Complexities arising from interaction between multiple inter-connected components in an autonomous cyber-physical system can potentially result in differences in intended and observed operations of a cyber-physical system. To perform fault analysis of a CPS, it is imperative to explain this discrepancy in terms of the components of the cyber-physical system's control code. This paper proposes FaultEx framework that derives a hybrid system representation of the cyber-physical system operation in deployment from the observed input/output traces and matches it with a finite state machine based simplification of the CPS code. Discrepancy in system's operational behavior can then be explained in terms of call conditions as binary or unary operations on input and output variables and status of function call arguments. Usage of FaultEx on two different heavy vehicle braking system emulation platform shows that it can identify new modes and timed transitions in CPS code.