MG Charger Hacking

[Jack Bauer]

Ok, MG on board chargers. So far I have looked at two models that as far as I know are from 2019 and 2022 model year ZS vehicles. Both are capable of 6.6kw. The Gen1 as I'm calling it is a charger only and uses very simple CAN commands as detailed on the Github repo :
https://github.com/damienmaguire/MG-EV-Charger

The Gen2 has a 6.6kw charger, 2kw DCDC converter and 3.6kw V2L capability. A 3 phase and sinlge phase version of the latter is available. As far as I kn ow Gen1 is single phase only.

Aim of the game will be to add these to Zombieverter VCU in the future. I have a Gen2 installed in the Red Arrow (E36) so this will probably be the first put through its paces.

Some videos :

[manny]

Have one of the single phase MG chargers in my Saxo project (ZS10BC6600A).

Have done some testing with integration with Zombie. Did this the lazy way by changing the existing files for the outlander charger.

Also changed and improved the DBC file. The MG_VZ charger.txt is the DBC just change the .txt to .dbc

outlanderCharger files are the file I mangled to control the MG ZS charger. Use at your own risk

[LRBen]

I've got a Gen 2 charger from an MG5, part number EP2CCU6625A in my current project.

A slight difference in the pinout compared to the V2Lchargerpinout.png on the github, actually only figured it thanks to Damien's video. Just the pins of the hybrid can are difference. The charging wake up input also seems to have no effect. The pinout I have working is as follows:

A3: CP
A4: PT can H

B2: charge port temp +
B3: PP
B4: PT can L

D2: Charge port temp -
D3: 12v wake up

G2: hybrid Can H
G4: Gnd

H1: 12v
H2: hybrid Can L

I have the DC-DC working via canlog playbacks. Working on a test zombie modules now for that. No charging yet, but I also have a FOCCCI in this setup so there are some extra variables at play that I need to nail down first.
Currently one can ID clash between the MG logs and FOCCCI, with the can ID 0x358. In the MG logs this is all 00s so hopefully it is not required for the charger, but will test more and report back.

[LRBen]

So I've made a bit of progress with this. I have DC-DC running on a zombie test module, I also have charging running with fixed frames, these frames are in the current zombie test module but I haven't done any charge start code yet so it's not 100% functional.
The DC-DC needs only a couple of bytes to change. It is important for these bytes to change back when zombie shuts down to allow the charger to reset, otherwise it sometimes requires a 12v cycle to work again.

Code: Select all

        bytes[0] = 0x06;
        bytes[1] = 0xA0;
        bytes[2] = 0x26; //26 for on, 06 for off
        bytes[3] = 0x00;  
        bytes[4] = 0x00; 
        bytes[5] = 0x00; 
        bytes[6] = 0x00;
        bytes[7] = 0x7F; 
        can->Send(0x19C, (uint32_t*)bytes, 8);

        bytes[0] = 0x00;
        bytes[1] = 0x03; // 01 is stand by, 03 is driving, 06 is AC charging, 07 is CCS charging
        bytes[2] = 0x00;
        bytes[3] = 0x00;
        bytes[4] = 0x00;
        bytes[5] = 0x00;
        bytes[6] = 0x20; // 20 to wake up charger.
        bytes[7] = 0x00;
        can->Send(0x297, (uint32_t*)bytes, 8); // 297 is BMS state

        bytes[0] = 0x0E; //0E to wake up
        bytes[1] = 0x00;
        bytes[2] = 0x00;
        bytes[3] = 0x00;
        bytes[4] = 0x00;
        bytes[5] = 0x00;
        bytes[6] = 0x20; 
        bytes[7] = 0x00;
        can->Send(0x1F1, (uint32_t*)bytes, 8);

For the charging you need these frames:

Then to reset you need to change that to this:
It is mostly just 297, and 29C that change I think. In here is also the DC-DC messages.

I haven't found any current ramp so far, these charging messages were taken from a low current granny plug charging log. But if I used them when plugged into a 6kW wall charger I get 6kW of charging. I am guessing somewhere in here are BMS charge current limits, probably 29B or 29C.

My github repo for the test module is here:
https://github.com/SomersetEV/Stm32-vcu/tree/MGgen2V2L

I need to add a charge start and stop code, so it's definitely not functional right now.
One issue I have found is that it doesn't like the CP spoofing from Zombie outputs. Only works with the real thing as far as I have experienced. This does make integration with FOCCCI a little tricky.

I have attempted to get V2L working but so far no luck there.

[LRBen]

Added PP detect on the zombie module and today charged with zombie controlled charger for the first time. Updated the github with this code.

It only starts with PP detect, still no current ramp or stop mechanism. For this current implementation I used the wall charger to stop charging, then when I unplugged the zombie shut down.

Canbus logs of this attached for anyone who is interested.
On the canbus is:
Zombie
MG charger
Leaf inverter
Isa shunt
FOCCCI

The events the log captures
Zombie in off mode
EVSE plugged in
zombie enters charge mode via precharge and starts charging, ramping up to 6kW
EVSE stops charge, I assume with a CP disconnect or something along those lines
I unplug the EVSE
Zombie moves to OFF mode and opens contactors

[LRBen]

Had another play with the charger today.

Managed to cut down the messages required for charging to the following:

I have yet to move this to the zombie test module to confirm. But it's looking promising so far.

I also think I have found the current limit message in 0x29C, the last two bytes.

[johu]

I also think I have found the current limit message in 0x29C, the last two bytes.

The one that reads 0x57? So 87 decimal. Does it charge with 8.7A right now?
Or 0x5700 22272 mA?

[LRBen]

The one that reads 0x57? So 87 decimal. Does it charge with 8.7A right now?
Or 0x5700 22272 mA?

I have some rather vague data from my notes. At the time I could only get AC current as that was easily read from the socket meter.

When everything else was 00, byte 6 would have the following effect on the charge current.
0x47 is 1 amp AC, 0x48 is 2 amps AC, 0x49 is at least 8 amps AC as it maxed out the 2kW EVSE I was charging from at the time. Changing byte 7 did have some smaller effects, but I couldn't get anything uniform.
Damien has suggested it's a value spread across bytes 6 and 7 and I think he is correct. I just need to do some more testing to verify. I'll also try to get some DC amp data as well.

With it set to 0x57 as it has been so far for testing it would max out the MG charger from a 7kW wall EVSE.