geekabit

lightbulb

EVBox protocol documentation

Project | Article by Maarten Tromp | Published | 2849 words.

This page documents the internal "Max" communications protocol, used between EVBox modules.

All information is collected from tests on my own charger, combined with publicly available sources. Background information on the project can be found on the project page. If you noticed any errors or have additional information, please let me know.

In this article:

Charger

The used charger is an EVBox HomeLine, gen 3, 32A, 7.4kW, single phase.

Physical layer

The physical layer deals with byte-by-byte delivery over a physical medium.

Mechanical

Connectors are pluggable terminal blocks, 4 pins, by Phoenix Contact.

Charger modules have male MSTBVA 2,5/ 4-G-5,08 1x4 PCB header.

CP modules have a female ICV 2,5/ 4-G-5,08 1x4 PCB header.

Electrical

pinfunction
1+12V
2RS-485 A
3RS-485 B
4GND

CP and charger module(s) communicate over an RS-485 bus. The bus is terminated on the CP module, but not on the charger module. On such a short bus this should not be a problem, and on a longer bus termination can be added at the last module. There is no bias. The bus is in multi master mode, so each module can transmit messages on the bus.

The CP module RS-485 driver uses 3V levels, while the charger module RS-485 driver uses 5V levels.

Serial baud rate is 38400bps 8N1, half-duplex.

    Notes:
  • EVBox supports a maximum of 20 charger modules + 1 CP module per bus.
  • Maximum bus length is 1200m, using shielded twisted-pair cabling.

Network layer

The network layer deals with addressing packets across the data link layer,

A packet (ASCII-decoded frame payload) exists of: destination address, source address, and application data.

Packet encoding

The entire packet is a string, containing only numbers and capital letters.

Addresses are hex encoded. Example: string "3A" → address 0x3a (hex) = 58 (decimal).

Destination address

The first 2 characters of a packet are packet destination address.

Value: hex pair, resulting in a 1 byte destination address.

Source address

Next 2 characters are packet source address.

Value: hex pair, resulting in a 1 byte source address.

Application data

The remaining characters are application data. This is described in more detail in the application layer.

Addressing

Every module has unique address.

addressnamedetails
00new modulescharger module before address is assigned
01charger moduleChargeBox module
70unknownobserved in several messages.
80CP moduleChargePoint module
A0SmartGrid moduleexplained in Max protocol specification
BCbroadcast
FDunknownobserved in several messages

Packet example

packet (hex)800121
functiondestinationsourceapplication data

Application layer

The application layer is an abstraction layer that deals with process to process communication and depends on the network layer for transport,

Application data exists of: command and parameters.

Command

The first 2 characters of application data are command. Some documentation refers to these as "action".

Value: hex pair, resulting in a 1 byte command.

Similar commands are grouped, indexes are 1-based. Commands 11-20 are initialization, 21-30 are initiated by charger, 31-40 are initiated by CP, 61-70 are power management, E1-FF deal with addresses 70 and FD.

Parameters

The remaining zero of more characters are parameters. Protocol Max documentation refers to these as "data".

Value: variable length and encoding, depending on the command. Most parameters are encoded as hex pair, but a few as string. Each command has a fixed number of parameters, with fixed encoding and length. The only way to know the correct parameter type and length is to know the protocol.

    Notes:
  • Shorter values are padded with "0" to predetermined length.
  • Identification numbers (charger serial number, card number) are usually sent as string.
  • The first 2 or 4 bytes are usually status. Status AA00 = ack, 0055 = nack.
  • Parameter length is not present in the packet.
  • There is no validation on the number of parameter bytes or their contents.

Application data procedures

Most communication follows the form: request - response, but there are a few exceptions.

Response messages have the same command byte as the request message, but (usually) different parameters. There is no way of knowing if an individual message is request or response without knowing the protocol. If multiple messages with the same command byte are sent, only the last one can be responded to.

When a response is required, but not received, the request is repeated every 2 seconds.

The first thing a charger module does after boot is request an address. All charger modules start at address 0x00, and send command 11 requests to the CP, containing their serial number. The CP then sends a response containing charger serial number and assigned bus address. From that point, normal communication can start.

All decision making is done in the CP.

Application data example

This is an example of command 23 (start metering) request parameters, sent from charger to CP.

0E01 2345 6789 ABCD EF00 0000 00FF 30F2

All command 23 requests start with 0E, which I assume is a status byte.

The next 22 bytes are a string, containing charge card number: 0123456789ABCDEF000000.

Last 8 bytes are meter value: 00FF30F2. This is hex encoded value 1672421, which is value * 100, resulting in actual meter value of 16724.21kWh.

Observed commands

This is a list of all observed commands. Those are mostly understood and, mostly, safe to use.

Command 11: Request for address

Request sent by: charger (from address 00).

byteparameterlengthencoding
0-6charger serial number7 bytesstring
7-14always same8 byteshex

Response: broadcast

byteparameterlengthencoding
0-6charger serial number7 bytesstring
7-8new address2 byteshex
9-10always same2 byteshex

Example:

dst: 80 (CP)
src: 00 (new)
cmd: 11 request (request for address), length: 15
dat: 1917911 0125 0003 (serial number: 1917911)
dst: BC (broadcast) src: 80 (CP) cmd: 11 response (request for address), length: 11 dat: 1917911 01 03 (serial number: 1917911, address: 01)
    Notes:
  • Requesting an address is the first thing a charger does after boot.
  • No other messages are accepted by the charger until an address is assigned.
  • I assume all modules initialize at address 00.
  • Request without parameters results in CP sending a response with invalid checksum and parity, followed by command 13 read some values request.
  • Response does not need to be broadcast. Direct addressing can be used as well.
  • No Response parameters can be left out, but setting last 2 bytes to 00 is accepted by charger.

Command 13: Read some values

Request sent by: CP, 0 bytes.

Response:

byteparameterlengthencoding
0-3AA00 (ack)4 byteshex
28-35??8 bytesstring
56-59always same4 byteshex
60-63always same4 byteshex

Example:

dst: 01 (charger)
src: 80 (CP)
cmd: 13 request (read some values), length: 0
dst: 80 (CP) src: 01 (charger) cmd: 13 response (read some values), length: 64 dat: AA00 0216 0000 0000 0000 000B ALD1 D5FS 00A0 0000 364D 3341 0000 0000 1388 2001 ()
    Notes:
  • Response has only observed parameter with non-hex characters.
  • Value 1388 occurs in command 26 as well.

Command 18: Request charger state update

Request sent by: CP.

byteparameterlengthencoding
0-1p12 byteshex
p1details
00nothing
01command 21 heartbeat
02command 26 status update
03command 26 status update
04nothing
05nothing

Response: none.

Example:

dst: 01 (charger)
src: 80 (CP)
cmd: 18 request (request charger update), length: 2
dat: 02 ()
dst: 80 (CP) src: 01 (charger) cmd: 26 request (charger state update), length: 132 dat: 0215 0000 0000 0012 A800 FF30 F200 000A 2EB0 2F04 F078 0008 0008 0104 6400 0000 0000 00DE 0000 0000 0000 0000 0000 0000 03E8 0000 0000 0000 0000 0000 0000 0384 1388 (charger: idle, meter: 16724.21kWh, temperature: 26.0°C, session: 0, voltage: 222V, current: 0.0A, limit: 90.0A)
    Notes:
  • When no charger modules have been registered at CP, request is sent as broadcast. Otherwise direct addressing is used.
  • The only observed P1 value is 02. Other values are found by experimenting.

Command 1B: Connection state changed

Request sent by: CP as broadcast.

byteparameterlengthencoding
0-9always same10 byteshex

Response: none.

Example:

dst: 01 (charger)
src: 80 (CP)
cmd: 1B request (connection state changed), length: 10
dat: 0000 0384 00 ()
    Notes:
  • Request is sent once CP has established backend connection.
  • Request parameter could be baud rate.
  • Request without parameters is accepted by charger.

Command 1E: Reset

Request sent by: CP as broadcast, 0 bytes.

Response: none.

Example:

dst: BC (broadcast)
src: 80 (CP)
cmd: 1E request (reset), length: 0
dst: 80 (CP) src: 00 (new) cmd: 11 request (request for address), length: 15 dat: 1917911 0125 0003 (serial number: 1917911)
    Notes:
  • Request results in charger rebooting.
  • Request is the first message CP sends after boot.
  • Request does not need to be broadcast. Direct addressing can be used as well.

Command 21: Heartbeat

Request sent by: charger, 0 bytes.

Response: 0 bytes.

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: 21 request (heartbeat), length: 0
dst: 01 (charger) src: 80 (CP) cmd: 21 response (heartbeat), length: 0
    Notes:
  • Request is sent every 16 minutes.

Command 22: Authorize card

Request sent by: charger.

byteparameterlengthencoding
0-1state2 byteshex
2-3always same2 byteshex
4-25card number22 bytesstring

Response:

byteparameterlengthencoding
0-1state2 byteshex
2-3always same2 byteshex
4-25card number22 bytesstring
26-29always same4 byteshex
statedescription
00request
01authenticated
03not connected to backend
12access denied
1Dinvalid card number

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: 22 request (card authentication request), length: 26
dat: 000E xxxx xxxx xxxx xxxx xxxx xx (authentication request, card: xxxxxxxxxxxxxxxxxxxxxx)
dst: 01 (charger) src: 80 (CP) cmd: 22 response (card authentication request), length: 30 dat: 010E xxxx xxxx xxxx xxxx xxxx xxFF FF (authenticated, card: xxxxxxxxxxxxxxxxxxxxxx) dat: 0300 0000 0000 0000 0000 0000 00FF FF (not connected to backend, card number: 0000000000000000000000) dat: 120E xxxx xxxx xxxx xxxx xxxx xxFF FF (access denied, card serial number: xxxxxxxxxxxxxxxxxxxxxx)
    Notes:
  • Request is sent after scanning RFID charge card.
  • Request parameters can be left out. Response is state 1D.
  • Response parameters can be truncated to 4 bytes, of which only first 2 bytes are used.
  • Response card number is set to 0 when CP is not connected to backend.
  • Response is followed by charger sending command 6A charging state.

Command 23: Metering start

Request sent by: charger.

byteparameterlengthencoding
0-1always same2 byteshex
2-24card number22 bytesstring
2-31meter8 bytesstring

Response:

byteparameterlengthencoding
0-1always same2 byteshex
2-9session id8 byteshex
10-17timestamp8 byteshex

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: 23 request (metering start), length: 32
dat: 0Exx xxxx xxxx xxxx xxxx xxxx 00FF 30F2 (card: xxxxxxxxxxxxxxxxxxxxxx, meter: 16724.21kWh)
dst: 01 (charger) src: 80 (CP) cmd: 23 response (metering start), length: 18 dat: 0100 0000 002E 7C41 F5 (session: 0, timestamp: 2024-09-17 13:34:45)
(a few seconds later)
dst: 01 (charger) src: 80 (CP) cmd: 23 response (metering start), length: 18 dat: 0100 C079 EA2E 7C41 F9 (session: 12614122, timestamp: 2024-09-17 13:34:49)
    Notes:
  • Request follows on CP sending command 6B start charging.
  • Request without parameters is accepted by CP.
  • Request gets two responses. The first response has Session id 0, in the second response it has a value.
  • Omitting the second response is accepted by charger.
  • Response is followed by charger sending a command 26 status update request.

Command 24: Metering end

Request sent by: charger.

byteparameterlengthencoding
0-1always same2 byteshex
2-23card number22 bytesstring
24-31meter value8 byteshex
32-39session id8 byteshex
40-41always same2 byteshex
42-49timestamp8 byteshex

Response:

byteparameterlengthencoding
0-1always same2 byteshex

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: 24 request (metering end), length: 50
dat: 0Exx xxxx xxxx xxxx xxxx xxxx 00FF 3156 00C0 79EA 392E 7C44 49 (card: xxxxxxxxxxxxxxxxxxxxxx, meter: 16724.31kWh, session: 12614122, timestamp: 2024-09-17 13:44:41)
dst: 01 (charger) src: 80 (CP) cmd: 24 response (metering end), length: 2 dat: 01 ()
    Notes:
  • Request is sent after unplugging EV.
  • Request is sent after stopping session from charger (Harm Otten)
  • Request without parameters is accepted by CP.
  • Response without parameters is accepted by charger.
  • Response results in charger sending command 6A charging state.

Command 26: Charger state update

Request sent by: charger.

byteparameterlengthencoding
0-1state2 byteshex
2-3always same2 byteshex
4-7state14 byteshex
8-11state24 byteshex
12-15state34 byteshex
18-25meter8 byteshex
48-49state42 byteshex
52-55temperature4 byteshex
58-65session id8 byteshex
68-71voltage phase 14 byteshex
80-84current phase 14 byteshex
124-127current limit4 byteshex
128-131always same4 byteshex
statestate1state2state3state4description
0200000000001264idle
4700000000201264starting (EV plugged in, or card authenticated, but not both)
4800010401201221charging
4A0000030120120Anot charging
4B00000001201264finished (EV still plugged in)

Flow: 02 (idle) → 47 (starting) → 4A (not charging) → 48 (charging) → 4A (not charging) → 4B (finished) → 02 (idle)

Response:

byteparameterlengthencoding
0-7session id8 byteshex
8-15timestamp8 byteshex

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: 26 request (charger state update)
dat: 4815 0001 0401 2012 A900 FF5B 180C 1C0C 2E98 17D4 2F2F 0010 000F 0136 2100 C23E 5901 00DE 0000 0000 0532 0000 0000 0000 03E8 0000 0000 0000 0000 0000 0000 00C8 1388 (charger: charging, meter: 16735.0kWh, temperature: 31.0°C, session: 12729945, voltage: 222V, current: 13.3A, limit: 20.0A)
dst: 01 (charger) src: 80 (CP) cmd: 26 response (charger state update) dat: 00C2 3E59 2E84 3391 (session: 12729945, timestamp: 2024-09-23 14:11:29)
    Notes:
  • Request parameters could include: multi-phase voltage, current, cos phi.
  • Response timestamp is set to 0 when CP is not connected to backend.
  • Response with session set to 0 is accepted by charger.
  • Value 1388 also occurs in command 13 (read some values).
  • Value 03E8 also occurs in command 33 (get configuration) and 34 (set configuration).
  • There does not seem to be a difference between the command 26 message sent after EV plugged in, but not authenticated yet, and authenticated, but not plugged in yet.
  • During charging session (from metering start to metering end) command 26 update is sent every 15 minutes.

Command 33: Get configuration

Request sent by: CP, 0 bytes.

Response:

byteparameterlengthencoding
0-73always same74 byteshex

Example:

dst: 01 (charger)
src: 80 (CP)
cmd: 33 request (get configuration), length: 0
dst: 80 (CP) src: 01 (charger) cmd: 33 response (get configuration), length: 74 dat: 0000 003C 0000 0384 0000 0384 0300 0001 0100 1E01 0000 0000 0000 0000 0000 0000 0000 03E8 01 ()
    Notes:
  • Parameters could include baud rate.
  • Value 03E8 also occurs in command 26 (status update) and 34 (set configuration).

Command 34: Set configuration

Request sent by: CP.

byteparameterlengthencoding
0-85always same86 byteshex

Parameters for dimming are: 3000 0000 vv, with vv is value in percent. (Harm Otten)

Other observed parameters: 0003 C000 0000 0001 0100 0000 0000 0000 (Harm Otten)

Response:

byteparameterlengthencoding
0-3AA00 (ack)4 byteshex

Example:

dst: 01 (charger)
src: 80 (CP)
cmd: 34 request (set configuration), length: 86
dat: 03A3 F781 1E03 0000 0101 0001 0000 0000 0000 0000 0000 0000 3C00 0003 8400 0003 8400 0000 0000 03E8 0100 00 ()
dst: 80 (CP) src: 01 (charger) cmd: 34 response (set configuration), length: 4 dat: AA00 ()
    Notes:
  • Request without parameters is accepted by charger. I don't know what the effect of that is though.
  • Response without parameters results in CP sending a command 33 request.
  • Value 03E8 also occurs in command 26 (status update) and 34 (get configuration).
  • Parameters could include baud rate.

Command 68: Charging state

Request sent by: SmartGrid.

    Notes:
  • Explained in Max protocol specification.

Command 69: Charging state

Request sent by: SmartGrid.

    Notes:
  • Explained in Max protocol specification.

Command 6A: Charging state

Request sent by: charger.

byteparameterlengthencoding
0-1state2 byteshex
2-3always same2 byteshex
statedescription
07unknown, mentioned by Harm Otten
80EV has unplugged
81charging
A0charger idle
A7starting
C1finished
E7failed

Flow: A0 (idle) → EV plugged in + authenticated → A7 (starting) → 81 (charging) → C1 (finished) → EV unplugged → 80 (unplugged) → A0 (idle)

Response:

byteparameterlengthencoding
0-3A000 (ack)4 byteshex

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: 6A request (charging mode), length: 4
dat: A03C (state: charger idle)
dst: 01 (charger) src: 80 (CP) cmd: 6A response (charging mode), length: 4 dat: AA00 (ack)
    Notes:
  • Request without parameters is accepted by CP.

Command 6B: Set current limit

Request sent by: CP.

byteparameterlengthencoding
0-1always same2 byteshex
2-5initial current limit4 byteshex
6-9current limit4 byteshex
10-13current limit4 byteshex
14-17current limit4 byteshex

Response: 0 bytes.

Example:

dst: 01 (charger)
src: 80 (CP)
cmd: 6B request (set current limit), length: 18
dat: 0100 3C00 C800 C800 C8 (current limit: 20.0A)
dst: 80 (CP) src: 01 (charger) cmd: 6B response (set current limit), length: 0
    Notes:
  • Request is sent when charging has started or ended.
  • Request always follows on command 6A charging state.
  • Response is followed by charger sending a command 23 metering start request.
  • This command also acts as "start charging".
  • There might be 3 current limits for 3 phases, but command 23 only returns a single one.
  • Initial current limit is only for the first 2 minutes of the charging session (Harm Otten).
  • Request without parameters is accepted by charger.

Commands that need work

This is a list of commands found by experimenting. It is not always clear what those might do.

Command 1C: LED ring enable

Request sent by: CP as broadcast.

byteparameterlengthencoding
0-1state2 byteshex
statedescription
00disable
01enable

Response: ??

    Notes:
  • Mentioned by Harm Otten
  • LED ring dimming is possible using command 34 set configuration.

Command 2A: Unknown

Request sent by: charger.

Response: ??

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: 2A request (unknown), length: 0
dst: 02 (unknown) src: 80 (CP) cmd: 2A response (unknown), length: 0
    Notes:

Command 31: Remote start

Request sent by: CP, from back office.

byteparameterlengthencoding
0-1always 0E2 byteshex
2-23card number22 bytesstring

Response:

byteparameterlengthencoding
0-1always 012 bytehex

Example:

dst: 01 (charger)
src: 80 (CP)
cmd: 31 request (remote start), length: 0
dst: 80 (CP) src: 01 (charger) cmd: 6A request (charging mode), length: 4 dat: A03C (state: charger idle)
    Notes:
  • Found by experimenting, also mentioned by Harm Otten
  • Request without parameters is accepted by charger.
  • Request results in charger sending command 6A charging state.

Command 32: Remote stop

Request sent by: CP, from back office.

byteparameterlengthencoding
0-7session id8 byteshex

Response:

byteparameterlengthencoding
0-1state2 byteshex
statedescription
01success
23already stopped
    Notes:
  • Mentioned by Harm Otten

Command 35: Soft reset

Request sent by: CP as broadcast.

byteparameterlengthencoding
0-1p12 byteshex

Observed P1 values are 52 and 3F.

Response: none.

Example:

dst: BC (broadcast)
src: 80 (CP)
cmd: 35 request (soft reset), length: 2
dat: 52 (unknown)
    Notes:
  • Request results in charger rebooting?
  • Request follows on command FB.
  • Found by experimenting, also mentioned by Harm Otten

Command 36: Unknown

Request sent by: charger.

Response: 132 bytes.

Example:

dst: 01 (charger)
src: 80 (CP)
cmd: 36 response (unknown), length: 0
dst: 80 (CP) src: 01 (charger) cmd: 26 request (charger state update), length: 132 dat: 0215 0000 0100 0012 9D00 FF75 4400 000A 2EBA 2F00 F078 0008 0008 00BE 6400 0000 0000 00E6 0000 0000 0000 0000 0000 0000 03E8 0000 0000 0000 0000 0000 0000 0384 1388 (charger: idle, meter: 16741.7kWh, temperature: 19.0°C, session: 0, voltage: 230V, current: 0.0A, limit: 90.0A)
    Notes:

Command 41: Unknown

Request sent by: CP and charger.

Response: ??

Example initiated by charger:

dst: 01 (charger)
src: 80 (CP)
cmd: 41 unknown (unknown 41), length: 0
dst: 80 (CP) src: 01 (charger) cmd: 41 unknown (unknown 41), length: 54 dat: 0100 0008 0008 2EBA 129A 08FC F87F 00BE 0375 4430 4203 3030 3032 45 ()

Example initiated by CP:

dst: 80 (CP)
src: 01 (charger)
cmd: 41 unknown (unknown), length: 0
dst: FD (unknown) src: 80 (CP) cmd: 41 unknown (unknown), length: 2 dat: 37 ()
    Notes:
  • If request is sent by charger, CP sends request to address FD.

Command 42: Set serial number

Request sent by: CP.

byteparameterlengthencoding
0-6charger serial number7 bytesstring

Response:

byteparameterlengthencoding
0-6charger serial number7 bytesstring

Example:

dst: 01 (charger)
src: 80 (CP)
cmd: 42 request (set serial number), length: 0
dst: 80 (CP) src: 00 (new) cmd: 42 response (set serial number), length: 7 dat: 2F0F?00 (serial number: 2F0F?00))
    Notes:
  • Request without parameters results in setting serial number 2F0F\x0300 (which is request checksum, parity, EoF, padded with 0). This could seriously ruin your day.
  • Response is sent from address 00, but charger keeps its earlier address.

Command 43: Unknown

Request sent by: ??

Response: ??

Example:

dst: 01 (charger)
src: 80 (CP)
cmd: 43 unknown (unknown), length: 0
start of frame marker not found in data: b"\x92\x1a\xc1276\x03\xff"
    Notes:

Command 65: Unknown

Request sent by: charger.

Response:

byteparameterlengthencoding
0-4??4 byteshex
5-43always same40 byteshex

Example:

dst: 01 (charger)
src: 80 (CP)
cmd: 65 response (unknown), length: 0
dst: 80 (CP) src: 01 (charger) cmd: 66 request (unknown), length: 44 dat: 00E3 0000 0000 0000 0000 0000 03E8 0000 0000 00FF 7544 () dat: 00E4 0000 0000 0000 0000 0000 03E8 0000 0000 00FF 7544 () dat: 00E5 0000 0000 0000 0000 0000 03E8 0000 0000 00FF 7544 () dat: 00E6 0000 0000 0000 0000 0000 03E8 0000 0000 00FF 7544 ()
    Notes:
  • Response results in charger sending command 66 request.

Command 66: Unknown

Request sent by: charger.

Response: ??

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: 66 request (unknown), length: 0
dst: 01 (charger) src: 80 (CP) cmd: 66 response (unknown), length: 0
    Notes:

Command 6C: Unknown

Request sent by: ??

Response: ??

Example:

dst: 01 (charger)
src: 80 (CP)
cmd: 6C unknown (unknown), length: 0
start of frame marker not found in data: b"\xe10016C23A77D\x03\xff"
    Notes:

Command E1: Unknown

Request sent by: CP.

Response: ??

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: E1 response (unknown), length: 0
dst: 70 (unknown) src: 80 (CP) cmd: E6 request (unknown), length: 0
    Notes:
  • Response is followed by CP sending command E6 request to address 70.

Command E3: reboot

Request sent by: charger.

Response: none.

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: E3 request (reboot), length: 0
dst: BC (broadcast) src: 80 (CP) cmd: 1E request (reset), length: 0
    Notes:
  • Request results in CP rebooting.

Command E4: Unknown

Request sent by: address 70?

Response: 4 bytes.

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: E4 request (unknown), length: 0
dst: 70 (unknown) src: 80 (CP) cmd: E4 response (unknown), length: 4 dat: AA00 (ack)
    Notes:
  • Response is sent to address 70.

Command E6: Unknown

Request sent by: CP.

Response: ??

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: E1 response (unknown), length: 0
dst: 70 (unknown) src: 80 (CP) cmd: E6 request (unknown), length: 0
    Notes:
  • Request follows on E1 response.

Command EB: Unknown

Request sent by: charger.

Response: 8 bytes.

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: EB request (unknown), length: 0
dst: FD (unknown FD) src: 80 (CP) cmd: EB response (unknown), length: 8 dat: 0134 0125 (unknown)
dst: BC (broadcast) src: 80 (CP) cmd: 1B request (connection state changed), length: 10 dat: 0000 0384 00 ()
    Notes:
  • Response is sent to address FD.
  • Response is followed by CP broadcasting command 1B connection state changed request.

Command EC: Unknown

Request sent by: charger.

Response: ??

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: EC request (unknown), length: 0
dst: FD (unknown) src: 80 (CP) cmd: EC response (unknown), length: 0
dst: FD (unknown) src: 80 (CP) cmd: ED request (unknown), length: 2 dat: 08 (unknown)
    Notes:
  • Response is sent to address FD.
  • Response is followed by CP sending command ED request to address FD.

Command ED: Unknown

Request sent by: CP.

Response: ??

Example:

dst: FD (unknown)
src: 80 (CP)
cmd: ED request (unknown), length: 2
dat: 08 (unknown)
    Notes:
  • Request follows on command EC response.
  • Request is sent to address FD.

Command F0: Unknown

Request sent by: address FD.

Response: 102 bytes.

Example initiated by charger:

dst: 80 (CP)
src: 01 (charger)
cmd: F0 request (unknown), length: 0
dst: FD (unknown) src: 80 (CP) cmd: F0 response (unknown), length: 102 dat: 407C 30FF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FF ()

Example initiated by CP:

dst: 01 (charger)
src: 80 (CP)
cmd: F0 request (unknown), length: 0
dst: FD (unknown) src: 01 (charger) cmd: F0 response (unknown), length: 102 dat: 3F7F 30FF 2ABF 66E9 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FF (unknown)
    Notes:
  • Response is always sent to address FD.

Command F1: Unknown

Request sent by: address FD.

Response: 6 bytes.

Example initiated by CP:

dst: 01 (charger)
src: 80 (CP)
cmd: F1 request (unknown), length: 0
dst: FD (unknown) src: 01 (charger) cmd: F1 response (unknown), length: 6 dat: 407E 30 (unknown)

Example initiated by charger:

dst: 80 (CP)
src: 01 (charger)
cmd: F1 request (unknown F1), length: 0
dst: FD (unknown FD) src: 80 (CP) cmd: F1 response (unknown F1), length: 6 dat: 417D 30 ()
    Notes:
  • Response is always sent to address FD.

Command F2: Unknown

Request sent by: address FD.

Response: ??

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: F2 request (unknown), length: 0
dst: FD (unknown) src: 80 (CP) cmd: F2 response (unknown), length: 0
    Notes:
  • Response is sent to address FD.

Command F3: Unknown

Request sent by: address FD.

Response: 10 bytes.

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: F3 request (unknown), length: 0
dst: FD (unknown) src: 80 (CP) cmd: F3 response (unknown), length: 10 dat: 437F 3000 00 (unknown)
    Notes:
  • Response is sent to address FD.

Command F4: Unknown

Request sent by: address FD.

Response: 10 bytes.

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: F4 request (unknown), length: 0
dst: FD (unknown) src: 80 (CP) cmd: F4 response (unknown), length: 10 dat: 4478 3000 00 (unknown)
    Notes:
  • Response is sent to address FD.

Command F5: Unknown

Request sent by: address FD.

Response: ??

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: F5 response (unknown), length: 0
dst: 80 (CP) src: 01 (charger) cmd: F6 request (unknown), length: 0
    Notes:
  • Response is followed by CP sending command F6 request to address FD.

Command F6: reboot

Request sent by: address FD??

Response: none.

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: F6 request (reboot), length: 0
dst: BC (broadcast) src: 80 (CP) cmd: 1E request (reset), length: 0
    Notes:
  • Request follows on command F5 response.
  • Request results in CP rebooting.

Command F7: Unknown

Request sent by: address FD.

Response: ??

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: F7 request (unknown), length: 0
dst: FD (unknown) src: 80 (CP) cmd: F7 response (unknown), length: 0
    Notes:
  • Response is sent to address FD.

Command F8: Unknown

Request sent by: address FD.

Response: 122 bytes.

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: F8 request (unknown), length: 0
dst: FD (unknown) src: 80 (CP) cmd: F8 response (unknown), length: 122 dat: 4874 330D 38FF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FF (unknown)
    Notes:
  • Response is sent to address FD.

Command F9: Unknown

Request sent by: address FD.

Response: 10 bytes.

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: F9 request (unknown), length: 0
dst: FD (unknown) src: 80 (CP) cmd: F9 response (unknown), length: 10 dat: 4975 330D 38 (unknown)
    Notes:
  • Response is sent to address FD.

Command FA: Unknown

Request sent by: address FD.

Response: ??

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: FA request (unknown), length: 0
dst: FD (unknown) src: 80 (CP) cmd: FA response (unknown), length: 0
    Notes:
  • Response is sent to address FD.

Command FB: Unknown

Request sent by: address FD.

Response: ??

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: FB request (unknown), length: 0
dst: FD (unknown) src: 80 (CP) cmd: FB response (unknown), length: 0
dst: BC (broadcast) src: 80 (CP) cmd: 35 request (soft reset), length: 2 dat: 52 (unknown)
    Notes:
  • Response is sent to address FD.
  • Request results in CP broadcasting command 35 (soft reset) request.

Command FD: reboot

Request sent by: address FD??

Response: none.

Example:

dst: 80 (CP)
src: 01 (charger)
cmd: FD request (unknown), length: 0
dst: BC (broadcast) src: 80 (CP) cmd: 1E request (reset), length: 0
    Notes:
  • Request results in CP rebooting.

Capture

Here are 2 logs, one from boot and one from from a charging session.

dst: BC (broadcast)
src: 80 (CP)
cmd: 1E request (reset), length: 0
dst: 80 (CP) src: 00 (new) cmd: 11 request (request for address), length: 15 dat: 1917 9110 1250 003 (serial number: 1917911)
dst: BC (broadcast) src: 80 (CP) cmd: 11 response (request for address), length: 11 dat: 1917 9110 103 (serial number: 1917911, address: 01)
dst: 01 (charger) src: 80 (CP) cmd: 1B request (connection state changed), length: 10 dat: 0000 0384 00 ()
dst: 80 (CP) src: 01 (charger) cmd: 6A request (charging mode), length: 4 dat: A000 (state: charger idle)
dst: 01 (charger) src: 80 (CP) cmd: 6A response (charging mode), length: 4 dat: AA00 (ack)
dst: 80 (CP) src: 01 (charger) cmd: 26 request (charger state update), length: 132 dat: 0215 0000 0000 0012 B000 FF30 F200 000A 2EB0 2F04 F078 0008 0008 0104 6400 0000 0000 00E2 0000 0000 0000 0000 0000 0000 03E8 0000 0000 0000 0000 0000 0000 0384 1388 (charger: idle, meter: 16724.21kWh, temperature: 26.0°C, session: 0, voltage: 226V, current: 0.0A, limit: 90.0A)
dst: 01 (charger) src: 80 (CP) cmd: 26 response (charger state update), length: 16 dat: 0000 0000 0000 0000 (not connected to backend)
dst: 01 (charger) src: 80 (CP) cmd: 13 request (read some values), length: 0
dst: 80 (CP) src: 01 (charger) cmd: 13 response (read some values), length: 64 dat: AA00 0216 0000 0000 0000 000B ALD1 D5FS 00A0 0000 364D 3341 0000 0000 1388 2001 ()
dst: 01 (charger) src: 80 (CP) cmd: 33 request (get configuration), length: 0
dst: 80 (CP) src: 01 (charger) cmd: 33 response (get configuration), length: 74 dat: 0000 003C 0000 0384 0000 0384 0300 0001 0100 1E01 0000 0000 0000 0000 0000 0000 0000 03E8 01 ()
dst: 01 (charger) src: 80 (CP) cmd: 34 request (set configuration), length: 86 dat: 03A3 F781 1E03 0000 0101 0001 0000 0000 0000 0000 0000 0000 3C00 0003 8400 0003 8400 0000 0000 03E8 0100 00 ()
dst: 80 (CP) src: 01 (charger) cmd: 34 response (set configuration), length: 4 dat: AA00 ()
# CP connected to backend
dst: BC (broadcast) src: 80 (CP) cmd: 1B request (connection state changed), length: 10 dat: 0000 0384 00 ()
dst: 80 (CP) src: 01 (charger) cmd: 26 request (charger state update), length: 132 dat: 0215 0000 0000 0012 A800 FF30 F200 000A 2EB0 2F04 F078 0008 0008 0104 6400 0000 0000 00E1 0000 0000 0000 0000 0000 0000 03E8 0000 0000 0000 0000 0000 0000 0384 1388 (charger: idle, meter: 16724.21kWh, temperature: 26.0°C, session: 0, voltage: 225V, current: 0.0A, limit: 90.0A)
dst: 01 (charger) src: 80 (CP) cmd: 26 response (charger state update), length: 16 dat: 0000 0000 2DF4 7A2C (session: 0, timestamp: 2024-06-06 13:46:20)
dst: 01 (charger) src: 80 (CP) cmd: 18 request (request charger update), length: 2 dat: 02 ()
dst: 80 (CP) src: 01 (charger) cmd: 26 request (charger state update), length: 132 dat: 0215 0000 0000 0012 A800 FF30 F200 000A 2EB0 2F04 F078 0008 0008 0104 6400 0000 0000 00DE 0000 0000 0000 0000 0000 0000 03E8 0000 0000 0000 0000 0000 0000 0384 1388 (charger: idle, meter: 16724.21kWh, temperature: 26.0°C, session: 0, voltage: 222V, current: 0.0A, limit: 90.0A)
dst: 01 (charger) src: 80 (CP) cmd: 26 response (charger state update), length: 16 dat: 0000 0000 2DF4 7A37 (session: 0, timestamp: 2024-06-06 13:46:31)
# plug in EV
dst: 80 (CP) src: 01 (charger) cmd: 26 request (charger state update), length: 132 dat: 4715 0000 0000 2012 AA00 FF31 5600 000B 2E91 234C F080 0010 000D 0136 6400 0000 0000 00E2 0000 0000 0000 0000 0000 0000 03E8 0000 0000 0000 0000 0000 0000 0384 1388 (charger: starting, meter: 16724.31kWh, temperature: 31.0°C, session: 0, voltage: 226V, current: 0.0A, limit: 90.0A)
dst: 01 (charger) src: 80 (CP) cmd: 26 response (charger state update), length: 16 dat: 0000 0000 2E80 3F5E (session: 0, timestamp: 2024-09-20 14:12:46)
# scan fob
dst: 80 (CP) src: 01 (charger) cmd: 22 request (card authentication request), length: 26 dat: 000E xxxx xxxx xxxx xxxx xxxx xx (authentication request, card: xxxxxxxxxxxxxxxxxxxxxx)
dst: 01 (charger) src: 80 (CP) cmd: 22 response (card authentication request), length: 30 dat: 010E xxxx xxxx xxxx xxxx xxxx xxFF FF (authenticated, card: xxxxxxxxxxxxxxxxxxxxxx)
dst: 80 (CP) src: 01 (charger) cmd: 6A request (charging mode), length: 4 dat: A73C (state: charger starting)
dst: 01 (charger) src: 80 (CP) cmd: 6A response (charging mode), length: 4 dat: AA00 (ack)
dst: 01 (charger) src: 80 (CP) cmd: 6B request (set current limit), length: 18 dat: 0100 3C00 3C00 3C00 3C (current limit: 6.0A)
dst: 80 (CP) src: 01 (charger) cmd: 6B response (set current limit), length: 0
dst: 80 (CP) src: 01 (charger) cmd: 23 request (metering start), length: 32 dat: 0Exx xxxx xxxx xxxx xxxx xxxx 00FF 3156 (card: xxxxxxxxxxxxxxxxxxxxxx, meter: 16724.31kWh)
dst: 01 (charger) src: 80 (CP) cmd: 23 response (metering start), length: 18 dat: 0100 0000 002E 803F 76 (session: 0, timestamp: 2024-09-20 14:13:10)
dst: 80 (CP) src: 01 (charger) cmd: 26 request (charger state update), length: 132 dat: 4A15 0000 0301 2012 A800 FF31 5600 000D 2E9F 0816 2F66 0010 000E 0136 0A00 0000 0000 00E0 0000 0000 0000 0000 0000 0000 03E8 0000 0000 0000 0000 0000 0000 003C 1388 (charger: ready, meter: 16724.31kWh, temperature: 31.0°C, session: 0, voltage: 224V, current: 0.0A, limit: 6.0A)
dst: 80 (CP) src: 01 (charger) cmd: 26 request (charger state update), length: 132 dat: 4A15 0000 0301 2012 A800 FF31 5600 000E 2EA0 012C 2F68 0010 0010 0136 0A00 0000 0000 00E0 0000 0000 0000 0000 0000 0000 03E8 0000 0000 0000 0000 0000 0000 003C 1388 (charger: ready, meter: 16724.31kWh, temperature: 31.0°C, session: 0, voltage: 224V, current: 0.0A, limit: 6.0A)
dst: 01 (charger) src: 80 (CP) cmd: 26 response (charger state update), length: 16 dat: 0000 0000 2E80 3F79 (session: 0, timestamp: 2024-09-20 14:13:13)
dst: 01 (charger) src: 80 (CP) cmd: 23 response (metering start), length: 18 dat: 0100 C178 1F2E 803F 7A (session: 12679199, timestamp: 2024-09-20 14:13:14)
dst: 80 (CP) src: 01 (charger) cmd: 26 request (charger state update), length: 132 dat: 4A15 0000 0301 2012 A800 FF31 5600 000B 2E90 234C F0BC 0010 0010 0136 0A00 C178 1F00 00E1 0000 0000 0000 0000 0000 0000 03E8 0000 0000 0000 0000 0000 0000 003C 1388 (charger: ready, meter: 16724.31kWh, temperature: 31.0°C, session: 12679199, voltage: 225V, current: 0.0A, limit: 6.0A)
dst: 80 (CP) src: 01 (charger) cmd: 26 request (charger state update), length: 132 dat: 4A15 0000 0301 2012 A800 FF31 5600 000B 2E9D 2184 2F58 0010 0010 0136 0A00 C178 1F00 00E1 0000 0000 0000 0000 0000 0000 03E8 0000 0000 0000 0000 0000 0000 003C 1388 (charger: ready, meter: 16724.31kWh, temperature: 31.0°C, session: 12679199, voltage: 225V, current: 0.0A, limit: 6.0A)
dst: 01 (charger) src: 80 (CP) cmd: 26 response (charger state update), length: 16 dat: 00C1 781F 2E80 3F7B (session: 12679199, timestamp: 2024-09-20 14:13:15)
dst: 80 (CP) src: 01 (charger) cmd: 26 request (charger state update), length: 132 dat: 4815 0001 0401 2012 A800 FF31 5600 000C 2E98 1709 2F58 0010 0010 0136 0A00 C178 1F00 00E1 0000 0000 0000 0000 0000 0000 03E8 0000 0000 0000 0000 0000 0000 003C 1388 (charger: charging, meter: 16724.31kWh, temperature: 31.0°C, session: 12679199, voltage: 225V, current: 0.0A, limit: 6.0A)
dst: 80 (CP) src: 01 (charger) cmd: 26 request (charger state update), length: 132 dat: 4815 0001 0401 2012 A900 FF31 5600 000C 2E98 1708 2F58 0010 000F 0136 0A00 C178 1F00 00E1 0000 0000 0000 0000 0000 0000 03E8 0000 0000 0000 0000 0000 0000 003C 1388 (charger: charging, meter: 16724.31kWh, temperature: 31.0°C, session: 12679199, voltage: 225V, current: 0.0A, limit: 6.0A)
dst: 01 (charger) src: 80 (CP) cmd: 26 response (charger state update), length: 16 dat: 00C1 781F 2E80 3F7E (session: 12679199, timestamp: 2024-09-20 14:13:18)
dst: 80 (CP) src: 01 (charger) cmd: 6A request (charging mode), length: 4 dat: A73C (state: charger starting)
dst: 01 (charger) src: 80 (CP) cmd: 6A response (charging mode), length: 4 dat: AA00 (ack)
dst: 01 (charger) src: 80 (CP) cmd: 6B request (set current limit), length: 18 dat: 0100 3C00 3C00 3C00 3C (current limit: 6.0A)
dst: 80 (CP) src: 01 (charger) cmd: 6B response (set current limit), length: 0
dst: 80 (CP) src: 01 (charger) cmd: 6A request (charging mode), length: 4 dat: 813C (state: charging started)
dst: 01 (charger) src: 80 (CP) cmd: 6A response (charging mode), length: 4 dat: AA00 (ack)
dst: 01 (charger) src: 80 (CP) cmd: 6B request (set current limit), length: 18 dat: 0100 3C00 C800 C800 C8 (current limit: 20.0A)
dst: 80 (CP) src: 01 (charger) cmd: 6B response (set current limit), length: 0
dst: 80 (CP) src: 01 (charger) cmd: 26 request (charger state update), length: 132 dat: 4815 0001 0401 2012 AB00 FF34 080B C20C 2E97 17D6 2F31 0010 000F 0140 2100 C178 1F01 00DD 0000 0000 0514 0000 0000 0000 03E8 0000 0000 0000 0000 0000 0000 00C8 1388 (charger: charging, meter: 16725.0kWh, temperature: 32.0°C, session: 12679199, voltage: 221V, current: 13.0A, limit: 20.0A)
dst: 01 (charger) src: 80 (CP) cmd: 26 response (charger state update), length: 16 dat: 00C1 781F 2E80 4304 (session: 12679199, timestamp: 2024-09-20 14:28:20)
dst: 80 (CP) src: 01 (charger) cmd: 21 request (heartbeat), length: 0
dst: 01 (charger) src: 80 (CP) cmd: 21 response (heartbeat), length: 0
dst: 80 (CP) src: 01 (charger) cmd: 26 request (charger state update), length: 132 dat: 4815 0001 0401 2012 AF00 FF36 B00A 820C 2E92 17D4 2F38 0010 0010 0140 2100 C178 1F01 00DD 0000 0000 0488 0000 0000 0000 03E8 0000 0000 0000 0000 0000 0000 00C8 1388 (charger: charging, meter: 16725.68kWh, temperature: 32.0°C, session: 12679199, voltage: 221V, current: 11.6A, limit: 20.0A)
dst: 01 (charger) src: 80 (CP) cmd: 26 response (charger state update), length: 16 dat: 00C1 781F 2E80 4688 (session: 12679199, timestamp: 2024-09-20 14:43:20)
dst: 80 (CP) src: 01 (charger) cmd: 21 request (heartbeat), length: 0
dst: 01 (charger) src: 80 (CP) cmd: 21 response (heartbeat), length: 0
(...)
dst: 80 (CP) src: 01 (charger) cmd: 26 request (charger state update), length: 132 dat: 4A15 0000 0301 2012 AF00 FF58 4804 240B 2E98 22C5 2F29 0010 000F 0140 2100 C178 1F00 00E1 0000 0000 01CC 0000 0000 0000 03E8 0000 0000 0000 0000 0000 0000 00C8 1388 (charger: ready, meter: 16734.28kWh, temperature: 32.0°C, session: 12679199, voltage: 225V, current: 4.6A, limit: 20.0A)
dst: 01 (charger) src: 80 (CP) cmd: 26 response (charger state update), length: 16 dat: 00C1 781F 2E80 768F (session: 12679199, timestamp: 2024-09-20 18:08:15)
# charging finished
dst: 80 (CP) src: 01 (charger) cmd: 6A request (charging mode), length: 4 dat: C13C (state: charger finished)
dst: 01 (charger) src: 80 (CP) cmd: 6A response (charging mode), length: 4 dat: AA00 (ack)
dst: 01 (charger) src: 80 (CP) cmd: 6B request (set current limit), length: 18 dat: 0100 3C00 C800 C800 C8 (current limit: 20.0A)
dst: 80 (CP) src: 01 (charger) cmd: 6B response (set current limit), length: 0
dst: 80 (CP) src: 01 (charger) cmd: 26 request (charger state update), length: 132 dat: 4A15 0000 0301 2012 A800 FF58 4800 000B 2E98 22C8 2F23 0010 0010 0136 2100 C178 1F01 00E6 0000 0000 0000 0000 0000 0000 03E8 0000 0000 0000 0000 0000 0000 00C8 1388 (charger: ready, meter: 16734.28kWh, temperature: 31.0°C, session: 12679199, voltage: 230V, current: 0.0A, limit: 20.0A)
dst: 01 (charger) src: 80 (CP) cmd: 26 response (charger state update), length: 16 dat: 00C1 781F 2E80 7A13 (session: 12679199, timestamp: 2024-09-20 18:23:15)
dst: 80 (CP) src: 01 (charger) cmd: 21 request (heartbeat), length: 0
dst: 01 (charger) src: 80 (CP) cmd: 21 response (heartbeat), length: 0
# unplug EV
dst: 80 (CP) src: 01 (charger) cmd: 6A request (charging mode), length: 4 dat: 803C (state: EV has unplugged)
dst: 01 (charger) src: 80 (CP) cmd: 6A response (charging mode), length: 4 dat: AA00 (ack)
dst: 80 (CP) src: 01 (charger) cmd: 26 request (charger state update), length: 132 dat: 4B15 0000 0001 2012 A800 FF58 4800 000A 2EA0 2EFC F350 000F 0010 0136 6400 C178 1F00 00E0 0000 0000 0000 0000 0000 0000 03E8 0000 0000 0000 0000 0000 0000 0384 1388 (charger: finished, meter: 16734.28kWh, temperature: 31.0°C, session: 12679199, voltage: 224V, current: 0.0A, limit: 90.0A)
dst: 01 (charger) src: 80 (CP) cmd: 26 response (charger state update), length: 16 dat: 00C1 781F 2E80 7BA9 (session: 12679199, timestamp: 2024-09-20 18:30:01)
dst: 80 (CP) src: 01 (charger) cmd: 26 request (charger state update), length: 132 dat: 4B15 0000 0001 2012 A800 FF58 4800 000A 2EA0 2EFC F078 000F 000D 0136 6400 C178 1F00 00E0 0000 0000 0000 0000 0000 0000 03E8 0000 0000 0000 0000 0000 0000 0384 1388 (charger: finished, meter: 16734.28kWh, temperature: 31.0°C, session: 12679199, voltage: 224V, current: 0.0A, limit: 90.0A)
dst: 01 (charger) src: 80 (CP) cmd: 26 response (charger state update), length: 16 dat: 00C1 781F 2E80 7BB3 (session: 12679199, timestamp: 2024-09-20 18:30:11)
dst: 80 (CP) src: 01 (charger) cmd: 24 request (metering end), length: 50 dat: 0Exx xxxx xxxx xxxx xxxx xxxx 00FF 5848 00C1 781F 392E 807B B3 (card: xxxxxxxxxxxxxxxxxxxxxx, meter: 16734.28kWh, session: 12679199, timestamp: 2024-09-20 18:30:11)
dst: 01 (charger) src: 80 (CP) cmd: 24 response (metering end), length: 2 dat: 01 ()
dst: 80 (CP) src: 01 (charger) cmd: 6A request (charging mode), length: 4 dat: A03C (state: charger idle)
dst: 01 (charger) src: 80 (CP) cmd: 6A response (charging mode), length: 4 dat: AA00 (ack)
dst: 80 (CP) src: 01 (charger) cmd: 26 request (charger state update), length: 132 dat: 0215 0000 0000 0012 A800 FF58 4800 000A 2EA0 2EFC F078 0010 000C 0136 6400 0000 0000 00E0 0000 0000 0000 0000 0000 0000 03E8 0000 0000 0000 0000 0000 0000 0384 1388 (charger: idle, meter: 16734.28kWh, temperature: 31.0°C, session: 0, voltage: 224V, current: 0.0A, limit: 90.0A)
dst: 80 (CP) src: 01 (charger) cmd: 26 request (charger state update), length: 132 dat: 0215 0000 0000 0012 A800 FF58 4800 000A 2EA0 2EFC F078 0010 000D 0136 6400 0000 0000 00E0 0000 0000 0000 0000 0000 0000 03E8 0000 0000 0000 0000 0000 0000 0384 1388 (charger: idle, meter: 16734.28kWh, temperature: 31.0°C, session: 0, voltage: 224V, current: 0.0A, limit: 90.0A)
dst: 01 (charger) src: 80 (CP) cmd: 26 response (charger state update), length: 16 dat: 0000 0000 2E80 7BB7 (session: 0, timestamp: 2024-09-20 18:30:15)

Resources

In addition to my own testing, I have used these publicly available sources: