Suzuki code reader

[strosek]

Has anyone had any luck coming up with a code reader for the Suzuki motor. The bike people just use the dash for flash codes, but this won't work on the f1000. I can rig up a test connector if anyone knows what protocol Suzuki uses for the SDS. My car has started randomly dieing on the track but it won't due it in the shop. I am hoping some code might point me in the right direction. When it dies it will not restart with the clutch out but will start right back with the starter button.
Thanks,
Eric

[Jon Jeffords]

Call George Dean at GDRE (425) 778-4431
He can give you some suggestions for a remedy for your symptoms. He may have some cheats for reading the DTC's as well.

Is it killing quickly and completely, or sputtering/stumbling/then dying?

[neilca]

Call George Dean at GDRE (425) 778-4431
He can give you some suggestions for a remedy for your symptoms. He may have some cheats for reading the DTC's as well.

Is it killing quickly and completely, or sputtering/stumbling/then dying?

This is very good advice. George is fantastic

[strosek]

It shuts off like you turned of the switch. I suspect the crank sensor, but can't confirm.

[Jon Jeffords]

Per a recent conversation with George regarding the 07/08 GSXR-1000:
1. The only sensor that will kill the engine outright when it goes bad is the crank position sensor. All the other sensors will still allow the engine to run if/when they go bad, but at a reduced performance level.
2. A failed sensor will frequently pass a volt-ohm meter bench test. Don't trust the positive VOM results; replace the suspect sensor with new when troubleshooting.

The fact that it dies quickly without a stumble points a little more to an electrical issue rather than fuel delivery. You indicated "When it dies it will not restart with the clutch out but will start right back with the starter button." So if it suddenly dies with the clutch engaged (engine and rear wheels turning) it will not restart on its own, but if you push the clutch pedal down (disengage the clutch) and hit the starter button, it will start right up without hesitation and have full performance? Is this correct?

Could this be due to a tip-over sensor that was never filled with epoxy?

[strosek]

Have checked the tip sensor, it is filled and I can not shake it, tip it or anything else and make the car die. The car would restart with the starter button only. Dragging the wheels would not restart, but after three or four restarts with the button it would fail to restart and I would have to be pulled off the track. It would restart before I could get the body panels off to check it.

[ghickman]

My guess is a bad crank position sensor.

I'm going to assume you tried a different ECU?

Is this car equipped with a Geartronics or Flatshifter?

[strosek]

It does have a flat shifter.

[ghickman]

It does have a flat shifter.

As I recall the Flatshifter does a coil cut.....or is it fuel? Could this somehow be the cause?

I'd at a minimum remove it from the circuit just for trouble shooting process of elimination...or maybe you've already done that.

Other than the Crank pos. sensor the Suzuki 07/08 is near bullet proof. Frankly I've only had one CPS go bad in 9 years of running this config.

[jchracer]

The Flatshifter does a coil cut. I had this problem when the Flatshifter control box would get hot. Problem goes away when box cools down. Moved box to a cool location and helped but did not eliminate the issue.

[Jon Jeffords]

Eric, your previous comments below would seem to be consistent with jhc's experience in which the Flatshifter control box is overheating and causing an unwanted ignition coil cut.

"My car has started randomly dying on the track but it won't do it in the shop."
"…after three or four restarts with the button it would fail to restart and I would have to be pulled off the track. It would restart before I could get the body panels off to check it."

[strosek]

Yes that is a possibility. The last time I got towed off the track I had left the body panel off so I could get to thing quickly, I have the Flatshifter plugged into the ign coils with male and female spades so I can remove quickly, I took it out of the loop and it still would not start. After messing with the car for about ten minutes it started and ran again. I am planning on using a heatgun on the cranksensor and see if I can get a fail. I will try the same on the Flatshifter.

[ghickman]

Don't you just love chasing intermittent problems down, especially electrical

[JJLudemann]

If you're really interested in using the Suzuki ECU protocol, here's a file full of notes I gathered from various places on the internet while doing the same thing. I was successful. If you're using an Arduino, I could send you the code to do it. Good luck!

-JJ

https://forum.arduino.cc/index.php?topic=236092.30

Here are the steps that need to happen. In my case, I used a variable called mode to step through my code.

1. fastinit(); Using pinmode, and HIGH and LOW
2. send message = 0x81,0x12,0xF1,0x81,0x05
3. wait for response 80 F1 12 03 C1 EA 8F C0
4. send data request 0x80,0x12,0xF1,0x02,0x21,0x08,0xAE
5. read incoming data "I believe you will receive 56 bytes back
6. store results
7. repeat steps 4 through 6 over and over as long as you are getting response from the ECU.

I am not sure how to properly stop communication but, I do know that there is a message that can be sent to do it.




/////////////// decoding protocol values ///////////////////////////////////////

/////////////// mode 2 (read Values) //////////////////////////////////////////
int const engine_value[9] = {
((rx_data[15] / 50.5) * 9.2) - 14.7,
(rx_data[17]*256 + rx_data[18]) / 2.56,
125*(rx_data[19]-55)/(256-55),
rx_data[20]*4*0.136,
1.1 * (rx_data[21] - 15),
1.1 * (rx_data[22] - 15),
rx_data[23] - rx_data[20]*4*0.136,
rx_data[24]/12.7,
rx_data[26],
};
String const engine_value_desc[] = {
"boost ",
"rpm ",
"tps ",
"ip ",
"ect ",
"iat ",
"iap ",
"bat ",
"gear ",
};


Boost: 15
RPM: 17
Throttle Position: 19
Intake Air Pressure 1: 20
Engine Coolant Temp: 21
Intake Air Temp: 22
Intake Air Pressure: 23
Battery: 24
Gear: 26
Intake Air Pressure 2: 27
Second Throttle Pos: 46

RPM = Value*100/255
Throttle position (°) = Value*125/255
Manifold pressure = (Value*5 - 153)*133/4/255
Temperature (C) = Value*160/255 - 30
Temperature (F) = Value*288/255 - 22
Voltage = Value*20/255
Secondary throttle position (%) = Value*100/255
EXCVA sensor = Value*100/255

=================================================

http://ecuhacking.activeboard.com/t2.../sds-protocol/

Command Response

Wakeup
81 12 F1 81 05 80 F1 12 03 C1 EA 8F C0

Model number? Model number
80 12 F1 02 1A 9A 39 80 F1 12 12 5A 9A 33 32 39 32 30 2D 31 38 48 32 00 00 00 00 00 00 99

Request Model number
80 12 F1 02 1A 91 30 80 F1 12 12 5A 91 33 32 39 32 30 2D 31 38 48 32 2A 00 00 00 00 00 BA

Keep alive Pair repeats forever
80 12 F1 01 3E C2 80 F1 12 01 7E 02

Data Monitor Returns 21 sensor values
80 12 F1 02 21 08 AE 80 F1 12 34 61 08 0C 16 50 E0 17 50 E1 FF FF FF FF 00 00 01 FF 00 00 FF 00 FF 00 FF
7C FF 00 00 00 00 00 00 00 00 FF FF 40 40 40 40 FF 00 FF FF 26 00 00 01 22 FF FF D0

Disconnect
80 12 F1 01 82 06 80 F1 12 01 C2 46


From Tester: 80 12 F1
From ECU: 80 F1 12
4th byte: # Data bytes
Last byte: Checksum = sum all bytes && FF
Command bytes are responded with same byte OR'd 0x40
Tester: F1
ECU: 12



ISO 14230-2 Commands
--------------------

10 Start Diagnostic Session
11 ECU Reset
12 Read Freeze Frame Data
13 Read Diagnostic Trouble Codes
14 Clear Diagnostic Information
17 Read Status Of Diagnostic Trouble Codes
18 Read Diagnostic Trouble Codes By Status
1A Read Ecu Id
20 Stop Diagnostic Session
21 Read Data By Local Id
22 Read Data By Common Id
23 Read Memory By Address
25 Stop Repeated Data Transmission
26 Set Data Rates
27 Security Access
2C Dynamically Define Local Id
2E Write Data By Common Id
2F Input Output Control By Common Id
30 Input Output Control By Local Id
31 Start Routine By Local ID
32 Stop Routine By Local ID
33 Request Routine Results By Local Id
34 Request Download
35 Request Upload
36 Transfer data
37 Request transfer exit
38 Start Routine By Address
39 Stop Routine By Address
3A Request Routine Results By Address
3B Write Data By Local Id
3D Write Memory By Address
3E Tester Present
81 -> xx xx Start Communication
82 Stop Communication
83 Access Timing Parameters
85 Start Programming Mode

=============================================

Fastinit:
______ _____ ____ ____
----------\_____/ \/\/\/\/ \/\/\/\/
300ms 25ms 25ms packet response

1) Wait for 300ms with K line high.
2) Pull K line low for 25 +/- 1 ms
3) Let K line rise high and wait 25ms
4) init serial connection to 10400 baud, 8N1, 1=0Volt 0=12Volt, least significant bit first
5) send package c1 33 f1 81 66 33=dest, f1=our tester id, 81=start comms
6) wait for response 83 f1 01 c1 e9 8f ae 01=physical address, c1=response ok (7f=fail), e9=kb1, 8f=kb2


Slowinit:

_______ S ___ 2 3 ___ 6 7 ___ ___ ____
------------\_/0 1\___/4 5\___/P \/\/\/\/ \/\/\/\/
300ms 200 400 400 400 400 250 packet response

1) Wait for 300ms with K line high.
2) send a byte 33 hex at 5 baud. 200ms per bit
startbit: 200ms low
databit0,1: 400ms high
databit2,3: 400ms low
databit4,5: 400ms high
databit6,7: 400ms low
stopbit+pause: 250ms high
4) init serial connection to 10400 baud, 8N1, 1=0Volt 0=12Volt, least significant bit first
5) send package c1 33 f1 81 66 33=dest, f1=our tester id, 81=start comms
6) wait for response 83 f1 01 c1 e9 8f ae 01=physical address, c1=response ok (7f=fail), e9=kb1, 8f=kb2

The comm protocol itself was figured out by RR several posts back. Basically its:
Command 80, destination, source, # of data bytes, data bytes, checksum.
The starting packet is a little different, using Command 81 instead of 80 and not showing a data byte count.

===================================

http://freediag.sourceforge.net/Scantool-Manual.html


Data Monitor Response
---------------------
Byte Value
1 80
2 f1
3 12
4 34
5 61
6 08
7
8
9
10
11
12
13
14
15
16
17
18 RPM Hi
19 RPM Lo
20 TPS
21 IP
22 ECT
23 IAT
24 AP
25 Batt
26 O2
27 Gear
28
29 Idle Speed Target
30 ISC Valve Position
31
32 Fuel Hi 1
33 Fuel Lo 1
34 Fuel Hi 2
35 Fuel Lo 2
36 Fuel Hi 3
37 Fuel Lo 3
38 Fuel Hi 4
39 Fuel Lo 4
40
41
42
43
44
45
46
47 STP (Secondary Throttle Pos)
48
49
50
51 Mode ABC
52 PAIR
53 Motor Start / Clutch
54 NT mumble_on
55
56

-------------------------------------------------------------------------------

Packets

Send command packet:
header: [c0+cmdlen] [destination=33] [source=f1]
data: [cmd0] [cmd1] ... [cmd(cmdlen-1)]
checksum: [sum(header)+sum(data)]

cmd0 = service ID
cmd1 = PID

Received response packet on success:
header: [80+datalen] [destination=f1] [source=01]
data: [40+cmd0] [cmd1] ... [cmd(cmdlen-1)] [result0] [result1] ... [result(datalen-cmdlen-1)]
checksum: [sum(header)+sum(data)]

Received response packet on failure:
header: [80+datalen] [destination=f1] [source=01]
data: [errorcode=7f] [cmd0] [Response Failure Code, see below]
checksum: [sum(header)+sum(data)]

Multibyte data is sent high byte first.


Tester Commands

request and response packet diagram format:
cmd0 cmd1 ... -> result0 result1 ... comment
Note: only the data of the request and only the result of the response are show.

yy 00 -> xx xx xx xx bitmask of capabilities for mode yy, bit7 represents pid 1, bit6 pid 2, etc, if
data4:bit0 is set then pid 20 contains capabilities for pid 21-40


00-0F: SAE J1979 Diagnostic Test Modes
01 00 -> xx xx xx xx capabilites
01 01 -> [b7: MIL light, b0-6: dtc count] [b4-7: readiness] [b5: o2monitoring] [b0-7: readiness]
01 03 -> xx xx Fuel System Status bitmap b0:Open, b1:Closed, b2:Open-Driving, b3:Open-Fault, b4:Closed-Fault
01 04 -> xx Calculated Load Value % x*100.0/255
01 05 -> xx Engine Coolant Temperature C x-40
01 06 -> xx Short term fuel trim Bank 1 % x*(100.0/128)-100
01 07 -> xx Long term fuel trim Bank 1 % x*(100.0/128)-100
01 08 -> Short term fuel trim Bank 2 % x*(100.0/128)-100
01 09 -> Long term fuel trim Bank 2 % x*(100.0/128)-100
01 0a -> Fuel Pressure kPaG x*3
01 0b -> xx Intake Manifold Pressure kPaA x
01 0c -> xx xx Engine RPM RPM x*0.25
01 0d -> xx Vehicle Speed km/h x
01 0e -> xx Ignition timing advance Cyl #1 deg X*0.5-64
01 0f -> xx Intake Air Temperature C X-40
01 10 -> xx xx Air Flow Rate gm/s X*0.01
01 11 -> xx Absolute Throttle Position % X*(100.0/255)
01 12 -> xx Commanded secondary air status
01 13 -> xx Oxygen sensor locations bitmap b0=sensor1, b1=sensor2, ..., b7=sensor8
01 14 -> xx yy Bank 1 Sensor 1 Voltage/Trim V, % x*0.005, if y!=ff then y*(100.0/128)-100)
01 15 -> xx yy Bank 1 Sensor 2 Voltage/Trim V, % x*0.005, if y!=ff then y*(100.0/128)-100)
01 16 -> Bank 1 Sensor 3 Voltage/Trim V, % x*0.005, if y!=ff then y*(100.0/128)-100)
01 17 -> Bank 1 Sensor 4 Voltage/Trim V, % x*0.005, if y!=ff then y*(100.0/128)-100)
01 18 -> Bank 2 Sensor 1 Voltage/Trim V, % x*0.005, if y!=ff then y*(100.0/128)-100)
01 19 -> Bank 2 Sensor 2 Voltage/Trim V, % x*0.005, if y!=ff then y*(100.0/128)-100)
01 1a -> Bank 2 Sensor 3 Voltage/Trim V, % x*0.005, if y!=ff then y*(100.0/128)-100)
01 1b -> Bank 2 Sensor 4 Voltage/Trim V, % x*0.005, if y!=ff then y*(100.0/128)-100)
01 1c -> xx Auxiliary Input Status bitmap b0:PTO Active
01 20 -> xx xx xx xx capabilities
01 21 -> xx xx


02 00 00 -> xx xx xx xx capabilites SMART: 2 3 4 5 6 7 b c d
02 02 00 -> [dtc1h] [dtc1l] DTC that caused freezeframe


03 -> [dtc1h] [dtc1l] 00 00 00 00


05 00 00 -> xx xx xx xx capabilites


06 00 -> xx xx xx xx capabilites

06 yy -> [max=01,min=81] [valH] [valL] [limitH] [limitL] example 01 00 23 01 2c is value 23 (=35 dec)
with limit maximum 12c (=300 dec)

06 01 -> xx xx xx xx xx ncms
06 02 -> xx xx xx xx xx ncms
06 09 -> 01 xx xx xx xx -> 81 xx xx xx xx ncms


07 -> 00 00 00 00 00 00 cms


08 00 00 00 00 00 00 -> xx xx xx xx capabilites SMART: none


09 00 -> 01 30 00 00 00 capabilites 5 bytes???


10 Start Diagnostic Session
11 ECU Reset
12 Read Freeze Frame Data
13 Read Diagnostic Trouble Codes
14 Clear Diagnostic Information
17 Read Status Of Diagnostic Trouble Codes
18 Read Diagnostic Trouble Codes By Status
1A Read Ecu Id
20 Stop Diagnostic Session
21 Read Data By Local Id
22 Read Data By Common Id
23 Read Memory By Address
25 Stop Repeated Data Transmission
26 Set Data Rates
27 Security Access
2C Dynamically Define Local Id
2E Write Data By Common Id
2F Input Output Control By Common Id
30 Input Output Control By Local Id
31 Start Routine By Local ID
32 Stop Routine By Local ID
33 Request Routine Results By Local Id
34 Request Download
35 Request Upload
36 Transfer data
37 Request transfer exit
38 Start Routine By Address
39 Stop Routine By Address
3A Request Routine Results By Address
3B Write Data By Local Id
3D Write Memory By Address
3E Tester Present
81 -> xx xx Start Communication
82 Stop Communication
83 Access Timing Parameters
85 Start Programming Mode


Response Failure Codes

10 General Reject
11 Service Not Supported
12 Sub Function Not Supported - Invalid Format
21 Busy - repeat Request
22 Conditions Not Correct Or Request Sequence Error
23 Routine Not Complete Or Service In Progress
31 Request Out Of Range
33 Security Access Denied - security Access Requested
35 Invalid Key
36 Exceed Number Of Attempts
37 Required Time Delay Not Expired
40 Download Not Accepted
41 Improper Download Type
42 Can Not Download To Specified Address
43 Can Not Download Number Of Bytes Requested
50 Upload Not Accepted
51 Improper Upload Type
52 Can Not Upload From Specified Address
53 Can Not Upload Number Of Bytes Requested
71 Transfer Suspended
72 Transfer Aborted
74 Illegal Address In Block Transfer
75 Illegal Byte Count In Block Transfer
76 Illegal Block Trasnfer Type
77 Block Transfer Data Checksum Error
78 Request Correcty Rcvd - Rsp Pending
79 Incorrect Byte Count During Block Transfer
80 Service Not Supported In Active Diagnostic Mode
C1 Start Comms +ve response
C2 Stop Comms +ve response
C3 Access Timing Params +ve response
81-8F Reserved
90-F9 Vehicle manufacturer specific
FA-FE System supplier specific
FF Reserved by document


Sample scan obtained of a SMART FOR TWO car

--wakeup
81 -> e9 8f
--get capabilities
01 00 -> b2 3f f8 11 capabilities service 1: 1 3 4 5 6 7 b v d e f 10 11 12 13 14 15 1c 20
01 20 -> 80 00 00 00 capabilities service 1: 21
02 00 00 -> 7e 38 00 00 capabilities service 2: 2 3 4 5 6 7 b c d
05 00 00 -> 7f 05 11 capabilities service 5: none
06 00 -> ff c0 80 00 capabilities service 6: 1 2 3 4 5 6 7 8 9 a 11
08 00 00 00 00 00 00 -> 7f 08 11 capabilities service 8: none
09 00 -> 01 30 00 00 00 ???? expected 4 byte response...
--get status
01 01 -> 01 07 69 00 MIL light off, 1 dtc, ready, no 02monotoring
--get dtc's
03 -> 07 02 00 00 00 00 dtc P0702
--scan sensors
01 03
01 04
01 05 -> 3a engine coolant temp = 18C (3a=58 dec - 40 dec)
01 06
01 07
01 0b
01 0c
01 0d
01 0e
01 0f
01 10
01 11
01 12
01 13 -> 03 2 sensors
01 14
01 15
01 1c
01 20 -> 80 00 00 00 (always same: capabilities 21-40)
01 21 -> 00 37

[strosek]

Thanks JJ, I will check that out.