Environment and Bench Preflight

Preflight is the boundary between "the application is installed" and "this workstation is correctly prepared to operate the selected protocol against a real peer". Run it whenever the PC, network adapter, certificate set, VeriStand version, bench wiring or ChargeLink release changes.

Most first-day failures are environmental rather than protocol defects: the wrong NIC is selected, IPv6 is disabled, UDP 15118 is blocked, another process owns the TCP port, a certificate is expired, or a VeriStand project no longer deploys. Preflight isolates those conditions before a live session creates misleading protocol symptoms.

$CL   = 'C:\ChargeLink\0.5.0-rc2\pc1\bin\chargelink.exe'
$Data = 'C:\ChargeLinkData'

1. Record the exact software identity

chargelink --version
chargelink --runtime-root "$Data\runtime" --artifact-root "$Data\artifacts" --json license status
chargelink --runtime-root "$Data\runtime" --artifact-root "$Data\artifacts" --json doctor --strict
chargelink --runtime-root "$Data\runtime" --artifact-root "$Data\artifacts" --json runtime list

Make sure no stale session holds a role lock. If runtime list shows a session whose heartbeat is old and whose process no longer exists, recover it:

chargelink --runtime-root "$Data\runtime" --artifact-root "$Data\artifacts" --json runtime recover --stale-only --dry-run
chargelink --runtime-root "$Data\runtime" --artifact-root "$Data\artifacts" --json runtime recover --stale-only

2. Identify the bench adapter and its IPv6 identity

Get-NetAdapter | Sort-Object ifIndex | Format-Table ifIndex,Name,Status,LinkSpeed,MacAddress -AutoSize
Get-NetIPAddress -AddressFamily IPv6 | Where-Object PrefixOrigin -eq 'WellKnown' |
  Sort-Object InterfaceIndex | Format-Table InterfaceIndex,InterfaceAlias,IPAddress,AddressState -AutoSize
Get-NetAdapterBinding -Name '<ADAPTER_NAME>' -ComponentID ms_tcpip6

Pick the physical adapter cabled to the other bench PC, the vehicle or the charger. A PLC modem is not connected to this adapter directly: a real powerline (PLC) link goes through the DEVlink PLC Relay Unit, which is in development (see Connecting to Real PLC Hardware). Do not select Wi-Fi, VPN, Hyper-V, Docker or an unrelated USB NIC because it has a lower index. Record two values that every live command needs:

• Interface index, for example 19 (--interface-index 19).
• Link-local address with zone, for example fe80::1234:5678:9abc:def0%19 (--advertise-ipv6 on the EVSE, --peer-ipv6 on the EVCC).

$IfIndex   = 19
$Advertise = (Get-NetIPAddress -InterfaceIndex $IfIndex -AddressFamily IPv6 |
              Where-Object IPAddress -like 'fe80::*' | Select-Object -First 1).IPAddress + "%$IfIndex"
$Advertise

Expected: Enabled: True for the IPv6 binding and one fe80:: address in state Preferred.

3. Check the ISO 15118 / DIN ports

Get-NetUDPEndpoint -LocalPort 15118 -ErrorAction SilentlyContinue
Get-NetTCPConnection -LocalPort 50118 -ErrorAction SilentlyContinue
netstat -ano | findstr ':15118 :50118'

An existing listener is not automatically wrong; it can be a ChargeLink session you started. Map the PID with Get-Process -Id <PID>. Use the PowerShell commands above to check ports.

4. Run the ChargeLink live preflight (ISO 15118-20, ISO 15118-2, DIN 70121)

evse live-preflight resolves the selected profile, checks port ownership and stale sessions, validates TLS material if given, and writes a preflight artifact. It does not start the listener.

chargelink --runtime-root "$Data\runtime" --artifact-root "$Data\artifacts" --json evse live-preflight `
  --source external-evcc `
  --protocol iso15118-20 `
  --profile-id iso15118_20_dc `
  --host '::' `
  --tcp-port 50118 `
  --udp-port 15118 `
  --advertise-ipv6 $Advertise `
  --interface-index $IfIndex `
  --recover-stale

--source is external-evcc for a peer on another machine and same-pc for an EVCC on this PC. Repeat with --protocol iso15118-2 or --protocol din70121 and the matching profile. Add --allow-active-evse only when an EVSE session is intentionally running, and --skip-port-check only for diagnostics.

A successful preflight means ChargeLink accepted the configuration and found no local blocker. It is not proof that the remote peer will negotiate.

5. TLS / Plug & Charge preflight

Validate the certificate material before any TLS session. The doctor accepts PEM files and checks key match, chain and validity period:

chargelink --runtime-root "$Data\runtime" --artifact-root "$Data\artifacts" --json evse tls-pki-doctor `
  --protocol iso15118-20 --profile-id iso15118_20_dc `
  --tls --require-ca `
  --tls-cert "$Data\pki\secc-chain.pem" `
  --tls-key  "$Data\pki\secc-key.pem" `
  --tls-cafile "$Data\pki\v2g-root-ca.pem"

Then run the live preflight with the same TLS options plus --tls. For ISO 15118-2 sessions with an external EVCC that uses TLS 1.2 through Windows SChannel, add --external-evcc-windows-tls --tls-pfx <identity.pfx>. ISO 15118-20 requires TLS 1.3 with mutual authentication and therefore the default rustls adapter with --require-ca; the SChannel adapter cannot select ISO 15118-20. Details and certificate requirements are in TLS, PKI and Plug & Charge.

Also verify the clock. Certificate validation fails when the workstation time is wrong even if the files are valid:

w32tm /query /status
Get-Date

6. Scripted DC-CAN lanes (optional)

If you use the scripted DC-CAN lanes, confirm that they run on this PC. They play fixed fixture frames on a virtual bus and open no hardware:

chargelink --runtime-root "$Data\runtime" --artifact-root "$Data\artifacts" --json dc-can catalog
chargelink --runtime-root "$Data\runtime" --artifact-root "$Data\artifacts" --json dc-can virtual-run --protocol chademo --profile dc_can_virtual_evse --frame-count 4
chargelink --runtime-root "$Data\runtime" --artifact-root "$Data\artifacts" --json dc-can chademo-can-adapter-loop --run-id preflight-dc-can-loop `
  --adapter-kind peak-pcan --adapter-mode loopback --channel PCAN_USBBUS1 --bitrate-kbps 500

Accepted --adapter-kind values: peak-pcan, vector-xl, kvaser-canlib, socketcan, slcan, lawicel, usbtin. They are descriptors: the run binds its evidence to the named adapter configuration without opening the hardware, so hardware_loop_evidence_complete is false.

7. NI VeriStand preflight

On PC1 of the VeriStand bench, check the NI files and the .NET runtime, then let the owner host validate the bench configuration without starting VeriStand or a listener:

Get-FileHash 'C:\Program Files\National Instruments\VeriStand 2024\veristand-server.exe','C:\Program Files\National Instruments\VeriStand 2024\NationalInstruments.VeriStand.SystemDefinitionAPI.dll'
dotnet --list-runtimes
cd C:\ChargeLink\0.5.0-rc2\pc1
powershell -NoProfile -ExecutionPolicy Bypass -File .\Start-SeccSession.ps1 -ValidateOnly
powershell -NoProfile -ExecutionPolicy Bypass -File .\Start-SeccSession.ps1 -Mode Manual -ValidateOnly

Compare the hashes with the package's docs\INSTALL-PC1.md; dotnet must list Microsoft.NETCore.App 10.0.x; both validations must print Configuration accepted by the owner host. Make sure no other VeriStand project is deployed and logical processors 10, 11 and 12 are free of other load. The full procedure is in Set Up the VeriStand Bench.

8. Firewall and endpoint security

Get-NetFirewallRule -Enabled True | Where-Object DisplayName -Match 'ChargeLink|VeriStand' |
  Format-Table DisplayName,Direction,Action,Profile -AutoSize

Document every allow rule rather than disabling the firewall globally. The gRPC server accepts only a loopback --listen address and requires its per-start access token on every call; it has no TLS transport, so the management API is local only (Production Security).

9. Bench release checklist

Only after this checklist is complete should the operator move to the selected protocol runbook.