View MRF24XAT-IMQ_8472506.PDF datasheet online --- IC-ON-LINE

Datasheet File OCR Text:

? 2015 microchip technology inc. preliminary ds70005023c-page 1 mrf24xa features ieee 802.15.4?-2003 and ieee 802.15.4-2006 standard compliant rf transceiver multiple air-data-rates: - 250 kbps (ieee 802.15.4) - 125, 500, 1000, 2000 kbps, co-existence with standard networks configurable tx output power: -19 to 1 dbm frame header duration scales with the selected data rate on-the-fly, per frame air-data-rate detection (link-by-link independent air-data-rates) inferred destination addressing (to further save on framing overheads; optional) full-featured mcu support hardware frame parser hardware csma-ca controller, automatic acknowledgment (ack) and frame check sequence (fcs) supports all clear channel assessment (cca) modes reports ed, rssi, lqi, and cfo channel agility with acknowledgments two independent 128 byte frame buffers streaming mode to maximize throughput automatic packet retransmit capability hardware security engine (aes-128) and configurable encryption/decryption mode low-power extreme minimization of radio on time - highest channel-admissible data rate used - 20%-70% overall reduction through framing 2 mbps frames can reduce radio on time by a factor of 4 to 8 with respect to 250 kbps frames 27.5 ma tx current (typical at 0 dbm) 13.5 ma rx current in rx listen power-saving mode 15.5-16.5 ma rx current in rx packet demodulation mode (data rate and device configuration dependent) deep sleep, sleep, crystal on, and rx listen power-saving modes memory retention in deep sleep mode (<40 na typi- cal) automated functions minimize mcu on time general low external component count best-in-class battery life preservation supply range: 1.5v to 3.6v compact 32-pin 5x5 mm 2 qfn package temperature range: -40 o c to +85 o c certified turnkey-ready solutions available applications ieee 802.15.4/zigbee ? systems (rf4ce and miwi tm network) industrial monitoring and control ieee 1588 precise timing protocol networks automatic meter reading home building automation low-power wireless sensor networks consumer electronics, voice and audio low-power, 2.4 ghz ism-band ieee 802.15.4? rf transceiver with extended proprietary features downloaded from: http:///
mrf24xa ds70005023c-page 2 preliminary ? 2015 microchip technology inc. pin diagram av dd rfout p rfout n av dd rfin p av ss 12 3 4 5 6 7 8 rfin n av dd vregout gpio2 gpio1 gpio0 9 10 11 12 13 14 1516 av ss rbias av dd av ss osc2 osc1 dv ddio dv dd 32 31 30 29 28 27 26 25 sdi sdo reset dv ss pa lna 2423 22 2120 1918 17 mrf24xa vregin av dd sck int cs av ss downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 3 mrf24xa table of contents 1.0 device overview .......................................................................................................................................................................... 5 2.0 hardware description................................................................................................................................................................... 7 3.0 functional description...................................................................................................... .......................................................... 71 4.0 general transceiver operations ................................................................................................................................................ 89 5.0 ieee 802.15.4? compliant frame format and frame processing .................................................................. ...................... 133 6.0 proprietary frame format and frame processing................................................................................................................... 169 7.0 advanced link behavior in proprietary packet mode .............................................................................................................. 189 8.0 bridging .................................................................................................................................................................................... 197 9.0 physical layer functions.................................................................................................... ....................................................... 199 10.0 battery life optimization .......................................................................................................................................................... 237 11.0 electrical characteristics .......................................................................................................................................................... 241 12.0 packaging information.............................................................................................................................................................. 245 appendix a: revision history............................................................................................................................................................. 249 the microchip web site ..................................................................................................................................................................... 251 customer change notification service .............................................................................................................................................. 251 customer support .............................................................................................................................................................................. 251 index ................................................................................................................................................................................................ 255 to our valued customers it is our intention to provide our valued customers with the best documentation possible to ensure successful use of your micro chip products. to this end, we will continue to improve our publicat ions to better suit your needs. our publications will be refined and enhanced as new volumes and updates are introduced. if you have any questions or comments regard ing this publication, please contact the marketing communications department via e-mail at docerrors@microchip.com or fax the reader response form in the back of this data sheet to (480) 792-4150. we welcome your feedback. most current data sheet to obtain the most up-to-date version of this data s heet, please register at our worldwide web site at: http://www.microchip.com you can determine the version of a data sheet by examining its literature number found on the bottom outside corner of any page . the last character of the literature number is the vers ion number, (e.g., ds30000a is version a of document ds30000). errata an errata sheet, describing minor operational differences from the data sheet and recommended workarounds, may exist for curren t devices. as device/documen tation issues become known to us, we will publish an errata sheet. the errata will specify the revisi on of silicon and revision of document to which it applies. to determine if an errata sheet exists for a partic ular device, please check with one of the following: microchips worldwide web site; http://www.microchip.com your local microchip sales office (see last page) when contacting a sales office, please spec ify which device, revision of silicon and dat a sheet (include literature number) you are using. customer notification system register on our web site at www.microchip.com to receive the most current information on all of our products. downloaded from: http:///
mrf24xa ds70005023c-page 4 preliminary ? 2015 microchip technology inc. notes: downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 5 mrf24xa 1.0 device overview mrf24xa is an ieee 802.1 5.4? standard compliant 2.4 ghz rf transceiver with feature extensions. mrf24xa integrates the phy and mac functionality in a single-chip solution. mrf24xa implements a low- cost, low-power, high data rate (125 kbps to 2 mbps) wireless personal area network (wpan) device. all the data rates contains the same spectral shape requiring identical bandwidth. at 125 kbps data rate direct sequence spread spectrum (dsss) is combined with error correction and coding for maximum range and robustness against interference. the 2 mbps data rate is used to minimize radio on time, therefore ext ending battery life. figure 1-1 illustrates a simplified block diagram of a mrf24xa wireless node. mrf24xa interfaces to many popular microchip pic ? microcontrollers through a 4-wire serial spi interface, inte rrupt, gpio, and reset pins. mrf24xa can also handle external power amplifier (pa) and low noise amplifier (lna). mrf24xa provides hardware support for: energy detection carrier sense four cca modes csma-ca algorithm automatic packet retransmission automatic acknowledgement independent transmit and receive buffers security engine supports encryption and decryption for mac sublayer and upper layer inferred destination addressing channel agility with acks battery monitoring these features reduce the processing load, allowing the use of low-cost 8-bit microcontrollers. mrf24xa is compatible with microchips zigbee ? , miwi? and miwi p2p software stacks. each software stack is available as a free download, including source code, from the microchip web site: http://www.microchip.com/wireless . figure 1-1: mrf24xa wire less node block diagram phy mac interface power management cs sdi sdosck int reset rfout p rfout n rfin p rfin n io sdo sdi sck intx io mrf24xa pic mcu matching network ? 16 mhz crystal antenna downloaded from: http:///
mrf24xa ds70005023c-page 6 preliminary ? 2015 microchip technology inc. notes: downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 7 mrf24xa 2.0 hardware description 2.1 overview mrf24xa is an ieee 802.15.4 standard compliant 2.4 ghz rf transceiver wit h extended feature set for longer battery life, hig her throughput and increased operating range. mrf24xa integrates the phy and mac functionality in a single-chip solution. figure 2-1 illustrates a block diagram of the mrf24xa circuitry. an external 16 mhz crystal clocks the frequency synthesizer and generates a 2.4 ghz frequency rf carrier. the receiver is a zero-if ar chitecture consisting of a low-noise amplifier, down conversion mixers, channel filters and baseband amplifiers with a received signal strength indicator (rssi). the transmitter is a direct conversion architecture with a 1 dbm maximum output (typical) and 20 db power control range. the internal transmitter and receiver circuits contains separate rfp and rfn input/output pins that connects to impedance matching circuitry (balun) and antenna. an external powe r amplifier or low noise amplifier, or both is controlled through the pa and lna pins. three general purpose input/output (gpio) pins are configurable for control or monitoring purposes. the power management circuitry consists of an integrated low dropout (ldo) voltage regulator and a 5-bit resolution battery monitor block. mrf24xa is placed into a low-current (<40 na typical) deep sleep mode. the media access controller (mac) circuitry can sequence the transmit, receive and automatically enable the security operations. the host mcu can control these mechanisms through register configurations and frame control (fctrl) field embedded in the downloaded formatted frames. three alternative frame formats are supported: ieee 802.15.4 2003, 2006 compliant mac frame formats and a flexible and power-efficient advanced mac frame format, which is proprietary. before launching transmission, the host must load the buffer with a formatted frame. the hardware can optionally perform encryption and message integrity code appending as configured, then sends the frame appending a frame check sequence (fcs). hardware can autonomously sequence acknowledge reception and automatic retransmissions. in reception, the format of the demodulated frame is verified. depending on the configuration, duplicate frames, frames with co rrupted fcs or address mismatch are discarded. on reception of valid frames, automatic acknowledge sending, decryption and message integrity che cking are supported. as the default, separate buffers are reserved for transmission and reception. alternatively, either the transmit streaming (tx-st reaming) or the receive streaming (rx-streaming) modes are selected whereby buffers are used by alternating between the two for servicing a single direction of data flow. the aes-128 engine are governed to perform network- layer security processing and supports complete security suites such as ctr, cbc-mac and ccm*. transceiver is controlled through a 4-wire spi, interrupt and reset pins. 2.2 operating modes table 2-1 summarizes the operating modes of mrf24xa. table 2-1: mrf24xa power modes operating mode internal functional blocks 1.2v ldo crystal oscillator synthesizer rx front end rx baseband tx chain deep sleep off off off off off off sleep on off off off off off rfoff crystal on on on off off off off rfoff synthesizer on on on on off off off rx listen power-save on on on on off off rx listen on on on on on off tx on on on off off on downloaded from: http:///
mrf24xa ds70005023c-page 8 preliminary ? 2015 microchip technology inc. 2.3 block diagram figure 2-1: mrf24xa arch itecture block diagram downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 9 mrf24xa 2.4 pin descriptions table 2-2: mrf24xa pin descriptions pin symbol type description 1a v dd power 1.2v supply, normally connected to vregout (pin 29) 2r f o u t p ao differential rf output (+) 3r f o u t n ao differential rf output (C) 4a v dd power 1.2v supply, normally connected to vregout (pin 29) ( 1 ) 5r f i n p ai differential rf input (+) 6a v ss ground ground 7r f i n n ai differential rf input (C) 8a v dd power 1.2v supply, normally connected to vregout (pin 29) 9a v ss power ground ( 1 ) 10 gpio2 dio gpio2 11 gpio1 dio gpio1 12 gpio0 dio gpio0 13 int do interrupt output, active-low 14 cs di spi chip select pin, active-low 15 sck di spi serial clock 16 sdi di spi serial data input 17 sdo do spi serial data output 18 reset di reset input, active-low 19 dv ss ground digital ground 20 pa do external pa enable output 21 lna do external lna enable output 22 dv dd power digital 1.2v supply, normally connected to vregout (pin 29) 23 dv ddio power digital 1.5vC3.6v supply for the io blocks, normally connected to vregin (pin 30) 24 osc1 ai crystal oscillator pin 1, external clock input 25 osc2 ao crystal oscillator pin 2 26 av ss ground ground 27 av dd power 1.2v supply, normally connected to vregout (pin 29) 28 rbias ao external resistor reference pin 29 vregout power 1.2v regulated output 30 vregin power 1.5vC3.6v regulator input 31 av ss ground ground 32 av dd power 1.2v supply, normally connected to vregout (pin 29) legend: a = analog, d = digital, i = input, o = output note 1: in case pcb runs out of sp ace, disconnect these pins. downloaded from: http:///
mrf24xa ds70005023c-page 10 preliminary ? 2015 microchip technology inc. 2.4.1 power and ground pins ta b l e 2 - 3 lists the recommended bypass capacitors. v dd pins 29 and 30 are power pins, which require different bypass capacitors to ensure sufficient bypass decoupling and stability. bypass capacitors must have low serial resistance. the 4.7 f capacitors must be made of ceramic or high-performance tantalum. on pcb layout minimize trace length from the v dd pin to the bypass capacitors and connect capacitors to the pads as short as possible. pcb tracks must be wide enough to minimize voltage drop and serial inductance of the power line. analog and digital power lines must follow a star topol- ogy, where the common point is the bypass capacitor on pin 30. 2.4.2 16 mhz main oscillator pins the 16 mhz oscillator is connected to osc1 and osc2 pins as shown in figure 2-2 , which provides the reference frequency for the internal rf, mac and bb circuitry. table 2-4 lists the crystal parameters. to minimize parasitic effect s on pins, the crystal must be put as close as possible to mrf24xa. it keeps the tracks short. crystal must be surrounded with ground pour to minimize cross coupling effects. crystal load capacitors must be placed close to the crystal. figure 2-2: 16 mhz main oscillator crystal circuit table 2-3: recommended bypass capacitor values v dd pin symbol bypass capacitor 1a v dd 3.3 pf 29 vregout 4.7 f 30 vregin 10 nf + 4.7 f table 2-4: 16 mhz crystal parameters ( 1 ) parameters value frequency 16 mhz frequency tolerance for 500, 250 and 125 kbps data rates (including manufac- turing aging and temperature) 60 ppm ( 1 ) frequency tolerance for 2 and 1 mbps data rates (including manufacturing aging and temperature) 40 ppm ( 2 ) mode fundamental load capacitance 18 pf esr 80 ohm max note 1: ieee 802.15.4 def ines 40 ppm. 2: these values are only used for design guidance . 16 mhz main oscillator x1 cl1 cl2 osc1 osc2 downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 11 mrf24xa 2.4.3 reset (reset ) pin an external hardware reset is performed by asserting the reset pin 18 low. if the reset pin is deasserted, mrf24xa starts the internal calibration process. rdyif interrupt is set when the device is ready to use. the reset pin contains an internal weak pull-up resistor. 2.4.4 interrupt (int ) pin the interrupt (int ) pin 13 provides an interrupt signal to the host mcu from mrf24xa where the signal is active-low polarity. interrupt sources must be enabled and unmasked before the int pin becomes active. refer to section 3.2 interrupts for the functional description of interrupts. 2.4.5 general purpose input/ output (gpio) pins three gpio pins are configured individually for control or monitoring purposes. the trisgpiox bits in the gpio register (0x0d) configures t he input or output selection. gpio data is read or written through the gpio bits of gpio register. the gpio interrupt polarity is selected through gpioxp bits in the stgpio (0x0e) register. gpio lines in input mode ar e used in schmitt trigger input mode. stengpiox bits of stgpio register enables schmitt triggers. gpios are also used to monitor the internal blocks. the gpiomode bits <3:0> of the pincon (0x0c) register selects these monitoring functions. 2.4.6 serial peripheral interface (spi) port pins mrf24xa communicates with a host mcu through a 4-wire spi port as a slave device. mrf24xa supports spi mode 0,0, which requires that sck idles in a low state. the cs pin must be held low while communicat- ing with mrf24xa. figure 2-3 illustrates timing for a read and a write operation. mrf24xa receives the data through the sdi pin and clocks in on the rising edge of sck. mrf24xa sends data through the sdo pin and clocks out on the falling edge of sck. the sdo lines preserve its hiz state in deep sleep mode. downloaded from: http:///
mrf24xa ds70005023c-page 12 preliminary ? 2015 microchip technology inc. 2.5 application example figure 2-3 illustrates the schematic of a recommended application circuit for mrf24xa. figure 2-3: mrf24xa application circuit mosi miso sck ncs nreset nint gnd gnd gnd gnd gnd 1 x116mh exp 33 e x p rfavdd 1 rfoutp 2 rfoutn 3 rfavdd 4 rfinp 5 rfavss 6 rfinn 7 rfavdd 8 nc (gnd) 9 gpio2 10 gpio1 11 gpio0 12 int 13 cs 14 sck 15 sdi 16 sdo 17 reset 18 dvss 19 pa 20 lna 21 dvdd 22 dvddio 23 oscin 24 osco 25 avss 26 avdd 27 rbias 28 vregout 29 avss 31 avdd 32 vregin 30 ic1 mrf24xa-i/ml 50v0402 18pf c4 50v0402 18pf c5 6.3v 0402 4.7uf c1 6.3v 0402 4.7uf c2 50v0402 3.3pf c3 gnd gnd gnd +vcc 20k0402 1% r1 gnd gpio0 gpio1 gpio2 ant1 place close to pin#1 balun downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 13 mrf24xa 2.6 memory organization table 2-5 shows that memory is functionally divided into special function registers (sfr) and data buffers. the sfrs provide control, status and device configura- tion addressing for mrf24xa operations. data buffers serve as temporary buffers for data transmission and reception. memory is acce ssed through two addressing methods: short (1 byte) and long (2 bytes). 2.6.1 address overview mrf24xa contains two addressing modes: short address mode: requires one byte for address, and may be used to access the first 64 on-chip control registers. long address mode: requires two bytes for address, and may be used to access all on-chip registers and data buffers. figure 2-4 illustrates these modes. table 2-5: mrf24xa memory map system level mac phy tx and extdev mac phy data buffer 1 data buffer 2 reserved 0x00 ... 0x0f 0x39 0x3a ... 0x30 0x2f ... 0x10 0x3f ... 0x40 ... 0x600x70 0x2840x285 ... 0x200 0x1ff 0x2ff ... 0x385 0x384 0x300 0x3ff ...... short addressing long addressing retained in deep sleep pir4 (0x07) pie1 (0x08) reserved reserved ... downloaded from: http:///
mrf24xa ds70005023c-page 14 preliminary ? 2015 microchip technology inc. table 2-6: short address register summary for mrf24xa architecture address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 page system level 0x00 regrst r r regrst<5:0> 71 0x01 fsmrst r r rf s m r s t < 4 : 0 > 71 0x02 opstatus r macop<3:0> rfop<2:0> 18 0x03 status initdonesf xtalsf regsf calst xtaldis dsleep idlesf por 19 0x04 pir1 vregif r rdyif idleif r calsoif calhaif r 20 0x05 pir2 txif txencif txmaif txackif txcsmaif txszif txovfif frmif 21 0x06 pir3 rxif rxdecif rxtagif r rxidentif rxfltif rxovfif strmif 22 0x07 pir4 txsfdif rxsfdif errorif warnif edccaif gpio2if gpio1if gpio0if 23 0x08 pie1 r r rdyie idleie r calsoie calhaie r 24 0x09 pie2 txie txencie txmaie txackie txcsmaie txszie txovfie frmie 25 0x0a pie3 rxie rxdecie rxtagie r rxidentie rxfltie rxovfie strmie 26 0x0b pie4 txsfdie rxsfdie errorie warnie edccaie gpio2ie gpio1ie gpio0ie 27 0x0c pincon rg i e r irqif gpiomode<3:0> 28 0x0d gpio gpioen trisgpio2 trisgpio1 trisgpio0 r gpio2 gpio1 gpio0 29 0x0e stgpio r gpio2p gpio1p gpio0p r stengpio2 stengpio1 stengpio0 30 0x0f pullgpio r pulldirgpio2 pulldirgpio1 pulldirgpio0 r pullengpio2 pullengpio1 pullengpio0 31 mac 0x10 maccon1 trxmode<1:0> addrsz<2:0> crcsz frmfmt secflagovr 32 0x11 maccon2 channel<3:0> secsuite<3:0> 34 0x12 txcon txst dtsm txenc txbufempty csmaen dr<2:0> 35 0x13 rxackwait rxackwait<7:0> 37 0x14 retxcount retxmcnt<3:0> retxccnt<3:0> 37 0x15 rxcon1 rxen nopa rxdec rxvlqien rsvrssien rsvchdren rsvcfoen r 38 0x16 rxcon2 rxbufful identrej ackrxfp acktxfp autorpten autoacken adptchen adptdren 39 0x17 txackto txackto<7:0> 41 0x18 rxfilter pancrdn crcrej cmdrej datarej unirej notmerej bcrej nstdrej 42 0x19 tmrcon bomcnt<2:0> basetm<4:0> 44 0x1a csmabe maxbe<3:0> minbe<3:0> 45 0x1b bounit bounit<7:0> 46 0x1c strmtol strmto<7:0> 46 0x1d strmtoh strmto<15:8> 46 0x1e offtm offtm<7:0> 47 legend: r = reserved, read as 0 . downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 15 mrf24xa 0x1f addr1 addr<7:0> 48 0x20 addr2 addr<15:8> 48 0x21 addr3 addr<23:16> 48 0x22 addr4 addr<31:24> 48 0x23 addr5 addr<39:32> 48 0x24 addr6 addr<47:40> 48 0x25 addr7 addr<55:48> 48 0x26 addr8 addr<63:56> 48 0x27 shaddrl shaddr<7:0> 49 0x28 shaddrh shaddr<15:8> 49 0x29 panidl panid<7:0> 49 0x2a panidh panid<15:8> 49 0x2b sechdrindx r sechdrindx<6:0> 50 0x2c secpayindx r secpayindx<6:0> 50 0x2d secendindx r secendindx<6:0> 51 0x2e macdebug buf1txpp buf2txpp buf1rxpp buf2rxpp txrdbuf rxwrbuf busrdbuf buswrbuf 52 phy 0x2f ccacon1 ccabusy ccast rssithr<5:0> 53 0x30 ccacon2 csthr<3:0> ccalen<1:0> ccamode<1:0> 53 0x31 edcon r r edmode edst edlen<3:0> 54 0x32 edmean edmean<7:0> 54 0x33 edpeak edpeak<7:0> 55 0x34 cfocon cfotx<3:0> cforx<3:0> 55 0x35 cfomeas cfomeas<7:0> 56 0x36 ratecon dis2000 dis1000 dis500 dis250 disstd dis125 optimal psav 57 0x37 powsave desensthr<3:0> psavthr<3:0> 58 0x38 bbcon rndmod afcovr rxgain<1:0> prmbhold prmbsz<2:0> 59 0x39 ifgap r r ri f g a p < 4 : 0 > 60 tx and extdev 0x3a txpow chipboost<2:0> txpow<4:0> 60 0x3b tx2idle r r r tx2idle<4:0> 61 0x3c tx2txma r r rt x 2 t x m a < 4 : 0 > 61 0x3d extpa r extpa_p paen pa2txma<4:0> 62 0x3e extlna r extlna_p lnaen lnadly<4:0> 62 0x3f batmon r r batmonpd batmon<4:0> 63 legend: r = reserved, read as 0 . table 2-6: short address register summary for mrf24xa (continued) architecture address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 page downloaded from: http:///
mrf24xa ds70005023c-page 16 preliminary ? 2015 microchip technology inc. table 2-7: long address register summary for mrf24xa address name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 page mac 0x40 seckey1 seckey<7:0> 63 0x41 seckey2 seckey<15:8> 63 0x42 seckey3 seckey<23:16> 63 0x43 seckey4 seckey<31:24> 63 0x44 seckey5 seckey<39:32> 63 0x45 seckey6 seckey<47:40> 63 0x46 seckey7 seckey<55:48> 63 0x47 seckey8 seckey<63:56> 63 0x48 seckey9 seckey<71:64> 63 0x49 seckey10 seckey<79:72> 63 0x4a seckey11 seckey<87:80> 63 0x4b seckey12 seckey<95:88> 63 0x4c seckey13 seckey<103:96> 63 0x4d seckey14 seckey111:104> 63 0x4e seckey15 seckey<119:112> 63 0x4f seckey16 seckey<127:120> 63 0x50 secnonce1 secnonce<7:0> 65 0x51 secnonce2 secnonce<15:8> 65 0x52 secnonce3 secnonce<23:16> 65 0x53 secnonce4 secnonce<31:24> 65 0x54 secnonce5 secnonce<39:32> 65 0x55 secnonce6 secnonce<47:40> 65 0x56 secnonce7 secnonce<55:48> 65 0x57 secnonce8 secnonce<63:56> 65 0x58 secnonce9 secnonce<71:64> 65 0x59 secnonce10 secnonce<79:72> 65 0x5a secnonce11 secnonce<87:80> 65 0x5b secnonce12 secnonce<95:88> 65 0x5c secnonce13 secnonce<103:96> 65 0x5d secencflag secencflag<7:0> 0x5e secauthflag secauthflag<7:0> 0x5f r phy 0x60 sfd1 sfd1<7:0> 66 0x61 sfd2 sfd2<7:0> 67 0x62 sfd3 sfd3<7:0> 67 0x63 sfd4 sfd4<7:0> 68 0x64 sfd5 sfd5<7:0> 68 0x65 sfd6 sfd6<7:0> 69 0x66 sfd7 sfd7<7:0> 69 0x67 r 0x68 r 0x69 r 0x6a r 0x6b r 0x6c r 0x6d r 0x6e sfdto sfdtimeout<7:0> 0x7f r downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 17 mrf24xa 2.6.2 address when using a short addressing mode, the address field is 6 bits wide to reduce framing overhead while accessing the mostly active registers (0x00..0x3f). in long addressing mode, the address field is 10 bits wide (0x00..0x3ff) thus all the address is available for spi operation. 2.6.3 automatic tx start feature when a write to trxbuf is done using long address- ing mode and the 3rd bit of byte 2 is set, the txst bit automatically sets after the cs pin is released, and then mrf24xa sends the packet. 2.6.4 automatic buffer flush feature when a read from trxbuf is done using long addressing mode and the 3rd bit of byte 2 is set, the buffull bit automatically becomes cleared after the cs pin is negated. 2.6.5 address auto-increment feature after the starting address is loaded, the first byte of data is read from or written to this address. the second byte (assuming the cs pin is not negated between bytes) is read from or written to the starting address plus one, and so on. if the memory map end is reached, the effective address rolls over to the be ginning of the memory map. it is the sole responsibility of the software to handle this situation correctly. figure 2-4 illustrates the available address modes. figure 2-4: spi framing types downloaded from: http:///
mrf24xa ds70005023c-page 18 preliminary ? 2015 microchip technology inc. 2.7 register details register 2-1: opstatus (operation status) ( 3 ) address: 0x02 r-0 r/hs/hc-0 r/hs/hc-0 r/hs/hc-0 r/hs/ hc-0 r/hs/hc-0 r/hs/hc-0 r/hs/hc-0 r macop<3:0> rfop<2:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = ha rdware clear hs = hardware set bit 7 reserved: maintain as 0 bit 6-3 macop<3:0>: mac operation register bits ( 1, 2 ) provides status information on the current mac st ate machine state. encoding on macop<3:1>: 111 = transmitting acknowledge (txack) 110 = receiving a packet (rxbusy) 101 = receiver listening to the channel waiting for packet (rx) 100 = receiving (or waiting for) acknowledge (rxack) 011 = transmitting a packet (tx) 010 = performing clear channel assessment (cca) 001 = back-off before repeated cca (bo) 000 = mac does not perform any o ation (idle) bit 2-0 rfop<2:0>: radio operation register bits provides status information on the current radio state. encoding on rfop<2:0>: 111 = tx with external pa is turned on (tx+pa) 110 = rx with external lna is turned on (rx+lna) 101 = synthesizer and external pa or lna is turned on (synth+pa/lna) 100 = radio calibrates if the host mcu sets the cals t, otherwise, device malf unction occurs (cal/mal) 011 = analog transmit chain is activated (tx) 010 = analog receiver chain is active (rx). digital may be partially shut off 001 = synthesizer is steady or ramping up or channel change is issued (synth) 000 = only the crystal oscillator is on (off), (except when xtalsf = 1 ) note 1: gpio<2:0> is dedicated to output macop<3:1> or rfop<2:0>. refer to the pincon register, which specifies the pin configuration. 2: macop<0> is connected to the rxbufful regist er bit. it cannot be output over gpios. 3: the opstatus register is sent on the sdo pi n during the first byte of the spi operation. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 19 mrf24xa register 2-2: status (d evice status) address: 0x03 r/hs r/hs r/hs r/w/hc-0 r/w-0 r/w-0 r/hs r/w/hc initdonesf xtalsf regsf calst xtaldis dsleep idlesf por bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 initdonesf: device initialization status flag bit indicates that the ready state is reached since the ldo is on, (if vregif = 1 ). initdonesf is asserted when rdyif is set for the first time after vregif. this bit is only cleared on reset (por, devfrst and pinrst). bit 6 xtalsf: crystal status flag bit xtalsf = 1 , indicates that 16 mhz system clock (from t he crystal oscillator) is active. this bit is cleared either when xtaldis is set or reset (por, devfrst, pinrst). xtalsf = 0 , indicates that the crystal oscillator is either powered off (xtaldis = 1 ) or is ramping up or is not stabilized yet, and the system clock is inactive. bit 5 regsf: configuration registers status flag bit regsf = 1 indicates that all the 1.2v register content is valid. either it holds the default value after reset and the retention memory does not hold any data to restore, or the register configura- tions are restored from the retention memory. regsf = 0 indicates that registers from 0x08-0x6e are invalid. this occurs when the wake-up proce- dure from deep sleep mode did not complete the register restore operation yet. this bit is only cleared on reset (por, devfrst, and pinrst). bit 4 calst: calibration start bit mcu sets this bit to start calibration procedure after a calsoif or calhaif interrupt occurred. mcu may not clear it to abort calibration. the device clears calst when the calibration is completed (calhaif = 0 indicates success, calhaif = 1 indicates failure). issuing calst operation without calhaif/calsoif terminates witho ut any effect on the device. bit 3 xtaldis: crystal disable bit mcu sets this bit to send the device into xtal off state (reachable from ready state). xtalsf auto- matically gets cleared. the spi register access is performed when crystal is not working. bit 2 dsleep: deep-sleep bit mcu sets this bit to send the device in to deep sleep stat e. following dsleep = 1 , the spi access to the sfr is shut off, and the spi pins must be quite, unless the host mcu wants to wake-up the device. when dsleep is set, the device transitions th rough register backup (tak ing cca. 16 s) before ldo is powered off. bit 1 idlesf: idle status flag bit indicates idle state of the device when all of the following bits are deasserted: txbufempty = 0 since it is transmitted (txst) network layer security finished (txenc) crypto engine finished (rxdec) energy detect operation finished (edst) clear channel assessment finished (ccast) bit 0 por: power-on-reset flag bit the 3.3v por flag status. the device sets th is only on 3.3v power-up (e.g., when battery is changed). cleared by host mcu to be able to sens e a brown-out reset (bor). settable for software testing. downloaded from: http:///
mrf24xa ds70005023c-page 20 preliminary ? 2015 microchip technology inc. register 2-3: pir1 (peripheral interrupt register 1) address: 0x04 r/hs-1 r-0 r/hs-0 r/w/hc-0 r -0 r/w/hs-0 r/w/hs-0 r-0 vregif r rdyif idleif r calsoif calhaif r bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 vregif: voltage regulator on interrupt flag bit this is a nonpersistent bit. the register bit initia lizes to one on 1.2v reset except for pinreset and only clears when reading pir1. note that t he corresponding ie bit is not implemented ( 1 ) . bit 6 reserved: maintain as 0 bit 5 rdyif: ready state interrupt flag bit set each time when ready state is reached: when calibration ended (calst = 0 ) when initialization ended (initdonesf = 1 ) when crystal is ramped up (xtalsf = 1 ) this bit is cleared when pir1 is read. bit 4 idleif: idle state interrupt flag bit set each time the idlesf is set and if mcu did not trigger this change. this is unchanged when mcu aborts an action by clearing either of txst, txenc, rxdec or edst bits. this bit is cleared when pir1 is read. bit 3 reserved: maintain as 0 bit 2 calsoif: calibration soft interrupt flag bit calsoif = 1 indicates that calibration is needed (calst) although the radio is still functional. it also warns of a possible degradation in signal quality and consumption, and a risk of calhaif interrupt. this bit is cleared when pir1 is read. bit 1 calhaif: calibration hard interrupt flag bit calhaif = 1 indicates that immediate calibration (calst ) is mandatory, otherwise the radio is not functional. the device enters into malfunction state. this bit is cleared when pir1 is read. bit 0 reserved: maintain as 0 note 1: generated non-maskable interrupt is gated off until the 1.2v reset is released. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 21 mrf24xa register 2-4: pir2 (peripheral interrupt register 2) address: 0x05 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 txif txencif txmaif txackif txcsmaif txszif txovfif frmif bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 txif: transmission done interrupt flag bit the current tx operation (txst) is successfully co mpleted. this event is unchanged when a hardware generated ack packet completed the transmission or when a packet is repeated. nonpersistent, cleared by spi read. bit 6 txencif: transmit encryption interrupt flag bit the tx packet is successfully encrypted or comp lemented, or both with a message integrity code (mic). set by the device after txenc = 1 , when txenc is cleared. nonpersistent, cleared by spi read. bit 5 txmaif: transmitter medium access interrupt flag bit set by the device when the medium is accessed specifically when the first sample in the preamble is transmitted into the air. nonpersistent, cleared by spi read. bit 4 txackif: transmission unacknowledged failure interrupt flag bit set by the device when acknowledge is not received after the configured maximum number of trans- mission retries retxmcnt<3:0>, provided that the fram e control field of t he transmitted frame indicates ackreq = 1 . nonpersistent, cleared by spi read. bit 3 txcsmaif: transmitter csma failure interrupt flag bit set by the device when csma-ca finds the channel busy for bomcnt<2:0> number of times, provided that csmaen = 1 is configured. nonpersist ent, cleared by spi read. bit 2 txszif: transmit packet size e rror interrupt flag bit set by the device if tx packet size (first byte of the tx buffer) is fo und to be zero or greater than the maximum size that the buffer can support. automati c size check is performed after txst is set by the user. please note that the device may modify the packet length after crc or mic calculation. nonper- sistent, cleared by spi read. bit 1 txovfif: transmitter overflow interrupt flag bit the host controller attempted to write a tx buffer that was not empty (txbufempty = 0 ). nonpersistent, cleared by spi read. bit 0 frmif: frame format error interrupt flag bit set if the transmitter/receiver fails to parse the fram e in the buffer (it is not as it must be or it is corrupted in demodulation). downloaded from: http:///
mrf24xa ds70005023c-page 22 preliminary ? 2015 microchip technology inc. register 2-5: pir3 (peripheral interrupt register 3) address: 0x06 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 rxif rxdecif rxtagif r rxidentif rxfltif rxovfif strmif bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 rxif: received successful interrupt flag bit set by the device when a frame passed packet filtering and accepted, refer to register 2-23 . this interrupt flag is only set once for a packet and is not set when the packet is the duplicate of a repeated transmission (sequence number matches with the previously received frame). nonpersistent, cleared by spi read. bit 6 rxdecif: receiver decryption/authenticat ion passed interrupt flag bit set by the device when decryption/ authentication finished without error. nonpersistent, cleared by spi read. bit 5 rxtagif: receiver decryption/authenticat ion failure interrupt flag bit set by the device when decryption/authentication finished with error. nonpersistent, cleared by spi read. bit 4 reserved: maintain as 0 bit 3 rxidentif: received packet identi cal interrupt flag bit set by the device when the packet is the duplicate of a repeated transmission (sequence number and source address matches with the previously receiv ed frame). nonpersistent , cleared by spi read. bit 2 rxfltif: received packet filtered interrupt flag bit set by the device when a packet is received, but rejected by one or more rx filters, refer to register 2- 23 . nonpersistent, cleared by spi read. bit 1 rxovfif: receiver overflow error interrupt flag bit set by the device to indicate that a packet was rece ived, but all rx buffers we re full. consequently the packet was not received, but was discarded instead ( 1 ) . nonpersistent, cleared by spi read. bit 0 strmif: receive stream time-out error interrupt flag bit set by the device to indicate that the duration s pecified in strmto elaps ed since the last received packet while in rx-streaming mode, and the mac clears the stored sequence number. nonpersistent, cleared by spi read. note 1: in packet mode, use a single buffer for received fram es. in rx-streaming mode, use both buffers for recep- tion. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 23 mrf24xa register 2-6: pir4 (peripheral interrupt register 4) ( 1 ) address: 0x07 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 txsfdif rxsfdif errorif warnif edccaif gpio2if gpio1if gpio0if bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 txsfdif: transmit sfd sent interrupt flag bit set by the device when the last sample of the sfd field is sent into the air. nonpersistent, cleared by spi read bit 6 rxsfdif: receive sfd detected interrupt flag bit set by the device when the sfd field of the received frame is detected. nonpersistent, cleared by spi read. bit 5 errorif: general error interrupt flag bit set by the device, when ma lfunction state is reached. bit 4 warnif: warning interrupt flag bit set by the device when one of the following occurred: battery voltage drops below the threshold by batmon<4:0> at 0x3f indicates that resistor is missing or improperly connected. bit 3 edccaif: energy detect/cca done interrupt flag bit set by the device when energy-detect or cca meas urement is complete (following that the host mcu sets the edst/ccast bit to start the measurement and the device is clearing it for completion). nonpersistent. cleared by spi read. bit 2 gpio2if: gpio2 interrupt flag bit set by the device if the gpiomo de register is set to normal operation, the gpio is enabled and configured to input and the level matches with the polarity. bit 1 gpio1if: gpio1 interrupt flag bit set by the device if the gpiomo de register is set to normal operation, the gpio is enabled and configured to input and the level matches with the polarity. bit 0 gpio0if: gpio0 interrupt flag bit set by the device if the gpiomo de register is set to normal operation, the gpio is enabled and configured to input and the level matches with the polarity. note 1: cfomeas<7:0> indi cation becomes valid on sfd found. downloaded from: http:///
mrf24xa ds70005023c-page 24 preliminary ? 2015 microchip technology inc. register 2-7: pie1 (periphera l interrupt enable 1) address: 0x08 r-0 r/w-1 r/w-1 r-0 r/w-1 r/w-1 r-0 r rdyie idleie r calsoie calhaie r bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-6 reserved: maintain as 0 bit 5 rdyie: ready interrupt enable bit this bit masks the rdyif interrupt bit. bit 4 idleie: idle interrupt enable bit this bit masks the idleif interrupt bit. bit 3 reserved: maintain as 0 bit 2 calsoie: calibration soft interrupt enable bit this bit masks the calsoif interrupt bit. bit 1 calhaie: calibration hard interrupt enable bit this bit masks the calhaif interrupt bit. bit 0 reserved: maintain as 0 downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 25 mrf24xa register 2-8: pie2 (periphera l interrupt enable 2) address: 0x09 r/w-1 r/w-1 r/w-0 r/w-1 r/w-1 r/w-1 r/w-1 r/w-1 txie txencie txmaie txackie txcsmaie txszie txovfie frmie bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 txie: transmit interrupt enable bit this bit masks the txif interrupt bit. bit 6 txencie: transmit encryption and authentication interrupt enable bit this bit masks the txencif interrupt bit. bit 5 txmaie: transmitter medium access interrupt enable bit this bit masks the txmaif interrupt bit. bit 4 txackie: transmission unacknowledged failure interrupt enable bit this bit masks the txackif interrupt bit. bit 3 txcsmaie: transmitter csma failure interrupt enable bit this bit masks the txcsmaif interrupt bit. bit 2 txszie: transmit packet size er ror interrupt enable bit this bit masks the t xszif interrupt bit. bit 1 txovfie: transmitter overflow interrupt enable bit this bit masks the txovfif interrupt bit. bit 0 frmie: frame format error interrupt enable bit this bit masks the frmif interrupt bit. downloaded from: http:///
mrf24xa ds70005023c-page 26 preliminary ? 2015 microchip technology inc. register 2-9: pie3 (periphera l interrupt enable 3) address: 0x0a r/w-1 r/w-1 r/w-1 r-0 r/w-0 r/w-0 r/w-1 r/w-1 rxie rxdecie rxtagie r rxidentie rxfltie rxovfie strmie bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 rxie: received succe ssful interrupt enable bit this bit masks the rxif interrupt bit. bit 6 rxdecie: receiver decryption/authentication passed interrupt enable bit this bit masks the rxdecif interrupt bit. bit 5 rxtagie: receiver decryption/authenticati on failure interrupt enable bit this bit masks the rx tagif inte rrupt bit. bit 4 reserved: maintain as 0 bit 3 rxidentie: received packet identical interrupt enable bit this bit masks the rxid entif interrupt bit. bit 2 rxfltie: received packet filtered interrupt enable bit this bit masks the rxfltif interrupt bit. bit 1 rxovfie: receiver overflow interrupt enable bit this bit masks the rxovfif interrupt bit. bit 0 strmie: receive stream time-out error interrupt enable bit this bit masks the strmif interrupt bit. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 27 mrf24xa register 2-10: pie4 (periphera l interrupt enable 4) address: 0x0b r/w-0 r/w-0 r/w-1 r/w-1 r/w-1 r/w-0 r/w-0 r/w-0 txsfdie rxsfdie errorie warnie edccaie gpio2ie gpio1ie gpio0ie bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 txsfdie: transmit sfd sent interrupt enable bit this bit masks the t xsfdif interrupt bit. bit 6 rxsfdie: receive sfd detected interrupt enable bit this bit masks the rxsf dif interrupt enable. bit 5 errorie: general error inte rrupt enable bit this bit masks the er rorif interrupt bit. bit 4 warnie: warning interrupt enable bit this bit masks the warnif interrupt bit. bit 3 edccaie: energy detect/cca done interrupt enable bit this bit masks the ed ccaif interrupt bit. bit 2 gpio2ie: gpio2 interrupt enable bit this bit masks the gp io2if inte rrupt bit. bit 1 gpio1ie: gpio1 interrupt enable bit this bit masks the gp io1if inte rrupt bit. bit 0 gpio0ie: gpio0 interrupt enable bit this bit masks the gp io0if inte rrupt bit. downloaded from: http:///
mrf24xa ds70005023c-page 28 preliminary ? 2015 microchip technology inc. register 2-11: pincon (pin co nfiguration register) address: 0x0c r-0 r/w-1 r-0 r-1 r/w-0000 r gie r irqif gpiomode<3:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 reserved: maintain as 0 bit 6 gie: general interrupt enable bit this bit enables to output irqif on int pin. note that the polarity of int pin is active-low. bit 5 reserved: maintain as 0 bit 4 irqif: interrupt request pending bit this bit is the or relationship of the enabled interrupt flags. bit 3-0 gpiomode <3:0>: gpio mode field bits this field enables redefining the func tionality of the gpio pins encoding: 11xx = reserved 1011 = gpio pins are used for receive streaming (rxstream). pins gpio<2:0> are used to output {rxwrbuf, busrdbuf, rxbufful} 1010 = gpio pins are used for transmit streaming (txstream). pins gpio<2:0> are used to output {txrdbuf, buswrbuf, txbufempty} 1001 = reserved 1000 = reserved 0111 = reserved 0110 = reserved 0101 = intended for supporting precise network time synchronization (timesyn ). gpio<0> is used to output tx, while gpio<1> to output rx sfd indication pulses. gpio<2> is used in normal operation mode. 0100 = gpio pins are used for radio monitoring (rfmon). pins gpio<2:0> are used to output rfop<2:0>. 0011 = gpio pins are used for mac monitoring (ma cmon). pins gpio<2:0> are used to output macop<3:1>. 0010 = gpio pins are used for rxfsm monitoring (rxfsmmon). pins gpio<2:0> are used to output receiver state-machine. 000 = preamble search 001 = hi-rate sfd search 010 = mid-rate sfd search 011 = low-rate sfd search 100 = legacy length field processing 101 = payload processing 0001 = gpio pins are used for agc monitoring (agc mon). pins gpio<2:0> are used to output {agc- hold, gain<1:0>} where agchold is an internal flag set when a receiver detects a preamble and clears when the agc is set fr ee after the end of the frame. 0000 = gpio pins are used as general purpose i/os by the host mcu (normal). downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 29 mrf24xa register 2-12: gpio (general purpose i/o register) address: 0x0d r/w-0 r/w-1 r/w-1 r/w-1 r-0 r/w-0 r/w-0 r/w-0 gpioen trisgpio2 trisgpio1 trisgpio0 r gpio2 gpio1 gpio0 bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 gpioen: gpio enable bit this bit enables the gpios control, if gpiomode is configured into normal mode. the other gpiomode configuration aut omatically controls gpio pins. bit 6 trisgpio2: tri-state control for gpio 2 pin bit if set, the pin is configured into input mode. value reads from gpio2 bit. if cleared, the pin is configured into out put mode. value sets through the gpio2 bit. bit 5 trisgpio1: tri-state control for gpio 1 pin bit if set, the pin is configured into input mode. value reads from gpio1 bit. if cleared, the pin is configured into out put mode. value sets through the gpio1 bit. bit 4 trisgpio0: tri-state control for gpio 0 pin bit if set, the pin is configured into input mode. value reads from gpio0 bit. if cleared, the pin is configured into out put mode. value sets through the gpio0 bit. bit 3 reserved: maintain as 0 bit 2 gpio2: gpio 2 value bit this bit represents the value on the gpio 2 pin. bit 1 gpio1: gpio 1 value bit this bit represents the value on the gpio 1 pin. bit 0 gpio0: gpio 0 value bit this bit represents the value on the gpio 0 pin. downloaded from: http:///
mrf24xa ds70005023c-page 30 preliminary ? 2015 microchip technology inc. register 2-13: stgpio (schmitt trig ger general purpose i/o register) address: 0x0e r-0 r/w-0 r/w-0 r/w-0 r-0 r/w-0 r/w-0 r/w-0 r gpio2p gpio1p gpio0p r stengpio2 stengpio1 stengpio0 bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 reserved: maintain as 0 bit 6 gpio2p: gpio 2 polarity bit this bit controls gpio2if polarity when configured into input mode. 1 = rising edge 0 = falling edge bit 5 gpio1p: gpio 1 polarity bit this bit controls gpio1if polarity when configured into input mode. 1 = rising edge 0 = falling edge bit 4 gpio0p: gpio 0 polarity bit this bit controls gpio0if polarity when configured into input mode. 1 = rising edge 0 = falling edge bit 3 reserved: maintain as 0 bit 2 stengpio2: schmitt trigger enable gpio 2 bit this bit enables schmitt-trigger circuit on gpio 2 pad and turns off by default. 1 = schmitt trigger enabled 0 = schmitt trigger disabled bit 1 stengpio1: schmitt trigger enable gpio 1 bit this bit enables schmitt-trigger circuit on gpio 1 pad and turns off by default. 1 = schmitt trigger enabled 0 = schmitt trigger disabled bit 0 stengpio0: schmitt trigger enable gpio 0 bit this bit enables schmitt-trigger circuit on gpio 0 pad and turns off by default. 1 = schmitt trigger enabled 0 = schmitt trigger disabled downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 31 mrf24xa register 2-14: pullgpio (pull cont rol general purpose i/o register) address: 0x0f r-0 r/w-0 r/w-0 r/w-0 r-0 r/w-1 r/w-1 r/w-1 r pulldir gpio2 pulldir gpio1 pulldir gpio0 r pullen gpio2 pullen gpio1 pullen gpio0 bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 reserved: maintain as 0 bit 6 pulldirgpio2: pull direction on gpio 2 bit these bits control the 75 kohm weak-pull circuit direction on gpio 2 pin. 1 = pull-up 0 = pull-down bit 5 pulldirgpio1: pull direction on gpio 1 bit these bits control the 75 kohm weak-pull circuit direction on gpio 1 pin. 1 = pull-up 0 = pull-down bit 4 pulldirgpio0: pull direction on gpio 0 bit these bits control the 75 kohm weak-pull circuit direction on gpio 0 pin. 1 = pull-up 0 = pull-down bit 3 reserved: maintain as 0 bit 2 pullengpio2: pull enable on gpio 2 bit this bit enables the weak-pull circuit in gpio 2 pin. note that when pin is configured to output, weak-pull circuit is automatically disabled. 1 = pull enabled 0 = pull disabled bit 1 pullengpio1: pull enable on gpio 1 bit this bit enables the weak-pull circuit in gpio 1 pin. note that when pin is configured to output, weak-pull circuit is automatically disabled. 1 = pull enabled 0 = pull disabled bit 0 pullengpio0: pull enable on gpio 0 bit this bit enables the weak-pull circuit in gpio 0 pin. note that when pin is configured to output, weak-pull circuit is automatically disabled. 1 = pull enabled 0 = pull disabled downloaded from: http:///
mrf24xa ds70005023c-page 32 preliminary ? 2015 microchip technology inc. register 2-15: maccon1 (mac control 1 register) address: 0x10 r/w-00 r/w-001 r/w-1 r/w-0 r/w-0 trxmode<1:0> addrsz<2:0> crcsz frmfmt secflagovr bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-6 trxmode<1:0>: tx/rx mode select field bits 11 = reserved 10 = tx-streaming mode . in this mode, use both buffers for packet transmission. when issuing trx- mode = 10 , rxen is cleared. spi addresses 0x200 to 0x27f access buffer 1 or buffer 2 in alter- nation. access to 0x37f through 0x383 has non-defined effect. 01 = rx-streaming mode . in this mode, use both buffers for packet reception. when issuing trx mode = 01 , txst and txenc/rxdec bits are cleared and rxen is set. spi addresses 0x300 to 0x383 access buffer 1 or buffer 2 in alternation. in this mode, propr ietary mode packets other than streaming type are automat ically discarded. access to 0x200 through 0x283 has non- defined effect. 00 = packet mode . in this mode, buffer 1 is used as a transmit while buffer 2 as a receive packet buffer. spi addresses from 0x200 to 0x27f access buffer 1. spi addresses 0x300 to 0x383 access buffer 2. trxmode = 00 is mandatory when frmfmt = 0 . bit 5-3 addrsz<2:0>: source/destination address size field bits ( 1, 2 ) the size of the source and destination addresses for proprietary packet. note that this fi eld has no effect on the proc essing ieee 802. 15.4 frames. 111 = 8 octets 110 = 7 octets 101 = 6 octets 100 = 5 octets 011 = 4 octets 010 = 3 octets 001 = 2 octets 000 = 1 octet bit 2 crcsz: crc size bit this bit indicates the size of the crc field in each packet 1 = 2 octets 0 = 0 octet bit 1 frmfmt: mac frame format bit adopted by the network ( 3 ) this bit determines the frame format used in the network. 1 = proprietary 0 = ieee 802.15.4 st andard compliant. note 1: zero-length address occurs when the corresponding daddrpr snt/saddrprsnt bits of the packet frame con- trol field are set to 0 . 2: use addrsz field while receiving and transmitting, and must not be modi fied while rxen or txst is set. 3: use frmfmt field while receiving and transmitting, and must not be modified while rxen or txst is set. in debug mode, use this register bit to determine the frame format fo r both tx/rx frame in the packet buffers. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 33 mrf24xa bit 0 secflagovr: security flag override bit the user can override security flags used in the ccm-ctr, cbc-mac and ccm operation, otherwise the device uses the standard (2003/2006) definition. register 2-15: maccon1 (mac control 1 register) (continued) address: 0x10 note 1: zero-length address occurs when the corresponding daddrpr snt/saddrprsnt bits of the packet frame con- trol field are set to 0 . 2: use addrsz field while receiving and transmitting, and must not be modified while rxen or txst is set. 3: use frmfmt field while receiving and transmitting, and must not be modified while rxen or txst is set. in debug mode, use this register bit to determine the frame format fo r both tx/rx frame in the packet buffers. downloaded from: http:///
mrf24xa ds70005023c-page 34 preliminary ? 2015 microchip technology inc. register 2-16: maccon2 (mac control 2 register) address: 0x11 r/w-0000 r/w/hs-0000 channel<3:0> secsuite<3:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-4 channel<3:0>: tx/rx operating channel bits these register bits are used as the current operating channel for tx/rx operation ( 1 ) . 0x0 = channel 11 0x1 = channel 12 0xf = channel 26 bit 3-0 secsuite<3:0>: security suite bits ( 2 ) 1111 = aes-cbc-mac-32 (authentication with a 32 -bit mac, but no encryption/decryption) 1110 = aes-cbc-mac-64 (authentication with a 64 -bit mac, but no encryption/decryption) 1101 = aes-cbc-mac-128 (authenticat ion with a 128-bit mac, but no encryption/decryption) 1100 = reserved 1011 = reserved 1010 = reserved 1001 = aes-ctr (encryption/decrypti on, but no authentication) 1000 = aes-ecb (encryption only) 0111 = aes-enc-mic-128 (authentic ation with a 128-bit mac and encryption/decryption) 0110 = aes-enc-mic-64 (authent ication with a 64-bit mac and encryption/decryption) 0101 = aes-enc-mic-32 (authent ication with a 32-bit mac and encryption/decryption) 0100 = aes-enc (encryption/decryption, but no authentication) 0011 = aes-mic-128 (authenticatio n with a 128-bit mac, but no encryption/decryption) 0010 = aes-mic-64 (authen tication with a 64-bit mac, bu t no encryption/decryption) 0001 = aes-mic-32 (authen tication with a 32-bit mac, bu t no encryption/decryption) 0000 = no security services enabled, or security is handled by upper protocol layers; ignore the setting of the secen bit (if value is 0 ) note 1: use this field while receiving and transmitting, and must not be modified while rxen or txst is set. 2: in 15.4-2006 standard mode mac layer security processi ng, the register field is automatically set based on the seclvl bits of the auxsechdr control field. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 35 mrf24xa register 2-17: txcon (trans mit control re gister) address: 0x12 r/w/hc-0 r/w-0 r/w/hc-0 r/hs/hc-1 r/w-1 r/w-011 txst dtsm txenc txbufempty csmaen dr<2:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 txst: transmit start bit 1 = starts the transmission of the next tx packet ( 1, 2 ) 0 = termination of current tx operation, which may re sult in the transmission of an incomplete packet hardware clear: once the packet is successfully tr ansmitted (including all attempted retransmissions, if any), the hardware clears this bit and sets the txif and idleif. if the packet transmission fails due to a csma failure, this bit is cleared, and txcsmaif is set. if acknowledge is requested (ackreq bit field in the transmitted frame is set) and not received after the configured number of retransmissions (txretmcnt), then txst bit is cleared, and txackif is set. in tx-streaming mode (trxmode), txst is set even when it is already set, resulting in a posted start. when the current tx operation comp letes, the posted start immediately starts afterward. clearing of the txst bit clears both the current and the posted (pending) tx starts. txovfif is set when txst = 1 , a posted start is present and a host controller write to the packet buffer occurs. outside of tx-streaming mode, writes to txst when txst is already set is ignored. clearing this bit aborts the cu rrent operation in these cases: when transmitting a packet in packet mode or in tx-streaming mode when waiting for an ack packet after a transmission during the csma ca algorithm when transmitting a repeated frame this field is read at any time to determine if tx operation is in progress. bit 6 dtsm: do not touch security materials bit ( 2 ) 1 = device does not change the security material configured by the host mcu 0 = device tries to configure the security material related registers mcu must fill the following registers: secnonce, sechdrindx, secpayindx and secend- indx. bit 5 txenc: tx encryption setting this bit starts the tx security processing (authentication or encryption, or both) of the packet in the buffer it was last written. txenc is cleared and txencif is set when the processing is com- plete. txenc must be issued when nwk layer se curity needs to be processed. 802.15.4-2003/2006 mac layer security operation is aut omatically performed when txst bit is set. note that this field must not be modified while txst is set. note 1: transmission may include automatic security pr ocessing, crc appending, csma-ca channel access, acknowledge reception and retransmissions depending on the register configuration and the frame con- trol field of the frame to be transmitted. 2: dtsm has no relevance in reception as the host can always reconfigure the security material before set- ting rxdec. downloaded from: http:///
mrf24xa ds70005023c-page 36 preliminary ? 2015 microchip technology inc. bit 4 txbufempty: tx buffer empty bit txbufempty = 1 indicates that the host mcu can safely st art writing a new frame to the buffer with- out overwriting any content that is in use. writing a single byte to the buffer clears this bit. txbufempty = 0 does not prevent the host from writin g further bytes to the buffer. txbufempty is set by the device when transmission is complete. 1 = mcu can safely start writing a new frame to the buffer 0 = buffer is full, or being written to when trxmode = 00 : packet mode is configured then txbufempty is set at the same time as txst is cleared and an interrupt is generated. therefore, th is bit provides no extra information. when trxmode = 10 : tx-streaming mode is configured then txbufempty is set at the same time as one of the buffers becomes free, while txst may be set. therefore, the host mcu uses txbufempty to ensure that the next frame starts loading to the buffers, without overwriting a packet being sent (txovfif). bit 3 csmaen: csma-ca enable bit this bit enables csma-ca algorithm before transmission. 1 = csma-ca enabled 0 = csma-ca disabled bit 2-0 dr<2:0>: transmit data rate field bits 111 = reserved 110 = 2 mbps 101 = 1 mbps 100 = 500 kbps 011 = 250 kbps 010 = 125 kbps 001 = reserved 000 = reserved when transmitting an auto-ack frame with adaptive da ta rate in response to a received frame, the ackdatarate field in the received frame automatica lly determines the data rate of the phy, and not by this register field. in all ot her cases, use this register field as the current phy data rate when transmitting. the phy automatically determines the data rate for all received frames regardless of this register field and the adaptive data rate configuration. for more information, refer to register 2-43 . note 1: transmission may include automatic security pr ocessing, crc appending, csma-ca channel access, acknowledge reception and retransmissions depending on the register configuration and the frame con- trol field of the frame to be transmitted. 2: dtsm has no relevance in reception as the host can always reconfigure the security material before set- ting rxdec. register 2-17: txcon (transmit co ntrol register) (continued) address: 0x12 downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 37 mrf24xa register 2-18: rxackwait (rx acknowledge wait register) address: 0x13 register 2-19: retxcount (retr ansmission count register) address: 0x14 r/w-0 r/w-1 r/w/hc-1 r/w-0 r/w-0 r/w-0 r/w-0 r/w-0 rxackwait<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear bit 7-0 rxackwait<7:0>: auto acknowledge wait field bits this field indicates the number of base time units t hat the device must wait after receiving a packet with ackreq = 1 , before transmitting the corresponding ack packe t. this field is only used when auto- acken = 1 . for more information on base time units, see section 4.1 mac architecture . r/w-0011 r-0000 retxmcnt<3:0> r etxccnt<3:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-4 retxmcnt<3:0>: retransmission max count field bits ( 1, 2 ) the maximum number of retries allowed after a transmission failure. 1111 = 15 retries 0001 = 1 retry 0000 = transmitter does not wait for ack bit 3-0 retxccnt<3:0>: retransmission current count field bits this read-only field indicates the current retransmit attempt number. when retxccnt<3:0> = retx- mcnt<3:0> and the tx attempt fails, the transmission is aborted, generating txackif interrupt. note 1: use this field during transmission, and must be unmodified while txst is set. downloaded from: http:///
mrf24xa ds70005023c-page 38 preliminary ? 2015 microchip technology inc. register 2-20: rxcon1 (mac receive control 1 register) address: 0x15 r/w/hc/hs-0 r/w-0 r/w/hc-0 r/w-0 r/w-0 r/w-0 r/w-0 r-0 rxen nopa rxdec rsvlqien rsvrssien rsvchdren rsvcfoen r bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 rxen: receive enable field bit this bit enables/disables the packet reception. if an rx packet is currently being received, clearing this bit causes that packet to be discarded. 1 = rx enabled 0 = rx disabled hardware clear/set when: cleared when trxmode is set to tx-streaming mode set when trxmode is set to rx-streaming mode clearing this bit aborts the curr ent operation in the following cases: receiving a packet in packet mode or in rx-streaming mode changes to most rx related settings must be only done when this bit is cleared. note that the clear channel assessment (csm aen) and ack-frame reception does not require rxen = 1 , as the device turns the radio into rx when needed, irrespective of the status of the rxen bit. bit 6 nopa: no parsing bit this bit disables packet parsing. only crc is checked, if it is enabled. this feature is useful in sniffer mode. 1 = disable packet parsing 0 = enable packet parsing bit 5 rxdec: rx decryption bit setting this bit starts the rx security processing (authentication or decryption, or both) on the last received packet. 1 = rx security processing started/in process. rxdecif or rxtagif is set. 0 = rx security processing inactive or complete this bit clears itself after rx decryption is completed. bit 4 rsvlqien: receive status vector lqi enable bit if bit is set, the measured link quality is appe nded after the received frame in the packet buffer. 1 = append lqi field 0 = do not append lqi field bit 3 rsvrssien: receive status vector rssi enable bit if bit is set, the measured rssi is appended after the received frame in the packet buffer. 1 = append rssi field 0 = do not append rssi field bit 2 rsvchdren: receive status vector channel/mac type/data rate enable bit if bit is set, channel, mac type and data rate configurations used wit h the received frame are appended after the received frame in the packet buffer, using the encoding specified for ch<3:0>, frmfmt and dr<2:0> (concatenated in this order when most significant bit (msb) is first). 1 = append channel, mac type and data rate fields 0 = do not append channel, mac type and data rate fields downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 39 mrf24xa bit 1 rsvcfoen: receive status vector cfo enable bit if bit is set, the estimated carrier frequency offs et of the received frame is appended after the received frame in the packet buffer, using the same encoding as cfomeas register. 1 = append cfo estimation 0 = do not append estimated cfo bit 0 reserved: maintain as 0 register 2-20: rxcon1 (mac receive control 1 register) (continued) address: 0x15 register 2-21: rxcon2 (mac receive control 2 register) address: 0x16 r/c/hs-0 r/w-0 r-0 r/w-0 r/w-0 r/w-0 r/w-0 r/w-0 rxbufful identrej ackrxfp acktxfp au torpten autoacken adptchen adptdren bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 rxbufful: rx buffer full bit host mcu clears this bit to indicate that the rx pack et is processed. if this bi t is uncleared before the next valid rx packet is detected (packet is not a duplicat e, pass rx filter, and so on), then the device sets rxovfif and the buffer content is unmodified, where rxbufful = 1 locks write access by a new frame. moreover, the host can both read and write to the buffer or perform security processing. in trxmode = 00 (packet) mode: 1 = receive buffer content is yet to be read by the host or processed, and cann ot be overwritten by a new frame 0 = receive buffer is free for receiving a new frame in trxmode = 01 (rx-streaming) mode: 1 = current buffer being read from the bus contains a valid rx packet 0 = current buffer being read from the bus is empty bit 6 identrej: reject identical packet bit setting this bit enables the user to reject an incoming packet, in case its source address and sequence number is the same as the previously received packet. this bit is used whenever a packet is received and ack is transmitted, but the ack is never received that the sender resends the tx pa cket. when this happens, triggers for rxif is avoided for the second time for the same packet, thus, the second packet is ignored. this bit is also used when a packet is repeated and the next repeater repeats the same packet back. this packet is received, but ignored. 1 = any packet received with the same source address and sequence number as the last packet suc- cessfully received is discarded and rxidntif is thrown 0 = duplicated packets are processed further same as non-duplicated packets note 1: use adptchen field while receiving and transmitting a packet, and must be unmodified while rxen or txst is set. 2: use adptdren field while receiving and transmitting a packet, and must be unmodified while rxen or txst is set. downloaded from: http:///
mrf24xa ds70005023c-page 40 preliminary ? 2015 microchip technology inc. bit 5 ackrxfp: ack rx frame pending bit this read-only status bit reflects the value of the fr amectrl (framepend) bit in the last received 802.15.4 compatible ack frame. bit 4 acktxfp: ack tx frame pending bit the value of this bit is transmitted in the fram ectrl (framepend) bit slot when the mac sends out an ack packet in 802.15.4 compatibility mode. bit 3 autorpten: auto-repeat enable bit if this bit is set, the mac automatically transmit s a packet whenever a packet is received, and its repeat bit is set. 1 = auto-repeat feature is enabled 0 = auto-repeat feature is disabled bit 2 autoacken: auto-acknowledge enable bit if this bit is set, then the device automatically transmits an ack packet whenever a packet is received, and its ackreq bit is set. 1 = automatic acknowledge processing enabled 0 = automatic acknowledge processing disabled bit 1 adptchen: adaptive channel enable bit ( 1 ) setting this bit enables the mac in proprietary mode to set the transmitting channel for the ack packet based on the ackinfo field (proprie tary packet) of the received packe t, rather than the ch<3:0> register bits. 1 = adaptive channel feature is enabled 0 = adaptive channel feature is disabled this feature is also known as channel agility. for more information, see section 7.1 channel agility . bit 0 adptdren: adaptive data rate enable bit ( 2 ) setting this bit enables the mac in proprietary mode to set the transmission data rate for the ack packet based on the ackinfo field (proprie tary packet) of the received packe t, rather than the dr<2:0> register bits. 1 = adaptive data rate feature is enabled 0 = adaptive data rate feature is disabled this feature is also known as channel agility. for more information, see section 7.1 channel agility . register 2-21: rxcon2 (mac receive control 2 register) (continued) address: 0x16 note 1: use adptchen field while receiving and transmitting a packet, and must be unmodified while rxen or txst is set. 2: use adptdren field while receiving and transmitting a packet, and must be unmodified while rxen or txst is set. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 41 mrf24xa register 2-22: txackto (tx acknowl edge time-out register) address: 0x17 r/w-10000000 txackto<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-0 txackto<7:0>: tx acknowledge time-out field bits ( 1 ) the maximum time in base time units that the device must wait for receiving an ack packet. 0x00 = wait 1 base time unit before retransmitting , implying that the device continually retransmits retxmcnt<3:0> times. for more information on base time units, see section 4.1 mac architecture . 0x01 = wait 1 base time unit before retransmitting 0x7f = wait 127 base time units before retransmitting note 1: use txackto field during transmission, and it must be unmodified while txst is set. downloaded from: http:///
mrf24xa ds70005023c-page 42 preliminary ? 2015 microchip technology inc. register 2-23: rxfilter (r x filter register) address: 0x18 r/w-0 r/w-1 r/w-1 r/w-1 r/w-1 r/w-1 r/w-1 r/w-1 pancrdn crcrej cmdrej datarej unirej notmerej bcrej nstdrej bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 pancrdn: pan coordinator bit setting this bit enables the node to accept damode = 00 type packets if it is a cmd or data frame. 1 = disable rejection 0 = reject all data and cmd packets when damode = 00 bit 6 crcrej: crc error reject enable bit ( 1 ) setting this bit enables the user to reject all packet s that contains an invalid crc, provided that it is present (crcsz = 1 ). clearing this bit enables the user to accept all packets that contains an invalid crc, provided that it is present (crcsz = 1 ), skipping any further filter ing. when crc is not present then this bit has no effect (crcsz = 0 ). 1 = reject all packets having an invalid crc 0 = accept all packets having an invalid crc without further filtering bit 5 cmdrej: command frame reject enable bit setting this bit enables the user to reject all packets with framectrl (type) equal to command. 1 = reject all command packets 0 = disable command frame rejection bit 4 datarej: data frame reject enable bit setting this bit enables the user to reject all packets with framectrl (type) equal to data. 1 = reject all data packets 0 = disable data frame rejection bit 3 unirej: unicast reject enable bit ( 2 ) setting this bit enables the user to reject all unicast packets as in: 802.15.4 mode: pan identifier matches with the panid< 15:0> or 0xffff, and destination address matches the address in the addr<63:0> or shad dr<15:0> register, which the damode selects. proprietary mode: destination address matches the a ddress in addr*8-1:0> reg- ister, provided that daddrprsnt frame control field is set ( 1 ) . 1 = reject all unicast packets addressed to this node 0 = disable unicast rejection note 1: in proprietary mode (frmfmt = 1 ), when crcrej = 1 is used to reject unicast frames not addressed to this node. notmerej = 1 does not reject these frames. 2: unirej does not affect the frames using implied de stination addressing in 802.15.4 mode and inferred destination addressing in proprietary mode. 3: notmerej does not affect the fr ames using implied destination ad dressing in 802.15.4 mode and inferred destination addressing in proprietary mode. 4: nstdrej does not affect the proprietary frames in proprietary mode. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 43 mrf24xa bit 2 notmerej: not me unicast reject enable bit ( 3 ) setting this bit enables the user to reject all unicast packets as in: 802.15.4 mode: destination pan identifier does not matc h panid<15:0> and is not 0xffff (broad- cast) or destination address d oes not match the address in the addr<63:0> register or the shaddr<15:0> register, which the damode selects. proprietary mode: destination address matches the a ddress in addr*8-1:0> reg- ister, provided that daddrprsnt frame control field is set ( 1 ) . 1 = reject all unicast packets not addressed to this node 0 = disable not me unicast rejection filtering bit 1 bcrej: broadcast rejection bit 802.15.4 mode: setting this bit enables the user to reject all broadcast packets of type data or com- mand. a data or command packet is broadcast w hen short destination addressing is used (damode = 10) and short address is equal 0xffff. proprietary mode: setting this bit enables the user to reject all broadcast packets of type data or command (or streaming). a packet is broadcast when framectrl[broadcast] is set. 1 = reject broadcast packets 0 = disable broadcast rejection bit 0 nstdrej: non-standard frame reject bit ( 4 ) this bit enables the user to reject all 802.15.4 frames having 01 for the damode or samode fields or having the msb (bit 2) in the type field set (1) or having the msb (bit 1) in the frame version field set to ( 1 ) . 1 = reject all non-standard 802.15.4 packets 0 = disable non-standard rejection note 1: in proprietary mode (frmfmt = 1 ), when crcrej = 1 is used to reject unicas t frames not addressed to this node. notmerej = 1 does not reject these frames. 2: unirej does not affect the frames using implied de stination addressing in 802.15.4 mode and inferred destination addressing in proprietary mode. 3: notmerej does not affect the frames using impl ied destination addressing in 802.15.4 mode and inferred destination addressing in proprietary mode. 4: nstdrej does not affect the proprietary frames in proprietary mode. register 2-23: rxfilter (rx filt er register) (c ontinued) address: 0x18 downloaded from: http:///
mrf24xa ds70005023c-page 44 preliminary ? 2015 microchip technology inc. register 2-24: tmrcon (timer control register) address: 0x19 r/w-100 r/w-00010 bomcnt<2:0 > basetm<4:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-5 bomcnt<2:0>: csma-ca back-off maximum count bits the maximum number of back-off attempts the csma-ca algorithm attempts before declaring a chan- nel access failure. 111 = reserved 110 = reserved 101 = 5 attempts 100 = 4 attempts 011 = 3 attempts 010 = 2 attempts 001 = 1 attempts 000 = 0 attempt bit 4-0 basetm<4:0>: base time field bits the number of 1 s clock cycles that a base time unit represents in all register settings. for more infor- mation on base time units, see section 4.1 mac architecture . downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 45 mrf24xa register 2-25: csmabe (csma-ca ba ck-off exponent control register) address: 0x1a r/w-0101 r/w-0011 maxbe<3:0> minbe<3:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-4 maxbe<3:0>: csma-ca back-off maximum count field bits the maximum value of the back-off exponent (be), in the csma-ca algorithm. the back-off time is (2 be -1) units. 1111 = reserved 1001 = reserved 1000 2 8 -1 = 255 maximum units of back-off time 0000 2 0 -1 = no back-off time bit 3-0 minbe<3:0>: csma-ca back-off minimum count bits the minimum value of the back-off exponent (be), in the csma-ca algorithm. the back-off time is (2 be -1) units. 1111 = reserved 1001 = reserved 1000 2 8 -1 = 255 maximum units of back-off time 0000 2 0 -1 = no back-off time downloaded from: http:///
mrf24xa ds70005023c-page 46 preliminary ? 2015 microchip technology inc. register 2-26: bounit (back-off time unit register) address: 0x1b register 2-27: strmtoh/strmtol (s tream time-out register) address: 0x1c C 0x1d r/w-10100000 bounit<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-0 bounit<7:0>: csma-ca back-off period unit field bits the number of base time units for the basic back-off time unit used by csma-ca algorithm. 11111111 = 256 base time units 00000000 = 1 base time unit r/w-11111111 strmto<15:8> bit 15 bit 8 r/w-11111111 strmto<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 15-0 strmto<15:0>: stream time-out bits the strmto<15:0> bits indicate the maximum numbe r of allowed base time units between the end of one rx stream packet and the successful reception of the next. if no rx stream packet is successfully received within this time, strmif is set. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 47 mrf24xa register 2-28: offtm (off-timer register) address: 0x1e r/w-00000000 offtm<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-0 offtm<7:0>: off-timer field bits this value sets the minimum pll off time in 1 s resolution. minimum off time = offtm<7:0> * 32 if this register is set to 0xff, pll remains off. downloaded from: http:///
mrf24xa ds70005023c-page 48 preliminary ? 2015 microchip technology inc. register 2-29: addr (address register) address: 0x1f C 0x26 r/w-00000000 addr<63:56> bit 63 bit 56 r/w-00000000 addr<55:48> bit 55 bit 48 r/w-00000000 addr<47:40> bit 47 bit 40 r/w-00000000 addr<39:32> bit 39 bit 32 r/w-00000000 addr<31:24> bit 31 bit 24 r/w-00000000 addr<23:16> bit 23 bit 16 r/w-00000000 addr<15:8> bit 15 bit 8 r/w-00000000 addr<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 63-0 addr<63:0>: long address field bits current devices long address (lsb stored). for pr oprietary frames, the number of address bytes is defined in addrsz<2:0>. for addresses less than 8 octets , use the least significant bits of this register. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 49 mrf24xa register 2-30: shaddrh/shaddrl (sho rt address register) address: 0x27 C 0x28 register 2-31: panidh/panidl (pan identifier register) address: 0x29 C 0x2a r/w-00000000 shaddr<15:8> bit 15 bit 8 r/w-00000000 shaddr<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 15-0 shaddr<15:0>: short address field bits current devices short address (lsb st ored). only used in 802.15.4 mode. r/w-00000000 panid<15:8> bit 15 bit 8 r/w-00000000 panid<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 15-0 panid<15:0>: pan identifier field bits current devices pan identifier (lsb st ored). only used in 802.15.4 mode. downloaded from: http:///
mrf24xa ds70005023c-page 50 preliminary ? 2015 microchip technology inc. register 2-32: sechdrindx (securit y header index register) address: 0x2b register 2-33: secpayindx (securit y payload index register) address: 0x2c r-0 r/w/hs-0000000 r sechdrindx<6:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hs = hardware set bit 7 reserved: maintain as 0 bit 6-0 sechdrindx<6:0>: security header index field bits this field defines the portion of the header which performs the authentication operations. for mac layer security, sechdrindx<6:0> is define d as the address offset of the mac header from the beginning of the frame, as stored in the buffer (0 = length field, 1 = framectrl field, and so on), and is automatically loaded for both 802.15.4 and proprietary frames ( 1 ) . for network layer security, sechdrindx<6:0> is defi ned as the address offset of the network header from the beginning of the frame and the host controller loads it only for 802.15.4 frames. note that for proprietary frames, the mac automatically loads it. note 1: setting the dtsm bit disables the automatic computation of this field in tx mode. r-0 r/w/hs-0000000 r secpayindx<6:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hs = hardware set bit 7 reserved: maintain as 0 bit 6-0 secpayindx<6:0>: security payload index field bits this field defines the portion of the payload, whic h the encryption/decryption operations are performed. for mac layer security, secpayindx<6:0> is defined as the address offset of the mac payload from the beginning of the frame, as stored in the buffer (0 = length field, 1 = framectrl field, and so on), and is automatically loaded for both 802.15.4 and proprietary frames ( 1 ) . for network layer security, secpayindx<6:0> is defined as the address offset of the payload from the beginning of the frame and the host controller loads it only for 802.15.4 frames. note that for propri- etary frames, the mac aut omatically loads it. note 1: setting the dtsm bit disables the automatic computation of this field in tx mode. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 51 mrf24xa register 2-34: secendindx (secur ity end index register) address: 0x2d r-00 r/w/hs-0000000 r secendindx<6:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hs = hardware set bit 7 reserved: maintain as 0 bit 6-0 secendindx<6:0>: security end index field bits ( 1 ) this field defines the end of the payload, wh ich the security operations are performed. note 1: setting the dtsm bit disables the automatic computation of this field in tx mode. downloaded from: http:///
mrf24xa ds70005023c-page 52 preliminary ? 2015 microchip technology inc. register 2-35: macdebug (mac de bug control register) address: 0x2e r/w/hc-0 r/w/hc-0 r/w-0 r/w-0 r/hs/hc -0 r/hs/hc-0 r/hs/hc-0 r/hs/hc-0 buf1txpp buf2txpp buf1rxpp buf2r xpp txrdbuf rxwrbuf busrdbuf buswrbuf bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 buf1txpp: buffer 1 tx process packet bit setting this bit performs all of the processing (crc generation and security) on buf1 that is normally done before transmitting a packet, but without actually trans mitting the packet. bit 6 buf2txpp: buffer 2 tx process packet bit setting this bit performs all of the processing (crc generation and security) on buf2 that is normally done before transmitting a packet, but without actually trans mitting the packet. bit 5 buf1rxpp: buffer 1 rx process packet bit setting this bit performs all of the processing ( crc checking and security) on buf1 that is normally done when receiving a packet, but without actually receiving the packet. this bit must be asserted while downloading security materials and so on during debug. bit 4 buf2rxpp: buffer 2 rx process packet bit setting this bit performs all of the processing ( crc checking and security) on buf2 that is normally done when receiving a packet, but without actually receiving the packet. this bit must be asserted while downloading security materials and so on, during debug. bit 3 txrdbuf: tx read buffer flag bit indicates the physical buffer number ( 0 = buf1, 1 = buf2) that the tx hardware is reading. bit 2 rxwrbuf: rx write buffer flag bit indicates the physical buffer number ( 0 = buf1, 1 = buf2) that the rx hardware is writing to. bit 1 busrdbuf: bus read buffer flag bit indicates the physical buffer number ( 0 = buf1, 1 = buf2) that the sfr bus is reading. this bit is only used in rx-streaming mode. bit 0 buswrbuf: bus write buffer flag bit indicates the physical buffer number ( 0 = buf1, 1 = buf2) that the sfr bus is writing to. this bit is only used in tx-streaming mode. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 53 mrf24xa register 2-36: ccacon1 (cca control 1 register) address: 0x2f register 2-37: ccacon2 (cca control 2 register) address: 0x30 r/hs/hc-0 r/w/hc-0 r/w-001100 ccabusy ccast rssithr<5:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 ccabusy: clear channel assessment busy flag bit this bit represents the result of the latest cca measurement. 1 = medium is busy 0 = medium is silent bit 6 ccast: clear channel assessment start bit ( 1 ) setting this register bit triggers mcu to start a new cca measurement. the hardware clears this bit when the cca measurement is done (edccaif is set) and ccabusy is valid. bit 5-0 rssithr<5:0>: rssi threshold bits ( 2 ) this threshold is used in cca operation when ener gy detect or energy and carrier sense mode is selected. representation: resolution of 2 db/lsb, rssithr = 0x 10 represents ca. -75 dbm noise level. note that this threshold may be different with other matching network or antenna. note 1: rx chain must be turned on (rxen = 1 ) to perform this measurement. packet reception is not disabled during the measurement, ma in purpose is testing. 2: in the corresponding cca modes the radio measures edmean<7:0>. if edmean <7:2> is greater than rssithr<5:0>, ccabusy is set. exam ple: to set the rssi threshold where the chip measures 0x30 edmean, rssithr<5:0> must be 0x0c. r-0 r/w-01 r/w-01 csthr<3:0> ccalen<1:0> ccamode<1:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-4 csthr<3:0>: carrier sense threshold field bits. this threshold is used in cca operation when carrier sense mode is selected. bit 3-2 ccalen<1:0>: clear channel assessment length bits ( 1 ) value n indicates duration of 2^n * 32 s. bit 1-0 ccamode<1:0>: clear channel assessment mode field bits ( 2 ) 11 = cca mode 3/a in the ieee 802.15.4 sta ndard: energy and carrier sense threshold 10 = cca mode 2 in the ieee 802.15.4 standard: carrier sense threshold 01 = cca mode 1 in the ieee 802.15.4 standar d: energy detect threshold (default) 00 = cca mode 3/b in the ieee 802.15.4 standard: energy or carrier sense threshold note 1: the ieee 802.15.4 standard requires 128 s, but shorte r length is recommended when using higher rates with optimized preamble m ode (ratecon.optimal = 1 ). 2: the measured rssi result is stored in edm ean<7:0> register in all modes except mode 2. downloaded from: http:///
mrf24xa ds70005023c-page 54 preliminary ? 2015 microchip technology inc. register 2-38: edcon (energy detect control register) ( 1 ) ) address: 0x31 register 2-39: edmean (energy detect mean indication register) address: 0x32 r-00 r/w-0 r/w/hc-0 r/w-1110 r edmode edst edlen<3:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear bit 7-6 reserved: maintain as 0 bit 5 edmode: energy detect mode select bit 1 = energy detect sampling mode. ed duration is 128 s. a single atomic rssi-peak measurement is accomplished. the result is stored in ed peak<7:0> register. 0 = energy detect scan mode. edlen<3:0> sets the ed duration. the result is stored in edmean<7:0> register. bit 4 edst: energy detect measurement start bit setting this register bit trigers mcu to start a new ed measurement. the hardware clears this bit when the ed measurement is done (edccaif is unchanged) and values in edmean<7:0> and edpeak<7:0> are valid. if the ed measurement is aborted (rx state changes, or the mcu cl ears the edst bit), then edccaif is unchanged. bit 3-0 edlen<3:0>: energy detect measurement length field bits ( 2 ) value m indicates a sequence of (m + 1) * 8 atomic rssi-peak measurements, each having the duration of 128 s. at the end of the aggregate measurem ent, the mean and the peak value of the sequence are available in edmean<7:0> and edpeak<7:0>. note 1: the rx chain must be turned on (rxen = 1 ) to perform this measurement. packet reception is disabled during the measurement. 2: when edlen<3:0> = m = 0xe, the 128 s atomic measurements are preformed 120 times, which is equal to the a basesuperframeduration parameter in the ieee 802.15.4 standard. r/hs/hc-00000000 edmean<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7-0 edmean<7:0>: energy detect mean indication field bits measured mean signal strength during ed/cca measurement. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 55 mrf24xa register 2-40: edpeak (energy detect peak indication register) address: 0x33 register 2-41: cfocon (cfo pre compensation re gister) address: 0x34 r/hs/hc-00000000 edpeak<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7-0 edpeak<7:0>: energy detect peak indication field bits measured peak signal strength during ed measurement. computation: the gain-compensated rssi va lue is averaged over intervals of 128 s. the peak value obtained from a sequence of such measurem ents is stored in edpeak when edmode = 1 . r/w-0000 r/w-0000 cfotx<3:0> cforx<3:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-4 cfotx<3:0>: tx carrier frequency offset field bits the host writes this value to co mpensate for the carrier frequency offset of the node during transmis- sion. pre-compensation allows using crystals with wider tolerances. frequency offset unit is: 13 ppm/ lsb. twos complement encoding. bit 3-0 cforx<3:0>: rx carrier frequency offset field bits the host writes this value to pre-compensate the carrier frequency offset estimation window (55 ppm). frequency offset unit is: 13 ppm/ lsb. twos complement encoding. downloaded from: http:///
mrf24xa ds70005023c-page 56 preliminary ? 2015 microchip technology inc. register 2-42: cfomeas (cfo meas urement indication register) address: 0x35 r/w-00000000 cfomeas<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-0 cfomeas<7:0>: cfo measurement field bits if afcovr bit is cleared, then th is register is written and valid when rxsfdif is set with the value of the carrier frequency offset that was estimated durin g the acquisition of the packet. the host may use this value together with the lqi as a preamble qual ity indication (lqi is m easured over the cfo com- pensated payload). if afcovr bit is set, this receiver compensates th e carrier frequency offset. note that in this case, the cfo estimation algorithm is disabled, thus 13 ppm cfo is tolerated. cforx has no effect when afcovr is set. frequency offset unit is: ~1.62 ppm /lsb of the 2.4 ghz carrier. twos complement encoding is used. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 57 mrf24xa register 2-43: ratecon (rate configuration re gister) address: 0x36 r/w-0 r/w-0 r/w-0 r/w-0 r/w-0 r/w-0 r/w-1 r/w-1 dis2000 dis1000 dis500 dis250 disstd dis125 optimal psav bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 dis2000: disable 2 mbps frame reception bit if this bit is set, then recepti on of 2 mbps frames is disabled. bit 6 dis1000: disable 1 mbps frame reception bit if this bit is set, then recepti on of 1 mbps frames is disabled. bit 5 dis500: disable 500 kbps frame reception bit if this bit is set, then reception of 500 kbps frames is disabled. bit 4 dis250: disable 250 kbps frame reception bit if this bit is set, then reception of 250 kbps frames with non-standard-compliant sfd patterns is disabled. bit 3 disstd: disable ieee 802.15.4 compli ant frame reception bit if this bit is set, th en reception of 250 kbps frames with ieee 802.15.4 compliant sfd patterns is disabled. bit 2 dis125: disable 125 kbps frame reception bit if this bit is set, then reception of 125 kbps frames is disabled. bit 1 optimal: optimized preamble selection bit when this bit is set, then optimi zed preamble is used instead of legacy. 1 = optimized preamble 0 = legacy preamble bit 0 psav: power-save mode selection bit if this bit is set, frame detecti on is dependent on the rssi signal, and the receive signal processor is turned on when a sudden and significant increase ( psavthr<3:0>) is detected in the signal strength or the signal strength is above an absolute level (desensthr<3:0>). 1 = power-save mode 0 = hi-sensitivity mode downloaded from: http:///
mrf24xa ds70005023c-page 58 preliminary ? 2015 microchip technology inc. register 2-44: powsave (power-sa ve configuration register) address 0x37 r/w-1010 r/w-1010 desensthr<3:0> psavthr<3:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-4 desensthr<3:0>: desensitization threshold field bits this field defines an absolute level on the rssi si gnal to activate receive signal processor if psav = 1 . unit is 4 db/lsb. unsigned encoding is used. bit 3-0 psavthr<3:0>: frame detection threshold register field bits this field defines a relative (relative to the last 4 s rssi value) threshold level on the rssi signal to activate receive signal processor, if psav = 1 . unit is 0.5 db/lsb. unsigned encoding is used. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 59 mrf24xa register 2-45: bbcon (baseband configurat ion register) address 0x38 r/w-0 r/w-0 r/w-11 r/w-0 r/w-001 rndmod afcovr rxgain<1:0> prmbhold prmbsz<2:0> bit 7 bit 0 legend: w = writable bit r = readable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 rndmod: random modulation bit if this bit is set, the transmitte r randomly transmits dsss symbols or msk chips if prmbhold bit is set. the purpose of this register is only for testing. bit 6 afcovr: afc override bit if this bit is set, the receiver uses cfomeas register as the cfo in reception. bit 5-4 rxgain<1:0>: receiver gain register field bits if this bit is set, the agc operation is inhibited in the receiver and the receiver radio gain configuration is selected between three different gain levels. encoding: 11 = agc operation is enabled (default value) 10 = high gain 01 = middle gain 00 = low gain this feature is used for testi ng and streaming purposes. to reduce the required interframe-gap, the rxgain must be set to one of the fixed gain options when the mac is in streaming mode. bit 3 prmbhold: preamble hold enable bit effect: appends extra bytes to the transmitted pr eamble in endless repetition until it is cleared. details: the hardware checks this bit during transmission before finishing the preamble. the dr<2:0> and the register optimal determine the appropriat e preamble byte and applies the modulation format. when this flag is released, the transmission of the cu rrent preamble byte is completed followed by trans- mitting the length field and the payload. 1 = enable endless preamble repetition 0 = disable/stop endless preamble repetition bit 2-0 prmbsz<2:0>: preamble size adjustment field bits allows adjusting the transmitte d preamble length when optimal = 1 . encoding: 500 kbps preamble length = (prmbsz<2> + 4) units, where unit = 16 s (1 octet at 500 kbps) 1 mbps preamble length = (prmbsz<1 :0> + 8) units, where unit = 4 s (1 octet at 2 mbps) 2 mbps preamble length = (prmbsz<1 :0> + 8) units, where unit = 4 s (1 octet at 2 mbps) legacy frames and 125/250 kbps optimized frames are not affected by this register field. downloaded from: http:///
mrf24xa ds70005023c-page 60 preliminary ? 2015 microchip technology inc. register 2-46: ifgap (inter f rame configuration register) address 0x39 register 2-47: txpow (transmit po wer configuration register) address 0x3a r-000 r/w-10111 r ifgap<4:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-5 reserved: maintain as 0 bit 4-0 ifgap<4:0>: tx interframe-gap field bits this field allows configuring a tx interframe-gap ranging from 0 to 30 s. this duration is enforced as a minimum separation between the last sample of a tr ansmitted frame and the start of the preamble for a potential subsequent fram e transmission. unit is 2 s/lsb. r/w-000 r/w-11111 chipboost<2:0> txpow<4:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-5 chipboost<2:0>: tx chip boosting field bits this field modifies the spec trum of the oqpsk transmission. bit 4-0 txpow<4:0>: tx power register field bits this field allows configuring a tx power ranging from -19 to 1 dbm. encoding: 11111 = +1 dbm 00001 = -19 dbm 00000 = pa off downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 61 mrf24xa register 2-48: tx2idle (transmit power- down to idle configuration register) address 0x3b register 2-49: tx2txma (transmit powe r-up to medium access configuration register) address 0x3c r-0 r/w-00011 r tx2idle<4:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-5 reserved: maintain as 0 bit 4-0 tx2idle<4:0>: transmit power-down to idle duration field bits defines the duration of the interval while pll cannot be tuned (turned off or change channel) following that the transmitter and external pa (if pae = 1 ) are turned down together. representation: 1 s/1 lsb. no offset. r-0 r/w-00011 r tx2txma<4:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-5 reserved: maintain as 0 bit 4-0 tx2txma<4:0>: transmit power-up to medium access configuration field bits defines the time interval between turning on the inter nal transmitter of the device and the start time of medium access (start of the phy-layer frame). tx_to_txma = the transient time of the transmitter, in the following scenarios : paen = 0 paen = 1 , but the pa is turned on first. pa_to_tx ma = tx_to_txma + pa transient time. paen = 1 , but the tx and pa transients are not sequenced. tx_to_txma = the transient time of the transmitter + pa_to_txma: paen = 1 , and the transmitter is turned on first (transients are sequenced). representation: 1 s/1 lsb. no offset. downloaded from: http:///
mrf24xa ds70005023c-page 62 preliminary ? 2015 microchip technology inc. register 2-50: extpa (external powe r amplifier configuration register) address 0x3d register 2-51: extlna (ext ernal low-noise amplifier configuration register) address 0x3e r-0 r/w-0 r/w-0 r/w-00100 r extpap paen pa2txma<4:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 reserved: maintain as 0 bit 6 extpap: external power amplifier polarity bit 1 = 3.3v turns power amplifier on 0 = gnd turns power amplifier on bit 5 paen: external power amplifier enable bit this bit enables the pa pin to output the control signal for external power amplifier. bit 4-0 pa2txma<4:0>: external power amplifier power-up to medium access configuration field bits defines the time interval between turning on the external pa of the device and the start time of medium access (start of the phy-layer frame). pa_to_txma = the transient time of the external pa, in the following scenarios: paen = 1 , and the transmitter is turned on first. tx_t o_txma = pa_to_txma + tx transient time. paen = 1 , but the tx and pa transients are not sequenced. pa_to_txma = the transient time of the pa + tx_to_txma: paen = 1 , and the external power amplifier is turned on first (transients are sequenced). representation: 1 s/1 lsb. no offset r-0 r/w-0 r/w-0 r/w-00100 r extlnap lnaen lnadly<4:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 reserved: maintain as 0 bit 6 extlnap: external low noise amplifier polarity bit 1 = 3.3v turns low-noise amplifier on 0 = gnd turns low-noise amplifier on bit 5 lnaen: external low-noise power amplifier enable bit this bit enables the lna pin to output the co ntrol signal for external low-noise amplifier. bit 4-0 lnadly<4:0>: external low-noise amplifier power-up transient delay field bits defines the duration between the lna is turned on and the reception is valid. lna and internal receiver are turned on together. the longer transient is awaited before input signal is accepted as valid. representation: 1 s/1 lsb. no offset. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 63 mrf24xa register 2-52: batmon (battery moni tor configuration register) address: 0x3f r-0 r/w-1 r/w-11111 r batmonpd batmon<4:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-6 reserved: maintain as 0 bit 5 batmonpd: battery monitor power-down bit if battery monitor is working and battery voltag e drops below the threshold by batmon<4:0>, then warnif is set. 1 = battery monitor is off 0 = battery monitor is working bit 4-0 batmon<4:0>: battery monitor threshold field bits v threshold = 3.6 - 0.071 * batmon<4:0> (v) register 2-53: seckey (security key register) address: 0x40 C 0x4f r/w-00000000 seckey<127:120> bit 127 bit 120 r/w-00000000 seckey<119:112> bit 119 bit 112 r/w-00000000 seckey<111:104> bit 111 bit 104 r/w-00000000 seckey<103:96> bit 103 bit 96 r/w-00000000 seckey<95:88> bit 95 bit 88 r/w-00000000 seckey<87:80> bit 87 bit 80 r/w-00000000 seckey<79:72> bit 79 bit 72 downloaded from: http:///
mrf24xa ds70005023c-page 64 preliminary ? 2015 microchip technology inc. r/w-00000000 seckey<71:64> bit 71 bit 64 r/w-00000000 seckey<63:56> bit 63 bit 56 r/w-00000000 seckey<55:48> bit 55 bit 48 r/w-00000000 seckey<47:40> bit 47 bit 40 r/w-00000000 seckey<39:32> bit 39 bit 32 r/w-00000000 seckey<31:24> bit 31 bit 24 r/w-00000000 seckey<23:16> bit 23 bit 16 r/w-00000000 seckey<15:8> bit 15 bit 8 r/w-00000000 seckey<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 127-0 seckey<128:0>: security key field bits security key used in security operation. register 2-53: seckey (security key register) (continued) address: 0x40 C 0x4f downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 65 mrf24xa register 2-54: secnonce ( security nonce register) address: 0x50 C 0x5c r/w/hs/hc-00000000 secnonce<103:96> bit 103 bit 96 r/w-00000000 secnonce <95:88> bit 95 bit 88 r/w-00000000 secnonce<87:80> bit 87 bit 80 r/w-00000000 secnonce<79:72> bit 79 bit 72 r/w-00000000 secnonce<71:64> bit 71 bit 64 r/w-00000000 secnonce<63:56> bit 63 bit 56 r/w-00000000 secnonce<55:48> bit 55 bit 48 r/w-00000000 secnonce<47:40> bit 47 bit 40 r/w-00000000 secnonce<39:32> bit 39 bit 32 r/w-00000000 secnonce<31:24> bit 31 bit 24 r/w-00000000 secnonce<23:16> bit 23 bit 16 r/w-00000000 secnonce<15:8> bit 15 bit 8 downloaded from: http:///
mrf24xa ds70005023c-page 66 preliminary ? 2015 microchip technology inc. register 2-55:sfd1 (start frame deli miter pattern 1 configuration register) address: 0x60 r/w-00000000 secnonce<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 103-0 secnonce<103:0>: security nonce field bits the register represents security n once used in security operation. this field is deterministic in both 802.15.4 -2003 and 802.15.4-2006 standards. device can automatically calculate this field. r/w-00100001 sfd1<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-0 sfd1<7:0>: start frame delimiter pattern 1 register field bits this octet is used as sfd pattern with 2 mbps rate when optimal = 0 , and as the msb of the sfd pattern with 2 mbps rate when optimal = 1 . when optimal = 0 : the hexadecimal digits must be different from 0x 0 and different from the corresponding digits in sfd, k = 2, 3, 4, 6, and the value 0xa7 is forbidden. when optimal = 1 : the hexadecimal digits must be different from 0x0 a nd different from the corresponding digits of sfd2. register 2-54: secnonce (securit y nonce register) (continued) address: 0x50 C 0x5c downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 67 mrf24xa register 2-56: sfd2 (start frame delimiter pattern 2 configuration register) address: 0x61 register 2-57: sfd3 (start frame delimi ter pattern 3 configuration register) address: 0x62 r/w-11110001 sfd2<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-0 sfd2<7:0>: start frame delimiter pattern 2 register field bits this octet is used as sfd pattern with 1 mbps rate when optimal = 0 , and as the msb of the sfd pattern with 1 mbps rate when optimal = 1 . when optimal = 0 : the hexadecimal digits must be different from 0x0 and different from the corresponding digits in sfd, k = 1, 3, 4, 6, and the value 0xa7 is forbidden. when optimal = 1 : the hexadecimal digits must be different from 0x0 a nd different from the corresponding digits of sfd2. r/w-00111011 sfd3<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-0 sfd3<7:0>: start frame delimiter pattern 3 register field bits this octet is used as sfd pattern with 500 kbps rate. when optimal = 0 : the hexadecimal digits must be different from 0x0 and different from the correspond digits in sfd, k = 1, 2, 4, 6, and the value 0xa7 is forbidden. when o ptimal = 1 : the hexadecimal digits must be different from 0x0. downloaded from: http:///
mrf24xa ds70005023c-page 68 preliminary ? 2015 microchip technology inc. register 2-58: sfd4 (start frame delimi ter pattern 4 configuration register) address: 0x63 register 2-59: sfd5 (start frame delimi ter pattern 5 configuration register) address: 0x64 r/w-11100101 sfd4<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-0 sfd4<7:0>: start frame delimiter pattern 4 register field bits this octet is used as sfd pattern with 250 kbps ra te when proprietary mac is in use. otherwise, the 0xa7 pattern defined in the standard is used instead. the hexadecimal digits must be different from 0x0 and from the corresponding digits in sfd, where k = 6 or 1, 2, 3. when optimal = 0 , the value 0xa7 is forbidden. r/w-01001101 sfd5<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-0 sfd5<7:0>: start frame delimiter pattern 5 register field bits this octet is used as the msb of the sfd pattern with 125 kbps rate. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 69 mrf24xa register 2-60: sfd6 (start frame delimi ter pattern 6 configuration register) address: 0x65 register 2-61: sfd7 (start frame delimi ter pattern 7 configuration register) address: 0x66 r/w-10101000 sfd6<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-0 sfd6<7:0>: start frame delimiter pattern 6 register field bits when optimal = 1 : this octet is used as the lsb of the sfd pattern with 2 mbps rate. this octet is used as the lsb of the sfd pattern with 125 kbps rate. when optimal = 0 : the value 0xa7 is forbidden.the hexadecimal digits must be different from 0x0 and different from the corresponding digits in sfd, k = 4 or 1, 2, 3 . r/w-11001000 sfd7<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-0 sfd7<7:0>: start frame delimiter pattern 7 register field bits when optimal = 1 , this octet is used as the lsb of the sfd pattern with 1 mbps rate. downloaded from: http:///
mrf24xa ds70005023c-page 70 preliminary ? 2015 microchip technology inc. notes: downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 71 mrf24xa 3.0 functional description 3.1 reset mrf24xa has three reset types: power-on reset (por) C mrf24xa has built-in por circuitry that automati cally resets all control registers when power is applied. after por, mrf24xa starts the internal calibration process. rdyif interrupt is set when the device is ready to use. reset pin C th host mcu can reset mrf24xa by asserting the reset pin18 low. all control regis- ters are reset to default value. if the r eset pin is deasserted, mrf24xa starts the internal calibra- tion process. rdyif interrupt is set when the device is ready to use. software reset C the host mcu can perform the software reset through the spi interface. regrst register (0x00) provides reset signals for the configuration registers, while fsmrst register (0x01) provides reset f unctionality for the internal state machines. the reset signals are asynchronous and the level is evaluated immediately without any internal synchronization. the recommended reset sequences: - fsmrst = 0x1f - regrst = 0x3f - regrst = 0x00 register 3-1: regrst (configuration reset) ( 1 ) address: 0x00 register 3-2: fsmrst (controller reset) ( 1 ) address: 0x01 r-00 r/w-000000 r regrst<5:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-6 reserved: maintain as 0 bit 5-0 regrst<5:0>: asynchronous register reset field bits 111111 = reset configuration registers to default 000000 = release from reset note 1: after setting the field, the host mcu must al so clear it to release the device from reset. r-000 r/w-00000 r fsmrst<4:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-5 reserved: maintain as 0 bit 4-0 fsmrst<4:0>: asynchronous functional reset field bits 11111 = reset state machines to default 00000 = release from reset note 1: after setting the field, the host mcu must clear it to release the device from reset. downloaded from: http:///
mrf24xa ds70005023c-page 72 preliminary ? 2015 microchip technology inc. table 3-1: registers associated with reset 3.2 interrupts mrf24xa has one interrupt (int ), pin 13 that signals interrupt events to the host mcu. interrupt sources are enabled through pie1 (0x08) to pie4 (0x0b) register bits. all interrupts are enabled or disabled using gie bit (pincon<6>). if gie bit is cleared, all interrupts are disabled and int pin remains in inactive state. despite having the interrupts cleared by gie bit clearing, the interrupt flags of the enabled interrupt sources are set. interrupt flags are located in the pir1 (0x04) to pir4 (0x07) registers. the pirx register bits clears-to-zero upon read. therefore, the host mcu must read and store the value of the pirx registers and check the bits to determine which interrupt occurred. the int pin continues to signal an interrupt until all active interrupts flags in pirx registers are read. register 3-3: pincon (pin co nfiguration register) address: 0x0c name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 regrst r regrst<5:0> fsmrst r fsmrst<4:0> legend: r = reserved, read as 0. r-0 r/w-1 r-0 r-x r/w-0000 rg i e r irqif gpiomode<3:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 reserved: maintain as 0 bit 6 gie: general interrupt enable bit this bit enables to output irqif on int pin. note that the polarity of int pin is active-low. bit 5 reserved: maintain as 0 bit 4 irqif: interrupt request pending bit this bit is the or relationship of the enabled interrupt flags. bit 3-0 gpiomode <3:0>: gpio mode field bits this bit field is out of scope. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 73 mrf24xa 3.2.1 piex - interrupt enable registers register bits of pie1 to pie4 registers enable the appropriate interrupt sources to generate interrupts to the host mcu through int pin. the interrupt is enabled when the appropriate bit is set to 1 . register 3-4: pie1 (periphera l interrupt enable 1) address: 0x08 r-0 r/w-1 r/w-1 r-0 r/w-1 r/w-1 r-0 r rdyie idleie r calsoie calhaie r bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-6 reserved: maintain as 0 bit 5 rdyie: ready interrupt enable bit this bit masks the rdyif interrupt bit. bit 4 idleie: idle interrupt enable bit this bit masks the idleif interrupt bit. bit 3 reserved: maintain as 0 bit 2 calsoie: calibration soft interrupt enable bit this bit masks the calsoif interrupt bit. bit 1 calhaie: calibration hard interrupt enable bit this bit masks the calhaif interrupt bit. bit 0 reserved: maintain as 0 downloaded from: http:///
mrf24xa ds70005023c-page 74 preliminary ? 2015 microchip technology inc. register 3-5: pie2 (periphera l interrupt enable 2) address: 0x09 r/w-1 r/w-1 r/w-0 r/w-1 r/w-1 r/w-1 r/w-1 r/w-1 txie txencie txmaie txackie txcsmaie txszie txovfie frmie bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 txie: transmit interrupt enable this bit masks the txif interrupt register. bit 6 txencie: transmit encryption and authentication interrupt enable bit this bit masks the txenci f interrupt register. bit 5 txmaie: transmitter medium access interrupt enable bit this bit masks the txmaif interrupt register. bit 4 txackie: transmission unacknowledged failure interrupt enable bit this bit masks the txackif interrupt register. bit 3 txcsmaie: transmitter csma failure interrupt enable bit this bit masks the txcsma if interrupt register. bit 2 txszie: transmit packet size erro r interrupt enable bit this bit masks the txszif interrupt register. bit 1 txovfie: transmitter overflow interrupt enable bit this bit masks the txovfif interrupt register. bit 0 frmie: frame format error interrupt flag bit this bit masks the frmif interrupt register. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 75 mrf24xa register 3-6: pie3 (periphera l interrupt enable 3) address: 0x0a r/w-1 r/w-1 r/w-1 r-0 r/w-0 r/w-0 r/w-1 r/w-1 rxie rxdecie rxtagie r rxidentie rxfltie rxovfie strmie bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 rxie: received successful interrupt enable bit this bit masks the rxif interrupt register. bit 6 rxdecie: receiver decryption/authentication passed interrupt enable bit this bit masks the rxdecif interrupt register. bit 5 rxtagie: receiver decryption/authentication failure interrupt enable bit this bit masks the rxtagif interrupt register. bit 4 reserved: maintain as 0 bit 3 rxidentie: received packet identical interrupt enable bit this bit masks the rxiden tif interrupt register. bit 2 rxfltie: received packet filtered interrupt enable bit this bit masks the rxflti f interrupt register. bit 1 rxovfie: receiver overflow interrupt enable bit this bit masks the rxovfif interrupt register. bit 0 strmie: receive stream time-out error interrupt enable bit this bit masks the strmif interrupt register. downloaded from: http:///
mrf24xa ds70005023c-page 76 preliminary ? 2015 microchip technology inc. register 3-7: pie4 (periphera l interrupt enable 4) address: 0x0b r/w-0 r/w-0 r/w-1 r/w-1 r/w-1 r/w-0 r/w-0 r/w-0 txsfdie rxsfdie errorie warnie ed ccaie gpio2ie gpio1ie gpio0ie bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 txsfdie: transmit sfd sent interrupt enable bit this bit masks the txsfdi f interrupt register. bit 6 rxsfdie: receive sfd detected interrupt enable bit this bit masks the rxsf dif interrupt enable. bit 5 errorie: general error inte rrupt enable bit this bit masks the errori f interrupt register. bit 4 warnie: warning interrupt enable bit this bit masks the warni f interrupt register. bit 3 edccaie: energy detect/cca done interrupt enable bit this bit masks the edccai f interrupt register. bit 2 gpio2ie: gpio2 interrupt enable bit this bit masks the gpio2i f interrupt register. bit 1 gpio1ie: gpio1 interrupt enable bit this bit masks the gpio1i f interrupt register. bit 0 gpio0ie: gpio0 interrupt enable bit this bit masks the gpio0i f interrupt register. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 77 mrf24xa 3.2.2 pirx- periph eral interrupt registers register bits of pir1 to pir4 registers indicates the source of the interrupt. the interrupt must be enabled when the appropriate bit is set to 1 in the correspond- ing piex register. mrf24xa automatically clears the contents of the pirx registers when the host mcu reads the content of the r egister. mcu must store the pirx register values in the firmware as needed . register 3-8: pir1 (peripheral interrupt register 1) address: 0x04 r/hs-1 r-0 r/hs-0 r/w/hc-0 r-0 r/w/hs-0 r/w/hs-0 r-0 vregif r rdyif idleif r calsoif calhaif r bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 vregif: voltage regulator on interrupt flag bit ( 1 ) this is a nonpersistent bit. the register bit initializes to 1 on 1.2v reset except when reset is used and only cleared when pir1 is read. note th at the corresponding ie bit is not implemented. bit 6 reserved: maintain as 0 bit 5 rdyif: ready state interrupt flag bit set each time when ready state is reached: when calibration ended (calst = 0 ) when initialization ended (initdonesf = 1 ) when crystal is ramped up (xtalsf = 1 ) this bit is cleared when pir1 is read. bit 4 idleif: idle state interrupt flag bit set each time the idlesf is set and if mcu did not trigger this change. this is unchanged when mcu aborts an action by clearing either of txst, txenc, rxdec, edst or cca bits. this bit is cleared when pir1 is read. bit 3 reserved: maintain as 0 bit 2 calsoif: calibration soft interrupt flag bit this flag indicates that maybe calibration is needed (calst) although the radio is still functional. it also warns of a possible degradation in signal quality and cu rrent consumption, and a risk of calhaif inter- rupt. this bit is cleared when pir1 is read. bit 1 calhaif: calibration hard interrupt flag bit this flag indicates that immediate calibration (cal st) is mandatory, otherwise the radio is not func- tional. the device enters into malfunction state. this bit is cleared when pir1 is read. bit 0 reserved: maintain as 0 note 1: generated non-maskable interrupt is gated off until the 1.2v reset is released. downloaded from: http:///
mrf24xa ds70005023c-page 78 preliminary ? 2015 microchip technology inc. register 3-9: pir2 (peripheral interrupt register 2) address: 0x05 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 txif txencif txmaif txackif tx csmaif txszif txovfif frmif bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 txif: transmission done interrupt flag bit the current tx operation (txst) is successfully completed. this event becomes unchanged when a hardware generated ack packet completed the transmission or when a packet is repeated. nonper- sistent, cleared by spi read. bit 6 txencif: transmit encoding interrupt flag bit the tx packet was successfully encrypted or comp lemented, or both with a message integrity code (mic). set by the device after txenc = 1 , when txenc is cleared. nonpersistent, cleared by spi read. bit 5 txmaif: transmitter medium access interrupt flag bit set by the device when the medium is accessed, specifically when the first sample in the preamble is transmitted into the air. nonpersistent, cleared by spi read. bit 4 txackif: transmission unacknowledged failure interrupt flag bit set by the device when acknowledge is not receiv ed after the configured maximum number of trans- mission retries retxmcnt<3:0>, provided that the frame control field of the transmitted frame indi- cates ackreq = 1 and autoacken = 1 . nonpersistent, cleared by spi read. bit 3 txcsmaif: transmitter csma failure interrupt flag bit set by the device when csma-ca finds the channel busy for bomcnt<2:0> number of times, provided that csmaen = 1 is configured. nonpersisten t, cleared by spi read. bit 2 txszif: transmit packet size e rror interrupt flag bit following txst is set the packet size (including mic ta gs and crc) is found to be zero or to be greater than the maximum size that the buffers can support. nonpersistent, cleared by spi read. bit 1 txovfif: transmitter overflow interrupt flag bit the host controller attempted to write a tx buffer that was not empty (txbufempty = 0 ). nonpersistent, cleared by spi read. bit 0 frmif: frame format error interrupt flag bit set if the transmitter/receiver fails to parse the frame in the buffer (it is not as it must be or it is corrupted in demodulation). nonpersist ent, cleared by spi read. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 79 mrf24xa register 3-10: pir3 (peripheral interrupt register 3) address: 0x06 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 rxif rxdecif rxtagif r rxidentif rxfltif rxovfif strmif bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 rxif: received successful interrupt flag bit set by the device when a frame passed packet filtering and accepted, refer to register 5-1 . this interrupt flag is only set once for a packet and is not set when the packet is the duplicate of a repeated transmission (sequence number matches with the previously receiv ed frame). nonpersistent, cleared by spi read. bit 6 rxdecif: receiver decryption/authentica tion passed interrupt flag bit set by the device when decryption/aut hentication finished without error. nonpersistent, cleared by spi read. bit 5 rxtagif: receiver decryption/authentication failure interrupt flag bit set by the device when decryption/ authentication finished with error. nonpersistent, cleared by spi read. bit 4 reserved: maintain as 0 bit 3 rxidentif: received packet identica l interrupt flag bit set by the device when the packet is the duplicat e of a repeated transmission (sequence number, source address matches with the previously received frame). nonpersistent, cleared by spi read. bit 2 rxfltif: received packet filtered interrupt flag bit set by the device when a packet was received, but rejected by one or more rx filters, refer to register 5-1 . nonpersistent, cleared by spi read. bit 1 rxovfif: receiver overflow error interrupt flag bit set by the device to indicate that a packet was received, but all rx buffers were full. consequently the packet was not received, but was discarded instead ( 1 ) . nonpersistent, cleared by spi read. bit 0 strmif: receive stream time-out error interrupt flag bit set by the device to indicate the duration specified in strmto elaps ed since the last received packet while in rx-streaming mode, and the ma c clears the stored sequence number. nonpersistent, cleared by spi read. note 1: in packet mode, use a single buffer for received frames. in rx-streaming mode, use both buffers for reception. downloaded from: http:///
mrf24xa ds70005023c-page 80 preliminary ? 2015 microchip technology inc. register 3-11: pir4 (peripheral interrupt register 4) address: 0x07 table 3-2: registers associated with interrupts r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 txsfdif rxsfdif errorif warnif edccaif gpio2if gpio1if gpio0if bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 txsfdif: transmit sfd sent interrupt flag bit set by the device when the last sample of the sfd field is sent into the air. nonpersistent, cleared by spi read. bit 6 rxsfdif: receive sfd detected interrupt flag bit set by the device when the sfd field of the received frame is detected ( 1 ) . nonpersistent, cleared by spi read. bit 5 errorif: general error interrupt flag bit set by the device, when malfunction state is reached. bit 4 warnif: warning interrupt flag bit set by the device when one of the following is occurred: battery voltage drops below the threshold by batmon<4:0> at 0x3f indicating that resistor is missing or not connected well bit 3 edccaif: energy detect/cca done interrupt flag bit set by the device when energy-detect or cca meas urement is complete (following that the host mcu sets the edst/ccast bit to start the measurement and the device is clearing it in on completion). nonpersistent. cleared by spi read. bit 2 gpio2if: gpio2 interrupt flag bit set by the device if the gpiomode register is set to normal oper ation, the gpio is enabled and configured to input and the level matches with the polarity. bit 1 gpio1if: gpio1 interrupt flag bit set by the device if the gpiomode register is set to normal oper ation, the gpio is enabled and configured to input and the level matches with the polarity. bit 0 gpio0if: gpio0 interrupt flag bit set by the device if the gpiomode register is set to normal oper ation, the gpio is enabled and configured to input and the level matches with the polarity. note 1: the detection latency (01 s after the last sample of the sfd). note that the sfd may trigger on noise or interference. note that the cfomeas<7:0> indication becomes valid when r xsfdif is asserted. name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 pir1 vregif r rdyif idleif r calsoif calhaif r pir2 txif txencif txmaif txackif txcsmaif txszif txovfif frmif pir3 rxif rxdecif rxtagif r rxidentif rxfltif rxovfif strmif pir4 txsfdif rxsfdif errorif warni f edccaif gpio2if gpio1if gpio0if pie1 r rdyie idleie r calsoie calhaie r pie2 txie txencie txmaie txackie txcsmaie txszie txovfie frmie pie3 rxie rxdecie rxtagie r rxidentie rxfltie rxovfie strmie pie4 txsfdie rxsfdie errorie warni e edccaie gpio2ie gpio1ie gpio0ie pincon r gie r irqif gpiomode<3:0> legend: r = reserved. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 81 mrf24xa 3.3 gpio functions and gpio interrupts mrf24xa has three gpio pins, gpio2 pin 12, gpio1 pin 11 and gpio0 pin 10. gpio pins are used as gen- eral purpose io pins or gpios can monitor internal states. refer to register 3-17 for more information on gpio monitoring. 3.3.1 gpio general io functionalities to operate mrf24xa gpiox pins in general purpose io mode, set gpioen bit (0x0d<7>) to 1 and set gpi- omode<3:0> bits (0x0c<3:0>) to 0000 . the trisgpiox bits (0x0d<6:4>) configures the input or output selection of gpio s. clearing the trisgpiox bit sets the appropriate gpio line to output mode. input the default gpio line direction after por. gpio lines in input mode are used with schmitt trigger input buffers. stengpiox bits (0x0e<2:0>) enables the schmitt triggers. setting the stengpiox bit to 1 enables schmitt trigger inpu t of the appropriate pin. gpio data is read or written to through the gpio bits (0x0d<2:0>). gpio lines can have active pull-up or pull-down. pullengpiox (0x0f<2:0>) bits enable line pulling function. setting pullengpiox bit to 1 enables active pull-up or pull-down circuit. pulldirgpiox bit (0x0f<6:4>) sets the pull direction. setting pulldirgpiox bit to 1 defines pull-up, while clearing the bit defines pull-down on the appropriate gpio line. 3.3.2 gpio interrupt handling gpio lines can also generate interrupts. to use gpio interrupts, set the appropri ate gpioxie bit (0x0b<2:0>) to 1 to enable the interrupt generation. to enable inter- rupt generation on int pin, set gie bit (0x0c<6>) to 1 . the gpio interrupt polarity is selected through gpi- oxp bits (0x0e<6:4>). setting gpioxp bit to 1 triggers interrupt logic at the rising edge of the input signal. while clearing the bit enables interrupt generation on the falling edge of the input pin. downloaded from: http:///
mrf24xa ds70005023c-page 82 preliminary ? 2015 microchip technology inc. register 3-12: pir4 (peripheral interrupt register 4) address: 0x07 register 3-13: pie4 (periphera l interrupt enable 4) address: 0x0b r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 txsfdif rxsfdif errorif warnif edccaif gpio2if gpio1if gpio0if bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-3 out of scope bit 2 gpio2if: gpio2 interrupt flag bit set by the device if the gpiomode register is se t to normal operation, the gpio is enabled and configured to input and the level matches with the polarity. bit 1 gpio1if: gpio1 interrupt flag bit set by the device if the gpiomode register is se t to normal operation, the gpio is enabled and configured to input and the level matches with the polarity. bit 0 gpio0if: gpio0 interrupt flag bit set by the device if the gpiomode register is se t to normal operation, the gpio is enabled and configured to input and the level matches with the polarity. r/w-0 r/w-0 r/w-1 r/w-1 r/w-1 r/w-0 r/w-0 r/w-0 txsfdie rxsfdie errorie warnie edccaie gpio2ie gpio1ie gpio0ie bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-3 out of scope bit 2 gpio2ie: gpio2 interrupt enable bit this bit masks the gpio2if interrupt register. bit 1 gpio1ie: gpio1 interrupt enable bit this bit masks the gpio1if interrupt register. bit 0 gpio0ie: gpio0 interrupt enable bit this bit masks the gpio0if interrupt register. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 83 mrf24xa register 3-14: gpio (general purpose i/o register) address: 0x0d r/w-0 r/w-1 r/w-1 r/w-1 r-0 r/w-0 r/w-0 r/w-0 gpioen trisgpio2 trisgpio1 trisgpio0 r gpio2 gpio1 gpio0 bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 gpioen: gpio enable bit this bit enables the gpios control, if gpiomode is only configured into normal mode. the other gpi- omode configuration automati cally controls gpio pins. bit 6 trisgpio2: tri-state control for gpio 2 pin bit if set, the pin is configured into input mode. value reads from gpio2 bit. if cleared, the pin is configured into outp ut mode. value sets through the gpio2 bit. bit 5 trisgpio1: tri-state control for gpio 1 pin bit if set, the pin is configured into input mode. value reads from gpio1 bit. if cleared, the pin is configured into outp ut mode. value sets through the gpio1 bit. bit 4 trisgpio0: tri-state control for gpio 0 pin bit if set, the pin is configured into input mode. value reads from gpio0 bit. if cleared, the pin is configured into outp ut mode. value sets through the gpio0 bit. bit 3 reserved: maintain as 0 bit 2 gpio2: gpio 2 value bit this bit represents the value on the gpio 2 pin. bit 1 gpio1: gpio 1 value bit this bit represents the value on the gpio 1 pin. bit 0 gpio0: gpio 0 value bit this bit represents the value on the gpio 0 pin. downloaded from: http:///
mrf24xa ds70005023c-page 84 preliminary ? 2015 microchip technology inc. register 3-15: stgpio (schmitt trig ger general purpose i/o register) address: 0x0e r-0 r/w-0 r/w-0 r/w-0 r-0 r/w-0 r/w-0 r/w-0 r gpio2p gpio1p gpio0p r stengpio2 stengpio1 stengpio0 bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 reserved: maintain as 0 bit 6 gpio2p: gpio 2 polarity bit this bit controls gpio2if polarity when configured into input mode. 1 = rising edge 0 = falling edge bit 5 gpio1p: gpio 1 polarity bit this bit controls gpio1if polarity when configured into input mode. 1 = rising edge 0 = falling edge bit 4 gpio0p: gpio 0 polarity bit this bit controls gpio0if polarity when configured into input mode. 1 = rising edge 0 = falling edge bit 3 reserved: maintain as 0 bit 2 stengpio2: schmitt trigger enable gpio 2 this bit enables schmitt-trigger circuit on gpio 2 pad and turns off by default. 1 = schmitt trigger enabled 0 = schmitt trigger disabled bit 1 stengpio1: schmitt trigger enable gpio 1 this bit enables schmitt-trigger circuit on gpio 1 pad and turns off by default. 1 = schmitt trigger enabled 0 = schmitt trigger disabled bit 0 stengpio0: schmitt trigger enable gpio 0 this bit enables schmitt-trigger circuit on gpio 0 pad and turns off by default. 1 = schmitt trigger enabled 0 = schmitt trigger disabled downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 85 mrf24xa register 3-16: pullgpio (pull cont rol general purpose i/o register) address: 0x0f r-0 r/w-0 r/w-0 r/w-0 r-0 r/w-0 r/w-0 r/w-0 r pulldirgpio2 pulldirgpio1 pulldirgpio0 r pullengpio2 pulleng pio1 pullengpio0 bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 reserved: maintain as 0 bit 6 pulldirgpio2: pull direction on gpio 2 bit these bits control the 75 kohm weak-pul l circuit direction on gpio 2 pin. 1 = pull-up 0 = pull-down bit 5 pulldirgpio1: pull direction on gpio 1 bit these bits control the 75 kohm weak-pul l circuit direction on gpio 1 pin. 1 = pull-up 0 = pull-down bit 4 pulldirgpio0: pull direction on gpio 0 bit these bits control the 75 kohm weak-pul l circuit direction on gpio 0 pin. 1 = pull-up 0 = pull-down bit 3 reserved: maintain as 0 bit 2 pullengpio2: pull enable on gpio 2 bit this bit enables to weak-pull circuit in gpio 2 pi n. note that when pin is configured to output, weak-pull circuit automatically disables. 1 = pull enabled 0 = pull disabled bit 1 pullengpio1: pull enable on gpio 1 bit this bit enables to weak-pull circuit in gpio 1 pi n. note that when pin is configured to output, weak-pull circuit automatically disables. 1 = pull enabled 0 = pull disabled bit 0 pullengpio0: pull enable on gpio 0 bit this bit enables to weak-pull circuit in gpio 0 pin. note that when pin is configured to output, weak- pull circuit automatically disables. 1 = pull enabled 0 = pull disabled downloaded from: http:///
mrf24xa ds70005023c-page 86 preliminary ? 2015 microchip technology inc. register 3-17: pincon (pin co nfiguration register) address: 0x0c r-0 r/w-1 r-0 r-1 r/w-0000 r gie r irqif gpiomode<3:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 reserved: maintain as 0 bit 6 gie: general interrupt enable bit this bit enables to output irqif on int pin. note that the polarity of int pin is active-low. bit 5 reserved: maintain as 0 bit 4 irqif: interrupt request pending bit this bit is the or relationship of the enabled interrupt flags. bit 3-0 gpiomode <3:0>: gpio mode field bit this field allows redefining the functionality of the gpio pins encoding: 11xx = reserved 1011 = gpio pins are used for receive streaming (r xstream). pins gpio<2:0> are used to output {rxwrbuf, busrdbuf, rxbufful}. 1010 = gpio pins are used for transmit streaming (t xstream). pins gpio<2:0> are used to output {txrdbuf, buswrbuf, txbufempty}. 1001 = reserved 1000 = reserved 0111 = reserved 0110 = reserved 0101 = intended for supporting precis e network time synchronization (timesyn). gpio<0> is used to output tx, while gpio<1> to output rx sfd indi cation pulses. gpio<2> is used in normal operation mode. 0100 = gpio pins are used for radio monitoring (rfmon). pins gpio<2:0> are used to output rfop<2:0>. 0011 = gpio pins are used for mac monitoring (m acmon). pins gpio<2:0> are used to output macop<3:1>. 0010 = gpio pins are used for rxfsm monitoring (r xfsmmon). pins gpio<2:0> are used to output receiver state-machine 000 = preamble search 001 = hi-rate sfd search 010 = mid-rate sfd search 011 = low-rate sfd search 100 = legacy length field processing 101 = payload processing 0001 = gpio pins are used for agc monitoring (agc mon). pins gpio<2:0> are used to output {agc- hold, gain<1:0>} where agchold is an internal flag set when a receiver detects a preamble and clears when the agc is set fr ee after the end of the frame. 0000 = gpio pins are used as general purpose i/os by the host mcu (normal). downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 87 mrf24xa 3.4 pa and lna outputs mrf24xa has a power amplifier (pa) control pin (pin 20) and a low noise amplifier (lna) control pin (pin 21). these pins are capable of handling external pas and lnas or external antenna switch circuits. mrf24xa can also tolerate different start-up times of different external circuits by sending or accepting data if the external circuits completes their ramp up. mrf24xa can handle both active-high or active-low control signal sensitive circuits. for more information, refer to section 9.13 external power amplifier (pa)/low-noise amplifier (lna) . 3.5 battery monitor the voltage level on the battery is monitored. if the bat- tery monitoring is enabled and the voltage level drops below a threshold, voltage interrupt (warnif) is asserted. refer to register 3-18 for more information on the battery. register 3-18: batmon (battery moni tor configuration register) address: 0x3f table 3-3: registers associated with gpio functionalities name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 pir4 txsfdif rxsfdif errorif warnif edccaif gpio2if gpio1if gpio0if pie4 txsfdie rxsfdie errorie warnie edccaie gpio2ie gpio1ie gpio0ie gpio gpioen trisgpio2 trisgpio1 trisgpio0 r gpio2 gpio1 gpio0 stgpio r gpio2p gpio1p gpio0p r stengpio2 stengpio1 stengpio0 pullgpio r pulldirgpio2 pulldirgpio1 pulldirgpio0 r pullengpio2 pullengpio1 pullengpio0 pincon r gie r irqif gpiomode<3:0> legend: r = reserved, read as 0 . r-0 r/w-1 r/w-11111 r batmonpd batmon<4:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-6 reserved: maintain as 0 bit 5 batmonpd: battery monitor power-down bit if battery monitor is working and battery voltage drops below the threshold by batmon<4:0> then warnif is set. 1 = battery monitor is off 0 = battery monitor is working bit 4-0 batmon<4:0>: battery monitor th reshold field bits v threshold = 3.6 - 0.071 * batmon<4:0> (v) downloaded from: http:///
mrf24xa ds70005023c-page 88 preliminary ? 2015 microchip technology inc. notes: downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 89 mrf24xa 4.0 general transceiver operations 4.1 mac architecture the architecture of mac layer processing is illustrated in figure 4-1 . in reception, the receive signal processor acquires the synchronization header of the frame on-air, and demod- ulates the frame starting from the length field. the demodulated data is written directly into the receiver buffer (default, buffer 2) if the targeted buffer is declared empty (rxbufful = 0 ). after length number of bytes are received into the buffer and rsv data are appended, the frame is parsed according to the selected framing mode (ieee 802.15.4 or proprietary). the frame control sequence (fcs ) is checked to detect corruption by noise. corrupted frames or frames not addressed to this node are rejected (discarded), which the host configures. rejection means that reception is completed now and the receive buffer status remains empty (rxbufful = 0 ). it is configurable whether the frame is discarded silently or generates an interrupt to the host. if a frame is accepted and acknowledge is requested for the frame, then the radio turns to transmit and sends an acknowledgment. as ot her features, automatic ack-sending are enabled or bypassed. if the frame is the duplicate of a previously received and accepted frame then the frame is discarded (following acknowledgment). otherwise, the frame is the first copy of an acc epted frame, which must be reported to the host. to lock the buffer from being overwritten by a new frame, rxbufful is automatically set (1). rxif interrupt is generated for the host, which completes the reception. the host mcu can only a ccess the receive buffer when rxbufful is set (1). to free up the buffer, the host clears rxbufful (0). if the frame is encrypted or contains an authentication tag (mic), the host mcu must run the decrypt/ authenticate operation before it reads the payload and frees up the buffer. when sending, the host mcu constructs the frame and downloads it to the transmit buffer (default, buffer 0), and triggers transmission after the last byte. the device processes the content of the buffer in-place. after pars- ing, a security processing takes place if required, finally an fcs is generated and appended to the frame. the length is adjusted each time an authentication tag (mic) or fcs is appended to the frame. after in-place frame processing the medium is accessed using the carrier sense multiple access with collision avoidance (csma-ca). the rf transmit chain is only enabled when the channel is free, or if csma is bypassed. as soon as the rf can transmit, the transmit signal processor starts sending the synchronization header (shr) and followed by the buffer content up the fcs. if an acknowledgment is requested then the rf chain is turned into receive. if ack is not received before the expiration of a time-out, the transmission can automa tically start over from csma through shr-transmission, and then transmitting the shr-transmission frame if configured. after successful sending an interrupt is generated to the host mcu. only either the tx mac or the rx mac is active at a time. downloaded from: http:///
mrf24xa ds70005023c-page 90 preliminary ? 2015 microchip technology inc. figure 4-1: mac functional block diagram 4.2 operations overview 4.2.1 terminology node denotes the wireless communication node that is formed by a mrf24xa device and a host mcu. device denotes the mrf24xa device. software/sw denotes the software running in the host mcu. the device does not contain a processor core that runs software. frame and packet are used interchangeably. 4.2.2 host interface the host mcu controls t he device over spi (max. 10 mhz), whereas the device indicates task completion or failure events, and frames received over the air by rais- ing an interrupt. most interrupt flags are masked, which means that these are still se t on the respective event, but cannot activate the interrupt pin on the device. the host services the interrupts through reading the inter- rupt register. the interrupt bytes are self-cleared on spi-read. using the convention, the if suffix in mne- monics refers to interrupt flag. for example, txif and rxif. for software troubleshooting, the host can set the interrupt flags. 4.2.3 buffers the device has two frame buffers (128 bytes each). spi allows accessing each byte in the frame buffer at its own address. as the default, the buffer starting at address 0x200 is used for transmission (buf1) and the buffer starting at address 0x300 is used for reception (buf2). 4.2.4 operating states the figure 4-3 chart describes the top-level state machine of mrf24xa, including the valid state transitions. note that t he register access can also perform the other transitions, however these may result in an unexpected behavior. for more information on the mrf24xa power modes on power consumption in each state, refer to ta b l e 2 - 1 . 4.2.4.1 description of each state radio in pin reset: mcu keeps nrst pin low. radio is in reset, functions are unavailable. power off: voltage on 3v3 pin is 0v. radio is shut down. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 91 mrf24xa init (rst = 1 ): internal state. radio performs automatic initialization af ter power or pin reset. in this state, spi is active and tx buffer can be pre-loaded. register access is limited to 0x00 - 0x07. init (rst = 0 ): internal state. radio performs automatic initialization to recover from deep sleep. in this state, spi is active and tx buffer can be pre-loaded. register access is limited to 0x00 - 0x07. deep sleep: the radio is in an extremely low- power state. current cons umption is 40 na. all parts, including the 1v2 on-chip regulator, is turned off. 3v3 backup memory is only powered to keep the register settings. to maintain the set- tings, the chip must not be powered down com- pletely. initial calibration: afte r reset, some internal circuits must be calibr ated. the radio automati- cally performs these calib rations . in case some problem occurs during calibration, the chip remains in this state. radio off: this is the first stable state after power cycle or pin reset. th e radio is ready for all operations, every register is accessible. even if crystal is running, it takes 50 s for the synthe- sizer to ramp up before rx or tx mode gets enabled. idle: radio is up and all registers are accessible. crystal and synthesizer are up and running to reduce transition to rx or tx. sleep: only the regulator is powered on, crystal is not running. this state may be used for pre- loading register values or tx buffer. no other functionality are available. rx listen and rx listen power save: radio awaits for packets to arrive and to be received. all registers are accessible and tx buffer may be loaded. even if psav is enabled, the operation remains the same. the difference displays in power consumption and sensitivity. rx frame: temporary internal state for the actual packet reception process. tx frame: temporary internal state for sending out a packet from tx buffer. 4.2.4.2 detailed transition description 1: mcu releases nrst. radio moves into init (rst = 1 ) mode. in case there were no power cycles, por bit retains its state. 2: radio gets powered on. por bit sets to 1 and vregif is set when the 1v2 regulator is up. vregif is not maskable. 3: to start recovery from deep sleep mode, a dummy spi read operation (at least four changes on sdi line) is required from the mcu. th e first interrupt after wake- up is vregif, which indicates the start of the on-chip 1.2v regulator. the spi is oper ational at this point that enables the mcu to service the interrupt by reading the interrupt source register. por flag retains its state before deep sleep mode. transmit buffers are accessible for preloads. after the crystal oscillator becomes stabilized (1-3 ms; 1,4 ms typical), the device sets the rdyif interrupt without going through recalibration, and then all the registers become accessible. previously stored configuration is retained during deep sleep, thus calibration is not necessary. 4: in case radio was star ted with any kind of reset, calibration is needed. transition from init state and the initial calibration are automatically done. 5: theoretically, it is possible that calibration fails. in that case, the chip remains in this internal state. further information in status register description. 6. automatic transition to radio off after successful calibration. 7: radio automatically turns to off mode after the register values are restored and rx is disabled before deep sleep. 8: in case rx is enabled before deep sleep, radio automatically turns back to rx or rx power save mode. 9, 12: to initiate transition to sleep mode, mcu must set xtaldis bit. note that sleep mode is only accessible from idle and radio off mode. 10: to recover from sleep mode mcu must clear xtaldis bit. afterwards crystal ramps up and radio turns back to off modes. 11. transferring to deep sleep mode. mcu must clear por bit and all interrupt registers and set dsleep bit afterwards. 13, 14: rx mode is accessible from radio off and idle mode. the only difference is in transition time: from off mode user must wa it for synthesizer to ramp up. 15: mcu clears rxen bit to go back to idle. for further information on transition, see check point 20. 16, 17 and 18: mcu sets txst to transmit packet from buffer. the difference is in transition time: from off mode user must wait for synthesizer to ramp up. 19, 21: radio turns back to idle mode (if started from idle or off mode) after the packet is sent or the mcu clears the txst bit. transition to rx takes place if rxen bit is set on high before setting txst. 20: transition depends on offtm register settings. when txst or rxen bits are cleared, radio waits offtm number of base time units and then it turns to off mode to save power. to disable automatic transition, set offtm to 0xff. 22: automatic transition if radio detects a packet being transmitted over air. downloaded from: http:///
mrf24xa ds70005023c-page 92 preliminary ? 2015 microchip technology inc. 23: transition after packet reception is over or mcu clears rxen bit . figure 4-2: transition from deep sl eep to rx listen power-save mode table 4-1: transition times starting state destination state radio internal tasks typ. transition time. power off radio off regulator, xtal ramp up and calibra- tion 1.6 ms ( 1 ) pin reset radio off xtal ramp up, calibration 1.4 ms ( 1 ) radio off, idle, rx deep sleep save registers, shut down 1v2 ldo 45 ms ( 2 ) deep sleep radio off regulator an d xtal ramp up, register recovery 1.6 ms ( 1 ) deep sleep rx regulator and xtal ramp up, register recovery, synthesizer on 1.65 ms ( 1 ) radio off rx listen synthesizer ramp up, power on rx front end 57 s radio off tx frame synthesizer ramp up, power on tx front end 52 s idle rx listen power on rx front end 6.8 s idle tx frame power on tx front end 1.3 s radio off sleep crystal power off 25 s sleep radio off crystal ramp up 1.4 ms ( 1 ) note 1: xtal ramp up time is depending on temperature. mini mum values 1 ms, typical value 1.4 ms, maximum value 3 ms 2: this time is referring to the complete discharge time on the internally regulated 1v2 bus and may depend on the actual capacitance on this network. 1v2 regulator ramp up: 200 sec at 0,3ma deep sleep: 40na xtal ramp up: 1400 sec at 1,1ma synthesiser on: 50 sec at 7ma lna ramp up: 6 sec at 13,5ma rx listen downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 93 mrf24xa figure 4-3: mrf24xa top level state machine (simplifies state transition chart) legend: internal substate automatic transition user initiated transition rxlisten receiver on frame acquisition power off deep sleep initial calibration rx listen or rx listen psav init (rst=0) init (rst=1) radio off radio in pin reset tx frame rx frame 1. mcu releases rst 2. power is turned on 3. spi-read causes wake-up 7. (if rxen=0 ) 8.(if rxen=1) 11. mcu sets dsleep 4. sleep 5. 9. mcu sets xtaldis 10. mcu clears xtaldis idle 6. 12. mcu sets xtaldis 1 3 . m cu s e t s r x e n 15. mcu clears rxen 14. mcu sets rxen 17. mcu sets txst 11. 19. 16. mcu sets txst 21. 22. 23. 20. 11. 18. mcu sets txst note: see section 4.2.4.2 detailed transition description for details on the interrupts in connection with state transitions. downloaded from: http:///
mrf24xa ds70005023c-page 94 preliminary ? 2015 microchip technology inc. frame sending/reception involves the following steps as shown in the figure 4-4 . (note: sending = originator, receiving = recipient) 1. originator and recipient nodes apply the previ- ously shared (negotiated/ global) configurations. 2. recipient mcu enables reception in the device when the rxen (1) control bit in the rxcon1 register is set. 3. originator mcu constructs the payload. 4. originator mcu constructs the mac frame header applying the per frame configurations. 5. originator mcu loads the mac frame to the device. 6. originator mcu starts transmit operation when the txst (1) control bi t (maccon1 register) in the device is set. mac layer encryption is automatically applied while for network layer encryption 7. originator device executes in-place processing on the frame. for example, encryption and fcs appending, and checks the configuration of the frame header that affects the per frame device behavior for this frame (whether an acknowl- edge is requested from the recipient). 8. originator device attempts to send the message to the receiver devi ce. prior accessing the medium, ensure that no other device is using it on the same channel frequency, or jammed by interferers before sending. the applied proce- dure is called csma-ca. when the channel is clear, it sends the fram e. finally, the device waits for an acknowledge as the frame is config- ured to request one. 9. recipient device receives the frame and parses it. the frame is accepted . the frame can also be rejected due to destination address or fcs mis- match. 10. recipient device sends an ack. 11. recipient device generates an rxif (1) inter- rupt to its host mcu when ack-sending is complete. since the frame is accepted and acknowledged, rxbufful is set (1) by the device. this protects the frame from being over- written by a subsequ ent different frame. 12. recipient mcu may trigger in-place processing (for example, decryption by setting rxdec) on the frame after servicing the interrupt. 13. originator device fails to receive the ack-frame. therefore, it starts ov er transmitting the same frame (retransmission) through csma-ca first and then sending follows. 14. recipient device receives the retransmitted frame and finds out it is a duplicate. it still sends another ack-frame to it, but discards the duplicate frame. 15. originator device receives the ack and gener- ates a txif (1) interrupt to confirm the success- ful sending to its host mcu. it also clears the txst (0) control/status bit. originator device returns to reception mode if rxen = 1 is configured, otherwise it turns to trxoff. 16. mcu services the interrupt (txif) to learn the confirmation. transacti on is successfully com- pleted. 17. recipient device completes the in-place decryp- tion of the frame and generates a rxdecif (1) interrupt to indicate status to its host mcu. 18. recipient mcu reads the decrypted frame from the buffer and unlocks the buffer when the con- trol/status flag rxbufful (0) of the device is cleared. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 95 mrf24xa figure 4-4: wireless sending: exampl e scenario (message sequence chart) in-place processing (whether transmitting or receiving- side) is tested using a single node. this is useful in device testing or software troubleshooting. figure 4-5 illustrates the procedure of in-place test using a single node. note that the originator and the recipient node can be the same hardware. txbuf1pp triggers the processing that txst origi- nally performs. txif interrupt is generated at the end of in-place processing, without attempting to physically send the frame. the device clears txbuf1pp at the same time. tx host mcu tx device rx device rx host mcu spi, intn medium spi, intn originator node recipient node tx configuration (autoacken=1) payload rx configuration (autoacken=1) mhr (secen=1) (ackreq=1) load buffer security key = when ack required then device handles it ackreq = acknowledge required for this frame wait for rxif interrupt wait for confirmation interrupt get ackreq, secen encrypt fcs append csma, send ? 10 8 7 6 5 4 2 1 1 3 send ack rxbuffull=1 rxif read mhr 11 12 secen=1 13 csma, resend ack time-out fcs check (accepted) 9 ack received send ack duplicate ! 14 rxec, security key wait for rxdec interrupt decrypt 15 new state depends on rxen decryption complete 16 confirmation done (interrupt serviced) 17 rxdecif interrupt serviced read payload 18 buffer unlocked wait for new frame free the buffer wait for new frame rxen 1 txst 1 txif=1, txst 0 rxbuffull 0 downloaded from: http:///
mrf24xa ds70005023c-page 96 preliminary ? 2015 microchip technology inc. buffer 1 holds the processed (encrypted, fcs- appended) frame. if rxbuf1pp is set, frame filtering is performed and rxif interrupt is generated. alternatively, the processing is performed in buffer 2 (the normal receive buffer) using txbuf2pp and rxbuf2pp. note that unlike txbuf1pp and txbuf2pp, rxbuf1pp and rxbuf2pp do not automatically clears when rxif is set but selects which buffer must be processed when rxdec is issued. figure 4-5: in-place test using a single node: example scenario (message sequence chart) tx host mcu tx device rx device rx host mcu spi, intn spi, intn node in originator role same node in recipient role tx configuration (autoacken=1) payload mhr (secen=1) (ackreq=1) load buffer security key autoacken is ?don?t care? ackreq is ?don?t care? wait for confirmation interrupt get ackreq, secen encrypt fcs append ? 10 7 6 5 4 2 1 rxif read mhr 11 12 secen=1 fcs check (accepted) 9 14 rxec, security key wait for rxdec interrupt txif decrypt decryption complete 16 confirmation done (interrupt serviced) 17 rxdecif interrupt serviced read payload 18 buffer unlocked wait for new frame free the buffer wait for new frame encrypted frame in tx buffer change role rx configuration (autoacken=x) wait for rxif interrupt 1 3 15 13 8 process tx buffer as if frame was received txbuf1pp 1 rxbuffull 0 rxen 1 rxbuf1pp 1 downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 97 mrf24xa 4.3 global vs. per node vs. per packet configurations for certain configurable parameters, the selected options apply to all nodes in a network. the following are the global attributes: the mac frame format used in the network (frmfmt register bit configuration) the fcs appending and checking method (refer to crcsz register bit) the medium access (csmaen register bit config- uration 4.3.1 global configurations global attributes are negotiated through management information travelling in the mac payload (of the current frame or a previo us frame). for example, address size in proprietary mac framing mode network layer security enabling and security material in ieee 802.15.4-compliant mac framing mode these global attributes are shared between all nodes of the network as all the nodes can access the same medium, and the sending and recipient sides must process the frame consistently. 4.3.2 per packet configurations as opposed to global configurations, per packet attributes vary from packet to packet. for example, acknowledge requested for the current frame (ackreq) security processing enabled for the current frame (secen) these attributes must be s hared between the originator and the recipient of the fram e and must travel with the packet. prior sending a frame, the originator mcu applies the desired attributes when the respective frame control bits (for exam ple, ackreq, secen) in the mac header of the frame ar e configured. when the send operation is triggered, the sending device checks these attributes and adapts its (frame processing and sending) behavior accordingly. the receiver device does the same on reception. 4.3.3 per node configuration it applies to specific nodes in the network, having a specific role. the auto-r epeater functionality (in proprietary mac mode) is a typical example. another case is how a node filters frames. a sniffer node must have different configuration than an ordinary node. this configuration may also be different since the sniffer must not send acknowledge. 4.4 features overview the device supports two framing modes: ieee 802-15.4 standard compliant, see section 5.0 ieee 802.15. 4? compliant frame format and frame processing format proprietary format, see section 6.0 proprietary frame format and frame processing hardware support is provid ed for both the features, but a network must only use one of these in all the nodes. a compromise is offered through bridging, see section 8.0 bridging . for the discussion it is helpful to distinguish between protocol agnostic and protocol dependent . configuration options: the availability and configuration format of proto- col dependent options are conditioned on the selected framing protoc ol whether ieee 802.15.4- compliant or proprietary network operation is required. in contrast, the availabi lity, behavior and configu- ration format of other options are protocol agnostic from a device point of view, which means that the configuration occurs similarly for framing protocol. all protocol agnostic options can freely combined with any of the protocol-dependent configurations as far as the device constrains it . to comply with the ieee 802.15.4 protocol, the constr aints specified in the stan- dards must be followed, see ta b l e 4 - 3 . figure 4-6 lists the higher level (mac layer) configura- tion features. fcs method: hardware supports the 2-byte long crc sequence adopted by ieee 802-15.4. this must be adequate for most applications. in the contrary case, the crc appending and checking are disabled if crcsz = 0 . if crcsz = 0 then autoacken = 0 and rxfilter = 0x00 is required. crcsz = 1 is assumed in the discus- sion. csma is described in section 4.11 carrier sense multiple access-collision avoidance (csma-ca) and only requires packet mode. automatic acknowledgement reception and sending is configured as specified in section 4.12 clear channel assessment (cca) , section 4.14 acknowledge sending by recipient and section 4.15 acknowledge reception by originator . downloaded from: http:///
mrf24xa ds70005023c-page 98 preliminary ? 2015 microchip technology inc. in both framing configur ations, the device offers support for: frame parsing, frame filtering, frame types, addressing modes applicable to multi-cast and uni-cast frames and security processing. standard mode operation is described in section 5.0 ieee 802.15.4? compliant frame format and frame processing . proprietary mode is described in section 6.0 proprietary frame format and frame processing through section 7.0 advanced link behavior in proprietary packet mode . the following modes are only available in propri- etary modes: bridging, link agility, see section 7.1 channel agility , and auto- repeater, see section 7.3 auto-repeater . table 4-2 lists a summary of possible node behaviors and node types. section 5.0 ieee 802.15.4? com- pliant frame format and frame processing focuses on the general pr ocessing of ieee 802.15.4- compliant and proprietary-format non-streaming frames when the node is non- streaming configured in packet mode. differences to this behavior are specified for the other scenarios in the respective sections. figure 4-6: mac layer configuration overview frame error detection protocolagnostic: communication aspects available options per packet or per node or global? trailer fcs by hw: yes/no? global option (typically, but not enforced) link reliability acknowledge request: yes/no? (if yes, # of retransmissions?) per packet option multiple access automatic ack response: yes/no? per node option csma: yes/no? per packet option protocoldependent: frame parsing ieee 802.15.4 vs. proprietary? global option ( exept for ?bridging ) frame filtering filters by validity, type, address per node option frame type type: data/cmd/ack/beacon...? per packet option multi-cast frames broadcast/unicast destination? per packet option address format dest. address/src. address format? per packet C in ieee 802.15.4 global C in proprietary mode mac layer security privacy: yes/no? frame authenticity: yes/no, mic-tag size? per packet enabling option nwk layer security per packet C in proprietary mode privacy: yes/no? frame authenticity: yes/no, mic-tag size? proprietary mode only: link agility air-data-rate adaptation: yes/no? adapt channel between tx/rx? per packet option buffer handling packet vs. streaming buffer mode per packet option auto-repeater auto-repeat mode per packet and per rx node option downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 99 mrf24xa table 4-2: summary of node configuration options node configuration packet mode propr. tx stream propr. rx stream ieee 802.15.4? proprietary proprietary repeater trxmode (00: packet mode) 00 00 00 10 01 frmfmt (std:0, proprietary:1) 0 1 1 1 1 autorpten (repeater node:1) 0 0 1 0 0 feature/frame node capability csmaen (csma enable:1) 0 or 1 0 or 1 0 or 1 0 no tx crcsz (crc 2 bytes: 1, none: 0) 1 (or 0) 0 or 1 0 or 1 0 or 1 0 or 1 autoacken (auto-ack enable:1) ( 3 ) 0 or 1 0 or 1 0 (or 1 ( 1 ) )0 0 , ignore 1 retransmission capability yes yes no no no buffer handling 1 rx, 1 tx 1 rx, 1 tx 2 trx 2 tx 2 rx with ieee 802.15.4 frames, capability to: tx, rx rx (tx) ( 4 ) (bridging) discard n/a discard with proprietary non-streaming type of frames (repeat:0/1), capability to: discard tx, rx repeat if repeat = 1 n/a discard with proprietary streaming type of frames, capability to: discard rx (sets on rx- streaming) discard tx rx security processing available available none available but impractical channel agility support for ack-ing no yes n/a n/a n/a phy-features same for all available data rates all ( 2 ) all all all all on-the-fly receiver rate adaptation yes yes yes yes yes dsss yes yes yes yes yes note 1: proprietary frames requesting both acknowledge and r epeat are not recommended if any of the repeaters has autoacken = 0 , and vice versa. setting all of these may cause issues. 2: although 250 kbps is the only data rate that ensu res compliance to the ieee 802.15.4 standard, however as an extension, the other data rates can also be us ed with the standard mac format, which may be easier to integrate with the legacy software. 3: crcsz = 0 has no practical use in standard-format mode. if crcsz = 0 then autoacken = 0 and rxfilter = 0x00 is required. 4: acknowledge sending is solved. to send a frame, the transmitter changes frmfmt for the sending. downloaded from: http:///
mrf24xa ds70005023c-page 100 preliminary ? 2015 microchip technology inc. register 4-1: maccon1 (mac control 1 register) address: 0x10 r/w-00 r/w-001 r/w-1 r/w-0 r/w-0 trxmode<1:0> addrsz<2:0> crcsz frmfmt secflagovr bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-6 trxmode<1:0>: tx/rx mode select field bits 11 = reserved 10 = tx-streaming mode . in this mode, use both buffers for packet transmission. when issuing trx- mode = 10 , rxen is cleared. spi addresses 0x200 to 0x27f access buffer 1 or buffer 2 in alternation. access to 0x37f through 0x383 has non-defined effect. 01 = rx-streaming mode . in this mode, use both buffers for packet receptio n. when issuing trxmode = 01 , txst and txenc/rxdec bits are cleared and rxen is set. spi addresses 0x300 to 0x383 access buffer 1 or buffer 2 in alternation. in th is mode, proprietary mode packets other than stream- ing type are automatically discarded. access to 0x200 through 0x283 has non-defined effect. 00 = packet mode . in this mode, buffer 1 is used as a transm it and buffer 2 is used as a receive packet buffer. spi addresses from 0x200 to 0x27f access buffer 1. spi addresses 0x300 to 0x383 access buffer 2. trxmode = 00 is mandatory when frmfmt = 0. bit 5-3 addrsz<2:0>: source/destination address size field bits ( 1, 2 ) the size of the source and destination addresses for pr oprietary packet. note that this field has no effect on the processing ieee 802.15.4 frames. 111 = 8 octets 110 = 7 octets 101 = 6 octets 100 = 5 octets 011 = 4 octets 010 = 3 octets 001 = 2 octets 000 = 1 octet bit 2 crcsz: crc size bit this bit indicates the size of the crc field in each packet. 1 = 2 octets 0 = 0 octet bit 1 frmfmt: mac frame format adopted by the network bit ( 3 ) this bit determines the frame format used in the network. 1 = proprietary 0 = ieee 802.15.4 standard compliant bit 0 secflagovr: security flag override bit the user can override security flags used in the ccm-ctr, cbc-mac and ccm operation, otherwise the device uses the standard (2003/2006) definition. note 1: zero-length address occurs when the corresponding daddrpr snt/saddrprsnt bits of the packet frame con- trol field are set to 0 . 2: use the addrsz field while re ceiving and transmitting, and must not be modified while rxen or txst is set. 3: use the frmfmt field while receiving and transmitting, and must not be modified while rxen or txst is set. in debug mode, this register bit is used to determine the frame format for bo th tx/rx frame in the packet buffers. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 101 mrf24xa 4.5 protocol selection and constraints applications typically fall into two categories: category 1: standard compliant operation is required exclusively category 2: standard compliant operation is not required, capability to form a gateway to standard network is sufficient: - green-field development. proprietary mac framing is optimal. - legacy software is better served when the standard mac frame format is applied, although the network is not required to use ieee 802.15.4 standard modulation formats over the air. in category 1, the proprieta ry features are not used. the constraints listed in ta b l e 4 - 3 must be applied. a significant limitation is th at ieee 802.15.4 only allows using a single air-data-rate, 250 kbps. in category 2, these constraints are relieved and the network may either adopt the proprietary (frmfmt = 1 ) or the ieee 802. 15.4 mac (frmfmt = 0 ) frame for- mats which fits better with the conditions. in either options, the network can use all the air-data-rates. a gateway to a standard network is formed through bridging, see section 8.0 bridging . the physical layer configuration is described in section 9.0 physical layer functions . table 4-3: the ieee 802.15. 4? standard constraints parameter description register field default on reset ieee 802.15.4? constraint/recommendation frame format frmfmt 0 0 (std. frame format) buffer handling trxmode 00 00 (packet mode) sender data rate dr<2:0> 011 011 (tx 250 kbps) receiver data rate reject filter (otherwise data rate is adapted on-the-fly, per frame) ratecon<7:2> 000000 (all enabled) 111101 (only enable: rx 250 kbps, sfd = 0xa7) fcs (crc) size (0 or 2 bytes) crcsz 1 1 (2 byte crc appended) frame rejection on crc mismatch crcrej 1 1 (crc match enforced) frame rejection filter rxfilter<7:0> 0x7f 0x40 (frame rejection only on crc mismatch) duplicate rejection identrej 0 1 (discard duplicates) automatic acknowledge handling (send/re ceive) autoacken 0 1 (auto ack enabled) base time units applied by txackwait and rxackwait basetm<4:0> 00010 (2 s) 10000 (must be a divisor of 16 s) wait duration (in base units) before acknowledge sending (by the data frame recipient) rxack- wait<7:0> 0x60 0x0c (must be >= 192 s) time-out duration (in base units) for acknowledge reception (by the data originator) txackto<7:0> 0x80 (256 s) 0x36 (must be >= 864 s) csma medium access enabled csmaen 1 1 (csma enabled) cca mode (energy vs. carrier) ccamode (1) 01 01 (4 options allowed) cca measurement duration ccalen (1) 01 10 (128 s) cca energy threshold edthreshold (1) 0x32 (-88 dbm) 0x46 (-78 dbm; must be <-75 dbm energy detect mode (1: 128 us, 0: variable dura- tion) edmode ( 1 ) 0 0 (edlen applies) energy detect duration edlen ( 1 ) 0xe 0xe (15.360 ms; must be repeated multiple times) note 1: for more information on physical layer configuration, see section 9.0 physical layer functions . note: proprietary is not equivalent to full-custom. the length field and frame control field must be used as described. (the transmitter processing of the framec trl.secen bit cannot be disabled.) the payload portion can still carry customized management information t hat is processed in software. it is recommended that frmfmt = 1 be used with nstdrej = 1 if a gateway is not required. downloaded from: http:///
mrf24xa ds70005023c-page 102 preliminary ? 2015 microchip technology inc. 4.6 frame-on-air/air-data-rate in the originator of the frame, frmfmt and dr<2:0> select the air-data-rate and the frame format. the prmbhld bit indefinitely holds out the preamble. for more information on register definitions, refer to register 4-2 . the recipient of the frame can receive the frame formats that frmfmt and ratecon<7:2> selects. the recipient sends the acknowledge using the same frame format as the acknowledged frame, except for the agility, see section 7.1 channel agility . the originator must set ratecon<7:2> adequately to receive the ack frame. ratecon<1> selects between legacy and optimal phy frame format. this is set independently from the rate or the mac protocol using the mac operation. figure 4-7: frame-on -air/air-data-rate preambulum sfd mac frame length ? preamble type: legacy: 192 s fix optimal: duration scales reciprocally with dr frmfmt: 0 ieee 802.15.4? standard compliant 1 proprietary prmbhld downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 103 mrf24xa register 4-2: ratecon (rate configuration re gister) address: 0x36 r/w-0 r/w-0 r/w-0 r/w-0 r/w-0 r/w-0 r/w-1 r/w-1 dis2000 dis1000 dis500 dis250 disstd dis125 optimal psav bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 dis2000: disable 2 mbps frame reception bit if this bit is set, then recept ion of 2 mbps frames is disabled. bit 6 dis1000: disable 1 mbps frame reception bit if this bit is set, then recept ion of 1 mbps frames is disabled. bit 5 dis500: disable 500 kbps frame reception bit if this bit is set, then reception of 500 kbps frames is disabled. bit 4 dis250: disable 250 kbps frame reception bit if this bit is set, then reception of 250 kbps frames with non-standard-compliant sfd patterns is disabled. bit 3 disstd: disable ieee 802.15.4 compli ant frame reception bit if this bit is set, th en reception of 250 kbps frames with ieee 802.15.4 compliant sfd patterns is disabled. bit 2 dis125: disable 125 kbps frame reception bit if this bit is set, then reception of 125 kbps frames is disabled. bit 1 optimal: optimized preamble selection bit when this bit is set, then optimi zed preamble is used instead of legacy. 1 = optimized preamble 0 = legacy preamble bit 0 psav: power-save mode selection bit when this bit is set, frame detection is dependent on the rssi signal, and the receive signal processor is turned on when a sudden and significant increase ( psavthr<3:0>) is detected in the signal strength or the signal strength is above an absolute level (desensthr<3:0>). 1 = power-save mode 0 = hi-sensitivity mode downloaded from: http:///
mrf24xa ds70005023c-page 104 preliminary ? 2015 microchip technology inc. register 4-3: maccon1 (mac control 1 register) address: 0x10 r/w-00 r/w-001 r/w-1 r/w-0 r/w-0 trxmode<1:0> addrsz<2:0> crcsz frmfmt secflagovr bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-6 trxmode<1:0>: tx/rx mode select field bits 11 = reserved 10 = tx-streaming mode . in this mode, use both buffers for packet transmission. when issuing trx- mode = 10 , rxen is cleared. spi addresses 0x200 to 0x27f access buffer 1 or buffer 2 in alternation. access to 0x37f through 0x383 has non-defined effect. 01 = rx-streaming mode . in this mode, use both buffers for packet reception. when issuing trx mode = 01 , txst and txenc/rxdec bits are cleared and rxen is set. spi addresses 0x300 to 0x383 access buffer 1 or buffer 2 in alternation. in this mode, proprietary mode packets other than stream- ing type are automatically discarded. access to 0x200 through 0x283 has non-defined effect. 00 = packet mode . in this mode, buffer 1 is used as a transmit while buffer 2 as a receive packet buffer. spi addresses from 0x200 to 0x27f access buffer 1. spi addres ses 0x300 to 0x383 access buffer 2. trxmode = 00 is mandatory when frmfmt = 0 . bit 5-3 addrsz<2:0>: source/destination address size fields bits ( 1, 2 ) the size of the source and destination addresses fo r proprietary packet. note that this field has no effect on the processing ieee 802.15.4 frames. 111 = 8 octets 110 = 7 octets 101 = 6 octets 100 = 5 octets 011 = 4 octets 010 = 3 octets 001 = 2 octets 000 = 1 octet bit 2 crcsz: crc size bit this bit indicates the size of the crc field in each packet. 1 = 2 octets 0 = 0 octet bit 1 frmfmt: mac frame format bit adopted by the network bit ( 3 ) this bit determines the frame format used in the network. 1 = proprietary 0 = ieee 802.15.4 st andard compliant. bit 0 secflagovr: security flag override bit the user can override security flags used in the ccm-ctr, cbc-mac and ccm operations, otherwise the device uses the standard (2003/2006) definition. note 1: zero-length address occurs when the corresponding daddrpr snt/saddrprsnt bits of the packet frame con- trol field are set to 0 . 2: use addrsz field while receiving and transmitting, and must not be modi fied while rxen or txst is set. 3: use frmfmt field while receiving and transmitting, and must not be modified while rxen or txst is set. in debug mode, this register bit is us ed to determine the frame format for both tx/rx frame in the packet buf- fers. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 105 mrf24xa register 4-4: bbcon (baseband configurat ion register) address 0x38 r/w-0 r/w-0 r/w-11 r/w-0 r/w-001 rndmod afcovr rxgain<1:0> prmbhold prmbsz<2:0> bit 7 bit 0 legend: w = writable bit r = readable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 rndmod: random modulation bit if this bit is set, the transmitter randomly trans mits dsss symbols or msk chips if prmbhold bit is set. the purpose of this register is only for testing. bit 6 afcovr: afc override bit if this bit is set, the receiver uses cfomeas register as the cfo in reception. bit 5-4 rxgain<1:0>: receiver gain register field bits if this bit is set, the agc operation is inhibited in the receiver and the receiver radio gain configuration is selected between three different gain levels. encoding: 11 = agc operation is enabled (default value) 10 = high gain 01 = middle gain 00 = low gain this feature is used for test and streaming purposes. to reduce the required interframe-gap, the rxgain must set to one of the fixed gain opti ons when the mac is in streaming mode. bit 3 prmbhold: preamble hold enable bit effect: appends extra bytes to the transmitted pr eamble in endless repetition until it is cleared. details: the hardware checks this bit during transmission before finishing the preamble. the dr<2:0> and the register optimal determine the appropriat e preamble byte and applies the modulation format. when this flag is released the transmission of the cu rrent preamble byte is completed followed by trans- mitting the length field and the payload. 1 = enable endless preamble repetition 0 = disable/stop endless preamble repetition bit 2-0 prmbsz<2:0>: preamble size adjustment field bits enables adjusting the transmitted preamble length when optimal = 1 . encoding: 500 kbps preamble length = (prmbsz<2> + 4) units, where unit = 16 s (1 octet at 500 kbps) 1 mbps preamble length = (prmbsz<1 :0> + 8) units, where unit = 4 s (1 octet at 2 mbps) 2 mbps preamble length = (prmbsz<1 :0> + 8) units, where unit = 4 s (1 octet at 2 mbps) this register field does not affect the lega cy frames and 125/250 kbps optimized frames. downloaded from: http:///
mrf24xa ds70005023c-page 106 preliminary ? 2015 microchip technology inc. 4.7 security suites mrf24xa provides extensive hardware support for security suites defined in 802.15.4-2003/2006 stan- dard. the security suites are based on the aes-128 block cipher transformation. block ciphers are ciphers that work on a plaintext bl ock of a fixed length to pro- duce a ciphertext block of the same length. given a particular key ( k ), there is a 1-to-1 correspondence between the plaintext block ( p ) and the ciphertext block ( c ). encryption operation: c i = e k (p i ) ciphertext block ( i ) is produced by encrypting plaintext block ( i ) using key k. decryption operation: p i = d k (c i ) plaintext block ( i ) is produced by decrypting ciphertext block ( i ) using key k. 4.7.1 electronic code book mode (ecb) the simple usage of the block cipher is known as ecb mode. there are several issues in using a block cipher in ecb mode to encrypt data. each plaintext block is encrypted to the same ciphertext block and it is possi- ble to associate the ciphertext block with an event with- out knowing that the plaintext block itself. to trigger the event, user can resend the ciphertext block, a process known as replay attack. in addition, most block cipher algorithms in ecb mode do nothing to scramble repet- itive data, making the plaintext block reversible from the ciphertext block. 4.7.2 counter mode (ctr) in ctr mode, each chipertext block is produced by xor'ing, the plaintext block with the encrypted version of a counter input. the initial value of the counter serves as the initialization vector (iv) for the message block, and may be changed for each message block. although the term counter is used, this does not man- date the use of a true counter. an easy-to-compute function, which is practically non-repeating (at least for a long time) may be used. ctr mode may be 100% parallelized for both encryption and decryption. 802.15.4-2003 defines ctr mode as follows: ctr 0 = 0 loop on each 16 byte block of plaintext c i = p i xor e k ({encflags, secnonce, ctr i }) ctr i +1 = ctr i +1 end where, encflags is defined by the standard (0x82), secnonce is defined in the standards and ctri is a 2 byte block counter. if the last block of the plaintext is not 16 byte, it is zero-padded and only the required number of msb bytes is used in th e xor operation. the host can override encflags field when the secflagovr bit in maccon1 register is enabled, and the new flags through secencflag register is set. the host can overwrite the secnonce r egister anytime through secnonce1..13 registers. 802.15.4-2006 does not define ctr mode. 4.7.3 cipher block chaining mode (cbc) in cbc mode, each plaintext block is xored with the result of the previous block encryption operation before being encrypted. in this way all plai ntext blocks depend on the previous block, making it difficult to remove, add or change individual blocks without detection. in addi- tion, the encryption for the fi rst block is performed using xor of the plaintext block and an initial value (iv). this initial value changes for each message, making it more resistant to replay attacks. mrf24xa does not support cbc mode. 4.7.4 cipher block chaining message authentication code mode (cbc-mac) a cbc-mac protects the authenticity of a message, and therefore implicitly its in tegrity. the algorithm takes the variable length input message and a secret key, and produces a mic tag (mic and mac terms are often used interchangeably). any change to the content of the message results in a change of the mic tag, which guarantees the integrit y of the message. as the same message with a different secret key also pro- duces a different mic tag, a mac mode also provides protection of authenticity. 802.15.4-2003 defines cbc-mac mode as follows: p = {length, machdr, macpayload} o 1 = e k (p 1 ) loop on each 16 byte block of plaintext o i = e k (p i xor o i -1 ) end mictag is the leftmost m bit of o end where length is the number of bytes to be authenti- cated (mac header and payload). 802.15.4-2006 does not define cbc-mac mode. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 107 mrf24xa 4.7.5 authenticate and encrypt block cipher mode (ccm*) this mode is a combination of ctr mode (encryption) and cbc-mac mode (authentication). initially, cbc- mac is applied to compute the mic tag. ctr mode (encryption) is only performed on a selected portion of the authenticated message and the mic tag. different combination of authentication and encryption are formed. 802.15.4-2003/2006 defines ccm* mode as follows: p = {authentication flag, nonce, length, mac- header, macpayload} o 1 = e k (p 1 ) loop on each 16 byte block of plaintext o i = e k (p i xor o i-1 ) end mictag is the leftmost m bit of o end authentication flag : reserved || adata || m || l 4.8 buffer processing in non-secured sending general frame proces sing as shown in figure 4-8 , applies when autorpten = 0. unsecured frame (secen = 0 ) is not an acknowledgement and crcsz = 1 . acknowledgement is transmitted or received by software (autoacken = 0 ) and crcsz = 1 (ack may contain piggyback data in the payload, at the discretion of the host software). in figure 4-8 , note the following: transmit buffer is the buffer starting at 0x200, whereas the receive buffer is the buffer starting at address 0x300 (this also applies for streaming mode). in the transmit buffer, fcs is automatically appended to the frame, and the length field is also automatically incremented. the receive buffer holds the fcs appended frame, and the according length. rsv is appended to the frame. note the ordering of the rsv fields. rsv appending does not affect the length field. the following cases are not described in this data sheet: processing of secured frames (secen = 1 ) is pre- sented in section 5.3 security material . when ackreq = 1 (implying txrxmode = 00 , crcsz = 1 ), then the acknowledge frame is gen- erated or accepted on-the- fly: without writing or reading the buffers (if crcsz = 0 then the crc appending does not take place and acknowledge is always processed by software: autoacken = 0 ). repeater mode is described in section 7.3 auto-repeater . figure 4-8: general frame processing tx buffer loaded: tx buffer processed: txst set by host length mhr payload length mhr payload crc rxif interrupt received, rxbufful is set. (rsv appending enabled in: rxcon2) length mhr payload crc rx buffer holds rsv /length up to payload /length up to crc / if crcsz = 1 in transmitter /length up to crc / if crcsz = 1 in receiver mac frame downloaded from: http:///
mrf24xa ds70005023c-page 108 preliminary ? 2015 microchip technology inc. 4.9 frame transmission in packet mode figure 4-9: transmitter processing in packet mode txst 1 select buf1 tx mhr parsing parsable? tx security processing fcs appending txszif txst txretccnt 0 csma-ca ack required? ack received? acknowledge reception txcsmaif increment txretccnt txretccnt >= txretmcnt buf1txpp 1 buf2txpp 1 select buf2 in place processing test frmif 1 if crcsz = 1 1 size run over 127 bytes: txszif = 1 no (sending complete) txif 1 reset retransmission count 1 medium access failure: txcsmaif = 1 txif 1 yes (success) txif 1 yes (failure) max. retransmissions reached no buf1txpp 0 buf2txpp 0 txst 0 txbufempty 1 interrupt service ackreq = 1 fail (invalid format) if required 0 (in-place test only) txif 1 0 1 0 yes no select buf1 figure 5-7 figure 5-9 figure 4-12 pass downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 109 mrf24xa register 4-5: txcon (transmi t control regi ster) address: 0x12 r/w/hc-0 r/w-0 r/w/hc-0 r/hs/hc-1 r/w-1 r/w-011 txst dtsm txenc txbufempty csmaen dr<2:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 txst: transmit start bit 1 = starts the transmission of the next tx packet ( 1, 2 ) . 0 = termination of current tx operation, which may result in the transmission of an incomplete packet hardware clear: after the packet is successfully transmitted (including all attemp ted retransmissions, if any), the hardware clears this bit and sets the txif and idleif. if the packet transmission fails due to a csma failur e, then this bit is cleared, and txcsmaif is set. if acknowledge is requested (ackreq bit field in the transmitted frame is set) and not received after the configured number of retransmissions (txretmcnt), then txst bit is cleared and a txackif is set. in tx-streaming mode (trxmode), txst is set ev en when it is already set, resulting in a posted start. when the current tx operation co mpletes, the posted start immediately starts afterward. clearing of the txst bit clears both the current and the posted (pending) tx starts. txovfif is set when txst = 1 , a posted start is present and a host controller write to the packet buffer occurs. outside of tx-streaming m ode, writes to txst when txst is already set is ignored. clearing this bit aborts the current operation in the following cases: when transmitting a packet in packet mode or in tx-streaming mode when waiting for an ack packet after a transmission during the csma ca algorithm when transmitting a repeated frame this field is read at any time to dete rmine if the tx operation is in progress. bit 6 dtsm: do not touch security material bits ( 2 ) 1 = device do not change the security material configured by the host mcu 0 = device tries to configure the security material related registers mcu must fill the following registers: secnonce, sechdrindx, secpayindx and secend- indx. bit 5 txenc: tx encryption setting this bit starts tx security processing (authenti cation or encryption, or bot h) of the packet in the buffer it was last written. txenc is cleared a nd txencif is set when the processing is complete. txenc must be issued when nwk layer security mu st be processed. 802.15.4-2003/2006 mac layer security operation is automatically performed when t xst bit is set. this field must not be modified while txst is set. note 1: transmission may include automatic security proc essing, crc appending, csma-ca channel access, acknowledge reception and retransmissions depending on the register configurati on and the frame control field of the frame to be transmitted. 2: setting txst bit in either sleep/rfoff state, de vice transits to tx st ate for packet transmission. downloaded from: http:///
mrf24xa ds70005023c-page 110 preliminary ? 2015 microchip technology inc. bit 4 txbufempty: tx buffer empty bit txbufempty = 1 indicates that the host mcu can safely start writing a new frame to the buffer with- out overwriting any content that is in use. writing a single byte to the buffer causes this bit to be cleared. txbufempty = 0 does not prevent the host from writing further bytes to the buffer. txbufempty is set by the device when transmission is complete. 1 = mcu can safely start writing a new frame to the buffer 0 = buffer is full, or being written to when trxmode = 00 : (packet) mode is configured then txbufempty is set at the same time as txst is cleared. an interrupt is also generated. therefore, this bit provides no extra information. when trxmode = 10 : (txstreaming) mode is configured then txbufempty is set at the same time as one of the buf- fers becomes free, while txst may be set. therefore, the host mcu uses txbufempty to ensure that it can start loading the next frame to the buffers without overwriting a packet being sent (txovfif). bit 3 csmaen: csma-ca enable bit this bit enables csma-ca algorithm before transmission. 1 = csma-ca enabled 0 = csma-ca disabled bit 2-0 dr<2:0>: transmit data rate field bits 111 = reserved 110 = 2 mbps 101 = 1 mbps 100 = 500 kbps 011 = 250 kbps 010 = 125 kbps 001 = reserved 000 = reserved when transmitting an auto-ack frame with adaptive da ta rate in response to a received frame, the ackdatarate field in the received frame automatic ally determines the data rate of the phy, and not by this register field. in all other cases, use th is register field as the current phy data rate when transmitting. the phy determines the data rate for all received frames regardless of this register field and the adaptive data rate configuration. for more information, refer to register 4-2 . note 1: transmission may include automatic security proc essing, crc appending, csma-ca channel access, acknowledge reception and retransmissions depending on the register configuration and the frame control field of the frame to be transmitted. 2: setting txst bit in either sleep/rfoff state, devi ce transits to tx state for packet transmission. register 4-5: txcon (transmit cont rol register) (continued) address: 0x12 downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 111 mrf24xa register 4-6: pir2 (peripheral interrupt register 2) address: 0x05 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 txif txencif txmaif txackif txcsmaif txszif txovfif frmif bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 txif: transmission done interrupt flag bit the current tx operation (txst) his successfully completed. this event is unchanged when a hardware generated ack packet is transmitted or when a packet is repeated. nonpersistent, cleared by spi read. bit 6 txencif: transmit encoding interrupt flag bit the tx packet was successfully encrypted or comp lemented, or both with a message integrity code (mic). set by the device after txenc = 1 , when txenc is cleared. nonpersistent, cleared by spi read. bit 5 txmaif: transmitter medium access interrupt flag bit set by the device when the medium is accessed, spec ifically when the first sample in the preamble is transmitted into the air. nonpersistent, cleared by spi read. bit 4 txackif: transmission unacknowledged failure interrupt flag bit set by the device when acknowledge is not received after the configured maximum number of trans- mission retries retxmcnt<3:0>, provided that the fram e control field of t he transmitted frame indicates ackreq = 1 . nonpersistent, cleared by spi read. bit 3 txcsmaif: transmitter csma failure interrupt flag bit set by the device when csma-ca finds the channel busy for bomcnt<2:0> number of times, provided that csmaen = 1 is configured. nonpersist ent, cleared by spi read. bit 2 txszif: transmit packet size e rror interrupt flag bit following txst is set the packet size (including mic tags and crc) is found to be zero or to be greater than the maximum size that the buffers can support. nonpersistent, cleared by spi read. bit 1 txovfif: transmitter overflow interrupt flag bit the host controller attempted to write a tx buffer that was not empty (txbufempty = 0 ). nonpersistent, cleared by spi read. bit 0 frmif: frame format error interrupt flag bit set if the transmitter/receiver fails to parse the fram e in the buffer (it is not as it must be or it is corrupted in demodulation). downloaded from: http:///
mrf24xa ds70005023c-page 112 preliminary ? 2015 microchip technology inc. register 4-7: pir4 (peripheral interrupt register 4) address: 0x07 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 txsfdif rxsfdif errorif warnif edccaif gpio2if gpio1if gpio0if bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 txsfdif: transmit sfd sent interrupt flag bit set by the device when the last sample of the sfd fi eld is sent into the air. nonpersistent, cleared by spi read. bit 6 rxsfdif: receive sfd detected interrupt flag bit set by the device when the sfd field of the receiv ed frame is detected. nonpersistent, cleared by spi read. bit 5 errorif: general error interrupt flag bit set by the device, when ma lfunction state is reached. bit 4 warnif: warning interrupt flag bit set by the device when one of the following occurred: battery voltage drops below the threshold given by batmon<4:0> resistor on pin 28 is missing or not connected well bit 3 edccaif: energy detect/cca done interrupt flag bit set by the device when energy-detect or cca meas urement is complete (following that the host mcu has set the edst/ccast bit to start the measurement and the device is clearing it in on completion). nonpersistent. cleared by spi read. bit 2 gpio2if: gpio2 interrupt flag bit set by the device if the gpiomo de register is set to normal operation, the gpio is enabled and configured to input and the level matches with the polarity. bit 1 gpio1if: gpio1 interrupt flag bit set by the device if the gpiomo de register is set to normal operation, the gpio is enabled and configured to input and the level matches with the polarity. bit 0 gpio0if: gpio0 interrupt flag bit set by the device if the gpiomo de register is set to normal operation, the gpio is enabled and configured to input and the level matches with the polarity. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 113 mrf24xa 4.10 frame reception in packet mode figure 4-10: receiver operation (if autorpten = 0 ) mcu:rxen 1 while txst = 0 txst 0 while rxen = 1 rxlisten operation frame acquired? rxsfdif 1 frame reception mcu:edst/ccast 1 while in rxlisten mcu:rxen 0 mcu:txst 1 while in rxlisten abort rxlisten or frame reception enter rxlisten operation disabling acquisition do ed/cca measurement edccaif 1 abort rxlisten or frame reception abort rxlisten or frame reception do transmission txst 0 by device or abortion: txst 0 by host no yes abort events downloaded from: http:///
mrf24xa ds70005023c-page 114 preliminary ? 2015 microchip technology inc. figure 4-11: frame reception in packet mode (trxmode = 00 ) rxsfdif 1 by device buf2 selected rxbufful? lentgh and mac frame written into buffer rsv appending mhr parsing parsable? fcs-check rxfilter rejected? rxidentif 1 if duplicate ack required? auto ack-sending rxidentif security material retrieval support rxbufful 1 rxif 1 exit with success (rxbufful = 1 ) buf1rxpp 1 buf2rxpp 1 buf1 selected buf2 selected frmif 1 rxfltif 1 exit with failure packet discarded (rxbufful = 0 ) software reads the buffer content, may decide on proceeding to security processing ( ); finally, frees up the buffer by clearing rxbufful. duplicate? rxovfif 1 exit with failure. packet discarded. earlier packet kept. (rxbufful = 1 ) acknowledge must be sent for duplicated frames if ackreq = 1 . frame received over the medium frame loaded to buffer for debug ackreq = 0 or autoacken = 0 or debug (buf1rxpp or buf2rxpp) fail yes (discard) no no (accepted) rxidentif 1 acknowledge sending is always bypassed in debug yes no 1 0 pass yes 1 0 figure 4-13 figure 5-15 figure 5-16 downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 115 mrf24xa register 4-8: rxcon1 (mac rece ive control 1 register) address: 0x15 r/w/hc/hs-0 r/w-0 r/w/hc-0 r/w-1 r/w-1 r/w-1 r/w-1 r-0 rxen nopa rxdec rsvlqien rsvrssien rsvchdren rsvcfoen r bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 rxen: receive enable field bit this bit enables/disables the packet reception. if an rx packet is currently being received, clearing this bit causes that packet to be discarded. 1 = rx enabled 0 = rx disabled hardware clear/set when: cleared when trxmode is set to tx-streaming mode set when trxmode is set to rx-streaming mode clearing this bit aborts the curr ent operation in the following cases: receiving a packet in packet mode or in rx-streaming mode changes to most rx related settings must be only done when this bit is cleared. the clear channel assessment (csmaen) and ack-frame reception does not require rxen = 1 as the device turns the radio into rx when needed, ir respective of the status of the rxen bit. bit 6 nopa: no parsing bit this bit disables packet parsing. only crc is checked if it is enabled. this feature is useful in sniffer mode.1 = disable packet parsing 0 = enable packet parsing bit 5 rxdec: rx decryption bit setting this bit starts rx security processing ( authentication or decryption, or both) on the last received packet. 1 = rx security processing started/in process. rxdecif or rxtagif is set. 0 = rx security processing inactive or complete this bit clears itself after rx decryption is completed. bit 4 rsvlqien: receive status vector lqi enable bit if this bit is set, the measured link quality is appended after the received frame in the packet buffer. 1 = append lqi field 0 = do not append lqi field bit 3 rsvrssien: receive status vector rssi enable bit if this bit is set, the measured rssi is appended after the received frame in the packet buffer. 1 = append rssi field 0 = do not append rssi field bit 2 rsvchdren: receive status vector channel/mac type/data rate enable bit if this bit is set, channel, mac type and data rate configurations used with the received frame are appended after the received frame in the packet bu ffer, using the encoding specified for ch<3:0>, frmfmt and dr<2:0> (concatenated in this order when most significant bit (msb) is first). 1 = append channel, mac type and data rate fields 0 = do not append channel, mac type and data rate fields bit 1 rsvcfoen: receive status vector cfo enable bit if this bit is set, the estimated carrier frequency offset of the received frame is appended after the received frame in the packet buffer, using the same encoding as cfomeas register. 1 = append cfo estimation 0 = do not append estimated cfo bit 0 reserved: maintain as 0 downloaded from: http:///
mrf24xa ds70005023c-page 116 preliminary ? 2015 microchip technology inc. register 4-9: rxcon2 (mac receive control 2 register) address: 0x16 r/c/hs-0 r/w-0 r-0 r/w-0 r/w-0 r/w-0 r/w-0 r/w-0 rxbufful identrej ackrxfp acktxfp au torpten autoacken adptchen adptdren bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 rxbufful: rx buffer full bit host mcu clears this bit to indicate that the rx pack et is processed. if this bit is uncleared before the next valid rx packet is detected (packet is not a dupl icate, pass rx filter, and so on), then the device sets rxovfif and the buffer content is unmodified, where rxbufful = 1 locks write access by a new frame. moreover, the host can both read and write to the buffer or perfo rm security processing. in trxmode = 00 (packet) mode: 1 = receive buffer content is yet to be read by th e host or processed, and cannot be overwritten by a new frame 0 = receive buffer is free for receiving a new frame in trxmode = 01 (rxstreaming) mode: 1 = current buffer being read from the bus contains a valid rx packet 0 = current buffer being read from the bus is empty bit 6 identrej: reject identical packet bit setting this bit enables the user to reject an incoming packet, in case its source address and sequence number is the same as the previously received packet. this bit is used whenever a packet is received a nd ack is transmitted, but the ack is never received that the sender resends the tx packet. when this happens, triggers for rxif is avoided for the second time for the same packet, thus, the second packet is ignored. this bit is also used when a packet is repeated and the next repeater repeats the same packet back. this packet is received, but ignored. 1 = any packet received with the same source address and sequence number as the last packet suc- cessfully received is discarded and rxidntif is thrown 0 = duplicated packets are processed further same as non-duplicated packets bit 5 ackrxfp: ack rx frame pending bit this read-only status bit reflects the value of the framectrl (framepend) bit in the last received 802.15.4 compatible ack frame. bit 4 acktxfp: ack tx frame pending bit the value of this bit is transmitted in the framec trl (framepend) bit slot when the mac sends an ack packet in 802.15.4 compatibility mode. bit 3 autorpten: auto-repeat enable bit if this bit is set, the mac automatically transmits a packet whenever a packet is received and its repeat bit is set. 1 = auto-repeat feature is enabled 0 = auto-repeat feature is disabled note 1: use adptchen field while receiving and transmitting, and must be unmodified while rxen or txst is set. 2: use adptdren field while receiving and transmitting, and must be unmodified while rxen or txst is set. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 117 mrf24xa bit 2 autoacken: auto-acknowledge enable bit setting this bit enables the devic e to automatically transmit an ack packet whenever a packet is received and its ackreq bit is set. 1 = automatic acknowledge processing enabled 0 = automatic acknowledge processing disabled bit 1 adptchen: adaptive channel enable bit ( 1 ) setting this bit enables the mac in proprietary mode to set the transmitting channel for the ack packet based on the ackinfo field (p roprietary packet) of the received pa cket, rather than the ch<3:0> register bits. 1 = adaptive channel feature is enabled 0 = adaptive channel feature is disabled this feature is also known as channel agility. for more information, see section 7.1 channel agility . bit 0 adptdren: adaptive data rate enable bit ( 2 ) setting this bit enables the mac in proprietary mode to set the transmission da ta rate for the ack packet based on the ackinfo field (proprietary packe t) of the received packet, rather than the dr<2:0> register bits. 1 = adaptive data rate feature is enabled 0 = adaptive data rate feature is disabled this feature is also known as channel agility. for more information, see section 7.1 channel agility . register 4-9: rxcon2 (mac receive control 2 register) (continued) address: 0x16 note 1: use adptchen field while receiving and transmitting, and must be unmodified while rxen or txst is set. 2: use adptdren field while receiving and transmitting, and must be unmodified while rxen or txst is set. downloaded from: http:///
mrf24xa ds70005023c-page 118 preliminary ? 2015 microchip technology inc. register 4-10: pir3 (peripheral interrupt register 3) address: 0x06 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 rxif rxdecif rxtagif r rxidentif rxfltif rxovfif strmif bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 rxif: received successful interrupt flag bit set by the device when a frame passed the packet filtering and accepted, refer to register 2-23 . this inter- rupt flag is set only once for a packet and is not set when the packet is the duplicate of a repeated transmis- sion (sequence number matches with the previously received frame). nonpersistent, cleared by spi read. bit 6 rxdecif: receiver decryption/authenticat ion passed interrupt flag bit set by the device when decryption/au thentication finished without error. nonpersistent, cleared by spi read. bit 5 rxtagif: receiver decryption/authenticat ion failure interrupt flag bit set by the device when decryption/authentication finished with error. nonpersistent, cleared by spi read. bit 4 reserved: maintain as 0 bit 3 rxidentif: received packet identi cal interrupt flag bit set by the device when the packet is the duplicate of a repeated transmission (sequence number and source address matches with the previously receiv ed frame). nonpersistent, cleared by spi read. bit 2 rxfltif: received packet filtered interrupt flag bit set by the device when a packet was received, bu t rejected by one or more rx filters, refer to register 2-23 . nonpersistent, cleared by spi read. bit 1 rxovfif: receiver overflow error interrupt flag bit set by the device to indicate that a packet was received, but all rx buffers are full. consequently, the packet was not received, but was discarded instead ( 1 ) . nonpersistent, cleared by spi read. bit 0 strmif: receive stream time-out error interrupt flag bit set by the device to indicate that the duration s pecified in strmto elaps ed since the last received packet while in rx-streaming mode, and the mac cl ears the stored sequence number. nonpersistent, cleared by spi read. note 1: in packet mode, use a single buffer for received fram es. in rx-streaming mode, use both buffers for recep- tion. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 119 mrf24xa register 4-11: pir4 (peripheral interrupt register 4) address: 0x07 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 txsfdif rxsfdif errorif warnif edccaif gpio2if gpio1if gpio0if bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 txsfdif: transmit sfd sent interrupt flag bit set by the device when the last sample of the sfd field has been sent into the air. nonpersistent, cleared by spi read. bit 6 rxsfdif: receive sfd detected interrupt flag bit set by the device when the sfd field of the received frame is detected. nonpersistent, cleared by spi read. bit 5 errorif: general error interrupt flag bit set by the device, when ma lfunction state is reached. bit 4 warnif: warning interrupt flag bit set by the device when one of the following occurred: battery voltage drops below the threshold given by batmon<4:0> resistor on pin 28 is missing or not connected well bit 3 edccaif: energy detect/cca done interrupt flag bit set by the device when energy-detect or cca meas urement is complete (following that the host mcu has set the edst/ccast bit to start the measurement and the device is clearing it in on completion). nonpersistent. cleared by spi read. bit 2 gpio2if: gpio2 interrupt flag bit set by the device if the gpiomo de register is set to normal operation, the gpio is enabled and configured to input and the level matches with the polarity. bit 1 gpio1if: gpio1 interrupt flag bit set by the device if the gpiomo de register is set to normal operation, the gpio is enabled and configured to input and the level matches with the polarity. bit 0 gpio0if: gpio0 interrupt flag bit set by the device if the gpiomo de register is set to normal operation, the gpio is enabled and configured to input and the level matches with the polarity. downloaded from: http:///
mrf24xa ds70005023c-page 120 preliminary ? 2015 microchip technology inc. register 4-12: pir2 (peripheral interrupt register 2) address: 0x05 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 txif txencif txmaif txackif txcsmaif txszif txovfif frmif bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7-1 out of scope bit 0 frmif: frame format error interrupt flag bit set if the transmitter/receiver fails to parse the frame in the buffer (it is not as it must be or it is corrupted in demodulation). for example, reserved values found in the mac header fields. nonpersistent, cleared by spi read. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 121 mrf24xa 4.11 carrier sense multiple access- collision avoidance (csma-ca) carrier sense multiple access-collision avoidance (csma-ca) is performed before transmitting a packet to increase the odds that the packet is successfully received without interference from other transmitting devices nearby. when enabled (csmaen = 1 ), the mac automatically performs csma-cs using the underlying clear channel assessment (cca) operation. csma-ca is only performed before transmitting a packet (excluding ack packets automatically transmitted during auto- acknowledge) in packet and repeater mode. 4.11.1 csma-ca configuration setting the csmaen register bit enables csma-ca. csma-ca is automatically executed when the txst register bit is set before the packet is transmitted. csma-ca is considered part of a transmission operation and it is aborted when the txst register bit is cleared, and not when the rxen register bit is cleared. the following register bits are used in the configuration of csma-ca: csmaen bomcnt<2:0> bounit<7:0> minbe<3:0> maxbe<3:0> 4.11.2 csma-ca back-off algorithm 1. wait a random number of base time units between 0 and (2 minbe -1) * bounit<7:0>. 2. perform a clear channel assessment (cca) operation. 3. if cca fails, then wait for a random number of base time units between 0 and (2 (minbe+1) -1) * bounit<7:0>. 4. repeat above two steps until cca passes, incrementing the back-off exponent each time, until the maximum ba ck-off time becomes (2 maxbe -1) * bounit<7:0>, or until the number of attempts is greater than bomcnt<2:0>. 5. if cca is failed, but the number of attempts is less than bomcnt<2:0 >, keep trying with a back-off time of (2 maxbe -1) * bounit<7:0> base time units until t he number of attempts is greater than bomcnt<2:0>, or cca passes. 6. if cca still fails, the tx csma error event is generated. mrf24xa automatically controls an external lna if enabled. note: if minbe = 0 , the first iteration of the csma algorithm performs a cca operation imme- diately without any backoff time. downloaded from: http:///
mrf24xa ds70005023c-page 122 preliminary ? 2015 microchip technology inc. register 4-13: tmrcon (timer control register) address: 0x19 r/w-100 r/w-00010 bomcnt<2:0 > basetm<4:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-5 bomcnt<2:0>: csma-ca back-off maximum count field bits the maximum number of back-off attempts that t he csma-ca algorithm tries before declaring a chan- nel access failure. 111 = reserved 110 = reserved 101 = 5 attempts 100 = 4 attempts 011 = 3 attempts 010 = 2 attempts 001 = 1 attempts 000 = 0 attempt bit 4-0 basetm<4:0>: base time field bits the number of 1 s clock cycles that a base time unit represents in all register settings. for more infor- mation, see section 4.1 mac architecture . downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 123 mrf24xa register 4-14: csmabe (csma-ca ba ck-off exponent control register) address: 0x1a r/w-0101 r/w-0011 maxbe<3:0> minbe<3:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-4 maxbe<3:0>: csma-ca back-off maximum count fields the maximum value of the back-off exponent (be) is in the csma-ca algorithm. the back-off time is (2 be -1) units. 1111 = reserved 1001 = reserved 1000 2 8 -1 = 255 maximum units of back-off time 0000 2 0 -1 = no back-off time bit 3-0 minbe<3:0>: csma-ca back-off minimum count bit the minimum value of the back-off exponent (be) is in the csma-ca algorithm. the back-off time is (2 be -1) units. 1111 = reserved 1001 = reserved 1000 2 8 -1 = 255 maximum units of back-off time 0000 2 0 -1 = no back-off time downloaded from: http:///
mrf24xa ds70005023c-page 124 preliminary ? 2015 microchip technology inc. register 4-15: bounit (back-off time unit register) address: 0x1b figure 4-12: csma-ca algorithm r/w-10100000 bounit<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-0 bounit<7:0>: csma-ca back-off period unit field bits the number of base time units for the basic back-off time unit used by csma-ca algorithm. 11111111 = 256 base time units 00000000 = 1 base time unit nb = 0 be = minbe <3:0> delay for a random number of back-off periods between 0 and 2^ be -1 perform cca channel idle? nb = nb +1 be = min (be + 1, maxbe <3:0>) nb > bomcnt <2:0>? transmit pending packet (success) (failure) yes no no yes downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 125 mrf24xa 4.12 clear channel assessment (cca) clear channel assessment (cca) is a function within csma/ca to determine whether the wireless medium is ready and able to receive data, thus the transmitter can start sending it. cca is implemented outside of the mac. this enables the radio to transmit in the presence of interference from other wireless protocols that operate on the same frequency. cca may be performed using either energy detection (ed), carrier sense (cs), or a combination of both. for more information on regi ster description, see section 9.6 clear channel assessment (cca) . 4.13 condition for hardware acknowledgement figure 4-12 illustrates the condition for hardware acknowledgement as examined in figure 4-9 and figure 4-11 . the autoacken = 0 case, when acknowledgement is done by software. both acknowledgement mechanisms (autoacken = 0 / 1 ) are described for the originator and the recipient. figure 4-13: ack requirement decision autoacken = 1 evaluates to true ack required? ackreq = 1 packet mode (trxmode = 00 ) and non-streaming frames are only consider ed since streaming type of frames always contain ackreq, and rx-streaming nodes discard non-stream ing type of frames. ack is handled by software. the sender of the frame does not request an ack to it. no yes yes autoacken = 1 is forbidden in repeater nodes, thus autorpten = 0 is implied. the required and sufficient condition for acknowledge sending is trxmode = 00 and autorpten = 0 and autoacken = 1 and ackreq = 1 . evaluates to false if the transmitter (txst = 1 ) of the frame having ackreq = 1 is configured as trxmode = 00 and autoack = 1 then it must receive a valid ack to the sent frame to report successful sending. if the receiver (txst = 0 ) of the frame having ackreq = 1 is configured as trxmode = 00 and autoack = 1 then it must transmit an ack to the received frame and all of the subsequent duplicates that arrive before the mhr is overwritten in the frame buffer. no downloaded from: http:///
mrf24xa ds70005023c-page 126 preliminary ? 2015 microchip technology inc. register 4-16: rxcon2 (mac rece ive control register 2) address: 0x16 r/c/hs-0 r/w-0 r-0 r/w-0 r/w-0 r/w-0 r/w-0 r/w-0 rxbufful identrej ackrxfp acktxfp autorpten autoacken adptchen adptdren bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hs = ha rdware set c = clearable bit bit 7-3 out of scope bit 2 autoacken: auto-acknowledge enable bit recipient of a data frame: if this bit is set, the device automat ically transmits an ack packet whenever a packet is received and its ackreq bit is set. originator of a data frame: if this bit is set, the device awaits an ack packet after the transmission of a packet (and after each retransmissions), and auto matically processes the received acknowledge packet without writing it to the buffer. setting this bi t is required to enable automatic retransmissions of the device. the host mcu must clear autoacken to disable the automatic processing of acknowledge frames and enable writing to the buffer. 1 = automatic acknowledge processing enabled 0 = automatic acknowledge processing disabled bit 1-0 out of scope downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 127 mrf24xa 4.14 acknowledge sending by recipient ack sending must never use csma whether auto- acken = 1 or 0 . a txif is not generated when an ack packet completes transmission. however, txsfdif and txmaif are set. figure 4-14: automatic acknow ledge sending (autoacken = 1 and ackreq = 1 ) frmfmt = 1 exit enter proprietary frame carrying ackinfo. 0 no receiver turned off, transmitter remains on await rxackwait base time units. (start transition to tx just in time) start transmitting the preamble in the frame (without doing csma) (when sfd is sent: txsfdif 1) generate acknowledge frame mhr without writing to buffer. if frmfmt = 0 then framectrl.framepend acktxfp. sequence received frame sequence append fcs (on-the-fly) ch<3:0> selected as receive channel return to rx adptchen use ackinfo field of the received frame to select the transmitting channel for the ack frame adptdren use ackinfo field of the received frame to select the transmitting data rate for the ack frame 0 yes (default) rxchannel = txchannel = ch<3:0>. for the exception, refer to rxen = 1 framectrl.ackreq = 1 must hold for entry 1 1 section 7.1 channel agility on agility. downloaded from: http:///
mrf24xa ds70005023c-page 128 preliminary ? 2015 microchip technology inc. table 4-4: identical packet rejection scenario rxbuffull identrej autoack ackreg description 0000 no ack is sent, rxbuffull<1 0001 0010 0 0 1 1 ack is sent, rxbuffull<- 1 0100 store sequence number and source address (sa + pid) no ack is sent, rxbuffull<- 1 0101 0110 0 1 1 1 store sequence number and source address (sa + pid) ack is sent, rxbuffull<- 1 1 0 x x no ack is sent, rxovfif<- 1 1 1 0 0 no ack is sent, if stored sequence number and source address match with the received one, then rxidentif<- 1 otherwise, rxovfif<- 1 1101 1110 1 1 1 1 if stored sequence number and source address match with the received one, ack is sent and rxidentif <- 1 otherwise, rxovfif<- 1 downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 129 mrf24xa 4.15 acknowledge reception by originator after the reception of a valid ack packet (sequence field matches with transmitted frame sequence field), rxsfdif and txif interrupts are generated (the rxif is not generated while receiving an ack frame). if the maximum number of retransmissions is reached (txretccnt >= txretmcnt), for example, no valid acknowledge received, txacki f interrupt is generated. figure 4-15: acknowledge recept ion and retransmission control enter transmitter processing in packet mode txst = 1 entered when ack required receiver turned off rxchannel selected receiver turned off txchannel selected increment txretccnt valid ack frame received with sequence field matching the transmitted frame? receiver turned off txchannel selected radio to rx start time-out counter frame received? timer reached txackto base time units? txretccnt >= txretmcnt? no (default) rxchannel = txchannel = ch<3:0>. for the exception, refer to rxsfdif 1 frame parsed without writing to buffer txackif 1 update ackrxfp exit retransmit success no yes yes yes no no failure txst = 1 yes figure 4-9 on agility. section 7.1 channel agility downloaded from: http:///
mrf24xa ds70005023c-page 130 preliminary ? 2015 microchip technology inc. 4.16 base time units writing the basetm<4:0> regi ster bits selects the desired base time. each increment of basetm<4:0> is equal to 1 s. the rxackwait<7:0>, txackto<7:0>, bounit<7:0>, strmto<15:0> and offtm<7:0> (3) fields are specified in terms of base time units. the basetm<4:0> bits mu st be unchanged while rxen = 1 or txst = 1 . the base time is used in all modes for all types of packets. table 4-5: base time units function/timer range of timer with basetm<4:0> = 0x01 (1 s resolution) range of timer with basetm<4:0> = 0x02 (2 s resolution) range of timer with basetm<4:0> = 0x04 (4 s resolution) time to wait before transmitting an ack packet (rxackwait<7:0>) 0-128 s 0-256 s 0-512 s maximum time to look for an ack packet before issuing a tx ack error or before retransmitting (txackto<7:0>) 0-256 s 0-512 s 0-1024 s csma backoff time (0 - (2 be - 1) * bounit<7:0>) bounit<7:0> = 160 ( 1, 2 ) (320 s) bounit<7:0> = 80 ( 2 ) (320 s) be = 0 0 be = 1 0-320 s be = 2 0-960 s be = 3 0-2.24 ms be = 4 0-4.8 ms be = 5 0-9.92 ms be = 6 0-20.16 ms be = 7 0-40.64 ms be = 8 0-81.6 ms rx stream timeout (strmto<15:0>) 0-65 ms 0-131 ms 0-131 ms minimum off time (offtm<7:0> * 32) ( 3 ) 0-8 ms 0-16 ms 0-32 ms note 1: the maximum delay that mac can support is 131 ms. va lues outside this range may be set, but results in truncation of the number to one that is less than or equal to 131 ms. 2: the value of 320 s is chosen as it is the value referenced in the 802.15.4-200 6 specification. other val- ues are possible, but may break 802.15.4 compliance. 3: note that the offtm<7: 0> register is the only timer value that is expressed not directly in basetm units, but rather is expre ssed in basetm * 32 units. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 131 mrf24xa 4.17 initialization sequence to reach optimal rx and tx parameters, some private register values must be changed after every reset. note that all results in this document were measured with this initialization sequence. initiate hw reset; wait for ready if; mrf24xa_writebyte(0xff, 0x5a); mrf24xa_writebyte(0xb7, 0xc0); mrf24xa_writebyte(0x80, 0x87); mrf24xa_writebyte(0x81, 0x84); mrf24xa_writebyte(0x82, 0x8a); mrf24xa_writebyte(0x83, 0x5e); mrf24xa_writebyte(0x84, 0xa5); mrf24xa_writebyte(0x8a, 0x2b); mrf24xa_writebyte(0x8b, 0x30); mrf24xa_writebyte(0x8c, 0x30); mrf24xa_writebyte(0x97, 0xd0); mrf24xa_writebyte(0xa3, 0x37); mrf24xa_writebyte(0xa5, 0x14); mrf24xa_writebyte(0xaa, 0x54); mrf24xa_writebyte(0xab, 0x0b); note: mrf24xa_writebyte (unsigned short address, unsigned char value) writes the given value to the selected address. downloaded from: http:///
mrf24xa ds70005023c-page 132 preliminary ? 2015 microchip technology inc. notes: downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 133 mrf24xa 5.0 ieee 802.15.4? compliant frame format and frame processing figure 5-1 shows the general mac header structure. the specific format of the acknowledge frame is pro- vided in figure 5-2 . the frame buffer is written in the following sequence: (1) length field byte, (2) byte 0 of the framectrl field, (3) byte 1 of the framectrl field, and (4) sequence. figure 5-1: ieee.802.15.4? mac header structure type<2:0>: indicates the frame type. for more information, see section 5.1 frame types in ieee 802.15.4-compli ant framing mode . secen: security enable bit. for more information, see section 5.3 security material and section 5.4 security material retrieval with ieee 802.15.4 compliant frames . framepend: this bit of the ack frame must be set when acktxfp = 1 and the frame being ackd is an 802.15.4 data request command frame (framectrl.type = 011 and cmdtype = 0x04), and cleared otherwise . csma-ca is not performed before sending out ack packets. ackreq: ack request. for more information, see section 4.12 clear channel assessment (cca) . pidcmp: pan identifier compare. for more information, see section 5.2 addressing in ieee 802.15.4 compliant framing mode . damode: destination address mode. for more information, see section 5.2 addressing in ieee 802.15.4 compliant framing mode . samode: source address mode. for more information, see section 5.2 addressing in ieee 802.15.4 compliant framing mode . pidcmp (1 bit) ackreq (1 bit) framepend (1 bit) secen (1 bit) type (3 bits) rsvd. (1 bit) rsvd. (2 bits) byte 0 byte 1 sequence (1 octet) destpid (0/2 octets) srcpid (0/2 octets) framectrl (2 octets) mhr: mac header (ieee 802.15.4?) framectrl (ieee 802.15.4) 7 6 5 4 3 2:0 1:0 samode (2 bits) 7:6 framever (2 bits) 5:4 damode (2 bits) 3:2 destaddr (0/2/8 octets) srcaddr (0/2/8 octets) auxsechdr (0-14 octets) destination (0/4/10 octets) source(0/2/4/8/10 octets) downloaded from: http:///
mrf24xa ds70005023c-page 134 preliminary ? 2015 microchip technology inc. figure 5-2: ieee.802.15.4? acknowledge f rame structure figure 5-3: example: packet mode without security pidcmp 0 ackreq 0 framepend 0/1 secen 0 type 010 rsvd. 0 rsvd. 00 byte 0 = 02 h or 12 h 0x00 or 0x10 byte 1 = 00 h or 10 h 0x02 or 0x12 framectrl (2 octets) sequence (1 octet) length (1 octet) mhr framectrl (ieee 802.15.4 ack frame) 7 6 5 4 3 2:0 1:0 samode 00 7:6 framever 00/01 5:4 damode 00 3:2 fcs (2 octets) acknowledge frame (ieee 802.15.4?) downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 135 mrf24xa transmitter side: receiver side: 1 description tx configuration: secen = 0 csmaen = 0 example shortaddress: 0x1a1b pid: 0x2c2d 2 description construct, download unprocessed frame example 0c | 01 98 | a8 | 2c 2d | ff ff | 2c 2d | 1a 1b | ff | (no crc) length = 12 d + 2 d (crc) = 14 d = 0x0e framectrl = 0x01 0x98 = lsb_0000_0001_1001_1000 (data, sec = 0 , da, sa short addresses, ver2006) sequence = 0xa8 sa/da pid = 0x2d2c da = 0xffff (broadcast) sa = 0x1b1a (unicast) mac payload = 0xff 3 description set txst: launches transmission. crc is appended. length is incremented accordingly. example 0e | 01 98 | a8 | 2c 2d | ff ff | 2c 2d | 1a 1b | ff | a7 8e crc: 0xa7 0x8e 4 description end of transmission (no ack request, no csma): txif received. txbufempty = 1 1 description rx configuration: secen = 0 (nwk), security suite example address: dont care. 2 description rxsfdif = 1 unless rxbufful = 1 (if rxbufful= 1 then rxsfdif = 1 ; rxovfif = 1 ; no writing to buffer 3 description rx parsing and filtering when frame reception is complete. if duplicated packet then silently discarded else if packet filtered then rxfltif, otherwise rxif = 1 (since secen = 0) example rxfilter(@0x18) = 0x45 4 description rxif = 1 . crc is not valid for the decrypted frame. example 0e | 01 98 | a8 | 2c 2d | ff ff | 2c 2d | 1a 1b | ff | a7 8e||rsvs downloaded from: http:///
mrf24xa ds70005023c-page 136 preliminary ? 2015 microchip technology inc. figure 5-4: example: packet mo de with nkw-layer security tx host mcu tx device rx device rx host mcu sending node receiving node construct frame txbufempty=0 1 medium spi, int spi, int 5 4 3 2 unprocessed frame (fr) tx configuration key, nonce, indices set txenc txencif=1, txenc=0 6 check prfr- optional set txst txsfdif=1 txif=1, txbufempty=1 7 tx security processing processed frame (prfr) frame sending frame started on air shr (sfd) finished buffer is written to if no rxovfif frame complete rx configuration 1 if rxbuffull=1 when rxsfdif=1 then rxovfif=1 and drops packet rxsfdif=1 rx frame filter rxfltif=1 or rxif=1 2 3 read tx buffer read rx buffer 4 check prfr retrieve key,... key, nonce, indices 4 set rxdec 5 rx security processing rxdecif=1 or rxtagif=1 6 read rx buffer check fr legend: data flow direction initiator event or control flow responder downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 137 mrf24xa transmitter side: 1 description construct, download unprocessed frame example 12 | 01 98 | a8 | 2c 2d | ff ff | 2c 2d | 1a 1b | 01 02 03 04 05 06 | ff | (no mic, no crc) length = 18 d + 4 d (mic-32) + 2 d (crc) = 24 d = 0x18 framectrl = 0x01 0x98 = lsb_0000_0001_1001_1000 (sec = 0, da, sa short addresses, ver2006) sequence = 0xa8 sa/da pid = 0x2d2c da = 0xffff (broadcast) sa = 0x1b1a (unicast) network header = 0x01 0x02 0x03 0x04 0x05 0x06 network payload = 0xff 2 description tx configuration: nwk layer security example security suite = mic-32 3 description tx configuration: key, nonce, payload index, header index example short address = 0x1b1a pid = 0x2d2c header index (@0x2b) = 12 d payload index (@0x2c) = 18 d mrf24xa register content 0x20 22 33 44 55 66 77 88 1a 0x28 1b 2c 2d 0c 12 00 00 00 key = 0x0f0e0d0c0b0a09080706050403020100 nonce = 0x50 + , i = 012 mrf24xa register content 0x40 00 01 02 03 04 05 06 07 0x48 08 09 0a 0b 0c 0d 0e 0f 0x50 60 61 62 63 64 65 66 67 0x58 68 69 6a 6b 6c 00 00 00 4 description issue txenc: launches ccm authentication and encryption. 5 description security processing done: txencif = 1 , txenc = 0 . optionally, tx buffer is read. processed frame pr fr is compared to the result of the receiver security processing or to the calculated expected outcome. example expected buffer content: 16 | 01 98 | a8 | 2c 2d | ff ff | 2c 2d | 1a 1b | 01 02 03 04 05 06 | 46 | 78 c3 22 32 | (no crc) encrypted payload (0xff): 0x46 mic-32: 0x{78 c3 22 32} crc: 0xa7 0x8e 6 description set txst: launches transmission. crc is appended. example 18 | 01 98 | a8 | 2c 2d | ff ff | 2c 2d | 1a 1b | 01 02 03 04 05 06 | 46 | 78 c3 22 32 | a7 8e crc: 0xa7 0x8e 7 description end of transmission (no ack reques t, no csma): txif received. txbufempty= 1 downloaded from: http:///
mrf24xa ds70005023c-page 138 preliminary ? 2015 microchip technology inc. receiver side: 5.1 frame types in ieee 802.15.4-compliant framing mode the type<2:0> bit field in framectrl uses the encoding in table 5-1 . if secen bit in framectrl is set, the hardware parses the frame to construct the security material (both at sending and after reception). in the case of beacon frames, it is the responsibilit y of the host mcu to set the security materials before transmission (txst) and after reception (rxif). for beacon frames, the frame version subfield must be set to 1 if the security enabled subfield is set to 1 . 1 description rx configuration: security suite example security suite = mic-32 2 description if rxbufful is 0 then rxsfdif = 1 if rxbufful is 1 then rxsfdif = 1 rxovfif = 1 (no writing to buffer) 3 description rx parsing and filtering when frame reception is complete. if packet filtered then rxfltif, otherwise = 1 (network secured frame received since secen = 0 ) example rxfilter(@0x18) = 0x45 4 description read rx buffer containing prfr + crc. crc is valid for the encrypt ed frame and, lqi, rssi (rsvs) appended to the frame. example 18 | 01 98 | a8 | 2c 2d | ff ff | 2c 2d | 1a 1b | 01 02 03 04 05 06 | 46 | 78 c3 22 32 | a7 8e || rsvs crc: 0xa7 0x8e 5 description rxdec = 1 launches decryption and authenticity checking. 6 description if authenticity is approved (success): rxdecif = 1 . crc is not valid for the decrypted frame. otherwise rxtagif = 1 . example 1a | 01 98 | a8 | 2c 2d | ff ff | 2c 2d | 1a 1b | 01 02 03 04 05 06 | ff | 78 c3 22 32 | a7 8e |6c 42rssi: 0x6c lqi: 0x42 table 5-1: ieee 802. 15.4? frame types type field b2,b1,b0 frame type related hardware features 000 beacon beacons are a specific type of broadcast frames. this device does not provide support for mhr-parsing on beacon frames. beacon frames are always accepted as valid frames. 001 data this is filtered by setting datarej. 010 acknowledge must be generated by the receiver (from sw or hw), if ackreq = 1 in the last received frame, and must contain the same sequence value. this is generated by hardware (autoacken = 1 ). in this case it is not loaded to the tx frame buffer. autoacken = 1 requires crcsz = 1 on both the transmitter and the receiver side. 011 command this is filtered by cmdrej. first byte of payload (com mand) is never encrypted. see command encoding in table 82 in section 7.3 of ieee 802.15.4?-2006. 1xx reserved downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 139 mrf24xa register 5-1: rxfilter (rx filter register) address: 0x18 r/w-0 r/w-1 r/w-1 r/w-1 r/w-1 r/w-1 r/w-1 r/w-1 pancrdn crcrej cmdrej datarej unirej notmerej bcrej nstdrej bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-6 out of scope bit 5 cmdrej: command frame reject enable bit setting this bit enables the user to reject al l packets with framectrl equal to command. 1 = reject all command packets 0 = disable command frame rejection bit 4 datarej: data frame reject enable bit setting this bit enables the user to reject all packets with framectrl equal to data. 1 = reject all data packets 0 = disable data frame rejection bit 3-0 out of scope downloaded from: http:///
mrf24xa ds70005023c-page 140 preliminary ? 2015 microchip technology inc. 5.2 addressing in ieee 802.15.4 compliant framing mode the destination addressing mode (damode) and source addressing mode (samode) bit fields of framecrtl defines the address format used in mhr, see figure 5-1 . damode subfield encodes the length of the destpid and destaddr fields as listed in ta b l e 5 - 3 . samode subfield encodes the length of the srcpid and srcaddr fields as listed in ta b l e 5 - 3 . on reception of a frame, each node compares its own shaddr, addr, panid configuration, see ta b l e 5 - 4 , to the appropriate destination addressing fields in the received frame. a valid frame is identified if a match is found. additionally, rules apply for broadcast frames and for implied unicast addressing as explained in the sequel. table 5-2: ieee 802. 15.4? destination addressing modes damode b1, b0 destination addressing mode destpid | destaddr format 11 16-bit destpid and 64-b it dest. long address xxxxh | xxxx_ xxxx_ xxxx_ xxxxh 10 16-bit destpid and 16-bit de st. short address xxxxh | xxxxh 01 reserved 00 destpid and destaddr are not present table 5-3: ieee 8 02.15.4? source addressing modes samode b1, b0 source addressing mode srcpid | srcaddr format 11 if damode<1> = 1 and pidcmp = 1 , then only 64-bit source long address (srcpid is implied by destpid) else, 16-bit srcpid and 64-bit source long address - |xxxx_xxxx_xxxx_xxxxh xxxxh | xxxx_xxxx_xxxx_xxxxh 10 if damode<1> = 1 and pidcmp = 1 , then only 16-bit source short address (srcpid is implied by destpid) else, 16-bit srcpid and 16-bit source short address - |xxxxh xxxxh | xxxxh 01 reserved 00 srcpid and srcaddr are not present table 5-4: relevant registers fo r ieee 802.15.4?-mode addressing addr. resgister bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x1f addr1 addr<7:0> 0x20 addr2 addr<15:8> 0x21 addr3 addr<23:16> 0x22 addr4 addr<31:24> 0x23 addr5 addr<39:32> 0x24 addr6 addr<47:40> 0x25 addr7 addr<55:48> 0x26 addr8 addr<63:56> 0x27 shaddrl shaddr<7:0> 0x28 shaddrh shaddr<15:8> 0x29 panidl panid<7:0> 0x2a panidh panid<15:8> downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 141 mrf24xa if damode subfield is equal to zero and the frame type subfield does not specify that this frame is an acknowledgment or beacon frame, then the samode subfield must be non-zero, implying that the frame is directed to the pan coordinator with the pan identifier as specified in the source pan identifier field. this addressing option is referred to as implied. broadcast frames of type data or command must always use damode = 01 and destaddr = ffffh . acknowledge frames are broadcast frames and always use damode = 00 and samode = 00 . beacon frames are broadcast frames and always use damode = 00 , pidcmp = 0 with samode = 01 or 10 . table 5-6 and table 5-7 show the examples for desti- nation and source addressing, using the tx and rx node configurations in ta b l e 5 - 5 . the valid address formats are summarized in table 5-8 for all frame types. broadcast and unicast cases are dis- tinguished in the case of command and data frames. unicast frames are either addressed to the receiving node or to a different node. unirej and notmerej are sensitive to the former or the latter case, respec- tively. broadcast command and data frames are filtered when bcrej is set. the parser does not filter the bea- con frames. table 5-5: example configuration tx (source) configuration addr = 0x080706050403020100 shaddr = 0x1211 panid = 0xd2d1 rx (destination) configuratio n addr = 0xa8a7a6a5a4a3a2a1a0 shaddr = 0xb2b1 panid = 0xb2b1 mhr framectrl | sequence | destpi d | destaddr| srcpid | srcaddr framectrl framectrl<7:0> = 0 | pidcmp | x | x | x | type<2:0> framectrl<15:8> = samode<1:0> | 0 | x | damode<1:0> | 0 | 0 where, type is not acknowledge and x is either of {0,1} table 5-6: destination addressing options (ieee 802.15.4?) using the example options broadcast unicast command (or data) beacon long short implied to coordin. destpid | destaddr xx,xx | ff, ff d1,d2 | a1, a2,, a8 d1,d2 | b1, b2 type xxx 000 xxx xxx not 000 damode 10 00 11 10 00 address filter bcrej notmerej, unirej note 1: damode = 01 is reserved and is rejected by nstdrej = 1 . table 5-7: source addressing option s (ieee 802.15.4?) using the example options long (explicit srcpid) long (implied srcpid) short (explicit srcpid) short (implied srcpid) none srcpid | srcaddr d1,d2 | 01, 02, 03,, 08 01, 02, 03,, 08 d1, d2 | 11, 12 11, 12 type xxx xxx xxx xxx xxx samode 11 11 10 10 00 damode xx 1x xx 1x xx pidcmp 0 1 0 1 x note 1: samode = 01 , is reserved, and is rejected by nstdrej = 1 . downloaded from: http:///
mrf24xa ds70005023c-page 142 preliminary ? 2015 microchip technology inc. register 5-2: rxfilter (rx filter) C when ieee 802. 15.4? mode address: 0x18 r/w-0 r/w-1 r/w-1 r/w-1 r/w-1 r/w-1 r/w-1 r/w-1 pancrdn crcrej cmdrej datarej unirej notmerej bcrej nstdrej bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-4 out of scope bit 3 unirej: unicast reject enable bit ( 2 ) setting this bit enables the user to reject all unicast packets as in: 802.15.4 mode: pan identifier matches with the panid< 15:0> or 0xffff, and destination address matches the address in the addr<63:0> or shad dr<15:0> register, which the damode selects. proprietary mode: destination address matches the a ddress in addr*8-1:0> reg- ister, provided that daddrprsnt frame control field is set ( 1 ) . 1 = reject all unicast packets addressed to this node 0 = disable unicast rejection bit 2 notmerej: not me unicast reject enable bit ( 3 ) setting this bit enables the user to reject all unicast packets as in: 802.15.4 mode: destination pan identifier does not match panid<15:0> and is not 0xffff (broad- cast) or destination address do es not match the address in the addr<63:0> register or the shaddr<15:0> register, which the damode selects. proprietary mode: destination address matches the a ddress in addr*8-1:0> reg- ister, provided that daddrprsnt frame control field is set ( 1 ) . 1 = reject all unicast packets not addressed to this node 0 = disable not me unicast rejection filtering bit 1 bcrej: broadcast rejection bit 802.15.4 mode: setting this bit enables the user to reject all broadcast packets of type data or com- mand. a data or command packet is broadcast w hen short destination addressing is used (damode = 10) and short address is equal 0xffff. proprietary mode: setting this bit enables the user to reject all broadcast packets of type data or command (or streaming). a packet is broadcast when framectrl[broadcast] is set. 1 = reject broadcast packets 0 = disable broadcast rejection bit 0 nstdrej: non-standard frame reject bit ( 4 ) this bit enables the user to reject all 802.15.4 frames having 01 for the damode or samode fields or having the most significant bit (msb) (bit 2) in the type field set (1) or having the msb (bit 1) in the frame version field set to (1) . 1 = reject all non-standard 802.15.4 packets 0 = disable non-standard rejection note 1: in proprietary mode (frmfmt = 1 ), when crcrej = 1 is used to reject unicast frames not addressed to this node. notmerej = 1 does not reject these frames. 2: unirej does not affect the frames using implied de stination addressing in 802.15.4 mode and inferred destination addressing in proprietary mode. 3: notmerej does not affect the fr ames using implied destination ad dressing in 802.15.4 mode and inferred destination addressing in proprietary mode. 4: nstdrej does not affect the proprietary frames in proprietary mode. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 143 mrf24xa when a valid frame gets filt ered, rxfltif is set, other- wise, rxif terminates the successful reception. for more information, refer to register 5-1 . invalid addressing formats are produced if: either damode or samode are set to the reserved value of 01 . damode or samode values are used with an incompatible type field value. for example, - beacon with damode = 1x - damode = 00 , samode = 00 used with type of beacon/command / data. pidcmp is set on an inconsistent way to damode and samode. srcpid or srcaddr holds ffff , or if destpid holds ffff while damode = 11 . length field is less than the mhr length computed from framectrl. the device checks the firs t condition and frmif is generated. the device does not check the second con- dition, therefore one out of rxif, rxfltif, frmif is expected. the hardware checks the third condition and pidcmp value is handled as 0 . the hardware does not check the fourth condition and rxif is expected. all other invalid formats also produces one out of rxif, rxfltif, and frmif. table 5-8: ieee 802.15 .4? test cases: valid addressing formats da pid comp sa dest ( 2 ) types ( 3 ) field sizes in octets ( 4 ) description ( 5 ) 00 0 ( 1 ) 00 bc3 a 0|0|0|0 acknowledge frame (no auto-ack) 10 0 ( 1 ) 00 bc1 c,d 2|2|0|0 short destin ation (xxxx|ffff), no source 10 0 ( 1 ) 00 bc2 c,d 2|2|0|0 short destination (ffff|xxxx), no source 10 0 ( 1 ) 00 uni c,d 2|2|0|0 short destination, no source 10 0 ( 1 ) 00 notme c,d 2|2|0|0 short destination, no source 11 0 ( 1 ) 00 uni c,d 2|8|0|0 long destination, no source 11 0 ( 1 ) 00 notme c,d 2|8|0|0 long destination, no source 00 0 ( 1 ) 10 bc3 b 0|0|2|2 beacon frame sent by the coordinator 00 0 ( 1 ) 10 uni2, pancrdn c,d 0|0|2|2 implied addressing to coordinator node. uni2 for coordinator. 00 0 ( 1 ) 10 notme2, pancrdn c,d 0|0|2|2 implied addressing to coordinator node. notme2 for all nodes other. 00 0 ( 1 ) 11 bc3 b 0|0|2|8 beacon frame sent by the coordinator 00 0 ( 1 ) 11 c,d 0|0|2|8 implied addressing to coordinator node. uni2 for coordinator. 00 0 ( 1 ) 11 notme2, pancrdn c,d 0|0|2|8 implied addressing to coordinator node. notme2 for all nodes other. 10 0 ( 1 ) 10 bc1 c,d 2|0|2|2 short destinati on (xxxx | ffff), short source 10 0 ( 1 ) 10 bc2 c,d 2|0|2|2 short destination (ffff | xxxx), short source 10 0 10 uni c,d 2|0|2|2 short destination, short source 10 0 10 notme c,d 2|2|2|2 short destination, short source 10 1 10 bc1 c,d 2|2|0|2 short destination(xxxx | ffff), short source (pid compression) 10 1 10 uni c,d 2|2|0|2 short destination, short source (pid compression) 10 1 10 notme c,d 2|2|0|2 short destination, short source (pid compression) 10 0 11 bc1 c,d 2|2|2|8 short destin ation (xxxx | ffff), long source 10 0 11 bc2 c,d 2|2|2|8 short destination (ffff | xxxx), long source 10 0 11 uni c,d 2|2|2|8 short destination, long source 10 0 11 notme c,d 2|2|2|8 short destination, long source 10 1 11 bc1 c,d 2|2|0|8 short destination (xxxx | ffff), long source (pid compression) 10 1 11 uni c,d 2|2|0|8 short destination, long source (pid compression) downloaded from: http:///
mrf24xa ds70005023c-page 144 preliminary ? 2015 microchip technology inc. 5.3 security material the security material required for cbc-mac, ctr, and ccm are the inputs configured to the registers as listed in table 5-10 . secsuite<3:0> select s the security suite consisting of encryption or authentication, or both, see table 5-9 . sechdrindx<6:0> is the byte index where authentication must start. secpayindx<6:0> is the byte index where encryption/decryption must start. secendindx<6:0> points at the last byte of the payload (before mic and fcs). seckey<127:0> holds the symmetric key. secnonce<103:0> holds a nonce value that is unique for each frame while a specific key is in use. this ensures sequence freshness (for pro- tection against repeat-attack) and protects the key from being deciphered based on the encoded messages. the transmitter generates the infor- mation required to generate the nonce and then sends to the receiver as plain text as part of the frame. section 5.4 security material retrieval with ieee 802.15.4 compliant frames describes how the security level is selected and whether the device or software fills out the above registers before the security operation is launched. devi ce/host fills in these reg- isters and the authentication appends a mic tag to the frame (before fcs is appended), after the position pointed at by secendindx. encryption/ decryption alters the payload stored in the buffer from secpay- indx through secendindx. the range defined for payload does not necessarily coincide with the mac payload as explained in the sequel. figure 5-2 to figure 5-9 illustrate the order of all the security operations, which is valid for both 2003/2006 compliant framing modes. 10 1 11 notme c,d 2|2|0|8 short destination, long source (pid compression) 11 0 10 uni c,d 2|8|2|2 long destination, short source 11 0 10 notme c,d 2|8|2|2 long destination, short source 11 1 10 uni c,d 2|8|0|2 long destination, short source (pid compression) 11 1 10 notme c,d 2|8|0|2 long destination, short source (pid compression) 11 0 11 uni c,d 2|8|2|8 long destination, long source 11 0 11 notme c,d 2|8|2|8 long destination, long source 11 1 11 uni c,d 2|8|0|8 long destination, long source (pid compression) 11 1 11 notme c,d 2|8|0|8 long destination, long source (pid compression) note 1: the standard requires 0 in the cases marked by (1); yet, 1 is handled as 0 in such cases by the device parser (without erroring out). 2: bc1- broadcast addr,bc2- broadcast pid, bc3- broadcast no daddr, uni- unicast to this node, uni2- uni- cast to this node when no destination address is pres ent, notme- unicast to different node, notme2- uni- cast to different node when no destination address is present. 3: frame types legend: a-acknowledge, b-beacon, c-command, d-data. 4: destpid | destaddr | srcpid | srcaddr. 5: in the descriptions, xxxx represents a 4-digit hexa number different from ffff . table 5-8: ieee 802.15 .4? test cases: valid addressing formats (continued) da pid comp sa dest ( 2 ) types ( 3 ) field sizes in octets ( 4 ) description ( 5 ) table 5-9: security level: mode of operation security level ( 1 ) payload mic tag of octets comment 0000 plain text no authentication 0001 plain text 4 bytes ccm operation. only defined in 2006. 0010 plain text 8 bytes ccm operation. only defined in 2006. 0011 plain text 16 bytes ccm operation. only defined in 2006. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 145 mrf24xa 0100 encrypted no authentication ccm operation. only defined in 2006. 0101 encrypted 4 bytes ccm operation. only defined in 2003/2006. 0110 encrypted 8 bytes ccm operation. only defined in 2003/2006. 0111 encrypted 16 bytes ccm operation. only defined in 2003/2006. 1000 encrypted no authentication ecb operation. no t defined in 2003/2006 (only encryption) 1001 encrypted no authentication ctr operation. only defined in 2003. 1010 reserved 1011 reserved 1100 reserved 1101 plain text 16 bytes cbc-mac operation. only defined in 2003. 1110 plain text 8 bytes cbc-mac operation. only defined in 2003. 1111 plain text 4 bytes cbc-mac operation. only defined in 2003. note 1: in 2006 compliant framing, the security level is trave ling with the frame, while in 2003 it must be set glob- ally. table 5-9: security level: mode of operation (continued) security level ( 1 ) payload mic tag of octets comment table 5-10: security material inputs to cbc-mac, ctr and ccm addr. resgister bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x10 maccon1 trxmode<1:0> addrs z<2:0> crcsz frmfmt secflagovr 0x11 maccon2 channel<3:0> secsuite<3:0> 0x2b sechdrindx sechdrindx<6:0> 0x2c secpayindx secpayindx<6:0> 0x2d secendindx secendindx<6:0> 0x40 through 0x4f seckey1 seckey<7:0> <2,3,4,15> seckey16 seckey<127:120> 0x50 through 0x5c secnonce1 secnonce<7:0> <2,3,4,12> secnonce13 secnonce<103:96> 0x5d secencflag secencflag<7:0> 0x5e secauthflag sec authflag<7:0> downloaded from: http:///
mrf24xa ds70005023c-page 146 preliminary ? 2015 microchip technology inc. figure 5-5: ccm*/cbc-mac auth entication operation (tx) exception handling: txszif: transmit packet size error interrupt flag txst is set when the packet size (including mic tags and crc) is found to be zero or to be greater than the maximum size that the buffers can support. frmif: frame format error interrupt flag set if the transmitter/receiver fails to pa rse the frame in the buffer (it is not as it must be or it is corrupted in demod- ulation). for example, reserved values are found in the mac header fields. mhr mac payload length authentication tx buffer mhr mac payload tag length crc generation mhr mac payload crc tag length transmitted into the air updating updating downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 147 mrf24xa figure 5-6: ccm*/cbc-mac de-a uthentication operation (rx) ( 1, 2 ) note 1: the length field above refers to the total number of octets as reported by the baseband, and therefore includes the tag (mic), but excludes any rsv octets. 2: if present, rsv octets are placed after the tag, as these are only received when the complete frame is received. it is the responsibility of software to determine the address of the rsv in the buffer (rsv address = length + 1), and to discard/ignore the tag octets. rx buffer crc check mhr mac payload crc tag length received from the air mic compare mhr data/cmd payload crc tag length mhr data/cmd payload crc tag length downloaded from: http:///
mrf24xa ds70005023c-page 148 preliminary ? 2015 microchip technology inc. figure 5-7: ccm*/ctr/ecb encryption operation (tx) exception handling: txszif: transmit packet size error interrupt flag txst is set when the packet size (including mic tags and crc) is found to be zero or to be greater than the maximum size that the buffers can support. frmif: frame format error interrupt flag set if the transmitter/receiver fails to parse the frame in the buffer (it is not as it must be or it is corrupted in demod- ulation). for example, reserved values are found in the mac header fields. mhr data/cmd payload length encryption tx buffer mhr encrypted payload length crc generation mhr encrypted payload crc length transmitted into the air updating downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 149 mrf24xa figure 5-8: ccm*/ctr/ecb decryption operation (tx) ( 1, 2 ) exception handling: rxtagif: receiver decryption/authentic ation failure interrupt flag set by the device when decryption/au thentication finished with error. note 1: the length field above refers to the total number of octets as reported by the baseband, and therefore includes the tag (mic), but excludes any rsv octets. 2: if present, rsv octets are placed after the tag, as these are only received when the complete frame is received. it is the responsibility of software to determine the address of the rsv in the buffer (rsv address = length + 1), and to discard/ignore the tag octets. rx buffer crc check mhr encrypted payload crc length received from the air decryption mhr encrypted payload crc length mhr data/cmd payload crc length downloaded from: http:///
mrf24xa ds70005023c-page 150 preliminary ? 2015 microchip technology inc. figure 5-9: ccm* encryption and authentication operation (tx) mhr mac payload length authentication tx buffer mhr mac payload tag length encryption mhr encrypted payload encrypted tag length transmitted into the air crc generation mhr encrypted payload crc encrypted tag length updatingupdating exception handling: txszif: transmit packet size error interrupt flag txst is set when the packet size (including mic tags an d crc) is found to be zero or to be greater than the maximum size that the buffers can support. frmif: frame format error interrupt flag set if the transmitter/receiver fails to parse the frame in the bu ffer (it is not as it must be or it is corrupted in demod- ulation). for example, reserved values are found in the mac header fields. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 151 mrf24xa figure 5-10: ccm* decryption and de-authentication operation (rx) ( 1, 2, 3 ) exception handling: rxtagif: receiver decryption/authenti cation failure interrupt flag set by the device when decryption/authentication finished with error. note 1: the length field above refers to the total number of octets as reported by the baseband, and therefore includes the tag (mic), but excludes any rsv octets. 2: if present, rsv octets are placed after the tag, as these are only received when the complete frame is received. it is the responsibility of software to determine the address of the rsv in the buffer (rsv address = length + 1), and to discard/ignore the tag octets. 3: the message and tag decryption oper ations do not depend on each other, and may be computed in any order. all other factors being equal, the tag dec ryption operation must be performed first, as it uses the starting counter value. rx buffer crc check received from the air mic compare mhr data/cmd payload crc tag length mhr data/cmd payload crc tag length decryption mhr encrypted payload crc encrypted tag length mhr encrypted payload crc encrypted tag length downloaded from: http:///
mrf24xa ds70005023c-page 152 preliminary ? 2015 microchip technology inc. 5.4 security material retrieval with ieee 802.15.4 compliant frames this section explains how the security material, see section 5.3 security material , is retrieved when the mac frame is formatted to the ieee 802. 15.4 specifi- cation (either frmfmt = 0 or bridging) and security is applied either at the mac layer or at the nwk layer, or both. table 5-10 indicates the relevant configuration regis- ters (secsuite<3:0>). figure 5-11 represents the rel- evant security fields (secen, seclvl<2:0>, framever<1:0>, framecnt, keyidmode, keysrc, keyindex). the ieee 802.15.4 standard enables five different security scenarios. the difference among these sce- narios are shown in ta b l e 5 - 1 3 . if secen = 1 , then the mac layer security is ena bled. in case nwk layer security is also enabled, then it is calculated before mac layer security. mac layer security material retrieval differs in the 2006 and the 2003 versions of t he standard. distinction is possible based on the framever<1:0> field. the device does not support the security material retrieval for bea- con frames. the type<2:0> field distinguishes the bea- con frames. keyidmode, keysrc, keyindex in the auxsechdr are done by software for the retrieval of the mac layer symmetric key, the details are out of scope. if 2006-mac layer security is applied, use the framecnt, seclvl, and 8-byte source address to construct the nonce, see figure 5-12 . if 2003 mac layer security is applied, use the framecnt , keyseqcnt, and source address to construct the nonce field, see figure 5-13 . when the frame contains a short source address, the device cannot set the nonce correctly. similarly, if the frame is of type = beacon, then the secpayindx is set incorrectly. in these cases, the registers must be config- ured from software. on the rx side, this is easily done before launching the security processing (rxdec = 1 ). on the tx-side, set dtsm to prevent the device from overwriting the nonce and indexes that the software configures. only the mac layer security contains specific indexes as the network layer security configures the software: in mac layer security, sechdrindx is always the first byte of the mhr. in mac layer security applied for frames of type data and streaming, secpayindx is the first byte of the payload. for command frames, secpayindx is the second byte of the payload. secpayindx can take different values for beacon frames, which the software must always specify. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 153 mrf24xa register 5-3: sechdrindx (security header index register) address: 0x2b register 5-4: secpayindx (security payload index register) address: 0x2c r-0 r/w/hs-0000000 r sechdrindx<6:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hs = hardware set bit 7 reserved: maintain as 0 bit 6-0 sechdrindx<6:0>: security header index bits this field defines the portion of the header which performs t he authentication operations. for mac layer security, sechdrindx<6:0> is define d as the address offset of the mac header from the beginning of the frame, as stored in the buffer (0 = length field, 1 = framectrl field, and so on), and is automatically loaded for both 802.15.4 and proprietary frames. for network layer security, sechdrindx<6:0> is defi ned as the address offset of the network header from the beginning of the mac payload, and the ho st controller loads it only for 802.15.4 frames. note that for proprietary frames, the mac automatically loads it ( 1 ) . note 1: the setting dtsm in tx mode disables automatic computation of this field. r-0 r/w/hs-0000000 r secpayindx<6:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hs = hardware set bit 7 reserved: maintain as 0 bit 6-0 secpayindx<6:0>: security payload index bits this field defines the portion of the payload wh ich performs the encryption/decryption operations. for mac layer security, secpayindx<6:0> is defined as the address offset of the mac payload from the beginning of the frame, as stored in the buffer (0 = length field, 1 = framectrl field, and so on), and is automatically loaded for both 802.15.4 and proprietary frames. for network layer security, secpayindx<6:0> is defin ed as the address offset of the network header from the beginning of the mac payload, and the ho st controller loads it only for 802.15.4 frames. note that for proprietary frames, the mac automatically loads it ( 1 ) . note 1: the setting dtsm in tx mode disables automatic computation of this field. downloaded from: http:///
mrf24xa ds70005023c-page 154 preliminary ? 2015 microchip technology inc. register 5-5: secendindx (securit y end index register) address: 0x2d r-0 r/w/hs-0000000 r secendindx<6:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hs = hardware set bit 7 reserved: maintain as 0 bit 6-0 secendindx<6:0>: security end index bits this field defines the end of the payl oad which performs the security operations ( 1 ) . note 1: the setting dtsm in tx mode disables automatic computation of this field. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 155 mrf24xa figure 5-11 illustrates the construction of the nonce in 802.15.4-mode. figure 5-11: ieee.802.15.4 ? security control fields pidcmp (1 bit) ackreq (1 bit) framepend (1 bit) secen (1 bit) type (3 bits) rsvd. (1 bit) rsvd. (2 bits) byte 0 byte 1 sequence (1 octet) destpid (0/2 octets) srcpid (0/2 octets) framectrl (2 octets) mhr: mac header (ieee 802.15.4?) framectrl (ieee 802.15.4 2003) 7 6 5 4 3 2:0 1:0 samode (2 bits) 7:6 framever (2 bits) 5:4 damode (2 bits) 3:2 destaddr (0/2/8 octets) srcaddr (0/2/8 octets) auxsechdr (0-14 octets) destination (0/4/10 octets) source(0/2/4/8/10 octets) x x x 1/0 beacon/ data/ command 0 00 xx 2003-00 / 2006-01 xx auxsechdr (ieee 802.15.4?C2006) secctr 1 octet framecnt 4 octets keysrc 0/4/8 octets keyindex 0/1 octet 4:3 2:0 7:5 secctr (ieee 802.15.4) keyidmode (2 bits) seclvl (3 bits) reserved (3 bits) keysrc # octets keyidmode 0 00 01 0 4 10 11 8 keyindex # octets keyidmode 0 00 01,10,11 1 nonce<103:0> secsuite<2:0> in maccon2 (secsuite<3> 0) 8-byte srcaddr framecnt 4 octets keyseqcnt 1 octet auxsechdr (ieee 802.15.4?C2003) downloaded from: http:///
mrf24xa ds70005023c-page 156 preliminary ? 2015 microchip technology inc. figure 5-12: 802.15.4 ccm nonc e (only mac layer security)-2006 figure 5-13: 802.15.4 ccm nonce (only mac layer security)-2003 note: the originator device automatically fills in sr caddr field using the values of registers addr8 through addr1 irrespective of the samode. th e recipient host must fill in the nonce if samode is different from 11 . framectr (4 octets) {5'b00000, seclvl} (1 octet) srcaddr (8 octets) 13 octets 7:0 7:0 7:0 15:8 23:16 31:24 15:8 23:16 31:24 39:32 47:40 55:48 63:56 note: the originator device automatically fills in sr caddr field using the values of registers addr8 through addr1 irrespective of the samode. th e recipient host must fill in the nonce if samode is different from 11 . framectr (4 octets) keyseqcnt srcaddr (8 octets) 13 octets 7:0 7:0 15:8 23:16 31:24 39:32 47:40 55:48 63:56 15:8 23:16 31:24 7:0 (1 octet) downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 157 mrf24xa 5.5 transmit security processing of ieee 802.15.4 compliant frames setting txst triggers automatic mac layer security processing and frame sending as an uninterrupted sequence, see figure 5-14 . (network layer) which is triggered by txenc is applied, where txencif must be awaited before other operation. buf1txpp, buf2txpp, txe nc, and txst can trig- ger security functions as shown in figure 5-12 and figure 5-14 , where buf1txpp and buf2txpp are both used for debug. the respective interrupts are gen- erated on completion and the device automatically clears the aforementioned triggering bits. in figure 5- 12 , the device shows the condit ions for security mate- rial retrieval and the operation of the dtsm bit. figure 5-14: transmit security processing when frmfmt = 0 (ieee 802.15.4? format) before launching the transmit processing ( figure 4-9 ): sw always configures seckey sw may configure secsuite, secnonce, sechdrindx, secpayindx, secendindx enter secen dtsm ctr, cbc-mac, ccm exit mhr parsed mac security parse ahr configure secsuite, secnonce, sechdrindx, secpayindx, secendindx. lentgh is incremented when a mic tag is attached. txszif is set when length>0x7f. no security 0 1 1 0 samode * downloaded from: http:///
mrf24xa ds70005023c-page 158 preliminary ? 2015 microchip technology inc. figure 5-15: transmitter txenc processi ng when frmfmt = 0 (ieee 802.15.4? format) length is affected. mac mac/nwk. exception handling: txszif: transmit packet size error interrupt flag txst is set when the packet size (including mic tags and crc) is found to be zero or to be greater than the maximum size that th e buffers can support. frmif: frame format error interrupt flag txenc 1 interrupt service lentgh is incremented when a mic tag is attached. new length must not exceed 0x7f . otherwise txszif is set. ctr, cbc-mac and ccm txszif? txenc 0 txencif 1 txenc 0 0 1 txenc is only required for nwk layer security processing. sw configured seckey, secsuite, secnonce, sechdrindx, secpayindx and secendindx. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 159 mrf24xa 5.6 security processing of received ieee 802.15.4 compliant frames receive security is always performed when rxdec is set and awaits rxdecif or rxtagif as it is not auto- matically triggered . if both mac and nwk layer secu- rity are applied, then both must be processed in this order when rxdec is set for a second time after updat- ing the security material correctly. figure 5-17 shows the security functions triggered by rxdec . the device automatically clears the respective interrupts generated on completion and rxdec. figure 5-16: security material retrieva l support in receive processing when frmfmt = 0 (ieee 802.15.4? format) length is affected. mac mac/nwk. exception handling: frmif: frame format error interrupt flag the bit is set if the transmitter/receiver fails to parse the fr ame in the buffer (it is not as it must be or it is cor- rupted in demodulation). for ex ample, reserved values found in the mac header fields. enter secen exit mhr parsed mac security parse ahr configure secsuite, secnonce, sechdrindx, secpayindx, secendindx. for beacon frames, the configuration must be overridden by sw. 0 1 after rxif is asserted: sw always configures seckey. sw may need to configure secsuite, secnonce, sechdrindx, secpayindx, secendindx. downloaded from: http:///
mrf24xa ds70005023c-page 160 preliminary ? 2015 microchip technology inc. figure 5-17: receiver rxdec processing when frmfmt = 0 (ieee 802.15.4?-mode) rxdec 1 interrupt service aes-ccm mic tag mismatch? rxdec 0 rxdecif 1 rxdec 0 rxtagif 1 authentication failed success the valid frame is available in buf2 in mission mode, or in the buffer selected by buf1rxpp or buf2rxpp during debug. device and sw have both parsed the frame. illustrates the security material retrieval support. sw has configured seckey as required for the frame, and can also overwrite the configurations in secsuite, secnonce, sechdrindx, secpayindx, secendindx. figure 5-16 downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 161 mrf24xa 5.7 security procedure for ieee 802.15.4 compliant frames for more information about the frame format, refer to table 5-12 through ta b l e 5 - 1 4 and figure 5-3 . table 5-11: relevant register bits fo r security control wi th ieee 802.15.4? frames name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 maccon1 trxmode<1:0> addrsz<2:0> crcsz frmfmt secflagovr legend: r = reserved, read as 0 . table 5-12: definition of security support categories (ieee 802.15.4? frames) security support category secen framever <1:0> type<2:0> (and samode) description 0 0 0x data/cmd/beacon/ack no security a 1 0x data/cmd 2003/2006 mac layer security b 1 0x beacon 2003/2006 mac layer secured beacon c 0 0x data/(cmd)/beacon nwk layer security d 1 0x data/cmd nwk + 2003/2006 mac layer security e 1 0x beacon nwk + 2003/2006 mac layer security for beacon frames downloaded from: http:///
mrf24xa ds70005023c-page 162 preliminary ? 2015 microchip technology inc. table 5-13: secured frame transmissi on (ieee 802.15.4? mac format) # processing step steps per each security case abc d e 1 host mcu constructs the frame and loads the buffer. secen = 1 framever = 0x (either) secen = 1 frameve = 0x (either) secen = 0 framever = 0x (either) secen = 1 framever = 0x (either) secen = 1 framever = 0x (either) 2 for nwk security processing, host mcu configures: no nwk layer security. seckey secsuite sec*indx ( 1 ) nonce seckey secsuite sec*indx nonce seckey secsuite sec*indx nonce 3 host mcu triggers security processing without sending. txenc 1 txenc 1 txenc 1 4 device performs the secu- rity processing for nwk layer if txenc is set. length and secend- indx are updated if mic takg is appended. txszif if size run over 127 bytes. nwk layer security length, secendindx nwk layer security length, secendindx nwk layer security length, secendindx 5 host mcu awaits txencif interrupt, indicating comple- tion. device clears txenc. txencif 1 txenc 0 txencif 1 txenc 0 txencif 1 txenc 0 6 for mac security process- ing, host mcu configures: seckey (+nonce, if samode is not 11) (+secsuite, if framever=2003) seckey secsuite sec*indx nonce no mac security seckey (+nonce, if samode is not 11) (+secsuite, if framever=200 3) seckey secsuite sec*indx nonce 7 host mcu sets dtsm to inhibit the hardware from overwriting just configured secsuite, sec*indx and nonce registers. dtsm = 0 (= 1 , if samode is not 11) dtsm = 1 dtsm = x dtsm = 0 (= 1 , if samode is not 11) dtsm = 1 8 host mcu triggers security processing and sending. txst 1 txst 1 txst 1 txst 1 txst 1 9 if secen = 1 and dtsm = 0 , then the device config- ures the secsuite, sec*indx and nonce registers. secsuite sec*indx nonce secsuite sec*indx nonce 10 device performs the secu- rity processing for mac layer: length is adjusted if mic tag is appended. txszif if size runs over 127 bytes. mac layer security length, if mic added mac layer security length, if mic added m a c layer security length, if mic added mac layer security length, if mic added 11 length is adjusted as crc is appended (if crcsz = 1 ). txszif if size runs over 127 bytes. length, crc 12 frame is sent. txif (if no txszif or frmif) txst 0 note 1: sec*indx denotes sechdrindx, secpayindx and secendindx. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 163 mrf24xa table 5-14: secured frame recept ion (ieee 802.15.4? mac format) # processing step steps per each security case abcde -2 device parses the secen bit in the framectrl. secen = 1 secen = 1 secen = 0 secen = 1 secen = 1 -1 for mac security processing, the device configures (correctly or incor- rectly) the following: secsuite sec*indx nonce incorrect configuration no mac layer security secsuite sec*indx nonce incorrect configuration 0 valid frame received on air and accepted by rxfilter. rxif = 1 , rxbufful = 1 , (rxsfdif = 1 ) 1 host mcu has the opportunity to check the secen, framever and samode bits in the mac header. framever = 0x (either) framever = 0x (either) framever = 0x (either) framever = 0x (either) framever = 0x (either) 2 for mac security processing, the host mcu must load the following: seckey (+nonce if samode is not 11) seckey secsuite sec*indx nonce no mac layer security seckey (+nonce if samode is not 11) seckey secsuite sec*indx nonce 3 host mcu starts mac security pro- cessing by setting rxdec. rxdec 1 rxdec 1 rxdec 1 rxdec 1 4 device performs mac layer security processing as illustrated in figure 5-4 through figure 5-9 . mac layer mac layer mac layer mac layer 5 if authentication fails then rxtagif is generated. otherwise, the security operation is successful and rxdecif is generated. rxdecif (or rxtagif) rxdecif (or rxtagif) rxdecif (or rxtagif) rxdecif (or rxtagif) 6 sw examines rxtagif, if set, sw aborts further processing and frees the buffer by clearing rxbufful.. rxtagif 1 rxtagif 1 rxtagif 1 rxtagif 1 7 for nwk security processing, the host mcu must load the following: no nwk layer security seckey secsuite sec*indx nonce seckey sec- suite sec*indx nonce seckey sec- suite sec*indx nonce 8 host mcu starts nwk security processing by setting rxdec. rxdec 1 rxdec 1 rxdec 1 9 device performs nwk layer security processing. (no figure) nwk layer security nwk layer security nwk layer security 10 if authentication fails , rxtagif is gen- erated. otherwise, the security opera- tion is successful and rxdecif is generated. the device clears rxdec. rxdecif (or rxtagif) rxdec 0 rxdecif (or rxtagif) rxdec 0 rxdecif (or rxtagif) rxdec 0 11 sw examines rxtagif, if set, sw aborts further processing and frees the buffer by clearing rxbufful. for the length 12 sw reads the entire frame from the buffer. 13 sw clears the rxbufful to free the buffer. downloaded from: http:///
mrf24xa ds70005023c-page 164 preliminary ? 2015 microchip technology inc. 5.8 security examples the following section provides examples for the usage of mrf24xa security. 5.8.1 802.15.4-2006 compliant frame annex c.2.2 (type a) configuration: network configuration: extended address, pan compression, and ackreq source address: 0xacde480000000001, where 01 is at address 0x1f destination address: 0xacde480000000002 panid 0x4321, where 21 is at address 0x29 payload: 61 62 63 64 frame counter: 0x00000005 security level: 0x04 packet: data packet. 5.8.1.1 transmission for 802.15.4-2006 compliant, follow these transmission flow: 1. host mcu constructs the frame and loads the buffer: 1e || 69 dc 84 21 43 02 00 00 00 00 48 de ac 01 00 00 00 00 48 de ac || 04 05 00 00 00 || 61 62 63 64 2. 3. 4. 5. 6. host mcu configures seckey. 0xc0c1c2c3c4c5c6c7c8c9cacbcccd- cecf, where lsb (0xcf) is at address 0x40 7. host mcu clears dtsm. 8. host mcu issues txst. 9. mrf24xa configures: - secsuite to 0x04 - secnonce to 0xac- de4800000000010000000504, where msb (0xac) is at address 0x5c - sechdrindx to 0x01 - secpayindx to 0x1b - secendindx to 0x1e. 10. mrf24xa performs ccm* encryption, where 61 62 63 64 is encrypted to d4 3e 02 2b. 11. mrf24xa appends crc: 0x18e0 . 12. mrf24xa transmits the packet to the medium. mrf24xa is waiting for an acknowledge frame. different if is received based on the reg- ister settings (for example, tx with csma). tx buffer (0x200) content: 20 || 69 dc 84 21 43 02 00 00 00 00 48 de ac 01 00 00 00 00 48 de ac || 04 05 00 00 00 || d4 3e 02 2b || e0 18 5.8.1.2 reception 1. mrf24xa receives the following packet through the antenna: 20 || 69 dc 84 21 43 02 00 00 00 00 48 de ac 01 00 00 00 00 48 de ac || 04 05 00 00 00 || d4 3e 02 2b || e0 18 2. mrf24xa configures: - secsuite to 0x04 - secnonce to 0xac- de4800000000010000000504, where msb (0xac) is at address 0x5c - sechdrindx to 0x01 - secpayindx to 0x1b - secendindx to 0x1e. 3. mrf24xa asserts rxif (rxsfdif): - packet accepted by rx filter - ack frame: 05 || 02 10 84 || 05 e2 sent to medium (asserts txsfd, txmaif). 4. 5. host mcu downloads seckey 0xc0c1c2c3c4c5c6c7c8c9cacbcccd- cec f, where lsb (0xcf) is at address 0x40. 6. host mcu issues rxdec. 7. mrf24xa performs ccm* decryption, d4 3e 02 2b is decrypted to 61 62 63 64. 8. mrf24xa asserts rxdecif (and idleif). 9. 10. 11. 12. 13. 14. 15. sw read the entire fram e from the rx buffer (0x300): 20 || 69 dc 84 21 43 02 00 00 00 00 48 de ac 01 00 00 00 00 48 de ac || 04 05 00 00 00 || 61 62 63 64 || e0 18 || rsvs downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 165 mrf24xa 5.8.2 802.15.4-2006 compliant frame annex c.2.3 (type a) network configuratio n: extended address, ackreq source address: 0xacde480000000001, where 01 is at address 0x1f source panid: 0x4321, where 21 is at address 0x29 destination address: 0xacde480000000002 destination panid: 0xffff payload: 01 ce frame counter: 0x00000005 security level: 0x06 packet: command packet 5.8.2.1 transmission 1. host mcu constructs the frame and loads the buffer: 1e || 2b dc 84 21 43 02 00 00 00 00 48 de ac ff ff 01 00 00 00 00 48 de ac || 06 05 00 00 00 || 01 ce 2. 3. 4. 5. 6. host mcu configures seckey 0xc0c1c2c3c4c5c6c7c8c9cacbcccd- cecf, where lsb (0xcf) is at address 0x40. 7. host mcu clears dtsm register. 8. host mcu issues txst. 9. mrf24xa configures: - secsuite to 0x06 - secnonce to 0xac- de4800000000010000000504, where msb (0xac) is at address 0x5c - sechdrindx to 0x01 - secpayindx to 0x1e (remember when type = cmd, first octet of payload is not encrypted) - secendindx to 0x1e. 10. mrf24xa performs ccm* authentication with encryption, where 01 ce is encrypted to 01 d8, and the following mic tag is attached: 4f de 52 90 61 f9 c6 f1 11. mrf24xa appends crc: 0x4fe4. 12. mrf24xa transmits the packet to the medium. mrf24xa is waiting for an ack frame. different if is received based on the register settings (for example, tx with csma). tx buffer (0x200) content: 28 || 2b dc 84 21 43 02 00 00 00 00 48 de ac ff ff 01 00 00 00 00 48 de ac || 06 05 00 00 00 || 01 d8 || 4f de 52 90 61 f9 c6 f1 || e4 4f 5.8.2.2 reception 1. mrf24xa receives the following packet through the antenna: 28 || 2b dc 84 21 43 02 00 00 00 00 48 de ac ff ff 01 00 00 00 00 48 de ac || 06 05 00 00 00 || 01 d8 || 4f de 52 90 61 f9 c6 f1 || e4 4f 2. mrf24xa configures: - secsuite to 0x06 - secnonce to 0xac- de4800000000010000000504, where msb (0xac) is at address 0x5c - sechdrindx to 0x01 - secpayindx to 0x1e - secendindx to 0x26. 3. mrf24xa asserts rxif (rxsfdif): - packet accepted by rx filter - ack frame: 05 || 02 10 84 || 05 e2 sent to medium (asserts txsfd, txmaif). 4. 5. host mcu downloads seckey 0xc0c1c2c3c4c5c6c7c8c9cacbcccd- cecf, where lsb (0xcf) is at address 0x40. 6. host mcu issues rxdec. 7. mrf24xa performs ccm* de-authentication and decryption, where the mic tag is compared against the received one, and 01 d8 is decrypted to 01 ce. 8. mrf24xa asserts rxdecif (and idleif). 9. 10. 11. 12. 13. 14. 15. sw can read the entire frame from rx buffer (0x300): 28 || 2b dc 84 21 43 02 00 00 00 00 48 de ac ff ff 01 00 00 00 00 48 de ac || 06 05 00 00 00 || 01 ce || 4f de 52 90 61 f9 c6 f1 || e4 4f || rsvs downloaded from: http:///
mrf24xa ds70005023c-page 166 preliminary ? 2015 microchip technology inc. 5.8.3 nwk layer security (type c) network configuration: extended address source address: n/a source panid: n/a destination address: 0x9897969594939291 destination panid: 0xd2d1 network header: 41 41 network payload: 14 14 network security level: 0x06 packet: data packet 5.8.3.1 transmission 1. host mcu constructs the frame and loads the buffer: 11 || 01 0c 14 d1 d2 91 92 93 94 95 96 97 98 || 41 41 14 14 2. host mcu configures security materials: - secsuite register to 0x06 - secnonce register to 0xfdfcfb- faf9f8f7f6f5f4f3f2f1, where msb (0xfd) is at address 0x5c - seckey register to 0x0f0e0d0c0b0a0908070605040302010, where lsb (0x00) is at address 0x40 - sechdrindx register to 0x0e - secpayindx register to 0x10 - secendindx register to 0x11. 3. host mcu issues txenc. 4. mrf24xa performs ccm* authentication with encryption, where 14 14 is encrypted to 14 da, and the following mic tag is attached: 53 99 39 a1 55 c5 d3 f6 5. mrf24xa asserts txencif (and idleif). 6. 7. 8. host mcu issues txst. 9. 10. 11. mrf24xa appends crc: 0x9bc9. 12. mrf24xa transmits the packet to the medium. different if is received based on the register settings (for example, tx with csma). tx buffer (0x200) content: 1b || 01 0c 14 d1 d2 91 92 93 94 95 96 97 98 || 41 41 14 da 53 99 39 a1 55 c5 d3 f6 || c9 9b 5.8.3.2 reception 1. mrf24xa receives the following packet through the antenna: 1b || 01 0c 14 d1 d2 91 92 93 94 95 96 97 98 || 41 41 14 da 53 99 39 a1 55 c5 d3 f6 || c9 9b 2. 3. mrf24xa asserts rxif (rxsfdif): packet accepted by rx filter. 4. 5. 6. 7. 8. 9. 10. host mcu configures security materials: - secsuite to 0x06 - secnonce to 0xfdfcfb- faf9f8f7f6f5f4f3f2f1, where msb (0xfd) is at address 0x5c - seckey to 0x0f0e0d0c0b0a0908070605040302010, where 00 is at address 0x40 - sechdrindx to 0x0e - secpayindx to 0x10. 11. host mcu issues rxdec. 12. mrf24xa performs ccm* de-authentication and decryption, where the mic tag is compared against the received one and 14 da is decrypted to 14 14. 13. mrf24xa asserts rxdecif (and idleif). 14. 15. sw can read the entire frame from rx buffer (0x300): 1b || 01 0c 14 d1 d2 91 92 93 94 95 96 97 98 || 41 41 14 14 53 99 39 a1 55 c5 d3 f6 || c9 9b || rsvs downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 167 mrf24xa 5.8.4 802.15.4-2006 compliant frame with nwk layer security (type d) network configuration: extended address source address: 0x0807060504030201, where lsb (0x01) is at address 0x1f source panid: 0xc2c1, where lsb (0xc1) is at address 0x29 destination address: 0x9897969594939291 destination panid: 0xd2d1 network header: 41 41 network payload: 14 14 network security level: 0x06 frame counter: 0x55555555 security level: 0x07 packet: command packet 5.8.4.1 transmission 1. host mcu constructs the frame and loads the buffer: 20 || 09 dc 14 d1 d2 91 92 93 94 95 96 97 98 c1 c2 01 02 03 04 05 06 07 08 || 07 55 55 55 55 || 41 41 14 14 2. host mcu configures security materials for nwk: - secsuite register to 0x06 - secnonce register to 0xfdfcfb- faf9f8f7f6f5f4f3f2f1, where msb (0xfd) is at address 0x5c - seckey register to 0x0f0e0d0c0b0a0908070605040302010, where lsb (0x00) is at address 0x40 - sechdrindx register to 0x1d - secpayindx register to 0x1f - secendindx register to 0x20. 3. host mcu issues txenc. 4. mrf24xa performs ccm* authentication with encryption, where 41 41 14 14 is encrypted to 41 41 14 da, and the following mic tag is attached: 53 99 39 a1 55 c5 d3 f6 mic-tag. 5. mrf24xa asserts txencif (and idleif). 6. host mcu downloads seckey 0x0f0e0d0c0b0a09080706050403020100, where lsb (0x00) is at address 0x40. 7. host mcu clears dtsm register. 8. host mcu issues txst. 9. mrf24xa configures: - secsuite to 0x07 - secnonce to 0x08070605040302015555555507, where msb (0x08) is at address 0x5c - sechdrindx to 0x01 - secpayindx to 0x1d - secendindx to 0x38. 10. mrf24xa performs ccm* authentication with encryption, where 41 41 14 da 53 99 39 a1 55 c5 d3 f6 is encrypted to c9 87 c6 d8 7f e4 bd a2 a4 00 89 9f, and the following mic tag is attached: b4 e6 9c b1 54 7f 9b b3 4089 77 fb 93 34 e2 d6 11. mrf24xa appends crc: 0x1aa8. 12. mrf24xa transmits the packet to the medium. different if is received based on the register settings (for example, tx with csma). tx buffer (0x200) content: 3a || 09 dc 14 d1 d2 91 92 93 94 95 96 97 98 c1 c2 01 02 03 04 05 06 07 08 || 07 55 55 55 55 || c9 87 c6 d8 7f e4 bd a2 a4 00 89 9f b4 e6 9c b1 54 7f 9b b3 40 89 77 fb 93 34 e2 d6 || a8 1a 5.8.4.2 reception 1. mrf24xa receives the following packet through the antenna: 3a || 09 dc 14 d1 d2 91 92 93 94 95 96 97 98 c1 c2 01 02 03 04 05 06 07 08 || 07 55 55 55 55 || c9 87 c6 d8 7f e4 bd a2 a4 00 89 9f b4 e6 9c b1 54 7f 9b b3 40 89 77 fb 93 34 e2 d6 || a8 1a 2. mrf24xa configures: - secsuite to 0x07 - secnonce to 0x08070605040302015555555507, where msb (0x08) is at address 0x5c - sechdrindx to 0x01 - secpayindx to 0x1d - secendindx to 0x38. 3. mrf24xa asserts rxif (rxsfdif): packet accepted by rx filter. 4. 5. host mcu configures seckey 0xc0c1c2c3c4c5c6c7c8c9cacbcccd- cecf, where lsb (0xcf) is at address 0x40. 6. host mcu issues rxdec. 7. mrf24xa performs ccm* de-authentication and decryption, where the mic tag is compared against the received one, and c9 87 c6 d8 7f e4 bd a2 a4 00 89 9f is decrypted to 41 41 14 da 53 99 39 a1 55 c5 d3 f6 downloaded from: http:///
mrf24xa ds70005023c-page 168 preliminary ? 2015 microchip technology inc. 8. mrf24xa asserts rxdecif (and idleif). 9. 10. host mcu configures security materials: - secsuite to 0x06 - secnonce to 0xfdfcfb- faf9f8f7f6f5f4f3f2f1, where msb (0xfd) is at address 0x5c - seckey to 0x0f0e0d0c0b0a0908070605040302010, where lsb (0x00) is at address 0x40 - sechdrindx to 0x1d - secpayindx to 0x1f. 11. host mcu issues rxdec. 12. mrf24xa performs ccm* de-authentication and decryption, where the mic tag is compared against the received one, and 14 da is decrypted to 14 14. 13. mrf24xa asserts rxdecif (and idleif). 14. 15. sw can read the entire frame from the rxbuffer (0x300): 3a || 09 dc 14 d1 d2 91 92 93 94 95 96 97 98 c1 c2 01 02 03 04 05 06 07 08 || 07 55 55 55 55 || 41 41 14 14 53 99 39 a1 55 c5 d3 f6 b4 e6 9c b1 54 7f 9b b3 40 89 77 fb 93 34 e2 d6 || a8 1a || rsvs 5.8.5 802.15.4-2003 compliant frame (type a) network configuration: extended address, pan compression source address: 0x0807060504030201, where 01 is at address 0x1f destination address: 0xaaaaaaaaaaaaaaaa panid: 0x3412 where 12 is at address 0x29 payload: ff frame counter: 0x0403020100 key sequence counter: 0x12 security level: ccm-32 (seclevel: 0x05) packet: data packet 5.8.5.1 transmission 1. host mcu constructs the frame and loads the buffer: 1b || 49 cc 01 12 34 aa aa aa aa aa aa aa aa 01 02 03 04 05 06 07 08 || 01 02 03 04 05 || ff 2. 3. 4. 5. 6. host mcu configures seckey: 0x000102030405060708090a0b0c0d0e0f, where lsb (0x0f) is at address 0x40. 7. host mcu clears dtsm. 8. host mcu issues txst. 9. mrf24xa configures: - secnonce to 0x01020304050607080102030405, where msb (0x01) is at address 0x5c - sechdrindx to 0x01 - secpayindx to 0x1b - secendindx to 0x1b. 10. mrf24xa performs ccm* authentication with encryption, where ff is encrypted to ac, and the following mic tag is attached: fc 30 db bd 11. mrf24xa appends crc: 0xeb32. 12. mrf24xa transmits the packet to the medium. different if is received based on the register settings (for example, tx with csma). tx buffer (0x200) content: 21 || 49 cc 01 12 34 aa aa aa aa aa aa aa aa 01 02 03 04 05 06 07 08 01 02 03 04 05 || ac fc 30 db bd || 32 eb downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023b-page 169 mrf24xa 6.0 proprietary frame format and frame processing 6.1 proprietary mac frame configuration figure 6-1 shows the proprietary mac header struc- ture. figure 6-2 shows the specific format of acknowl- edge frame. the frame buffer is written first with the length field byte, and then followed by the framectrl field. an optional acknowledge info field is sent before the sequence. figure 6-1: proprietary mac header structure 6.2 frame types (1 bit) ackreq (1 bit) repeat (1 bit) secen (1 bit) broadcast (1 bit) saddrprsnt (1 bit) 1 byte of framectrl (proprietary) type (2 bits) 7 6 54 3 2 1:0 ackinfo (0-1 octets) sequence destaddr (0-8 octets) srcaddr (0-8 octets) auxsechdr (0-3 octets) framectrl (1 octets) destination source mhr: mac header (proprietary) daddrprsnt table 6-1: frame types (both protocols) frame type ieee mi-wi description data 001 01 filtered by datarej command 011 11 filtered by cmdrej first byte of payload (command) is never encrypted. ack 010 10 acknowledge frame must be generated by the receiver (from sw or hw) if ackreq = 1 in the last received frame, us ing the same sequence number. acknowledge frame is generat ed by hardware (autoacken = 1 ). if this is the case, it is not loaded to the tx frame buffer. autoacken = 1 requires crcsz = 1 on both the transmitter and the receiver side. beacon 000 (limited hw support) n/a filtered by bcrej otherwise, this device does not pr ovide support for parsing on beacon frames. security processing requir es adjusting the payload index (secpayindx). beacon frames are only used with broadcast addressing. downloaded from: http:///
mrf24xa ds70005023b-page 170 preliminary ? 2015 microchip technology inc. figure 6-2: proprietary mac header structure: acknowledge frame 6.3 addressing in proprietary framing mode the following fields are handled using these examples: header sequence number address data/command crc inferred destination addressing: the destination address participates in the crc computation as part of the frame, but it is omitted from the frame that is sent into the air. streaming n/a 00 trxmode= 01 by transmitter trxmode= 10 by receiver the two buffers are handled by alternating between the two to service a single direction. security parsing makes no distinction between streaming frames and data frames. streaming frames are never acknowledged. table 6-1: frame types (both protocols) (continued) frame type ieee mi-wi description daddrprsnt (1 bit) ackreq (1 bit) repeat (1 bit) secen (1 bit) broadcast (1 bit) saddrprsnt (1 bit) type (2 bits) 7 6 54 3 2 1:0 framectrl (1 octet) sequence (1 octet) fcs (2 octets) length (1 octet) mhr 1 byte of framectrl (proprietary) = 0x06 0 0 0 0 0 1 10 acknowledge frame (proprietary) downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023b-page 171 mrf24xa legend: r = reserved, read as 0. table 6-2: relevant registers for proprietary mode addressing addr. register bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 0x10 maccon1 trxmode<1:0> addrsz <2:0> crcsz frmfmt secflagovr 0x1f addr1 addr<7:0> 0x20 addr2 addr<15:8> 0x21 addr3 addr<23:16> 0x22 addr4 addr<31:24> 0x23 addr5 addr<39:32> 0x24 addr6 addr<47:40> 0x25 addr7 addr<55:48> 0x26 addr8 addr<63:56> table 6-3: example configuration tx and rx common addrsz<2:0>= 101 => (means that addr<63:40> is not used) tx (source) configuration addr<63:0>= 0xxxxx060504030201 (4 msbs not used) shaddr<15:0> = xx xx (not used) panid <15:0> = xx xx (not used) rx (destination) configuration addr<63:0>= 0xxxxx969594939291 (4 msbs not used) shaddr<15:0> = xx xx (not used) panid <15:0> = xx xx (not used) framectrl type<1:0> | broadcast| 0 | 0 | 0 | daprsnt | saprsnt type is not acknowledge (not = 00) frame length | framectrl | sequence+ + | dest | src | payload | (crc) table 6-4: legal destination addressing options using the example options: broadcast unicast addrsz<2:0> inferred example dest. 0x969594939291 type xx xx xx broadcast 1 0 0 daprsn x 1 0 addrsz<2:0> xxx 3'b101 xxx crcsz x xx 1 table 6-5: legal source addressing options using the example options: unicast addrsz<2:0> inferred example src. 0x060504030201 type xx xx saprsnt 0 0 addrsz<2:0> 3'b101 xxx downloaded from: http:///
mrf24xa ds70005023b-page 172 preliminary ? 2015 microchip technology inc. register 6-1: rxfilter (rx filter register) address: 0x18 r/w-0 r/w-1 r/w-1 r/w-1 r/w-1 r/w-1 r/w-1 r/w-1 pancrdn crcrej cmdrej datarej unirej notmerej bcrej nstdrej bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-6 out of scope bit 5 cmdrej: command frame reject enable bit setting this bit enables the user to reject all packets with framectrl equal to command. 1 = reject all command packets 0 = disable command frame rejection bit 4 datarej: data frame reject enable bit setting this bit enables the user to reject all packets with framectrl equal to data. 1 = reject all data packets 0 = disable data frame rejection bit 3-0 out of scope downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023b-page 173 mrf24xa 6.3.1 inferred destination addressing inferred destination addressing is indicated in the proprietary frame format through the combination of daddrpresent = 0 and broadcast = 0 flags in the frame header (framecontrol field) and crcsz = 1 in the maccon1 register. the transmitter calculates the crc over the complete frame, see figure 6-3 , but drops the destination address (daddr) from the transmitted one, see figure 6-4 . the receiver checks the crc with its own address inserted. in the case of a match the frame is accepted, otherwise it is si lently discarded. this way crc filtering takes over the role of address-match fil- tering. as the framing overhead becomes shorter, the duty- cycle of the radio gets decreased or the throughput gets increased. therefore, the energy consumed by sending a single byte can outweigh the energy budget of hundreds of mcu byte-o perations, the impact on battery life is straightforward. note that in case of infe rred da, the ackinfo field is mandatory when ackreq = 1. otherwise, the ackinfo field is only mandatory if adptdren = 1 or adptchen = 1. figure 6-3: inferred destination address mode framectrl seqno daddr saddr payload crc transmitter constructs the frame framectrl seqno saddr payload crc frame sent into the air without the daddr field framectrl seqno naddr saddr payload crc receiver checks the crc using its own node address = daddr present = false . note 1: the indicated frame format is arbitrary to some extent. seqno and saddr refer to sequence num- ber and source address respectively. ( 1 ) downloaded from: http:///
mrf24xa ds70005023b-page 174 preliminary ? 2015 microchip technology inc. 6.4 security material retrieval support with proprietary frames figure 6-4: proprietary mac auxsechdr octets (only present when secen = 1 ) as the macpayindex and netp ayindex fields can point anywhere in the frame (within the range of pointer rep- resentation), it is the arbitr ary choice of the application weather the nonce and the security suite is included in the frame or not. seclayer (2 bits) macpayindex (6 bits) 1-byte seclayer (2 bits) nethdrindex (7 bits) 2 bytes netpayindex (7 bits) seclayer (2 bits) macpayindex (6 bits) 3 bytes nethdrindex (7 bits) 0 netpayindex (7 bits) 0 seclayer = 10 (mac and nwk layer security) seclayer = 01 (nwk layer security only) seclayer = 00 (mac layer security only) 7:2 1:0 1:0 1:0 8:2 15:9 7:2 14:8 22:16 23 15 note: always encode security in dices with da present (inferred da mode). downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023b-page 175 mrf24xa 6.5 security processing of transmitted proprietary frames setting txst triggers automatic security processing and frame sending as an uninterrupted sequence as shown in figure 6-5 . which is triggered by txenc is only required when both nwk layer and mac layer security are applied, see figure 6-6 . in this case, txenc is set to perform nwk layer security and txencif must be awaited, then mac security is con- figured and txst is set to launch the mac security processing and sending. buf1txpp, buf2txpp, txenc, and txst can trigger security functions as shown in figure 6-5 and figure 6-6 , where buf1txpp and buf2txpp are both used for debug. the respective interrupts are generated on completion and the device automatically clears the aforementioned triggering bits. figure 6-5 illustrates the conditions for security material retrieval. figure 6-5: transmit security processing when frmfmt = 1 (proprietaryC format) enter secen ahr parsed dtsm seclayer = 00 or seclayer = 10 sechdrindx 1 secpayindx macpayindex ctr, cbc-mac, ccm* exit nwk security to do only sechdrindx nethdrindex secpayindx netpayindex seclayer = 11 is undefined no yes yes mac security left to do mhr parsed already no 1 0 before launching the transmit processing - sw always configures seckey, secsuite, secnonce. - sw must never configure sechdrindx, secpayindx, secendindx, except if dtsm = 1 . 1 0 no security seclayer = 01 ( figure 4-9 ) downloaded from: http:///
mrf24xa ds70005023b-page 176 preliminary ? 2015 microchip technology inc. figure 6-6: transmitter txenc processing when frmfmt = 1 (proprietary C format) txenc 1 seclayer = 10 dtsm sechdrindx nethdrindex secpayindx netpayindex ctr, cbc-mac, ccm* txenc 0 interrupt service unintended use: sechdrindx, secpayindx and secendindx configured for mac layer sw configured seckey, secsuite and secnonce. txenc is only required for nwk layer security processing in the case when seclayer = 10 (implying that mac layer security is applied on setting txst). nwk+mac layer do nwk layer no yes 1 0 downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023b-page 177 mrf24xa 6.6 security processing of received proprietary frames receive security is always performed when rxdec is set and awaits rxdecif or rxtagif as it is not auto- matically triggered. if both mac and nwk layer secu- rity are applied, then both must be processed in this order when rxdec is set for a second time after updat- ing the security material correctly. figure 6-7 shows the security functions triggered by rxdec. the respective interrupts are generated on completion and the device automatically clears the rxdec. figure 6-7: receiver rxdec processing when frmfmt = 1 (proprietary) rxdec 1 sechdrindx nethdrindex secpayindx netpayindex rxdec 0 rxdecif 1 interrupt service the valid frame is available in buf2 in mission mode, or in the buffer selected by buf1rxpp or buf2rxpp during debug. device and sw have both parsed the frame. refer to for security material retrieval support. sw has configured seckey secsuite, secnonce as required for the frame, and can also overwrite the conf igurations in sechdrindx, secpayindx ctr, cbc-mac, ccm* mic tag match? seclayer = 10 ? rxdec 0 rxtagif 1 authentication failed success upon successful mac layer processing, if network layer is also secured, the indexes are retrieved. sw must update seckey, secnonce, secsuite yes no no match yes figure 6-4 secendndx mic-tag length downloaded from: http:///
mrf24xa ds70005023b-page 178 preliminary ? 2015 microchip technology inc. 6.7 security procedure for proprietary frames provided that secen is set (1) in the mhr, three levels of security processing are possible, based on the seclayer<1:0> bits carried in the auxsechdr<1:0> field of a given frame: 00-mac only, 01-nwk only, 10-mac and nwk. table 6-6: secured frame transmission (proprietary mac format) # processing step steps per each security case mac only nwk only mac + nwk layer 1 host mcu constructs the frame and loads the buffer. secen = 1 secen = 1 secen = 1 2 for nwk security processing, host mcu configures: no nwk layer security seckey secsuite nonce seckey secsuite nonce 3 host mcu triggers security processing without sending. no txenc. host: txenc 1 4 device performs the security processing for nwklayer if txenc is set. secpayindx, sechdrindx are filled in from nethdrin- dex, netpayindex, respectively. secendindx initially points at the last payload byte. length and secendindx are updated if mic tag is appended. txszif if size runs over 127 bytes. nwk layer security secpayindx sechdrindx length, secendindx 5 host mcu awaits txencif interrupt, indicating completion. device clears txenc. txencif 1 txenc 0 6 for mac security processing, host mcu configures: seckey secsuite nonce no mac security. seckey secsuite nonce 7 host mcu triggers security processing and sending. host: txst 1 host: txst 1 host: txst 1 8if secen = 1 and dtsm = 0 then the device config- ures the sec*indx registers using macpayindex, machdrindex and the length field. sechdrindx secpayindx secendindx sechdrindx secpayindx secendindx 9 device performs the security processing for the indicated layer: length is adjusted if ma c or nwk layer mic tag is appended. txszif if size run over 127 bytes. mac layer security length if mic added nwk layer security length if mic added mac layer security length if mic added 10 length is adjusted as crc is appended (if crcsz = 1 ). txszif if size run over 127 bytes. length, crc 11 frame is sent. txif (if no txszif or frmif) txst 0 downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023b-page 179 mrf24xa table 6-7: secured frame recept ion (proprietary mac format) # processing step steps per each security case mac only nwk only mac + nwk layer -2 device parses the secen bit in the framectrl. secen = 1 secen = 1 secen = 1 -1 for mac security processing, the device config- ures the sechdrindx, secpayindx based on the auxiliary security header, as well as the secendindx based on the length field. sec*indx from machdrindex, macpayindex and the length sec*indx from nethdrindex, net- payindex and the length sec*indx from machdrindex, macpayindex and the length 0 valid frame received and accepted by rxfilter. rxif = 1 , rxbufful = 1 , (rxsfdif = 1 ) 1 host mcu reads the frame header to check secen, seclayer, source address, and so on. read frame header from buffer. 2 for mac security processi ng, the host mcu must load the following: seckey nonce secsuite no mac layer security seckey nonce secsuite 3 host mcu starts mac security processing by set- ting rxdec. host: rxdec 1 host: rxdec 1 4 device performs mac layer security. mac layer security mac layer security 5 if seclayer = 10 then sec*indx are filled in preparation for network layer security processing following in the sequel. sec*indx from nethdrindex, net- payindex and the mac layer mic-posi- tion (if present) 6 if authentication fails then rxtagif is generated otherwise the security ope ration is successful and rxdecif is generated. device clears rxdec. rxdecif (or rxtagif) rxdec 0 rxdecif (or rxtagif) rxdec 0 7 sw examines rxtagif. if set, sw aborts further processing and frees the buffer by clearing rxbufful. rxtagif 1 rxtagif 1 8 for nwk security processi ng, the host mcu must load the following: no nwk layer security seckey secsuite nonce seckey secsuite nonce 9 host mcu starts nwk security processing by set- ting rxdec. host: rxdec 1 host: rxdec 1 10 device performs nwk layer security processing. (no figure). nwk layer security nwk layer security 11 if authentication fails then rxtagif is generated. otherwise, the security operation is successful and rxdecif is generated. device clears rxdec. rxdecif (or rxtagif) rxdec 0 rxdecif (or rxtagif) rxdec 0 12 sw examines rxtagif. if set, sw aborts further processing and frees the buffer by clearing rxbufful. rxtagif 1 rxtagif 1 13 sw reads the payload from the buffer. 14 sw clears the rxbufful to free the buffer. rxbufful 0 downloaded from: http:///
mrf24xa ds70005023b-page 180 preliminary ? 2015 microchip technology inc. 6.8 security examples this section provides examples for proprietary mode framing. 6.8.1 mac layer security example 1 network configuration: address size is 8 bytes source address: 0x0807060504030201, where lsb (0x01) is at address 0x1f destination address: 0x9897969594939291 payload: ba ba mac security level: 0x04 mac security indices: only encode from the sec- ond payload packet: data packet 6.8.1.1 transmission 1. host mcu constructs the frame and loads the buffer: 15 || c9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 54 || ba ba 2. 3. 4. 5. 6. host mcu configures: - secsuite to 0x04 - seckey to 0x0f0e0d0c0b0a0908070605040302010, where lsb (0x00) is at address 0x40 - secnonce to 0x08070605040302015555555506, where msb (0x08) is at address 0x5c. 7. host mcu sets the txst register 8. mrf24xa configures: - sechdrindx to 0x01 - secpayindx to 0x15 - secendindx to 0x15. 9. mrf24xa performs ccm* encryption, where ba ba is encrypted to ba f7. 10. mrf24xa appends crc: 0x9d0a. 11. mrf24xa transmits the packet to the medium. different if is received based on the register settings (for example, tx with csma). tx buffer (0x200) content: 17 || c9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 54 || ba f7 || 0a 9d 6.8.1.2 reception 1. mrf24xa receives the following packet through the antenna: 17 || c9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 54 || ba f7 || 0a 9d 2. mrf24xa configures: - sechdrindx to 0x01 - secpayindx to 0x15 - secendindx to 0x15. 3. mrf24xa asserts rxif (rxsfdif): packet accepted by rx filter. 4. 5. host mcu configures: - secsuite to 0x04 - seckey to 0x0f0e0d0c0b0a0908070605040302010, where lsb (0x00) is at address 0x40 - secnonce to 0x08070605040302015555555506, where msb (0x08) is at address 0x5c. 6. host mcu issues rxdec. 7. mrf24xa performs ccm* decryption, where ba f7 is decrypted to ba ba. 8. mrf24xa asserts rxdecif (and idleif). 9. 10. 11. 12. 13. 14. 15. 16. sw read the entire frame from rx buffer (0x300): 17 || c9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 54 || ba ba || 0a 9d || rsvs downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023b-page 181 mrf24xa 6.8.2 mac layer security example 2 network configuration: address size is 8 bytes, inferred destination addressing source address: 0x0807060504030201, where lsb (0x01) is at address 0x1f destination address: 0x9897969594939291 payload: ba ba mac security level: 0x07 mac security indices: only encode from the sec- ond payload packet: data packet 6.8.2.1 transmission 1. host mcu constructs the frame and loads the buffer: 15 || 09 55 91 92 93 94 95 96 97 98 || 34 || ba ba always encode security indices with da present in auxsechdr! 2. 3. 4. 5. 6. host mcu configures: - secsuite to 0x07 - seckey to 0x0f0e0d0c0b0a09080706050403020100, where lsb (0x00) is at address 0x40 - secnonce 0x08070605040302015555555506, where msb (0x08) is at address 0x5c. 7. host mcu issues txst. 8. mrf24xa configures - sechdrindx to 0x01 - secpayindx to 0x0d - secendindx to 0x0d. 9. mrf24xa performs ccm* authentication with encryption, where ba ba is encrypted to ba f7, and the following mic tag is attached: 00 11 6c 8c 59 02 66 ac 5b dc 2d 30 21 1e d0 0c 10. mrf24xa appends crc: 0xa2d2. 11. mrf24xa transmits the packet to the medium. different if is received based on the register settings (for example, tx with csma). packet transmitted to the medium: 17 || 09 55 || 34 || ba f7 || 00 11 6c 8c 59 02 66 ac 5b dc 2d 30 21 1e d0 0c || d2 a2 tx buffer (0x200) content: 1f || 09 55 91 92 93 94 95 96 97 98 || 34 || ba f7 || 00 11 6c 8c 59 02 66 ac 5b dc 2d 30 21 1e d0 0c || d2 a2 6.8.2.2 reception 1. mrf24xa receives the following packet through the antenna: 17 || 09 55 || 34 || ba f7 || 00 11 6c 8c 59 02 66 ac 5b dc 2d 30 21 1e d0 0c || d2 a2 2. mrf24xa configures: - sechdrindx to 0x01 - secpayindx to 0x0d (inferred da is considered) - secendindx to 0x15. 3. mrf24xa asserts rxif (rxsfdif): packet accepted by rx filter. 4. 5. host mcu configures: - secsuite to 0x07 - seckey to 0x0f0e0d0c0b0a09080706050403020100, where lsb (0x00) is at address 0x40 - secnonce to 0x08070605040302015555555506, where msb (0x08) is at address 0x5c. 6. host mcu issues rxdec. 7. mrf24xa performs ccm* de-authentication and decryption, where the mic tag is compared against the received one, and ba f7 is decrypted to ba ba. 8. mrf24xa asserts rxdecif (and idleif). 9. 10. 11. 12. 13. 14. 15. sw read the entire frame from rx buffer (0x300): 17 || 09 55 || 34 || ba ba || 00 11 6c 8c 59 02 66 ac 5b dc 2d 30 21 1e d0 0c || d2 a2 || rsvs downloaded from: http:///
mrf24xa ds70005023b-page 182 preliminary ? 2015 microchip technology inc. 6.8.3 mac layer security example 3 network configuration: address size is 1 byte, inferred destination addressing source address: 0x01 (is at address 0x1f) destination address: 0x91 payload: ba ba mac security level: 0x07 mac security indices: only encode from the sec- ond payload packet: data packet 6.8.3.1 transmission 1. host mcu constructs the frame and loads the buffer: 06 || 09 55 91 || 18 || ba ba. always encode security indices with da present in auxsechdr! 2. 3. 4. 5. 6. host mcu configures: - secsuite to 0x07 - seckey to 0x0f0e0d0c0b0a09080706050403020100, where lsb (0x00) is at address 0x40 - secnonce 0x08070605040302015555555506, where msb (0x08) is at address 0x5c. 7. host mcu issues txst. 8. mrf24xa configures: - sechdrindx to 0x01 - secpayindx to 0x06 - secendindx to 0x06. 9. mrf24xa performs ccm* authentication with encryption, where ba ba is encrypted to ba f7, and the following mic tag is attached: 35 84 fc 4f 1b 92 36 d2 8f d5 d8 b6 68 79 6a 13 10. mrf24xa appends crc: 0x23a9. 11. mrf24xa transmits the packet to the medium. different if is received based on the register settings (for example, tx with csma). packet transmitted to the medium: 17 || 09 55 || 18 || ba f7 || 35 84 fc 4f 1b 92 36 d2 8f d5 d8 b6 68 79 6a 13 || a9 23 tx buffer (0x200) content: 18 || 09 55 91 || 18 || ba f7 || 35 84 fc 4f 1b 92 36 d2 8f d5 d8 b6 68 79 6a 13 || a9 23 6.8.3.2 reception 1. mrf24xa receives the following packet through the antenna: 17 || 09 55 || 18 || ba f7 || 35 84 fc 4f 1b 92 36 d2 8f d5 d8 b6 68 79 6a 13 || a9 23 2. mrf24xa configures: - sechdrindx to 0x01 - secpayindx to 0x06 (inferred da is considered) - secendindx to 0x15. 3. mrf24xa asserts rxif (rxsfdif): packet accepted by rx filter. 4. 5. host mcu configures: - secsuite to 0x07 - seckey to 0x0f0e0d0c0b0a09080706050403020100, where lsb (0x00) is at address 0x40 - secnonce to 0x08070605040302015555555506, where msb (0x08) is at address 0x5c. 6. host mcu issues rxdec. 7. mrf24xa performs ccm* de-authentication and decryption, where the mic tag is compared against the received one, and ba f7 is decrypted to ba ba. 8. mrf24xa asserts rxdecif (and idleif). 9. 10. 11. 12. 13. 14. 15. sw read the entire frame from rx buffer (0x300): 17 || 09 55 || 18 || ba ba || 35 84 fc 4f 1b 92 36 d2 8f d5 d8 b6 68 79 6a 13 || a9 23 || rsvs downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023b-page 183 mrf24xa 6.8.4 nwk layer security example 1 network configuration: address size is 8 bytes source address: 0x0807060504030201, where lsb (0x01) is at address 0x1f destination address: 0x9897969594939291 network header: ba ba network payload: ab ab net security level: 0x01 packet: data packet 6.8.4.1 transmission 1. host mcu constructs the frame and loads the buffer: 15 || c9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 55 2e || ba ba ab ab 2. host mcu configures: - secsuite to 0x01 - seckey to 0x0f0e0d0c0b0a09080706050403020100, where lsb (0x00) is at address 0x40 - secnonce 0x08070605040302015555555506, where msb (0x08) is at address 0x5c. 3. 4. 5. 6. 7. host mcu issues txst. 8. mrf24xa configures: - sechdrindx to 0x15 - secpayindx to 0x17 - secendindx to 0x18. 9. mrf24xa performs ccm* authentication, where the following mic tag is attached: fb 17 32 26 10. mrf24xa appends crc: 0xaa70. 11. mrf24xa transmits the packet to the medium. different if is received based on the register settings (for example, tx with csma). tx buffer (0x200) content: 1e || c9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 55 2e || ba ba fb 17 32 26 || 70 aa 6.8.4.2 reception 1. mrf24xa receives the following packet through the antenna: 1e || c9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 55 2e || ba ba fb 17 32 26 || 70 aa 2. mrf24xa configures: - sechdrindx to 0x15 - secpayindx to 0x17 - secendindx to 0x18. 3. mrf24xa asserts rxif (rxsfdif): packet accepted by rx filter. 4. 5. 6. 7. 8. 9. 10. 11. host mcu configures: - secsuite to 0x04 - seckey to 0x0f0e0d0c0b0a09080706050403020100, where lsb (0x00) is at address 0x40 - secnonce to 0x08070605040302015555555506, where msb (0x08) is at address 0x5c. 12. host mcu issues rxdec. 13. mrf24xa performs ccm* de-authentication, where the mic tag is compared against the received one. 14. mrf24xa asserts rxdecif (and idleif). 15. 16. sw read the entire frame from rx buffer (0x300): 1e || c9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 55 2e || ba ba fb 17 32 26 || 70 aa || rsvs downloaded from: http:///
mrf24xa ds70005023b-page 184 preliminary ? 2015 microchip technology inc. 6.8.5 nwk layer security example 2 network configuration: address size is 8 bytes, inferred destination addressing source address: 0x0807060504030201 where lsb (0x01) is at address 0x1f destination address: 0x9897969594939291 network header: ba ba network payload: ab ab security level: 0x07 packet: data packet 6.8.5.1 transmission 1. host mcu constructs the frame and loads the buffer: 15 || 89 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 55 2e || ba ba ab ab 2. host mcu configures: - secsuite to 0x07 - seckey to 0x0f0e0d0c0b0a09080706050403020100, where lsb (0x00) is at address 0x40 - secnonce 0x08070605040302015555555506, where msb (0x08) is at address 0x5c. 3. 4. 5. 6. 7. host mcu issues txst. 8. mrf24xa configures: - sechdrindx to 0x15 - secpayindx to 0x17 - secendindx to 0x18. 9. mrf24xa performs ccm* authentication and encryption, where ba ba ab ab is encrypted to ba ba e6 e5, and the following mic tag is attached: 77 fe 46 e2 d4 0e 1d c6 34 d9 34 36 4f 28 2f d8 10. mrf24xa appends crc: 0x55c1. 11. mrf24xa transmits the packet to the medium. different if is received based on the register settings (for example, tx with csma). packet transmitted to the medium: 22 || 89 55 01 02 03 04 05 06 07 08 || 55 2e || ba ba e6 e5 77 fe 46 e2 d4 0e 1d c6 34 d9 34 36 4f 28 2f d8 || c1 55 tx buffer (0x200) content: 2a || 89 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 55 2e || ba ba e6 e5 77 fe 46 e2 d4 0e 1d c6 34 d9 34 36 4f 28 2f d8 || c1 55 6.8.5.2 reception 1. mrf24xa receives the following packet through the antenna: 22 || 89 55 01 02 03 04 05 06 07 08 || 55 2e || ba ba e6 e5 77 fe 46 e2 d4 0e 1d c6 34 d9 34 36 4f 28 2f d8 || c1 55 2. mrf24xa configures: - sechdrindx to 0x15 (inferred da is considered) - secpayindx to 0x17 (inferred da is considered) - secendindx to 0x20. 3. mrf24xa asserts rxif (rxsfdif): packet accepted by rx filter. 4. 5. 6. 7. 8. 9. 10. 11. host mcu configures: - secsuite to 0x07 - seckey to 0x0f0e0d0c0b0a09080706050403020100, where lsb (0x00) is at address 0x40 - secnonce to 0x08070605040302015555555506, where msb (0x08) is at address 0x5c. 12. host mcu issues rxdec. 13. mrf24xa performs ccm* de-authentication and decryption, where the mic tag is compared against the received one, and ba ba e6 e5 is decrypted to ba ba ab ab. 14. mrf24xa asserts rxdecif (and idleif). 15. 16. sw read the entire frame from rx buffer (0x300): 22 || 89 55 01 02 03 04 05 06 07 08 || 55 2e || ba ba ab ab 77 fe 46 e2 d4 0e 1d c6 34 d9 34 36 4f 28 2f d8 || c1 55 || rsvs downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023b-page 185 mrf24xa 6.8.6 nwk layer example 3 network configuration: address size is 1 byte, inferred destination addressing source address: 0x01 (is at address 0x1f) destination address: 0x91 network header: ba ba network payload: ab ab security level: 0x07 packet: data packet 6.8.6.1 transmission 1. host mcu constructs the frame and loads the buffer: 0a || 89 55 91 01 || 1d 12 || ba ba ab ab 2. host mcu configures: - secsuite to 0x07 - seckey to 0x0f0e0d0c0b0a09080706050403020100, where lsb (0x00) is at address 0x40 - secnonce 0x08070605040302015555555506, where msb (0x08) is at address 0x5c. 3. 4. 5. 6. 7. host mcu issues txst. 8. mrf24xa configures: - sechdrindx to 0x07 - secpayindx to 0x09 - secendindx to 0x0a. 9. mrf24xa performs ccm* authentication and encryption, where ba ba ab ab is encrypted to ba ba e6 e5, and the following mic tag is attached: 77 fe 46 e2 d4 0e 1d c6 34 d9 34 36 4f 28 2f d8 10. mrf24xa appends crc: 0xcd05. 11. mrf24xa transmits the packet to the medium. different if is received based on the register settings (for example, tx with csma). packet transmitted to the medium: 1b || 89 55 01 || 1d 12 || ba ba e6 e5 77 fe 46 e2 d4 0e 1d c6 34 d9 34 36 4f 28 2f d8 || 05 cd tx buffer (0x200) content: 1c || 89 55 91 01 || 1d 12 || ba ba e6 e5 77 fe 46 e2 d4 0e 1d c6 34 d9 34 36 4f 28 2f d8 || 05 cd 6.8.6.2 reception 1. mrf24xa receives the following packet through the antenna: 1b || 89 55 01 || 1d 12 || ba ba e6 e5 77 fe 46 e2 d4 0e 1d c6 34 d9 34 36 4f 28 2f d8 || 05 cd 2. mrf24xa configures: - sechdrindx to 0x07 (inferred da is considered) - secpayindx to 0x09 (inferred da is considered) - secendindx to 0x19. 3. mrf24xa asserts rxif (rxsfdif): packet accepted by rx filter. 4. 5. 6. 7. 8. 9. 10. 11. host mcu configures: - secsuite to 0x07 - seckey to 0x0f0e0d0c0b0a09080706050403020100, where lsb (0x00) is at address 0x40 - secnonce to 0x08070605040302015555555506, where msb (0x08) is at address 0x5c. 12. host mcu issues rxdec. 13. mrf24xa performs ccm* de-authentication and decryption, where the mic tag is compared against the received one, and ba ba e6 e5 is decrypted to ba ba ab ab. 14. mrf24xa asserts rxdecif (and idleif). 15. 16. sw read the entire frame from the rx buffer (0x300): 1b || 89 55 01 || 1d 12 || ba ba ba ba 77 fe 46 e2 d4 0e 1d c6 34 d9 34 36 4f 28 2f d8 || 05 cd || rsvs downloaded from: http:///
mrf24xa ds70005023b-page 186 preliminary ? 2015 microchip technology inc. 6.8.7 mac and nwk layer security example 1 network configuration: address size is 8 bytes source address: 0x0807060504030201, where lsb (0x01) is at address 0x1f destination address: 0x9897969594939291 payload: ba ba network header: ab network payload: ab network security level: 0x07 mac security level: 0x03 mac security indices: only encode from the sec- ond payload packet: data packet 6.8.7.1 transmission 1. host mcu constructs the frame and loads the buffer: 19 || c9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 5e 18 19 || ba ba ab ab 2. host mcu configures: - secsuite to 0x07 - seckey to 0x0f0e0d0c0b0a09080706050403020100, where lsb (0x00) is at address 0x40 - secnonce 0x08070605040302015555555506, where msb (0x08) is at address 0x5c. 3. host mcu issues txenc. 4. mrf24xa configures: - sechdrindx to 0x18 - secpayindx to 0x19 - secendindx to 0x19. 5. mrf24xa performs ccm* authentication with encryption, where ab ab is encrypted to ab e6, and the following mic tag is attached: ab 4b 03 7b b7 30 98 b1 e5 93 ca d7 86 81 8a 2d 6. mrf24xa asserts txencif (and idleif). 7. host mcu configures: - secsuite to 0x03 - seckey to 0xfffefdfcfb- faf9f8f7f6f5f4f3f2 f1f0, where lsb (0xf0) is at address 0x40 - secnonce 0xf8f7f6f5f4f3f2f15555555506, where (0xf8) is at address 0x5c. 8. host mcu issues txst. 9. mrf24xa configures: - sechdrindx to 0x01 - secpayindx to 0x17 - secendindx to 0x29. 10. mrf24xa performs ccm* authentication, where the following mic tag is attached: 05 15 ab 5f 6c 7d 5c 70 6c 96 91 c0 34 e5 18 0d 11. mrf24xa appends crc: 0x717b. 12. mrf24xa transmits the packet to the medium. different if is received based on the register settings (for example, tx with csma). tx buffer (0x200) content: 3b || c9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 5e 18 19 || ba ba ab e6 ab 4b 03 7b b7 30 98 b1 e5 93 ca d7 86 81 8a 2d 05 15 ab 5f 6c 7d 5c 70 6c 96 91 c0 34 e5 18 0d || 7b 71 6.8.7.2 reception 1. mrf24xa receives the following packet through the antenna: 3b || c9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 5e 18 19 || ba ba ab e6 ab 4b 03 7b b7 30 98 b1 e5 93 ca d7 86 81 8a 2d 05 15 ab 5f 6c 7d 5c 70 6c 96 91 c0 34 e5 18 0d || 7b 71 2. mrf24xa configures: - sechdrindx to 0x01 - secpayindx to 0x17 - secendindx to 0x39. 3. mrf24xa asserts rxif (rxsfdif): packet accepted by rx filter. 4. 5. host mcu configures: - secsuite to 0x03 - seckey to 0xfffefdfcfb- faf9f8f7f6f5f4f3f2 f1f0, where lsb (0xf0) is at address 0x40 - secnonce 0xf8f7f6f5f4f3f2f15555555506, where msb (0xf8) is at address 0x5c. 6. host mcu issues rxdec. 7. mrf24xa performs ccm* de-authentication, where the mic tag is compared against the received one. 8. mrf24xa configures: - sechdrindx to 0x18 - secpayindx to 0x19 - secendindx to 0x29. 9. mrf24xa asserts rxdecif (and idleif). 10. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023b-page 187 mrf24xa 11. host mcu configures: - secsuite to 0x07 - seckey to 0x0f0e0d0c0b0a09080706050403020100, where lsb (0x00) is at address 0x40 - secnonce to 0x08070605040302015555555506, where msb (0x08) is at address 0x5c. 12. host mcu issues rxdec. 13. mrf24xa performs ccm* de-authentication and decryption, where the mic tag is compared against the received one, and ab e6 is decrypted to ab ab. 14. mrf24xa asserts rxdecif (and idleif). 15. 16. sw read the entire frame from the rx buffer (0x300): 3b || c9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 5e 18 19 || ba ba ab ab ab 4b 03 7b b7 30 98 b1 e5 93 ca d7 86 81 8a 2d 05 15 ab 5f 6c 7d 5c 70 6c 96 91 c0 34 e5 18 0d || 7b 71 || rsvs 6.8.8 mac and nwk layer security example 2 network configuration: ad dress size is 4 bytes, inferred destination addressing source address: 0x04030201 where lsb (0x01) is at address 0x1f destination address: 0x94939291 payload: ba ba network header: ab network payload: ab network security level: 0x07 mac security level: 0x07 mac security indices: only encode from the sec- ond payload packet: data packet 6.8.8.1 transmission 1. host mcu constructs the frame and loads the buffer: 11 || 89 55 91 92 93 94 01 02 03 04 || 3e 10 11 || ba ba ab ab 2. host mcu configures: - secsuite to 0x07 - seckey to 0x0f0e0d0c0b0a09080706050403020100, where lsb (0x00) is at address 0x40 - secnonce 0x08070605040302015555555506, where msb (0x08) is at address 0x5c. 3. host mcu issues txenc. 4. mrf24xa configures: - sechdrindx to 0x10 - secpayindx to 0x11 - secendindx to 0x11. 5. mrf24xa performs ccm* authentication with encryption, where ab ab is encrypted to ab e6, and the following mic tag is attached: ab 4b 03 7b b7 30 98 b1 e5 93 ca d7 86 81 8a 2d 6. mrf24xa asserts txencif (and idleif). 7. host mcu configures: - secsuite to 0x03 - seckey to 0xfffefdfcfb- faf9f8f7f6f5f4f3f2 f1f0, where lsb (0xf0) is at address 0x40 - secnonce 0xf8f7f6f5f4f3f2f15555555506, where (0xf8) is at address 0x5c. 8. host mcu issues txst. downloaded from: http:///
mrf24xa ds70005023b-page 188 preliminary ? 2015 microchip technology inc. 9. mrf24xa configures: - sechdrindx to 0x01 - secpayindx to 0x0f - secendindx to 0x21 10. mrf24xa performs ccm* authentication with encryption, where ba ba ab e6 ab 4b 03 7b b7 30 98 b1 e5 93 ca d7 86 81 8a 2d is encrypted to ba a2 6d 3c 78 90 8f 99 bb e6 6b 29 cc af a1 6f 14 9b 0d 7a, and the following mic tag is attached: 23 eb c5 73 e8 44 da 0e 8d d7 9c e7 06 e1 bd c2 11. mrf24xa appends crc: 0xf9b3. 12. mrf24xa transmits the packet to the medium. different if is received based on the register settings (for example, tx with csma). packet transmitted to the medium: 2f || 89 55 01 02 03 04 || 3e 10 11 || ba a2 6d 3c 78 90 8f 99 bb e6 6b 29 cc af a1 6f 14 9b 0d 7a 23 eb c5 73 e8 44 da 0e 8d d7 9c e7 06 e1 bd c2 || b3 f9 tx buffer (0x200) content: 33 || 89 55 91 92 93 94 01 02 03 04 || 3e 10 11 || ba a2 6d 3c 78 90 8f 99 bb e6 6b 29 cc af a1 6f 14 9b 0d 7a 23 eb c5 73 e8 44 da 0e 8d d7 9c e7 06 e1 bd c2 || b3 f9 6.8.8.2 reception 1. mrf24xa receives the following packet through the antenna: 2f || 89 55 01 02 03 04 || 3e 10 11 || ba a2 6d 3c 78 90 8f 99 bb e6 6b 29 cc af a1 6f 14 9b 0d 7a 23 eb c5 73 e8 44 da 0e 8d d7 9c e7 06 e1 bd c2 || b3 f9 2. mrf24xa configures: - sechdrindx to 0x01 - secpayindx to 0x0f (inferred da is considered) - secendindx to 0x2d. 3. mrf24xa asserts rxif (rxsfdif): packet accepted by rx filter. 4. 5. host mcu configures: - secsuite to 0x07 - seckey to 0xfffefdfcfb- faf9f8f7f6f5f4f3f2 f1f0, where lsb (0xf0) is at address 0x40 - secnonce 0xf8f7f6f5f4f3f2f15555555506, where (0xf8) is at address 0x5c. 6. host mcu issues rxdec. 7. mrf24xa performs ccm* de-authentication, where the mic tag is compared against the received one, and ba a2 6d 3c 78 90 8f 99 bb e6 6b 29 cc af a1 6f 14 9b 0d 7a is decrypted to ba ba ab e6 ab 4b 03 7b b7 30 98 b1 e5 93 ca d7 86 81 8a 2d 8. mrf24xa configures: - sechdrindx to 0x10 - secpayindx to 0x11 - secendindx to 0x1d. 9. mrf24xa asserts rxdecif (and idleif). 10. 11. host mcu configures: - secsuite to 0x07 - seckey to 0x0f0e0d0c0b0a0908070605040302010, where lsb (0x00) is at address 0x40 - secnonce to 0x08070605040302015555555506, where msb (0x08) is at address 0x5c. 12. host mcu issues rxdec. 13. mrf24xa performs ccm* de-authentication and decryption, where the mic tag is compared against the received one, and ab e6 is decrypted to ab ab. 14. mrf24xa asserts rxdecif (and idleif). 15. 16. sw read the entire frame from rx buffer (0x300): 2f || 89 55 01 02 03 04 || 3e 10 11 || ba ba ab ab ab 4b 03 7b b7 30 98 b1 e5 93 ca d7 86 81 8a 2d 23 eb c5 73 e8 44 da 0e 8d d7 9c e7 06 e1 bd c2 || b3 f9 || rsvs downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 189 mrf24xa 7.0 advanced link behavior in proprietary packet mode 7.1 channel agility in some communication environments, where several nodes use the same medium, it is necessary to choose different channels for the communicating nodes. it introduces difficulties in ack receiving. figure 7-1 illus- trates the example of channel agility. to prevent higher mcu load on channel changing, mrf24xa handles the channel change for the automatic sending of ack. this feature is enabled by adptchen bit that must be enabled for all the nodes within the same network. figure 4-13 describes the ack sending mechanism. note that in case of infe rred da, the ackinfo field is mandatory when ackreq=1. otherwise the ackinfo field is mandatory if adptdren = 1 or adptchen = 1. figure 7-1: channel agility example example 7-1: auto ack example with channel agility channel agility is based on ackinfo field of the propri- etary mac header. proprietary mac header is described in figure 6-1 . figure 7-2: proprietary mac ackinfo<7:0> octet (only present when ackreq = 1 ) node a node b rx channel: 7 rx channel: 10 interfering node interfering node channel: 10 channel: 7 a b: a: channel = 10 (1) txst channel = 7 b: channel = 10 (2) rxif channel = 7 sending ack back to a channel = 10 note 1: node a knows the frequency channel that node b uses for receiving. 2: however, node b knows the rx channel of node a, as autoack = 1 the ack must immediately sent back, and there is no time for mcu interactions. ackdatarate: when adptdren = 1 and ackreq = 1 , this field determines the tx data rate for the ack packet, regardless of the setting of the dr<3:0> register field. ackchannel: when adptchen = 1 and ackreq = 1 , this field determines the tx channel for the ack packet, regardless of the setting of the ch<3:0> register field. ackd atarate ackc hannel 1 o ctet 3:0 7:4 (4 bits) (4 bits) downloaded from: http:///
mrf24xa ds70005023c-page 190 preliminary ? 2015 microchip technology inc. register 7-1: rxcon2 (mac rece ive control 2 register) address: 0x16 r/c/hs-0 r/w-0 r-0 r/w-0 r/w-0 r/w-0 r/w-0 r/w-0 rxbufful identrej ackrxfp acktxfp autorpten autoacken adptchen adptdren bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hs = hardware set c = clearable bit bit 7-2 out of scope bit 1 adptchen: adaptive channel enable bit ( 1 ) setting this bit enables the mac to set the transm itting channel for the ack packet based on the ack- info field (proprietary packet) of the received packet, rather than the ch<3:0> register bits. 1 = adaptive channel feature is enabled 0 = adaptive channel feature is disabled bit 0 out of scope note 1: use adptchen field while receiving and transmitting, and must be unmodified while rxen or txst is set. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 191 mrf24xa 7.2 data rate agility similar to channel agility as described in figure 7.1 , ack is sent at different data rates within different nodes. it may provide more robust ack sending mech- anism in busier networking environments. data rate agility is enabled by the adptdren bit that must be set for all the nodes within the same network. data rate agility is based on acki nfo field of the proprietary mac header. proprietary mac header is described in figure 6-1 . ackinfo field is described in figure 7-1 . figure 4-13 describes the ack sending mechanism. register 7-2: rxcon2 (mac rece ive control 2 register) address: 0x16 r/c/hs-0 r/w-0 r-0 r/w-0 r/w-0 r/w-0 r/w-0 r/w-0 rxbufful identrej ackrxfp acktxfp autorpten autoacken adptchen adptdren bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hs = hardware set c = clearable bit bit 7-1 out of scope bit 0 adptdren: adaptive data rate enable bit ( 1 ) setting this bit enables the mac to set the transmission data rate for the ack packet based on the ackinfo field (proprietary packet) of the received packet, rather than the dr<2:0> register bits. 1 = adaptive data rate feature is enabled 0 = adaptive data rate feature is disabled note 1: use adptdren field while receiving and transmitting, and must be unmodified while rxen or txst is set. downloaded from: http:///
mrf24xa ds70005023c-page 192 preliminary ? 2015 microchip technology inc. 7.3 auto-repeater the auto-repeat feature enables to automatically (with- out host controller intervent ion) repeat any packets that request it (framectrl[repeat] = 1). auto-repeat is not available in rx- or tx- streaming modes as these modes are designed to provide maximum throughput rather than reliable transport. only data and command frames are repeated with auto-repeat. if mrf24xa receives a data or command frame with its framectrl[repeat] bit set, the frame may be repeated without mcu intervention when autorpten register bit is set. if the packet is a unicast packet, and its destination address (explicit or inferred) matches the addr<63:0> register, then the packet is not repeated, but received as a normal packet instead. if the packet is a broadcast packet, or is a unicast packet with a non- matching address, the packet is received into the buffer, and then retransmitted (repe ated) without modification (no crc generation or encryption steps are performed). it is recommended to use this function together with the csma/ca algorithm to avoid the collision with the iden- trej = 1 function. therefore, packet received more than twice is not repeated. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 193 mrf24xa 7.4 streaming the streaming feature provides the maximum throughput between two nodes. in this mode, the two packet buffers are used to transmit/receive packets by alternating between the two. the main advantage of this mode is that mcu can perform buffer rw while the packet is being transmitted over the air. auto-ack and auto-retransmission are unavailable in this mode. additionally, csma-ca operation is skipped to provide the maximum throughput. 7.4.1 tx after the initial negotiation (channel, power, security key, and so on), the tx node sets the trxmode<1:0> register to 2b10. the mcu shall write the packets to address 0x200. the switching is handled internally. note that mcu must write mrf24xa if the txbuffempty flag is set. to maximize throughput, write and set txst spi framing format is recommended. note that txrdbuf, buswrbuf, and txbufempty signals are the output on the gpio pins with gpiomode = 1010 settings. handling buffer empty flag by an additional interrupt is recommended to avoid constant polling over spi. figure 7-3: streaming mode tx timeline downloaded from: http:///
mrf24xa ds70005023c-page 194 preliminary ? 2015 microchip technology inc. 7.4.2 rx after the initial negotiation (channel, power, security key, and so on), the rx node sets the trxmode<1:0> register to 2b01. the mcu must read the packets from address 0x300. the switching is handled internally. note that mcu must read mrf24xa when the rxbuffull flag is set. in streaming mode receiving packets after rxif do not work. to maximize throughput, read and clear rxbuffull spi framing format is recommended. note that rxwrbuf, busrdbuf, and rxbufful signals are the output on the gpio pins with gpiomode = 1011 settings. handling buffer full flag by an additional interrupt is recommended to avoid constant polling over spi. to reach optimal sensitivit y, turn power save (psav) off. figure 7-4: streaming rx timeline downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 195 mrf24xa 7.4.3 stream rx timeout the radio sets strmif to indicate that the time defined in strmto register has elapsed. register 7-3: pir3 (peripheral interrupt register 3) address: 0x06 register 7-4: trmtoh/strmtol (s tream time-out register) address: 0x1c C 0x1d r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 r/w/hs/hc-0 rxif rxdecif rxtagif r rxidentif rxfltif rxovfif strmif bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7-1 out of scope bit 0 strmif: receive stream time-out error interrupt flag bit set by the device to indicate that the duration s pecified in strmto elaps ed since the last received packet while in rx-streaming mode, and the mac clears the stored sequence number. nonpersistent, cleared by spi read. note 1: in packet mode, use a single buffer for received frames. in rx-streaming mode, use both buffers for recep- tion. r/w-11111111 strmto<15:8> bit 15 bit 8 r/w-11111111 strmto<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 15-0 strmto<15:0>: stream time-out bits the strmto<15:0> bits indicate the maximum numbe r of allowed base time units between the end of one rx stream packet and the successful reception of the next. if no rx stream packet is successfully received within this time, strmif is set. downloaded from: http:///
mrf24xa ds70005023c-page 196 preliminary ? 2015 microchip technology inc. notes: downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 197 mrf24xa 8.0 bridging any member of a proprietary node may run two stacks and be part of a 15.4 netwo rk. this enables the node to act as a gateway between the two networks. as the default configuration, nwfrmfmt = 1 . this setting is overriden when it receives a 15.4 frame, but switches back temporarily when it needs to send. the network is configurable to use proprietary or stan- dard (ieee 802.15.4) mac. however, a proprietary net- work must also be able to send and receive frames to/ from standard-compliant net works. this capability is referred to as bridging. the bridging node must implement both the proprietary and the standard compliant mac framing protocols. each time a 250 kbps frame is received through the bridging node, it must decide which mac protocol to use for parsing the incoming frame. the problem of bridging is that the 802.15.4 mac frame control field will not allow for distinction in the case of 250 kbps frames. therefore, the selected sfd is used for distinction. standard compliant sfd pattern is selected when standard mac is used with 250 kbps frame, otherwise, a diff erent sfd value is used. when the host mcu (or mac) selects the 250 kbps air- data-rate for transmission, it also indicates which mac is used by a sideband signal. the transmitter baseband selects the sfd accordingly. if proprietary mac is selected, the sfd is read from a host configurable register, otherwise, the standard defined pattern is used (0xa7). additionally, if proprietary is used, the length and payload fields are scrambled. on the receiver side, the 250 kbps preamble and the sfd are detected first. this determines which mac protocol is used to parse the phy payload. figure 8-1: bridging downloaded from: http:///
mrf24xa ds70005023c-page 198 preliminary ? 2015 microchip technology inc. notes: downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 199 mrf24xa 9.0 physical layer functions 9.1 synthesizer power-up, power off table 2-1 illustrates mrf24xa power modes, while figure 4-3 illustrates the operation states. rfoff state is the state when most of the rf circuits are powered off. as table 2-1 illustrates, rfoff state is divided into two sub-states. in crystal on state, only 16 mhz on-chip crystal oscillator is powered on and the synthesizer is switched off. in synthesizer on state, both the on-chip crystal oscillator and the synthesizer are powered on. mrf24xa provides an off-timer to optimize the power consumption by managing the on time of the on-chip synthesizer. before the synthesizer is switched off, rxen or txst turns to 0 from 1, the user must set offtm<7:0>. the value of the register is interpreted as an off time counter. as the counter runs out, synthesizer is st arted regardless of the state of rxen and txst bits. register 9-1: offtm (off-timer register) address: 0x1e r/w-00000000 offtm<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-0 offtm<7:0>: off-timer field bits this value sets the minimum pll off time. minimum off time = offtm<7:0> * 32 ? s if this register is set to 0xff, pll remains off. downloaded from: http:///
mrf24xa ds70005023c-page 200 preliminary ? 2015 microchip technology inc. register 9-2: rxcon1 (mac receive control 1 register) address: 0x15 r/w/hc/hs-0 r/w-0 r/w/hc-0 r/w-0 r/w-0 r/w-0 r/w-0 r-0 rxen nopa rxdec rsvlqien rsvrssien rsvchdren rsvcfoen r bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 rxen: receive enable field bit this bit enables/disables the packet reception. if an rx packet is being received, clearing this bit will causes that packet to be discarded. 1 = rx enabled 0 = rx disabled hardware clear/set when: cleared when trxmode is set to tx-streaming mode set when trxmode is set to rx-streaming mode clearing this bit aborts the curr ent operation in the following cases: receiving a packet in packet mode or in rx-streaming mode changes to most rx related settings must be only done when this bit is cleared. the clear channel assessment (csmaen) and ack- frame reception does not require rxen = 1 as the device turns the radio into rx when required, irrespective of the status of the rxen bit. bit 6 nopa: no parsing bit this bit disables packet parsing. only crc is checked, if it is enabled. this feature is useful in sniffer mode. 1 = disable packet parsing 0 = enable packet parsing bit 5 rxdec: rx decryption bit setting this bit starts rx security processing ( authentication or decryption, or both) on the last received packet. 1 = rx security processing started/in process. rxdecif or rxtagif is set. 0 = rx security processing inactive or complete this bit clears itself after rx decryption has completed. bit 4 rsvlqien: receive status vector lqi enable bit if this bit is set, the measured link quality is appended after the received frame in the packet buffer. 1 = append lqi field 0 = do not append lqi field bit 3 rsvrssien: receive status vector rssi enable bit if this bit is set, the measured rssi is appended after the received frame in the packet buffer. 1 = append rssi field 0 = do not append rssi field bit 2 rsvchdren: receive status vector channel/mac type/data rate enable bit if this bit is set, channel, mac type and data rate configurations used with the received frame are appended after the received frame in the packet buffer, using the encoding specified for ch<3:0>, frmfmt and dr<2:0> (concatenated in this order when most significant bit (msb) is first). 1 = append channel, mac type and data rate fields 0 = do not append channel, mac type and data rate fields downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 201 mrf24xa register 9-3: txcon (transmit control register) address: 0x12 bit 1 rsvcfoen: receive status vector cfo enable bit if bit is set, the estimated carrier frequency offs et of the received frame is appended after the received frame in the packet buffer, using the same encoding as cfomeas register. 1 = append cfo estimation 0 = do not append estimated cfo bit 0 reserved: maintain as 0 r/w/hc -0 r/w-0 r/w/hc-0 r/hs/hc-1 r/w-1 r/w-011 txst dtsm txenc txbufempty csmaen dr<2:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hard ware clear hs = hardware set bit 7 txst: transmit start bit. this is set or cleared by the host mcu bit ( 1, 2 ) 1 = starts the transmission of the next tx packet 0 = termination of current tx oper ation, which may result in the transmission of an incomplete packet. hardware clear: after the packet is successfully transmitted (including all attempted retransmissions, if any), the hardware clears this bit and sets the txif and idleif . if the packet transmission fails due to a csma failure, then this bit is cleared, and txcsmaif is set. if acknowledge is requested (ackreq bi t field in the transmitted frame and autoacken register bit are both set) and not received after the configured number of retransmissions ( txretmcnt ), then txst bit is cleared and a txackif is set. in tx-streaming mode (trxmode), txst is set even when it is already set, resulting in a posted start. when the current tx operation completes, the posted start immediately starts afterward. clearing of the txst bit clears both the current and the posted (pending) tx starts. txovfif is unchanged when txst = 1 , a posted start is present an d a host controller write to the packet buffer occurs. outside of tx-streaming mode, writes to txst when txst is already set is ignored. clearing this bit aborts the current operation in the following cases: when transmitting a packet in packet mode or in tx-streaming mode when waiting for an ack packet after a transmission during the csma ca algorithm when transmitting a repeated frame this field is read at any time to determine if the tx operation is in progress. bit 6-0 out of scope note 1: transmission may include automatic security proc essing, crc appending, csma-ca channel access, acknowledge reception and retransmissions depending on the register configuration and the frame control field of the frame to be transmitted. 2: by setting the txst bit in either sleep/rfoff st ate, the device transits to tx state for packet transmission. register 9-2: rxcon1 (mac receive control 1 register) (continued) address: 0x15 downloaded from: http:///
mrf24xa ds70005023c-page 202 preliminary ? 2015 microchip technology inc. 9.2 operating channel mrf24xa is capable of selecting one of sixteen channel frequencies in the 2.4 ghz band. the desired channel is selected by configuring the channel<3:0> bits in the maccon2 register. refer to table 9-2 for the maccon2 register setting for channel number and frequency. if channel agility is not used, all nodes share the same channel both in rx and tx modes. the channel is defined by channel<3:0> as indicated below. for more information on channel agility, see section 7.1 channel agility . register 9-4: maccon2 (mac control 2 register) address: 0x11 table 9-2: channel selection maccon2 (0x11) register setting table 9-1: registers associated with off pll power-up, power off names bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 offtm offtm<7:0> rxcon1 rxen nopa rxdec rsvlqien rsvrssien rsvchdren rsvcfoen r txcon txst dtsm txenc txbufempty csmaen dr<2:0> legend: r = reserved, read as 0. r/w-0000 r/w/hs-0000 channel<3:0> secsuite<3:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-4 channel<3:0>: tx/rx operating channel field bits ( 1 ) these register bits are used as the current operating channel for tx/rx operation. 0x0 = channel 11 0x1 = channel 12 0xf = channel 26 bit 3-0 out of scope note 1: use this field while receiving and transmitting, and must be unmodified while rxen or txst is set. channel<3:0> bits in maccon2 channel number channel frequency 0x0 11 2.405 ghz 0x1 12 2.410 ghz 0x2 13 2.415 ghz 0x3 14 2.420 ghz 0x4 15 2.425 ghz 0x5 16 2.430 ghz 0x6 17 2.435 ghz 0x7 18 2.440 ghz 0x8 19 2.445 ghz 0x9 20 2.450 ghz 0xa 21 2.455 ghz 0xb 22 2.460 ghz 0xc 23 2.465 ghz 0xd 24 2.470 ghz 0xe 25 2.475 ghz 0xf 26 2.480 ghz channel<3:0> bits in maccon2 channel number channel frequency downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 203 mrf24xa register 9-5: rxcon1 (mac rece ive control 1 register) address: 0x15 r/w/hc/hs-0 r/w-0 r/w/hc-0 r/w-0 r/w-0 r/w-0 r/w-0 r-0 rxen nopa rxdec rsvlqien rsvrssien rsvchdren rsvcfoen r bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 rxen: receive enable bit ( 1, 2 ) this bit enables/disables the packet reception. if an rx packet is being received, clearing this bit causes that packet to be discarded. 1 = rx enabled 0 = rx disabled hardware clear/set when: cleared when trxmode is set to tx-streaming mode set when trxmode is set to rx-streaming mode clearing this bit aborts the current operation in the following cases: receiving a packet in packet mode or in rx-streaming mode transmitting an ack packet for a received frame during an auto-acknowledge operation bit 6-0 out of scope note 1: changes to most rx related settings must be only done when this bit is cleared. 2: clear channel assessment (csmaen) and ack-fram e reception does not require rxen = 1 as the device turns the radio into rx when needed, irre spective of the status of the rxen bit. downloaded from: http:///
mrf24xa ds70005023c-page 204 preliminary ? 2015 microchip technology inc. register 9-6: rxcon2 (mac rece ive control 2 register) address: 0x16 9.3 rxlisten operations the air-data-rate is detected in two stages: 1. simultaneously monitoring the presence of 2 mbps, 500 kbps, 250 kbps modulated pream- bles until one of these is detected with sufficient reliability. 2. searching for a start frame delimiter that may further distinguish between air-data-rates. figure 9-1 and figure 9-2 show the order of processing steps and decisions for the optimal and legacy frame formats. r/c/hs-0 r/w-0 r-0 r/w-0 r/w-0 r/w-0 r/w-0 r/w-0 rxbufful identrej ackrxfp acktxfp autorpten autoacken adptchen adptdren bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hs = hardware set c = clearable bit bit 7-2 out of scope bit 1 adptchen: adaptive channel enable bit ( 1 ) setting this bit enables the mac to set the transmitting channel for the ack packet based on the ack- info field (proprietary packet) of the received packet, rather than the ch<3:0> register bits. 1 = adaptive channel feature is enabled 0 = adaptive channel feature is disabled bit 0 adptdren: adaptive data rate enable bit ( 1 ) setting this bit enables the mac to set the tran smission data rate for the ack packet based on the ackinfo field (proprietary packet) of the received packet, rather than the dr<2:0> register bits. 1 = adaptive data rate feature is enabled 0 = adaptive data rate feature is disabled note 1: use this field while receiving and trans mitting, and must be unmodified while rxen or txst is set. table 9-3: registers associated with channel selection names bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 maccon2 channel<3:0> secsuite<3:0> rxcon1 rxen nopa rxdec rsvlqien rsvrssien rsvchdren rsvcfoen r rxcon2 rxbufful identrej ackrxfp acktxfp autorpten autoacken adptchen adptdren legend: r = reserved, read as 0. downloaded from: http:///
mrf24xa ds70005023c-page 205 preliminary ? 2015 microchip technology inc. figure 9-1: data rate selection in the receiver when optimal framing mode is configured start rx signal processing 500 kbps preamble? 16-bit exact match to pattern_2000 signal path to 2 mbps bit- and byte-aligned demodulation/decoding 2 mbps preamble? 250 kbps preamble? signal path to 500 kbps bit- and byte-aligned demodulation/decoding signal path to 250 kbps bit- and byte-aligned demodulation/decoding search for two different 16-chip sfd patterns (at 2 mbps) search for 8-bit sfd pattern search for two different 16-chip sfd patterns (at 250 kbps) continue 2 mbps reception switch to 1 mbps reception 8-bit exact match to pattern_500 8-bit exact match to 0xa7 8-bit exact match to pattern_250 8-bit exact match to pattern_125 continue 500 kbps reception switch to 250 kbps reception continue 250 kbps reception as in the standard switch to 125 kbps reception receive length field receive payload bytes 16-bit tolerant match to pattern_1000 no no no no yes yes no no yes yes yes yes yes no yes yes ieee 802.155.4 frame no no downloaded from: http:///
mrf24xa ds70005023c-page 206 preliminary ? 2015 microchip technology inc. figure 9-2: data rate selection in the re ceiver when legacy framing mode is configured start rxsignal processing 250 kbps preamble? switch signal path to 250 kbps bit- and byte-aligned demodulation and decoding 8-bit exact match to pattern_l2000 after length field switch to 2 mbps reception 8-bit exact match to pattern_l1000 8-bit exact match to pattern_l500 no no search for two different 16-bit sfd patterns (at 2 mbps) yes no 8-bit exact match to 0xa7 8-bit exact match to pattern_250 16-bit tolerant match to pattern_125 start descrambler start descrambler start descrambler after length field switch to 1 mbps reception after length field switch to 500 kbps reception continue 250 kbps reception switch to 125 kbps reception: llr mapping, de-interleaving, fec decoding continue 250 kbps reception start descrambler receive length field receive payload bytes no no yes yes no yes yes yes no yes ieee 802.155.4 frame downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 207 mrf24xa figure 9-3: physical receiv er operation: overview abort/reset from upper layer preamble loss? switch signal flow to bit- and byte-aligned demodulation at the detected preamble air-data rate; start sfd detectors; agc must hold the gain sfd detected? start agc start digital demodulator preamble acquired? agc level triggered? gain change sfd time-out? switch the signal path to the detected payload data rate transfer bytes to mac last byte done? init sfd time-out yes no yes yes no yes no yes no no no yes - downloaded from: http:///
mrf24xa ds70005023c-page 208 preliminary ? 2015 microchip technology inc. 9.4 automatic gain control (agc) agc circuit can provide aut omatic gain adjustment according to the received field strength. agc gain is set in four steps. register 9-7: bbcon (baseband configuration register) address 0x38 r/w-0 r/w-0 r/w-11 r/w-0 r/w-001 rndmod afcovr rxgain<1:0> prmbhold prmbsz<2:0> bit 7 bit 0 legend: w = writable bit r = readable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 out of scope bit 6 out of scope bit 5-4 rxgain<1:0>: receiver gain register field bits by setting this bit, the agc operation is inhibi ted in the receiver and the receiver radio gain configuration is selected between three different gain levels. encoding: 11 = agc operation is enabled (default value) 10 = high gain 01 = middle gain 00 = low gain this feature is used for test and streaming purposes. to reduce the required interframe-gap, the rxgain must be set to one of the fixed gain options when the mac is in streaming mode. bit 3-0 out of scope downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 209 mrf24xa 9.5 energy detection the received signal strength indicator (rssi) is an estimate of the received signal power within the band- width of a particular channel, and obtained by the user using energy detection (ed). mrf24xa has the capa- bility to measure the received signal power for a user- defined number of symbols, and to report back the measured rssi value. the mapping between the rssi value returned and the input power level is shown in figure 9-4 . this aggregates all the agc curves, hence user does not require to calculate with any other settings. the curve is directly used. the rssi value associated with a received packet may also be automatically stored as part of the packets receive status vector (rsv). figure 9-4: rssi value vs. received power equation 9-1: rssi value vs. received power equation pin = 0.5 * energy detect code (1) - 112 (2) note 1: energy detect code is read from edmean<7:0> field. 2: equation 9-1 is valid for edmean<7:0> from 40 to 184 decimal values. downloaded from: http:///
mrf24xa ds70005023c-page 210 preliminary ? 2015 microchip technology inc. register 9-8: rxcon1 (mac receive control 1 register) address: 0x15 r/w/hc/hs-0 r/w-0 r/w/hc-0 r/w-0 r/w-0 r/w-0 r/w-0 r-0 rxen nopa rxdec rsvlqien rsvrssien rsvchdren rsvcfoen r bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 rxen: receive enable field bit this bit enables/disables the packet reception. if an rx packet is currently being received, clearing this bit causes that packet to be discarded. 1 = rx enabled 0 = rx disabled hardware clear/set when: cleared when trxmode is set to tx-streaming mode set when trxmode is set to rx-streaming mode clearing this bit aborts the curr ent operation in the following cases: receiving a packet in packet mode or in rx-streaming mode changes to most rx related settings must be only done when this bit is cleared. the clear channel assessment (csmaen) and ac k-frame reception does not require rxen = 1 as the device turns the radio into rx when needed, irrespective of the status of the rxen bit. bit 6 nopa: no parsing bit this bit disables packet parsing. only crc is checked, if it is enabled. this feature is useful in sniffer mode. 1 = disable packet parsing 0 = enable packet parsing bit 5 rxdec: rx decryption bit setting this bit starts rx security processing ( authentication or decryption, or both) on the last received packet. 1 = rx security processing started/in process. rxdecif or rxtagif is set. 0 = rx security processing inactive or complete this bit clears itself after rx decryption is completed. bit 4 rsvlqien: receive status vector lqi enable bit if this bit is set, the measured link quality is appended after the received frame in the packet buffer. 1 = append lqi field 0 = do not append lqi field bit 3 rsvrssien: receive status vector rssi enable bit if this bit is set, the measured rssi is appended after the received frame in the packet buffer. 1 = append rssi field 0 = do not append rssi field downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 211 mrf24xa register 9-9: ccacon1 (cca control 1 register) address: 0x2f bit 2 rsvchdren: receive status vector channel/mac type/data rate enable bit if this bit is set, channel, mac type and data rate configurations used wit h the received frame are appended after the received frame in the packet buffer, using the encoding specified for ch<3:0>, frmfmt and dr<2:0> (concatenated in this order when msb is first). 1 = append channel, mac type and data rate fields 0 = do not append channel, mac type and data rate fields bit 1 rsvcfoen: receive status vector cfo enable bit if bit is set, the estimated carrier frequency offs et of the received frame is appended after the received frame in the packet buffer, using the same encoding as cfomeas register. 1 = append cfo estimation 0 = do not append estimated cfo bit 0 reserved: maintain as 0 register 9-8: rxcon1 (mac receive control 1 register) (continued) address: 0x15 r/hs/hc-0 r/w/hc-0 r/w-001100 ccabusy ccast rssithr<5:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 ccabusy: clear channel assessment busy flag bit this bit represents the result of the latest cca measurement. 1 = medium is busy 0 = medium is silent bit 6 ccast: clear channel assessment start bit ( 1 ) setting this register bit triggers mcu to start a new cca measurement. the hardware clears this bit when the cca measurement is done (edccaif is set) and ccabusy is valid. bit 5-0 rssithr<5:0>: rssi threshold bits ( 2 ) this threshold is used in cca operation when ener gy detect or energy and carrier sense mode is selected. representation: resolution of 2 db/lsb, rssithr = 0x 10 represents ca. -75 dbm noise level. note that this threshold may be different with other matching network or antenna. note 1: rx chain must be turned on (rxen = 1 ) to perform this measurement. packet reception is not disabled during the measurement, its main purpose is testing. 2: in the corresponding cca modes the radio measures edmean<7:0>. if edm ean<7:2> is greater than rssithr<5:0>, ccabusy is set. exam ple: to set the rssi threshold where the chip measures 0x30 edmean, rssithr<5:0> must be 0x0c. downloaded from: http:///
mrf24xa ds70005023c-page 212 preliminary ? 2015 microchip technology inc. register 9-10: edcon (energy detect control register) ( 1, 2 ) address: 0x31 register 9-11: edmean (energy dete ct mean indication register) address: 0x32 r-00 r/w-0 r/w/hc-0 r/w-1110 r edmode edst edlen<3:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear bit 7-6 reserved: maintain as 0 bit 5 edmode: energy detect mode select bit 1 = energy detect sampling mode. ed duration is 128 s. a single atomic rssi-peak measurement is accomplished. the result is stored in edpeak<7:0> register. 0 = energy detect scan mode. edlen<3:0> sets the ed duration. the result is stored in edmean<7:0> register. bit 4 edst: energy detect measurement start bit setting this register bit triggers mcu to start a new cca measurement. the hardware clears this reg- ister bit when the ed measurement is done (edcca if is unchanged) and values in edmean<7:0> and edpeak<7:0> are valid. if the ed measurement is aborted (rx state is changed, or the mcu clears the edst bit) then edc- caif is unchanged. bit 3-0 edlen<3:0>: energy detect measurement length field bits value m indicates a sequence of (m + 1) * 8 atomic rssi-peak measurements, each having the duration of 128 s. at the end of the aggregate measurem ent, the mean and the peak value of the sequence are available in edmean<7:0> and edpeak<7:0>. note 1: the rx chain must be turned on (rxen = 1 ) to perform this measurement. packet reception is disabled during the measurement. 2: when edlen<3:0> = m = 0xe, then the 128 s atomic measurements are preformed 120 times, which is equal to the a basesuperframeduration parameter in the ieee 802.15.4 standard. r/hs/hc-00000000 edmean<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7-0 edmean<7:0>: energy detect mean indication field bits measured mean signal strength during ed/cca measurement. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 213 mrf24xa register 9-12: edpeak (energy detect peak indication register) address: 0x33 r/hs/hc-00000000 edpeak<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7-0 edpeak<7:0>: energy detect peak indication field bits measured peak signal strength during ed measurement. computation: the gain-compensated rssi va lue is averaged over intervals of 128 s. the peak value obtained from a sequence of su ch measurements is stored in edpeak, when edmode = 1 . table 9-4: registers associated with rssi and ed names bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 rxcon1 rxen nopa rxdec rxvlqien rsvrssien rsvchdren rsvcfoen r ccacon1 ccabusy ccast rssithr<5:0> edcon r edmode edst edlen<3:0> edmean edmean<7:0> edpeak edpeak<7:0> legend: r = reserved, read as 0. downloaded from: http:///
mrf24xa ds70005023c-page 214 preliminary ? 2015 microchip technology inc. 9.6 clear channel assessment (cca) clear channel assessment is a function within csma/ ca to determine whether the wireless medium is ready and able to receive data, therefore the transmitter can start sending the data. cca is implemented outside of the mac. this enables the radio to transmit in the presence of interference from other wireless protocols that operate on the same frequency. cca may be performed using either energy detection (ed), carrier sense (cs) or a combination of both. 9.6.1 cca configuration cca is automatically exec uted (potentially multiple times) as part of the csma-ca procedure when the txst register bit is set and csma-ca is enabled. the following register bits are used in the configuration of cca: ccamode<1:0> ccalen<1:0> csthr<3:0> rssithr<5:0> 9.6.1.1 energy detection (ed) when ccamode<1:0> = 10 , the cca reports a busy medium upon detecting energy above the energy detection threshold defined in the rssithr<5:0> reg- ister bits. to use this method of cca, the following configuration must be used: ccalen<1:0> = measurement duration ccamode<1:0> = 10 rssithr<5:0> = rssi threshold value the mapping between the rssithr threshold and the power level is shown in figure 9-4 and equation 9-1 . 9.6.1.2 carrier sense (cs) when ccamode<1:0> = 01 , the cca reports a busy medium upon detecting of a signal with particular mod- ulation and spreading characteristics. to use this method of cca, the following configuration must be used: ccalen<1:0> = measurement duration ccamode<1:0> = 01 csthr<3:0> = carrier sense threshold 9.6.1.3 carrier sense with energy detection when ccamode<1:0> = 11 , the cca reports a busy medium upon detecting of a signal with particular mod- ulation and spreading characteristics and energy above the energy detection threshold defined in the rssithr<5:0> register bits. to use this method of cca, the following configuration must be used: ccalen<1:0> = measurement duration ccamode<1:0> = 11 rssithr<5:0> = rssi threshold value csthr<3:0> = carrier sense threshold 9.6.2 cca operation mrf24xa automatically initiates cca as part of the csma-ca algorithm. cca operation is requested inde- pendently for software csma-ca, or for test purpose through the ccast bit. note: in the corresponding cca modes the radio measures edmean<7:0>. if edmean<7:2> is gr eater than rssi- thr<5:0>, ccabusy is set. example: to set the rssi threshold where the chip measures 0x30 edmean, rssi- thr<5:0> must be 0x0c. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 215 mrf24xa register 9-13: opstatus (operation status) ( 3 ) address: 0x2 r-0 r/hs/hc-0 r/hs/hc-0 r/hs/hc-0 r/ hs/hc-0 r/hs/hc-0 r/hs/hc-0 r/hs/hc-0 r macop<3:0> rfop<2:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 reserved: maintain as 0 bit 6-3 macop <3:0>: mac operation register field bits ( 1, 2 ) provides status information on the current state of the mac state machine. encoding on macop<3:1>: 111 = transmitting acknowledge (txack) 110 = receiving a packet (rxbusy) 101 = receiver listening to the channel waiting for packet (rx) 100 = receiving (or waiting for) acknowledge (rxack) 011 = transmitting a packet (tx) 010 = performing clear channel assessment (cca) 001 = back-off before repeated cca (bo) 000 = mac does not perform any operation (idle) bit 2-0 rfop <2:0>: radio operation register field bits provides status information on the curre nt radio state. encoding on rfop<2:0>: 111 = tx with external pa is turned on (tx+pa) 110 = rx with external lna is turned on (rx+lna) 101 = synthesizer and external pa or lna is turned on (synth+pa/lna) 100 = radio calibrates if the host mcu sets t he calst, otherwise, device malfunction occurs (cal/mal) 011 = analog transmit chain is activated (tx) 010 = analog receiver chain is active (rx). (digital may be partially shut off) 001 = synthesizer is steady or ramping up or channel change is issued (synth) 000 = only the crystal oscillator is on(off), (except when xtalsf = 1 ) note 1: gpio<2:0> is dedicated to output macop<3:1> or rf op<2:0>. refer to pincon register, which speci- fies the pin configuration. 2: macop<0> is connected to rxbufful register bit. it cannot be output over gpios. 3: opstatus register is sent on the sdo pin during all spi operation. downloaded from: http:///
mrf24xa ds70005023c-page 216 preliminary ? 2015 microchip technology inc. register 9-14: ccacon1 (cca control 1 register) address: 0x2f register 9-15: ccacon2 (cca control 2 register) address: 0x30 r/hs/hc-0 r/w/hc-0 r/w-001100 ccabusy ccast rssithr<5:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 ccabusy: clear channel assessment busy flag bit this bit represents the result of the latest cca measurement. 1 = medium is busy 0 = medium is silent bit 6 ccast: clear channel assessment start bit ( 1 ) setting this register bit triggers mcu to start a new cca measurement. the hardware clears this bit when the cca measurement is done (edccaif is set) and ccabusy is valid. bit 5-0 rssithr<5:0>: rssi threshold bits ( 2 ) this threshold is used in cca operation when ener gy detect or energy and carrier sense mode is selected. representation: resolution of 2 db/lsb, rssithr = 0x 10 represents ca. -75 dbm noise level. note that this threshold may be different with other matching network or antenna. note 1: rx chain must be turned on (rxen = 1) to perform this measurement. packet reception is not disabled during the measurement, and main purpose is testing. 2: in the corresponding cca modes the radio measures edmean<7:0>. if edmean<7:2> is greater than rssithr<5:0>, ccabusy is set. example: to set th e rssi threshold where the chip measures 0x30 edmean, rssithr<5:0> must be 0x0c. r-0 r/w-01 r/w-01 csthr<3:0> ccalen<1:0> ccamode<1:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-4 csthr<3:0>: carrier sense threshold field bits bit 3-2 ccalen<1:0>: clear channel assessment length bits ( 1 ) value n indicates duration of 2^n * 32 s. bit 1-0 ccamode<1:0>: clear channel assessment mode field bits ( 2 ) 11 = cca mode 3/a in the std. <1>: energy and carrier sense threshold 10 = cca mode 2 in the std. <1>: carrier sense threshold 01 = cca mode 1 in the std. <1>: energy detect threshold (default) 00 = cca mode 3/b in the std.<1>: energy or carrier sense threshold note 1: the ieee 802.15.4 standard requires 128 s. but shorter length is recommended when using higher rates with optimized preamble mode (ratecon.optimal = 1 ). 2: the measured rssi result is st ored in edmean<7:0> register in all modes except in mode 2. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 217 mrf24xa register 9-16: edmean (energy dete ct mean indication register) address: 0x32 r/hs/hc-00000000 edmean<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7-0 edmean<7:0>: energy detect mean indication field bits measured mean signal strength during ed/cca measurement. table 9-5: registers associated with cca names bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 opstatus r macop<3:0> rfop<2:0> ccacon1 ccabusy ccast rssithr<5:0> ccacon2 csthr<3:0> ccalen<1:0> ccamode<1:0> edmean edmean<7:0> legend: r = reserved, read as 0. downloaded from: http:///
mrf24xa ds70005023c-page 218 preliminary ? 2015 microchip technology inc. 9.7 physical framing physical frame durations for the different data rates are shown in ta b l e 9 - 6 . duration is expressed in payload byte time. different frame data rates are recognized and pro- cessed based on the recognized sfd field of the phy frame. figure 4-7 describes the basic phy frame struc- ture. ratecon<7:2> bits can disable the reception of the unwanted data rate frames. table 9-6: frame duration frame formats t [s/byte] duration expressed in payload byte time (t) preamble sfd length phy payload proprietary 125 kbps 64 4 1 1 n standard 250 kbps 32 4 1 1 n proprietary 500 kbps 16 4 1 1 n proprietary 1 mbps 8 4 1 1 n proprietary 2 mbps 4 8 2 1 n table 9-7: used sfd fields for various data rates preamble type data rate pattern used sfd field fault tolerance optimal pattern_2000 exact match required pattern_1000 maximally two non-contiguous two-element burst error pattern_500 sfd3 exact match required pattern_250 proprietary sfd4 exact match required pattern_250 standard 0xa7 exact match required pattern_125 maximally two faulty nibbles from four legacy pattern_2000 sfd1 exact match required pattern_1000 sfd2 exact match required pattern_500 sfd3 exact match required pattern_250 proprietary sfd4 exact match required pattern_250 standard 0xa7 exact match required pattern_125 downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 219 mrf24xa register 9-17: ratecon (rate configuration register) address: 0x36 r/w-0 r/w-0 r/w-0 r/w-0 r/w-0 r/w-0 r/w-1 r/w-1 dis2000 dis1000 dis500 dis2 50 disstd dis125 optimal psav bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 dis2000: disable 2 mbps frame reception bit if this bit is set, then receptio n of 2 mbps frames is disabled. bit 6 dis1000: disable 1 mbps frame reception bit if this bit is set, then receptio n of 1 mbps frames is disabled. bit 5 dis500: disable 500 kbps frame reception bit if this bit is set, then receptio n of 500 kbps frames is disabled. bit 4 dis250 : disable 250 kbps frame reception bit if this bit is set, the reception of 250 kbps frames with non-standard-co mpliant sfd patterns is disabled. bit 3 disstd: disable ieee 802.15.4 comp liant frame reception bit if this bit is set, then reception of 250 kbps frames with ieee 802.15.4 compliant sfd patterns is disabled. bit 2 dis125: disable 125 kbps frame reception bit if this bit is set, then receptio n of 125 kbps frames is disabled. bit 1 optimal: optimized preamble selection bit when this bit is set, then optimized preamble is used instead of legacy. 1 = optimized preamble 0 = legacy preamble bit 0 out of scope downloaded from: http:///
mrf24xa ds70005023c-page 220 preliminary ? 2015 microchip technology inc. register 9-18: sfd1 (start frame deli miter pattern 1 configuration register) address: 0x60 register 9-19: sfd2 (start frame delimiter pattern 2 configuration register address: 0x61 r/w-00100001 sfd1<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-0 sfd1<7:0>: start frame delimiter pattern 1 register field bits this octet is used as sfd pattern with 2 mbps rate when optimal = 0 , and as the msb of the sfd pattern with 2 mbps rate when optimal = 1 . when optimal = 0 : the hexadecimal digits must be different from 0x 0 and different from the corresponding digits in sfd, k = 2, 3, 4, 6, and the value 0xa7 is forbidden. when optimal = 1 : the hexadecimal digits must be different from 0x0 a nd different from the corresponding digits of sfd2. r/w-11110001 sfd2<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-0 sfd2<7:0>: start frame delimiter pattern 2 register field bits this octet is used as sfd pattern with 1 mbps rate when optimal = 0 , and as the msb of the sfd pattern with 1 mbps rate when optimal = 1 . when optimal = 0 : the hexadecimal digits must be different from 0x 0 and different from the corresponding digits in sfd, k = 1, 3, 4, 6, and the value 0xa7 is forbidden. when optimal = 1 : the hexadecimal digits must be different from 0x0 a nd different from the corresponding digits of sfd1. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 221 mrf24xa register 9-20: sfd3 (start frame delimi ter pattern 3 configuration register) address: 0x62 register 9-21: sfd4 (start frame delimiter pattern 4 configuration register) address: 0x63 r/w-00111011 sfd3<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-0 sfd3<7:0>: start frame delimiter pattern 3 register field bits this octet is used as sfd pattern with 500 kbps rate. when optimal = 0 : the hexadecimal digits must be different from 0x0 and different from the corresponding digits in sfd, k = 1, 2, 4, 6, and the value 0xa7 is forbidden. when optimal = 1 : the hexadecimal digits must be different from 0x0. r/w-11100101 sfd4<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-0 sfd4<7:0>: start frame delimiter pattern 4 register field bits this octet is used as sfd pattern with 250 kbps rate when proprietary mac is in use, otherwise, the 0xa7 pattern defined in the standard <1> is used instead. the hexadecimal digits must be different from 0x0 a nd from the corresponding digits in sfd, where, k = 1, 2, 3, 6 when optimal = 0 . the value 0xa7 is forbidden. downloaded from: http:///
mrf24xa ds70005023c-page 222 preliminary ? 2015 microchip technology inc. register 9-22: sfd5 (start frame delimi ter pattern 5 configuration register) address: 0x64 register 9-23: sfd6 (start frame delimi ter pattern 6 configuration register) address: 0x65 register 9-24: sfd7 (start frame deli miter pattern 7 configuration register) address: 0x66 r/w-01001101 sfd5<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-0 sfd5<7:0>: start frame delimiter pattern 5 register field bits this octet is used as the msb of the sfd pattern with 125 kbps rate. r/w-10101000 sfd6<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-0 sfd6<7:0>: start frame delimiter pattern 6 register field bits this octet is used as the lsb of the sfd pattern with 125 kbps rate. when optimal = 1 , this octet is used as the lsb of the sfd pattern with 2 mbps rate. the hexadecimal digits must be different from 0x 0 and different from the corresponding digits in sfd, k = 1, 2, 3, 4 when optimal = 0 . the value 0xa7 is forbidden. r/w-11001000 sfd7<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-0 sfd7<7:0>: start frame delimiter pattern 7 register field bits when optimal = 1 , this octet is used as the lsb of the sfd pattern with 1 mbps rate. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 223 mrf24xa 9.8 start-of-frame delimiter (sfd) detection the following sections describe the sfd detection mechanism for the different data rates. header processing is required to work at least as reli- ably as the demodulation. to meet this requirement, longer preamble and 16-bit sfd is defined for frames where the payload data rate is lower than the air-data- rate of the preamble. 9.8.1 sfd detection at 125 kbps the input contains a nibble of bits decoded from the received dsss symbol. this input is updated on every new dsss symbol received. in each update, the latest four received nibbles are compared against the nibbles contained in the 16-bit sfd pattern that the host mc configures. at least three out of four nibbles must match to trigger an sfd_- found event. sfd_timeout occurs if the latest five nibbles are different from 0000 (preamble lost) while sfd_- found is not triggered. reception is reset on sfd_- timeout. for the 125 kbps data rate the last decoded four nibbles and the nibbles of pattern_125 must match in at least three nibble positions. 9.8.2 sfd detection at 1 mbps the input contains a byte, which is updated on every new byte received after the first preamble byte has been detected (this identifies the byte boundary). the two latest received bytes form a word of 16 bits is denoted by w. sfd_found event is reported if w exactly matches the host configured 16-bit pr eamble pattern (sfd), or if an approximate match is found with the following error patterns: sfd xor w = 110...01100 (two error bursts of length 2) sfd xor w = 10...011001 (single error burst of length 2, and single error on either or both ends) sfd xor w = 0...01100 (single error burst of length 2) sfd xor w = 0...0100 (single error) the rationale behind selecting these patterns is that the maximum-likelihood demodulator tends to produce error bursts of length 2 due to the trellis of the msk modulation (this particular tolerance scheme seems to be novel). sfd_timeout event is reported if the latest three octets are different from 0x0f0f0f, while sfd_- found is not triggered. reception is reset on sfd_- timeout. at 1 mbps the match tolerates single bit or maximum 2 non-contiguous 2-bit burst differences in the comparison of the last received 16 bits and pattern_1000 (simultaneously isolated single bit mismatches at both ends of the pattern constitute a single 2-bit mismatch burst). downloaded from: http:///
mrf24xa ds70005023c-page 224 preliminary ? 2015 microchip technology inc. 9.9 physical transmissions mcu sets txst and transmission starts when txst is set to 1 . txmaif, txsfdif and rxsfdif flags are handled. rxsfdif is handled even with ack. external pa/lna is automatically handled. for more information on this mode, see section 9.13 external power amplifier (pa)/low-noise amplifier (lna) . channel, data rate and link adaptation is based on retransmission, and the information is from the receiver. register 9-25: txpow (transmit powe r configuration register) address 0x3a figure 9-5: output power in function of txpow figure 9-6: tx current in function of txpow r/w-000 r/w-11111 chipboost<2:0> txpow<4:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-5 chipboost<2:0>: tx chip boosting field bits this field modifies the spec trum of the oqpsk transmission. bit 4-0 txpow<4:0>: tx power register field bits this field enables configuring the tx power ranging from -19 to 1 dbm. encoding: 11111 = +1 dbm 00001 = -19 dbm 00000 = pa off -20 -15 -10 -5 0 1 11 1 21 2 31 output power (dbm) txpow register (decimal) 11 1 21 2 31 1 11 1 21 2 31 current (ma) txpow register (decimal) note: some variance is expected due to a differ- ent matching network. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 225 mrf24xa 9.10 signal detection (power-save listen mode) in power-save listen mode, only the rx front end cir- cuit is powered, the baseband is switched off. in this mode, approximately 3 ma re ceive current is saved. to use this mode, set the psav bit to 1 . register 9-26: ratecon (rate configuration re gister) address: 0x36 note: in this mode, mrf24xa consumes less current that causes sensitivity degradation. table 9-8: recommended settings for power-save listen mode thresholds 125/250/ legacy 500 kbps 1 mbps 2 mbps desensthr 0x3 0x4 0x5 0x5 psavthr 0x9 0xc 0xf 0xf r/w-0 r/w-0 r/w-0 r/w-0 r/w-0 r/w-0 r/w-1 r/w-1 dis2000 dis1000 dis500 dis250 disstd dis125 optimal psav bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-1 out of scope. bit 0 psav: power-save mode selection bit when this bit is set, frame detection is dependent on the rssi signal, and the receive signal processor is turned on when a sudden and significant increase ( psavthr<3:0>) is detected in the signal strength or the signal strength is above an absolute level (desensthr<3:0>). 1 = power-save mode 0 = hi-sensitivity mode downloaded from: http:///
mrf24xa ds70005023c-page 226 preliminary ? 2015 microchip technology inc. register 9-27: powsave (power-sa ve configuration register) address 0x37 r/w-1010 r/w-1010 desensthr<3:0> psavthr<3:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-4 desensthr<3:0>: desensitization threshold field bits this field defines an absolute level on the rssi si gnal to activate receive signal processor if psav = 1 . unit is: 4 db/lsb. unsigned encoding is used. bit 3-0 psavthr<3:0>: frame detection threshold register field bits this field defines a relative (relative to the last 4 ? s rssi value) threshold level on the rssi signal to activate receive signal processor if psav = 1 . unit is 0.5 db/lsb. unsigned encoding is used. table 9-9: registers associated with power-save listen mode name bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 ratecon dis2000 dis1000 dis500 dis250 disstd dis125 optimal psav powsave desensthr<3:0> psavthr<3:0> legend: r = reserved, read as 0 . downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 227 mrf24xa 9.11 afc afc circuit of mrf24xa measures carrier frequency offset (cfo), for all the received packets. the measured value is interpreted as the frequency offset between the two communicating nodes. register 9-28: cfocon (cfo pre compensation re gister) address: 0x34 note: afc circuit stores cfo value in cfo- meas field after the sfd is detected and clears the field as the frame processing is finished and rxif interrupt is generated. cfotx is used as digital cfo compensa- tion for transmitting. cforx is used as digital cfo compensation for receiving. r/w-0000 r/w-0000 cfotx<3:0> cforx<3:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-4 cfotx<3:0>: tx carrier frequency offset field bits the host writes this value to compensate for the carrier frequency offset of the node during transmis- sion. pre-compensation enables usin g crystals with wider tolerances. frequency offset unit is: 13 ppm/ lsb. twos complement encoding. bit 3-0 cforx<3:0>: rx carrier frequency offset field bits the host writes this value to pre-compensate the carrier frequency offset estimation window (55 ppm). frequency offset unit is: 13 ppm/ lsb. twos complement encoding. downloaded from: http:///
mrf24xa ds70005023c-page 228 preliminary ? 2015 microchip technology inc. register 9-29: cfomeas (cfo meas urement indication register) address: 0x35 9.12 receive status vector (rsv) ( 1 , 2 ) the receive status vect or (rsv) can extend the received packet that gives extra information about the link. rsv bits are individually enabled. r/w-00000000 cfomeas<7:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-0 cfomeas<7:0>: cfo measurement field bits if afcovr bit is cleared, then th is register is written and valid when rxsfdif is set with the value of the carrier frequency offset that was estimated durin g the acquisition of the packet. the host may use this value together with the lqi as a preamble quality indication (t he lqi is measured over the cfo compensated payload). if afcovr bit is set, this receiver compensates th e carrier frequency offset. note that in this case, the cfo estimation algorithm is disabled, thus 13 ppm cfo is tolerated. cforx has no effect when afcovr is set. frequency offset unit is: ~1.62 ppm /lsb of the 2.4 ghz carrier. twos complement encoding is used. note 1: rsv does not affect the length field of the packet. 2: lqi, rssi, chdr and cfo are the order of appending the crc. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 229 mrf24xa register 9-30: rxcon1 (mac receive control 1 register) address: 0x15 r/w/hc/hs-0 r/w-0 r/w/hc-0 r/w-0 r/w-0 r/w-0 r/w-0 r-0 rxen nopa rxdec rsvlqien rsvrssien rsvchdren rsvcfoen r bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 rxen: receive enable field bit this bit enables/disables the packet reception. if an rx packet is currently being received, clearing this bit causes that packet to be discarded. 1 = rx enabled 0 = rx disabled hardware clear/set when: cleared when trxmode is set to tx-streaming mode set when trxmode is set to rx-streaming mode clearing this bit aborts the curr ent operation in the following cases: receiving a packet in packet mode or in rx-streaming mode changes to most rx related settings must be only done while this bit is cleared. the clear channel assessment (csmaen) and ac k-frame reception does not require rxen = 1 as the device turns the radio into rx when needed, irrespective of the status of the rxen bit. bit 6 nopa: no parsing bit this bit disables packet parsing. only crc is checked, if it is enabled. this feature is useful in sniffer mode. 1 = disable packet parsing 0 = enable packet parsing bit 5 rxdec: rx decryption bit setting this bit starts rx security processing ( authentication or decryption, or both) on the last received packet. 1 = rx security processing started/in process. rxdecif or rxtagif is set. 0 = rx security processing inactive or complete this bit clears itself after rx decryption has completed. bit 4 rsvlqien: receive status vector lqi enable bit if bit is set, the measured link quality is appe nded after the received frame in the packet buffer. 1 = append lqi field 0 = do not append lqi field bit 3 rsvrssien: receive status vector rssi enable bit if bit is set, the measured rssi is appended after the received frame in the packet buffer. 1 = append rssi field 0 = do not append rssi field downloaded from: http:///
mrf24xa ds70005023c-page 230 preliminary ? 2015 microchip technology inc. 9.13 external power amplifier (pa)/ low-noise amplifier (lna) mrf24xa has a pa control pin (pin 20) and an lna control pin (pin 21) to handle external pas and lnas or external antenna switch circuits. mrf24xa can also tolerate different start-up times of different external cir- cuits by sending or accepting data if the external cir- cuits completes their ramp up. mrf24xa can handle both active-high or active-low control signal sensitive circuits. 9.13.1 external pa handling mrf24xa can automatically switch on and off exter- nal pa circuits as the internal functionalities require to transmit any signal. pa pin is automatically set to its preset active state as external pa is needed and set back to its inactive state if pa is not needed. to enable external pa handling, set paen bit of extpa register to 1. extpap bit sets the active state of pa control line. the current value of extpap bit is the active state of the pa line. rfop<2:0>, field of the radio operation register show s the status of the radio and external pa. 9.13.1.1 pa switch time management mrf24xa is used with various external pa circuits. dif- ferent pa circuits may have different start-up time con- straints to reach the steady state. mrf24xa can manage to start transmitting if both the internal and external pa circuits are ready to operate. tx2txma<4:0>, transmit power-up to medium access configuration, defines the time delay that mrf24xa waits after powering on the internal pa before sending any data to transmit. its por default value is calculated to cover most of the cases, but user can redefine its value if needed. pa2txma<4:0>, external power amplifier power-up to medium access configuration, defines the time delay that mrf24xa waits after powering on the exter- nal pa before sending any data to transmit. figure 9-7 illustrates the method of pa time management of mrf24xa. bit 2 rsvchdren: receive status vector channel/mac type/data rate enable bit if bit is set, channel, mac type and data rate configurations used with the received frame are appended after the received frame in the packet buffer, using the encoding specified for ch<3:0>, frmfmt and dr<2:0> (concatenated in this order when msb is first). 1 = append channel, mac type and data rate fields 0 = do not append channel, mac type and data rate fields bit 1 rsvcfoen: receive status vector cfo enable bit if bit is set, the estimated carrier frequency offs et of the received frame is appended after the received frame in the packet buffer, using the same encoding as cfomeas register. 1 = append cfo estimation 0 = do not append estimated cfo bit 0 reserved: maintain as 0 register 9-30: rxcon1 (mac receive control 1 register) (continued) address: 0x15 downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 231 mrf24xa figure 9-7: pa acc ess time management switching on external pa switching on internal pa start transmitting t0 t0 - pa2txma t0 - tx2txma downloaded from: http:///
mrf24xa ds70005023c-page 232 preliminary ? 2015 microchip technology inc. 9.13.2 external lna handling mrf24xa can automatically switch on and off exter- nal lna circuit as the internal functionalities require receiving. lna pin is automat ically set to its predefined active state as external lna circuit is needed, and set back to its inactive state if lna is not needed. to enable external lna handling, set lnaen bit of the extlna register to 1 . extlnap bit sets the active state of lna line. the actual value of extlnap bit is the active state of the lna line. mrf24xa is programmed to delay signal receiving after powering on the external lna circuit. it enables to optimize the power consumption to the startup time of the external lna circuit. lnadly<4:0> defines the time delay between lna power-up and the start of sig- nal reception. the time base is 1 s. higher lnadly value means longer wait before starting reception. rfop<2:0> field of the radio operation register shows the status of the radio and external lna. register 9-31: opstatus (o peration status) address: 0x02 r-0 r/hs/hc-0 r/hs/hc-0 r/hs/hc-0 r/ hs/hc-0 r/hs/hc-0 r/hs/hc-0 r/hs/hc-0 r macop<3:0> rfop<2:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved hc = hardware clear hs = hardware set bit 7 reserved: maintain as 0 bit 6-3 out of scope bit 2-0 rfop <2:0>: radio operation register field bits provides status information on the curre nt radio state. encoding on rfop<2:0>: 111 = tx with external pa is turned on (tx+pa) 110 = rx with external lna is turned on (rx+lna) 101 = synthesizer and external pa or lna is turned on (synth+pa/lna) downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 233 mrf24xa register 9-32: tx2txma (transmit powe r-up to medium access configuration register) address 0x3c r-0 r/w-00011 r tx2txma<4:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7-5 reserved: maintain as 0 bit 4-0 tx2txma<4:0>: transmit power-up to medium access configuration field bits defines the time interval between turning on the transmitter of the device and the start time of medium access (start of the phy-layer frame). tx_to_txma = the transient time of the transmitter, in the following scenarios: paen = 0 paen = 1 , but the pa is turned on first. pa_to_tx ma = tx_to_txma + pa transient time. paen = 1 , but the tx and pa transients are not sequenced. tx_to_txma = the transient time of the transmitter + pa_to_txma : paen = 1 , and the transmitter is turned on first (transients are sequenced). representation: 1 ? s/1 lsb. no offset. downloaded from: http:///
mrf24xa ds70005023c-page 234 preliminary ? 2015 microchip technology inc. register 9-33: extpa (external powe r amplifier configuration register) address 0x3d r-0 r/w-0 r/w-0 r/w-00100 r extpap paen pa2txma<4:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 reserved: maintain as 0 bit 6 extpap: external power amplifier polarity bit 1 = 3.3v turns power amplifier on 0 = gnd turns power amplifier on bit 5 paen: external power amplifier enable bit this bit enables the pa pin to output the control signal for external power amplifier. bit 4-0 pa2txma<4:0>: external power amplifier power-up to medium access configuration field bits defines the time interval between turning on the external pa of the device and the start time of medium access (start of the phy-layer frame). pa_to_txma = the transient time of the external pa, in the following scenarios: paen = 1 , and the transmitter is turned on first. tx_t o_txma = pa_to_txma + tx transient time. paen = 1 , but the tx and pa transients are not sequenced. pa_to_txma = the transient time of the pa + tx_to_txma : paen = 1 , and the external power amplifier is turned on first (transients are sequenced). representation: 1 ? s/1 lsb. no offset downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 235 mrf24xa register 9-34: extlna (external low-n oise amplifier configuration register address 0x3e legend: r = reserved, read as 0. r-0 r/w-0 r/w-0 r/w-00100 r extlnap lnaen lnadly<4:0> bit 7 bit 0 legend: r = readable bit w = writable bit u = unimplemented bit, read as 0 -n = value at por 1 = bit is set 0 = bit is cleared x = bit is unknown r = reserved bit 7 reserved: maintain as 0 bit 6 extlnap: external low noise amplifier polarity bit 1 = 3.3v turns low-noise amplifier on 0 = gnd turns low-noise amplifier on bit 5 lnaen: external low-noise power amplifier enable bit this bit enables the lna pin to output the co ntrol signal for external low-noise amplifier. bit 4-0 lnadly<4:0>: external low-noise amplifier power-up transient delay field bits defines the duration between turning on the ln a and the time when the reception is valid. lna and receiver are turned on together. the longer transient is awaited before input signal is accepted as valid. representation: 1 ? s/1 lsb. no offset. table 9-10: registers associat ed with external pa and lna 7654 3 2 10 opstatus r macop<3:0> rfop<2:0> tx2txma rt x 2 t x m a < 4 : 0 > extpa r extpap paen pa2txma<4:0> extlna r extlnap lnaen lnadly<4:0> downloaded from: http:///
mrf24xa ds70005023c-page 236 preliminary ? 2015 microchip technology inc. notes: downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 237 mrf24xa 10.0 battery life optimization in a battery-operated application, the device only wakes up when it must transmit or requires to poll for data. polling is used for data reception as a means to synchronize the re motely transmitting node to the wake-up event in the receiver. between transmission and reception the device must be held in deep sleep mode drawing less current than the battery self-discharge, which is ab out 1 a. register contents and internal calibration state are maintained in deep sleep mode for efficient power mode changes. long battery life is achieved through low currents in each state of the device and a se ries of system features that contribute to minimize the duration required for transmit or receive. the following enhanced features are used to minimize radio on time: high air-data-rates to minimize the packet duration automatic, on-the-fly, per frame, air-data-rate adaptation in the receiver, allowing the transmitter to select the highest data rate that fits the quality of the link minimized framing overheads in both the phy and the mac layers minimized ramp-up and turnaround times short, still reliable channel assessment automatically handled tx and rx signal paths inferred destination addressing on-the-fly, per frame air-data-rate detection is the capability of the receiver to synchronize to the transmit- ter data rate without knowing the sender of the frame and the expected data rate in advance. on-the-fly, per frame, air-data-rate detection gives the following advantages: each low-power node can use the highest data rate allowed by its link quality to save its battery charge. the evaluation of t he link quality requires mcu interaction. multiple data rates are used within the same net- work. as opposed to conventional protocols supporting the simultaneous use of multiple air-data-rates in the net- work traffic, the frame header, which encodes the pay- load data rate, does not use the lowest data rate. without this feature either t he worst link defines the air- data-rate that all nodes must use, or each node must use the lowest data rate for the frame header, which can severely compromise the throughput and battery efficiency of the highest rates. passive listening, channel assessment and the dura- tion of the turnaround between transmit and receive contribute to the power consumption. in this regard, mrf24xa excels by minimized tx-to- rx turnaround durations, fast but reliable channel assessment and short pll and agc ramp-up dura- tions. power modes are automatically sequenced during csma sending by the internal state machines of the device without interaction from the mcu. these mechanisms can optionally control external pa and lna. the message chart in figure 10-1 illustrates a typical wake-up cycle: 1. while the low-power device is in deep sleep mode, the coordinator listens to the channel and buffers any messages addressed to the low-power node. 2. the low-power node wakes up when must trans- mit, or periodically to poll the coordinator for any pending data. 3. first, the low-power node sends a poll command to the coordinator and any data it must send. 4. low-power node can go back to deep sleep mode as soon as it gets an ack unless the coor- dinator has buffered pending data. this condi- tion is indicated in a specific bit field of the acknowledge frame that the coordinator is sending. 5. in the case of pending data, the low-power node may want to turn off the radio for a pre- determined duration allowing the coordinator to retrieve the pending data for sending. 6. finally, the coordinator turns to receive mode to get the pending data. on successful reception, it turns to transmit to send an ack and returns to deep sleep mode. 7. time-outs ensure that the low-power node does not stay powered-up forever in the case when the coordinator fails to respond in any of the transactions above. figure 10-1 shows that all the radio activities are mini- mized to immediately retu rn to deep sleep mode. as a result, the average current consumption is reduced by multiple factors in comparison to the stan- dard ieee 802.15.4 operation. the co mparison is done for three corner cases as follows: table 10-1 for polling without pending data table 10-2 for polling with 80 octets pending data table 10-3 for the transmission of 80 octets a combination of the three cases allow evaluating the energy budget of complex scenarios. a yearly 10 mah is to be added for battery self-discharge and deep sleep mode. equation 10-1 shows the self discharge current calculation. the c onsumption of the mcu and any sensors, displays must be added. downloaded from: http:///
mrf24xa ds70005023c-page 238 preliminary ? 2015 microchip technology inc. the enhanced mac and phy feature set also compresses the frame header time to achieve the shortest possible radio on time. to reduce leakage current, ensure that gpio weak pull up is turned off in case it is not needed in deep sleep mode. equation 10-1: battery self-discharge the discharge caused by 1 a average curren t over one year: 1a x 1 year = 8.76 mah table 10-1: polling for pending data C no pending data is available ( 1 ) wake-up consumed battery charge unit mode period 2 mbps extended data rate 802.15.4 compliant mode single wake-up per wake-up 4480 17450 ma*s = nc yearly average while waking up regularly in every 1s 39.3 152.9 mah/year = a 20s 2 7.6 mah/year = a 1 min 0.7 2.5 mah/year = a 5 min 0.1 0.5 mah/year = a note 1: the calculations are strongly depended on the used prot ocol. it may happen that a given protocol cannot produce the listed battery life values. table 10-2: polling for pending data C 80 octets of pending data received ( 1 ) wake-up consumed battery charge unit mode period 2 mbps extended data rate 802.15.4 compliant mode single wake-up per wake-up 12030 62620 ma*us = nc yearly average while waking up regularly in every 1s 163.7 936.7 mah/year = a 20s 8.2 46.8 mah/year = a 1 min 2.7 15.6 mah/year = a 5 min 0.5 3.1 mah/year = a note 1: the calculations are strongly depended on the used prot ocol. it may happen that a given protocol cannot produce the listed battery life values. table 10-3: polling for pending data C t ransmitting 80 octets to coordinator (as piggyback data C no pending received data) ( 1 ) wake-up consumed battery charge unit mode period 2 mbps extended data rate 802.15.4 compliant mode single wake-up per wake-up 10560 66090 ma*us = nc yearly average while waking up regularly in every 1s 92.5 579 mah/year = a 20s 4.6 28.9 mah/year = a 1 min 1.5 9.6 mah/year = a 5 min 0.3 1.9 mah/year = a note 1: the calculations are strongly depended on the used prot ocol. it may happen that a given protocol cannot produce the listed battery life values. downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 239 mrf24xa figure 10-1: mrf24xa power modes d uring data polling (message sequence chart) coordinator (mains powered) low-power (battery-powered) listen/ receive poll for pending data (+ optional piggyback data) acknowledge + indicate if data is pending pending data mcu retrieves the data to send and loads it for transmission waits for data retrieval (fixed duration) tx/rx off listen/receive duration is... deep sleep maximized wake-up minimized clear channel assessment rx-to-tx transmit tx-to-rx listen/ receive if data is not pending then deep sleep else trxoff-to-rx (start pll) minimized by high data rate and low framing overhead tx/rx off minimized by zero-if architecture minimized by high data rate and low framing overhead minimized by zero- if architecture minimized by sensitive detector minimized by high data rate and low framing overhead listen/ receive rx-to-tx transmit minimized by zero- if architecture minimized by high data rate and low framing overhead acknowledge downloaded from: http:///
mrf24xa ds70005023c-page 240 preliminary ? 2015 microchip technology inc. notes: downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 241 mrf24xa 11.0 electrical characteristics absolute maximum ratings ambient temperature under bias................................................................................................. ............. -40c to +85c storage temperature ............................................................................................................ .................. -40c to +125c voltage on any digital or analog pin with respect to v ss (except v dd ) ......................................... -0.3v to (v dd + 0.3v) voltage on v dd with respect to v ss ............................................................................................................... -0.3v to 6v maximum output current sunk by gpio0- gpio2 pins .......................................................................... 2ma at 0.3xv dd maximum output current sourced by gpio0-gpio2 pins ..................................................................... 2ma at 0.3xv dd note 1: for further details, see figure 9-5 and figure 9-6 . note: stresses above those listed under absolute ma ximum ratings may cause permanent damage to the device. this is a stress rating only and functional o peration of the device at t hose or any other conditions above those indicated in the operation listings of this specification is not implied. exposure to maximum rating conditions for extended periods ma y affect device reliability. table 11-1: recommended operating conditions parameter min. typ max. units ambient operating temperature -40 +25 +85 c supply voltage for rf, analog (av dd ) and digital circuits (dv dd ) 1.08 1.2 1.32 v supply voltage for ldo input (pin 30) and digital i/o (pin 23) 1.5 3.3 3.6 v input high voltage (v ih ) 0.65 x v dd v dd +0.3 v input low voltage (v il ) -0.3 0.35 x v dd v table 11-2: current consumption typical values: t a = 25c, v dd = 3.3v operating mode condition min. typ max. units deep sleep all gpio pins are grounded 40 na sleep 0.3 ma crystal on 1.1 ma synthesizer on 7 ma rx listen power-save all data rates 13.5 ma rx listen all data rates 16.5 ma rx packet demodulation 1 mbps or 2 mbps 15.5 ma rx packet demodulation 500 kbps, 250 kbps or 125 kbps 16.5 ma tx at maximum power ( 1 ) 3 0 m a downloaded from: http:///
mrf24xa ds70005023c-page 242 preliminary ? 2015 microchip technology inc. table 11-3: receiver characteristics typical values: t a = 25c, v dd = 3.3v parameters condition min. typ max. units rf input frequency 2.405 2.480 ghz rf sensitivity data rate: 250 kbps, per 1% -95 dbm 125 kbps at 0 ppm cfo -103 at +/- 110 ppm cfo -100 250 kbps at 0 ppm cfo -100 at +/- 110 ppm cfo -99 500 kbps: legacy and optimal framing at 0 ppm cfo -97 at +/- 110 ppm cfo -96 1 mbps: legacy framing at 0 ppm cfo -92 at +/- 110 ppm cfo -92 optimal framing at 0 ppm cfo -91 at +/- 85 ppm cfo -89 2 mbps: legacy framing at 0 ppm cfo -88 at +/- 110 ppm cfo -88 optimal framing at 0 ppm cfo -87 at +/- 85 ppm cfo -86 maximum rf input -10 dbm lo leakage maximal leakage when radio is in rx, measured after balun - 5 1 . 8d b m adjacent channel rejection at 5 mhz 32 db alternate channel rejection at 10 mhz 45 db rssi range 75 db rssi error 5 db table 11-4: transmitter characteristics typical values: t a = 25c, v dd = 3.3v parameters condition min. typ max. units rf carrier frequency 2.405 2.480 ghz maximum rf output power 1 dbm rf output power control range 20 db tx spectrum mask for o-qpsk signal offset frequency >3.5 mhz, at 0 dbm output power - 3 5d b m tx evm 17 23 30 % downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 243 mrf24xa figure 11-1: example spi slave mode timing 11.1 matching network due to some innovative rf solutions built into the chip, the conventional way of matching network design does not work with this radio. fo r further information, contact support or your sales representative. table 11-5: example slave mode requirements parameter number symbol characteristic min. max. units 70 t ss l2 sc hc s to sck input 50 ns 71 t sc h sck input high time 50 ns 72 t sc l sck input low time 50 ns 74 t sc h2 di l hold time of sdi data input to sck edge 25 ns 75 t do r sdo data output rise time 25 ns 76 t do f sdo data output fall time 25 ns 78 t sc r sck output risetime 25 ns 80 t sc h2 do v, t sc l2 do v sdo data output valid after sck edge 50 ns 82 t ss l2 do v sdo data output valid after ncs edge 50 ns 83 t ss l2 ss h ncs after sck edge 50 ns downloaded from: http:///
mrf24xa ds70005023c-page 244 preliminary ? 2015 microchip technology inc. notes: downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 245 mrf24xa 12.0 packaging information 12.1 package marking information b a 0.20 c 0.20 c 0.10 c a b 0.05 c (datum b) (datum a) c seating plane note 1 12 n 2x top view side view bottom view for the most current package drawings, please see the microchip packaging specification located at http://www.microchip.com/packaging note: note 1 1 2 n 0.10 c a b 0.10 c a b 0.10 c 0.08 c microchip technology drawing c04-160a sheet 1 of 2 32-lead very thin plastic quad flat, no lead package (mq) - 5x5x0.9 mm body [vqfn] 2x 32x d e 32x b e 2 e 32x l a a1 (a3) d2 e2 32x k downloaded from: http:///
mrf24xa ds70005023c-page 246 preliminary ? 2015 microchip technology inc. microchip technology drawing c04-160a sheet 2 of 2 for the most current package drawings, please see the microchip packaging specification located at http://www.microchip.com/packaging note: number of pins overall height terminal width overall width overall length terminal length exposed pad width exposed pad length terminal thickness pitch standoff units dimension limits a1 a b d e2 d2 a3 e l e n 0.50 bsc 0.20 ref 3.703.70 0.30 0.18 0.80 0.00 0.25 5.00 bsc 0.40 - - 0.900.02 5.00 bsc millimeters min nom 32 3.903.90 0.50 0.30 1.000.05 max k- 0.20 - ref: reference dimension, usually without tolerance, for information purposes only. bsc: basic dimension. theoretically exact value shown without tolerances. 1.2. 3. noes: pin 1 visual index feature may vary, but must be located within the hatched area. package is saw singulated dimensioning and tolerancing per asme y14.5m terminal-to-exposed-pad 32-lead very thin plastic quad flat, no lead package (mq) - 5x5x0.9 mm body [vqfn] alternate exposed pad configuration downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 247 mrf24xa recommended land pattern for the most current package drawings, please see the microchip packaging specification located at http://www.microchip.com/packaging note: dimension limits units c2 optional center pad width contact pad spacing optional center pad length contact pitch y2 x2 3.70 3.70 millimeters 0.50 bsc min e max 5.00 contact pad length (x32) contact pad width (x32) y1 x1 0.80 0.30 bsc: basic dimension. theoretically exact value shown without tolerances. notes: 1. dimensioning and tolerancing per asme y14.5m microchip technology drawing c04-2160a nom 32-lead ultra thin plastic quad flat, no lead package (mq) - 5x5x0.9 mm body [vqfn] 12 32 c1 contact pad spacing 5.00 contact pad to center pad (x32) g1 0.20 c1 c2 e x1 y1 g1 y2 x2 silk screen downloaded from: http:///
mrf24xa ds70005023c-page 248 preliminary ? 2015 microchip technology inc. notes: downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 249 mrf24xa appendix a: revision history revision a (august 2011) this is the initial releas ed version of the document. revision b (march 2013) incorporated major formatting and text updates throughout the document. revision c (march 2015) the following lists the modifications: incorporated major formatting revised a few sentences throughout the docu- ment added chapter 12 packaging information updated pulldirgpio x bit description to add 75 kohm information updated product identifi cation system section to add package information revised table 2-3 and figure 2-3. downloaded from: http:///
mrf24xa ds70005023c-page 250 preliminary ? 2015 microchip technology inc. notes: downloaded from: http:///
? 2015 microchip technology inc. ds70005023c-page 251 mrf24xa the microchip web site microchip provides online support via our www site at www.microchip.com . this web site is used as a means to make files and information easily available to customers. accessible by using your favorite internet browser, the web site contains the following information: product support C data sheets and errata, application notes and sample programs, design resources, users guides and hardware support documents, latest software releases and archived software general technical support C frequently asked questions (faq), technical support requests, online discussion groups, microchip consultant program member listing business of microchip C product selector and ordering guides, latest microchip press releases, listing of seminars and events, listings of microchip sales offices, distributors and factory representatives customer change notification service microchips customer notification service helps keep customers current on microchip products. subscribers will receive e-mail notification whenever there are changes, updates, revisions or errata related to a specified product family or development tool of interest. to register, access the microchip web site at www.microchip.com . under support, click on customer change notification and follow the registration instructions. customer support users of microchip products can receive assistance through several channels: distributor or representative local sales office field application engineer (fae) technical support customers should contact their distributor, representative or field application engineer (fae) for support. local sales offices are also available to help customers. a listing of sa les offices and locations is included in the back of this document. technical support is available through the web site at: http://microchip.com/support downloaded from: http:///
mrf24xa ds70005023c-page 252 ? 2015 microchip technology inc. notes: downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 253 mrf24xa product identification system to order or obtain information, for example, on pricing or delivery, refer to the factory or the listed sales office . part no. x t -x temperature tape and module device device: mrf24xa; v dd range 1.5v to 3.6v temperature range: i = -40o c to +85o c (industrial) package: mq = very thin plastic quad flat (5x5 mm body), 32-lead mq = ultra thin plastic quad flat, no-lead (5x5x0.9 mm body), 32-lead example: a) mrf24xa -i/ = industrial temp. tray. m. module range reel type downloaded from: http:///
mrf24xa ds70005023c-page 254 preliminary ? 2015 microchip technology inc. notes: downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 255 mrf24xa index a absolute maximum ratings .............................................. 241 agility ................................................................................ 189 c channel agility .................................................................. 191 customer change notification service ............................. 251 customer notification service........................................... 251 customer support ............................................................. 251 d deep sleep mode ............................................................. 237 e electrical characteristics................................................... 241 errata .................................................................................... 3 i internet address................................................................ 251 l low dropout (ldo) ............................................................... 7 m microchip internet web site .............................................. 251 mrf24xa ............................................................................. 5 p packaging information ...................................................... 245 pie2 .................................................................................... 25 pie3 .................................................................................... 26 power-saving features .................................................... 210 proprietary mac ................................................................ 169 r received signal strength indicator (rssi) ........................... 7 recommended operating conditions ............................... 241 rxlisten ........................................................................ 204 s synthesizer ....................................................................... 199 w www address.................................................................. 251 www, on-line support ....................................................... 3 downloaded from: http:///
mrf24xa ds70005023c-page 256 preliminary ? 2015 microchip technology inc. notes: downloaded from: http:///
? 2015 microchip technology inc. preliminary ds70005023c-page 257 information contained in this publication regarding device applications and the like is prov ided only for your convenience and may be superseded by updates. it is your responsibility to ensure that your application me ets with your specifications. microchip makes no representations or warranties of any kind whether express or implied, written or oral, statutory or otherwise, related to the information, including but not limited to its condition, quality, performance, merchantability or fitness for purpose . microchip disclaims all liability arising from this information and its use. use of microchip devices in life support and/or safe ty applications is entirely at the buyers risk, and the buyer agrees to defend, indemnify and hold harmless microchip from any and all damages, claims, suits, or expenses resulting fr om such use. no licenses are conveyed, implicitly or ot herwise, under any microchip intellectual property rights. trademarks the microchip name and logo, th e microchip logo, dspic, flashflex, flexpwr, jukeblox, k ee l oq , k ee l oq logo, kleer, lancheck, medialb, most, most logo, mplab, optolyzer, pic, picstart, pic 32 logo, righttouch, spynic, sst, sst logo, superflash and uni/o are registered trademarks of microchip te chnology incorporated in the u.s.a. and other countries. the embedded control solutions company and mtouch are registered trademarks of microc hip technology incorporated in the u.s.a. analog-for-the-digital age, bodycom, chipkit, chipkit logo, codeguard, dspicdem, dspicdem.net, ecan, in-circuit serial programming, icsp, inter-chip connectivity, kleernet, kleernet logo, miwi, mpasm, mpf, mplab certified logo, mplib, mplink, multitrak, netdetach, omniscient code generation, picdem, picdem.net, pickit, pictail, righttouch logo, real ice, sqi, serial quad i/o, total endurance, tsharc, usbcheck, varisense, viewspan, wiperlock, wireless dna, and zena are trademarks of microchip technology incorporated in the u.s.a. and other countries. sqtp is a service mark of mi crochip technology incorporated in the u.s.a. silicon storage technology is a registered trademark of microchip technology inc. in other countries. gestic is a registered tradem arks of microchip technology germany ii gmbh & co. kg, a subsidiary of microchip technology inc., in other countries. all other trademarks mentioned herein are property of their respective companies. ? 2015, microchip technology incorporated, printed in the u.s.a., all rights reserved. isbn: 978-1-63277-137-7 note the following details of the code protection feature on microchip devices: microchip products meet the specification cont ained in their particular microchip data sheet. microchip believes that its family of products is one of the mo st secure families of its kind on the market today, when used i n the intended manner and under normal conditions. there are dishonest and possibly illegal meth ods used to breach the code protection fe ature. all of these methods, to our knowledge, require using the microchip products in a manner outside the operating specif ications contained in microchips data sheets. most likely, the person doing so is engaged in theft of intellectual property. microchip is willing to work with the customer who is concerned about the integrity of their code. neither microchip nor any other semiconduc tor manufacturer can guarantee the security of their code. code protection does not mean that we are guaranteeing the product as unbreakable. code protection is constantly evolving. we at microchip are committed to continuously improving the code protection features of our products. attempts to break microchips c ode protection feature may be a violation of the digital millennium copyright act. if such acts allow unauthorized access to your softwa re or other copyrighted work, you may have a right to sue for relief under that act. microchip received iso/ts-16949:2009 certification for its worldwide headquarters, design and wafer fabrication facilities in chandler and tempe, arizona; gresham, oregon and design centers in california and india. the companys quality system processes and procedures are for its pic ? mcus and dspic ? dscs, k ee l oq ? code hopping devices, serial eeproms, microperi pherals, nonvolatile memory and analog products. in addition, microchips quality system for the design and manufacture of development systems is iso 9001:2000 certified. quality management s ystem certified by dnv == iso/ts 16949 == downloaded from: http:///
ds70005023c-page 258 ? 2015 microchip technology inc. americas corporate office 2355 west chandler blvd. chandler, az 85224-6199 tel: 480-792-7200 fax: 480-792-7277 technical support: http://www.microchip.com/ support web address: www.microchip.com atlanta duluth, ga tel: 678-957-9614 fax: 678-957-1455 austin, tx tel: 512-257-3370 boston westborough, ma tel: 774-760-0087 fax: 774-760-0088 chicago itasca, il tel: 630-285-0071 fax: 630-285-0075 cleveland independence, oh tel: 216-447-0464 fax: 216-447-0643 dallas addison, tx tel: 972-818-7423 fax: 972-818-2924 detroit novi, mi tel: 248-848-4000 houston, tx tel: 281-894-5983 indianapolis noblesville, in tel: 317-773-8323 fax: 317-773-5453 los angeles mission viejo, ca tel: 949-462-9523 fax: 949-462-9608 new york, ny tel: 631-435-6000 san jose, ca tel: 408-735-9110 canada - toronto tel: 905-673-0699 fax: 905-673-6509 asia/pacific asia pacific office suites 3707-14, 37th floor tower 6, the gateway harbour city, kowloon hong kong tel: 852-2943-5100 fax: 852-2401-3431 australia - sydney tel: 61-2-9868-6733 fax: 61-2-9868-6755 china - beijing tel: 86-10-8569-7000 fax: 86-10-8528-2104 china - chengdu tel: 86-28-8665-5511 fax: 86-28-8665-7889 china - chongqing tel: 86-23-8980-9588 fax: 86-23-8980-9500 china - dongguan tel: 86-769-8702-9880 china - hangzhou tel: 86-571-8792-8115 fax: 86-571-8792-8116 china - hong kong sar tel: 852-2943-5100 fax: 852-2401-3431 china - nanjing tel: 86-25-8473-2460 fax: 86-25-8473-2470 china - qingdao tel: 86-532-8502-7355 fax: 86-532-8502-7205 china - shanghai tel: 86-21-5407-5533 fax: 86-21-5407-5066 china - shenyang tel: 86-24-2334-2829 fax: 86-24-2334-2393 china - shenzhen tel: 86-755-8864-2200 fax: 86-755-8203-1760 china - wuhan tel: 86-27-5980-5300 fax: 86-27-5980-5118 china - xian tel: 86-29-8833-7252 fax: 86-29-8833-7256 asia/pacific china - xiamen tel: 86-592-2388138 fax: 86-592-2388130 china - zhuhai tel: 86-756-3210040 fax: 86-756-3210049 india - bangalore tel: 91-80-3090-4444 fax: 91-80-3090-4123 india - new delhi tel: 91-11-4160-8631 fax: 91-11-4160-8632 india - pune tel: 91-20-3019-1500 japan - osaka tel: 81-6-6152-7160 fax: 81-6-6152-9310 japan - tokyo tel: 81-3-6880- 3770 fax: 81-3-6880-3771 korea - daegu tel: 82-53-744-4301 fax: 82-53-744-4302 korea - seoul tel: 82-2-554-7200 fax: 82-2-558-5932 or 82-2-558-5934 malaysia - kuala lumpur tel: 60-3-6201-9857 fax: 60-3-6201-9859 malaysia - penang tel: 60-4-227-8870 fax: 60-4-227-4068 philippines - manila tel: 63-2-634-9065 fax: 63-2-634-9069 singapore tel: 65-6334-8870 fax: 65-6334-8850 taiwan - hsin chu tel: 886-3-5778-366 fax: 886-3-5770-955 taiwan - kaohsiung tel: 886-7-213-7828 taiwan - taipei tel: 886-2-2508-8600 fax: 886-2-2508-0102 thailand - bangkok tel: 66-2-694-1351 fax: 66-2-694-1350 europe austria - wels tel: 43-7242-2244-39 fax: 43-7242-2244-393 denmark - copenhagen tel: 45-4450-2828 fax: 45-4485-2829 france - paris tel: 33-1-69-53-63-20 fax: 33-1-69-30-90-79 germany - dusseldorf tel: 49-2129-3766400 germany - munich tel: 49-89-627-144-0 fax: 49-89-627-144-44 germany - pforzheim tel: 49-7231-424750 italy - milan tel: 39-0331-742611 fax: 39-0331-466781 italy - venice tel: 39-049-7625286 netherlands - drunen tel: 31-416-690399 fax: 31-416-690340 poland - warsaw tel: 48-22-3325737 spain - madrid tel: 34-91-708-08-90 fax: 34-91-708-08-91 sweden - stockholm tel: 46-8-5090-4654 uk - wokingham tel: 44-118-921-5800 fax: 44-118-921-5820 worldwide sales and service 01/27/15 downloaded from: http:///

▲Up To Search▲

Price & Availability of MRF24XAT-IMQ

	To Download MRF24XAT-IMQ Datasheet File
If you can't view the Datasheet, Please click here to try to view without PDF Reader .