MEB Chargers

Forum on Volkswagen related hardware, so VW, Audi, Seat, Skoda etc.
User avatar
crasbe
Posts: 234
Joined: Mon Jul 08, 2019 5:18 pm
Location: Germany
Has thanked: 43 times
Been thanked: 97 times

Re: MEB Chargers

Post by crasbe »

I spent some time "cracking" the CRC code and came to the following conclusion:
It uses the AUTOSAR method and VAG Magic bytes. The generator polynomial is 0x2F, the initial value 0xFF and the final CRC is XORd with 0xFF as well.

The reverse engineering was done with CRCbeagle ( https://github.com/colinoflynn/crcbeagle ), if you want to play with it yourself, this is the code I used:

Code: Select all

from crcbeagle import crcbeagle

crcb = crcbeagle.CRCBeagle()

crcb.search([
        # first 7 bytes are the message starting from the timer,
        # last byte is magic number based on timer
        [0x0A, 0x12, 0x0, 0x0, 0x0, 0x30, 0x0, 0xDB],   # Timestamp 527760 onwards
        [0x0B, 0x12, 0x0, 0x0, 0x0, 0x30, 0x0, 0x15],
        [0x0C, 0x12, 0x0, 0x0, 0x0, 0x30, 0x0, 0x4A],
        [0x0D, 0x12, 0x0, 0x0, 0x0, 0x30, 0x0, 0x6B],
        [0x0E, 0x12, 0x0, 0x0, 0x0, 0x30, 0x0, 0x23]],

        # checksums for each message
        [[0x27], [0xF3], [0x32], [0x0A], [0x17]]
)
# homework
##        F3	0B	12	0	0	0	30	0
##        32	0C	12	0	0	0	30	0
##        0A	0D	12	0	0	0	30	0
##        17	0E	12	0	0	0	30	0
##        E2	0F	12	0	0	0	30	0
##        92	00	12	0	0	0	30	0
##        E5	01	12	0	0	0	30	0
##        98	02	12	0	0	0	30	0
##        C4	03	12	0	0	0	30	0
##        5C	04	12	0	0	0	30	0
##        B8	05	12	0	0	0	30	0
##        1E	06	12	0	0	0	30	0
##        7C	07	12	0	0	0	30	0
##        4D	08	12	0	0	0	30	0
##        D7	09	12	0	0	0	30	0
##        27	0A	12	0	0	0	30	0
The output of that program is the following:

Code: Select all

Input parameters:
    8-bit CRC size
    5 total messages, with:
       5 messages with 8 byte payload
NOTE: Output parameters may be specific to this message size only. Pass different length messages if possible.

Working on messages of 8 length: 
  Found single likely solution for differences of len=8, yah!
  Found single XOR-out value for len = 8: 0x21
********** example usage *************
import struct
from crccheck.crc import Crc8Base
crc = Crc8Base
def my_crc(message):
  crc._poly = 0x2F
  crc._reflect_input = False
  crc._reflect_output = False
  crc._initvalue = 0x0
  crc._xor_output = 0x21
  output_int = crc.calc(message)
  output_bytes = struct.pack("B", output_int)
  output_list = list(output_bytes)
  return (output_int, output_bytes, output_list)

m = [10, 18, 0, 0, 0, 48, 0, 219]
output = my_crc(m)
print(hex(output[0]))
**************************************
If you have multiple message lengths this solution may be valid for this only.
CRCBeagle found the initial value to be 0x00 and the XOR output 0x21. This leads to the same solution, at least with the 5 messages I tried.

More information about the Magic Numbers can be found here, luckily the 0x187 address was already reverse engineered: https://github.com/commaai/opendbc/blob ... on.cc#L110

More information about the AUTOSAR specifications are here: https://www.autosar.org/fileadmin/user_ ... ibrary.pdf Chapter "7.2.1.2 8-bit 0x2F polynomial CRC Calculation".


For the ZombieVerter code, I wrote this function with a little test (should be executable with every C++ compiler:

Code: Select all

#include <cstdio>
#include <iostream>

/** Calculate the checksum for VAG MEB Chargers
 *
 * The method used is described in Chapter "7.2.1.2 8-bit 0x2F polynomial CRC Calculation".
 * CRC Parameters:
 *     0x2F - Polynomial
 *     0xFF - Initial Value
 *     0xFF - XOR Output
 *
 * @see https://github.com/colinoflynn/crcbeagle for CRC hacking :)
 * @see https://github.com/commaai/opendbc/blob/master/can/common.cc#L110
 * @see https://www.autosar.org/fileadmin/user_upload/standards/classic/4-3/AUTOSAR_SWS_CRCLibrary.pdf
 * @see https://web.archive.org/web/20221105210302/https://www.autosar.org/fileadmin/user_upload/standards/classic/4-3/AUTOSAR_SWS_CRCLibrary.pdf
 */
void vw_meb_crc(uint8_t* inputBytes, uint8_t length)
{
    const uint8_t poly = 0x2F;
    const uint8_t xor_output = 0xFF;
    // VAG Magic Bytes for Address 0x187
    const uint8_t magicBytes[16] = { 0x7F, 0xED, 0x17, 0xC2, 0x7C, 0xEB, 0x44, 0x21, 0x01, 0xFA, 0xDB, 0x15, 0x4A, 0x6B, 0x23, 0x05 };

    uint8_t crc = 0xFF;

    for (uint8_t i = 1; i < length + 1; i++)
    {
        // We skip the empty CRC position and start at the timer
        // The last element is the VAG magic byte for address 0x187 depending on the counter value.
        if (i < length)
            crc ^= inputBytes[i];
        else
            crc ^= magicBytes[inputBytes[1] & 0x0F];

        for (uint8_t j = 0; j < 8; j++)
        {
            if (crc & 0x80)
                crc = (crc << 1) ^ poly;
            else
                crc = (crc << 1);
        }
    }

    crc ^= xor_output;

    inputBytes[0] = crc; // set the CRC checksum directly in the output bytes
}


int main()
{
    //uint8_t bytes[8] = { 0x00, 0x0A, 0x12, 0x00, 0x00, 0x00, 0x30, 0x00 };
    uint8_t bytes[8] = { 0x9F, 0x88, 0x12, 0x00, 0x00, 0x00, 0x30, 0xFE };


    printf("Data bytes before CRC Calculation:\n");

    for (int i = 0; i < 8; i++) {
        printf("%02X, ", bytes[i]);
    }
    printf("\n");

    vw_meb_crc(bytes, 8);

    printf("\nData bytes after CRC Calculation:\n");

    for (int i = 0; i < 8; i++) {
        printf("%02X, ", bytes[i]);
    }

    printf("\n");

}
This program gives the following output:

Code: Select all

Data bytes before CRC Calculation:
00, 0A, 12, 00, 00, 00, 30, 00,

Data bytes after CRC Calculation:
27, 0A, 12, 00, 00, 00, 30, 00,

Using the function in the code should be straight forward. Just prepare the CAN message bytes as usual with the counter and the 6 information bytes , leaving the first byte empty (or not, it's overwritten anyways) and call the function. Since it accepts the buffer as pointer, it directly modifies the first byte and adds the CRC here. Then the message can be used for the CAN transmission.
tom91
Posts: 1272
Joined: Fri Mar 01, 2019 9:15 pm
Location: Bristol
Has thanked: 97 times
Been thanked: 201 times

Re: MEB Chargers

Post by tom91 »

Very good find. I had a quick go, I done the crc "hacking" for BMW BMS comms and that just had a specific final XOR per message ID. This magic Byte per counter is something that I was not aware of existing.

Why would they make things so overly complicated.
Founder Volt Influx https://www.voltinflux.com/
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: MEB Chargers

Post by Jack Bauer »

Big Big thanks to Crasbe for this:)
I'm going to need a hacksaw
User avatar
crasbe
Posts: 234
Joined: Mon Jul 08, 2019 5:18 pm
Location: Germany
Has thanked: 43 times
Been thanked: 97 times

Re: MEB Chargers

Post by crasbe »

I just changed the function a little bit. It seems that starting from Timestamp 19317670 the counter byte has it's high bit set. This means the counter runs from 80-8F instead of 00-0F. This would've led to an illegal memory access in the function.
Therefore I added a "& 0x0F" for the access of the magic bytes to mask out the high byte.

Verified it with the Python script and the C++ code and it still produces the correct results.
User avatar
crasbe
Posts: 234
Joined: Mon Jul 08, 2019 5:18 pm
Location: Germany
Has thanked: 43 times
Been thanked: 97 times

Re: MEB Chargers

Post by crasbe »

Some more CAN Hacking...

Damien sent me a CAN log file with the remaining 6 CAN addresses, which have unknown magic bytes (not in the OpenDBC source (yet)).
So I wrote a Python script to calculate the Magic Bytes with Brute Force and after that verify them against all messages in the log file.
(Maybe Damien can attach the log file. Since it's not mine, I didn't want to just do that.)

Attached you find the Python file (with .txt extension, because the forum doesn't accept .py ...).
This is the output of the script. At the very end it neatly prints the magic bytes in correct order so it's easy to import them into sourcecode.

Code: Select all

New Magic Number (0xD3))found for ID 00000097, Counter 0E
New Magic Number (0xD8))found for ID 00000097, Counter 0F
New Magic Number (0xBA))found for ID 00000124, Counter 08
New Magic Number (0x3C))found for ID 00000097, Counter 00
New Magic Number (0x54))found for ID 00000097, Counter 01
New Magic Number (0x7F))found for ID 00000124, Counter 09
New Magic Number (0xCF))found for ID 00000097, Counter 02
New Magic Number (0x3F))found for ID 000003A6, Counter 0C
New Magic Number (0xA3))found for ID 00000097, Counter 03
New Magic Number (0xEA))found for ID 00000124, Counter 0A
New Magic Number (0x81))found for ID 00000097, Counter 04
New Magic Number (0x93))found for ID 00000097, Counter 05
New Magic Number (0x59))found for ID 00000124, Counter 0B
New Magic Number (0xAB))found for ID 000003AF, Counter 06
New Magic Number (0xA1))found for ID 000006A4, Counter 08
New Magic Number (0x0B))found for ID 00000097, Counter 06
New Magic Number (0xC7))found for ID 00000097, Counter 07
New Magic Number (0x4C))found for ID 00000124, Counter 0C
New Magic Number (0x3E))found for ID 00000097, Counter 08
New Magic Number (0xDF))found for ID 00000097, Counter 09
New Magic Number (0xF0))found for ID 00000124, Counter 0D
New Magic Number (0x1C))found for ID 00000097, Counter 0A
New Magic Number (0xB0))found for ID 00000097, Counter 0B
New Magic Number (0x88))found for ID 00000124, Counter 0E
New Magic Number (0xA7))found for ID 00000097, Counter 0C
New Magic Number (0x3A))found for ID 000003A6, Counter 0D
New Magic Number (0x25))found for ID 00000097, Counter 0D
New Magic Number (0x15))found for ID 00000124, Counter 0F
New Magic Number (0x12))found for ID 00000124, Counter 00
New Magic Number (0x27))found for ID 000003AF, Counter 07
New Magic Number (0x7E))found for ID 00000124, Counter 01
New Magic Number (0x34))found for ID 00000124, Counter 02
New Magic Number (0x16))found for ID 00000124, Counter 03
New Magic Number (0xA4))found for ID 000003A6, Counter 0E
New Magic Number (0x25))found for ID 00000124, Counter 04
New Magic Number (0x8F))found for ID 00000124, Counter 05
New Magic Number (0xEF))found for ID 000006A3, Counter 08
New Magic Number (0xCB))found for ID 000003AF, Counter 08
New Magic Number (0x8E))found for ID 00000124, Counter 06
New Magic Number (0x35))found for ID 00000124, Counter 07
New Magic Number (0x02))found for ID 000003A6, Counter 0F
New Magic Number (0x22))found for ID 000003AF, Counter 09
New Magic Number (0xB6))found for ID 000003A6, Counter 00
New Magic Number (0x88))found for ID 000003AF, Counter 0A
New Magic Number (0x1C))found for ID 000003A6, Counter 01
New Magic Number (0xEF))found for ID 000003AF, Counter 0B
New Magic Number (0xCB))found for ID 000006A4, Counter 09
New Magic Number (0xC1))found for ID 000003A6, Counter 02
New Magic Number (0xA3))found for ID 000003AF, Counter 0C
New Magic Number (0x23))found for ID 000003A6, Counter 03
New Magic Number (0x05))found for ID 000006A3, Counter 09
New Magic Number (0xE1))found for ID 000003AF, Counter 0D
New Magic Number (0x6D))found for ID 000003A6, Counter 04
New Magic Number (0xD0))found for ID 000003AF, Counter 0E
New Magic Number (0x8B))found for ID 000003A6, Counter 05
New Magic Number (0xBB))found for ID 000003AF, Counter 0F
New Magic Number (0x0C))found for ID 000003A6, Counter 06
New Magic Number (0x94))found for ID 000003AF, Counter 00
New Magic Number (0x02))found for ID 000006A4, Counter 0A
New Magic Number (0x51))found for ID 000003A6, Counter 07
New Magic Number (0x6A))found for ID 000003AF, Counter 01
New Magic Number (0x38))found for ID 000003A6, Counter 08
New Magic Number (0x9A))found for ID 000006A3, Counter 0A
New Magic Number (0xB5))found for ID 000003AF, Counter 02
New Magic Number (0x32))found for ID 000003A6, Counter 09
New Magic Number (0x38))found for ID 000003AF, Counter 03
New Magic Number (0x24))found for ID 000003A6, Counter 0A
New Magic Number (0x8A))found for ID 000003AF, Counter 04
New Magic Number (0xA8))found for ID 000003A6, Counter 0B
New Magic Number (0xB4))found for ID 000003AF, Counter 05
New Magic Number (0x4F))found for ID 000006A4, Counter 0B
New Magic Number (0xBB))found for ID 000006A3, Counter 0B
New Magic Number (0x57))found for ID 000006A4, Counter 0C
New Magic Number (0x39))found for ID 000006A3, Counter 0C
New Magic Number (0x4E))found for ID 000006A4, Counter 0D
New Magic Number (0xF7))found for ID 000006A3, Counter 0D
New Magic Number (0x8E))found for ID 000006A4, Counter 0E
New Magic Number (0x80))found for ID 000006A3, Counter 0E
New Magic Number (0xE4))found for ID 000006A4, Counter 0F
New Magic Number (0xA7))found for ID 000006A3, Counter 0F
New Magic Number (0xC7))found for ID 000006A4, Counter 00
New Magic Number (0xC1))found for ID 000006A3, Counter 00
New Magic Number (0xD8))found for ID 000006A4, Counter 01
New Magic Number (0x8B))found for ID 000006A3, Counter 01
New Magic Number (0xF1))found for ID 000006A4, Counter 02
New Magic Number (0x38))found for ID 000006A3, Counter 02
New Magic Number (0xC4))found for ID 000006A4, Counter 03
New Magic Number (0xA8))found for ID 000006A3, Counter 03
New Magic Number (0xE3))found for ID 000006A4, Counter 04
New Magic Number (0xA4))found for ID 000006A3, Counter 04
New Magic Number (0x5E))found for ID 000006A4, Counter 05
New Magic Number (0x27))found for ID 000006A3, Counter 05
New Magic Number (0x9A))found for ID 000006A4, Counter 06
New Magic Number (0xEB))found for ID 000006A3, Counter 06
New Magic Number (0xE2))found for ID 000006A4, Counter 07
New Magic Number (0xC8))found for ID 000006A3, Counter 07
ID: 00000097, Magic Bytes: 0x3C,0x54,0xCF,0xA3,0x81,0x93,0x0B,0xC7,0x3E,0xDF,0x1C,0xB0,0xA7,0x25,0xD3,0xD8,
ID: 00000124, Magic Bytes: 0x12,0x7E,0x34,0x16,0x25,0x8F,0x8E,0x35,0xBA,0x7F,0xEA,0x59,0x4C,0xF0,0x88,0x15,
ID: 000003A6, Magic Bytes: 0xB6,0x1C,0xC1,0x23,0x6D,0x8B,0x0C,0x51,0x38,0x32,0x24,0xA8,0x3F,0x3A,0xA4,0x02,
ID: 000003AF, Magic Bytes: 0x94,0x6A,0xB5,0x38,0x8A,0xB4,0xAB,0x27,0xCB,0x22,0x88,0xEF,0xA3,0xE1,0xD0,0xBB,
ID: 000006A3, Magic Bytes: 0xC1,0x8B,0x38,0xA8,0xA4,0x27,0xEB,0xC8,0xEF,0x05,0x9A,0xBB,0x39,0xF7,0x80,0xA7,
ID: 000006A4, Magic Bytes: 0xC7,0xD8,0xF1,0xC4,0xE3,0x5E,0x9A,0xE2,0xA1,0xCB,0x02,0x4F,0x57,0x4E,0x8E,0xE4,
Verifying...
Done!
I extended the C++ VAG CRC calculation function with the used magic bytes. It might make sense to add the other magic bytes from the opendbc file, but at the moment I don't really see a need.

This is the output of the test routine, which compares the original message against the newly calculated message with the new checksum.
As you can see, with my arbitrarily chosen messages, it produces the correct checksum.

Code: Select all

Address: 0097
Before: 43, CE, 7F, CE, 05, 02, 00, 00,
After:  43, CE, 7F, CE, 05, 02, 00, 00,

Address: 0124
Before: D4, E8, 57, 4F, 4A, 31, 21, 01,
After:  D4, E8, 57, 4F, 4A, 31, 21, 01,

Address: 0187
Before: 9F, 88, 12, 00, 00, 00, 30, FE,
After:  9F, 88, 12, 00, 00, 00, 30, FE,

Address: 03A6
Before: 3D, 0C, 00, 00, 00, 01, 00, 00,
After:  3D, 0C, 00, 00, 00, 01, 00, 00,

Address: 03AF
Before: 56, D6, F7, 1F, E0, 01, 00, 00,
After:  56, D6, F7, 1F, E0, 01, 00, 00,

Address: 06A3
Before: C1, 08, 99, 3E, 6C, 66, 03, 00,
After:  C1, 08, 99, 3E, 6C, 66, 03, 00,

Address: 06A4
Before: 11, 09, 45, 3D, 40, 03, 00, 00,
After:  11, 09, 45, 3D, 40, 03, 00, 00,
Attachments
Magic Byte Cracker.py.txt
(8.88 KiB) Downloaded 89 times
VAG MEB CRC Calculation.cpp
(4.43 KiB) Downloaded 91 times
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: MEB Chargers

Post by Jack Bauer »

Thank you (again) and not just from me but all the people who will use this information to run these chargers.

I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: MEB Chargers

Post by Jack Bauer »

So the basics of running the Golf Phev charger from a CAN perspective are a total of 7 messages. One on PT CAN : 0x187 and 6 on Hybrid CAN : 0x097 , 0x124 , 0x3a6 , 0x3af , 0x6a3 and 0x6a4.

Now all of those msgs are blessed with the silly crc thing that crasbe kindly figured out for us in byte 0 and a counter in the lower nibble of byte 1 that goes from 0 to F.

Attached are logs of hybrid and pt can taken just after the video linked above and in broadly the same timeframes.

Several of these msgs have nice ramps and step changes in there that no doubt will control the charger. Thats the next part of my plan to figure what does what now that they can be generated by a microcontroller and not just replayed from savvycan.
Attachments
pt_chgat6A_1.csv
(58.86 KiB) Downloaded 65 times
hyb_chgat6A_1.csv
(387.02 KiB) Downloaded 66 times
I'm going to need a hacksaw
User avatar
marxx
Posts: 6
Joined: Wed Nov 03, 2021 11:46 am
Location: Attenkirchen / Germany
Contact:

Re: MEB Chargers

Post by marxx »

I started the OVMS modul for the VW e-UP (Mii sibling) a few years ago:

https://www.goingelectric.de/forum/view ... 50&t=54620

(German). We did loads of reverse engineering stuff on CAN1 and CAN3 of the car. My part was CAN3 (the comfort CAN), because I was interested in waking up the car and remote climate control.

My original documentation on CAN3 can be found here (English):

https://github.com/devmarxx/Open-Vehicl ... ex_t26.rst

But perhaps more interesting for you could be "sharkcows" repository here:

https://github.com/sharkcow/VW-e-UP-OBD-CAN-logs/

with loads of can-logs of the VW e-UP.

I also think it could be interesting to take a look at the "Ring". A good read for that is "CAN_univortrag.pdf" (you can "google" that). My implementation of the "Ring" is here:

https://github.com/devmarxx/Open-Vehicl ... up_t26.cpp

from line 533 on.

I hope it is of some help to you.

Greetinx

marxx
Charging station with Raspberry Pi, own Open Source Software
OVMS Leaf/e-Up, hitch Leaf, GE Android App, SteVe OCPP Raspi Image
http://www.arachnon.de/wb

Renault Twizy Life (owned battery) 06/2016,
VW e-Up! 07/2020.
Tesla Model 3 09/2019, LR AWD,
User avatar
marxx
Posts: 6
Joined: Wed Nov 03, 2021 11:46 am
Location: Attenkirchen / Germany
Contact:

Re: MEB Chargers

Post by marxx »

Edit: Here the more beautified and complete documentation on the OVMS VW e-UP module:

https://docs.openvehicles.com/en/latest ... index.html

marxx
Charging station with Raspberry Pi, own Open Source Software
OVMS Leaf/e-Up, hitch Leaf, GE Android App, SteVe OCPP Raspi Image
http://www.arachnon.de/wb

Renault Twizy Life (owned battery) 06/2016,
VW e-Up! 07/2020.
Tesla Model 3 09/2019, LR AWD,
User avatar
crasbe
Posts: 234
Joined: Mon Jul 08, 2019 5:18 pm
Location: Germany
Has thanked: 43 times
Been thanked: 97 times

Re: MEB Chargers

Post by crasbe »

Thank you for the information. I'm not sure if the CAN bus information can be applied to the Power Train and Hybrid CAN busses.
It looks like the Comfort CAN bus etc don't even use the CRC checksums for messages.
User avatar
marxx
Posts: 6
Joined: Wed Nov 03, 2021 11:46 am
Location: Attenkirchen / Germany
Contact:

Re: MEB Chargers

Post by marxx »

Yes, CAN3 probably not.

But perhaps the CAN logs in sharkcows repository are of some help. There are CCS charging sessions logged there.

And the "Ring" (ringbus) as a very VW specific CAN communication / device managing tool can perhaps be interesting too.

marxx
Charging station with Raspberry Pi, own Open Source Software
OVMS Leaf/e-Up, hitch Leaf, GE Android App, SteVe OCPP Raspi Image
http://www.arachnon.de/wb

Renault Twizy Life (owned battery) 06/2016,
VW e-Up! 07/2020.
Tesla Model 3 09/2019, LR AWD,
arber333
Posts: 3241
Joined: Mon Dec 24, 2018 1:37 pm
Location: Slovenia
Has thanked: 74 times
Been thanked: 223 times
Contact:

Re: MEB Chargers

Post by arber333 »

Jack Bauer wrote: Sun Nov 06, 2022 6:41 pm So the basics of running the Golf Phev charger from a CAN perspective are a total of 7 messages. One on PT CAN : 0x187 and 6 on Hybrid CAN : 0x097 , 0x124 , 0x3a6 , 0x3af , 0x6a3 and 0x6a4.

Now all of those msgs are blessed with the silly crc thing that crasbe kindly figured out for us in byte 0 and a counter in the lower nibble of byte 1 that goes from 0 to F.

Attached are logs of hybrid and pt can taken just after the video linked above and in broadly the same timeframes.

Several of these msgs have nice ramps and step changes in there that no doubt will control the charger. Thats the next part of my plan to figure what does what now that they can be generated by a microcontroller and not just replayed from savvycan.
Hm... JB do you think i could use a single CAN source to feed both PT CAN and Hybrid can at 500kbps while alternating extended and normal msg?
That would greatly simplify implementation. Maybe i could use Collins attach interrupt in DUE code to burst extended msgs at 100ms and command current via standard 500ms msg.
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: MEB Chargers

Post by Jack Bauer »

Patience grasshopper:) more info / discoveries on the way.
I'm going to need a hacksaw
User avatar
jalovick
Posts: 95
Joined: Mon Mar 11, 2019 10:14 am
Location: Sydney, Australia
Has thanked: 10 times
Been thanked: 6 times

Re: MEB Chargers

Post by jalovick »

Hi,

I don't currently have the ability to test, but based on part the part numbers I've been compiling on the Wiki, I suspect that there are 4 major versions of the VAG chargers:
- xxx915681xx - Typically 7.2 kW/dual phase chargers
- xxx915682xx - Typically 11 kW/3 phase chargers
- xxx915684xx - Typically 3.6 kW/single phase chargers
- xxx915685xx - Typically 3.6 kW/single phase chargers

The above numbers seem to be common across a variety of models, where some have different cooling I/O locations, some have HV pass throughs, and some may be multiple chargers in one (9J1915681Axx 3 phase 22 kW models from the Taycan)

It would be interesting to see if each of the model ranges share common commands.

Jamie
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: MEB Chargers

Post by Jack Bauer »

Yep there does indeed seem to be a nice range of power and sizes.
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: MEB Chargers

Post by Jack Bauer »

Small update. The good old Völlig Wertlos is finally responding to CAN generated by a micro and not just replayed logs. Oh and it doesnt care what you connect to the HV wires. 360v, 12v, heating element, dead short. Its mission in life is pumping current and annoying me with its silly amount of cross checks. But anyway, progress is being made:)
Attachments
2022-11-16 11.56.01.jpg
2022-11-16 11.55.57.jpg
I'm going to need a hacksaw
tom91
Posts: 1272
Joined: Fri Mar 01, 2019 9:15 pm
Location: Bristol
Has thanked: 97 times
Been thanked: 201 times

Re: MEB Chargers

Post by tom91 »

Wait so it just dumps out voltage even when it does not see any voltage present? This might greatly simplify my testing setup and allow me to do this at home.
Founder Volt Influx https://www.voltinflux.com/
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: MEB Chargers

Post by Jack Bauer »

correct. its a current pump. Damn the voltage and full speed ahead. found the can message today that commands the charge port lock so yay. More soon hopefully.
I'm going to need a hacksaw
User avatar
jalovick
Posts: 95
Joined: Mon Mar 11, 2019 10:14 am
Location: Sydney, Australia
Has thanked: 10 times
Been thanked: 6 times

Re: MEB Chargers

Post by jalovick »

Hi,

I don't know if these will be useful, but I found a site where someone had worked out some of the CAN messages for the e-Up!/Mii/Citigo e chargers, including the locking mechanism. Details are available here.

Jamie
arber333
Posts: 3241
Joined: Mon Dec 24, 2018 1:37 pm
Location: Slovenia
Has thanked: 74 times
Been thanked: 223 times
Contact:

Re: MEB Chargers

Post by arber333 »

Here. I have quickly recorded the CAN info so it wouldnt disappear on us :).
Attachments
VW chargers.xlsx
(14.57 KiB) Downloaded 94 times
User avatar
jalovick
Posts: 95
Joined: Mon Mar 11, 2019 10:14 am
Location: Sydney, Australia
Has thanked: 10 times
Been thanked: 6 times

Re: MEB Chargers

Post by jalovick »

Here's some more work that someone has done to map out some of the MEB functions, unfortunately not charging, but it may by useful.

Jamie
User avatar
jalovick
Posts: 95
Joined: Mon Mar 11, 2019 10:14 am
Location: Sydney, Australia
Has thanked: 10 times
Been thanked: 6 times

Re: MEB Chargers

Post by jalovick »

arber333 wrote: Mon Nov 21, 2022 8:37 am Here. I have quickly recorded the CAN info so it wouldnt disappear on us :).
There's a whole bunch of stuff that has been logged and put up on that site for the e-Up!

Jamie
User avatar
jalovick
Posts: 95
Joined: Mon Mar 11, 2019 10:14 am
Location: Sydney, Australia
Has thanked: 10 times
Been thanked: 6 times

Re: MEB Chargers

Post by jalovick »

Looking through more of that data on that German site, they also include a lot of options for customising settings on the e-Up!, but a weird thing that was noted at the bottom of this page (in German), is that via ODBEleven or VCDS, there is a passcode to access the e-Up! charger, "20103", which got me thinking, is it worth pointing something like VCDS at one of these to see what we can see? I'm heading to my parents this weekend (where my 11 kW OBC is sitting), and will try with my VCDS dongle as soon as I get a chance to get it on the bench.

Jamie
User avatar
jalovick
Posts: 95
Joined: Mon Mar 11, 2019 10:14 am
Location: Sydney, Australia
Has thanked: 10 times
Been thanked: 6 times

Re: MEB Chargers

Post by jalovick »

Speaking of coding, an interesting tidbit about the e-Up! chargers, earlier software versions were apparently only configured to run at 3.6 kW on a single phase, even though it will do 7.2 kW on two. There is a setting to change to make it do 7.2 kW on a single phase using long coding (coding mentioned here).

EDIT: It appears that the coding adds a setting in the charger control module (12E 915 022), not the charger itself, so it's not likely relevant to us.
hazelnut
Posts: 15
Joined: Fri Nov 25, 2022 12:22 pm
Has thanked: 3 times
Been thanked: 10 times

Re: MEB Chargers

Post by hazelnut »

Hello,
I'm new, just joining the fun. I have a VW charger (5QE915682AF) and a 60 pin connector (5Q0 906 379
) ordered from eBay. I have oscilloscopes, and lab PSUs and 26 years embedded software experience. Just need to get me the can thingamybob now.
-Hazel
Post Reply