Field diagnostics for CAN networks

01Before you measure

Diagnosis starts with knowing what normal looks like on the vehicle in front of you. Take the network topology from the manufacturer's service information: which ECUs sit on which bus, where the backbone runs, which nodes carry the terminating resistors and which bus type is used. A high-speed bus to ISO 11898-2, a fault-tolerant bus to ISO 11898-3, a single-wire bus to SAE J2411 and a J1939 backbone all look different on a meter.

02Multimeter checks

Bus voltages to ground

With the ignition on and the bus active, a multimeter averages the fast waveform into one DC value. On a healthy high-speed bus the recessive level is about 2.5 V on both wires, and dominant bits drive CAN-H towards 3.5 V and CAN-L towards 1.5 V. The meter therefore shows CAN-H slightly above 2.5 V and CAN-L slightly below, by an amount that grows with bus load. The two readings should add up to roughly 5 V.

Termination check with the ignition off

Resistance must be measured on an unpowered network. While the bus is awake, the transceivers bias and drive the lines and the reading is meaningless. Switch the ignition off and let the network sleep; better still, disconnect the battery negative terminal and wait a few minutes, following the manufacturer's instructions for battery disconnection.

Worked example. Consider a vehicle that shows intermittent stability-control warnings after an add-on was fitted. With the battery disconnected, the bus in question reads 41 Ω at a node connector. Three 120 Ω resistors in parallel give 120 ÷ 3 = 40 Ω, so a third terminator is the obvious suspect. Unplugging the add-on restores 60 Ω: its internal terminator was enabled. On the scope, the dominant differential level had dropped visibly below its usual 2 V, eating into the margin above the receivers' 0.9 V threshold.

Shorts to ground, to battery and between the wires

With the network unpowered, measure from each wire to ground and to battery positive. Both readings should be high, typically kilo-ohms or more, because the only paths run through transceiver inputs. A few ohms means a short. Then split the network: unplug nodes or open inline connectors one at a time and watch which disconnection makes the short disappear. Chafed harnesses at door hinges, seat rails, bulkhead grommets and recently installed accessories are the usual suspects.

Locating an open circuit

An open backbone splits the bus into two segments, each with one terminator, so the reading rises from 60 Ω to about 120 Ω and the nodes beyond the break lose contact with the rest. To locate it, open a connector on the backbone and measure each side separately: a continuous side reads about 120 Ω, its own terminator, while the side containing the break reads open circuit. Move to the next connector on the open side and repeat. Flexing the suspect section while watching the meter catches intermittent opens that a static test misses.

03Oscilloscope diagnostics

The multimeter tells you whether the bus is wired correctly; the oscilloscope tells you whether it works. Connect channel 1 to CAN-H and channel 2 to CAN-L, both referenced to a solid ground at the measuring point, and display the math channel CAN-H minus CAN-L, or use a differential probe.

Setting up the scope

Trigger on the rising edge of the differential signal, since the start-of-frame bit is the first recessive-to-dominant edge after bus idle, and use deep memory so you can scroll through whole frames at full sample rate. Ten samples per bit is the floor: to judge edges and ringing, use twenty or more.

What a healthy bus looks like

• CAN-H and CAN-L are mirror images: recessive at about 2.5 V on both, dominant at about 3.5 V and 1.5 V.
• The differential signal sits near 0 V when recessive and near 2 V when dominant. ISO 11898-2 requires receivers to treat less than 0.5 V as recessive and more than 0.9 V as dominant, and transmitters to deliver 1.5–3.0 V dominant into the specified load.
• Edges are clean, with little overshoot, and each level has settled well before the sample point, typically placed between about 75 % and 87.5 % of the bit time on vehicle networks.
• Levels are flat. Small, consistent differences in dominant amplitude between nodes are normal, because each sits at a different distance and ground.

Fault patterns and their causes

Error frames, error passive and bus-off

CAN protects itself through the fault confinement defined in ISO 11898-1. Every node keeps a transmit and a receive error counter. Each detected error, whether a bit error, a stuff error after six equal consecutive bits, a CRC error, a form error or a missing acknowledge, makes the node send an error flag that destroys the frame for everyone and raises its counters; successful frames lower them.

This explains a classic field symptom: one faulty node goes bus-off and falls silent, and every other node reports lost communication with it. The fault codes point at the victim's neighbours, while the cause is the node, or the wiring, that went quiet. In CAN FD frames, the ESI bit shows whether the transmitter is error passive, a useful clue on a scope with protocol decoding.

04Faults that appear after an add-on is installed

A large share of field faults follows the installation of telematics units, taximeters, alarms or diagnostic dongles. Before replacing a control unit, check whether the network itself was changed:

• A third terminator. Many general-purpose CAN devices ship with 120 Ω fitted or enabled. On an already terminated vehicle bus, the reading drops to about 40 Ω.
• A long stub. A device lead coiled behind the dashboard is still a stub, and its reflections degrade every edge.
• A classic-only node on a CAN FD bus. A classic controller that is not FD-tolerant treats every CAN FD frame as an error and transmits error flags, destroying traffic for the whole network.
• A node that will not sleep. A device that transmits, or keeps a control unit awake through its ignition input, stops the network sleeping and drains the battery.
• Untwisted or quick-tap joints. Faults that follow temperature, humidity or rough roads often trace back to a joint.
• Ground offset. A device grounded away from the units it communicates with carries starter current in its reference.

Installation best practices shows how to avoid each of these.

05A twelve-step field diagnosis checklist

1. 01
   Define the symptom

   Which functions fail, which lamps are lit, and when: cold, hot, on rough roads, or only after the vehicle has slept?

2. 02
   Read every fault memory

   Note which nodes report lost communication, and with whom. The node nobody can reach is the starting point.

3. 03
   Check supply and ground

   Battery voltage at rest and under load, plus the supply and ground of the suspect node. Many communication faults are a node browning out.

4. 04
   Ask about recent work

   What was installed, replaced or repaired? Look for add-on devices, quick taps and fresh tape on the harness.

5. 05
   Establish bus and topology

   Bus type, bit rate, backbone route, terminator locations and the connectors where the network can be split.

6. 06
   Measure bus voltages

   Ignition on: CAN-H and CAN-L to ground at the suspect node and at a known-good node.

7. 07
   Measure termination

   Network unpowered: about 60 Ω between the wires on a high-speed bus.

8. 08
   Check for shorts

   Each wire to ground and to battery positive, network unpowered.

9. 09
   Isolate by splitting

   Disconnect nodes or inline connectors one at a time until the reading or the symptom changes.

10. 10
    Look at the waveform

    Differential signal, levels, edges, ringing and error frames at the suspect node and at a reference node.

11. 11
    Repair to standard

    Use the manufacturer's repair method, keep the pair twisted, and remove or correct any non-conforming add-on.

12. 12
    Verify and document

    Clear the fault memories, re-measure, road-test, confirm that the network sleeps and record the readings.