OCPP Firmware Stack for AC and DC Chargers

Reconnect with exponential backoff and jitter. A cellular tower dropping causes every charger on it to try to reconnect simultaneously otherwise; you DDoS your own CMS.

Message queueing for offline periods. Transactions, MeterValues and StatusNotifications continue happening while the network is down. The client persists them, orders them, and replays on reconnect.

Clock drift handling. A charger with a battery-backed RTC that's off by hours produces confused timestamps. The client should reconcile against CMS-supplied time on BootNotification and Heartbeat responses.

When the CMS pushes a ChargingProfile via SetChargingProfile, the firmware has to enforce it at the connector level. This means the state machine has to drive the CP PWM duty cycle in real-time to reflect the current limit the profile allows.

Correct behaviour: profiles compose (transaction-level, connector-level, station-level), and the most restrictive wins. Multiple ChargingProfiles can be active simultaneously; the firmware evaluates every second and applies the tightest constraint.

OCPP Compliance Testing Tool (OCTT) is the vendor-neutral test suite. Passing OCTT is necessary but not sufficient; real chargers meet real CMS platforms with implementation quirks the spec doesn't cover.

RIOD's approach: OCTT plus interoperability testing against multiple commercial CMS platforms and RIOD-built platforms during firmware release cycles. It's how bugs that only appear at certain CMS software versions tend to get caught before customers do.

• Boot: check hardware, load config, initialise interfaces
• Connect: WebSocket subprotocol negotiation, BootNotification, receive heartbeat interval
• Authorize: check RFID or app credential against local list or CMS
• Start: OCPP StartTransaction, engage relay, begin metering
• Meter: periodic MeterValues with sampled current, voltage, energy, temperature
• Stop: OCPP StopTransaction with meter stop reading and stop reason
• Offline queue: journal all events when the network drops
• Replay: on reconnect, drain the queue in order
• Fault recovery: enter State F on hazard, notify CMS, wait for reset

• Transaction state, so a power cut mid-session does not lose the current session
• MeterValues, so replay carries actual energy delivered
• Message IDs and sequence numbers for dedup on retry
• Local authorization list snapshot with version
• Firmware campaign state (downloaded, verified, committed, rolled back)

• Test against multiple commercial CMS platforms (Ampeco, Driivz, ChargeLab, EVBox)
• Simulate network drops mid-session
• Test clock drift by advancing the charger's RTC by hours
• Send duplicate messages and verify idempotent handling
• Run long sessions (over 12 hours) to check accumulator overflow paths