Memosense pH probe communication CRC reverse engeneering - arduino

Question

I need some help with CRC calculation. I spent a week trying to understand how a CRC (or Checksum) is calculated on a communication protocol
I have a Endress+Hauser pH probe (CPS11D-7FA21) that has MemoSense connector. Basically it is a digital pH probe. The communication is RS485 but the protocol is proprietary, so no info on that.
I connected the probe to a meter and sniffed the frames. There is a lot of data going back and fourth in the beginning but the polling repeats.
I was able to write some code for an Arduino and it worked, I can initialize the probe and pool measurements (ph(mV) and temperature), but the problem is that it only work with one probe. If I connect a new one it all stops.
I was digging a bit and I found out that right before the pooling starts the Init frame is different... Ii seem the measuring device somehow calculates the Init data from some other data that is exchanged in the beginning.
Anyway the fist thing is that I want to understand how the data frame is constructed.
Here is an example of pooling one of the probes and the data changes slightly
0x01, 0x01, 0x00, 0x00, 0x00, 0x2e, 0x04, 0x03, 0x09, 0x00, 0x20, 0xb9
0x01, 0x01, 0x00, 0x00, 0x00, 0x2f, 0x04, 0x03, 0x09, 0x00, 0x21, 0x99
0x01, 0x01, 0x00, 0x00, 0x00, 0x30, 0x04, 0x03, 0x09, 0x00, 0x3e, 0x7a
0x01, 0x01, 0x00, 0x00, 0x00, 0x32, 0x04, 0x03, 0x09, 0x00, 0x3c, 0x3a
0x01, 0x01, 0x00, 0x00, 0x00, 0x33, 0x04, 0x03, 0x09, 0x00, 0x3d, 0x1a
| <-------------------> | \ / \ / | | |
Header pH(mV)/10 Temp/100 ? Csum CRC???
0x01, 0x01, 0x00, 0x00, 0x00, 0x8d, 0x06, 0xf4, 0x08, 0x00, 0x77, 0x56
0x01, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x06, 0xf4, 0x08, 0x00, 0x75, 0x16
0x01, 0x01, 0x00, 0x00, 0x00, 0x88, 0x06, 0xf4, 0x08, 0x00, 0x72, 0xf6
0x01, 0x01, 0x00, 0x00, 0x00, 0x94, 0x06, 0xf5, 0x08, 0x00, 0x6f, 0x7d
0x01, 0x09, 0x04, 0x00, 0x0c, 0x00, 0x14, 0x02, 0x03, 0x11, 0x36, 0x66, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x20, 0x20, 0x20, 0x20, 0x46, 0x57
0x01, 0x09, 0x04, 0x00, 0x0c, 0x00, 0x15, 0x07, 0x17, 0x12, 0x26, 0x66, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x20, 0x20, 0x20, 0x20, 0x45, 0xb0
0x01, 0x00, 0x04, 0x00, 0x05, 0xa8, 0x4b, 0x53, 0x47, 0x31, 0x20, 0x01, 0x01, 0x01, 0x5a, 0x02, 0x9f, 0x27, 0x40, 0x39, 0x3f, 0x04, 0x52, 0x31, 0x32, 0x38, 0x44, 0x46, 0x30, 0x35, 0x42, 0x30, 0x33, 0x14, 0x01, 0x16, 0x00, 0x69, 0x00
0x01, 0x00, 0x04, 0x00, 0x05, 0xa8, 0x4b, 0x53, 0x47, 0x31, 0x20, 0x01, 0x01, 0x01, 0x01, 0x00, 0x75, 0x27, 0x41, 0xb8, 0x41, 0x04, 0x53, 0x36, 0x33, 0x37, 0x45, 0x44, 0x30, 0x35, 0x42, 0x30, 0x37, 0x15, 0x07, 0x06, 0x00, 0x3c, 0xf3
0x01, 0x08, 0x04, 0x00, 0x0d, 0xb0, 0xe5, 0x69, 0x1b, 0x00, 0x00, 0x69, 0x1b, 0x15, 0x07, 0x17, 0x12, 0x26, 0x02, 0x44, 0x1b, 0xaa, 0x0f, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x66, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x20, 0x20, 0x20, 0x20, 0xe9, 0xcd
0x01, 0x08, 0x04, 0x00, 0x0d, 0x40, 0xe7, 0x58, 0x1b, 0x00, 0x00, 0x67, 0x1b, 0x14, 0x02, 0x03, 0x11, 0x36, 0x02, 0x44, 0x1b, 0xaa, 0x0f, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x66, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x20, 0x20, 0x20, 0x20, 0x27, 0xde
Here is what I learned so far, the Csum is a standard 8bit Xor checksum
that works here
https://www.scadacore.com/tools/programming-calculators/online-checksum-calculator/
But the CRC is a mystery for me ... I tried multiple calculator and different data pieces and nothing. To me it seems it is a CRC because the if one bit changes there is a huge difference in the CRC byte
Maybe someone here could shed some light on this
Thank you

Answer 1

The last byte appears to be an exclusive-or and rotate check on the non-header bytes. If the message with check values is the unsigned char array a[0..len-1], then this computes the last two check values, x == a[len - 2] and y == a[len - 1]:
unsigned x = 0, y = 0;
for (size_t i = 0; i < len - 2; i++)
x ^= a[i];
for (size_t i = 5; i < len - 2; i++) {
y = (y ^ a[i]) << 1;
if (y & 0x100)
y ^= 0x101;
}