I managed to do some more logging in the car over Easter, and found some nice messages:

ID#100

        Charge Timer VDS Feedback
                B1=06   (timer/plugin setting and timer confirmation)

                        B2=1B   (timer/plugin setting)
                                B3=0x01
                                B4=0x00
                                B5=0x00/0x01 (0x00=plugin, 0x01=timer)
                                B6=0x00
                                B7=0x00
                                B8=0x00

                        B2=1A   (timer start hour)
                                B3=0x01
                                B4=0x00
                                B5=TimerLSB                     (see id#102 B1=0x05 for details on this)
                                B6=TimerMSB                     (see id#102 B1=0x05 for details on this)
                                B7=0x00
                                B8=0x00

and

ID#102

        Set timer/plugin 
                B1=05   (timer/plugin setting and timer confirmation)

                        B2=1B   (timer/plugin setting)
                                B3=0x00
                                B4=0x00
                                B5=0x00/0x01 (0x00=plugin, 0x01=timer)
                                B6=0x00
                                B7=0x00
                                B8=0x00

                        B2=1A   (timer start hour)
                                B3=0x00
                                B4=0x00
                                B5=TimerLSB             \
                                B6=TimerMSB             | (gmthour*60)-1, with special case midnight gmthour=24
                                B7=0x00
                                B8=0x00

                N.B. Empirical values for TimerLSB and TimerMSB (a GMT+0800 car in Hong Kong) are:
                     1439 (0x059F) for midnight GMT, 59 (0x003B) for 1am GMT, up to 1379 (0x0563) for 11pm GMT.

It is a bit nasty because the ID#100 messages only seem to be sent in response (confirmation?) to a ID#102 command, so for a newly power-on module we won't be able to show the current setting unless we set the value first.

This is useful ground-work for the finish-charge-by feature, as it would be nice to just use the car timer.

I also found that on ID#100 B1=0x95 charger status message, a car in "Preparing to charge" "Charge scheduled for XX:XX" state will use B2 state 0x0D (preparing to charge) and a newly discovered B3 sub-state 0x05 (waiting for timed start). This seems to be in addition to the previously discovered 0x02 sub-state, and I have still to see when/why one is used vs the other.

Regards, Mark.