CAN Bus - Auto detecting CAN Hi short to Lo

[ashtray1987]

Hello gentleman,

I would like to share my experience but also ask for support regarding detecting CAN bus errors.

Currently I use a math channel (Ch A + B) to get CAN HI + Lo and produce a stable 5V line.

I would then put a mask around this math channel, roughly 1V tolerance. Then set an alarm to trigger when there is a mask fail.

This setup is able to detect, short to ground, short to positive and loose contact pins.

What I noticed however is that it cannot detect CAN Hi shorted to CAN Lo, as the math channel still outputs a stable 5V line.

Also what was interesting in the observations is that when I manually shorted CAN Hi, CAN Lo is also shorted, likewise the same for CAN Lo. I was expecting to see only one channel drop to ground and the CAN bus run on single wire mode.

Regarding the above, does anyone have any suggestions for a method to trace CAN HI short to CAN Lo using a trigger or math channel?

Appreciate any advice you have.

Thank you.
Ashley

[liviu2004]

In your case, there is only one 5V regulator in the can transceiver. So if you short can hi to ground, it is logical that can lo goes to ground as well.

If you want to health check can, use can decoder and watch, I find the can math too complex to bother.

[ashtray1987]

thank you for your comments.

I ask about a trigger or math channel for example if the complaint only occurs whilst driving or on rough roads, the math channel and mask is able to capture the event without any input from the technician. Meaning that only 1 person is required, wait for the beep and the error is found.

What I'm hoping for is a method that works for CAN short to each other.

Thanks again

[Steve Smith]

Hello and thank you for the posts.

This is certainly a challenge to detect CAN Hi and Lo shorted together (hands free)

With VAG Convenience CAN it’s not so bad as CAN Hi shorted to CAN Lo results in normal communication but in single wire mode. (Remember there are no termination resisters within the VAG Convenience CAN Bus)
However given the different voltage thresholds with VAG Convenience CAN, the math channel A+B still works in conjunction with a Mask and Alarm if CAN Hi is shorted to CAN Lo

VAG Convenience CAN Bus voltages

The image below highlights the behaviour of the VAG Convenience CAN when momentarily shorted together using a MASK.

Convenience CAN Mask Fail

Notice how CAN Hi + CAN Lo (A+B) no longer adds up to a fixed 5 V but instead switches between zero and 8 V which intrudes into the Mask where we can use this event to trigger an Alarm.

There is an exceptional VW Self-Study Program (SSP269) on this exact subject and well worth a read

Moving onto more conventional CAN with termination resisters and Bus voltages from 2.5 to 3.5 V (CAN Hi) and 2.5 to 1.5 V (CAN Lo) this is more challenging.
In the example below I have connected to a BMW F31 PT-CAN (500 kbps) and deliberately shorted both CAN wires
together.

Powertrain CAN shorted together

During the short circuit the Bus level voltage remains around 2.5 V approx. and this is the problem!
If we use math channel A+B (which will be a constant 5 V with normal CAN traffic) when CAN Hi shorts to CAN Lo we have 2.5 V on both CAN wires.
2.5 V + 2.5 V is 5 V, therefore any Mask drawn around our A+B math channel will not be intruded upon during the short circuit!
Having discussed this issue with colleagues we have the option to use a “Level Dropout Trigger”

Level Dropout

The trigger above will wait for the bus voltage to remain at 2.5 V for a maximum of 10 ms (after an “edge”) where it will then capture our signal. The 3% Hysteresis setting allows for a proportion of noise to be present at the trigger point in order to prevent pre or false triggering.

Level Dropout in action

The image above demonstrates how the scope captured the short between CAN Hi and CAN Lo once the bus level voltage remained at 2.5 V for >10 ms. Once the momentary short between these wires was removed, the CAN communication was restored.

This trigger is by no means the definitive answer as it is fundamentally floored where CAN traffic is low with prolonged idle states (2.5 V) on the Bus.

With the Powertrain CAN I found that 9 ms trigger settings would often false trigger due to normal idle bus periods (2.5 V) where there was the occasional interval > 9ms between messages

This will be a case of adapting the trigger to suit the bus under test and the utilisation rate of the bus. (How busy the bus maybe with CAN traffic)

A small video covering the set-up of the Level Dropout Trigger can be found here where we capture a short between CAN Hi and CAN Lo
https://drive.google.com/file/d/1rB3B1j ... sp=sharing

In addition, to make this a “Hands Free” process the use of Alarm’s with a sound bite certainly brings home how the scope can grab your attention during such glitches. (Please watch to the end)

The psdata file example using this trigger is below

10 MS LEVEL DROP OUT CAN HI LO SC test 4 .psdata

PSdata file example

(1.32 MiB) Downloaded 735 times

A word to the wise, in the example above shorting CAN Hi to CAN Lo resulted in a bus level voltage of 2.5 V and this revealed how to set up the Level Dropout Trigger voltage threshold.

Not all CAN Networks have the same characteristics when shorted together and so it is worth momentarily shorting your suspected CAN lines together prior to road-testing in order to understand how your CAN Network will respond.

I hope this helps take care……Steve

[ashtray1987]

Thank you very much Steve!

Exceptionally well written feedback, and perfectly answered my needs!

Cheers!
Ash

[igeorge688]

Hello everybody,
I have a dumb question.
What will happen if:
A-Connect the Canbus high to a permanent 3.3 volts external supply. Can I stop the traffic on the bus ?
B-Shortcircuit Canbus high with Canbus low. Can I stop the traffic on the bus?
What I want to do is to protect my car from being stolen, so nothing will happen when I press the start button until I close the relay and let the traffic-free on the bus.
Cutting the wire from starting relay to the start solenoid is not a solution. Somebody with time and a flashlight can find the cut wires and short them with a jumper.
I want to stop the ignition until I close an external relay, or send a signal to Canbus to enable ignition.
On the attachment, it is what I have now.
Can you help me, please?

[Steve Smith]

Hello and thank you for the post and not a dumb question at all.

Unfortunately there is no straight forward answer as not all CAN networks are made equal

Some networks are very susceptible to changes in network impedance
https://www.youtube.com/watch?v=mIw-4V1 ... Automotive

Other networks tolerant impedance change without any noticeable errors to the driver

Network architecture is another consideration as VAG Convenience CAN will tolerate CAN Hi and CAN Lo joined together with no issue at all (Switch to single wire mode) where as conventional CAN will typically halt communication unless the system is designed to accommodate such a short

Below we have conventional CAN Hi joined to CAN Lo

Image 1

Now, depending on the vehicle in question (complexity) when one network is off-line another may compensate so the vehicle can still drive and perform as normal (i.e. Back up CAN)

Knowing the architecture of your vehicle is going to be essential here as would be the consequences of an attempt to start the vehicle with the immobilizer active

Upon deactivation of the immobilizer you could be left with multiple warnings lights illuminated, multiple DTC's and reduced power until fault codes are cleared

With all that said, if you wish to corrupt an entire CAN network you can short both CAN Hi and Lo to battery positive/negative or send out high priority CAN messages at high frequencies such that other messages cannot win arbitration

It would be more desirable to prevent the exchange of CAN messages between ECU's that are essential to engine start, i.e., take the Engine ECU off-line

I hope this helps, take care....Steve

[igeorge688]

Thank you Steve