Waveform Pattern
CAN Bus Diagnosis
Capture CAN-H and CAN-L with a scope: recessive and dominant levels, termination checks, differential math, ringing, ground offset, and what bus-off really means.
Why a scope beats a scan tool on network faults
A scan tool tells you which modules stopped talking. A scope shows the physical signal: voltage levels, edge shape, ringing, and ground offset. That's where the cause is: a chafed wire, a bad splice, a missing terminator, or a module dragging the bus.
Network types you'll meet
| Type | Speed | Recessive (idle) | Dominant | Notes |
|---|---|---|---|---|
| High-speed CAN | 500 kb/s (sometimes 250 or 125 kb/s) | H ≈ 2.5 V, L ≈ 2.5 V | H ≈ 3.5 V, L ≈ 1.5 V | Terminated with 120 Ω at each end. Not fault tolerant: an open or short on either wire stops the bus |
| CAN FD | Same arbitration speed, faster data phase (several Mb/s) | Same levels | Same levels | Needs a faster sample rate for the data phase |
| Fault-tolerant low-speed CAN | Up to 125 kb/s | H ≈ 0 V, L ≈ 5 V | H ≈ 3.6 V, L ≈ 1.4 V | Can keep running on one wire if the other fails |
| Single-wire CAN | 33.3 kb/s | ≈ 0 V | ≈ 4 V (higher for wake-up) | One signal wire, referenced to ground |
This guide focuses on high-speed CAN, the powertrain and chassis network on most vehicles.
What you'll need
- Two-channel scope and a math channel (A − B) for the differential signal.
- Back-probe pins. At the OBD-II connector: pin 6 = CAN-H, pin 14 = CAN-L, pins 4/5 = ground.
- A meter for the termination check.
- Sample rate: at least 10 MS/s for 500 kb/s (20 samples per 2 µs bit).
Step-by-step capture
- Check termination with the network asleep. Ignition off, modules asleep (or battery disconnected). Measure between CAN-H and CAN-L:
Reading Meaning About 60 Ω Both 120 Ω terminators present (in parallel) About 120 Ω One terminator open or disconnected About 40 Ω An extra 120 Ω terminator on the bus Near 0 Ω CAN-H shorted to CAN-L - Channels: A on CAN-H, B on CAN-L, both 1 V/div, DC coupled, grounded at the connector ground or battery negative.
- Math channel: A − B, the differential signal the transceivers actually read.
- Timebase: 50–100 µs/div to see whole frames (a data frame at 500 kb/s is roughly 220–260 µs); 2–5 µs/div to inspect individual bits.
- Trigger: CAN-H rising edge at about 3 V. Every frame starts with a recessive-to-dominant transition.
- Wiggle-test the harness at connectors, pivots, and repair splices while watching the trace.
Reading the waveform
Healthy pattern
- CAN-H and CAN-L mirror each other around 2.5 V.
- Differential: a clean square wave between about 0 V (recessive) and about 2 V (dominant).
- Square edges with little ringing.
- Frames arriving in bursts with gaps between them, not stopping.
Missing termination
Ringing on every edge, and 120 Ω between H and L with the network asleep. Find the missing terminator (often inside a module) or an open wire isolating it.
Excessive ringing with correct termination
A long stub, or a repair spliced with untwisted wire. Twisting cancels the pair's field and controls impedance; a length of parallel wire doesn't. Locate it by capturing at several points along the harness.
Asymmetric CAN-H and CAN-L
The two wires no longer mirror each other. Causes: one wire shorted to ground or to B+, or a transceiver driving one wire badly. Measure each wire's resistance to ground and to B+ with the network asleep.
Recessive level not at 2.5 V
A module is pulling the bus. Disconnect modules one at a time while watching the recessive level; when it returns to about 2.5 V, the module you last disconnected (or its wiring) is the cause.
Frames stop from one module
This is what bus-off looks like on a scope. Bus-off is a module state, not a wire state: a module that detects too many of its own transmit errors takes itself off the bus. The wires look normal; that module's frames are simply missing. Check that module's power, ground, and connector first, then look for noise corrupting its transmissions.
No traffic at all
The network may be asleep. Wake it (unlock, open a door, switch the ignition on) before deciding the bus is dead. If it stays silent with the ignition on, check for a short between H and L, or either wire shorted to ground or B+.
Worked example: intermittent communication codes after collision repair
After a front-end repair, several modules set intermittent lost-communication codes. Termination reads 60 Ω, and the waveform at the diagnostic connector looks clean. Captured at the repair area, the waveform shows heavy ringing on every edge. The repair had spliced in a length of untwisted parallel wire. Replacing it with twisted pair removed the ringing, and the codes stopped.
Common mistakes
- Skipping the termination check.
- Measuring termination with the network awake.
- Triggering on the falling edge of CAN-H: frames start on the rising edge.
- Using a timebase too fast to see a whole frame.
- Declaring the bus dead while the network is asleep.
- Assuming high-speed CAN can run on one wire.
- Leaving aftermarket plug-in devices connected while diagnosing network faults.
Frequently asked questions
What voltages should CAN-H and CAN-L show?
On high-speed CAN, both sit near 2.5 V when idle (recessive). When a module transmits a dominant bit, CAN-H rises to about 3.5 V and CAN-L falls to about 1.5 V, a differential of about 2 V.
How do I check termination?
With the network asleep, measure between CAN-H and CAN-L: about 60 Ω is correct (two 120 Ω terminators in parallel), about 120 Ω means one is missing, about 40 Ω means an extra one.
What does bus-off look like?
It's a module state: a module with too many transmit errors stops transmitting. The wires still look normal; that module's frames just stop appearing. Look at that module's power, ground, and connector.
Why look at the differential trace?
Transceivers read the difference between CAN-H and CAN-L, so the differential (A − B) is what the modules actually see. Noise that affects both wires equally cancels out in it.