diff --git a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/loop_uart_proto.c b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/loop_uart_proto.c
index 411491b..f4b1ac4 100644
--- a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/loop_uart_proto.c
+++ b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/loop_uart_proto.c
@@ -92,9 +92,11 @@ int lup_verify_checksum(const uint8_t *pkg, uint16_t len)
  */
 void lup_append_checksum(uint8_t *pkg)
 {
-    // pkg[0]=7F, pkg[1]=Addr, pkg[2]=LEN, pkg[3]=CMD, ...
-    uint8_t  total_len = 1 + 3 + pkg[2] + 2;   // Magic(1) + Header(3) + Value(LEN) + Check(2)
-    uint16_t check_len = 2 + pkg[2];             // Addr(1) + LEN_field(1) + Value(LEN)
+    // Frame: [Magic][Addr][LEN][Value(LEN bytes)][XOR][SUM]
+    // Total = 1 + 1 + 1 + LEN + 2 = 5 + LEN
+    //   (Addr + LEN_field are NOT inside Value; CMD is the 1st byte of Value)
+    uint8_t  total_len = 5 + pkg[2];              // Magic(1)+Addr(1)+LEN(1)+Value(LEN)+Check(2)
+    uint16_t check_len = 2 + pkg[2];              // Addr(1)+LEN_field(1)+Value(LEN)
 
     pkg[total_len - 2] = lup_calc_xor(pkg + 1, check_len);
     pkg[total_len - 1] = lup_calc_sum(pkg + 1, check_len);
@@ -248,7 +250,7 @@ uint16_t lup_build_sensor_ack(uint8_t *buf, uint8_t sens_type,
 {
     buf[0] = LUP_MAGIC;
     buf[1] = LUP_ADDR_DEFAULT;
-    buf[2] = 0x07;               // LEN = 7 (CMD + SensType + Seq + SubAmount)
+    buf[2] = 0x07;               // LEN = 7 (CMD + SensType + Seq + SubAmount + 3 padding)
     buf[3] = LUP_CMD_SENSOR_REPORT;
     buf[4] = sens_type;
     buf[5] = seq;
@@ -256,9 +258,8 @@ uint16_t lup_build_sensor_ack(uint8_t *buf, uint8_t sens_type,
     buf[7] = 0x00;               // padding
     buf[8] = 0x00;
     buf[9] = 0x00;
-    buf[10] = 0x00;
     lup_append_checksum(buf);
-    return 13;  // Magic(1)+Header(3)+Value(7)+Check(2)
+    return 5 + buf[2];           // = 12: Magic+Addr+LEN+Value(7)+Check(2)
 }
 
 /*===========================================================================