openinverter forum

This thread is to discuss anything around the MG PTC Air Heaters, such as found in the MG ZS, MG4, MG5

Wikipage started here: https://openinverter.org/wiki/MG_PTC_Cabin_Air_Heater

Need to figure out LIN control and connector part numbers.

If anyone is also looking at this, please get in touch!

Working on it now. No lin logs so its the hard way.

So the heater seems to run at 19.2kbs speed and responds with a status frame to 0x3A. Found that by just brute forcing all possible LIN ids today. Now need to find the control id and content which will not be as easy I'm sure.

It gets progressively harder. Finding the request id is easy. In this case the heater only responds to one out of the 64 possible ids. In this case its 0x3A , 8 bytes in length , all 0x00 except byte 7 which flips to 0x21 after a second or two. Sending 0x2E and 0x2F make byte 7 of 0x3A flip back from 0x21 to 0x00. So far I have not found the enable sequence in the command ids to make the heater draw current or report some useful info in 0x3A.

My working theory is that it uses 2 command ids as it is a dual zone heater. Work continues.

Jack Bauer wrote: ↑Thu Feb 12, 2026 8:44 pm My working theory is that it uses 2 command ids as it is a dual zone heater. Work continues.

I can see two different Mosfets. But maybe they are also controlled by two bytes in the same ID ?

For those playing along at home I have attached my current LIN brute forcer for the heater command message. It may work on other LIN based components. No luck so far but made a few more observations :

-The MCU used is a STM8AF5288.

-There are 2 ACPL-K44T optos linking HV and LV sides. One from LV to HV and one from HV to LV.

-Sending ID 0x0E changes byte 7 of 0x3A to 0x23 from 0x21.

So we have 3 ids that make a change in the status message but no data format so far that makes the heater report useful info like temp, current etc.

Jack Bauer wrote: ↑Fri Feb 13, 2026 3:30 pmI have attached my current LIN brute forcer for the heater command message. It may work on other LIN based components. No luck so far (...)

Try adding a counter to a selected nibble. You should test consecutive bytes; there is no fixed rule here. The most commonly used sequence is from 0 to F. Usually, a fragment of the counter loop is sufficient. The control frame is most often 8 bytes long.

Its waking up on the bench now and drawing power. Will update with details tomorrow.

Alright, heater is powering up on the bench and drawing current. I can also command it to draw more or less power with the attached very crude Arduino due program.

Main points :

-MG ZS and MG5 use the same heater and same comms.

-LIN 2.0 at 19200 baud.

-Heater reports status on 0x3A and uses 0x2E and ox2F as command msgs at 100ms intervals.

- To activate heater send 0x2F with 8 bytes 0xFF, 0xFF, 0xF7, 0xF7, 0xFF, 0xFF, 0xFF, 0xFF and 0x2E with 8 bytes PWRlow, PWRhi, 0xFF, 0xFF, 0x96, 0xFF, 0xFF, 0xFF

- Heater SEEMS to send its DC current in 0x3A byte 5 once running. Needs further verification.

As of now I don't know if I am sending it a power or a temp request. Hope to have it installed in the Red Arrow soon on propper HV with airflow and can then decode further and implement in Zombie.

None of this would be possible without the kind assistance of forum member Alibro for logging his MG5 heater LIN. My scanner failed to elicit a response as the heater waits 3 seconds after its wake conditions are met (HV on,12v on and correct LIN data) before it will do anything or make a change in 0x3A.

Can someone please update the wiki page : https://openinverter.org/wiki/MG_PTC_Cabin_Air_Heater

Done, have put in https://openinverter.org/wiki/MG_PTC_Ca ... IN_Control as a start.
@Alibro, do you want to attach your log?

marcexec wrote: ↑Tue Feb 24, 2026 1:56 pm Done, have put in https://openinverter.org/wiki/MG_PTC_Ca ... IN_Control as a start.
@Alibro, do you want to attach your log?

Here you go

First of all thanks to Damien for doing the hard work on finding the ID's and Alibro for the logs. Today I played around with my MG PTC heater.
It is all Damien said +:

Control is in byte 0+1 of 0x2E
Scaling = x25
Little endian So if you want 20% power you need to send decimal 500 which is hex 01F4
So then Byte 0 = 0xF4 and Byte 1 = 0x01
Byte 4 looks to be on/off with 0x96 = ON and 0x00 = Off but it does not fully turn off. I kept seeing a current draw on the bench power supply of 0,07A at 300V.
When requesting power 0% this does drop to 0A.

Feedback Message 0x3A
Byte 5 and 6 contain the actual consumption in W as little endian.
So if Byte 5 = CF and Byte 6 = 04 that is 04CF in hex which is 1,2 kW.

Below about 250V it stops working. Then 0x3A sends
00 00 00 08 00 00 00 20

I have been able to get 2,5 kW out of it.

Brilliant thanks Lars.

Awesome, thanks for updating the Wiki as well @larsrengersen!