Set Up the VeriStand Bench

This guide takes the charger PC (the ChargeLink charger and NI VeriStand) from a fresh Windows installation to a validated bench, using only the files and scripts in ChargeLink-<VERSION>-bench-kit-win64.zip. Your vehicle or EVCC (the DUT) connects to the charger PC over the link adapter; for a self-test without a DUT, steps 7 and 8 also set up the ChargeLink vehicle on a second PC, the vehicle PC. Nothing is built or generated in VeriStand: the system definition and plant model are delivered ready to deploy, and the owner host deploys them for every session. What each file is, and how a session then runs, is on the NI VeriStand Bench page.

Before you start

Have ready (details in Prerequisites):

• Charger PC: Windows 11 Pro x64 with at least 13 logical processors, NI VeriStand 2024 Q4 installed and licensed, the .NET 10 runtime x64, the Microsoft Visual C++ 2015-2022 Redistributable x64, and 20 GB free disk space.
• One Ethernet adapter on the charger PC for the direct link to your DUT, IPv6 enabled. Note the adapter's name (Get-NetAdapter).
• For a self-test: a vehicle PC with Windows 10 or 11 x64, Windows PowerShell 5.1, the Visual C++ 2015-2022 Redistributable x64 and its own Ethernet adapter for the link.
• The package ZIP and its ChargeLink-<VERSION>-bench-kit-win64.zip.sha256 file.
• Either your own ISO 15118-20 Annex B certificates and keys for the charger and the vehicle side, or the decision to generate the engineering bench PKI in step 3.

The package's docs\INSTALL-CHARGER.md (charger PC) and docs\INSTALL-VEHICLE.md (vehicle PC) contain the same steps. The kit has a charger\ and a vehicle\ folder.

Step 1 — check NI VeriStand and .NET on the charger PC

Get-FileHash 'C:\Program Files\National Instruments\VeriStand 2024\veristand-server.exe','C:\Program Files\National Instruments\VeriStand 2024\NationalInstruments.VeriStand.SystemDefinitionAPI.dll'
dotnet --list-runtimes

Compare the two hashes with the table in docs\INSTALL-CHARGER.md, section 1. A different NI build is not the environment the bench was verified with; record the difference before relying on a result. dotnet --list-runtimes must list Microsoft.NETCore.App 10.0.x. New-BenchConfiguration.ps1 also checks that veristand-server.exe and NationalInstruments.VeriStand.ClientAPI.dll exist in the VeriStand folder.

Step 2 — unpack and verify the package on the charger PC

Verify the archive against its .sha256 file, unpack it to a local folder without spaces, and check every file:

Get-FileHash 'C:\Downloads\ChargeLink-<VERSION>-bench-kit-win64.zip' -Algorithm SHA256
Get-Content 'C:\Downloads\ChargeLink-<VERSION>-bench-kit-win64.zip.sha256'
Expand-Archive 'C:\Downloads\ChargeLink-<VERSION>-bench-kit-win64.zip' -DestinationPath 'C:\ChargeLink\<VERSION>'
cd C:\ChargeLink\<VERSION>
Get-Content .\manifest\SHA256SUMS | ForEach-Object {
    $hash, $path = $_ -split '  ', 2
    if ((Get-FileHash -LiteralPath $path -Algorithm SHA256).Hash -ne $hash.ToUpperInvariant()) { throw "Changed: $path" }
}
'all files verified'

If the ZIP contains a top-level ChargeLink-<VERSION>-bench-kit-win64 folder, run the check inside it and use that folder in place of C:\ChargeLink\<VERSION> below. If docs\SIGNING.md says the package is signed, also check Get-AuthenticodeSignature .\charger\bin\chargelink.exe.

Step 3 — TLS material

ISO 15118-20 requires mutual TLS 1.3 with the certificate profiles of ISO 15118-20 Annex B. Choose one of the two ways.

A. The engineering bench PKI (engineering and test use only)

Run this once on the charger PC, from a working folder outside the package (the CLI keeps its runtime state in .chargelink under the current folder). The output folder must not exist yet:

New-Item -ItemType Directory -Force C:\ChargeLink\work | Out-Null; cd C:\ChargeLink\work
C:\ChargeLink\<VERSION>\charger\bin\chargelink.exe evse tls-material-init --bench-pki --output-dir C:\ProgramData\DEVlink\ChargeLink\tls\engineering-pki

It writes new keys and certificates on every run, readable only by their owner and SYSTEM, and prints no key:

Every certificate carries the subject O ChargeLink ENGINEERING ONLY - not for production. The SECC accepts it only when the bench configuration allows it, which -EngineeringPki does. The root and sub-CA keys are discarded when the command ends, and there is no revocation service for this PKI. To replace the material, generate into a new folder, run step 5 again with -Force, and give the vehicle side the new vehicle files.

B. Your own PKI

Keep the charger PC files outside the package folder, for example in C:\ProgramData\DEVlink\ChargeLink\tls\charger, readable only by the operator account.

Step 4 — firewall on the charger PC (administrator, once)

The SECC answers SDP on UDP 15118 and accepts TLS on TCP 50118, on the link adapter only. Replace the adapter name and, if different, the package path:

$alias = 'Ethernet 3'; $exe = 'C:\ChargeLink\<VERSION>\charger\bin\chargelink.exe'
New-NetFirewallRule -DisplayName 'DEVlink ChargeLink EVSE SDP UDP 15118' -Direction Inbound -Action Allow -Profile Any -InterfaceAlias $alias -Protocol UDP -LocalPort 15118 -RemoteAddress 'fe80::/10' -Program $exe
New-NetFirewallRule -DisplayName 'DEVlink ChargeLink EVSE TCP' -Direction Inbound -Action Allow -Profile Any -InterfaceAlias $alias -Protocol TCP -LocalPort 50118 -RemoteAddress 'fe80::/10' -Program $exe
New-NetFirewallRule -DisplayName 'DEVlink ChargeLink ICMPv6 Diagnostics' -Direction Inbound -Action Allow -Profile Any -InterfaceAlias $alias -Protocol ICMPv6 -IcmpType 128 -RemoteAddress 'fe80::/10'

The rules name the executable by path; create them again if the package folder moves. The gRPC service the owner host starts listens on 127.0.0.1:50051 only and needs no rule.

Step 5 — bench configuration on the charger PC

Record the link adapter, the TLS files and the NI folder once, from charger. With the engineering bench PKI:

cd C:\ChargeLink\<VERSION>\charger
powershell -NoProfile -ExecutionPolicy Bypass -File .\New-BenchConfiguration.ps1 -InterfaceAlias 'Ethernet 3' `
    -EngineeringPki C:\ProgramData\DEVlink\ChargeLink\tls\engineering-pki

It prints a warning that the bench runs with engineering material. With your own PKI:

powershell -NoProfile -ExecutionPolicy Bypass -File .\New-BenchConfiguration.ps1 -InterfaceAlias 'Ethernet 3' `
    -TlsCertChain C:\ProgramData\DEVlink\ChargeLink\tls\charger\secc-cert-chain.pem `
    -TlsKey C:\ProgramData\DEVlink\ChargeLink\tls\charger\secc-key.pem `
    -TlsTrustAnchor C:\ProgramData\DEVlink\ChargeLink\tls\charger\v2g-root-ca.pem

The script reads the adapter's interface index and its preferred IPv6 link-local address, checks the NI files and the TLS files, and writes charger\bench-configuration.json. It prints the SECC address the vehicle side connects to; note it. Further parameters: -VeriStandDir (default C:\Program Files\National Instruments\VeriStand 2024), -RunsRoot (default runs next to charger), -Force to replace an existing file. Run it again with -Force whenever the adapter or the TLS files change: a link-local address can change when the adapter is reinstalled.

Step 6 — validate on the charger PC

powershell -NoProfile -ExecutionPolicy Bypass -File .\Start-SeccSession.ps1 -ValidateOnly
powershell -NoProfile -ExecutionPolicy Bypass -File .\Start-SeccSession.ps1 -Mode Manual -ValidateOnly

Each renders one run's native.json and campaign-configuration.json from charger\templates and has the owner host check them. It starts no VeriStand runtime and no listener. Both must print Configuration accepted by the owner host.

With your DUT, the charger PC is now ready: connect the DUT to the link adapter, give it the vehicle-side TLS material from step 3, and continue with step 8.

Step 7 — install the ChargeLink vehicle on the vehicle PC (self-test)

1. Copy the package's vehicle folder to the vehicle PC, for example to C:\ChargeLinkExternalEvcc, together with a copy of manifest\SHA256SUMS, and check the six vehicle/ files:

   cd C:\ChargeLinkExternalEvcc
   Get-Content .\SHA256SUMS | Where-Object { $_ -match '  vehicle/' } | ForEach-Object {
       $hash, $path = $_ -split '  ', 2
       $local = $path.Substring(4)
       if ((Get-FileHash -LiteralPath $local -Algorithm SHA256).Hash -ne $hash.ToUpperInvariant()) { throw "Changed: $local" }
   }
   'vehicle files verified'

2. TLS files. Place vehicle-cert-chain.pem, vehicle-key.pem and v2g-root-ca.pem in vehicle\tls (see vehicle\tls\README.txt). With the engineering bench PKI, these are the three files from its vehicle folder, copied unchanged, for example with a removable drive (delete the copy on the drive afterwards). Copy them again whenever the charger PC's material is regenerated. Restrict vehicle\tls to the operator account.
3. Firewall (administrator, once), if the Windows firewall filters outbound traffic on the vehicle PC:

   $alias = 'Ethernet 3'; $exe = 'C:\ChargeLinkExternalEvcc\chargelink.exe'
   New-NetFirewallRule -DisplayName 'DEVlink ChargeLink EVCC SDP UDP 15118' -Direction Outbound -Action Allow -Profile Any -InterfaceAlias $alias -Protocol UDP -RemotePort 15118 -RemoteAddress 'ff02::1' -Program $exe
   New-NetFirewallRule -DisplayName 'DEVlink ChargeLink EVCC TCP' -Direction Outbound -Action Allow -Profile Any -InterfaceAlias $alias -Protocol TCP -RemotePort '49152-65535' -RemoteAddress 'fe80::/10' -Program $exe
   New-NetFirewallRule -DisplayName 'DEVlink ChargeLink ICMPv6 Diagnostics' -Direction Inbound -Action Allow -Profile Any -InterfaceAlias $alias -Protocol ICMPv6 -IcmpType 128 -RemoteAddress 'fe80::/10'

4. EV cases. Start-Evcc.ps1 sets CHARGELINK_ISO20_LIVE_SEMANTIC_CASE to cases\nominal.json (-Case Nominal, the default) or cases\emergency-transition.json (-Case EmergencyTransition), and CHARGELINK_ISO20_FULL_WIRE_SESSION_MANIFEST to cases\full-wire-session-manifest.json. The ChargeLink vehicle refuses a live session without them. Do not edit them.

Step 8 — check the link

With your DUT, check from the charger PC that the DUT's link-local address answers on the link adapter (if your DUT answers ICMPv6 echo requests):

ping -6 'fe80::<DUT>%<CHARGER_PC_INTERFACE_INDEX>'

In a self-test, start a session on the charger PC (Start-SeccSession.ps1, see Running a session) so that the SECC listens, then probe it from the vehicle PC without starting an ISO 15118 session:

cd C:\ChargeLinkExternalEvcc
powershell -NoProfile -ExecutionPolicy Bypass -File .\Start-Evcc.ps1 -PeerIpv6 fe80::xxxx:xxxx:xxxx:xxxx -InterfaceAlias 'Ethernet 3' -ProbeOnly -WaitSeconds 60

-PeerIpv6 is the address step 5 printed, without the % zone; the launcher scopes it to the vehicle PC's own adapter. The launcher's defaults for -PeerIpv6 and -InterfaceAlias are placeholders: pass both every time, or edit the two defaults in Start-Evcc.ps1 once for this bench (its SHA-256 then differs from the manifest, which is expected; record the change). The probe opens and closes one TCP connection. The SECC waits for the vehicle only for its phase timeout (120 s in automation mode), so let that charger PC run end before the first real session.

The bench is ready. Continue with Running a session.

Troubleshooting the setup

Session-time problems are covered in NI VeriStand Bench, Troubleshooting.

Uninstalling

Delete the package folder and runs_root; remove the firewall rules (Remove-NetFirewallRule -DisplayName 'DEVlink ChargeLink*') on the charger PC and, if used, the vehicle PC; delete %ProgramData%\DEVlink\ChargeLink\RuntimeOwnership\native-activation.state on the charger PC; and destroy the TLS keys (for the engineering bench PKI: its output folder on the charger PC and the vehicle\tls files on the vehicle PC; remove the vehicle material from your DUT).