05/20/16

Decoding the SDS protocol on the SV650

So long story short, I replaced my old GPX Pro with an AiM MXL2 dash. One of the nice things is that the dash supports the Suzuki SDS protocol for the GSXR. SDS is sorta like ODBII for cars- if you’ve ever heard of a “K-Line”, well that is pretty much SDS. Long story short, the MXL2 dash can decode some of the sensors (TPS for example) but others are pretty far off (water temp).

I reached out to AiM to see if they could fix it, but they didn’t have the information necessary to fix their decoding of the messages. They suggested reaching out to Suzuki to get the specs, but I don’t know anyone there and nobody I know seems to know anyone there…

Long story short, I’m going to reverse engineer it myself.

I’ve started another little project up on GitHub. Right now it includes some python scripts I’ve written to parse the bytes on the wire and find the individual messages between the ECU and diagnostic tool. Here’s some sample messages:

OK [0.033ms] ToECU: 0x81,0x12,0xf1,0x81 csum:0x05 [5]
OK [0.107ms] FromECU: 0x80,0xf1,0x12,0x03,0xc1,0xea,0x8f csum:0xc0 [8]
OK [0.034ms] ToECU: 0x80,0x12,0xf1,0x02,0x1a,0x91 csum:0x30 [7]
OK [0.092ms] FromECU: 0x80,0xf1,0x12,0x12,0x5a,0x91,0x33,0x32,0x39,0x32,0x30,0x2d,0x31,0x37,0x47,0x32,0x2a,0x00,0x00,0x00,0x00,0x00 csum:0xb8 [23]
OK [0.035ms] ToECU: 0x80,0x12,0xf1,0x02,0x1a,0x91 csum:0x30 [7]
OK [0.091ms] FromECU: 0x80,0xf1,0x12,0x12,0x5a,0x91,0x33,0x32,0x39,0x32,0x30,0x2d,0x31,0x37,0x47,0x32,0x2a,0x00,0x00,0x00,0x00,0x00 csum:0xb8 [23]
OK [0.035ms] ToECU: 0x80,0x12,0xf1,0x02,0x1a,0x91 csum:0x30 [7]
OK [0.093ms] FromECU: 0x80,0xf1,0x12,0x12,0x5a,0x91,0x33,0x32,0x39,0x32,0x30,0x2d,0x31,0x37,0x47,0x32,0x2a,0x00,0x00,0x00,0x00,0x00 csum:0xb8 [23]
OK [0.034ms] ToECU: 0x80,0x12,0xf1,0x02,0x1a,0x9a csum:0x39 [7]
OK [0.092ms] FromECU: 0x80,0xf1,0x12,0x12,0x5a,0x9a,0x33,0x32,0x39,0x32,0x30,0x2d,0x31,0x37,0x47,0x30,0x00,0x00,0x00,0x00,0x00,0x00 csum:0x95 [23]
OK [0.034ms] ToECU: 0x80,0x12,0xf1,0x02,0x1a,0x9a csum:0x39 [7]
OK [0.094ms] FromECU: 0x80,0xf1,0x12,0x12,0x5a,0x9a,0x33,0x32,0x39,0x32,0x30,0x2d,0x31,0x37,0x47,0x30,0x00,0x00,0x00,0x00,0x00,0x00 csum:0x95 [23]
OK [0.030ms] ToECU: 0x80,0x12,0xf1,0x02,0x21,0x08 csum:0xae [7]
OK [0.060ms] FromECU: 0x80,0xf1,0x12,0x34,0x61,0x08,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xff,0xff,0xff,0xff,0x00,0xff,0x43,0xca,0x3f,0x40,0xff,0xa7,0xff,0x00,0xff,0xff,0xff,0xff,0x00,0x00,0x00,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0x47,0x47,0xff,0xff,0xff,0x80,0xff,0xff,0xff,0xff,0x00,0x04,0xff,0xff,0xff csum:0x4a [57]

My next plan is to see if I can hook up both the diagnostic tool and a Teensy + STL9637D chip which in an interface to the “K-Line” signaling used for the SDS protocol. If I can properly decode the messages to/from the ECU using the Teensy I should be able to capture more then ~12 sec of data (one of the limits of my cheap $50 logic analyzer is that it doesn’t have much memory for longer captures).

Once I have that then I can map each byte to a sensor and then start comparing the values on the wire to what is actually being displayed by the cheap-o diagnostic tool and figure out the formula for converting between the two values.

For those curious, here’s the project on GitHub.