Oscilloscope and CAN waveform diagnosis

A scan tool tells you a controller stopped answering. It cannot tell you whether the controller died, its power failed, or the pair of wires between it and everything else acquired a fault. For that you have to look at the electricity.

A bench oscilloscope standing on a red steel workshop trolley with a square wave trace across its screen, red and yellow probe leads running from its inputs off to the right towards a multi-way connector on an engine component, spare probes, adaptors and coaxial connectors laid out on the trolley top, a workshop with tool cabinets and a car with its bonnet raised out of focus behind. — The scan tool reports a controller's opinion. The scope shows what actually arrived.

Why a scope at all

A scan tool reports what a controller decided a signal meant — after filtering, after averaging, refreshed a few times a second. That is a summary, and summaries lose exactly the information you need.

The scope shows the signal itself. A dropout lasting forty microseconds, a slow edge caused by a high-resistance joint, ringing on a bus, noise riding on a sensor supply — all of them are invisible to a scan tool and all of them cause faults.

What a healthy CAN pair looks like

A diagram of CAN bus waveforms and the common faults. A healthy trace shows CAN high and CAN low both resting at about 2.5 volts in the recessive state and being driven apart symmetrically in the dominant state, high rising to about 3.5 volts and low falling to about 1.5 volts, with the difference between them plotted beneath as a clean square wave of about 2 volts. A panel explains that the receiver reads only the difference, so a disturbance coupling equally into both twisted conductors cancels out, and that this is why a fault affecting one line alone destroys the immunity along with the signal. Three fault traces follow. The first shows a missing terminating resistor, with heavy ringing and overshoot on every transition because the signal energy reflects from the unterminated end, still readable at low speed and corrupting data as the rate rises. The second shows CAN high shorted to ground, pinned near zero while CAN low continues to switch, so the difference never reaches the dominant threshold and communication stops. The third shows a high resistance joint, with rounded slow edges and reduced amplitude. A measurement panel shows the resistance check across the pair with the ignition off, giving about sixty ohms from the two one hundred and twenty ohm terminators in parallel, and notes that about one hundred and twenty ohms means one terminator is missing while sixty proves only that the parallel total is right. — Both lines at rest together, then driven apart symmetrically. The symmetry is the immunity.

Recessive — both lines resting together at about 2.5 V. The difference is near zero.

Dominant — CAN high driven up to around 3.5 V, CAN low down to around 1.5 V. The difference is roughly 2 V.

The receiver looks only at the difference. That is the whole design. Interference coupling into a twisted pair arrives on both conductors almost equally, and subtracting one from the other removes it.

The measurement to make first

Ignition off, both connectors unplugged as required, measure across CAN high and CAN low: about 60 Ω.

Two 120 Ω terminators at opposite ends of the bus, in parallel. Roughly 120 Ω means one is missing or its branch is open. 60 Ω does not prove both are present and correctly placed — only that the parallel total works out.

The four faults worth recognising on sight

Trace	Fault	Why it looks like that
Ringing and overshoot on every edge	Missing termination	The wave reflects from the unterminated end instead of being absorbed
One line pinned, the other still switching	Short to ground or to supply	The difference never reaches the dominant threshold
Rounded edges, reduced amplitude	High-resistance joint	The joint and the line capacitance form a slow filter
Clean bus, one node’s messages absent	A dead node, not a wiring fault	The bus is fine — the talker is not

That last row is the reason to look. On a scan tool, a dead controller and a shorted bus produce identical symptoms. On a scope they look nothing alike, and the difference is an hour of work.

Other things the scope is for

A diagram of oscilloscope signal patterns in vehicle diagnosis. An inductive crankshaft sensor trace is shown as a rising and falling alternating waveform whose amplitude grows with speed, with the missing tooth reference gap visible, contrasted with a Hall effect sensor producing a clean square wave of constant amplitude regardless of speed, and a note that a weak inductive signal at cranking speed may still be strong enough at running speed, so the fault appears only as a no start. An injector current trace is shown rising with a distinct step where the pin lifts, with a panel explaining that the absence of that step means the solenoid is energised but the mechanism has not moved. A relative compression capture is shown as starter current drawn over several engine revolutions, with even peaks on a healthy engine and one noticeably lower peak marking the cylinder with low compression, giving a compression comparison without removing a single spark plug. A voltage drop test panel contrasts an ohmmeter reading a corroded joint at a fraction of an ohm while passing only milliamps, with the same joint dropping several volts once ten amps flow through its reduced contact area, and states that testing at rest is how a bad connection passes inspection and fails in service. A final panel covers probe grounding, warning that clipping the ground lead to a painted bracket or a distant body point adds that path's own voltage drop into every trace. — Current through an injector, starter current across cylinders, a drop across a joint carrying real current.

Crank and cam sensors. An inductive sensor produces an alternating waveform whose amplitude grows with speed, so one that is weak at cranking speed may be perfectly adequate once running — a fault that presents only as a no-start. A Hall sensor gives a clean square wave of constant amplitude at any speed.

Injector current. The current ramp has a small step in it where the pin lifts. If the ramp is smooth, the solenoid is energised and the mechanism has not moved. That is a distinction no resistance measurement can make.

Relative compression. Capture starter current across several revolutions. Each compression stroke loads the starter, and each load shows as a peak. Even peaks mean even cylinders; one noticeably low peak identifies the weak cylinder — without removing a spark plug.

Voltage drop, not resistance

An ohmmeter passes a few milliamps. A corroded joint will carry that happily and read a fraction of an ohm.

Put the circuit’s real current through the same joint and the small remaining contact area heats and drops voltage — often several volts. Measure across the connection while it is working, not while it is idle.

Two habits worth forming

Ground the scope close to the circuit under test. The instrument measures against wherever its ground lead is clipped. A painted bracket or a remote body point adds its own drop into every trace, and you will spend the morning chasing noise you created.

Set the trap before provoking the fault. Intermittent problems do not survive being hunted one probe at a time. Arm a trigger, start the capture, then heat the connector, flex the loom, load the circuit. A glitch lasting microseconds is caught and held, and you can look at it afterwards.

What to take away

The scan tool gives a controller’s filtered opinion. The scope gives the signal.
Recessive is both lines together near 2.5 V; dominant drives them apart to roughly 2 V of difference.
The receiver reads only the difference, which is why the bus resists noise and why single-line faults are fatal.
About 60 Ω across the pair — two 120 Ω terminators in parallel.
Ringing means missing termination; a pinned line means a short; rounded edges mean resistance; a clean bus with one silent node means the node.
Voltage drop under real current, never resistance at rest.
Ground close, trigger first, then provoke the fault.

Next, the bench procedure where all of this meets a millimetre of tolerance — ADAS calibration, static and dynamic.