Hi All and thanks for the replies, I'll try and update you all as best as I can (no pun) ...
STC, thanks for pointing out the Bit rate at 500k, had relied upon Pico to auto configure (Pico Staff ... bug report ...please take a look and try some tests using the file uploaded to see why your auto detect routine keeps defaulting to 1mb for this signal, when it is 500k?!), and realised afterwards that it had set itself up at 1mb not 500k, so some of our issues lay in basic speed being wrong! but also in the voltage settings, which when corrected allowed all packets to decode.
This then lead to a read up of the ISO standards, yawn!, but basically the differences between what we label things as is summarised as follows, not exhaustive and probably over simplifying for our current car... but ...
K-line - typically has a resistance to live or ground of 510ohm, not always, rate if via the OBD port is fixed to 10.4k ... not specified within private networks as far as I can see, other than rates of 1.2k to 10.4k were implemented)
Can-bus pair - swing voltage of 2v nett, so often 2.5v and +1 high, -1 low, nett 2v. 120ohm end point resistors, giving nett 60ohm but this is very often NOT the case, and many manufacturers use resistors in each ECU, rather than external or others, so can't be relied upon, ISO 11898 states Low Speed CAN (up to 125kBit/s) or High Speed CAN (up to 1MBit/s), low speed can's can operate at 5v signal swing (sometimes we see 4v swing not 5v)
Single wire canbus = upto 83k speed, voltage swing of 5v (I guess 4v might exist in the real world too)
so, knowing this, the second "corrupt pair" is running at 500k and based on the ECU's both showing an internal reistance between pins 89-90 of 120ohms, fits the spec and description of a Pair can bus, not a signle wire. So the short onto the main power train can bus, is as best we can tell a fault, and we'll try to prove this later in the week...
The EOBD is on the power train bus on this car, the data is ubale to lie! The pins of both engine ECU's () and the Gearbox are all identical, this cannot be a repeated thing, it is the same bus, remove the ECU's and do continuity, it's 0.3 ohms or less, and put a resistor of say 4.7ohms on it and that increases the resistance as expected ... it's the same wire pair! So noise is bad on only 1 bus, not 3 different ones.
So, the resistance on 6 and 14 is about 53ohms (Ohms law being 2 x 120ohm resistors in parallel give 60ohms resistance), so this is acceptable, take any ECU off, and this changes the resistance based on the ecu removed (gearbox is different to each engine ecu as it has different internal resistor termination), so again proves pins 6 and 14 are on the power train wires not some gateway. There may be a gateway for other ECU, on one of the 2 low speed (100k) can bus pairs that are made public at the EOBD socket (yes there are 3 can bus pairs visible there - see below), so no this is not the same as other VAG, and it has more in common with the Aventador architecture and other common ECU, than the R8, but the Aventador uses the Lambo in house dual LIE engine ECU and their own Gearbox ecu, where as the LP560 shares the MED9.1.1 but not the R8 Gearbox ecu ... and the MED 9.1.1 is pin programmable, so might not be software implemented the same as the R8. Don't have full R8 wiring to compare.
EOBD exposed CAN Lines (from our own research, which is still incomplete, in that we have not mapped every ECU, so airbag, steering, ABS etc not placed into our map/topology just yet...)
Pair CB1 - ECU's - Same Bus as EOBD (13L/12H) and xx () and xx () and xx ()
12 - CB1H = CanBus 100k High(Pair with Pin 13) [0v Base +4v High]
13 - CB1L = CanBus 100k Low (Pair with Pin 12) [5v Base -4v Low]
Pair CB2 - ECU's - Same Bus as EOBD (09L/08H) and xx () and xx () and xx ()
08 - CB2H = CanBus 100k High(Pair with Pin 09) [0v Base +4v High]
09 - CB2L = CanBus 100k Low (Pair with Pin 08) [5v Base -4v Low]
Pair CB3 - Same Bus as EOBD (14L/06H) and Gearbox (33L/45H) and Engine ECU RH (67L/68H) and Engine ECU LH (67L/68H) and xx ()
06 - CB3H = CanBus 500k High(Pair with Pin 14) [2.5v Base +1v High]
14 - CB3L = CanBus 500k Low (Pair with Pin 06) [2.5v Base -1v Low]
Mark, yes a topology is he first thing I try to get for any CAN issue, and sadly no, we don't have! We do have a partial one for the Gallardo 5.0L pre the LP560, but that is completely different and uses several K lines at EOBD, plus the old Lambo LIE and bespoke gearbox ECU's not Bosch/Marelli ones on this vehicle. We tried to start using that as a guide (as GFA, ZKE and other ECU's appear similar, but it became clear starting from no assumptions was easier and quicker) ... anyone with this or PIN outs for any ECU's (would consider R8 or Aventador too, just to get ideas!) or CAN pins, would be great - Dash, GFA, ZKE ILM being the ones most useful that we have little data on.
Mark, part answer above, but Andrew and Mark, the noise is not from our leads, as best we can tell, but with better decoding parameters, can decode the signal. Still not sure how much is Gibbs effect. The regular spikes not sure, but engine is off, ignition on, would need to check further if this is relevant or not once the big issues are fixed, and if any fix removes them....
steevegt, the Gallardo chassis and signal ground, like many cars now have a common earth point, but we're bonded on a breakout box using both, and using a new scope, so all 4 channels have their own grounds. While a branch on a high speed CAN has a theoretical limit of 30cm, with a 1Mega ohm impedance device like the PICO, we should be fine using 1meter cables, but have tried 15cm wires too which did not improve things. I'm old school, I used to install older Ethernet computer networks using 50ohm termination and fault find them when people had mixed topologies, and done other silly things, so canbus is like memory lane for me! Sadly, unrelated I also have a load of Voip clients, so use packet sniffers for proper high speed traffic, so would love to get hold of a wireshark equivalent, or maybe build an ardunio board to allow this sort of sniffing over longer periods ... but I digress
Only the power train CAN (500k) has the noise, the 2 low speed CAN's don't.
the errors occur regardless of kit being plugged in, so we are not causing the errors ourselves!
Currently we are focusing on the fact that the ENGINE ecu's off the car are 120ohms between pins 89 and 90, yes both ECU the same, this supports the other data, including third party, and the speed it works at, the voltage logic levels, that 89 and 90 and a pair can-bus. But not operating as such due to the signal on pin 90 being a "copy" of pin 67, so looking at the rouge wire - pin 90, with engine ecu's disconnected, the harness has less than 0.5ohm resistance to pin 67 of the same harness or pin 14 at the EOBD (so there is a short somewhere). While it is open circuit between 89 and 90 (ecu's off), indicating that it is a private can directly between the two 120ohm terminations within each engine ecu. further with the ecu's off and the car powered the single wire of pin 89 has no voltage or wake up messages/logic levels.
As the owner has reported he got the car very hot (too hot to touch the rear quarter or engine lid), we're looking at maybe melted wires from a point where the harness runs too close to a heat shield etc. but there is no sign of anything other than so water ingress which we've already repaired and was not bad enough to cause a fault just yet, at any of the points we've stripped or inspected ... so it's going to be a deep dive in the guts of teh car.
While this might not solve all the issues, fixing what you can find is a good place, as the other problems might stem from other wires melted/chaffed at the same location. We then have further tests to ensure the body ECU is sending on a K line (well that's what we've been told it's using!) to both Engine ECU and Gearbox ECU's (a shared single wire K line with all 4 ECU) ... and then checking the rest of the CANBUS's to see if there is another one wee've not found, or allocate each ECU to the BUS's we have found.
In terms of ECU's we can or cannot communicate with, we seem to be able to see them all, although don't have a CAN visibility utility (we do for Ferrari etc) that can check presence ... is there a VAG tool that we could try?
Thanks again for all the questions and pointers, sometimes it realy does helps to have a different perspective being put forward, even if only to retest the things you thought, and prove they are what you thought!
Sorry for long rambling reply, but any further ideas, comments, and questions, or diagrams/tech data most welcome