During the analysis of communication between an automotive scanner and an ECU, the operation of the OBD2 “Read Fault Codes” service corresponding to Mode 03 was studied. This service allows the scanner to request the fault codes stored in the Engine Control Module (ECM) through the frame `01 03`, where `01` represents the number of transmitted bytes and `03` is the DTC reading mode. Unlike the UDS protocol, this method does not use subfunctions, status masks, or additional status bytes; it only responds with the positive identifier `43` followed by the DTC codes encoded in two bytes each. For example, to report the P0300 fault code (multiple misfire detected), the ECU responds with the frame `03 43 03 00`, where `43` indicates a positive response to Mode 03 and `03 00` corresponds to the P0300 DTC. Likewise, for the P0101 fault related to the MAF sensor, the response would be `03 43 01 01`. During the tests performed using diagnostic and CAN emulation tools, it was observed that some generic codes such as P0100 are not always displayed by certain scanners, while more specific codes such as P0101, P0102, or P0103 are correctly recognized. This made it possible to understand that some scanners interpret DTCs according to the manufacturer’s internal logic and not only based on the frame structure. In addition, it was verified that the Mode 03 service is considerably simpler than the UDS protocol, since it only requires the positive response header and the encoded DTCs, facilitating fault simulation within an automotive CAN communication testing environment.
