CAN Bus Waveform Analysis with Oscilloscope: See the Data, Find the Fault

Why the Scope Catches What the Meter Misses

The 60-ohm resistance test tells you the physical layer is intact — the wires are connected, the terminators are present, there are no shorts. It is a go or no-go test for the physical infrastructure. But passing the 60-ohm test does not mean the data on the bus is clean. A CAN bus with perfect resistance can still have corrupted data from a failing module output driver, noise from nearby high-current wiring, water intrusion in a connector, or a module that is transmitting valid data at the wrong timing.

The oscilloscope makes the actual electrical signals visible in real time. You see every dominant bit and every recessive bit as it occurs on the bus. You see whether the transitions are clean or rounded. You see whether the voltage levels reach their correct values. You see noise, you see asymmetry between the two channels, and you see the exact timing of when corruption occurs — which tells you which module is transmitting when the corruption appears.

The scope is the tool for CAN bus diagnosis when the resistance test passes but communication faults persist. It is the tool for confirming bus signal quality after a repair. It is the tool for finding a module that is corrupting the bus in a way that intermittently disrupts communication without being severe enough to fail the resistance test.

Scope Setup for CAN Bus Analysis

Connect a dual-channel scope to the DLC. Channel A probe tip to pin 6 (CAN-H), channel B probe tip to pin 14 (CAN-L). Both probe grounds to pin 4 (chassis ground). This gives you the two CAN bus signals simultaneously with a shared reference, which is essential for seeing whether they are properly mirroring each other.

Set the time base to approximately 200 to 500 microseconds per division for high-speed CAN at 500 kilobits per second. At this time base, individual CAN bits are visible — each bit period on 500 kbps CAN is 2 microseconds. A setting of 200 microseconds per division shows you approximately 1,600 bits per screen — enough to see multiple complete CAN message frames and the idle periods between them.

Set the voltage scale to 1 to 2 volts per division. CAN-H swings from 2.5V to 3.5V — a 1-volt range. CAN-L swings from 1.5V to 2.5V — also 1-volt range. At 1 volt per division with appropriate offset, each channel's full swing fills one to two divisions vertically, which gives you good visibility of voltage level accuracy and any asymmetry between the channels.

Turn on the ignition. With modules communicating, the scope immediately shows activity. Adjust the trigger to capture a stable, repeating display. For continuous bus traffic analysis, free-run mode without a trigger often gives the clearest view of what is happening on the bus.

What Healthy CAN Bus Looks Like

A healthy high-speed CAN bus waveform has specific, unmistakable characteristics. Learn this pattern and deviations from it become immediately obvious.

In the idle state — between message frames — both CAN-H and CAN-L rest at exactly 2.5 volts. The two channels show a flat line at the same voltage level. No module is transmitting. The bus is in the recessive state waiting for the next message.

When a module begins transmitting, CAN-H rises from 2.5V to approximately 3.5V during dominant bits. Simultaneously — exactly at the same moment, with the same timing — CAN-L drops from 2.5V to approximately 1.5V. The two channels move in exactly opposite directions by exactly the same amount at exactly the same time. This is the mirror-image pattern that defines healthy differential CAN signaling. If you overlay the two channels on screen, they should look like mirror images of each other reflected across the 2.5V centerline.

The pulse edges are clean and sharp — the signal rises and falls quickly from one level to the other. Rise times are fast relative to the bit period. The top and bottom of each pulse are flat and stable at the correct voltage levels — 3.5V for CAN-H dominant bits and 1.5V for CAN-L dominant bits. Between frames, the return to 2.5V idle is clean and immediate.

The message frames appear as bursts of pulses separated by idle periods. The pattern of bursts varies depending on bus traffic — heavy traffic shows near-continuous pulses with minimal idle gaps. Light traffic shows longer idle periods between bursts. Both are normal depending on the vehicle's state — a vehicle actively in a drive cycle with engine running and multiple systems active generates much more bus traffic than a vehicle in park with only the BCM and instrument cluster communicating.

What Bad CAN Bus Looks Like

Noise on the bus appears as jagged, irregular edges on pulses that should be clean and square. Instead of a clean vertical rise from 2.5V to 3.5V, the edge oscillates — going up, overshooting, bouncing back, and settling. This is ringing from a impedance mismatch or signal reflection. If ringing appears on every edge regardless of which module is transmitting, the problem is in the bus wiring or termination, not in any specific module. If ringing appears only when certain modules transmit, those modules have degraded output drivers.

Asymmetric waveforms — where CAN-H pulses to the correct 3.5V level but CAN-L only drops to 2.0V instead of 1.5V, or vice versa — indicate an imbalance in bus loading. One channel is being loaded more than the other. A partial short on one bus wire, a module with a degraded input circuit that loads one line more than the other, or water intrusion creating an asymmetric resistance path between the two wires can all cause this pattern. The differential receiver can tolerate some asymmetry, but severe asymmetry degrades noise immunity and causes intermittent data errors.

Rounded pulse edges — slow rise times instead of sharp transitions — indicate excessive capacitance on the bus. Capacitance slows the rate at which a transmission line can change voltage. Normal bus capacitance produces sharp edges. Excessive capacitance from water intrusion (which creates a capacitive coupling between CAN-H and CAN-L through the water film), a damaged cable with degraded insulation, or an overly long bus run creates progressively rounder edges. As edge rounding worsens, the voltage levels during bits become less distinct and the receiving modules have more difficulty reliably reading bit values.

Completely flat waveforms — both channels showing the same flat voltage with no transitions — indicate that no module is transmitting. This could mean the ignition is off (normal), or all modules have lost power, or a bus fault is so severe that no module can achieve any bus access. Compare this to the resistance test result — if the bus is shorted (near zero ohms resistance), the short is holding both lines at the same intermediate voltage.

Finding the Module Corrupting the Bus

When the CAN bus waveform shows noise or corruption but the resistance test is correct, a specific module is injecting bad signals onto an otherwise intact physical bus. The module may have a failing output driver, corrupted firmware, or a connector that is partially corroded and causing the module's bus connection to be intermittent.

The diagnostic approach is systematic disconnection while monitoring the scope. Leave the scope connected to pins 6 and 14 at the DLC. With ignition on and the bus showing the noise or corruption, begin unplugging module connectors one at a time. After each disconnection, observe the waveform for 10 to 15 seconds. If the waveform cleans up after you disconnect a specific module — the noise stops and the waveform returns to the clean mirror-image pattern — that module was the source of the corruption.

Confirm by reconnecting the module. The corruption should return. Disconnect it again — the corruption should stop. This bidirectional confirmation eliminates doubt about which module is the source.

Before condemning the module as internally failed, thoroughly inspect its connector. Corroded pins that create intermittent contact between the module's CAN transceiver and the bus wires can cause the same waveform corruption as an internally failed module — the module's output is being distorted by the poor connection before it reaches the bus. Clean the connector pins, apply dielectric grease, and reconnect. If the waveform becomes clean, the connector was the fault. If the waveform remains corrupted after a clean connector, the module's internal output driver has failed and the module requires replacement.

Single-Wire CAN and GM Class 2

Not every vehicle network at the OBD-II DLC uses the standard two-wire CAN protocol on pins 6 and 14. Understanding manufacturer-specific single-wire networks prevents misinterpreting what you see on pins 1 and 2.

General Motors has used single-wire CAN on pin 1 of the DLC on a range of vehicles, including many trucks and SUVs from the mid-2000s through the 2010s. This is a single wire that pulses between 0 volts and approximately 5 volts — not the 1.5V to 3.5V differential range of standard CAN. On a scope, single-wire CAN looks like a standard digital signal referenced to ground rather than the differential pair pattern of two-wire CAN. The data rate and frame structure follow CAN protocol, but the electrical interface is different.

Older GM vehicles from the late 1990s through mid-2000s used Class 2 serial data on pin 2 of the DLC. Class 2 is a 10.4 kilobit-per-second single-wire network with a distinctive waveform pattern — variable-width pulses that encode data in the pulse width rather than in discrete bit levels. On a scope, Class 2 looks noticeably different from CAN — the pulses vary in width in a recognizable pattern rather than showing the uniform bit-width pattern of CAN. A scope trace that shows pin 2 active with variable-width pulses on an older GM vehicle is Class 2 network traffic — not a fault.

When working on a vehicle where the network waveform on the scope does not match standard CAN expectations, check the vehicle's network architecture in service information before concluding there is a fault. Manufacturer-specific networks are common enough that encountering them is not unusual in a diverse shop environment.

Documenting CAN Bus Findings

Save every CAN bus scope capture that shows either a confirmed healthy bus or a confirmed fault. Label each capture with the vehicle information, the DLC pin connections used, and a description of what the waveform shows. Build a reference library of CAN bus captures from healthy vehicles — known-good waveforms for common vehicle platforms are your comparison reference when you capture a suspect waveform from a vehicle with communication faults.

A documented CAN bus waveform showing corruption before a module replacement and a clean waveform after the replacement provides concrete evidence of the repair's success. This documentation is useful for technical disputes, warranty claims on module replacements, and your own diagnostic record.

When writing up the repair order for a CAN bus diagnosis, describe specifically what you measured — resistance between pins 6 and 14, scope waveform condition before and after repair, which module was identified as the fault source and how. This specificity demonstrates competent diagnostic process and justifies the diagnostic time billed.

The Bottom Line

CAN bus waveform analysis with an oscilloscope is the diagnostic step after the resistance test — it confirms signal quality on a physically intact bus and identifies module-level faults that the resistance test cannot reveal. Learn what healthy CAN bus looks like on your scope. Practice recognizing the mirror-image pattern, the clean square edges, and the 2.5V idle state. Deviations from those characteristics point you directly to the type and location of the fault. Combined with the 60-ohm resistance test and systematic module isolation, scope analysis makes CAN bus diagnosis systematic and accurate — which is exactly what automotive technician training should produce.