{"id":1807,"date":"2015-08-08T21:02:09","date_gmt":"2015-08-08T18:02:09","guid":{"rendered":"http:\/\/saisa.eu\/blogs\/Guidance\/?p=1807"},"modified":"2015-08-10T11:39:58","modified_gmt":"2015-08-10T08:39:58","slug":"car-on-board-diagnostics-odb-ii-with-android-first-tests","status":"publish","type":"post","link":"https:\/\/saisa.eu\/blogs\/Guidance\/?p=1807","title":{"rendered":"Car on-board diagnostics (ODB II) with android, first tests"},"content":{"rendered":"<p><strong><u>Short version<\/u><\/strong><\/p>\n<p>With an android phone and ODB adapter one can get access to the standardized diagnostic interface(s) of a car. I bought an ODB II bluetooth adapter to find out what information is available from a car. With a quick test of some android software, one could verify that some data is available. The data available is related to engine diagnostics.<\/p>\n<p>List of items:<\/p>\n<ul>\n<li>Car with ODB II connector<\/li>\n<li>ELM327 ODB II bluetooth adaptor<\/li>\n<li>android tablet or phone<\/li>\n<li>ODB II software for android<\/li>\n<\/ul>\n<table border=\"1\" cellspacing=\"0\" cellpadding=\"3\">\n<colgroup>\n<col width=\"200\" \/>\n<col width=\"200\" \/><\/colgroup>\n<tr>\n<td>ODB II connector<\/td>\n<td>ELM327 ODB II adapter<\/td>\n<\/tr>\n<\/table>\n<p>\n<a href=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/odb-opel-zafira-b-2.png\"><img loading=\"lazy\" alt=\"odb-opel-zafira-b\" src=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/odb-opel-zafira-b-2-small.png\" width=\"200\" height=\"213\" \/><\/a> <a href=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/elm327-adapter.png\"><img loading=\"lazy\" alt=\"ELM327-adapter\" src=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/elm327-adapter-small.png\" width=\"200\" height=\"149\" \/><\/a><\/p>\n<p><a href=\"https:\/\/play.google.com\/store\/apps\/details?id=com.palmerperformance.DashCommand\">DashCommand<\/a> provides a good looking interfaces with a lot of information, see below.<\/p>\n<table border=\"1\" cellspacing=\"0\" cellpadding=\"3\">\n<colgroup>\n<col width=\"200\" \/>\n<col width=\"200\" \/>\n<col width=\"200\" \/><\/colgroup>\n<tr>\n<td><small>Main view<\/small><\/td>\n<td><small>Data grid provides some values over test period<\/small><\/td>\n<td><small>Diagnostics would show any error codes, if there is any<\/small><\/td>\n<\/tr>\n<\/table>\n<p>\n<a href=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/dashcommand1.png\"><img loading=\"lazy\" alt=\"DashCommand1\" src=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/dashcommand1-small.png\" width=\"200\" height=\"355\" \/><\/a><a href=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/dashcommand2.png\"><img loading=\"lazy\" alt=\"DashCommand2\" src=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/dashcommand2-small.png\" width=\"200\" height=\"355\" \/><\/a><a href=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/dashcommand3.png\"><img loading=\"lazy\" alt=\"DashCommand3\" src=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/dashcommand3-small.png\" width=\"200\" height=\"355\" \/><\/a><\/p>\n<p><a href=\"https:\/\/play.google.com\/store\/apps\/details?id=de.wgsoft.scanmaster\">ScanMaster Lite<\/a> was another impressive tool with a lot of information.<\/p>\n<table border=\"1\" cellspacing=\"0\" cellpadding=\"3\">\n<colgroup>\n<col width=\"200\" \/>\n<col width=\"200\" \/>\n<col width=\"200\" \/><\/colgroup>\n<tr>\n<td><small>Main view<\/small><\/td>\n<td><small>VIN, CALID and CVN are available too<br \/>\n(picture data is sanitized)<\/small><\/td>\n<td><small>RPM example<\/small><\/td>\n<\/tr>\n<\/table>\n<p>\n<a href=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/scanmaster1.png\"><img loading=\"lazy\" alt=\"ScanMaster1\" src=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/scanmaster1-small.png\" width=\"200\" height=\"355\" \/><\/a><a href=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/scanmaster2sanitize.png\"><img loading=\"lazy\" alt=\"ScanMaster2sanitize\" src=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/scanmaster2sanitize-small.png\" width=\"200\" height=\"355\" \/><\/a><a href=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/scanmaster3.png\"><img loading=\"lazy\" alt=\"ScanMaster3\" src=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/scanmaster3-small.png\" width=\"200\" height=\"355\" \/><\/a><\/p>\n<p><a href=\"https:\/\/play.google.com\/store\/apps\/details?id=com.pnn.obdcardoctor\">ODB Car Doctor free<\/a> is another very informative tool.<\/p>\n<table border=\"1\" cellspacing=\"0\" cellpadding=\"3\">\n<colgroup>\n<col width=\"200\" \/>\n<col width=\"200\" \/>\n<col width=\"200\" \/><\/colgroup>\n<tr>\n<td><small>System overview<\/small><\/td>\n<td><small>options in the menu<\/small><\/td>\n<td><small>RPM meter<\/small><\/td>\n<\/tr>\n<\/table>\n<p>\n<a href=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/odb_cad_doctor1-sanitize.png\"><img loading=\"lazy\" alt=\"ODB cad doctor1-sanitize\" src=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/odb_cad_doctor1-sanitize-small.png\" width=\"200\" height=\"355\" \/><\/a><a href=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/odb_cad_doctor2.png\"><img loading=\"lazy\" alt=\"ODB cad doctor2\" src=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/odb_cad_doctor2-small.png\" width=\"200\" height=\"355\" \/><\/a><a href=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/odb_cad_doctor5.png\"><img loading=\"lazy\" alt=\"ODB cad doctor5\" src=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/odb_cad_doctor5-small.png\" width=\"200\" height=\"355\" \/><\/a><\/p>\n<p>Then there are other tools as well, which might provide some additional functions, or another look and feel.<\/p>\n<table border=\"1\" cellspacing=\"0\" cellpadding=\"3\">\n<colgroup>\n<col width=\"200\" \/>\n<col width=\"200\" \/>\n<col width=\"200\" \/><\/colgroup>\n<tr>\n<td><small><a href=\"https:\/\/play.google.com\/store\/apps\/details?id=com.app.elm327terminal\">Elm327 OBD Terminal<\/a><br \/>\n&#8211; allows any AT command<\/small><\/td>\n<td><small><a href=\"https:\/\/play.google.com\/store\/apps\/details?id=org.prowl.torquefree\">Torque<\/a><br \/>\n&#8211; good looking interface<\/small><\/td>\n<td><\/td>\n<\/tr>\n<\/table>\n<p>\n<a href=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/elm327obdterminal.png\"><img loading=\"lazy\" alt=\"Elm327 OBD Terminal\" src=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/elm327obdterminal-small.png\" width=\"200\" height=\"355\" \/><\/a><a href=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/torque.png\"><img loading=\"lazy\" alt=\"Torque\" src=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/torque-small.png\" width=\"200\" height=\"355\" \/><\/a><a href=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/odbii-elm327_car_diagnostics.png\"><\/a><\/p>\n<p>&nbsp;<\/p>\n<hr \/>\n<p><strong><u>Long version<\/u><\/strong> <\/p>\n<p>Car contains much more digital information over several buses than what is accessable via ODB II&#8230;<\/p>\n<p><a href=\"https:\/\/en.wikipedia.org\/wiki\/On-board_diagnostics\">Wikipedia<\/a>:<\/p>\n<blockquote>\n<p>On-board diagnostics (OBD) is an automotive term referring to a vehicle&#8217;s self-diagnostic and reporting capability.<br \/>\nOBD systems give the technician access to the status of the various vehicle subsystems.<br \/>\nOBD-II PIDs (On-board diagnostics Parameter IDs) are codes used to request data from a vehicle, used as a diagnostic tool.<\/p>\n<\/blockquote>\n<p><strong>ODB-II Connector<\/strong><\/p>\n<p><img loading=\"lazy\" alt=\"OBD connector shape svg\" src=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/obd_connector_shape_svg.png\" width=\"300\" height=\"120\" \/><\/p>\n<p><a href=\"http:\/\/pinoutsguide.com\/CarElectronics\/car_obd2_pinout.shtml\">Pin layout and protocols<\/a> :<\/p>\n<table style=\"WIDTH: 100%\" border=\"1\" cellspacing=\"0\" cellpadding=\"1\">\n<tr>\n<td><strong>Pin<\/strong><\/td>\n<td><strong>Signal<\/strong><\/td>\n<td><strong>Description<\/strong><\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>SAE J1850 Bus+<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td>4<\/td>\n<td>CGND<\/td>\n<td>Ground (Chassis)<\/td>\n<\/tr>\n<tr>\n<td>5<\/td>\n<td>SGND<\/td>\n<td>Signal Ground<\/td>\n<\/tr>\n<tr>\n<td>6<\/td>\n<td>CAN High<\/td>\n<td>J-2284<\/td>\n<\/tr>\n<tr>\n<td>7<\/td>\n<td>ISO 9141-2 K-LINE<\/td>\n<td>Tx\/Rx<\/td>\n<\/tr>\n<tr>\n<td>10<\/td>\n<td>SAE J1850 Bus-<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td>14<\/td>\n<td>CAN Low<\/td>\n<td>J-2284<\/td>\n<\/tr>\n<tr>\n<td>15<\/td>\n<td>ISO 9141-2 L-LINE<\/td>\n<td>Tx\/Rx<\/td>\n<\/tr>\n<tr>\n<td>16<\/td>\n<td>+12v<\/td>\n<td>Battery power<\/td>\n<\/tr>\n<\/table>\n<p>There are five diagnostics protocols in use with the OBD-II interface:<\/p>\n<table style=\"WIDTH: 80%\" border=\"1\" cellspacing=\"0\" cellpadding=\"3\">\n<tr>\n<td><strong>Pins<\/strong><\/td>\n<td><strong>Protocol<\/strong><\/td>\n<\/tr>\n<tr>\n<td>2 &amp; 10<\/td>\n<td><a href=\"http:\/\/www.sae.org\/\">SAE<\/a> J1850 PWM<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td><a href=\"http:\/\/www.sae.org\/\">SAE<\/a> J1850 VPW<\/td>\n<\/tr>\n<tr>\n<td>7 &amp; 15<\/td>\n<td>ISO 9141-2<\/td>\n<\/tr>\n<tr>\n<td>7 &amp; 15<\/td>\n<td>\n<p>ISO 14230 KWP2000<\/p>\n<p>(Physical layer identical to ISO 9141-2)<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>6 &amp; 14<\/td>\n<td>ISO 15765 CAN<\/td>\n<\/tr>\n<\/table>\n<p>These standardized protocols can be presented as layers. Why so many protocols? Good question. Anyway, these are alternative protocols meaning that one need to implement only one of the above mentioned protocols&#8230; (and luckily ELM 327 supports many protocols).<\/p>\n<p><a href=\"http:\/\/www.outilsobdfacile.com\/communication-norm-obd.php\"><img loading=\"lazy\" alt=\"norms-eobd\" src=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/norms-eobd.jpg\" width=\"600\" height=\"286\" \/><\/a><\/p>\n<p><strong>What information is available via ODB-II<\/strong><\/p>\n<p>In the standard interface, some specific information from <a href=\"https:\/\/en.wikipedia.org\/wiki\/Engine_control_unit\">engine control unit<\/a> (ECU) has been made available and operation mode and parameter IDs are used to select and get the information. <a href=\"https:\/\/en.wikipedia.org\/wiki\/Table_of_OBD-II_Codes\">Some of the OBD-II modes of operation<\/a> :<\/p>\n<ul>\n<li>01 Show current data<\/li>\n<li>02 Show freeze frame data<\/li>\n<li>03 Show stored Diagnostic Trouble Codes<\/li>\n<li>08 Control operation of on-board component\/system<\/li>\n<li>09 Request vehicle information<\/li>\n<\/ul>\n<p><a href=\"https:\/\/en.wikipedia.org\/wiki\/OBD-II_PIDs\">Some Parameter IDs<\/a> :<\/p>\n<ul>\n<li>Mode 01<\/li>\n<li style=\"LIST-STYLE-TYPE: none\">\n<ul>\n<li>03 Fuel system status<\/li>\n<li>05 Engine coolant temperature<\/li>\n<li>0A Fuel pressure<\/li>\n<li>0C Engine RPM<\/li>\n<li>0E Timing advance<\/li>\n<li>0F Intake air temperature<\/li>\n<li>11 Throttle position<\/li>\n<\/ul>\n<\/li>\n<li>Mode 09<\/li>\n<li style=\"LIST-STYLE-TYPE: none\">\n<ul>\n<li>02 Vehicle Identification Number (VIN)<\/li>\n<li>04 Calibration ID<\/li>\n<li>06 Calibration Verification Numbers (CVN)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>Good summary is available at <a href=\"http:\/\/www.outilsobdfacile.com\/obd-mode-pid.php\">OBD Modes<\/a>.<\/p>\n<p>The figure below &#8220;<a href=\"http:\/\/www.onboarddiagnostics.com\/page02.htm\">basic engine<\/a>&#8221; might be usefull.<\/p>\n<p><a href=\"http:\/\/www.onboarddiagnostics.com\/page02.htm\"><img loading=\"lazy\" alt=\"becc\" src=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/becc.gif\" width=\"510\" height=\"582\" \/><\/a><\/p>\n<p>Which car support which diagnostics? There are several sources in internet with varying quality:<\/p>\n<ul>\n<li>Information on <a href=\"http:\/\/www.obdkey.com\/featuredvehicle.asp?vehicle=277\">Opel Zafira<\/a> (this site contains many other cars as well).<\/li>\n<\/ul>\n<p>Please note that there are several <a href=\"https:\/\/en.wikipedia.org\/wiki\/Electronic_control_unit\">other control units<\/a> in the car, and these standards do not specify those.<\/p>\n<p><a href=\"https:\/\/en.wikipedia.org\/wiki\/Controller_Area_Network\"><strong>CAN bus<\/strong><\/a> <strong>and<\/strong> <a href=\"https:\/\/en.wikipedia.org\/wiki\/Electronic_control_unit\"><strong>control units<\/strong><\/a><\/p>\n<p>A controller area network (CAN bus) is a vehicle bus standard designed to allow microcontrollers and devices to communicate with each other in applications without a host computer. It is a message-based protocol, designed originally for multiplex electrical wiring within automobiles.<\/p>\n<p>The CAN bus is simply a pair of wires, often twisted around each other, running around the vehicle and terminated at either end of the two-wire network with resistors of 120 Ohms. The only components connected to the CAN bus are the electronic control units (nodes). Other components, such as sensors, motors, light bulbs, switches, etc. are wired only to the electronic control units.<\/p>\n<p>Some control units:<\/p>\n<ul>\n<li>Transmission control unit (<a href=\"https:\/\/en.wikipedia.org\/wiki\/Transmission_control_unit\">TCU<\/a>)<\/li>\n<li>Telematic control unit (<a href=\"https:\/\/en.wikipedia.org\/wiki\/Telematic_control_unit\">TCU<\/a>)<\/li>\n<li>Door control unit (DCU)<\/li>\n<li>ABS control unit<\/li>\n<\/ul>\n<p>Other CAN buses (non ODB-II):<\/p>\n<ul>\n<li>Convenience CAN bus<\/li>\n<li>Infotainment CAN bus<\/li>\n<\/ul>\n<p><strong>ELM 327<\/strong><\/p>\n<p><a href=\"http:\/\/www.elmelectronics.com\/DSheets\/ELM327DSH.pdf\">ELM 327<\/a> is a bridge device between ODB and RS232, and makes it possible to communicate with several protocols over serial connection (including bluetooth and wifi). The communication is done by using specific <a href=\"http:\/\/elmelectronics.com\/ELM327\/AT_Commands.pdf\">AT commands<\/a>.<\/p>\n<p><img loading=\"lazy\" alt=\"ELM327\" src=\"http:\/\/saisa.eu\/blogs\/Guidance\/wp-content\/uploads\/2015\/08\/elm327.png\" width=\"306\" height=\"333\" \/><\/p>\n<p><strong>Other links<\/strong><\/p>\n<p>Some of this information is meant for security professional to know what&#8217;s up, as car hacking has been in the media more often&#8230;<\/p>\n<ul>\n<li><a href=\"http:\/\/www.can-cia.org\/\">CAN in Automation (CiA)<\/a><\/li>\n<li><a href=\"http:\/\/opengarages.org\/handbook\/\">Car Hacker&#8217;s Handbook<\/a><\/li>\n<li><a href=\"http:\/\/www.ioactive.com\/pdfs\/IOActive_Adventures_in_Automotive_Networks_and_Control_Units.pdf\">Adventures in Automotive Networks and Control Units<\/a><\/li>\n<li><a href=\"http:\/\/www.securitytube.net\/video\/10191\">Car hacking for poories presentation<\/a> (video and slides)<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Short version With an android phone and ODB adapter one can get access to the standardized diagnostic interface(s) of a car. I bought an ODB II bluetooth adapter to find out what information is available from a car. With a &hellip; <a href=\"https:\/\/saisa.eu\/blogs\/Guidance\/?p=1807\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[9,68,74,67,34,80,51,7],"tags":[],"_links":{"self":[{"href":"https:\/\/saisa.eu\/blogs\/Guidance\/index.php?rest_route=\/wp\/v2\/posts\/1807"}],"collection":[{"href":"https:\/\/saisa.eu\/blogs\/Guidance\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/saisa.eu\/blogs\/Guidance\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/saisa.eu\/blogs\/Guidance\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/saisa.eu\/blogs\/Guidance\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1807"}],"version-history":[{"count":4,"href":"https:\/\/saisa.eu\/blogs\/Guidance\/index.php?rest_route=\/wp\/v2\/posts\/1807\/revisions"}],"predecessor-version":[{"id":1811,"href":"https:\/\/saisa.eu\/blogs\/Guidance\/index.php?rest_route=\/wp\/v2\/posts\/1807\/revisions\/1811"}],"wp:attachment":[{"href":"https:\/\/saisa.eu\/blogs\/Guidance\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1807"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/saisa.eu\/blogs\/Guidance\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1807"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/saisa.eu\/blogs\/Guidance\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1807"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}