EvseSlac

Implementation of SLAC data link negotiation according to ISO15118-3.

Handwritten Documentation

EvseSlac is the charger-side (EVSE) implementation of the SLAC protocol defined in ISO 15118-3. It is the part of EVerest that pairs the powerline modem in your charger with the modem in the car, so that the two can talk high level charging protocols (ISO 15118 / DIN 70121) afterwards.

This page explains what SLAC does, what features the module offers, which modem hardware is supported and how to configure the most common setups.

What is SLAC?

When an electric car and a DC or smart AC charger communicate, they do so via powerline communication (PLC): high-frequency signals injected onto the Control Pilot wire of the charging cable. Both sides contain a small HomePlug Green PHY modem for this.

Out of the box these modems do not trust each other. Before any charging related communication can happen, the charger has to verify that the car it hears is really the one plugged into this cable (and not a car at the neighbouring charging point, whose signal crosses over), and both modems have to join a private, encrypted network. The procedure that does this is SLAC — Signal Level Attenuation Characterization: the car sends a series of test signals (“sounds”), the charger measures how strongly they arrive, and if the signal is strong enough the two pair up using a fresh network key.

+------------------+                            +----------------------+
|     EV (car)     |      charging cable        |    EVSE (charger)    |
|                  |   ======================   |                      |
|  +-----------+   |     Control Pilot wire     |   +-----------+      |
|  | PLC modem |<--+--> ~~ HF signals ~~ <------+-->| PLC modem |      |
|  +-----------+   |   ======================   |   +-----+-----+      |
|                  |                            |         |            |
+------------------+                            |   EvseSlac           |
                                                |   EvseManager        |
                                                |   ISO 15118 stack    |
                                                +----------------------+

How a session unfolds

EvseSlac is driven by the EvseManager module: when the car is plugged in (Control Pilot state changes from A/E/F to B/C/D), EvseManager calls enter_bcd and the module starts listening. From the user’s perspective the whole procedure takes well under a second on a good connection.

Car plugged in (CP state A -> B)
       |
       v
EvseManager: enter_bcd  ------------>  EvseSlac armed
       |
       v
Car asks "is a charger listening?"     (CM_SLAC_PARM.REQ)
       |
       v
Sounding: car sends test signals,      (CM_MNBC_SOUND.IND)
charger measures the attenuation
       |
       v
Charger reports the measurement        (CM_ATTEN_CHAR.IND)
       |
       v
Car picks this charger, asks to pair   (CM_SLAC_MATCH.REQ)
       |
       v
Charger hands out a fresh network      (CM_SLAC_MATCH.CNF)
key (NMK) and programs its own modem
       |
       v
Both modems join the private network
(AVLN), the PLC link comes up
       |
       v
dlink_ready(true) is published:
high level communication starts

When the car is unplugged, EvseManager calls leave_bcd. From a matched or failed session the module leaves the logical network, generates a new key and re-arms itself; while still matching it just returns to idle, since no network was joined. Either way a failed or aborted session never gets the charger stuck.

Features

Robust startup and recovery

  • The module starts even if the PLC network interface is not (yet) present, and recovers automatically when the interface disappears and comes back — for example when the modem is reset or powered late during boot. Module readiness is held back until the PLC I/O is actually usable.

  • I/O and the SLAC state machine run event driven in a single thread; there are no polling threads burning CPU in idle.

  • If a PLC error interrupts an established session, dlink_ready(false) is published so the rest of the system reacts immediately instead of talking into a dead link.

Reliable modem key setup

Programming the network key into the local modem (CM_SET_KEY) is the step where real-world modems differ the most. Two behaviors are configurable:

  • set_key_handling_mode: one single attempt (legacy behavior), or retries with confirmation (retry_confirmed, the default) where the new key is only trusted after the modem has confirmed it.

  • set_key_cnf_success_mode: which confirmation result counts as success. Qualcomm chips answer 0x01 (the default expectation), the HomePlug Green PHY standard says 0x00, and a compatibility mode accepts both.

Fresh network keys are generated for every session. By default only printable characters are used (compatible with some picky EVs in the field); nmk_generation_mode: full_byte_range opts into the full byte range for a lower collision probability.

EV validation (BCB toggle)

If a car wants extra certainty that it is paired with the right charger, it can start the optional CM_VALIDATE procedure from ISO 15118-3: the car briefly toggles its Control Pilot state (B → C → B) a number of times and asks the charger how many toggles it saw. EvseSlac implements the full two-step exchange, including the timed observation window. The toggle count itself comes from EvseManager via the count_bc command of the slac interface, so this works out of the box in a standard EVerest setup.

Transmit power limitation (CM_AMP_MAP)

Some installations need to reduce the PLC transmit power on selected OFDM carriers, for example to meet EMC requirements. With initiate_amp_map: true the module sends an amplitude map to its modem once the network is established. The map is described in a small YAML file (amp_map_file) — see config/slac_amp_map_example.yaml:

carriers: 1155          # number of OFDM carriers
default_amplitude: 15   # 15 = full power, 0 = maximum reduction
overrides:              # optional per-carrier values
  100: 4
  101: 4

Incoming CM_AMP_MAP requests are always answered, regardless of this option.

Living next to other charging points

On sites with several charging points the modems hear each other (“cross talk”). The module keeps up to max_matching_sessions candidate sessions apart and answers each car individually — the attenuation measurement then makes sure only the physically connected car pairs up. On multi-connector hardware, startup_delay_ms staggers the modem queries of multiple EvseSlac instances at boot.

Autocharge support

With publish_mac_on_match_cnf (default on) the MAC address of the successfully matched car is published on the token_provider interface. This can be used for autocharge — identifying a returning car by its modem MAC — including on AC with cars that do not do high level communication.

Compatibility switches for real-world EVs

  • ac_mode_five_percent (default on): restart failed SLAC sessions as ISO 15118-3 specifies for AC. The standard does not allow the retries for DC, but leaving this on is strongly recommended — some EVs in the field frequently need a second attempt.

  • reset_instead_of_fail (default on): after an aborted session, go back to a ready state instead of the standard’s terminal failed state, because some cars immediately try again with a new CM_SLAC_PARM.REQ. Turn this off only for conformance testing.

  • sounding_attenuation_adjustment: add a dB offset to the measured attenuation to compensate for the coupling characteristics of your hardware.

Diagnostics

  • print_state_transitions logs every internal state change.

  • With EVerest telemetry enabled, the module publishes detailed information about every SLAC session.

  • Successful sessions are narrated at INFO level in the log, so a session can be followed without debug logging.

Supported hardware

The module talks standard HomePlug Green PHY on the wire and works with any compliant EVSE modem. The vendor of the connected modem is detected automatically at startup; for the following chips vendor-specific extensions are used:

Modem

Specialities

Qualcomm QCA7000 / QCA7005 (QCA700x family)

Link status detection and supervision. Optional chip reset after key setup (do_chip_reset, via the RS_DEV vendor extension; Lumissil uses NSCM RESET_DEVICE for the same step). Note that these chips confirm CM_SET_KEY with result 0x01; the default configuration expects this.

Lumissil CG5317

Link status detection and supervision (via the NSCM vendor extension). Default set-key timing works.

Other HPGP modems

Full SLAC functionality; link status detection and chip reset are not available and must stay disabled.

Typical configuration

For most chargers the defaults are sensible and only the network device needs to be set:

evse_slac:
  module: EvseSlac
  config_implementation:
    main:
      device: eth1

Recommended additions for hardware with a Qualcomm or Lumissil modem:

link_status_detection: true
link_status_debounce_count: 3   # ride out short link flaps

Requirements and notes

  • The module opens a raw ethernet socket on device. If EVerest does not run as root, the process needs the CAP_NET_RAW capability.

  • The EV-side counterpart of this module is EvSlac, built on the same library — useful for simulators and test setups.

  • debug_simulate_failed_matching and hack_disable_regenerate_key_on_reset are debugging aids and must not be enabled in production.

Auto-Generated Reference

Provides

main: slac
SLAC interface implementation.
config:
device: string <optional>
default: “eth1”
Ethernet device used for PLC.
number_of_sounds: integer <optional>
default: 10
SLAC number of sounds.
ac_mode_five_percent: boolean <optional>
default: True
Use AC 5% mode according to ISO15118-3. This restarts SLAC sessions if they fail according to the standard. The standard only allows the retries for AC, not for DC. However, it is strongly recommended to always set this option to true, also for DC, otherwise some EVs in the field will fail to do SLAC frequently.
set_key_timeout_ms: integer <optional>
default: 1000
Timeout and retry interval for CM_SET_KEY.REQ. Default works for QCA7000/QCA7005/CG5317.
set_key_handling_mode: string <optional>
default: “retry_confirmed”
Set-key behavior mode:
- legacy_single_attempt: send one CM_SET_KEY.REQ and only accept a valid CM_SET_KEY.CNF success result.
- retry_confirmed: retry on timeout/failure and only accept CM_SET_KEY.CNF result success.
enum:
- legacy_single_attempt
- retry_confirmed
set_key_cnf_success_mode: string <optional>
default: “modem_compat_0x01”
CM_SET_KEY.CNF success result interpretation:
- modem_compat_0x01: default QCA/practical modem behavior; only result 0x01 is accepted as success.
- hpgp_standard_0x00: explicit HomePlug Green PHY standard behavior; only result 0x00 is accepted.
- accept_0x00_or_0x01: compatibility mode accepting either standard 0x00 or modem-compatible 0x01.
enum:
- modem_compat_0x01
- hpgp_standard_0x00
- accept_0x00_or_0x01
nmk_generation_mode: string <optional>
default: “legacy_printable”
NMK generation mode for internal session NMK generation:
- legacy_printable: default compatibility mode; use legacy printable characters only (0-9A-Z).
- full_byte_range: explicit opt-in for the full byte range 0x00..0xFF to reduce collision probability.
enum:
- legacy_printable
- full_byte_range
set_key_max_attempts: integer <optional>
default: 10
Maximum CM_SET_KEY.REQ attempts before proceeding to the next reset state.
sounding_attenuation_adjustment: integer <optional>
default: 0
Offset in dB that should be added to the calculated sounding attenuation
publish_mac_on_match_cnf: boolean <optional>
default: True
Publish the EV MAC address on the token_provider interface when matching is confirmed (CM_SLAC_MATCH.CNF). This can be used for autocharge as an alternative to the EVCCID derived from HLC and published by EvseManager. This can be used for AC autocharge on cars that do not support actual HLC on AC.
publish_mac_on_first_parm_req: boolean <optional>
default: False
Publish the EV MAC address when the first CM_SLAC_PARM.REQ. This should not be used as it is quite error prone: The MAC address might be from another car via cross talk. It is better to wait for the matching to be done.
do_chip_reset: boolean <optional>
default: False
Perform a chip reset after setting the NMK (Qualcomm RS_DEV.REQ or Lumissil NSCM RESET_DEVICE vendor MME; other vendors skip the step)
chip_reset_delay_ms: integer <optional>
default: 100
Delay between SET_KEY.CNF and RS_DEV.REQ
chip_reset_timeout_ms: integer <optional>
default: 500
Timeout for RS_DEV.REQ (waiting for RS_DEV.CNF)
link_status_detection: boolean <optional>
default: False
After matching.cnf, wait for link to come up before sending out d_link_ready=connected using LINK_STATUS Vendor MME Extension (Works on Qualcomm and Lumissil chips)
link_status_retry_ms: integer <optional>
default: 100
Delay between retries of LINK_STATUS requests after matching request
link_status_timeout_ms: integer <optional>
default: 10000
Timeout for Link to come up after matching request
link_status_poll_in_matched_state_ms: integer <optional>
default: 200
Interval between LINK_STATUS polls while matched. Link-loss detection takes up to link_status_debounce_count consecutive polls, so keep debounce count times poll interval well below TP_match_leave (1 s) for ISO 15118-3 conformant leaving on connection loss.
link_status_debounce_count: integer <optional>
default: 1
Consecutive negative LINK_STATUS confirmations in the matched state before the link counts as lost and the session is torn down. 1 tears down on the first negative reply; higher values ride out transient PLC link flaps (e.g. re-sync under full DC load) at the cost of one poll interval of detection latency per additional confirmation. A positive confirmation resets the count.
debug_simulate_failed_matching: boolean <optional>
default: False
Only for debugging. Simulate failed matching by sending a wrong NMK to the EV.
reset_instead_of_fail: boolean <optional>
default: True
Go to reset state instead of failed state. This is against the ISO15118-3. But some cars directly send a CM_SLAC_PARAM.req message when the SLAC process aborts. To react to this message and restart the SLAC process, the EVSE go to the reset state here.
max_matching_sessions: integer <optional>
default: 5
Maximum number of simultaneous CM_SLAC_PARM sessions the EVSE keeps active.
startup_delay_ms: integer <optional>
default: 0
Delay initialization of SLAC I/O by the given amount. On some hardware platforms with multiple EvseSlac modules loaded this can be necessary to ensure that the initial query of the device information does not happen at the same time.
slac_init_timeout_ms: integer <optional>
default: 40000
Timeout for CM_SLAC_PARM.REQ. Values between 10000 and 20000 can be set at your own risk, as they violate ISO15118-3. Experience has shown that this should not cause any problems.
print_state_transitions: boolean <optional>
default: False
For debugging. Print all transitions of the internal state machine.
hack_disable_regenerate_key_on_reset: boolean <optional>
default: False
Hack: Do not regenerate NMK on reset, this is not spec compliant and should only be set for debugging purposes.
initiate_amp_map: boolean <optional>
default: False
Send a CM_AMP_MAP.REQ once the AVLN is established to reduce the transmit power of selected OFDM carriers (ISO 15118-3 A.9.6 transmit-power limitation). The amplitude map is read from amp_map_file. The SECC always answers an incoming CM_AMP_MAP.REQ with CM_AMP_MAP.CNF regardless of this option.
amp_map_file: string <optional>
default: “”
Path to a YAML file describing the CM_AMP_MAP amplitude map (keys: carriers, default_amplitude 0..15, overrides {carrier: amplitude}). Empty uses a built-in all-maximum-TX default (no reduction). See config/slac_amp_map_example.yaml. Only used when initiate_amp_map is true.

Metadata

Authors

Jan Christoph Habig (Pionix GmbH)
Cornelius Claussen (Pionix GmbH)

License