OBD-II Diagnostics

What is OBD-II?

On-Board Diagnostics II (OBD-II) is a standardized vehicle diagnostics protocol required by law on all US vehicles sold after January 1, 1996. The 16-pin OBD-II connector (SAE J1962), typically located within 2 feet of the steering wheel under the driver's dashboard, provides access to the vehicle's electronic control units (ECUs) for emissions-related diagnostics.

OBD-II was mandated by the California Air Resources Board (CARB) and the EPA to ensure that vehicles could be diagnosed for emissions compliance using standardized tools. Before OBD-II, each manufacturer had proprietary diagnostic connectors and codes — a mechanic needed different scan tools for each brand. OBD-II unified this into a single standard.

The J1962 Connector

The OBD-II connector is a 16-pin trapezoidal connector (SAE J1962) with specific pin assignments:

• Pin 2: SAE J1850 Bus+ (Ford)
• Pin 4: Chassis ground
• Pin 5: Signal ground
• Pin 6: CAN High (ISO 15765-4)
• Pin 7: K-Line (ISO 9141-2, ISO 14230)
• Pin 10: SAE J1850 Bus− (GM)
• Pin 14: CAN Low (ISO 15765-4)
• Pin 15: L-Line (ISO 9141-2)
• Pin 16: Battery power (+12V, always on)

Not all pins are used by every vehicle — different manufacturers use different protocols. A scan tool must auto-detect the protocol by probing the relevant pins.

Communication Protocols

Different manufacturers used different protocols, leading to fragmentation. OBD-II mandated protocol auto-detection so a single scan tool works on all vehicles:

• J1850 PWM (42 kbps): Ford vehicles. Differential signaling on pins 2 and 10. Variable pulse width modulation. Uses VPW encoding for data
• J1850 VPW (10.4 kbps): GM and Chrysler vehicles. Single-wire on pin 10. Variable pulse width. Simpler than PWM but slower
• ISO 9141-2 (10.4 kbps): Chrysler, European, and Asian vehicles. Uses K-Line (pin 7) for bidirectional communication. Asynchronous serial (UART-based). Initialization requires a 5-baud slow-key sequence
• ISO 14230 KWP2000 (10.4 kbps): Enhanced version of ISO 9141. Key Word Protocol 2000. Faster initialization, more diagnostic services. Used widely in European vehicles
• ISO 15765 CAN (250–500 kbps): All vehicles manufactured after 2008 in the US. Uses CAN bus on pins 6 and 14. Supports 8-byte frames at 500 kbps. The dominant protocol for modern vehicles

Diagnostic Trouble Codes (DTCs)

When a problem is detected, the ECU stores a Diagnostic Trouble Code (DTC) and illuminates the Check Engine Light (MIL — Malfunction Indicator Lamp). Codes follow a standardized format:

DTC Format: P0301

P = System:
  P = Powertrain (engine/transmission)
  B = Body (airbags, seats, A/C)
  C = Chassis (ABS, steering, suspension)
  U = Network (CAN, LIN, communication)

0 = Type:
  0 = Generic/SAE (same across all manufacturers)
  1 = Manufacturer-specific

3 = Subsystem:
  1 = Fuel and air metering
  2 = Fuel and air metering (injector circuit)
  3 = Ignition system
  4 = Auxiliary emissions
  5 = Vehicle speed, idle control
  6 = Computer output circuit
  7/8 = Transmission

01 = Specific fault (cylinder 1 misfire)

Common DTCs include:

• P0300–P0312: Random/multiple cylinder misfire (P0301 = cylinder 1, P0302 = cylinder 2, etc.)
• P0420/P0430: Catalyst system efficiency below threshold (bank 1/bank 2)
• P0171/P0174: System too lean (bank 1/bank 2) — vacuum leak, faulty MAF, or fuel delivery issue
• P0401: EGR flow insufficient — exhaust gas recirculation system fault
• P0440–P0457: EVAP system fault — evaporative emission control leak
• P0700–P0799: Transmission-related faults

OBD-II Modes (Services)

OBD-II defines 10 diagnostic services (modes) per SAE J1979:

• Mode 01: Show current data — live engine RPM, coolant temperature, intake air temperature, MAF airflow, throttle position, O2 sensor voltages, fuel trim, vehicle speed, engine load, timing advance, intake manifold pressure, control module voltage
• Mode 02: Freeze frame — data snapshot captured at the moment a DTC was set. Includes engine RPM, coolant temp, vehicle speed, engine load, fuel trim at time of fault
• Mode 03: Read stored DTCs — retrieves all diagnostic trouble codes currently stored in the ECU. Includes pending and confirmed codes
• Mode 04: Clear DTCs and MIL — erases stored codes, resets freeze frame data, and turns off the Check Engine Light. Used after repairs are completed
• Mode 05: O2 sensor monitoring test results — short-term and long-term fuel trim test results
• Mode 06: Non-continuous monitoring test results — misfire count, fuel system status, catalyst monitoring, EVAP system test results
• Mode 07: Pending DTCs — codes detected during current drive cycle but not yet confirmed. Useful for intermittent faults
• Mode 08: Control operation — special controls for system components (e.g., EVAP purge test, O2 heater test)
• Mode 09: Vehicle information — VIN (Vehicle Identification Number), calibration ID, CVN (Calibration Verification Number), ECU name and number
• Mode 10: Permanent DTCs — codes that cannot be cleared by Mode 04 (OBD-II clear). Only cleared after the ECU confirms the fault is resolved through its own monitoring tests

PIDs (Parameter IDs)

Each live data parameter is identified by a PID (Parameter ID). The ECU responds with the current value for each requested PID. Common PIDs include:

• PID 0x04: Calculated engine load (%) — 0–100%, formula: (A/255) × 100
• PID 0x05: Coolant temperature (°C) — formula: A − 40
• PID 0x0C: Engine RPM — formula: ((A × 256) + B) / 4
• PID 0x0D: Vehicle speed (km/h) — direct value of A
• PID 0x10: MAF airflow (g/s) — formula: ((A × 256) + B) / 100
• PID 0x11: Throttle position (%) — formula: (A/255) × 100
• PID 0x1F: Run time since engine start (seconds) — ((A × 256) + B)
• PID 0x46: Ambient air temperature (°C) — formula: A − 40

A typical OBD-II scan tool reads 20–30 PIDs per second, providing real-time engine data at 10–20 Hz update rates. Enhanced PIDs (manufacturer-specific) can number in the thousands, providing access to transmission data, airbag status, climate control, and other systems not covered by the standard.

The Hacking Gateway

While designed for emissions diagnostics, the OBD-II port became the primary attack vector for car hacking. Anything plugged into this port has direct access to the vehicle's entire CAN bus network — including powertrain, body, and chassis ECUs. There is no authentication or access control on the CAN bus — any device can transmit any CAN frame.

Security researchers use devices like the OBD-II to CAN bus adapter (ELM327, CANtact), Arduino + CAN shield, or professional tools (Vector CANalyzer, Intrepid Vehicle Spy) to sniff, inject, and replay CAN traffic. The OBD-II port is intentionally accessible for emissions testing — this accessibility is also its greatest security weakness.