CAN Bus Fault Diagnosis

Written by Anthony Calhoun, ASE Master Tech A1-A8

CAN Bus Basics — What You Need to Know Before You Diagnose

The Controller Area Network, or CAN bus, is the backbone of modern vehicle communication. Before 1995, modules talked to each other through dedicated point-to-point wiring. One module needed data from another, you ran a wire. That got complicated fast. CAN bus replaced all of that with a two-wire network where every module on the bus can broadcast and receive simultaneously.

Those two wires are CAN-H (high) and CAN-L (low), and they work as a differential pair. What that means in practice: when no data is being sent, both wires sit at 2.5 volts — that is the recessive state, which represents a logical 1 on the bus. When a module transmits a dominant bit (logical 0), CAN-H is driven up to 3.5 volts and CAN-L is pulled down to 1.5 volts simultaneously. The voltage difference between the two wires is what carries the signal. This differential design is the reason CAN bus is so resistant to electrical noise — any interference that hits both wires equally gets canceled out when the receiver looks at the difference between them.

Bus speed matters for diagnosis because different networks on the same vehicle run at different speeds. High-speed CAN (HS-CAN) runs at 500 kilobits per second and handles the powertrain, ABS, and other safety-critical systems where reaction time matters. Low-speed CAN — sometimes called comfort CAN or body CAN — runs at 125 kilobits per second and handles less time-sensitive systems like power windows, climate control, and interior lighting. Some vehicles have a third network, mid-speed CAN, running at 250 kilobits per second.

Why does this matter for diagnosis? Because when you connect a scan tool and pull codes, you need to know which network each module lives on. A fault on the HS-CAN powertrain bus will not affect modules on the body CAN unless the gateway module is also involved. Understanding which wires go where, and at what speed, tells you where to put your test leads.

Symptoms of CAN Bus Problems — What the Car Tells You

CAN bus faults have a distinctive symptom pattern that separates them from most other electrical problems. Once you recognize the pattern, you will stop chasing individual module failures and start looking at the network itself.

The most obvious symptom is multiple U-codes stored across multiple modules at the same time. U-codes are communication codes. A U0100 means lost communication with the ECM/PCM. A U0155 means lost communication with the instrument cluster. When you see five or six different U-codes spread across three or four different modules, that is not five or six separate failures — that is one network problem causing every module on the bus to complain about its neighbors.

Other common symptoms include:

• Instrument cluster goes dead or displays garbage while the engine still runs
• Warning lights for completely unrelated systems illuminating at the same time — ABS, traction control, stability, and airbag all on together
• Scan tool cannot communicate with any module on the affected bus, or can only communicate with some modules intermittently
• Individual module drops off the network only while driving, then comes back when the car sits overnight — classic intermittent wiring fault
• Engine starts and runs but has no throttle response — throttle-by-wire relies on CAN communication between the PCM and the throttle module
• Transmission shifts incorrectly or defaults to limp mode because the TCM cannot hear the PCM
• No crank, no start conditions when the BCM and PCM cannot verify each other for anti-theft purposes

When a customer comes in with a car that seems to have half its systems going haywire at once, think CAN bus first. Pull the codes from every module you can access, look at the U-codes, and map out which network they are pointing to. That narrows your diagnosis before you ever pick up a meter.

Termination Resistance — The First Test You Should Run

CAN bus is a terminated network. At each physical end of the bus, there is a 120-ohm resistor placed between CAN-H and CAN-L. These termination resistors absorb the signal at the end of the line and prevent it from reflecting back down the wire, which would corrupt the data. Two resistors, 120 ohms each, wired in parallel gives you 60 ohms total.

This means your first electrical test on any suspected CAN bus problem is simple: key off, disconnect the battery for a few minutes to let all capacitors discharge, then measure resistance between CAN-H and CAN-L at a known good access point — the DLC connector pins 6 and 14 for HS-CAN on most vehicles. You should read right around 60 ohms.

Resistance Reading	What It Means	Next Step
55 to 65 ohms	Both terminators present and healthy	Look elsewhere — termination is not your problem
120 ohms	One terminator is missing or open	Find which end of the bus lost its terminator
Near 0 ohms (under 10)	Short circuit between CAN-H and CAN-L	Find the short — can be a module, wiring, or connector
Over 120 ohms or OL	Both terminators open, or the bus wiring itself is broken	Check for open circuit in bus wiring, look for broken splice or connector

If you read 120 ohms instead of 60, one termination resistor is open. These resistors are often built into a module — the PCM and ABS module are common terminator locations depending on the vehicle. A module with an internal open terminator might otherwise function perfectly, making this easy to miss without the resistance check. Start disconnecting modules one at a time and recheck resistance after each disconnect. When you unplug a module and the reading changes from 120 to OL, that module was your surviving terminator. The other end is your problem.

Oscilloscope Diagnosis — Seeing the Bus in Real Time

A DVOM tells you what the CAN bus voltage is right now, at this instant. A scope shows you what the bus is doing over time, and that is the difference between guessing and knowing. If you are doing CAN bus work without a scope, you are working with one hand tied behind your back.

Connect your scope to CAN-H on channel 1 and CAN-L on channel 2, both referenced to chassis ground. Set your time base to around 1 millisecond per division and your voltage scale to 1 volt per division. Turn the key on or start the engine to get bus traffic flowing.

A healthy high-speed CAN bus looks like this: CAN-H shows a square wave bouncing between 2.5 volts (recessive) and 3.5 volts (dominant). CAN-L shows an equal and opposite square wave bouncing between 2.5 volts (recessive) and 1.5 volts (dominant). The two waves are mirror images of each other. The transitions are clean and sharp with square edges. Both wires move together — when CAN-H goes up, CAN-L goes down at exactly the same moment.

Here is what common faults look like on the scope:

• Short to ground on CAN-L: CAN-L is pulled flat at or near 0 volts and does not move. CAN-H may still show some activity but the bus cannot function because the differential signal is destroyed. The bus reads as permanently dominant, which is called a dominant short fault.
• Short to ground on CAN-H: Less common but possible. CAN-H is pulled down toward ground and cannot reach 3.5 volts. The bus looks like a low-amplitude, distorted version of the normal waveform.
• Short between CAN-H and CAN-L: Both wires are clamped together at the same voltage, somewhere around 2.0 to 2.5 volts. The scope shows both channels tracking each other instead of moving in opposite directions. Your resistance test would have caught this already as near 0 ohms.
• Open in CAN-H or CAN-L: The wire with the open circuit shows no activity — flat line at whatever voltage it floats to. The other wire may show a distorted waveform as the bus tries to communicate with the signal path broken.
• Corrupted bus with noise: The waveform is present but jagged. Transitions are not clean. You see ringing or spikes at the edges of the square waves. This is the signature of a bad module pulling the bus down intermittently, a failing terminator, or aftermarket interference.
• Bus stuck dominant (bus-off condition): Both wires are stuck at the dominant voltages — CAN-H held high, CAN-L held low — with no transitions. One module has gone into a bus-off state, which happens when a module detects too many transmission errors and shuts itself off to protect the network.

The scope is also how you catch intermittent faults. Set the scope to roll mode and wiggle wiring harnesses, connectors, and module connections while watching the waveform. When the waveform glitches or drops out as you flex a specific section of harness, you have found your fault location. This is something no code reader or DVOM can do.

Module Isolation — Unplugging Your Way to the Problem

When your scope shows a corrupted or collapsed bus waveform and you cannot pinpoint the fault from the wiring alone, module isolation is the systematic way to find which module is dragging the bus down. This technique works when a module has an internal failure that is pulling the bus lines to an abnormal voltage.

Start by getting a copy of the CAN bus network diagram for the specific vehicle. You need to know which modules are on the affected bus, where the termination resistors are located, and how the modules are daisy-chained or star-wired together. Start at the ends of the bus — the modules furthest from the gateway or scan tool connection point.

With the scope running and showing the faulty waveform, unplug the first module at the end of the bus. Watch the scope immediately. If the waveform improves dramatically or returns to normal, you found your problem module. If the waveform does not change, plug that module back in and move to the next module toward the center of the bus.

Work systematically. Do not skip modules. Do not unplug two at once. When the waveform changes as you unplug a specific module, that module is either internally shorted or actively corrupting the bus. Verify by plugging it back in — the fault should return.

Keep in mind that unplugging a module that contains a termination resistor will change your resistance reading. Factor that into your diagnosis — if resistance jumps to OL when you unplug a module you just removed from the end of the bus, that module was carrying the terminator.

Wiring Faults — Where the Problems Actually Hide

Most CAN bus faults on high-mileage vehicles are not failed modules — they are wiring problems. The CAN wires run the length of the vehicle, pass through multiple connectors, and get exposed to everything the road can throw at them. Here is where to look:

Door jamb connectors are the number one failure point on most vehicles. The harness that runs from the body to the door flexes thousands of times over the life of the vehicle. The insulation cracks, wires break, and connectors corrode. Any module in the door — power window module, mirror module, speaker amplifier — that lives on the CAN bus can take the whole network down when that door jamb wiring fails.

Under-carpet harness routing traps water from wet feet, leaking sunroofs, and HVAC drain issues. The CAN wires sit in that moisture for months. Connector pins corrode, insulation softens, and eventually CAN-H and CAN-L short together or to ground. Pull the carpet in the footwell and look for discolored or corroded connector housings.

Battery area wiring takes acid damage over time. Any harness running near the battery is at risk. Look for green or white corrosion on wires that run across the battery tray area.

Aftermarket installations are a major and underappreciated source of CAN bus problems. Alarm systems, remote starters, trailer brake controllers, and accessory modules are frequently wired by technicians who do not fully understand CAN bus. They splice into CAN wires using butt connectors or T-tap connectors. Every unauthorized splice adds impedance to the line and can corrupt signal quality. Worse, some aftermarket modules generate their own signals on the bus that conflict with factory modules.

Manufacturer-Specific Failure Points

Every manufacturer has recurring CAN bus weak spots that show up repeatedly once you know what to look for.

GM vehicles frequently develop CAN bus problems at the instrument cluster connector and the BCM connector, especially on early 2000s to early 2010s trucks and SUVs. The connector terminals back out of the housing over time from vibration. The BCM is often a termination point, so a loose BCM connector can show up as a missing terminator on your resistance test.

Ford vehicles have recurring issues with the gateway module (called the GEM or Central Junction Box depending on generation) and the steering column connector. The column connector flexes with every steering input and the CAN wires inside fatigue and break. On late-model Fords, the SYNC module has caused bus communication issues as well.

Chrysler and Stellantis vehicles have a well-known weakness at the TIPM (Totally Integrated Power Module). The TIPM contains multiple CAN bus termination and gateway functions. When it fails internally, it can corrupt multiple buses simultaneously. Rear liftgate wiring on crossovers and SUVs is another common failure point — the wiring loops through the liftgate and breaks at the hinge area.

Toyota vehicles have junction connectors that serve as the central splicing point for the CAN bus. These are not module connectors — they are inline harness connectors that simply splice multiple wires together. Corrosion at a Toyota junction connector can take out an entire segment of the bus. They are often buried under the instrument panel or inside the kick panel area.

VW and Audi vehicles have extensive multi-bus architectures with a central gateway module that everything passes through. The convenience CAN (K-CAN) which handles body modules is particularly prone to issues when door modules fail internally. The gateway itself can fail and block scan tool communication with any module, making it appear as though the scan tool is broken when it is actually a gateway fault.

Gateway Modules — The Bridge Between Networks

Modern vehicles do not run one CAN bus — they run two, three, or even four separate buses, each optimized for the modules on that network. The gateway module bridges these networks together. When the PCM on the HS-CAN powertrain bus needs to share engine speed data with the instrument cluster on the body CAN bus, that data passes through the gateway. The gateway translates between network speeds and protocols.

When a gateway fails, the symptoms depend on which side of the gateway failed. If the gateway loses communication on the powertrain bus side, no powertrain data makes it to the body modules. If the gateway loses communication on the body bus side, none of the body modules can share data with the powertrain. Either way, you get a cascade of U-codes that can look like the entire vehicle lost its mind.

The gateway also sits between the diagnostic link connector and the vehicle's networks. The DLC pin 6 is CAN-H and pin 14 is CAN-L on most modern vehicles — this is where your scan tool connects to the HS-CAN bus. The gateway receives your scan tool's requests and routes them to the appropriate network. If the gateway is down, your scan tool may not be able to communicate with any module at all, even though the vehicle is running fine.

Always check for power and ground at the gateway module before condemning it. A gateway that has lost a ground circuit will fail to bridge the networks even though nothing else is wrong.

Aftermarket Device Interference

This deserves its own section because it is responsible for a significant percentage of the CAN bus problems that shops see, and it is often the last place technicians look.

Remote starters and aftermarket alarm systems installed by auto accessories shops are the worst offenders. Many of these systems are designed to intercept CAN bus messages to handle door locks, windows, and ignition functions. When they work correctly, they monitor the bus passively and inject commands when needed. When they fail — or when they were installed incorrectly — they can hold CAN bus lines at the wrong voltage level, inject conflicting messages, or add enough capacitance to the line to slow signal transitions below specification.

Dashcams and USB chargers that tap into fuse boxes can backfeed voltage into circuits that share grounds with CAN modules. This creates noise on the CAN lines that the scope shows as ringing or irregular signal edges.

Trailer brake controllers that splice into the ABS CAN bus to read wheel speed data are another source of problems. An incorrectly installed trailer wiring harness can short CAN-L to the trailer ground through a corroded seven-pin connector.

To identify aftermarket CAN taps: trace the CAN wires from the DLC connector toward the major modules and look for any splices, T-taps, or added connectors that are not in the factory wiring diagram. Any wire entering a factory harness that is not on the diagram is suspect. Disconnect the aftermarket device completely — do not just unplug it from its power source — and retest the bus.

Repair Procedures — Doing It Right the First Time

CAN bus wiring repair is not the same as repairing a power circuit. The signal quality of the CAN bus depends on the electrical characteristics of the wire itself — its impedance, capacitance, and the twist rate of the twisted pair. Cut corners on the repair and you will be back diagnosing the same car in six months.

CAN-H and CAN-L wires are twisted together intentionally. The twist rate — how many times the wires twist per foot — is part of the design specification. When you repair these wires, you must maintain the twist rate through the repair area. Untwist only as much wire as you absolutely need to work with.

Butt connectors are not acceptable for CAN bus wire repairs. Butt connectors add resistance and can add a small antenna effect that picks up interference. The proper repair is solder and heat shrink. Strip the insulation, twist the wire ends together, flow solder into the joint until it is fully wetted, let it cool, then cover with adhesive-lined heat shrink tubing. Do this for each wire separately, then twist the repaired section back together at the factory twist rate before covering the repair with split loom or electrical tape.

For connector repairs, replace the terminal instead of splicing near the connector. CAN bus connectors use specific terminal designs that maintain proper contact force and impedance. Generic terminals from a bulk terminal kit are not designed for CAN bus duty. Use factory terminals or OEM-equivalent terminals from a reputable supplier.

After every CAN bus repair, verify with the scope. Do not just clear codes and call it done. Connect your scope to CAN-H and CAN-L, start the vehicle, and confirm the waveform is clean — equal and opposite square waves, sharp transitions, consistent amplitude. Drive the vehicle through the conditions that triggered the original complaint and watch the scope for any glitches. A repair that looks good in the bay but fails on the road is not a completed repair.

Recheck termination resistance after the repair as well. If your repair area was near a termination resistor location, verify you are still reading 60 ohms at the DLC.

Putting It All Together

CAN bus diagnosis has a logical flow. Start with the symptom pattern — multiple U-codes across multiple modules tells you to look at the network, not the modules. Pull codes from everything, map out which network is affected, and identify which modules live on that bus.

Run your termination resistance check first because it is fast, it is free, and it tells you whether the basic electrical foundation of the bus is intact. A bad reading gives you a direction immediately.

Connect your scope and look at the waveform under real operating conditions. A healthy bus versus a corrupted bus is obvious the moment you see both on the same screen. The type of corruption on the waveform points you toward the type of fault — short, open, bad module, or interference.

Use module isolation when the waveform is bad and the wiring checks clean. Work from the ends of the bus toward the center, one module at a time, watching the scope for improvement.

Check for aftermarket devices before you condemn any factory component. A five-dollar T-tap from a remote starter installer has put technicians down the wrong diagnostic path for hours on vehicles that were otherwise perfectly healthy.

Repair correctly — twisted pair, solder and heat shrink, maintained twist rate — and verify with the scope before you hand the keys back. CAN bus diagnosis is methodical work. There are no shortcuts, but there are no mysteries either. The bus tells you exactly what is wrong if you know how to read it.