DSM 16khz OBD?

[Rhinoman]

Hi
I'm looking for information on the DSM protocol used on my Suzuki Vitara. I'm hoping it may be common to other vehicles. I have an OBD2 connector with a one-wire interface on pin 9. I have captured the data transfer between the immobilizer and the ECU and it looks to be 16KHz 8N1. Data line is at 5V idle. I'm going to make an interface to hook it up to a PC and try and log the datastream.
I get one data exchange when the ignition is turned on, I'm pretty sure that this is the immobilizer, because if I disconnect it the CEL flashes, first byte is 0x99. I also get a second data exchange when the starter is engaged (0x98), maybe airbag? although my model doesn't have any fitted they were fitted to models sold in other countries.
Any clues/ideas gratefully accepted
Cheers
James

[Rhinoman]

The Serial Data Link is a bi-directional one wire interface. The bit rate is 15126 Baud (best approximation) 8n1, messages are 4 bytes long, as described below:

Header, Message Length, Address, Checksum


Send To ECU

Header = $13
Message length = $04
Offset = $00 to unknown (will depend on ECU)
Checksum = all bytes sum to zero

ECU returns

Header = $13
Messsage Length = $04
Data = ?
Csum

The offset is defined by a look up table in the ECU. This implies that there may be commonality between ECUs. The list below shows the addresses that I have determined so far for the EE88 EPROM. The first column is the OBD address, the second column is the actual memory address being read. I modified a microcontroller development board to create the hardware interface. When I have made some 'proper' hardware and interfaced it to my datalogger software then I'll spend some more time on this.

00 $0044
01 $0046
02 $0045
03 $0047
04 $0187
05 $004D = RPM/4 approx.
06 $004E
07 $00D5
08 $0093
09 $00DF
0A $00E0
0B $9803 = Model ID? always returns $EB
0C $0070 = TPS_Raw – TPS_Base??
0D $005B -- TPS
0E $005A -- unknown analogue input
0F $00AF = Inverse to RPM (CAS?)
10 $00FE
11 $00FF
12 $0066 -- Manifold Pressure?
13 $0040
14 $00BA = Fuel enrichment or Idle solenoid period??
15 $00D8
16 $00F3
17 $00EB
18 $00E1
19 $00D9
1A $0058 = Battery Voltage * 0.0737288
1B $0188
1C $0186 = Flags? Bit2 = FP?
1D $0095
1E $0079
1F $0002 this is a PORT?


So read the TPS position send:
$13, $04, $0D, $DC
The ECU will respond with:
$13, $04, Position, Csum

[itsdamo]

In addition to Rhinomans accomlishements thus far I have taken photos of the factory ECU in my 2000 model Suzuki Baleno 1.6
NOTE: These cars are known as Suzuki Esteem in the USA.
I hqave uploaded the main pictures of the ECU but have the link to where more are saved detailed below.

The main processor chip inside is manufactured by Motorola.
It has 160 pins.
The details I read off the chip are as depicted below.

MY0151
"M" (Motorola Symbol)
949927-0151
185
02B11C

I have Googled the details of the chip but have had no luck.
I am led to believe from my previous experience that many chips are made exclusively for the end user. In this case Denso / Suzuki.
Thus no info is publically available... No datasheets...

As Rhinoman has pointed out to me thse look like 68HC16 / 68HC916 chips.

As Rhinoman has already stated the diagnostic (OBD2 ish) connector under the dash has only 3 wires.
+12v power, Ground and DLC.
DLC is apparently a bi directional link.

I have uploaded more of the factory manual specific to the ECU at Untubbed.
http://www.untubbed.com/pics/thumbnails.php?album=125

Can anyone offer any advice on this or if it looks similar to any other known ECU?
Cheers,
Damian

[Rhinoman]

I have the same PCB in a UK version but the processor has what seems to be a more conventional Denso part number beginning with DS151807. I did request the BDM driver package for AN1230/D from Freescale but they say that they no longer support this.