Some connection method info that might help people connecting to VAG cars with their CBT.
<b>Method 1 - K-wire:</b>
The OBD cable that ships with the CBT is wired so that it connects to the K-wire in VW's OBD port. This is the generic (government mandated) diagnostics connector that you can use to get very simple data out of the car. The K-wire connects to the car's CAN Gateway which is setup to only provide the bare minimum legally required data on this port. This is the same data you can get to with a Bluetooth OBD dongle or generic ebay auto diagnostic tool.
It's a very simple protocol - single command out, single response back. No handshake or connection required. The requests to make, responses that are received and the formulas to decode returned data into human readable values are all publicly available around the web - search for 'OBD PIDs'.
<b>Method 2 - CANBus from OBD Port</b>
VW diagnostic programs (both the factory programs and professional grade 3rd party apps like RossTech VCDS) access devices on the CAN networks using the CANBus pins on the OBD port. These are cabled as if they were power train CAN wires, but they actually connect directly to the CAN Gateway. I need to check the pin spots but from memory they are available at Pin 8 (Can High) and Pin 7 (Can Low) on the OBD connector.
You can connect at 500kpbs as the CAN Gateway will translate requests onto the lower baud busses as required.
This CAN connection is data-on-request, so if you connect and start logging the traffic you won't see anything. The CAN Gateway only passes data down this bus if it is specifically requested.
To request data you need to handshake with the CAN Gateway, negotiate connection settings, request a set of data from a particular CAN device and read the data that is returned. With the right requests you can access data from any of the 3 busses from the one connection - so your CBT can request RPM from the Engine controller, Odometer from the Instrument Cluster, Window Position from the Front Right Door controller etc.
The protocols to request this data, and the formats the data come back in, is all VW proprietary and they don't publish the specs. To use this method you'll need to reverse engineer the process for the data you wish to request. If you tap the bus on the back side of the OBD connector then for example you can connect a VAGCOM cable to the OBD connector itself, and use VCDS to request and view data from the CAN controllers. If you do this with the CBT logging the bus you will see the data that flows with those connections and you can sift through to find the patterns you want.
The downside of this connection method is although you can access any controller on any of the 3 busses, you only get data on request, so if you don't know you're looking for something then you can't see it. For example, if you want your CBT to catch a steering wheel button press, you won't see this data on this bus connection unless you were asking the Steering Wheel Controller for the button status at just the right time.
<b>Method 3 - Directly Tapping CAN Busses</b>
This method involves finding the 3 CAN Bus wires in the harness and physically tapping into each of them to wire into the 3 busses on the CBT.
The best spot for this is to find the CAN Gateway (under the dash, driver's side) - follow the CAN power train wires from the OBD connector back to the Gateway box which will have connections to all 3 busses). Connect to the power train bus at 500kpbs, and the convenience and infotainment busses at 100kbps.
Tapping the busses on the car side of the gateway give you access to most traffic that runs across the busses. VW uses a 'tree' style CAN layout, so there are some controllers that are connected to the network as 'branches' off a parent controller, where the parent controller doesn't necessarily pass all data onto the main bus. If you're trying to access something on a branch you won't be able to watch for the traffic passing by - you'll have to request it yourself.
Watching the traffic gives an easier method of finding the data you want - simply log the bus traffic, repeat an action (for example pushing one steering wheel button repeatedly) and watch for patterns in the data. Once identified, just write some code to evaluate every CAN packet that goes by on the bus and match the pattern. There's no need to write data requests and listen for responses - you just eavesdrop on the chatty bus traffic and wait for the data you're interested in.
This is ideal for on-demand data (like button pushes, lock/unlock actions etc) and for frequently transmitted data (for example vehicle speed, RPM etc on the power train bus). If you want less common data (fuel sender resistance perhaps?) that none of the controllers usually pass around on the bus themselves you'll have to form a request and drop it onto the bus yourself to catch the response.