0

I am reverse engineering IR protocol of Daikin A/C. AC sends the whole current state of remote on each key press. Data sent is 8 byte long, last 4 bits seem to be the some kind of error checking. First byte never changes, it's always 01101000!

Here is the samples:

Time/Minutes changes in 3d byte (time 12:00am from 00 minutes to 10 minutes) (button On/off, it's 8th byte first bit before checksum):

01101000 01000100 00000000 00000000 00000000 00000000 00000100 001 1 1001
01101000 01000100 10000000 00000000 00000000 00000000 00000100 001 1 0101
01101000 01000100 01000000 00000000 00000000 00000000 00000100 001 1 1101
01101000 01000100 11000000 00000000 00000000 00000000 00000100 001 1 0011
01101000 01000100 00100000 00000000 00000000 00000000 00000100 001 1 1011 
01101000 01000100 10100000 00000000 00000000 00000000 00000100 001 1 0111 
01101000 01000100 01100000 00000000 00000000 00000000 00000100 001 1 1111 
01101000 01000100 11100000 00000000 00000000 00000000 00000100 001 1 0000 
01101000 01000100 00010000 00000000 00000000 00000000 00000100 001 1 1000 
01101000 01000100 10010000 00000000 00000000 00000000 00000100 001 1 0100 
01101000 01000100 00001000 00000000 00000000 00000000 00000100 001 1 0101

Temp (7th byte) from 20 to 30 (time 12:00am): 

01101000 01000100 00000000 00000000 00000000 00000000 10000100 0010 0100 
01101000 01000100 00000000 00000000 00000000 00000000 01000100 0010 1100 
01101000 01000100 00000000 00000000 00000000 00000000 11000100 0010 0010 
01101000 01000100 00000000 00000000 00000000 00000000 00100100 0010 1010 
01101000 01000100 00000000 00000000 00000000 00000000 10100100 0010 0110 
01101000 01000100 00000000 00000000 00000000 00000000 01100100 0010 1110 
01101000 01000100 00000000 00000000 00000000 00000000 11100100 0010 0001 
01101000 01000100 00000000 00000000 00000000 00000000 00010100 0010 1001 
01101000 01000100 00000000 00000000 00000000 00000000 10010100 0010 0101 
01101000 01000100 00000000 00000000 00000000 00000000 00001100 0010 0100

Fan speed (2nd byte, last 4bits) from auto to 3 (time 12:00am): 

01101000 0100 1000 00000000 00000000 00000000 00000000 00001100 0010 1000 
01101000 0100 0001 00000000 00000000 00000000 00000000 00001100 0010 0001 
01101000 0100 0010 00000000 00000000 00000000 00000000 00001100 0010 0010 
01101000 0100 0100 00000000 00000000 00000000 00000000 00001100 0010 0100
Improve this question
5
  • and the question is...?
    – 0xec
    Commented Nov 15, 2016 at 14:52
  • determine CRC calculation....
    – Alex
    Commented Nov 28, 2016 at 9:18
  • What remote model is this? For most models (e.g ARC433), the checksum is the last byte, not just the last 4 bits. It's just the sum of all the previous bytes, modulo 0xff. For your codes, it looks similar (note that the checksum increased as the data values increase), however treating it as a simple sum isn't quite working here, perhaps your bit decoding is a little off?
    – BenB
    Commented Mar 6, 2017 at 3:26
  • You may want to add that to question section, are you analysing binary file or network traffic? It will be better if you use relevant tags.
    – Kerim Can Kalıpcıoğlu
    Commented Nov 27, 2017 at 12:49
  • I am curious as to whether you found a solution to this problem. I am facing a very similar problem. And indeed the readings I have taken from the A/C remote are very similar to yours. It appears both our A/C remotes are "speaking" the same protocol. BTW, I tried running the answer given above against my numbers and not only do I not understand what is going on but I also think it doesn't work. ``` 0110 1000 0100 1000 1001 0000 0100 0100 1100 0110 1000 0000 0110 1000 0010 0011 :ModeCool 0110 1000 1000 1000 1001 0000 0100 0100 1100 0110 1000 0000 0110 1000 0010 1101 :ModeDry 0110 1000 0010 0001
    – A. B. Al-Idrus
    Commented Aug 8, 2019 at 13:51

1 Answer 1

Reset to default
2

Not sure why my last question was deleted.. anyway here is the answer - the bit order of the sum at the end is reversed..

uint8_t rev(uint8_t b) {
   b = (b & 0xF0) >> 4 | (b & 0x0F) << 4;
   b = (b & 0xCC) >> 2 | (b & 0x33) << 2;
   b = (b & 0xAA) >> 1 | (b & 0x55) << 1;
   return b;
}

int main() {
  uint8_t test2[] = { 0x68,0x44,0x1C,0xC8,0x88,0x08,0x04,0x2C };

  uint8_t total=rev(test2[7]) & (uint8_t)0xF;
  for (uint8_t i=0; i<7; i++) {
    total += (uint8_t)rev(test2[i]) & (uint8_t)0xf;
    total += (uint8_t)rev(test2[i]) >> 4;
  }
  printf("total sum: %d\n",total);
  printf("calc mask: %d\n",total & (uint8_t)0xF);
  printf("supplied mask: %d\n",rev(test2[7]) >> 4);
}
Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.