LC79D(A) LTO download: final CRC check always returns LTO_NACK (0xDD), firmware LC79DANR01A05S

IoT Modules GNSS Module
1

We’re implementing AGNSS LTO injection on the LC79D(A), following Quectel_LC79D(A)_AGNSS_Application_Note_V1.0, section 2.2.2. Every step succeeds except the final CRC verification, which always returns LTO_NACK.

Module: $PQVER,MODULE_LC79DANR01A05S,2020/12/07,09:25:14. The host UART runs at 115200 8N1, through an NXP SC16IS760 SPI-to-UART bridge.

Sequence (from our logs):

  1. $PQLTODOWNLOAD → $PQLTODOWNLOADOK*46
  2. File info AA 01 01 08 6E 21 01 00 59 57 FB 68 DB 55 → CC
  3. Flash erase → CC
  4. Data in 16 KB chunks, last one shorter: each chunk → CC (5 of 5 for a 74,094-byte file, 12 of 12 for a 181,391-byte file)
  5. Final CRC verification → DD. It arrives about 1.2 s after the last chunk for the 74 KB file and about 2.8 s for the 181 KB file.

What we’ve ruled out:

  • The file. It fails both with an LTO file from our mirror of your AGNSS server and with the lto2_2day.dat bundled with QGNSS V1.10 (74,094 bytes).
  • The CRC computation. We calculate CRC-32 (IEEE, reflected, init 0xFFFFFFFF, final XOR 0xFFFFFFFF) over the 4-byte little-endian size followed by the whole file, as the app note describes. We also tried CRC over the data only, size appended at the end, big-endian size, JAMCRC, CRC-32/MPEG-2 and CRC-32/BZIP2. Every variant gets DD.
  • Transfer timing. Sending byte by byte or in 64-byte bursts, with 2.5 s between chunks, gives the same result.

Questions:

  1. What exactly is the CRC definition (polynomial, reflection, init and final XOR values, and which bytes it covers)? Could you give the CRC value for the bundled lto2_2day.dat so we can check ours?
  2. Can DD at the final step mean anything other than a CRC mismatch, for example expired LTO data, no valid time, or the engine state?
  3. Are there known LTO download problems with firmware LC79DANR01A05S? Is LC79DANR11A02S (or a later version) recommended, and what’s the field upgrade procedure over a two-wire UART?
  4. Are there any requirements before $PQLTODOWNLOAD that the app note doesn’t mention, such as a cold start, $PQSTOPGNSS, or an AP_REQ state?

We can send full UART logs and the exact bytes we transmit.