CAN Bus Diagnosis

Why a scope beats a scan tool on CAN faults

A scan tool sees the bus as either "there" or "not there." A scope sees it as a physical signal you can measure — bit timing, amplitude, ringing, ground offset. When U-codes are flying and every module blames a different node, the scope is what tells you it's actually a broken twist in the harness above the transmission tunnel.

CAN flavors you'll meet

• High-Speed CAN (HS-CAN): 500 kb/s (some 125 kb/s), 2.5 V recessive, 3.5 V / 1.5 V dominant, terminated at both ends with 120 Ω. Powertrain and chassis systems.
• Medium-Speed CAN (MS-CAN): 125 kb/s, same voltage levels. Body/comfort systems.
• Low-Speed / Fault-Tolerant CAN: 33.3 kb/s, single-wire capable, ~0 V and ~5 V dominant. Some door/mirror/seat modules.
• CAN-FD: 500 kb/s arbitration, up to 5 Mb/s data phase. Same physical levels; you need a scope with enough bandwidth (100 MHz+) to see the fast bits cleanly.
• Single-Wire CAN (SWC / GMLAN): 33.3 kb/s single wire, 0 V / 4 V. Common on GM legacy body networks.

What you'll need

• Two-channel lab scope, 20 MHz+ for HS-CAN, 100 MHz+ for CAN-FD
• Two 10:1 probes; back-probe pins for the DLC (pins 6 = CAN-H, 14 = CAN-L on OBD-II)
• Math function to display (CH1 − CH2) for a differential trace
• Serial decode (nice to have, not required — the shape tells the story)
• DMM for the 60 Ω termination check

Step-by-step capture

1. Check termination first. Key off, back-probe pins 6 and 14 at the DLC, measure across. 60 Ω = healthy. 120 Ω = one terminator lost. 40 Ω or less = extra terminator or shorted wire.
2. Set channels: CH1 to CAN-H, CH2 to CAN-L, both 1 V/div, DC coupled, ground clip on battery negative or DLC pin 4/5.
3. Set timebase: 20 µs/div for HS-CAN (see a few frames), 2 µs/div to inspect individual bits.
4. Trigger: CAN-H falling edge at ~3 V so a frame's start sits mid-screen.
5. Enable math (CH1 − CH2) — the differential trace is what CAN transceivers actually read. A clean 0 V (recessive) / 2 V (dominant) square wave = healthy physical layer.
6. Wiggle-test the CAN harness at pivot points, connectors, and where it enters modules.

Reading the waveform

Healthy pattern

CAN-H sits at 2.5 V and pulses up to 3.5 V. CAN-L sits at 2.5 V and pulses down to 1.5 V. The two are mirror images. Bits are square with minimal ringing. Differential trace is a clean 0/2 V square wave. Frames arrive continuously — you'll see them cluster and gap, not stop.

CAN-H flatline at 2.5 V, CAN-L still active

CAN-H is open or the transceiver on the transmitting module has failed. Bus may still function in limp-home single-wire mode for a while. Follow CAN-H from module to module until the signal reappears.

CAN-L flatline at 2.5 V, CAN-H still active

Same story on the CAN-L side. Confirm by probing at both ends of the harness — the break is between the point where the signal is present and where it isn't.

CAN-H shorted to 12 V (or CAN-L shorted to ground)

The affected wire pins to power or ground and the whole bus goes dark. Most transceivers survive this temporarily but the bus is unusable until the short is fixed. Common culprit: a chafed wire against a sharp bracket or a coolant leak into a connector.

Excessive ringing on transitions

Termination is wrong (missing one 120 Ω), the harness twist rate is off (aftermarket repair with non-twisted wire), or a stub is too long. Ringing that hangs above the threshold voltage causes bit errors and intermittent U-codes.

Recessive voltage offset (not at 2.5 V)

A module is dragging the bus. Common on GM after a starter or alternator fault dumps voltage into the CAN network. Disconnect modules one at a time until the recessive line returns to 2.5 V — the last one disconnected is the culprit.

Long silence between frames

A high-priority module (usually the ECM or BCM) stopped transmitting. Check power and ground to that node first — 90% of "dead network" complaints are actually a single starved module, not a bus fault.

OEM quirks that trip up techs

• Ford MS-CAN: body network sleeps aggressively. If you probe with the doors closed and no wake events, you'll see zero traffic and think the bus is dead. Open a door before you decide.
• GM GMLAN single-wire: 0 V / 4 V, not 1.5 V / 3.5 V. Don't confuse a healthy SWC waveform for a broken HS-CAN.
• Chrysler CCD: not CAN at all — differential 2.5 V ± 20 mV. If the amplitude looks tiny, it's supposed to.
• Any hybrid/EV: multiple CAN networks (HV, LV, body, ADAS) plus gateway modules. Confirm which network the DLC pin is connected to before assuming a fault.
• Aftermarket dashcams and OBD dongles: notorious for keeping modules awake or injecting noise. Unplug before diagnosing intermittent U-codes.

Worked example: intermittent multiple U-codes after a collision repair

2019 SUV, sporadic U0100/U0101/U0140 after a fender repair. Termination reads 60 Ω. CAN scope at the DLC looks perfect. Scope on the CAN harness at the front-fender splice shows massive ringing on every edge — the shop had spliced in a section of untwisted parallel wire when repairing a chafe. Replaced with a twisted-pair pigtail; ringing gone, codes stopped.

Common mistakes

• Diagnosing single-wire captures without using the math channel — everything looks broken
• Skipping the 60 Ω termination check — five seconds that saves hours
• Assuming a "dead bus" without confirming module power and ground first
• Grounding the scope to the same wire you're probing — introduces a ground loop that looks like noise
• Forgetting to disconnect aftermarket OBD gadgets before probing

Frequently asked questions

Related guides

• Setting triggers & timebase →
• Intermittent fault capture →
• Automotive oscilloscope fundamentals →
• Engine sound diagnostics overview → — for driveability complaints where the network looks fine