Checking a used car with OBD: a 20-minute protocol to run before you hand over the money

The most expensive mistake when buying a used car does not cost money — it costs a wasted afternoon. You show up, plug in a scanner, see “no faults found”, and conclude the car is healthy. What you actually saw was whatever the seller had time to prepare.

Clearing every stored code takes five minutes and a $10 adapter. Hiding the consequences of clearing them does not work. What follows is a seven-step protocol built around exactly that: each step checks what the previous one could have missed, and the order matters.

Why “no faults” is not a result

Fault memory in the ECU is wiped with a single command. The codes go, and so do the freeze frames, the drive-cycle counters, and the Mode 06 statistics. One thing does not disappear — it becomes visible instead: the readiness monitors.

A readiness monitor is a flag meaning “I have managed to test my subsystem since the last reset”. After a memory wipe every flag drops to not ready and only returns to ready after a complete drive cycle: cold start, warm-up, city traffic, highway. Depending on the model that is anywhere from 30 to 200 miles spread over several days.

So the picture “zero faults + monitors not ready” reads unambiguously: the memory was cleared recently. Not “this car is perfect”, but “we are not being shown the history”.

The monitors themselves and the order in which they complete are covered separately in the readiness monitors explainer. All that matters here is the conclusion: this is the first thing to look at, and you look at it before the seller sees your screen.

The protocol: seven steps in the right order

The order is not decorative. Steps 1–3 happen before the engine starts, while the car is cold — some data changes irreversibly after start-up, and you only get one cold start per visit.

Step 1. Readiness monitors — first connection, engine off

Turn the ignition on without cranking, plug in the adapter, open the monitors.

What you see	How to read it
All ready	History has not been cleared for at least a few hundred miles. Good sign
1–2 not ready	Normal on some models — EVAP and catalyst monitors run rarely
3 or more not ready	Memory was cleared recently. Ask when, and why
All not ready	Cleared just now. From here you are evaluating the seller, not the car

That last row is not an automatic walk-away. It is a reason to say out loud: “the monitors are not ready, the codes were cleared today” — and watch the reaction. Sometimes it genuinely was a disconnected battery terminal after a replacement, and the seller explains it without blinking.

Step 2. Three kinds of codes, not one

Most people read only the stored codes. Those are the first thing wiped. But OBD-II defines two more types, and they behave very differently:

• Pending (Mode 07) — a fault recorded on one drive cycle but not yet confirmed on a second. No warning lamp, nothing the driver would notice. These reappear after 20–40 minutes of driving following any clear.
• Permanent (Mode 0A) — introduced specifically to defeat clearing codes before an emissions test. A scan tool cannot erase them at all. They clear themselves only after the ECU has repeatedly confirmed the fault is genuinely gone.

Permanent codes are the most honest data source in the vehicle. If something is sitting there, it is a confirmed fault that somebody tried to hide. Not every pre-2010 car supports them, but anything newer does.

Step 3. Freeze frame — the snapshot of the moment

If a stored code did turn up, it comes with a freeze frame: a capture of the parameters at the instant the fault was recorded — RPM, engine load, coolant temperature, speed, fuel trims.

Two things are useful here. First, temperature: a code logged at 68 °F means cold start, one logged at 195 °F means fully warmed — those are different faults. Second, on a number of makes the odometer reading is captured in the freeze frame. If it says 150,000 miles and the dash reads 112,000, you have just found odometer fraud, and found it for free. Other ways to spot it are in the guide on detecting odometer fraud through OBD.

Step 4. Cold start, watched through live data

Now start it. Watch three parameters in real time:

• Coolant temperature — should climb steadily from ambient to 185–205 °F within 5–10 minutes. Stuck at 140–160 °F means a thermostat, and that is P0128.
• Short-term fuel trim (STFT) — jumps around when cold, which is normal. Sitting at +20 % or higher after warm-up means a vacuum leak or weak fuel delivery. How to read the numbers is covered in STFT and LTFT explained.
• Idle RPM — swinging more than 150 RPM once warm points at the throttle body, the idle control valve, or misfires.

A cold start cannot be faked. A warmed-up engine forgives a great deal — which is precisely why sellers like “oh, I just got back, she’s still warm”.

Step 5. Re-check after warm-up

Bring it to operating temperature, let it idle for ten minutes, then read the pending codes again. Some faults are only recorded once the ECU permits its warm-engine tests to run: catalyst efficiency, oxygen sensors, EVAP.

This is the point where a freshly cleared car starts producing its first real codes.

Step 6. Module roll call — who is actually answering

Do not scan the engine alone. A modern car carries 15–40 modules on the bus, and each one is expected to answer a request. A module that does not answer produces a U-series code — lost communication: U0100 for the engine ECU, U0121 for ABS, U0151 for the restraints control module.

There is a subtlety here that saves real money. A module missing from the list entirely is not the same as a module reporting a fault. Missing usually means it was removed, swapped for a dead unit, or disabled to kill a warning lamp on the dash. This applies to the SRS module above all. Network faults are covered in depth in the BCM and bus communication guide.

Step 7. Test drive with logging on

The final step is 15–20 minutes of driving with a log running. Minimum parameter set: RPM, speed, load, coolant temperature, both fuel trims, and the per-cylinder misfire counters.

What driving catches that a stationary check never will:

• Misfires under load — the cylinder fires at idle and drops out under load. Classic worn coils; the full breakdown is in engine misfire troubleshooting.
• Boost falling away — the turbo holds pressure parked and loses it under load, which is P0299.
• Overheating under load — 195 °F at idle, 220 °F on the highway.
• New pending codes after the drive — the single most valuable output of the whole protocol.

What each step catches

Step	Catches	Time
1. Monitors	The fact that memory was cleared recently	1 min
2. Three code types	Hidden and un-erasable faults	2 min
3. Freeze frame	Fault conditions, sometimes the true mileage	2 min
4. Cold start	Thermostat, vacuum leaks, idle quality	8 min
5. Warm re-check	Catalyst, oxygen sensors, EVAP	3 min
6. Module roll call	Removed or dead modules, SRS above all	2 min
7. Logged test drive	Everything that only appears under load	20 min

About 40 minutes with the test drive, about 20 without. Less than the drive to the seller.

Three situations where you simply walk away

The protocol produces plenty of grey areas. Three of them are black:

1. A permanent code on a major system. It is still there because nobody could remove it. That is a confirmed, active fault, and the seller knows about it.
2. The SRS module is missing from the roll call or silent. The airbags have either already deployed or been disabled. The cost ranges from several hundred dollars to a failed inspection — and in a crash, to your health.
3. Freeze-frame mileage higher than the odometer. Nothing else needs checking.

What OBD will not show you — honestly

A scanner does not replace a lift and does not see mechanical condition:

• Body and corrosion — not once.
• Suspension condition — beyond the sensors attached to it.
• Actual engine life left — OBD does not measure compression.
• Crash history — apart from side effects such as dead or substituted modules.
• Quality of previous repairs — the code is gone, but a scanner cannot tell whether it went because a part was replaced or because the memory was wiped.

An OBD check is a filter, not a verdict. Its job is to eliminate half the candidates in 20 minutes, so that the one car that actually deserves a lift is the one that gets it.

What to bring

An adapter with an ELM327 v1.5 or later chip, the Bluetooth version, and an Android phone. Our app communicates over Bluetooth SPP — which matters, because BLE and Wi-Fi adapters will not connect to it no matter what they cost. How to avoid a counterfeit is covered in spotting fake ELM327 clones, and picking a model in the adapter buying guide.

Before you drive out to a seller, run the whole protocol once on your own car — so you are not hunting for the right screen while somebody watches.

Download the app and walk through the steps in advance: all three code types, readiness monitors, and freeze frame are available as soon as the adapter is connected.