VW GTE 3.6Kw charger 5QE 915 682 AF reverse engineer

[Mitchy]

Use the magic bytes from Damien,
The bytes change depending on the generation of chassis,
The Bytes and signaling for the 11kw chargers are for the MLBevo generation, while the 3.6 and 7.2kw chargers are likely based on the MQB generation.

But there may be some crossover or charger firmware versions that blur the line, I’d imagine the PHEV chargers for the MLBevo chassis are still the lower kw units. I think Ben had one from a cayenne.

[RetroZero]

so the magic bytes you gave me are from a 11kW charger?
If so, I will put them in anyway.
I am trying to get my head around the counter calculation for dummies at the moment.....

[Mitchy]

Oh no, the magic bytes for the post I made a few days ago should be MQB.
I’ll reconfirm though.

[RetroZero]

Just a small update.....I still have lots to sort out, and have many faults coming up. I think there are chechsums missing, but can't get my head around to understanding how to work out additional valiues to add to CAN ID's.....
However, I can initiate a charge, for about 10 seconds!! The charger then shuts down.
Process is as follows -
1: switch on Type2 home charger
2: plug in to socket ( locking mechanism has a hissy fit)
3: Activate charge from Arduino code
Now of tweaking and trying to find out where the problem lies, BUT, WE HAVE A CHARGER WORKING (sort of)!!!!!

[Mitchy]

Check your output voltage is above 300v
Sounds like how my unit was acting when I didn’t have a high enough resistance load and a low wattage EVSC wall plug.
After a duration the unit shuts down on low output voltage.
I think the limit is somewhere around 250v
I needed to place two elements in series to get the voltage drop needed.

I’ll take a look for the magic bytes tonight.

[RetroZero]

That makes sense. I'm glad I stuck to it and I'm learning heaps. I'm very pleased we're getting these chargers along with other vag components operational. Could not do it solo (han).
Script is all over the place, and will clean it up now that it's working. Thanks again ! Lets get this polished up

[RetroZero]

Seems there was a bug in my last sent message.
Errors regarding checksums are still present, however I am trying to learn how to calculate them via the python script that is being used. First I have to install python.
Voltage values are not calculated correctly, and might be part of the problem.
My setup has AC 230v being used to simulate battery voltage - 230vdc.
There is an Intermediate Voltage value, which I presume is AC to DC, because it spikes to 400v, & settles to 319v.
I have setup max charging voltage to 330v , thinking that AC voltage in = DC voltage out, so no big boost or buck required during testing.
Could this lack of voltage difference be part of the problem? Well, I have set battery voltage to a lower value of 190v, with no difference. Same goes with setting max charge voltage higher or lower.
Voltage out of charger with 2 heating elements in parallel= 149v & 5A.
So, just looking for sounding board going forward.

[RetroZero]

A bit off subject. I have worked out how to use the Magic Byte cracker & CRC VAG counter scripts, but don't know how or where the counters are inserted in code. I have been looking at different .ino files, and see for example byte vag_cnt3AF=0x00; - the 0x00 is for all vag_cnt
Is this correct? What am I missing?
I presume the counters are used to find the magic bytes, so no values are inserted except 0x00. Could someone please confirm.

On subject. I put an additional resistance in parallel, which might be creating further issues. I will put it in series & see what values I get back.

[RetroZero]

Going through coding and ID's tonight & playing with crc cracker from @crasbe. Seems BO 945 in DBC file is NOT 0x09C but 0X3B1...I was scrolling différent threads to find similarities. In the GTE world, 09C seems to be HV contactor related....
I'll update and report back once I get to run it

[RetroZero]

Spent the weekend trying to clean up script & get the charger process running reliably. I am in the "10 sec charge once a day loop at the moment". I can only make things worse (stop charge process & create more faults)....

[RetroZero]

Got an arduino uno and mcp2515 on the way to similate battery data. Would appreciate any input into this setup. Might be whats missing looking at other threads working on vag chargers.....

[RetroZero]

Another weekend staring at vcds & savvyCan. There must be something in the charge requests, because sometimes I get a quick charge, and other times nothing. Still the usual faults, but I'm trying not to focus too much on them, because they don't go away.
I am finding more data along the way, but I'm not able to confidently start a charge.

[RetroZero]

Another weekend sniffing.....Got some more data, but not any further with charge process.
Firstly, have a doubt about the mqb_dbc file, as the ID's don't match with the logs and the original VAG_phev_1.ino I am running.

I have found that 0x3AF & 0x187 throw my various faults, and I cannot find a way to spoof them at the minute.
0x3AF = Hybrid Powertrain stores U1121 & U1122 // DC_HYB_01, BMS_HYB_02, MSG_HYB_01 (all Time Out faults), & DC_HYB_02_CHK
0x187 = Engine Powertrain stores Motor_14, Diag_01, Motor_12, BEM_05, Motor_31, OBD_01 (Time out faults), & Error_Value_Motor_EV_01_CHK
0x365 & 5E7 = same faults as 0x187 + Motor_EV_01 (Timeout)
0x0A8 = Error_value Motor_12_CHK

Hope this info helps to hone in on the reason the charge process stops after 2 seconds....
I have spoofed battery voltage to 375v & Battery current (negative value of -5A), but nothing changes.

[RetroZero]

Another weekend banging head against wall....without a dbc this is really 'needle in the haystack stuff '. I'm comparing @DomT177 pwrtrain can log with arduino code and seems values are not similar in quite a few IDs. I'll see how I can spoof values to be more inline with the log and see if any amelioration.

[RetroZero]

Little update. Scrolling through values, I noticed Charge Mode = No request & Operating Status = Standby
I have not been able to spoof signals for these values . Could they be internal calculations based on the data received?

[RetroZero]

Another day, another hole on the wall..Some more spoofing, this time adding ID data from the 6A_charge_log.
Still have the LED light staying RED & no charge activation.
Feel free to dissect and comment on the new .ino file

[Heye]

Hey there, I might be joining the fun soon. I bought the cheapest OBC I was able to find on eBay which is a 5QE 915 682 BG with smashed connectors, which should be quite similar to the AF variant, according to your first message on this topic. Just to get up to speed quickly, what am I going to need other than a simple CAN bus adapter, Arduino Due and CAN transceivers? I'm currently uncertain on these items:

• VCDS adapter. Would a cheap one from Aliexpress work?
• ODIS-Adapter
• Charge port / Charge port door

Am I missing something else?

[RetroZero]

Nice to see I'm not banging my head against the wall alone.
Don't know about AliExpress vcds, I got a registered one.
I have the full charger cabling with port.
I also have savvycan along for seeing what's going on, for sending different messages.
I've now split the messages into 2 can busses and will try it out tomorrow.
I also have 2 heating elements in series as my load for the moment.

[Jacobsmess]

Ive got an aliexpress vcds. Not the most up to date but works fine. Make sure you use it on an air gapped laptop though

[Bigpie]

I have one of these chargers in the UK if anyone wants in to hack around with.

[RetroZero]

Ive got an aliexpress vcds. Not the most up to date but works fine. Make sure you use it on an air gapped laptop though

Have you used it for reading values whilst attempting to charge? If so, , anything stand out as not being coherent. I spent another day banging my head against the charger!!!! Cannot initiate a charge any longer.

[Jacobsmess]

Ive only used it on my ICEd van so far and on the power MQB steering rack

[Heye]

I've now prepared everything for when my fake Mongoose JLR arrives. I've wired power to my OBC, as well as an ECU connector with both CAN buses, temperature, power supply, the RGB LED, CC and CP and nothing else, according to the Wiki. When I apply 12V without any CAN communication, the LED doesn't light up. Is this expected behaviour? Or did I make some mistake in wiring the connector up?

More importantly, on which CAN bus should I connect the Mongoose? PT-CAN or Hybrid CAN? Does it matter? What would happen if I connected both buses together?

[RetroZero]

I have both buses together. I only get the red led to light up when attempting a charge process.

[Heye]

My mongoose arrived now and I have a laptop with ODIS, though I am still struggling. J2534 seems to work fine, my main problem is that I don't know what project to select for my 5QE 915 682 BG. Could you give me a hint on that? Do I need to import some external MCD project?

Edit:
Now, a few hours later, I see that I failed to mention the actual problem. ODIS complains that it is unable to see the car and won't let me select between control modules. While using my newly acquired Mongoose and ODIS to code in the AUX port on my mothers RCD 210 in an older VW Caddy, I tried to select VW37X as a project (which shouldn't be compatible with the Caddy) and I would have been able to connect to the OBC! Looking into the index.html of the VW37X project directory, I see that there are multiple EV_OBCSinglPhaseKLOMQB1 odx files.

In the MEB chargers thread, Mitchy seems to have been able to create an MCD project that doesn't require a full car. That project archive sadly isn't accessible anymore and I'm definitly lacking the skills to create such a project directory myself.

Seeing that a much older car was able to bypass the check in ODIS, maybe the easiest path forward would be to acquire a CAN gateway from any random VW car? At least that's what people on YouTube seem to use to bench flash their ECUs with ODIS. I might have to go back to the scrapyard.

Alternatively, maybe VCDS would actually be better? When trying to code the aux port into the radio, I didn't see the nice descriptions for the bit fields you get in VCDS, but that may just be my inability to use ODIS properly. I'm reluctant to get another clone dongle and struggle with another weird cracked software.

Edit 2: Still trying to get a gateway. I already held one in my hands, but the conveniently located scrapyard wanted 50€ for it! Gotta try the other scrapyard.

Edit 3: Fascinating! I was trying to sniff the behaviour of the CAN-bus between the Caddy and the Mongoose and somehow it's able to tell that there is a DB-9 adapter in between! If it isn't directly connected to the car, it will send three messages to 0x700 and then complain, otherwise it will send only one. Adding 12V on the appropriate pin didn't seem to help. I'm going to try and sniff the J2534 data, maybe this can tell me what's going on

Edit 4: Alright, I think I got it now. I messed up by connecting 12V between chassis ground and 12V, the Mongoose measures in reference to signal ground. I can now get a list of Control units. So, for reference, ODIS error ODS8001E can mean that no battery voltage was detected. I found out about it by comparing the output of this j2534-shim/logger between a working connection with the Caddy and a non-working connection.

Edit 5: ODIS can connect to the OBC now and is incredibly helpful. Some noteworthy things:

• VW37X does indeed seem to be the right project
• Coding out charge lock and flap seems to have worked
• 1068 Ohms on the thermistor wires didn't give values in range. I found 943 Ohms (measured out of circuit) to result in around 35°C. 22 Ohms less would be around -14°C.
• I will have to confirm the pinout of the connector tomorrow. ODIS reports electrical DTCs on the Charge lock, the charge socket itself and the third LED.

Edit 6: Confirmed: Blue LED is on pin 6, not on pin 22 for 682BG. Other electrical DTCs remain. Blue LED will start blinking when EVSE gets connected.

Edit 7: I'm stuck again. Coding out the charge lock didn't seem to have any effect. I've been trying all day to get the charge lock working first with a simple 74X-based circuit, now with an Arduino. It does seem to register the resistors and the relay I use to short the 10k resistor that's in series with a 1k resistor, because the initial values after powering the OBC down and up again (locked and unlocked) differ. Weirdly, it seems that only the locking pin ever gets pulled high. The unlocking pin (Pin 17) never sees any voltage. Can anyone confirm that this is expected behaviour? Or did I maybe fry pin 17 in my experiments?