Identifying 6-bit CRC Polynomial + Seed - Page 1
Forum section: electronics / beginners

author: pman92
author_rank: Contributor
timestamp: May 22, 2023, 11:15:35 am
content: Hey guys,I'm trying to identify a 6-bit CRC calculation (poly + seed value)It's from the slow-channel data from a dual 12-bit pressure sensor that communicates by the SENT J2716 protocol.There is no datasheet available for this sensor, it is part of an OEM ford part. But after some research it appears very very VERY similar to the Infineon KP276A1201 pressure/temperature sensor:https://www.infineon.com/cms/en/product/sensor/pressure-sensors/barometric-bap-manifold-map-sensors/kp276a1201/That sensor has a 12 bit pressure and 12 bit temperature output, where as this one has 2x 12-bit pressure. Similarities include:-The use of the same 3us tick time-Same fast channel nibble order (MSN, MidN, LSN, LSN, Mid, MSN)-Same J2716 "recommended" 4-bit CRC for the fast channel data-Same "enhanced serial message format" (see 1.6.2.3 of KP276A1201 datasheet in link above) - AKA slow channel data-A similar number of "enhanced serial message format" messages (see 1.6.2.4), most of which are using the same message ID's1.6.2.3 - Figure 10 in the above linked datasheet shows how the slow channel data (or "enhanced serial message format" as they call it) is encoded within bit 2 and 3 of the status/communication nibble. It takes 18 consecutive fast channel messages to transfer all the bits for a single slow channel message, which consists of an 8-bit message ID, 12-bits data, and 6-bit CRC.My problem lies with trying to calculate that CRC. Or work out how it is calculated. It is not explained in that datasheet, and I'm not sure if its for the 12 data bits only / 12 data and 8 ID bits / or all 24 bits including the constant zero bits.I found another Infineon datasheet which uses a 6-bit CRC, and talks about using a polynomial of "x6 + x + 1" and a seed value of "010101". However running that calculation on the sample values doesn't seem to work for me.Below is a bunch of the messages (8bit ID, 12bit Data + 6bit CRC) I have sampled from the sensor:Code:IDDATACRC010001B1031A021030906030061904001310500532060030D0700021084630109226310AFD2020B000220C463240D226140EFD2272931C2F2AAF1012B1EC3B2C1932C90B2D2D91853299254D28934AC22944102B9584D17961E31C9700035Where do I even begin trying to work out what the CRC function is?Thanks in advance

author: RAPo
author_rank: Super Contributor
timestamp: May 22, 2023, 11:48:20 am
content: Tryhttps://reveng.sourceforge.io/

author: jmelson
author_rank: Super Contributor
timestamp: May 22, 2023, 03:34:33 pm
content: I had to decipher a 5-bit CRC from a Fanuc serial encoder. I assumed the CRC starts with zero, and a good CRC check returned the register to zero. I set up an FPGA device to record a bunch of data from the encoder while I spun the shaft.Then, I set up a c program to go through the recorded data and do the CRC decode in software. I can't seem to find the original test program that allowed you to enter the LFSR taps at the command line, but I do have a test program that runs a specific tap setup against the recorded data. You can see how I created the CRC function by shifting bits over and XORing them with the bit shifted out the end.Jon

author: Nominal Animal
author_rank: Super Contributor
timestamp: May 22, 2023, 05:45:19 pm
content: Brute-force it. There are only 32 possible polynomials (from \$x^6+1\$ to \$x^6+x^5+x^4+x^3+x^2+x^1+1\$) and 64 seed values (0 through 63), so 32×64=2048 choices.In your captures, the checksum for zero data differs for IDs 01, 07, 0B, so the ID is definitely included in the checksum calculation.What is not obvious, is whether the data is formed bitwise from the transmitted data, or from the transmitted values, nor if the data is padded somehow.My bet is, it is bitwise from the transmitted data in the transmission order (because I believe that would be the simplest way to implement it in hardware), and not based on the interpreted values per se.I would start with reconstructing the binary transmitted data for each message, then checking if any of the 2048 possible polynomials and seeds generate the correct checksums. If none do, then the checksum is not calculated bitwise from the transmitted data, and you need to find a way to regenerate the bit strings that do based on the messages you have captured.

author: pman92
author_rank: Contributor
timestamp: May 24, 2023, 12:04:32 pm
content: Thought this would be a good opportunity to use some python (I haven't used it much before), so after a lot of google search help I came up with the following:Code:import csv# 2D table of possible poly/seed combinations# 63 possible polys (columns) - 1000001 to 1111111 inclusive# 64 possible seeds (rows) - 000000 to 111111 inclusivepossible_CRC = [[True for i in range(63)] for j in range(64)]def CRCcalc( data, data_length, poly, seed, crc_length):crc = ( data << crc_length ) | seedshift = data_length + crc_lengthwhile shift >= crc_length:mask = 1 << shiftif mask & crc:crc = crc ^ ( poly << (shift - crc_length) )shift = shift - 1return crcdef generateBinaryString(first, second):binary = 0for i in range(12):firstBit = 1 & (first >> i)secondBit = 1 & (second >> i)binary = (binary << 2) | (firstBit << 1) | secondBitreturn binarydef processDataRow(row):ID = int(row, 16)Data = int(row, 16)actualCRC = int(row, 16)# mergedBinary = ((ID << 12) & 0xFF000) | (Data & 0xFFF) # <IDx8> <Datax12># mergedBinary = ((Data << 8) & 0xFFF00) | (ID & 0xFF) # <Datax12> <IDx8># mergedBinary = ((((ID & 0xF0) << 2) | ((ID & 0x0F) << 1)) << 12) | (Data & 0xFFF) # 00 <IDx4> 0 <IDx4> 0 <Datax12># mergedBinary = ((((ID & 0xF0) << 2) | ((ID & 0x0F) << 1))) | ((Data & 0xFFF) << 12) # <Datax12> 00 <IDx4> 0 <IDx4> 0# mergedBinary = generateBinaryString((((ID & 0xF0) << 2) | ((ID & 0x0F) << 1)), Data)# mergedBinary = generateBinaryString(Data, (((ID & 0xF0) << 2) | ((ID & 0x0F) << 1)))# mergedBinary = generateBinaryString(Data, ID)# mergedBinary = generateBinaryString(ID, Data)for poly in range(0b1000001, (0b1111111 + 1)):for seed in range(0b0000, (0b111111 + 1)):if actualCRC != CRCcalc(mergedBinary, (8 + 12), poly, seed, 6):#if actualCRC != CRCcalc(mergedBinary, (12 + 12), poly, seed, 6):possible_CRC[poly - 0b1000001] = Falsewith open("input.csv", "r") as file:reader = csv.reader(file, delimiter=',')index = 0print("Processing CSV file...")for row in reader:processDataRow(row)index = index + 1for seed in range(64):for poly in range(63):if possible_CRC == True:actualPoly = poly+0b1000001print(f"Possible Solution: Poly={actualPoly:b} Seed={seed:b}")print("End")However I haven't had any luck finding anything using the following CSV file:Code:01,000,1B10,318,2103,006,1904,001,3101,000,1B05,005,3206,003,0D07,000,2101,000,1B08,463,0109,226,310A,FD2,0201,000,1B0B,000,220C,463,240D,226,1401,000,1B10,309,060E,FD2,2729,31C,2F01,000,1B2A,AF1,012B,1EC,3B2C,193,2C01,000,1B90,B2D,2D91,853,2992,54D,2801,000,1B93,4AC,2294,410,2B95,84D,1701,000,1B10,308,3496,1E3,1C97,000,35So I will give reveng a go next I guess. If that doesn't work I will have to sit down and work out exactly what order it is transmitted in, and try that.

author: Old Printer
author_rank: Frequent Contributor
timestamp: May 24, 2023, 12:35:05 pm
content: A bit over my head, but I am picking up a little. To the OP - I love a guy who doesn't give up