MQB Chargers

[jrbe]

So what's different from Damien's setup? Different territory / firmware maybe?

Regarding ID 5EA, I can get the value to toggle, but never keep it happy in REQUEST state. I assume it does some kind of check and that there's other parameters that are required for it to remain in Request State.....
I hope that theres an ID or 2 that is needed to complete Damiens code (as it apparently doesn't work anymore). Then we can move on to polishing up a working solution...

Is this specific id or group something you are sending repeatedly? Might / likely needs consistent request(s) to keep charging / checking other imperative info so it knows it's safe to continue.
Or to think of it a bit differently, If the can bus was cut / damaged the charger would need to stop. It very likely needs repeating messages to keep going.

[RetroZero]

I have been sending it repeatedly at 100ms, 200ms and 500ms, but it seems to need to change value/bit on order to validate Request Status. The id is one listed in the 6A log of Damien.

[RetroZero]

There might be a second parameter that is compared repeatedly. I'll play with the ID list tomorrow and see if I get any further values.

[RetroZero]

I've added @Mitchy's additional message for central locking to Damiens Code. No change.
Going through the ID list from the 6A log, I tried spoofing each one via SavvyCan and checking values in VCDS - I don't get other values to change, but quite a few times the charger goes into shut down mode (gets blocked) by part of a message.

So what's different from Damien's setup? Different territory / firmware maybe?

He is in Ireland, I'm in France - could that make adifference?
Different firmware in relation to the actual charger or Arduino? I suppose it could be a possible blockage, but there must be a way to tackle such an issue no?

This is the advanced Info for my unit. I don't think it's possible to update the firmware....

Friday,04,October,2024,18:30:58:18218
VCDS Version: Release 24.7.0 (x64)
Address C6: Batt. Chrg.
Control Module Part Number: 5QE 915 682 AF
Component and/or Version: OBC KOSTAL H40 4013
Software Coding: 115000003000
Advanced Identification/FAZIT
Serial number: 2302170BK000KB
Identification: KO1-ABY
Revision: --------
Date: 23.02.17
Manufacturer number: 0BK0
Test stand number: 00KB
Flash Status
Programming Attempts(application): 1/1
Programming Attempts(data): 1
Successful Attempts(data): 1
Flash Date: 17.02.23
Flash Tool Code(data): 00021 790 06314
Misc.
Hardware number: 5QE 915 682 AF
Workshop System Name: J1050
Equipment/PR Code: 00000000000000000000000D
Dataset Number: 8V0909811F
Dataset Version: 0022
ASAM Dataset: EV_OBCSinglPhaseKLOMQB12P
ASAM Dataset Revision: 001001
VCDS Info:
Labels: None
ROD: EV_OBCSinglPhaseKLOMQB12P.rod

[jrbe]

He is in Ireland, I'm in France - could that make adifference?
Different firmware in relation to the actual charger or Arduino? I suppose it could be a possible blockage, but there must be a way to tackle such an issue no?

The Tesla chargers hacking efforts ran into different can messages in different firmwares. Damien found 3 different ones last I saw. I mention it because there might be a similar issue going on here.

[RetroZero]

How to make things more interesting..... I'll start by playing back what my charger spits out and compare it to damiens and Doms logs. Going to be lots of time in front of a screen...

[RetroZero]

Tomorrow will be a day of staring at the charger again. Could ID 5EA require the magic byte cracker of @crasbe ? I have my vcds, savvycan with wifican along with an arduino due running Damien's code all waiting. I admit, this is not my area of "expertise" and groogle and yootoob can only go so far, so pointers to wheres I can learn to fish would be great

[RetroZero]

Did some playing about with SavvyCan and VCDS. When I have the Arduino with Damiens sketch connected, the battery SOC is 127%
Could it be that the charger thinks the batttery doesn't need charging, so just sits there? If so, how to change this to a more plausable value using the code?

[RetroZero]

Some hours of SavvyCan and VCDS this morning got me a few more ID's. Hope this helps

IDE_97 - (From damiens code - HCAN from BMS. 10ms - BMS reported current 0xc7f=0A)
From my SavvyCan & VCDS
IDE08719-IDE08720 - Values from battery mngmt-Current condition of battery BYTE_4, Bits 36,37,38 - STANDBY = 80, DC Main Charge = E0,
External Charging = C0, HV mains activ. = 90
IDE08719-MAS07396 - Values from battery mngmt-Act. voltage HV battery BYTES_3 & 4, Bits 24,25,26,27,28,29,30,31,32,33,34,35 (BYTE_3 = 00
& BYTE_4 = 90 equates to 0 Volts) (BYTE_3 = A0 and BYTE_4 = 93 equates to 232 volts)
IDE08719-MAS07397 - Values from battery mngmt-Act. current HV battery BYTEs_1 & 2, Bits 12,13,14,15,16,17,18,19,20,21,22,23 (BYTE_1 = F
& BYTE_2 = 80 equates to 1.0A)

ID_124 = IDE08719-MAS01420 - Values from battery mgmt-Limit for charge current BYTES_5 & 6, Bits 42,43,44,45,46,47,48,49,50,51 HIGH equates to 0Amps (BYTE_5=03 & BYTE_6=F0) (BYTE_5=0F & BYTE_6=F0 equates to 3 Amps)

I have yet to groogle "how to set scale factors etc"

[RetroZero]

Confirmed that when running Damiens code and 0x097 00 0F 80 A0 93 00 00 00 ,
WHILST there is no AC connected, "Current condition of battery management" can be switched to HV Mains active, Voltage HV battery=232volts and Current HV battery=1.0amps. When a Type2 charger cable is connected, the values remain at 0.
I know, for testing purposes, the code is supposed to mimic values for a BMS, this where I manually go change Damiens values right?

[modellfan]

I won't say how I found out. VW id.3 Chargers and the other chargers discussed here don't have the same AC plug. The id.3 and propably also id.4 / enyaq have small deviders bentween the horizontal pins. The others don't. CCS HARNESS NOT COMPATIBLE!

[uhi22]

Yeah, this is a very good point. This thread is mixing different vehicle architectures. The headline says MEB (which is ID.3, ID.4, Eniaq, ID.Buzz and so on), but a lot of discussions are around the old MLBevo (Taycan, Audi Q7) / MQB (Golf) platforms.
That's why I always propose to write the related part number to the discussion.
5QE ... ... is the old MQB platform.
1EA ... ... is MEB.

[modellfan]

One more thing my nightly research gave me. Since arround 2021 you can buy an option for 22kw in Audi etron 55 resulting in at least 4 different serialnumbers for chargers. Propably some of them are coded in a tandem mode. As well as there is the option to order the vehicle with one or two charge ports resulting in two numbers, one for single port and one for dual port just for the ccs cable. The dual ports at least are not directly connected to the charger but have an extra splitter [Current DIstribution Unit] in between. If someone has one arround would be interesting how it is working, as it looks like it is just a passive part.

[modellfan]

5QE ... ... is the old MQB platform.
1EA ... ... is MEB.

Thank you for clarification. Propably in the whole thread there isn't one post about MEB

[RetroZero]

Thank you for clarification. Propably in the whole thread there isn't one post about MEB

I agree, this thread is related to 'older' MQB platform . Can we change the Header?

[Bigpie]

I've updated the title of the first post, I'm not going through 8 pages to update them all unless I get really bored

[modellfan]

Can anybody confirm the pinout? I want to put it into the Wiki.

[modellfan]

As per the DBC file I posted, The charger is pretty integrated into the other bus messages, but the messages seem totally different than those found by Damien
**See Next Post for CAN Signal List**

Where do I find the dbc file ?

EDIT: viewtopic.php?t=3152

[crasbe]

Could ID 5EA require the magic byte cracker of @crasbe ?

That does not appear to be the case. 5EA is mostly static and does not have a counter, I would even say it does not have a CRC.

These are the individual messages from this log here: https://github.com/DomT177/GolfGTE/blob ... TrnRnd.asc

Code: Select all

Timestamp:        9.086060    ID:      5ea    S Rx                DL:  8    00 00 00 00 00 fe fb ff     Channel: 1
Timestamp:       10.085670    ID:      5ea    S Rx                DL:  8    00 00 00 00 78 fe fb ff     Channel: 1
Timestamp:       11.086500    ID:      5ea    S Rx                DL:  8    00 c8 c8 c0 78 fe ff f7     Channel: 1
Timestamp:       11.586220    ID:      5ea    S Rx                DL:  8    00 c8 c8 c0 78 fe 13 f8     Channel: 1
Timestamp:       36.575940    ID:      5ea    S Rx                DL:  8    00 c8 c8 c0 78 fe 17 f8     Channel: 1
Timestamp:       37.075410    ID:      5ea    S Rx                DL:  8    00 c8 c8 c0 78 fe 1b f8     Channel: 1
Timestamp:       40.073940    ID:      5ea    S Rx                DL:  8    00 c8 c8 c0 78 fe 1f f8     Channel: 1
Timestamp:       43.072480    ID:      5ea    S Rx                DL:  8    00 c8 c8 c0 78 fe 23 f8     Channel: 1
Timestamp:       47.070790    ID:      5ea    S Rx                DL:  8    00 c8 c8 c0 78 fe 27 f8     Channel: 1
Timestamp:       51.567900    ID:      5ea    S Rx                DL:  8    00 c8 c8 c0 28 fe 2b f8     Channel: 1[/quote]

As you can see, sometimes individual bytes are changing which would be weird if it had a CRC. You'd expect changes happening in two bytes.

It could be something else than a CRC though or it might be a two-part message where the checksum is somewhere else etc.

[modellfan]

Can anybody confirm the pinout? I want to put it into the Wiki.

Can't anybody pop out their mutlimeter and measure it? I unfortunatly don't have the original harness yet. Thank you ahead.

[modellfan]

Reverse image search of a Normaquick NW12 image
Normaquick NW12.jpeg
with something like "vag coolant connector" finds a bunch.

I put some time into verfying this / finding the original Audi/VW part number. For Audi etron this is the coolant hose assembly: https://parts.audiusa.com/p/Audi__e-tro ... 480AM.html with part number: 4KE122480AM. One of the connectors is 90° bend, the other is 90° bend + bleed pipe connector. Searching the part number gives some detailed pictures like the one attached and I am pretty sure, I can read 4KE 122 298 as part number. But google doesn't find any parts for this. Any ideas ?