11KW StreetScooter charger group hack

[uhi22]

The log shows, that the charger "accepts" the writing of the coding information (positive response 6E 06 00), but it ignores the data and does not store it. Maybe this coding service is just a left-over of the "base project" and not relevant at all. Or the content of the data matters, maybe it stores the data if it passed a certain consistency check.

[LRBen]

Well I would say we have probably gone as far as we can with it at this stage without further information on the firmware or maybe can logs from the specific vehicle.

But I think it's a good start. We have established that they still power on and can communicate with ODIS and a Mongoose adaptor. We know they are not standard VAG. I'll keep trying to get some contact from Street Scooter and see how open they are to sharing some information.
It is my suspicion that they will work without coding with the correct canbus messages, if they are indeed from Street Scooter. It makes sense if you are a smaller company to make things a bit less complicated.

[uhi22]

Is there any hint on / in the charger, what company produced them?

[crasbe]

If the wiki is right, they are made by KOSTAL: https://www.kostal-automobil-elektrik.c ... ectronics/
Seems at least plausible, my other charger says "Made in Ireland" and KOSTAL has two subsidaries in Ireland.

One hint is the high voltage warning sticker, it has a VW part number: "12E 010 001 B", my 5QE 915 684 AT charger has nearly the same sticker, but with part number "12E 010 001G". Otherwise there are just numbers in the casting, no letters. Possibly a date code of a casting of "04 2018".

[crasbe]

Comparing the stickers, the similarities between the VW one and StreetScooter tag are quite obvious.

[crasbe]

This might be the proof for Kostal: https://www.electrive.net/2018/08/11/ca ... etscooter/

Cadmium-belastete Ladegeräte sind zwischen 2013 und Juni 2018 verbaut worden. Betroffen sind der VW-Konzern und StreetScooter. Laut “Automobilwoche” stammt das Bauteil mit den belasteten Kontakten von Kostal.

Cadmium-polluted chargers were installed between 2013 and June 2018. Affected are the VW company and StreetScooter. According to "Automobilwoche", the part with the polluted contacts comes from Kostal."

I wonder.... are those chargers some that were affected by the recall and somehow jumped out of the dumpster? The tag with a date of 2020 however would indicate otherwise.
The casting from Jacobs charger says "23 2019", so it's a later model and apparently it's a week indicator, not a month indicator.
So my charger with "04 2018" might be cadmium polluted. Or maybe not.. probably not more than the bolts of the car it'll perhaps be installed into..

[uhi22]

Just for completeness: The unit from LRBen says software version 9005 in the diagnostic service 22 F189, this is near but not exact the 9007 on the sticker above.

[crasbe]

Ifound some CAN logs on Reddit, but it's just key off key on:

And this from a report where inductive charging was implemented: https://www.erneuerbar-mobil.de/sites/d ... ericht.pdf
Page 24 shows a screenshot with some decoded CAN data, but I'm not sure if that's of the internal charger or the added inductive charger.

That's about all I could find, there are some scientific publications but none with CAN IDs.

[crasbe]

Just for completeness: The unit from LRBen says software version 9005 in the diagnostic service 22 F189, this is near but not exact the 9007 on the sticker above.

Ben is doing the testing on another unit though. Perhaps his has an older software version. I will get my charger hooked up next month when I have some spare money to buy a Mongoose..

[Jacobsmess]

Ah I just wrote a long post and then tried to add a photo and the post was lost!
Anyway in short, I looked at replacing the large HV cable for something cheaper and more commonly available. The small HV connector cannot be removed due to some small wires with no slack and the 60 pin connector is more widely available.
The large HV connector uses 5 spade pins direct to the board with the top centre small pins unused. It looks like it might be possible to 3d print an adapter for the cable to something more commonly available or use spade connectors and a 3d printed gland or some form.

[LRBen]

Ah I just wrote a long post and then tried to add a photo and the post was lost!
Anyway in short, I looked at replacing the large HV cable for something cheaper and more commonly available. The small HV connector cannot be removed due to some small wires with no slack and the 60 pin connector is more widely available.
The large HV connector uses 5 spade pins direct to the board with the top centre small pins unused. It looks like it might be possible to 3d print an adapter for the cable to something more commonly available or use spade connectors and a 3d printed gland or some form.

I would try and get a VAG group charge port with the connector. Plenty on Ebay these days for around £150. Much cleaner and safer than making up an adaptor.

[Jacobsmess]

I would try and get a VAG group charge port with the connector. Plenty on Ebay these days for around £150. Much cleaner and safer than making up an adaptor.

That's a good shout although following a quick look I'm yet to find anything...

[Jacobsmess]

But I think it's a good start. We have established that they still power on and can communicate with ODIS and a Mongoose adaptor. We know they are not standard VAG. I'll keep trying to get some contact from Street Scooter and see how open they are to sharing some information.

Just wondering if Street scooter ever responded to you?

[LRBen]

Just wondering if Street scooter ever responded to you?

Afraid not.

[Jacobsmess]

Afraid not.

That's unfortunate no response at all or a refusal of information? I've just fired off an email also. Perhaps badgering is the way forwards.

[LRBen]

That's unfortunate no response at all or a refusal of information? I've just fired off an email also. Perhaps badgering is the way forwards.

Just no response at all. I expect it might be worth badgering them on a few different communication channels. I've been distracted by other projects for now so I've not really looked at this recently.

[Mitchy]

Ben

Figured I'd reply for the charge lock signals here,
Look at the signals within ZV_01 and ZV_02

In addition, I think your cut down code is based off of a 'oops' file I uploaded where somehow I wrote the if statements using single = signs... or else a replace all got me. But the brain fart is most likely!
Somehow the file worked on the bench, and strangely the state machine seemed to work faster in some cases; but it would give really inconsistent results.
Attached is the later one, just be sure to remove the .txt extension.

The vehicle lock signals (at least the ones I focused in on) are:
ZV_verriegelt_extern_ist
ZV_entriegeln_Anf


Been a while since I poked at the charger stuff, after the proof of concept, I continued on with the build.
I'm starting to dig back into it now, as I'm ending up offloading its control onto the STM32G474 gateway I've hacked together.
I'd love to incorporate it into zombie. but the chargers need so much spoofing!

[LRBen]

Ben

Figured I'd reply for the charge lock signals here,
Look at the signals within ZV_01 and ZV_02

In addition, I think your cut down code is based off of a 'oops' file I uploaded where somehow I wrote the if statements using single = signs... or else a replace all got me. But the brain fart is most likely!
Somehow the file worked on the bench, and strangely the state machine seemed to work faster in some cases; but it would give really inconsistent results.
Attached is the later one, just be sure to remove the .txt extension.

The vehicle lock signals (at least the ones I focused in on) are:
ZV_verriegelt_extern_ist
ZV_entriegeln_Anf


Been a while since I poked at the charger stuff, after the proof of concept, I continued on with the build.
I'm starting to dig back into it now, as I'm ending up offloading its control onto the STM32G474 gateway I've hacked together.
I'd love to incorporate it into zombie. but the chargers need so much spoofing!

Thanks for the information and new file.

I do have it integrated into Zombie already, had it working in the Tractor for a few months now and done a few charge cycles. It works ok, it does shut down when it reaches the set voltage, but the ramping is quite jumpy when it gets near the voltage set point.
When you first connect zombie to 12v it will momentarily try to go into charge mode. Just ignore that part! It works when you plug in an EVSE.
I have coded out the lock mechanisms but I think the code is still in there to try and operate it. Looks like it did try and use ZV_verriegelt_extern_ist and ZV_entriegeln_Anf, but

Here is the link to the repo if you wanted to take a look at it: https://github.com/SomersetEV/Stm32-vc ... arger.cpp

[Mitchy]

Just wondering if you could test something.
Seems the code doesn't clear the 'ZV_FT_entriegeln' and 'ZV_FT_verriegeln' signals between lock and unlock requests.
Not sure if that makes a difference, but it may be worth adding them in to alternate between the locked and unlock requests.
Looking over the code, I never actually did much with the 'Lock' command, as It seems it's not coded into the serial menu, so I may never have 'locked' the system, only ever unlocked it, triggering the unlock command. (and never setting the ZV_FT_verriegeln = 1)
In your code, it locks immediately, so both signals are likely still active instead of flip-flopping (As they're never set to 0).

Code: Select all

   void CayenneCharger::UnLockCP()
{

  ZV_FT_entriegeln = 1;
  ZV_entriegeln_Anf = 1;
  FCU_TK_Freigabe_Tankklappe = 1;
  ZV_verriegelt_extern_ist = 0;
}
void CayenneCharger::LockCP()
{
  ZV_FT_verriegeln = 1;
  ZV_verriegelt_extern_ist = 1;
  ZV_entriegeln_Anf = 0;
  FCU_TK_Freigabe_Tankklappe = 0;

Also, You can try to activate ZV_02 - signal ZV_verriegelt_soll - It's the signal for Vehicle overall locking status Target state for charging plug and charging flap locking.

You likely have the DBC file, but if not, the reference for this signal is:

• 0 "Init"

• 1 "not_locked"

• 2 "locked" ;

[LRBen]

Thanks, I've made those changes so I'll try and flash the new firmware tomorrow. However since I have coded the lock motor out of the charger I may need to remove it to code that back in. In which case it might take a bit longer for me to remove the charger for coding.
I'll see what happens tomorrow and go from there.

[RetroZero]

Are any of you tying the TW signal to anything? Ground or 12v? I'm spending the day on the other charger, but will use info from this thread to help along the way.

[RetroZero]

Attached is the later one, just be sure to remove the .txt extension.

The vehicle lock signals (at least the ones I focused in on) are:
ZV_verriegelt_extern_ist
ZV_entriegeln_Anf


Been a while since I poked at the charger stuff, after the proof of concept, I continued on with the build.
I'm starting to dig back into it now, as I'm ending up offloading its control onto the STM32G474 gateway I've hacked together.
I'd love to incorporate it into zombie. but the chargers need so much spoofing!

Any reason why I cannot attempt to run this on an Arduino Due and see what it does to the Single Phase chargers?

[RetroZero]

With this my Mongoose is sending the following can ids:
image.png

I noticed you have additional data underneath your CAN data bits. Is this due to you having a dbc file that corresponds?. I've tried a few dbc for the single 3,6kw charger, but I don't get as much info..

[LRBen]

I noticed you have additional data underneath your CAN data bits. Is this due to you having a dbc file that corresponds?. I've tried a few dbc for the single 3,6kw charger, but I don't get as much info..

I'm using one of the DBC files from here. Couldn't tell you which one from the top of my head though.
viewtopic.php?t=3152

[LRBen]

Jacobsmess has been busy digging around the internet and has found a ton of information that will be useful here.
Firstly attached is a DBC file, it's named for the charger but actually it contains the whole StreetScooter vehicle can data.

The charger is quite basic to control as I suspected/hoped it might be. The few messages it spits out are status messages, and then it is controlled by 0x617 and 0x618.

Only thing left to crack is the CRC required. Some can logs are incoming so we should soon have everything we need to get these chargers operational.