OBD2 Adaptor Teardown

A number of years back a bought one of those cheap bluetooth OBD diagnostic tools from eBay. I cant remember why I bought it now (obviously for use on the car) but I must have only used it a couple of times. Having found in my desk drawer at work last week I decided to take it apart and have a look inside. From what I recall I only paid around £10 for it so was quite intrigued to see what you get for your money.

The device has “ELM327” written on the top of it. For those who don’t know the ELM327 is a programmed micro controller produced by ELM Electronics for translating messages from a vehicles on-board diagnostics (OBD) interface. According to Wikipedia the ELM327 is implemented on a PIC18F2480 micro controller from Microchip. Vehicles that support OBD communicate over one of a number of protocols. For older vehicles this tends to be either ISO 9141-2, ISO 14230-4 KWP or J1850 pulse width and variable pulse width modulation. Modern cars tend to use the controller area network (CAN) protocol. The ELM327 supports all of these protocols.

Further research reveals that ELM failed to implement any code protection on the original ELM327 chips. These chips were then cloned and form the basis for the majority of the cheap Chinese imports you now find on eBay. The version number in the firmware of these clones also appears to have been modified to report versions newer than the original release even though the functionality remains the same. Most of the adaptors currently on eBay claim to be v1.5. I have been unable to find any reference to a v1.5 on the ELM website.

OBD2 Device

Here is a picture of the PCB after it was removed from the case. The OBD connector which is connected via a 16 pin ribbon cable to the pin header has also been removed. The soldering looks good. All the components appear to be fitted correctly. We can see the main micro controller is indeed a PIC18F2480 the same processor ELM use for their ELM327. No labelling here so its more than likely the PIC18F2480 has been flashed with the ripped off firmware.

Now comparing this PCB with suggested example circuit diagram on the ELM327 datasheet. It quickly becomes clear this example has been adopted with some minor modifications. An off the shelf Bluetooth module (middle right) has been added. The RS232 level shifting has been removed since the TX & RX lines on the PIC connect straight through to pins on the Bluetooth module. I haven’t gone over the board component by component but you can clearly see in addition to the main micro controller, the MCP2551 CAN transceiver, the 78M05 5V regulator (bottom right) used in place of a 78L05 on the schematic. The 1.5A 50V rectifier diode in line with the battery voltage for reverse polarity protection. The LM317 adjustable regulator used to control the J1850 bus voltage. There appears to be additional filtering on the board as well.

ELM327 Datasheet

The bluetooth module looks like the e-Gizmo EGBT-046S. Versions on eBay appear to be known as the HC-05 or HC-06. The difference being the HC-05 can be configured as a master whereas the HC-06 cannot apparently. The main chip on these boards is a CSR BC417143 BlueCore® 4-External single-chip radio and baseband IC. Below it is the 8Mbit of external flash containing the firmware.

After applying power to the header and successfully pairing it with my PC I was able to communicate with it using puTTY. The ELM327 AT commands list contains a list of all of the commands supported by the device. Now obviously I couldn’t issue commands to poll vehicle information but I can send AT commands to perform simple tasks such as reset the device or report the firmware version number.

I reset the device by sending an “ATZ” command to which the device responded with “ELM327 v1.4”. Interesting. Sending the command “AT@1” returned “OBD2 to RS232 Interpreter”. This seems to be valid. However sending the command “AT@2”, which is only supported in firmware versions v1.2 and greater, should display the device identifier. The device returned no response. This indicates to me as expected that this device must be one of the cloned originals.

Still putting this into perspective. The original ELM327 chips from ELM Electronics are priced at $18 and that’s just for the IC. Add in the additional cost of the CAN transceiver, the extra components, the PCB and a case and you could not even build one yourself for less than what I paid for it. And besides it works!



14 thoughts on “OBD2 Adaptor Teardown

  1. JGuembel

    Hi, very nice report. A little tip: with the command ‘at@3 xxxxxxxxxxxx’ you can set the response value for the at@2 command.

  2. iceman

    Hi, from where you bought this Elm327 adapter? I cannot find a good quality adapter, and this seems to be ok,

    1. mikesmodz Post author

      I purchased the adaptor from eBay. There are still some sellers selling these in the UK. Pretty sure all of the cheap ELM327 devices advertised on eBay at the moment are all using the same cloned chips.

      1. insanoff

        Recently I bought a Chinese OBD to USB adapter on Ebay to use its cloned ELM chip for hacking purposes. But then after taking it apart I have discovered that it even does not have a cloned ELM chip inside. PCB was almost empty with some CoB chip on it.
        I can share photos if you want.

  3. vik91830

    Which one did you buy in particular? The one you got seems like one of the better ones. What does the outer shell look like? There’s a very different circuit board in this one: http://archive.is/PBiSJ

    Also, I think some sellers are stealing your photo of the circuit board and putting it in their listings.

    1. mikesmodz Post author

      The one I bought looked exactly like the one you have linked to. Exactly the same from the outside but clearly not from the inside. They are both derived from the ELM327 datasheet with the absolute minimal amount of components used to keep the cost down. The original level shifting for the RS232 levels being replaced with the off the shelf bluetooth module. Having said that though the one shown in the article you linked to looks horrendous. They have used a double sided PCB and just plonked the micro and the bluetooth module on one side and everything else on the other. Whereas on my board they have given some thought to the layout.

      I bought mine years ago from a supplier on eBay here in the UK. Problem is without actually seeing inside the case you cant guarantee what you’ll get.

      So which sellers are stealing my images? Have you got any links?

  4. mikesmodz Post author

    Wow. The cheeky buggers. They have even had the gall to watermark it with their company name.

    To be fair the two boards do look identical like you say if that is whats fitted.

    1. vik91830

      Actually, I pointed out that they don’t match. The bluetooth module is different, which makes me think the pictures aren’t representative of the actual product. They could not confirm what the actual components are, except for claiming it has the latest chip compatible with all protocols.

  5. Antus

    ELM is just a chip, not an implemented circuit. There is a reference diagram but the implementations change. Vendors use any WiFi or BT or USB module they want with their own pros and cons and challenges. Many of the low quality clones are bad. I have bought several, and seen several DOA. On one the BT module was not even installed straight enough for its pins to make electrical contact. I was able to fix that one. Ive never been able to buy the same implementation twice. Its impossible to get assured quality as there is no one company or brand – its always going to be a lucky dip. There are also some bugs in the v1.0 code adding extra null bytes 00 to the stream. If you can spend the extra your better off with the allpro from obddiag.net (open source hardware and firmware) or the scantool.net obdlink mx (closed source) both of which are original implementations of the elm protocol on a more powerful CPU.

    1. mikesmodz Post author

      Hi Antus,

      Thanks for your input. The quality of these clones will of course be be questionable and to be fair this is to be expected based on the cost. I see you can now buy so called ELM327 plug in modules with Bluetooth for around £5 delivered in the UK. I mean come on you can’t expect a great deal from that. It’s nice to see a open source solution as well. The AllPro device looks really nice. However with most modern vehicles more than likely using CAN if I were developing anything now I would just cut out the middle man and use a micro that had CAN support built in. Then run everything from that one device.

  6. casablancamining.com

    I’m impressed, I must say. Seldom do I come across a blog that’s equally educative and
    interesting, and without a doubt, you have hit the nail on the head.

    The issue is something not enough people are speaking intelligently about.
    Now i’m very happy I found this during my search for something relating to this.


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s