Scope Waveforms & In-Cylinder Pressure the signal the scan tool can't show you
The scan tool hands you the ECU's opinion — a filtered number, a few times a second. The scope shows you the raw signal on the wire, thousands of times a second. Learn to read waveform shapes — sine, square, duty cycle, cam/crank sync — and then put a pressure transducer in a cylinder and read combustion itself. This is where good diagnosis stops guessing.
Start here
Two instruments, two completely different views
The scan tool shows you what the ECU concluded. A PID is a number the computer already measured, filtered, and published on the data bus — useful, but it's the summary, not the signal.
The scope shows you what's actually on the wire. Voltage over time, straight off the circuit, fast enough to catch the glitch, the dropout, the late edge — the things that disappear into the ECU's average.
Shape is information. A sine, a square, a duty cycle, a pressure hump — each shape tells you what kind of device made it and whether it's healthy. Read the shape and you're reading the component's health directly.
The rule: use the scan tool to see what the ECU thinks; reach for the scope the moment you need to know what's really happening — especially when a fault is fast or intermittent.
New to the scope itself? Start with Reading a Scope Waveform for setup and the five traces you'll read most. For PIDs and the measured-vs-calculated trap, see Reading Live Data.
The big oneScan data vs the scope — it's all about sample rate
This is the idea that changes how you diagnose. A scan tool reads PIDs off the data bus, and the bus has a speed limit. Each PID updates maybe a handful of times a second — and the more PIDs you watch, the slower each one refreshes, because they share the same pipe. Worse, the value is already filtered and averaged by the ECU before it's published. A scope doesn't ask the ECU anything — it samples the raw voltage directly, thousands to millions of times a second. It sees the waveform between the scan tool's updates, where the fast faults live.
Same signal, two instrumentssample rate decides what you see
Scope — raw voltageScan tool — bus PID samples
Scan PID rate~1–10 updates/sec, shared across PIDs — watch fewer PIDs to speed each one up
Scope sample ratethousands to millions/sec per channel — it sees the actual edges and glitches
Scan valuefiltered + averaged by the ECU — a conclusion, with latency, not a live measurement
Scope valueraw voltage on the wire — no filtering, no middle-man, no lag
Rule of thumbsample ≥ ~10× the fastest feature — a 5 Hz PID can't represent a signal swinging hundreds of times a second
What this means on the car
Intermittent dropouts vanish on a scan tool. A crank sensor that cuts out for a few milliseconds at cranking speed won't show in the RPM PID — but it's obvious on the scope.
"Commanded" and "calculated" PIDs aren't measurements. Load, commanded timing, calculated flow — those are the ECU's math. Don't chase them like a sensor reading; prove the input with the scope.
Use both, deliberately. Scan tool to read the ECU's story and command bidirectional tests; scope to confirm what the wire is really doing. The best techs correlate the two, not pick one.
ShapesSine vs square — analog vs digital
Before you name a signal, name its shape — it tells you what kind of device made it. An analog signal carries its information in the voltage level at every instant (a smooth, continuously varying line). A digital signal carries it in timing — two voltage levels, on and off, and the meaning is in when and how long.
Three shapes you'll meetsine · square · frequency
Sine (analog)Square (digital on/off)Frequency-coded
Sine — the analog world
Level = info
A smooth wave whose voltage is the message. Think a VR (magnetic / variable-reluctance) crank or cam sensor: it generates its own AC voltage as the reluctor teeth pass.
Key tell of a passive VR sensor: amplitude and frequency both rise with speed. At cranking it may be only a volt or two — a weak sensor or a wide air gap can drop out at crank speed and cause a crank-no-start.
Other analog shapes: alternator AC ripple (should be small and even — a diode fault chops it), a knock sensor's piezo ring, narrowband O₂ swinging 0.1–0.9 V.
Square — the digital world
Timing = info
Flat top, flat bottom, vertical edges. A Hall-effect crank/cam sensor outputs a clean square wave at constant amplitude regardless of speed (it's powered — 3 wires: power, ground, signal).
VR vs Hall at a glance: VR = AC sine, amplitude grows with rpm, 2 wires, passive. Hall = square, amplitude fixed, 3 wires, powered. Knowing which you're probing tells you what "good" looks like before you ever connect.
Also digital: injector/coil driver command edges, and any serial data line.
Frequency-coded
Hz = value
A square wave whose frequency (not duty) carries the reading — some mass-air and pressure sensors output Hz that climbs with flow or pressure.
The scan PID shows the decoded number; the scope shows the Hz directly, so you can catch dropouts or a flatlined/railed output the PID would smooth over.
ControlDuty cycle & PWM — how the ECU meters an actuator
Most outputs aren't just "on" or "off" — the ECU switches them on and off fast and varies the on-time. That's pulse-width modulation. Frequency stays fixed; duty cycle — the percent of each cycle the output is commanded on — slides up and down to control average power, flow, or position.
Duty cycle = on-time ÷ periodlow duty → high duty
The two things that trip people up
Energized is usually the LOW part of the trace. Most actuators are ground-side (low-side) switched: the ECU completes the ground. So on the control wire, B+ sits high when off and snaps to ~0 V when the ECU turns it on. Don't read it upside down.
Look for the inductive turn-off spike. When the driver opens a solenoid or injector, the collapsing magnetic field throws a voltage spike (injectors clamp it around ~60 V). That spike proves the winding has real inductance — it's intact and the driver actually switched. No spike = open winding or a driver that isn't firing.
Measure it: duty % = on-time ÷ full period × 100. Compare commanded (scan PID) against actual (scope) — a purge or boost solenoid commanded 40% but stuck full-on or dead-off on the scope is your answer.
You'll see PWM on purge and vent solenoids, boost/wastegate and turbo vane control, transmission pressure-control solenoids, variable-speed fuel pumps, cooling fans, and electronic throttle motors (H-bridge). Same reading skill every time: fixed frequency, variable on-time.
SyncCam/crank correlation — the overlay that proves timing
The crank sensor (CKP) rides a reluctor wheel with a missing-tooth reference gap (think 60−2 or 36−1) so the ECU knows exactly where the crank is. The cam sensor (CMP) fires once every two crank revolutions to tell the ECU which revolution it's on — power stroke vs the companion cylinder — for sequential fuel and spark. Put both on the scope at once and their relationship is the mechanical timing.
Crank (with sync gap) + cam, overlaidthe gap lines up the same way every cycle — or it doesn't
Cam (CMP)Crank (CKP)
What the overlay tells you
Consistent is correct. The cam edge should land at the same spot relative to the crank's sync gap on every cycle. Rock-steady = belt/chain and sensors in time.
Drifting or offset by teeth = mechanical. A cam-to-crank relationship that wanders, or is shifted a few teeth, is a jumped or stretched chain / slipped belt — and it's what sets a P0016/P0017/P0018/P0019 correlation code. The scope shows it directly instead of you guessing from a code.
Crank sensor dropout hides at low rpm. A VR crank that goes weak only at cranking speed gives a no-start that cranks fine; the scope catches the missing/low pulses the tach PID can't.
A cracked reluctor throws an extra or erratic edge in the same spot every revolution — easy to see once both traces are up.
A delta pressure sensor is a transducer you drop into the intake, the exhaust, or the crankcase and feed into the scope. It does not give you an exact, calibrated pressure — it reads the relative pressure change, the pulse each cylinder throws as it breathes. That's the whole point: the pattern is reliable and repeatable, so you diagnose from the shape and rhythm of the pulses, not from a number on a gauge. One transducer in the tailpipe or an intake port and the entire engine's breathing shows up as a waveform — valvetrain and all — with nothing taken apart.
Exhaust pulse train — one cylinder offread the pattern, not the number
Exhaust pressure pulses — even = healthy, the odd one out = the fault
In the exhaust
Valve seal / restriction
Each cylinder's exhaust event throws a pressure pulse. Healthy = an even, rhythmic train of matching pulses — the diagnosis is in the evenness.
Burnt or leaking exhaust valve → that cylinder's pulse goes weak, rounded, or distorted and stands out from the rest.
Restricted exhaust (plugging cat / DPF) → the baseline lifts and every pulse rounds over from back-pressure.
Reversion (bad overlap or valve timing) → backward-going dips where exhaust gets shoved back past the valve.
In the intake
Breathing / sealing
Each intake stroke pulls a vacuum pulse. Same game — you read the rhythm: a steady, matching set of pulses from a healthy engine.
A cylinder with a sealing problem — leaking or bent intake valve, low compression, a valvetrain fault — disturbs its own pulse. The odd pulse in the train is your suspect.
Count the pulses against the firing order and the one that doesn't match names which cylinder — before you pull a single cover.
In the crankcase
Rings / blow-by
Drop the transducer in through the dipstick tube or oil-fill and you're reading crankcase pressure. A healthy engine barely moves here — the PCV holds it near a slight, steady vacuum.
Worn rings, a cracked ring land, or a holed piston → combustion blows past into the crankcase and the pressure jumps, pulsing in time with that cylinder's power stroke. A big, rhythmic crankcase pulse is blow-by.
It settles the last question the pipe tests can't: the exhaust/intake pulse says a cylinder breathes wrong — the crankcase pulse says whether it's leaking past the rings (ring seal) rather than a valve. Ring-seal vs valve-seal, sorted with nothing apart.
It also catches a plugged PCV or blocked breather — crankcase goes positive and stays there instead of pulsing clean.
Why it works — and how it differs from in-cylinder
You read the pattern, not a value. It's not a calibrated gauge — it's a reliable, repeatable signature. Compare the pulses to each other; the odd one out is the fault. That's exactly why it works without ever handing you an exact number.
One transducer, whole engine, non-intrusive. From the tailpipe or an intake port you watch every cylinder breathe at once and pick out the bad one — no teardown, no plug pulled.
Relative pulse vs absolute in-cylinder: this reads the breathing pattern to find WHICH cylinder and whether it's an intake- or exhaust-side fault; the in-cylinder transducer (next) reads the absolute combustion pressure of that one cylinder to confirm what's wrong inside it. Find it with the pulse test, confirm it in the cylinder.
Start cheapRelative compression — the 30-second mechanical check
Before the transducer comes out, this is the fastest mechanical test on the car — and one of the most basic. Clamp a low-amp current probe around the main battery or starter cable, disable the engine from starting (pull fuel / ignition), and crank it while the scope watches starter current. Every compression stroke makes the starter work harder, so the current traces a repeating ripple — one hump per cylinder. You read every cylinder at once, in seconds, with nothing removed.
Cranking current — relative compressioneven humps = even compression
Starter current — one hump per compression stroke; the short one is the fault
How to read it
Even peaks = even compression. Each hump is one cylinder resisting the starter on its compression stroke; a healthy engine draws a steady, uniform ripple.
A short hump = a weak cylinder. Less compression means less load on the starter, so that cylinder's current hump is lower. Count it to the firing order to name the cylinder.
It's RELATIVE, not a number. It compares cylinders to each other — the odd one out is the find. An engine that's uniformly tired won't throw a standout, and a weak battery or a parasitic/charging load muddies it, so crank with a good battery.
The one-two punch: relative compression tells you which cylinder is weak in 30 seconds; the in-cylinder transducer (next) tells you why — rings, a valve, or timing. Fast screen first, deep confirm second.
Relative compression also appears in the primer — the current-clamp note in Reading a Scope Waveform.
The deep oneIn-cylinder pressure — put a transducer in the hole
This is the one that still feels like magic. A pressure transducer — the Pico WPS500 is the common one — adapts into the cylinder through the spark-plug hole (or a glow-plug / injector port on a diesel) and feeds the scope a voltage proportional to pressure. Now you're plotting absolute cylinder pressure against crank angle: all four strokes, from the driver's seat, with nothing torn down. Run it two ways — cranking (spark/injection disabled, for clean compression and valve events) or running at idle (dynamic breathing, and the exhaust-restriction test below).
One combustion cycle — the landmarks720° / two crank revolutions
Read the landmarks — every trace has them
Compression peak at TDC — the tall spike. Peak height compared cylinder-to-cylinder is relative compression with one transducer, no gauge in every hole.
Exhaust valve opens (EVO) → blowdown — pressure drops sharply on the power stroke as the exhaust valve cracks and the cylinder dumps to the pipe. Where that drop sits is an exhaust-cam timing marker.
The exhaust pocket — the low bump riding the exhaust stroke while the valve's open. Its height is your exhaust-side gauge — hold that thought for the restriction test.
Intake valve opens (IVO) → intake pocket — the dip toward (or below) atmospheric as the cylinder draws in; its position marks intake timing.
Always reference TDC. Put a crank/cam signal or a #1 coil trigger on a second channel — valve-event positions only mean something measured against TDC.
Pattern — healthy vs a restricted exhaustthe pocket & floor lift
A plugging cat or DPF raises back-pressure → the exhaust pocket and the floor lift toward the compression line. Snap the throttle and a restriction drives the pocket up further with flow. You condemn a cat by shape, in minutes, no pipe dropped.
Burnt / leaking exhaust valve
Valve seal
Compression peak is low for that cylinder and the exhaust side is disturbed — pressure escapes the moment it should be sealing. Confirm against a known-good cylinder on the same engine.
Worn rings / low compression
Bottom end
A low, rounded compression peak that builds slowly — and, cross-checked, a matching blow-by pulse in the crankcase (above). Rings leak into the crankcase; a valve leaks into a port. The pair tells you which.
Cam timing & VVT
Valve events
Jumped chain, stretched timing, or a VVT phaser stuck off and the EVO drop, the exhaust pocket, and the intake dip all shift relative to TDC. Referenced to a crank/#1 marker, you read cam timing off combustion itself — before you pull the front cover.
Pro move: overlay the pressure trace with the crank signal (or a #1 coil / TDC marker) on a second channel. Referencing valve events to crank angle is what turns a pretty waveform into a real measurement of cam timing and valve events — and lets you compare cylinders apples-to-apples.
The transducer reads real pressure — the interpretation is the skill. Compare a suspect cylinder to a known-good one on the same engine, confirm adapters and any OEM-specific access in service data, and always reference TDC for angle accuracy.
NetworksCAN bus on the scope — when the data line itself is the fault
Scan data assumes the network underneath it is healthy. When modules drop off, codes scatter across unrelated systems, or the bus goes dead, the scope is how you see the physical CAN signal — the part the scan tool can't show you, because that bus is its lifeline.
What a healthy bus looks like
Two mirror-image lines. CAN-High rises from ~2.5 V toward ~3.5 V while CAN-Low falls from ~2.5 V toward ~1.5 V — opposite and symmetric. That differential swing is what makes CAN shrug off noise; at rest (recessive) both sit near 2.5 V.
Clean, fast transitions. Rounding, ringing, or a line that won't leave 2.5 V is a physical-layer fault — wiring, a connector, or termination.
~60 Ω termination across the pair, key off (two 120 Ω resistors in parallel). ⚠️ A dead bus can still read a perfect 60 Ω — resistance alone never proves the bus is alive. The scope does.
What the scope catches that a meter won't
Physical layer
One line shorted to power or ground → it stops mirroring and the pair loses its symmetry.
A babbling / chattering module flooding the bus → a distorted or collapsed waveform you watch clear the instant you unplug it.
Missing or open termination → overshoot and ringing on every edge.
Which node is at fault — pull modules one at a time and watch the bus clean up.
Want the full walkthrough — eight simulated bus faults with the ohmmeter and scope reacting live? It has its own guide: CAN Bus Diagnosis.
Check yourselfFour quick ones
You're watching an RPM PID on the scan tool during a crank-no-start and it looks steady. Can you trust that the crank signal is good?
No. The scan PID updates only a few times a second and is filtered — a crank sensor that drops out for a few milliseconds at cranking speed can still show a "steady" RPM number. Put the scope on the raw CKP wire; that's the only way to see the dropout.
On an injector control wire you see the trace sitting at battery voltage, snapping to near zero, then a sharp spike as it releases. Which part is the injector energized?
The near-zero (low) part. It's a low-side (ground) driver — the ECU completes the ground to energize it, so "on" pulls the wire to ~0 V. The spike at turn-off is the winding's inductive kick (clamped ~60 V) and proves the coil is intact and the driver fired.
You put a delta pressure sensor in the exhaust and get an even pulse train with one weak, rounded pulse. It never shows an exact pressure — so how is it useful, and what does that pulse tell you?
You read the pattern, not a number — the train is a reliable, repeatable signature, so the pulse that doesn't match the others is the fault. A weak, rounded exhaust pulse points to that cylinder's exhaust side — a burnt or leaking exhaust valve (or a local restriction). Count it to the firing order to name the cylinder, then confirm with an in-cylinder trace.
An in-cylinder pressure trace shows the exhaust hump and the whole exhaust side lifted well above the atmospheric floor. First suspect?
Exhaust restriction — a plugged catalytic converter or DPF raising back-pressure. The lifted exhaust portion is the signature; confirm by comparing to a known-good shape or measuring exhaust back-pressure. You found it without dropping the pipe.
Bottom line
The scan tool tells you what the computer decided; the scope and a pressure transducer tell you what the engine is actually doing. Learn the shapes, respect the sample-rate gap, and you stop guessing — you measure. That's the difference between throwing parts and knowing.
Stuck on a real one right now? Ask Kate — she'll walk the waveform with you, free.