Computer Interfacing
Discussions about interfacing and electronics

Unable to detect CRC algorithm

Trying to decode Adax/Glamox home automation telegram


       Computer Interfacing Forum Index -> Error detection and correction
Author Message
New User

Joined: 23 Sep 2014
Posts: 1
Location: Norway

Sep 23, 2014 8:32 am


I'd like to ask for Your help on a CRC matter.

I am trying to decode a CRC for a telegram between an Adax CT5000 Symphony base, and a panel oven. The system can also control relays. The ovens are my primary interest.

I have tried some of the algorithms that I could Google up, but no success.

After discovering RevEng, I thought I'd solve the CRC, but still no success.

Here are a few examples :
#1 : 00000100,00001001,00011010,00001111,00001010,00001010,00000010,01110000,Telegram OK (4)(9)(26)(15)(10)(10)(2)(112)
04,09,1a,0f,0a,0a,02,70 (Hexadecimal, CRC = 70)

#2 : 00000100,00001001,00011010,00001111,00001111,00001111,00000010,11010110,Telegram OK (4)(9)(26)(15)(15)(15)(2)(214)
04,09,1a,0f,0f,0f,02,D6 (Hexadecimal, CRC = D6)

#3 : 00000100,00001001,00011010,00010000,00001111,00001111,00000010,11100100,Telegram OK (4)(9)(26)(16)(15)(15)(2)(228)
04,09,1a,10,0f,0f,02,e4 (Hexadecimal, CRC = E4)

#4 : 00000100,00001001,00011010,00001111,00010101,00010101,00000010,10001010,Telegram OK (4)(9)(26)(15)(21)(21)(2)(138)
04,09,1a,0f,15,15,02,8a (Hexadecimal, CRC = 8A)

#5 : 00000100,00001001,00011010,00001111,00010100,00010100,00000010,01101000,Telegram OK (4)(9)(26)(15)(20)(20)(2)(104)
04,09,1a,0f,14,14,02,68 (Hexadecimal, CRC = 68)

The telegram is sent over 433,92MHz RF, and Manchester decoded. Bytes 1, 2, 3(04,09,1a) and byte 7(02) are static. Byte 4 defines the receiving zone (1-16) and byte 5 and 6 gives the temperature. Byte 8 is the CRC.

The Manchester decoding gives the correct temperature, so I'm confident the Manchester decoding is good.

When I run them through 'reveng', the following comes up :

reveng -w 8 -s 04091a0f14140268 04091a0f1515028a 04091a0f0a0a0270
reveng: no models found

reveng -w 8 -s 6804091a0f141402 8a04091a0f151502
width=8 poly=0x53 init=0x16 refin=false refout=false xorout=0x00 check=0xa8 name=(none)
width=8 poly=0x5d init=0x99 refin=false refout=false xorout=0x00 check=0x80 name=(none)
width=8 poly=0x8f init=0xca refin=false refout=false xorout=0x00 check=0x1a name=(none)
width=8 poly=0x91 init=0x53 refin=false refout=false xorout=0x00 check=0x25 name=(none)
width=8 poly=0xad init=0xa3 refin=false refout=false xorout=0x00 check=0x3e name=(none)
width=8 poly=0xb7 init=0x5d refin=false refout=false xorout=0x00 check=0xf4 name=(none)
width=8 poly=0xcf init=0x0b refin=false refout=false xorout=0x00 check=0x64 name=(none)

reveng -w 8 -s 6804091a0f141402 8a04091a0f151502 7004091a0f0a0a02
width=8 poly=0xb7 init=0x5d refin=false refout=false xorout=0x00 check=0xf4 name=(none)

reveng -w 8 -s 6804091a0f141402 8a04091a0f151502 7004091a0f0a0a02 d604091a0f0f0f0f02 e404091a100f0f02
reveng: no models found

I tried other combinations, but the closest I came to a common decoding was poly=0xb7 and init=0x5d, but a test does not produce a correct CRC :
reveng -c -w 8 -p b7 -i 5d 04091a0f0f0f02, which returns 0x6a. Should be 0xd6.

If You could take a look at this, I'd be very grateful.

Thank You.

(A few edits to remove some input mistakes)
New User

Joined: 08 Jan 2015
Posts: 1

Jan 08, 2015 6:09 pm


i am working on a similar project with another kind of wireless sensor. i wondered if you solved your problem. I also have no luck in using reveng to figure out a single byte CRC.


       Computer Interfacing Forum Index -> Error detection and correction
Page 1 of 1

Running on php BB © 2001, 2009 php BB Group
   Lammert Bies     Interfacing     Sitemap     Forum