# Reverse engineer 4-bit CRC in LG IR packet

I am reverse engineering IR protocol of LG air conditioner. AC generally send the whole current state of remote on each key press. Data sent is 28 bits long, last 4 bits seem to be the checksum. I have already tried `reveng`, but without luck.

Bits 14-16 are mode of operation (heat/cool/fan/auto). Bits 17-20 are temperature + 15 degrees, bits 22-24 are fan speed and bits 25-28 seem to be 4-bit checksum.

Here are sample values:

``````100010000000100001000101 0001
100010000000100001010101 0010
100010000000100001100101 0011
100010000000100010000100 0100
100010000000100011000101 1001
100010000000100011010101 1010
100010000000100011110101 1100
100010000000000011000101 0001
100010001100000000000101 0001
``````

In the last two, only the position of `11` changed, but checksum stayed the same. How is that checksum calculated?

• Please take a look a link, it should help in your reverse engineering Apr 16, 2018 at 23:15

This seems to be a checksum, just as you state in your question, not a CRC as mentioned in the header.

Group the values into blocks of 4 bits, add them, ignore overflow (in these examples, ignore overflow means subtract 32):

``````1000 1000 0000 1000 0100 0101  0001 8+8+0+8+4+5=33  1
1000 1000 0000 1000 0101 0101  0010 8+8+0+8+5+5=34  2
1000 1000 0000 1000 0110 0101  0011 8+8+0+8+6+5=35  3
1000 1000 0000 1000 1000 0100  0100 8+8+0+8+8+4=36  4
1000 1000 0000 1000 1100 0101  1001 8+8+0+8+12+5=41 9
1000 1000 0000 1000 1101 0101  1010 8+8+0+8+13+5=42 10
1000 1000 0000 1000 1111 0101  1100 8+8+0+8+15+5=44 12
1000 1000 0000 0000 1100 0101  0001 8+8+0+0+12+5=33 1
1000 1000 1100 0000 0000 0101  0001 8+8+12+0+0+5=33 1
``````