Reverse engineer checksum algorithm

Question

I am trying to reverse-engineer the protocol used between my Air-conditioner and the wired control unit on my wall. (In order to have my home automation be able to monitor and control the A/C.)

The electrical interface is simple open-collector bus with either end sending bytes using 100-baud UART timing (very slow, probably to tolerate electrical noise on this un-balanced bus).

I have captured communication between the two ends, and found that they always send 13-byte packets, of which the last byte seems to be some sort of checksum. I am confident that I can figure out where in the 12-byte payload to find the temperature setpoint, on/off bits, etc. However, I cannot figure out how the checksum is calculated, and if I do not get that right, then I will not be able to inject commands to the A/C unit (other than re-playing known commands, which could work, but would not give me the satisfaction of complete reverse engineering.)

Below, I have copied the packets that I have captured so far. It is clear that the checksum is not a CRC, since often one bit flip in the data results in only one or a few adjacent bits in the checksum being flipped.

Studying how the checksum changes as the 8th byte is incremented reveals a clear pattern of differences: -1 +3 -1 -5 -1 +3 -1 -21 -1 +3 -1 -5 -1... The above sequence is part of what is generated by the formula y = (x & 0xAA) - (x & 0x55), so I think that it would somehow form part of the checksum algorithm.

I have not been able to figure out how overall to mix together the input bytes, though, which is why I ask the expert reverse engineers in this forum. Any observations are welcome, even if not a complete solution.

The air conditioner is Friedrich M09CJ, and the wall mounted "thermostat" DWC1 can interface with a number of other Friedrich air conditioners, so it is a reasonable guess that those would also use the same protocol.

The line numbers have been added later and do not belong to the data.

   1        A8 00 00 00 00 00 09 17 00 00 00 00 9D
   2        A8 00 00 00 00 00 09 18 00 00 00 00 9C
   3        A8 00 00 00 00 00 09 19 00 00 00 00 9F
   4        A8 00 00 00 00 00 09 1A 00 00 00 00 9E
   5        A8 00 00 00 00 00 09 1B 00 00 00 00 99
   6        A8 00 00 00 00 00 09 1C 00 00 00 00 98
   7        A8 00 00 00 00 00 09 1D 00 00 00 00 9B
   8        A8 00 00 00 00 00 09 1E 00 00 00 00 9A
   9        A8 00 00 00 00 00 09 1F 00 00 00 00 85
  10        A8 00 00 00 00 00 09 20 00 00 00 00 84
  11        A8 00 00 00 00 00 09 20 00 00 40 00 44
  12        A8 00 00 00 00 00 09 21 00 00 00 00 87
  13        A8 00 00 00 00 00 09 22 00 00 00 00 86
  14        A8 00 00 00 00 00 09 23 00 00 00 00 81
  15        A8 00 00 00 00 00 09 23 00 00 40 00 41
  16        A8 00 00 00 00 00 09 24 00 00 00 00 80
  17        A8 01 00 00 00 00 09 23 40 00 80 00 C0
  18        A8 01 00 00 00 00 09 24 40 00 80 00 C3
  19        A8 02 00 00 00 00 09 1E 00 00 00 00 84
  20        A8 02 00 00 00 00 09 20 00 00 00 00 86
  21        A8 02 00 00 00 04 05 1E 00 00 00 00 84
  22        A8 02 00 00 00 04 07 1F 00 00 00 00 81
  23        A8 02 00 00 00 04 09 1F 00 00 00 00 83
  24        A8 02 00 00 00 04 09 20 00 00 00 00 82
  25        A8 02 00 00 00 04 0A 20 00 00 00 00 8D
  26        A8 02 00 00 00 04 0E 1F 00 00 00 00 8E
  27        A8 02 00 00 00 04 0E 20 00 00 00 00 89
  28        A8 03 00 00 00 00 09 20 00 00 00 00 81
  29        A8 03 00 00 00 00 0A 20 00 00 00 00 80
  30        A8 03 00 00 00 00 0B 20 00 00 00 00 83
  31        A8 41 00 00 00 00 01 00 40 00 80 00 FF
  32        A8 41 00 00 00 00 01 1F 40 00 80 00 9C
  33        A8 42 00 00 00 00 09 1F 00 00 00 00 47
  34        A8 60 40 00 00 00 09 1F 00 00 00 00 25
  35        A8 60 40 00 00 00 09 20 00 00 00 00 24
  36        A8 60 40 00 00 00 09 21 00 00 00 00 27
  37        A8 60 40 00 00 00 09 22 00 00 00 00 26
  38        A8 60 40 00 00 00 09 23 00 00 00 00 21
  39        A8 62 00 00 00 00 09 1F 00 00 00 00 67
  40        A8 62 00 00 00 00 09 20 00 00 00 00 66
  41        A8 62 40 00 00 00 09 20 00 00 00 00 26
  42        A8 62 40 00 00 00 09 21 00 00 00 00 21
  43        A8 62 40 00 00 04 09 1D 00 00 00 00 21
  44        A8 62 40 00 00 04 09 1E 00 00 00 00 20
  45        A8 62 40 00 00 04 09 1F 00 00 00 00 23
  46        A8 62 40 00 00 04 09 20 00 00 00 00 22
  47        A8 62 40 00 00 04 09 21 00 00 00 00 2D
  48        C8 00 00 00 00 00 09 17 00 00 00 00 BD
  49        C8 00 00 00 00 00 09 18 00 00 00 00 BC
  50        C8 00 00 00 00 00 09 19 00 00 00 00 BF
  51        C8 00 00 00 00 00 09 1A 00 00 00 00 BE
  52        C8 00 00 00 00 00 09 1B 00 00 00 00 B9
  53        C8 00 00 00 00 00 09 1D 00 00 00 00 BB
  54        C8 00 00 00 00 00 09 1E 00 00 00 00 BA
  55        C8 00 00 00 00 00 09 1F 00 00 00 00 A5
  56        C8 00 00 00 00 00 09 20 00 00 00 00 A4
  57        C8 00 00 00 00 00 09 21 00 00 00 00 A7
  58        C8 00 00 00 00 00 09 21 00 00 40 00 67
  59        C8 00 00 00 00 00 09 22 00 00 00 00 A6
  60        C8 00 00 00 00 00 09 22 00 00 40 00 66
  61        C8 02 00 00 00 00 09 21 00 00 00 00 A1
  62        C8 02 00 00 00 04 09 20 00 00 00 00 A2
  63        C8 03 00 00 00 00 09 20 00 00 00 00 A1
  64        C8 03 00 00 00 00 09 21 00 00 00 00 A0
  65        C8 03 00 00 00 00 09 22 00 00 00 00 A3
  66        C8 03 00 00 00 00 0A 20 00 00 00 00 A0
  67        C8 03 00 00 00 00 0A 21 00 00 00 00 A3
  68        C8 03 00 00 00 00 0A 22 00 00 00 00 A2
  69        C8 03 00 00 00 00 0C 20 00 00 00 00 A2
  70        C8 03 00 00 00 00 0C 21 00 00 00 00 AD
  71        C8 03 00 00 00 00 0D 21 00 00 00 00 AC
  72        C8 03 00 00 00 00 0E 21 00 00 00 00 AF
  73        C8 03 00 00 00 00 0F 20 00 00 00 00 AF
  74        C8 03 00 00 00 00 0F 21 00 00 00 00 AE
  75        C8 03 00 00 00 04 03 20 00 00 00 00 A7
  76        C8 03 00 00 00 04 04 20 00 00 00 00 A6
  77        C8 03 00 00 00 04 05 20 00 00 00 00 A1
  78        C8 03 00 00 00 04 06 20 00 00 00 00 A0
  79        C8 03 00 00 00 04 07 20 00 00 00 00 A3
  80        C8 03 00 00 00 04 08 20 00 00 00 00 A2
  81        C8 03 00 00 00 04 09 20 00 00 00 00 AD
  82        C8 03 00 00 00 04 09 21 00 00 00 00 AC
  83        C8 03 00 00 00 04 0A 20 00 00 00 00 AC
  84        C8 03 00 00 00 04 0A 22 00 00 00 00 AE
  85        C8 03 00 00 00 04 0B 20 00 00 00 00 AF
  86        C8 03 00 00 00 04 0B 22 00 00 00 00 A9
  87        C8 03 00 00 00 04 0C 20 00 00 00 00 AE
  88        C8 03 00 00 00 04 0C 22 00 00 00 00 A8
  89        C8 03 00 00 00 04 0D 20 00 00 00 00 A9
  90        C8 03 00 00 00 04 0D 22 00 00 00 00 AB
  91        C8 03 00 00 00 04 0E 20 00 00 00 00 A8
  92        C8 03 00 00 00 04 0E 22 00 00 00 00 AA
  93        C8 03 00 00 00 04 0F 20 00 00 00 00 AB
  94        C8 03 00 00 00 04 0F 21 00 00 00 00 AA
  95        C8 03 00 00 00 04 0F 22 00 00 00 00 55
  96        C8 03 80 00 00 00 09 20 00 00 00 00 21
  97        C8 23 00 00 00 00 09 1F 00 00 00 00 46
  98        C8 23 00 00 00 00 09 20 00 00 00 00 41
  99        C8 43 00 00 00 00 09 1F 00 00 00 00 66
 100        C8 43 00 00 00 00 09 20 00 00 00 00 61
 101        C8 60 40 00 00 00 09 1B 00 00 00 00 D9
 102        C8 60 40 00 00 00 09 1C 00 00 00 00 D8
 103        C8 60 40 00 00 00 09 1D 00 00 00 00 DB
 104        C8 60 40 00 00 00 09 1E 00 00 00 00 DA
 105        C8 62 40 00 00 04 09 1E 00 00 00 00 C0
 106        C8 62 40 00 00 04 09 1F 00 00 00 00 C3
 107        C8 63 00 00 00 00 09 1F 00 00 00 00 06
 108        C8 63 00 00 00 00 09 20 00 00 00 00 01
 109        C8 63 40 00 00 00 09 1F 00 00 00 00 C6
 110        C8 63 40 00 00 04 09 1F 00 00 00 00 C2
 111        C9 C4 D0 1F 80 31 00 40 02 00 00 00 3A
 112        CA 00 00 00 00 00 00 00 00 02 F1 21 8B
 113        CB 00 00 FF FF 70 00 00 00 00 00 00 6C
 114        CB 00 00 FF FF 7C 00 00 00 00 00 00 10
 115        CB 00 00 FF FF 7D 00 00 00 00 00 00 13

Answer 1

You seem to have the same air conditioner like the guy who asked this question. Add up bytes 0-11, xor with 0x55 to get byte 12.

It could help if you stated the brand and model number of your AC unit, that makes it easier for other people who want to do the same thing.