Reverse engineer 4-bit CRC in LG IR packet

Question

I am reverse engineering IR protocol of LG air conditioner. AC generally send the whole current state of remote on each key press. Data sent is 28 bits long, last 4 bits seem to be the checksum. I have already tried reveng, but without luck.

Bits 14-16 are mode of operation (heat/cool/fan/auto). Bits 17-20 are temperature + 15 degrees, bits 22-24 are fan speed and bits 25-28 seem to be 4-bit checksum.

Here are sample values:

100010000000100001000101 0001
100010000000100001010101 0010
100010000000100001100101 0011
100010000000100010000100 0100
100010000000100011000101 1001
100010000000100011010101 1010
100010000000100011110101 1100
100010000000000011000101 0001
100010001100000000000101 0001

In the last two, only the position of 11 changed, but checksum stayed the same. How is that checksum calculated?

Answer 1

This seems to be a checksum, just as you state in your question, not a CRC as mentioned in the header.

Group the values into blocks of 4 bits, add them, ignore overflow (in these examples, ignore overflow means subtract 32):

1000 1000 0000 1000 0100 0101  0001 8+8+0+8+4+5=33  1
1000 1000 0000 1000 0101 0101  0010 8+8+0+8+5+5=34  2
1000 1000 0000 1000 0110 0101  0011 8+8+0+8+6+5=35  3
1000 1000 0000 1000 1000 0100  0100 8+8+0+8+8+4=36  4
1000 1000 0000 1000 1100 0101  1001 8+8+0+8+12+5=41 9
1000 1000 0000 1000 1101 0101  1010 8+8+0+8+13+5=42 10
1000 1000 0000 1000 1111 0101  1100 8+8+0+8+15+5=44 12
1000 1000 0000 0000 1100 0101  0001 8+8+0+0+12+5=33 1
1000 1000 1100 0000 0000 0101  0001 8+8+12+0+0+5=33 1