OBD-II Diagnostics
On-Board Diagnostics II standardized vehicle diagnostics. The OBD-II port provides access to engine data, emissions systems, and hundreds of real-time parameters. It became the gateway for both legitimate diagnostics and car hacking.
What is OBD-II?
On-Board Diagnostics II (OBD-II) is a standardized vehicle diagnostics protocol required by law on all US vehicles since 1996. The 16-pin OBD-II connector, typically located under the driver's dashboard, provides access to the vehicle's electronic control units (ECUs).
Communication Protocols
Different manufacturers used different protocols, leading to confusion:
- J1850 PWM: Ford vehicles (42 kbps, differential)
- J1850 VPW: GM vehicles (10 kbps, single wire)
- ISO 9141-2: Chrysler/Daimler (10 kbps, K-Line)
- ISO 15765 (CAN): All vehicles since 2008 (250-500 kbps)
Diagnostic Trouble Codes (DTCs)
When a problem is detected, the ECU stores a Diagnostic Trouble Code. Codes follow a standard format: P0xxx (powertrain), B0xxx (body), C0xxx (chassis), U0xxx (network). For example, P0301 indicates cylinder 1 misfire.
The second character distinguishes generic (SAE-defined) codes from manufacturer-specific ones: P0xxx and P2xxx are generic codes standardized across all manufacturers, while P1xxx and P3xxx are manufacturer-specific (a P1xxx code on a Ford means something different than the same code on a Toyota). The same P0/P1 vs generic/manufacturer split applies to the B, C, and U prefixes.
Mode 1-10 Services
OBD-II defines 10 diagnostic services (modes):
- Mode 1: Live data (engine RPM, temperature, O2 sensors)
- Mode 2: Freeze frame (data snapshot at time of fault)
- Mode 3: Read stored DTCs
- Mode 4: Clear DTCs
- Mode 5: O2 sensor monitoring
- Mode 6: Test results (non-continuous)
- Mode 7: Pending DTCs
- Mode 8: Special controls
- Mode 9: Vehicle info
- Mode 10: Permanent DTCs
The Hacking Gateway
While designed for emissions diagnostics, the OBD-II port became the primary attack vector for car hacking. Anything plugged into this port has access to the vehicle's entire network. Security researchers use devices like the CAN BUS Tap, Tripulant, or OBD-II adapters running custom software to analyze and manipulate vehicle systems.