 17 - n.

Manual terminal	Standard pin	Function	Wire / source on diagram
1	16	Battery +12 V	GRY, fuse No.49 "DOME2" (10 A)
12	5	Signal ground	BLK
13	4	Chassis ground	BLK
11	6	CAN-H (from standard assignment)	BLU, gateway pin 8
3	14	CAN-L (from standard assignment)	WHT, gateway pin 7

Use pins 6 and 14 for a CAN adapter. The diagram does not label CAN-H and CAN-L itself.

Cross-check with other reports

A BigJimny forum thread ("JB74 OBD2 connection", December 2020) describes a 2020 JB74 whose OBD plug had pins 4, 5, 6, 14, 15 and 16 wired, with pin 7 (K-line) not wired. The poster, quoting an older Suzuki pinout, lists pin 6 as a blue wire (CAN-H) and pin 14 as a white wire (CAN-L). This matches the table above: a blue CAN wire on pin 6 and a white one on pin 14.

• The CAN-H/CAN-L assignment in that thread comes from a pinout reference that the poster says predates the JB74, so it is a report, not a measurement.
• No wire for standard pin 7 (K-line) appears on the diagram page above, and the forum report also found it unwired. K-line is therefore unlikely to be available on the JB74 socket.
• On the forum poster's car, pin 15 was also wired; the diagram page above shows no wire for it. This may be a market or model-year difference.

Network layout

The DLC is not on the vehicle bus directly. The central gateway control module joins the vehicle CAN bus (its pins 20 and 21, RED/WHT) and provides a separate CAN pair to the DLC (its pins 8 and 7, BLU/WHT).

Modules on the vehicle bus (diagram): ECM, 4WD control module, TCM (A/T models), BCM, ESP control module, headlight auto levelling module (if equipped), dual sensor brake support control module (if equipped), P/S control module, steering angle sensor, TPMS control module / receiver (if equipped), combination meter, SDM, combination switch.

Gateway power: fuse No.60 "IG1 SIG" (10 A) and fuse No.52 "CONT" (5 A). Treat the ignition as needing to be on.

Observation: two captures from the DLC contained only IDs 0x798 and 0x7A8 (plus two error frames). No broadcast traffic from other modules was seen, so passive listening on the DLC will not show TPMS data.

Diagnostic requests seen

Request	Reply	Meaning
3E	7E	Tester present
1A 8A	5A 8A + ASCII 37120-78R0*	ECU identification
1A 8E	5A 8E + ASCII 37160-61M0	ECU identification: matches the "Model No. P61M0" printed on the TPMS controller label
18 00 FF 00	58 00 or 58 01 9A 31 E0	Read DTCs by status (second form = one code reported; not decoded)
21 00	61 00 + 100 bytes	Sensor data block (repeated about twice a second by the scan tool)

Part labels on the test car: TPMS controller 37160-78R00, "BASE ASSY-TPMS", Model No. P61M0, Continental A2C13930301, 433.92 MHz; central gateway controller 33580-79R01. The 1A 8E reply (37160-61M0) matches the TPMS controller's base number and model number; the 1A 8A reply (37120-78R0*) shares "78R0" with its full part number but its meaning is not confirmed

Reading it with an ELM327

Terminal commands, one at a time (CR line ending):

ATZ
ATSP6
ATSH798
ATS0
ATL0
ATFCSH798
ATFCSD300000
ATFCSM1
2100

• ATSH798 sets the request address. The reply address (0x7A8) is worked out automatically.
• ATFCSH798 / ATFCSD300000 / ATFCSM1 make the adapter send the ISO-TP flow-control frame (30 00 00) itself.
• ATS0 removes the spaces between bytes.Without it, the generic Chinese ELM327-based dongle (dongle 1) reported BUFFER FULL near byte 81.
• Expected output: a length line (066 = 102 bytes) and numbered lines 0: to E:.
• With default settings dongle 1 returned only the first line (61 00 xx 01 00 00).

Reply layout (21 00)

Byte positions count the 61 as byte 0.

Bytes	Content
0-1	61 00 (positive reply)
2	Varies 117-142. Looks like system voltage x 10 (unconfirmed)
12-21	Sensor record 1: front left
22-31	Sensor record 2: rear left
32-41	Sensor record 3: rear right
42-51	Sensor record 4: front right
56-71	Four 4-byte sensor-ID entries whose contents change (meaning unknown)
other	Not decoded

Sensor record (10 bytes)

Offset	Content
+0 to +3	Sensor ID
+4	Position flag
+5	Value 57-74. Behaves like temperature, possibly with an offset of 40 (unconfirmed)
+6	Pressure candidate (see calibration)
+7, +8	Not understood
+9	Always 0

Wheel	Sensor ID	Position flag
Front left	4E AA 09 43	0x10
Rear left	DD 91 B5 25	0x20
Rear right	4E AA 03 19	0x18
Front right	4E AA 09 C9	0x08

Sensor IDs are specific to one car. Yours will differ.

Calibration

Byte +6 against gauge readings (bar). The five deflation-test counts were reconstructed from the app's displayed values.

Raw	Gauge (bar)	Raw x 0.01372
136 (rear left)	1.868	1.866
131 (rear right)	1.795	1.797
131 (front right)	1.795	1.797
126	1.73	1.729
119	1.63	1.633
112	1.54	1.537
101	1.39	1.386
96	1.29	1.317

The last five rows are from one tyre during a slow deflation (assumed front left).

• bar = raw x 0.01372
• psi = raw x 0.199

No offset is needed, which suggests the byte holds gauge pressure. All points are within 0.004 bar except the lowest (0.027 bar off), which may be sensor update lag or slight non-linearity. More readings at low and high pressure are needed.

Torque Pro custom PIDs

Common fields for every wheel:

Field	Value
Header	798
Mode and PID	2100
Diagnostic start command	ATS0, ATL0, ATFCSH798, ATFCSD300000, ATFCSM1 (comma-separated)
Unit / min / max	bar, 0, 4 (or psi, 0, 60)

Equation uses a letter for each data byte. A is the first byte after 61 00 (reply byte 2).

Wheel	Byte +5 (temperature?)	Byte +6 (pressure candidate)
Front left	P	Q
Front right	AT	AU
Rear left	Z	AA
Rear right	AJ	AK

Example: Q*0.01372. Letters must be upper case. Whether Torque accepts two-letter variables is unconfirmed.

Known problem

Using dongle 1 (generic Chinese ELM327-based) with Torque Pro on the XTRONS PX90, Torque read bytes A to D (first line of the reply) correctly, but every byte from E onward returned -1, even though a terminal received the full 102 bytes with the same commands. The start-command field is applied (adding ATH1 changed the output). Tried without success: turning off "Faster communication", removing ATS0. Not yet tried: ATAT0, ATSTFF timeout settings, other apps, and the Veepeak OBDCheck BLE+ (dongle 2).. Unresolved. The same result occurred with the Veepeak OBDCheck BLE+ (dongle 2). Car Scanner Pro does not have this problem (see below).

Car Scanner Pro (working)

Car Scanner Pro reads all the bytes where Torque Pro fails. Custom PID settings used:

• Header: 798
• Request: 2100
• Start command (backslash-separated): ATAT0\ATSTFF\ATS0\ATL0\ATFCSH798\ATFCSD300000\ATFCSM1
• Equations use the same letters as the table above, for example Q*0.01372 for front left (bar)

The start command has not yet been shortened. Adapter: Both dongle 1 (generic ELM327-based) and dongle 2 (Veepeak OBDCheck BLE+) work with Car Scanner Pro.

Other modules found by a full scan

A full health-check scan with a Launch X431 CRP919, captured with PCAN-View on the OBD socket, shows 12 modules answering on the DLC. Every module that replied is listed here. The reply ID is not always the request ID plus 8.

Request	Reply	Protocol	Identification replies	Module	How identified
0x7E0	0x7E8	KWP	33980-78R0, 33980-78RC*	ECM	Standard engine address
0x261	0x661	KWP	56100-77RA, 56100-78RF*	ABS (inferred)	Only brake module left by elimination
0x263	0x663	KWP	38720-77R0, 38720-77R0*	EPS controller	Parts catalogue
0x271	0x671	KWP	36775-77R0, 36775-77RC*	Body control module	Parts catalogue
0x274	0x674	KWP	34100-78R0, 34110-78RD*	Instrument cluster	Rev counter sweep test
0x798	0x7A8	KWP	37160-61M0, 37120-78R0*	TPMS controller	Label and parts catalogue
0x79A	0x7AA	KWP	37210-74PA, 37210-74PE*	Lighting and turn switch	Parts catalogue
0x778	0x788	KWP	33990-52R0, 33990-78R8*	Dual sensor brake support	Parts catalogue
0x793	0x7A3	UDS	38910-77R0, 38910-78RC*	Airbag (SRS) controller	Parts catalogue
0x772	0x782	UDS	38885-77R0, 38885-78R0*	4WD shift controller	Parts catalogue
0x799	0x7A9	UDS	38960-78RA, 38960-78RA*	E-call controller	Parts catalogue
0x751	0x761	UDS	33580-79R0, 33580-78R0*	Central gateway	Label and parts catalogue

Reply ID offsets: engine +0x08; 0x261 to 0x274 +0x400; all others +0x10.

• KWP-style modules answer 1A 8E and 1A 8A (identification) and 18 00 FF 00 (DTCs). UDS-style modules answer 22 F1 01 and 22 F1 88 (identification) and 19 02 FF (DTCs).
• Requests to 0x273 and 0x262 (tester present) got no reply, so those modules are probably not fitted.
• The "probable" and "possible" names are guesses from the part-number series and are not confirmed.

Instrument cluster output test (0x274 / 0x674)

A rev counter sweep commanded by the Launch X431 appears as a single KWP output-control request, after which the cluster sweeps the needle up and down by itself:

Request	Reply	Notes
3E 00	7E	Tester present, about every 2.15 s
30 01 07 80 40 00 00	70 01 07	Starts the sweep (service 0x30, local ID 01, "short-term adjustment")
30 01 07 80 00 00 00	7F 30 22	Refused ("conditions not correct"); possibly a stop request sent after the sweep had finished

The meaning of the four control bytes (80 40 00 00) is not known.

Open questions

• Meaning of reply bytes +5, +7, +8 and the unexplained regions.
• A reliable pressure scale and offset (more gauge readings needed).
• Whether other Suzuki modules use addresses near 0x798 (not checked).
• Why Torque stops after the first line.

Sources

• Owner PCAN-View captures, October 2026.
• Suzuki wiring diagrams: A-8 CAN communication system; A-8 Central Gateway Control and DLC System (RHD).
• Forum thread "Jimny JB74 (2019+) - Torque Pro PID for TPMS".
• BigJimny forum thread "JB74 OBD2 connection" (December 2020).