MRF24XA Low-Power, 2.4 GHz ISM-Band IEEE 802.15.4™ RF Transceiver with Extended Proprietary Features Features Low-Power • IEEE 802.15.4™-2003 and IEEE 802.15.4-2006 Standard Compliant RF transceiver • Multiple air-data-rates: - 250 kbps (IEEE 802.15.4) - 125, 500, 1000, 2000 kbps, co-existence with standard networks • Configurable TX output power: -19 to 1 dBm • Frame header duration scales with the selected data rate • On-the-fly, per frame air-data-rate detection (link-by-link independent air-data-rates) • Inferred destination addressing (to further save on framing overheads; optional) • Extreme minimization of radio ON time - Highest channel-admissible data rate used - 20%-70% overall reduction through framing • 2 Mbps frames can reduce radio ON time by a factor of 4 to 8 with respect to 250 kbps frames • 27.5 mA TX current (typical at 0 dBm) • 13.5 mA RX current in RX Listen Power-Saving mode • 15.5-16.5 mA RX current in RX Packet Demodulation mode (data rate and device Configuration dependent) • Deep Sleep, Sleep, Crystal ON, and RX Listen Power-Saving modes • Memory retention in Deep Sleep mode (<40 nA typical) • Automated functions minimize MCU ON time Full-Featured MCU Support • Hardware frame parser • Hardware CSMA-CA controller, automatic Acknowledgment (ACK) and Frame Check Sequence (FCS) • Supports all Clear Channel Assessment (CCA) modes • Reports ED, RSSI, LQI, and CFO • Channel Agility with acknowledgments • Two independent 128 byte frame buffers • Streaming mode to maximize throughput • Automatic packet retransmit capability • Hardware Security Engine (AES-128) and configurable Encryption/Decryption mode 2015 Microchip Technology Inc. General • • • • • • Low external component count Best-in-class battery life preservation Supply range: 1.5V to 3.6V Compact 32-pin 5x5 mm2 QFN package Temperature range: -40oC to +85oC Certified turnkey-ready solutions available Applications • IEEE 802.15.4/ZigBee® systems (RF4CE and MiWiTM network) • Industrial monitoring and control • IEEE 1588 precise timing protocol networks • Automatic meter reading • Home building automation • Low-power wireless sensor networks • Consumer electronics, voice and audio Preliminary DS70005023C-page 1 MRF24XA AVSS OSC2 AVDD VREGOUT RBIAS AVSS VREGIN AVDD Pin Diagram 32 31 30 29 28 27 26 25 AVDD RFOUTP 1 24 OSC1 2 23 DVDDIO RFOUTN 3 22 DVDD 21 LNA AVDD 4 RFINP AVSS 5 MRF24XA 20 PA 6 19 DVSS RFINN 7 18 RESET AVDD 8 17 SDO DS70005023C-page 2 Preliminary SDI CS SCK GPIO0 INT GPIO1 GPIO2 AVSS 9 10 11 12 13 14 1516 2015 Microchip Technology Inc. MRF24XA Table of Contents 1.0 Device Overview .......................................................................................................................................................................... 5 2.0 Hardware Description................................................................................................................................................................... 7 3.0 Functional Description................................................................................................................................................................ 71 4.0 General Transceiver Operations ................................................................................................................................................ 89 5.0 IEEE 802.15.4™ Compliant Frame Format and Frame Processing ........................................................................................ 133 6.0 Proprietary Frame Format and Frame Processing................................................................................................................... 169 7.0 Advanced Link Behavior in Proprietary Packet Mode .............................................................................................................. 189 8.0 Bridging .................................................................................................................................................................................... 197 9.0 Physical layer Functions........................................................................................................................................................... 199 10.0 Battery Life Optimization .......................................................................................................................................................... 237 11.0 Electrical Characteristics .......................................................................................................................................................... 241 12.0 Packaging Information.............................................................................................................................................................. 245 Appendix A: Revision History............................................................................................................................................................. 249 The Microchip Web Site ..................................................................................................................................................................... 251 Customer Change Notification Service .............................................................................................................................................. 251 Customer Support .............................................................................................................................................................................. 251 INDEX ................................................................................................................................................................................................ 255 TO OUR VALUED CUSTOMERS It is our intention to provide our valued customers with the best documentation possible to ensure successful use of your Microchip products. To this end, we will continue to improve our publications to better suit your needs. Our publications will be refined and enhanced as new volumes and updates are introduced. If you have any questions or comments regarding this publication, please contact the Marketing Communications Department via E-mail at [email protected] or fax the Reader Response Form in the back of this data sheet to (480) 792-4150. We welcome your feedback. Most Current Data Sheet To obtain the most up-to-date version of this data sheet, please register at our Worldwide Web site at: http://www.microchip.com You can determine the version of a data sheet by examining its literature number found on the bottom outside corner of any page. The last character of the literature number is the version number, (e.g., DS30000A is version A of document DS30000). Errata An errata sheet, describing minor operational differences from the data sheet and recommended workarounds, may exist for current devices. As device/documentation issues become known to us, we will publish an errata sheet. The errata will specify the revision of silicon and revision of document to which it applies. To determine if an errata sheet exists for a particular device, please check with one of the following: • Microchip’s Worldwide Web site; http://www.microchip.com • Your local Microchip sales office (see last page) When contacting a sales office, please specify which device, revision of silicon and data sheet (include literature number) you are using. Customer Notification System Register on our web site at www.microchip.com to receive the most current information on all of our products. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 3 MRF24XA NOTES: DS70005023C-page 4 Preliminary 2015 Microchip Technology Inc. MRF24XA 1.0 DEVICE OVERVIEW MRF24XA provides hardware support for: • • • • • • • • Energy detection Carrier sense Four CCA modes CSMA-CA algorithm Automatic packet retransmission Automatic acknowledgement Independent transmit and receive buffers Security engine supports encryption and decryption for MAC sublayer and upper layer • Inferred destination addressing • Channel agility with ACKs • Battery monitoring MRF24XA is an IEEE 802.15.4™ Standard compliant 2.4 GHz RF transceiver with feature extensions. MRF24XA integrates the PHY and MAC functionality in a single-chip solution. MRF24XA implements a lowcost, low-power, high data rate (125 kbps to 2 Mbps) Wireless Personal Area Network (WPAN) device. All the data rates contains the same spectral shape requiring identical bandwidth. At 125 kbps data rate Direct Sequence Spread Spectrum (DSSS) is combined with error correction and coding for maximum range and robustness against interference. The 2 Mbps data rate is used to minimize radio ON time, therefore extending battery life. Figure 1-1 illustrates a simplified block diagram of a MRF24XA wireless node. MRF24XA interfaces to many popular Microchip PIC® microcontrollers through a 4-wire serial SPI interface, interrupt, GPIO, and RESET pins. These features reduce the processing load, allowing the use of low-cost 8-bit microcontrollers. MRF24XA is compatible with Microchip’s ZigBee®, MiWi™ and MiWi P2P software stacks. Each software stack is available as a free download, including source code, from the Microchip web site: http://www.microchip.com/wireless. MRF24XA can also handle external Power Amplifier (PA) and Low Noise Amplifier (LNA). FIGURE 1-1: MRF24XA WIRELESS NODE BLOCK DIAGRAM ® PIC MCU MRF24XA Matching network Antenna RFOUTP RFOUTN PHY MAC Interface CS IO SDI SDO RFINP SDO SDI RFINN SCK SCK INT Power Management RESET INTX IO 16 MHz crystal 2015 Microchip Technology Inc. Preliminary DS70005023C-page 5 MRF24XA NOTES: DS70005023C-page 6 Preliminary 2015 Microchip Technology Inc. MRF24XA 2.0 HARDWARE DESCRIPTION 2.1 Overview MRF24XA is an IEEE 802.15.4 Standard compliant 2.4 GHz RF transceiver with extended feature set for longer battery life, higher throughput and increased operating range. MRF24XA integrates the PHY and MAC functionality in a single-chip solution. Figure 2-1 illustrates a block diagram of the MRF24XA circuitry. An external 16 MHz crystal clocks the frequency synthesizer and generates a 2.4 GHz frequency RF carrier. The receiver is a zero-IF architecture consisting of a Low-Noise Amplifier, down conversion mixers, channel filters and baseband amplifiers with a Received Signal Strength Indicator (RSSI). The transmitter is a direct conversion architecture with a 1 dBm maximum output (typical) and 20 dB power control range. The internal transmitter and receiver circuits contains separate RFP and RFN input/output pins that connects to impedance matching circuitry (balun) and antenna. An external Power Amplifier or Low Noise Amplifier, or both is controlled through the PA and LNA pins. Three general purpose Input/Output (GPIO) pins are configurable for control or monitoring purposes. The power management circuitry consists of an integrated Low Dropout (LDO) voltage regulator and a 5-bit resolution Battery Monitor Block. MRF24XA is placed into a low-current (<40 nA typical) Deep Sleep mode. The Media Access Controller (MAC) circuitry can sequence the transmit, receive and automatically enable the security operations. The host MCU can control these mechanisms through register configurations and Frame Control (FCtrl) field embedded in the downloaded formatted frames. Three alternative frame formats are supported: IEEE 802.15.4 2003, 2006 compliant MAC frame formats and a flexible and power-efficient advanced MAC frame format, which is proprietary. Before launching transmission, the host must load the buffer with a formatted frame. The hardware can optionally perform encryption and message integrity code appending as configured, then sends the frame appending a Frame Check Sequence (FCS). Hardware can autonomously sequence acknowledge reception and automatic retransmissions. In reception, the format of the demodulated frame is verified. Depending on the Configuration, duplicate frames, frames with corrupted FCS or address mismatch are discarded. On reception of valid frames, automatic acknowledge sending, decryption and message integrity checking are supported. As the default, separate buffers are reserved for transmission and reception. Alternatively, either the Transmit Streaming (TX-Streaming) or the Receive Streaming (RX-Streaming) modes are selected whereby buffers are used by alternating between the two for servicing a single direction of data flow. The AES-128 engine are governed to perform networklayer security processing and supports complete security suites such as CTR, CBC-MAC and CCM*. Transceiver is controlled through a 4-wire SPI, interrupt and RESET pins. 2.2 Operating Modes Table 2-1 summarizes the Operating modes of MRF24XA. TABLE 2-1: MRF24XA POWER MODES Internal Functional Blocks Operating Mode 1.2V LDO Crystal Oscillator Synthesizer RX Front End Deep Sleep OFF OFF OFF OFF Sleep ON OFF OFF OFF OFF OFF RFOFF Crystal ON ON ON OFF OFF OFF OFF RFOFF Synthesizer ON ON ON ON OFF OFF OFF RX Listen Power-Save ON ON ON ON OFF OFF RX TX Chain Baseband OFF OFF RX Listen ON ON ON ON ON OFF TX ON ON ON OFF OFF ON 2015 Microchip Technology Inc. Preliminary DS70005023C-page 7 DS70005023C-page 8 FIGURE 2-1: MRF24XA ARCHITECTURE BLOCK DIAGRAM MRF24XA Block Diagram 2.3 Preliminary 2015 Microchip Technology Inc. MRF24XA 2.4 Pin Descriptions TABLE 2-2: MRF24XA PIN DESCRIPTIONS Pin Symbol Type Description 1 AVDD Power 2 RFOUTP AO Differential RF Output (+) 3 RFOUTN AO Differential RF Output (–) 4 AVDD Power 5 RFINP AI 6 AVSS Ground 7 RFINN AI 8 AVDD Power 1.2V supply, normally connected to VREGOUT (pin 29) 9 AVSS Power Ground(1) 1.2V supply, normally connected to VREGOUT (pin 29) 1.2V supply, normally connected to VREGOUT (pin 29)(1) Differential RF Input (+) Ground Differential RF Input (–) 10 GPIO2 DIO GPIO2 11 GPIO1 DIO GPIO1 12 GPIO0 DIO GPIO0 13 INT DO Interrupt Output, active-low 14 CS DI SPI Chip Select Pin, active-low 15 SCK DI SPI serial clock 16 SDI DI SPI serial data Input 17 SDO DO SPI serial data Output 18 RESET DI Reset Input, active-low 19 DVSS Ground 20 PA DO External PA enable Output 21 LNA DO External LNA enable Output Digital ground 22 DVDD Power Digital 1.2V supply, normally connected to VREGOUT (pin 29) 23 DVDDIO Power Digital 1.5V–3.6V supply for the IO blocks, normally connected to VREGIN (pin 30) 24 OSC1 AI Crystal oscillator Pin 1, External Clock Input 25 OSC2 AO Crystal oscillator Pin 2 26 AVSS Ground Ground 27 AVDD Power 1.2V supply, normally connected to VREGOUT (pin 29) 28 RBIAS AO 29 VREGOUT Power External resistor reference pin 1.2V regulated Output 30 VREGIN Power 1.5V–3.6V regulator Input 31 AVSS Ground Ground 32 AVDD Power 1.2V supply, normally connected to VREGOUT (pin 29) Legend: A = Analog, D = Digital, I = Input, O = Output Note 1: In case PCB runs out of space, disconnect these pins. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 9 MRF24XA 2.4.1 POWER AND GROUND PINS On PCB layout minimize trace length from the VDD pin to the bypass capacitors and connect capacitors to the pads as short as possible. PCB tracks must be wide enough to minimize voltage drop and serial inductance of the power line. Table 2-3 lists the recommended bypass capacitors. VDD pins 29 and 30 are power pins, which require different bypass capacitors to ensure sufficient bypass decoupling and stability. Bypass capacitors must have low serial resistance. The 4.7 µF capacitors must be made of ceramic or high-performance tantalum. TABLE 2-3: RECOMMENDED BYPASS CAPACITOR VALUES VDD Pin 2.4.2 Analog and digital power lines must follow a star topology, where the common point is the bypass capacitor on pin 30. Symbol 1 AVDD 3.3 pF 29 VREGOUT 4.7 μF 30 VREGIN 10 nF + 4.7 µF 16 MHz MAIN OSCILLATOR PINS The 16 MHz oscillator is connected to OSC1 and OSC2 pins as shown in Figure 2-2, which provides the reference frequency for the internal RF, MAC and BB circuitry. Table 2-4 lists the crystal parameters. TABLE 2-4: Bypass Capacitor To minimize parasitic effects on pins, the crystal must be put as close as possible to MRF24XA. It keeps the tracks short. Crystal must be surrounded with ground pour to minimize cross coupling effects. Crystal load capacitors must be placed close to the crystal. 16 MHz CRYSTAL PARAMETERS(1) Parameters Value Frequency tolerance for 500, 250 and 125 kbps data rates (including manufacturing aging and temperature) ±60 ppm(1) Frequency tolerance for 2 and 1 Mbps data rates (including manufacturing aging and temperature) ±40 ppm(2) Frequency 16 MHz Mode Fundamental Load Capacitance 18 pF ESR Note 1: 2: 80 Ohm max IEEE 802.15.4 defines ±40 ppm. These values are only used for design guidance . FIGURE 2-2: 16 MHz MAIN OSCILLATOR CRYSTAL CIRCUIT OSC1 CL1 X1 16 MHz Main Oscillator CL2 DS70005023C-page 10 OSC2 Preliminary 2015 Microchip Technology Inc. MRF24XA 2.4.3 RESET (RESET) PIN 2.4.6 An external Hardware Reset is performed by asserting the RESET pin 18 low. If the RESET pin is deasserted, MRF24XA starts the internal Calibration process. RDYIF interrupt is set when the device is ready to use. The RESET pin contains an internal weak pull-up resistor. 2.4.4 INTERRUPT (INT) PIN The Interrupt (INT) pin 13 provides an interrupt signal to the host MCU from MRF24XA where the signal is active-low polarity. Interrupt sources must be enabled and unmasked before the INT pin becomes active. SERIAL PERIPHERAL INTERFACE (SPI) PORT PINS MRF24XA communicates with a host MCU through a 4-wire SPI port as a slave device. MRF24XA supports SPI mode 0,0, which requires that SCK idles in a low state. The CS pin must be held low while communicating with MRF24XA. Figure 2-3 illustrates timing for a read and a write operation. MRF24XA receives the data through the SDI pin and clocks in on the rising edge of SCK. MRF24XA sends data through the SDO pin and clocks out on the falling edge of SCK. The SDO lines preserve its HiZ state in Deep Sleep mode. Refer to Section 3.2 “Interrupts” for the functional description of interrupts. 2.4.5 GENERAL PURPOSE INPUT/ OUTPUT (GPIO) PINS Three GPIO pins are configured individually for control or monitoring purposes. The TRISGPIOx bits in the GPIO register (0x0D) configures the input or output selection. GPIO data is read or written through the GPIO bits of GPIO register. The GPIO interrupt polarity is selected through GPIOxP bits in the STGPIO (0x0E) register. GPIO lines in Input mode are used in Schmitt Trigger Input mode. STENGPIOx bits of STGPIO register enables Schmitt Triggers. GPIOs are also used to monitor the internal blocks. The GPIOMODE bits <3:0> of the PINCON (0x0C) register selects these monitoring functions. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 11 Application Example MRF24XA DS70005023C-page 12 2.5 Figure 2-3 illustrates the schematic of a recommended application circuit for MRF24XA. FIGURE 2-3: MRF24XA APPLICATION CIRCUIT +Vcc C1 C2 4.7uF 6.3V 0402 4.7uF 6.3V 0402 C3 3.3pF 50V 0402 4 RFAVdd 1 RFAVdd RFAVdd 8 27 AVdd 32 AVdd 23 22 VREGOUT DVdd RFOUTn RFINp 2015 Microchip Technology Inc. 1 RBIAS LNA PA 28 AVss AVss EXP NC (GND) RFAVss RFINn 31 26 33 9 6 DVss 19 RESET GND C4 X1 18pF 50V 0402 GND RFOUTp MRF24XA-I/ML OSCIN 18 GND IC1 25 nRESET INT CS SCK SDI SDO 24 13 14 15 16 17 DVddIO nINT nCS SCK MOSI MISO GPIO2 GPIO1 GPIO0 VREGIN 10 11 12 OSCO Preliminary GPIO0 GPIO1 GPIO2 29 GND 30 GND Place close to pin#1 16MHz GND C5 18pF 50V 0402 GND R1 20k 1% 0402 GND 2 3 Balun 5 ANT1 7 21 20 GND MRF24XA Memory Organization 2.6.1 MRF24XA contains two Addressing modes: Table 2-5 shows that memory is functionally divided into Special Function Registers (SFR) and data buffers. • Short Address Mode: Requires one byte for address, and may be used to access the first 64 on-chip control registers. • Long Address Mode: Requires two bytes for address, and may be used to access all on-chip registers and data buffers. Figure 2-4 illustrates these modes. The SFRs provide control, status and device Configuration addressing for MRF24XA operations. Data buffers serve as temporary buffers for data transmission and reception. Memory is accessed through two addressing methods: Short (1 byte) and Long (2 bytes). MRF24XA MEMORY MAP Short Addressing TABLE 2-5: ADDRESS OVERVIEW 0x00 ... SYSTEM LEVEL 0x0F 0x10 ... MAC 0x2F 0x30 ... PHY 0x39 0x3A ... TX and EXTDEV 0x3F 0x40 ... PIR4 (0x07) PIE1 (0x08) Retained in Deep Sleep 2.6 MAC 0x60 PHY Long Addressing ... 0x70 RESERVED 0x1FF 0x200 ... DATA BUFFER 1 0x284 0x285 ... RESERVED 0x2FF 0x300 ... DATA BUFFER 2 0x384 0x385 ... RESERVED 0x3FF 2015 Microchip Technology Inc. Preliminary DS70005023C-page 13 SHORT ADDRESS REGISTER SUMMARY FOR MRF24XA Architecture Address SYSTEM LEVEL Preliminary MAC 2015 Microchip Technology Inc. Legend: Name Bit 7 Bit 6 0x00 REGRST r r Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0x01 FSMRST r r 0x02 OPSTATUS r 0x03 STATUS INITDONESF XTALSF REGSF CALST XTALDIS DSLEEP IDLESF POR 19 0x04 PIR1 VREGIF r RDYIF IDLEIF r CALSOIF CALHAIF r 20 0x05 PIR2 TXIF TXENCIF TXMAIF TXACKIF TXCSMAIF TXSZIF TXOVFIF FRMIF 21 0x06 PIR3 RXIF RXDECIF RXTAGIF r RXIDENTIF RXFLTIF RXOVFIF STRMIF 22 0x07 PIR4 TXSFDIF RXSFDIF ERRORIF WARNIF EDCCAIF GPIO2IF GPIO1IF GPIO0IF 23 0x08 PIE1 r r RDYIE IDLEIE r CALSOIE CALHAIE r 24 0x09 PIE2 TXIE TXENCIE TXMAIE TXACKIE TXCSMAIE TXSZIE TXOVFIE FRMIE 25 0x0A PIE3 RXIE RXDECIE RXTAGIE r RXIDENTIE RXFLTIE RXOVFIE STRMIE 26 EDCCAIE GPIO2IE GPIO1IE GPIO0IE 27 REGRST<5:0> r Page 71 FSMRST<4:0> MACOP<3:0> 71 RFOP<2:0> 18 0x0B PIE4 TXSFDIE RXSFDIE ERRORIE WARNIE 0x0C PINCON r GIE r IRQIF 0x0D GPIO GPIOEN TRISGPIO2 TRISGPIO1 TRISGPIO0 r GPIO2 GPIO1 GPIO0 29 0x0E STGPIO r GPIO2P GPIO1P GPIO0P r STENGPIO2 STENGPIO1 STENGPIO0 30 0x0F PULLGPIO r r PULLENGPIO2 PULLENGPIO1 PULLENGPIO0 31 0x10 MACCON1 CRCSZ FRMFMT SECFLAGOVR 32 0x11 MACCON2 0x12 TXCON GPIOMODE<3:0> PULLDIRGPIO2 PULLDIRGPIO1 PULLDIRGPIO0 TRXMODE<1:0> ADDRSZ<2:0> CHANNEL<3:0> TXST DTSM TXENC 28 SECSUITE<3:0> TXBUFEMPTY CSMAEN 34 DR<2:0> 35 0x13 RXACKWAIT 0x14 RETXCOUNT RXACKWAIT<7:0> 0x15 RXCON1 RXEN NOPA RXDEC RXVLQIEN RSVRSSIEN RSVCHDREN RSVCFOEN r 38 0x16 RXCON2 RXBUFFUL IDENTREJ ACKRXFP ACKTXFP AUTORPTEN AUTOACKEN ADPTCHEN ADPTDREN 39 0x17 TXACKTO 0x18 RXFILTER NOTMEREJ BCREJ NSTDREJ 0x19 TMRCON 0x1A CSMABE RETXMCNT<3:0> 37 RETXCCNT<3:0> 37 TXACKTO<7:0> PANCRDN CRCREJ CMDREJ DATAREJ UNIREJ BOMCNT<2:0> 41 BASETM<4:0> MAXBE<3:0> MINBE<3:0> 42 44 45 0x1B BOUNIT BOUNIT<7:0> 46 0x1C STRMTOL STRMTO<7:0> 46 0x1D STRMTOH STRMTO<15:8> 46 0x1E OFFTM OFFTM<7:0> 47 r = Reserved, read as ‘0’. MRF24XA DS70005023C-page 14 TABLE 2-6: 2015 Microchip Technology Inc. TABLE 2-6: SHORT ADDRESS REGISTER SUMMARY FOR MRF24XA (CONTINUED) Architecture Address Preliminary PHY DS70005023C-page 15 Legend: Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Page 0x1F ADDR1 ADDR<7:0> 48 0x20 ADDR2 ADDR<15:8> 48 0x21 ADDR3 ADDR<23:16> 48 0x22 ADDR4 ADDR<31:24> 48 0x23 ADDR5 ADDR<39:32> 48 0x24 ADDR6 ADDR<47:40> 48 0x25 ADDR7 ADDR<55:48> 48 0x26 ADDR8 ADDR<63:56> 48 0x27 SHADDRL SHADDR<7:0> 49 0x28 SHADDRH SHADDR<15:8> 49 0x29 PANIDL PANID<7:0> 49 0x2A PANIDH PANID<15:8> 49 0x2B SECHDRINDX r SECHDRINDX<6:0> 50 0x2C SECPAYINDX r SECPAYINDX<6:0> 50 0x2D SECENDINDX r SECENDINDX<6:0> 0x2E MACDEBUG BUF1TXPP BUF2TXPP 0x2F CCACON1 CCABUSY CCAST 0x30 CCACON2 0x31 EDCON 0x32 EDMEAN EDMEAN<7:0> 0x33 EDPEAK EDPEAK<7:0> 0x34 CFOCON 0x35 CFOMEAS 0x36 RATECON 0x37 POWSAVE 0x38 BBCON RNDMOD AFCOVR 0x39 IFGAP r r 0x3A TXPOW BUF1RXPP BUF2RXPP TXRDBUF BUSRDBUF BUSWRBUF RSSITHR<5:0> CSTHR<3:0> r 51 RXWRBUF r 53 CCAMODE<1:0> CCALEN<1:0> EDMODE EDST EDLEN<3:0> 54 55 CFORX<3:0> 55 CFOMEAS<7:0> DIS1000 DIS500 DIS250 DISSTD DESENSTHR<3:0> 56 DIS125 OPTIMAL PSAVTHR<3:0> RXGAIN<1:0> r CHIPBOOST<2:0> 53 54 CFOTX<3:0> DIS2000 52 PRMBHOLD PRMBSZ<2:0> PSAV 57 58 59 IFGAP<4:0> 60 TXPOW<4:0> 60 61 0x3B TX2IDLE r r r TX2IDLE<4:0> 0x3C TX2TXMA r r r TX2TXMA<4:0> 61 0x3D EXTPA r EXTPA_P PAEN PA2TXMA<4:0> 62 0x3E EXTLNA r EXTLNA_P LNAEN LNADLY<4:0> 62 0x3F BATMON r r BATMONPD BATMON<4:0> 63 r = Reserved, read as ‘0’. MRF24XA TX AND EXTDEV Name MRF24XA TABLE 2-7: MAC LONG ADDRESS REGISTER SUMMARY FOR MRF24XA Address Name 0x40 SECKEY1 0x41 0x42 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Page SECKEY<7:0> 63 SECKEY2 SECKEY<15:8> 63 SECKEY3 SECKEY<23:16> 63 0x43 SECKEY4 SECKEY<31:24> 63 0x44 SECKEY5 SECKEY<39:32> 63 0x45 SECKEY6 SECKEY<47:40> 63 0x46 SECKEY7 SECKEY<55:48> 63 0x47 SECKEY8 SECKEY<63:56> 63 0x48 SECKEY9 SECKEY<71:64> 63 0x49 SECKEY10 SECKEY<79:72> 63 0x4A SECKEY11 SECKEY<87:80> 63 0x4B SECKEY12 SECKEY<95:88> 63 0x4C SECKEY13 SECKEY<103:96> 63 0x4D SECKEY14 SECKEY111:104> 63 0x4E SECKEY15 SECKEY<119:112> 63 0x4F SECKEY16 SECKEY<127:120> 63 0x50 SECNONCE1 SECNONCE<7:0> 65 0x51 SECNONCE2 SECNONCE<15:8> 65 0x52 SECNONCE3 SECNONCE<23:16> 65 0x53 SECNONCE4 SECNONCE<31:24> 65 0x54 SECNONCE5 SECNONCE<39:32> 65 0x55 SECNONCE6 SECNONCE<47:40> 65 0x56 SECNONCE7 SECNONCE<55:48> 65 0x57 SECNONCE8 SECNONCE<63:56> 65 0x58 SECNONCE9 SECNONCE<71:64> 65 0x59 SECNONCE10 SECNONCE<79:72> 65 0x5A SECNONCE11 SECNONCE<87:80> 65 0x5B SECNONCE12 SECNONCE<95:88> 65 0x5C SECNONCE13 SECNONCE<103:96> 65 0x5D SECENCFLAG SECENCFLAG<7:0> 0x5E SECAUTHFLAG SECAUTHFLAG<7:0> r 0x5F PHY Bit 7 0x60 SFD1 SFD1<7:0> 66 0x61 SFD2 SFD2<7:0> 67 0x62 SFD3 SFD3<7:0> 67 0x63 SFD4 SFD4<7:0> 68 0x64 SFD5 SFD5<7:0> 68 0x65 SFD6 SFD6<7:0> 69 0x66 SFD7 SFD7<7:0> 69 0x67 r 0x68 r 0x69 r 0x6A r 0x6B r 0x6C r 0x6D 0x6E 0x7F DS70005023C-page 16 r SFDTO SFDTIMEOUT<7:0> r Preliminary 2015 Microchip Technology Inc. MRF24XA 2.6.2 ADDRESS 2.6.4 When using a Short Addressing mode, the Address field is 6 bits wide to reduce framing overhead while accessing the mostly active registers (0x00..0x3F). In Long Addressing mode, the Address field is 10 bits wide (0x00..0x3FF) thus all the address is available for SPI operation. 2.6.3 AUTOMATIC TX START FEATURE When a write to TRXBUF is done using Long Addressing mode and the 3rd bit of Byte 2 is set, the TXST bit automatically sets after the CS pin is released, and then MRF24XA sends the packet. AUTOMATIC BUFFER FLUSH FEATURE When a read from TRXBUF is done using Long Addressing mode and the 3rd bit of Byte 2 is set, the BUFFULL bit automatically becomes cleared after the CS pin is negated. 2.6.5 ADDRESS AUTO-INCREMENT FEATURE After the starting address is loaded, the first byte of data is read from or written to this address. The second byte (assuming the CS pin is not negated between bytes) is read from or written to the starting address plus one, and so on. If the memory map end is reached, the effective address rolls over to the beginning of the memory map. It is the sole responsibility of the software to handle this situation correctly. Figure 2-4 illustrates the available Address modes. FIGURE 2-4: SPI FRAMING TYPES 2015 Microchip Technology Inc. Preliminary DS70005023C-page 17 MRF24XA 2.7 Register Details REGISTER 2-1: R-0 OPSTATUS (OPERATION STATUS)(3) R/HS/HC-0 r R/HS/HC-0 R/HS/HC-0 R/HS/HC-0 Address: 0x02 R/HS/HC-0 MACOP<3:0> R/HS/HC-0 R/HS/HC-0 RFOP<2:0> bit 7 bit 0 Legend: R = Readable W = Writable bit bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared r = Reserved ‘1’ = Bit is set HC = Hardware Clear x = Bit is unknown HS = Hardware Set bit 7 Reserved: Maintain as ‘0’ bit 6-3 MACOP<3:0>: MAC Operation Register bits(1, 2) Provides status information on the current MAC state machine state. Encoding on MACOP<3:1>: 111 = Transmitting Acknowledge (TXACK) 110 = Receiving a packet (RXBUSY) 101 = Receiver listening to the channel waiting for packet (RX) 100 = Receiving (or waiting for) Acknowledge (RXACK) 011 = Transmitting a packet (TX) 010 = Performing Clear Channel Assessment (CCA) 001 = Back-off before repeated CCA (BO) 000 = MAC does not perform any o ation (IDLE) bit 2-0 RFOP<2:0>: Radio Operation Register bits Provides status information on the current radio state. Encoding on RFOP<2:0>: 111 = TX with external PA is turned on (TX+PA) 110 = RX with external LNA is turned on (RX+LNA) 101 = Synthesizer and external PA or LNA is turned on (SYNTH+PA/LNA) 100 = Radio calibrates if the host MCU sets the CALST, otherwise, device malfunction occurs (CAL/MAL) 011 = Analog transmit chain is activated (TX) 010 = Analog receiver chain is active (RX). Digital may be partially shut off 001 = Synthesizer is steady or ramping up or channel change is issued (SYNTH) 000 = Only the crystal oscillator is ON (OFF), (except when XTALSF = 1) Note 1: GPIO<2:0> is dedicated to output MACOP<3:1> or RFOP<2:0>. Refer to the PINCON register, which specifies the pin Configuration. MACOP<0> is connected to the RXBUFFUL register bit. It cannot be output over GPIO’s. The OPSTATUS register is sent on the SDO pin during the first byte of the SPI operation. 2: 3: DS70005023C-page 18 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-2: STATUS (DEVICE STATUS) Address: 0x03 R/HS R/HS R/HS R/W/HC-0 R/W-0 R/W-0 R/HS R/W/HC INITDONESF XTALSF REGSF CALST XTALDIS DSLEEP IDLESF POR bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 x = Bit is unknown INITDONESF: Device Initialization Status Flag bit Indicates that the ready state is reached since the LDO is on, (If VREGIF = 1). INITDONESF is asserted when RDYIF is set for the first time after VREGIF. This bit is only cleared on reset (POR, DEVFRST and PINRST). bit 6 XTALSF: Crystal Status Flag bit XTALSF = 1, indicates that 16 MHz system clock (from the crystal oscillator) is active. This bit is cleared either when XTALDIS is set or reset (POR, DEVFRST, PINRST). XTALSF = 0, indicates that the crystal oscillator is either powered off (XTALDIS = 1) or is ramping up or is not stabilized yet, and the system clock is inactive. bit 5 REGSF: Configuration Registers Status Flag bit REGSF = 1 indicates that all the 1.2V register content is valid. Either it holds the default value after reset and the retention memory does not hold any data to restore, or the register configurations are restored from the retention memory. REGSF = 0 indicates that registers from 0x08-0x6E are invalid. This occurs when the wake-up procedure from Deep Sleep mode did not complete the register restore operation yet. This bit is only cleared on Reset (POR, DEVFRST, and PINRST). bit 4 CALST: Calibration Start bit MCU sets this bit to start Calibration procedure after a CALSOIF or CALHAIF interrupt occurred. MCU may not clear it to abort Calibration. The device clears CALST when the Calibration is completed (CALHAIF = 0 indicates success, CALHAIF = 1 indicates failure). Issuing CALST operation without CALHAIF/CALSOIF terminates without any effect on the device. bit 3 XTALDIS: Crystal Disable bit MCU sets this bit to send the device into XTAL OFF state (reachable from ready state). XTALSF automatically gets cleared. The SPI register access is performed when crystal is not working. bit 2 DSLEEP: Deep-Sleep bit MCU sets this bit to send the device into Deep Sleep state. Following DSLEEP = 1 , the SPI access to the SFR is shut off, and the SPI pins must be quite, unless the host MCU wants to wake-up the device. When DSLEEP is set, the device transitions through register backup (taking cca. 16 ìs) before LDO is powered off. bit 1 IDLESF: Idle Status Flag bit Indicates Idle state of the device when all of the following bits are deasserted: • TXBUFEMPTY = 0 since it is transmitted (TXST) • Network layer security finished (TXENC) • Crypto engine finished (RXDEC) • Energy detect operation finished (EDST) • Clear Channel Assessment finished (CCAST) bit 0 POR: Power-on-Reset Flag bit The 3.3V POR flag status. The device sets this only on 3.3V power-up (e.g., when battery is changed). Cleared by host MCU to be able to sense a Brown-out Reset (BOR). Settable for software testing. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 19 MRF24XA REGISTER 2-3: PIR1 (PERIPHERAL INTERRUPT REGISTER 1) Address: 0x04 R/HS-1 R-0 R/HS-0 R/W/HC-0 R-0 R/W/HS-0 R/W/HS-0 R-0 VREGIF r RDYIF IDLEIF r CALSOIF CALHAIF r bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 x = Bit is unknown VREGIF: Voltage Regulator On Interrupt Flag bit This is a nonpersistent bit. The register bit initializes to one on 1.2V reset except for PINRESET and only clears when reading PIR1. Note that the corresponding IE bit is not implemented(1). bit 6 Reserved: Maintain as ‘0’ bit 5 RDYIF: Ready State Interrupt Flag bit Set each time when ready state is reached: • when Calibration ended (CALST = 0) • when initialization ended (INITDONESF = 1) • when crystal is ramped up (XTALSF = 1) This bit is cleared when PIR1 is read. bit 4 IDLEIF: Idle State Interrupt Flag bit Set each time the IDLESF is set and if MCU did not trigger this change. This is unchanged when MCU aborts an action by clearing either of TXST, TXENC, RXDEC or EDST bits. This bit is cleared when PIR1 is read. bit 3 Reserved: Maintain as ‘0’ bit 2 CALSOIF: Calibration Soft Interrupt Flag bit CALSOIF = 1 indicates that Calibration is needed (CALST) although the radio is still functional. It also warns of a possible degradation in signal quality and consumption, and a risk of CALHAIF interrupt. This bit is cleared when PIR1 is read. bit 1 CALHAIF: Calibration Hard Interrupt Flag bit CALHAIF = 1 indicates that immediate Calibration (CALST) is mandatory, otherwise the radio is not functional. The device enters into malfunction state. This bit is cleared when PIR1 is read. bit 0 Note 1: Reserved: Maintain as ‘0’ Generated non-maskable interrupt is gated off until the 1.2V reset is released. DS70005023C-page 20 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-4: PIR2 (PERIPHERAL INTERRUPT REGISTER 2) ADDRESS: 0x05 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 TXIF TXENCIF TXMAIF TXACKIF TXCSMAIF TXSZIF TXOVFIF FRMIF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 x = Bit is unknown TXIF: Transmission Done Interrupt Flag bit The current TX operation (TXST) is successfully completed. This event is unchanged when a hardware generated ACK packet completed the transmission or when a packet is repeated. Nonpersistent, cleared by SPI read. bit 6 TXENCIF: Transmit Encryption Interrupt Flag bit The TX packet is successfully encrypted or complemented, or both with a Message Integrity Code (MIC). Set by the device after TXENC = 1, when TXENC is cleared. Nonpersistent, cleared by SPI read. bit 5 TXMAIF: Transmitter Medium Access Interrupt Flag bit Set by the device when the medium is accessed specifically when the first sample in the preamble is transmitted into the air. Nonpersistent, cleared by SPI read. bit 4 TXACKIF: Transmission Unacknowledged Failure Interrupt Flag bit Set by the device when Acknowledge is not received after the configured maximum number of transmission retries RETXMCNT<3:0>, provided that the Frame Control field of the transmitted frame indicates AckReq = 1. Nonpersistent, cleared by SPI read. bit 3 TXCSMAIF: Transmitter CSMA Failure Interrupt Flag bit Set by the device when CSMA-CA finds the channel busy for BOMCNT<2:0> number of times, provided that CSMAEN = 1 is configured. Nonpersistent, cleared by SPI read. bit 2 TXSZIF: Transmit Packet Size Error Interrupt Flag bit Set by the device if TX packet size (first byte of the TX buffer) is found to be zero or greater than the maximum size that the buffer can support. Automatic size check is performed after TXST is set by the user. Please note that the device may modify the packet length after CRC or MIC calculation. Nonpersistent, cleared by SPI read. bit 1 TXOVFIF: Transmitter Overflow Interrupt Flag bit The Host Controller attempted to write a TX buffer that was not empty (TXBUFEMPTY = 0). Nonpersistent, cleared by SPI read. bit 0 FRMIF: Frame Format Error Interrupt Flag bit Set if the transmitter/receiver fails to parse the frame in the buffer (it is not as it must be or it is corrupted in demodulation). 2015 Microchip Technology Inc. Preliminary DS70005023C-page 21 MRF24XA REGISTER 2-5: PIR3 (PERIPHERAL INTERRUPT REGISTER 3) R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 RXIF RXDECIF RXTAGIF R-0 ADDRESS: 0x06 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 r RXIDENTIF RXFLTIF RXOVFIF STRMIF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 x = Bit is unknown RXIF: Received Successful Interrupt Flag bit Set by the device when a frame passed packet filtering and accepted, refer to Register 2-23. This interrupt flag is only set once for a packet and is not set when the packet is the duplicate of a repeated transmission (sequence number matches with the previously received frame). Nonpersistent, cleared by SPI read. bit 6 RXDECIF: Receiver Decryption/Authentication Passed Interrupt Flag bit Set by the device when decryption/authentication finished without error. Nonpersistent, cleared by SPI read. bit 5 RXTAGIF: Receiver Decryption/Authentication Failure Interrupt Flag bit Set by the device when decryption/authentication finished with error. Nonpersistent, cleared by SPI read. bit 4 bit 3 Reserved: Maintain as ‘0’ RXIDENTIF: Received Packet Identical Interrupt Flag bit Set by the device when the packet is the duplicate of a repeated transmission (sequence number and source address matches with the previously received frame). Nonpersistent, cleared by SPI read. bit 2 RXFLTIF: Received Packet Filtered Interrupt Flag bit Set by the device when a packet is received, but rejected by one or more RX Filters, refer to Register 223. Nonpersistent, cleared by SPI read. bit 1 RXOVFIF: Receiver Overflow Error Interrupt Flag bit Set by the device to indicate that a packet was received, but all RX buffers were full. Consequently the packet was not received, but was discarded instead(1). Nonpersistent, cleared by SPI read. bit 0 STRMIF: Receive Stream Time-Out Error Interrupt Flag bit Set by the device to indicate that the duration specified in STRMTO elapsed since the last received packet while in RX-Streaming mode, and the MAC clears the stored sequence number. Nonpersistent, cleared by SPI read. Note 1: In Packet mode, use a single buffer for received frames. In RX-Streaming mode, use both buffers for reception. DS70005023C-page 22 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-6: PIR4 (PERIPHERAL INTERRUPT REGISTER 4)(1) ADDRESS: 0x07 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 TXSFDIF RXSFDIF ERRORIF WARNIF EDCCAIF GPIO2IF GPIO1IF GPIO0IF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 x = Bit is unknown TXSFDIF: Transmit SFD Sent Interrupt Flag bit Set by the device when the last sample of the SFD field is sent into the air. Nonpersistent, cleared by SPI read bit 6 RXSFDIF: Receive SFD Detected Interrupt Flag bit Set by the device when the SFD field of the received frame is detected. Nonpersistent, cleared by SPI read. bit 5 ERRORIF: General Error Interrupt Flag bit Set by the device, when malfunction state is reached. bit 4 WARNIF: Warning Interrupt Flag bit Set by the device when one of the following occurred: • Battery voltage drops below the threshold by BATMON<4:0> at 0x3F • Indicates that resistor is missing or improperly connected. bit 3 EDCCAIF: Energy Detect/CCA Done Interrupt Flag bit Set by the device when Energy-detect or CCA measurement is complete (following that the host MCU sets the EDST/CCAST bit to start the measurement and the device is clearing it for completion). Nonpersistent. Cleared by SPI read. bit 2 GPIO2IF: GPIO2 Interrupt Flag bit Set by the device if the GPIOMODE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. bit 1 GPIO1IF: GPIO1 Interrupt Flag bit Set by the device if the GPIOMODE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. bit 0 GPIO0IF: GPIO0 Interrupt Flag bit Set by the device if the GPIOMODE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. Note 1: CFOMEAS<7:0> indication becomes valid on SFD found. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 23 MRF24XA REGISTER 2-7: PIE1 (PERIPHERAL INTERRUPT ENABLE 1) ADDRESS: 0x08 R-0 R/W-1 R/W-1 R-0 R/W-1 R/W-1 R-0 r RDYIE IDLEIE r CALSOIE CALHAIE r bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-6 Reserved: Maintain as ‘0’ bit 5 RDYIE: Ready Interrupt Enable bit This bit masks the RDYIF interrupt bit. bit 4 IDLEIE: Idle Interrupt Enable bit This bit masks the IDLEIF interrupt bit. bit 3 Reserved: Maintain as ‘0’ bit 2 CALSOIE: Calibration Soft Interrupt Enable bit This bit masks the CALSOIF interrupt bit. bit 1 CALHAIE: Calibration Hard Interrupt Enable bit This bit masks the CALHAIF interrupt bit. bit 0 Reserved: Maintain as ‘0’ DS70005023C-page 24 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-8: PIE2 (PERIPHERAL INTERRUPT ENABLE 2) ADDRESS: 0x09 R/W-1 R/W-1 R/W-0 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 TXIE TXENCIE TXMAIE TXACKIE TXCSMAIE TXSZIE TXOVFIE FRMIE bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7 TXIE: Transmit Interrupt Enable bit This bit masks the TXIF interrupt bit. bit 6 TXENCIE: Transmit Encryption and Authentication Interrupt Enable bit This bit masks the TXENCIF interrupt bit. bit 5 TXMAIE: Transmitter Medium Access Interrupt Enable bit This bit masks the TXMAIF interrupt bit. bit 4 TXACKIE: Transmission Unacknowledged Failure Interrupt Enable bit This bit masks the TXACKIF interrupt bit. bit 3 TXCSMAIE: Transmitter CSMA Failure Interrupt Enable bit This bit masks the TXCSMAIF interrupt bit. bit 2 TXSZIE: Transmit Packet Size Error Interrupt Enable bit bit 1 TXOVFIE: Transmitter Overflow Interrupt Enable bit This bit masks the TXSZIF interrupt bit. This bit masks the TXOVFIF interrupt bit. bit 0 FRMIE: Frame Format Error Interrupt Enable bit This bit masks the FRMIF interrupt bit. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 25 MRF24XA REGISTER 2-9: PIE3 (PERIPHERAL INTERRUPT ENABLE 3) ADDRESS: 0x0A R/W-1 R/W-1 R/W-1 R-0 R/W-0 R/W-0 R/W-1 R/W-1 RXIE RXDECIE RXTAGIE r RXIDENTIE RXFLTIE RXOVFIE STRMIE bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7 RXIE: Received Successful Interrupt Enable bit This bit masks the RXIF interrupt bit. bit 6 RXDECIE: Receiver Decryption/Authentication Passed Interrupt Enable bit This bit masks the RXDECIF interrupt bit. bit 5 RXTAGIE: Receiver Decryption/Authentication Failure Interrupt Enable bit This bit masks the RXTAGIF interrupt bit. bit 4 Reserved: Maintain as ‘0’ bit 3 RXIDENTIE: Received Packet Identical Interrupt Enable bit This bit masks the RXIDENTIF interrupt bit. bit 2 RXFLTIE: Received Packet Filtered Interrupt Enable bit This bit masks the RXFLTIF interrupt bit. bit 1 RXOVFIE: Receiver Overflow Interrupt Enable bit This bit masks the RXOVFIF interrupt bit. bit 0 STRMIE: Receive Stream Time-Out Error Interrupt Enable bit This bit masks the STRMIF interrupt bit. DS70005023C-page 26 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-10: PIE4 (PERIPHERAL INTERRUPT ENABLE 4) ADDRESS: 0x0B R/W-0 R/W-0 R/W-1 R/W-1 R/W-1 R/W-0 R/W-0 R/W-0 TXSFDIE RXSFDIE ERRORIE WARNIE EDCCAIE GPIO2IE GPIO1IE GPIO0IE bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7 TXSFDIE: Transmit SFD Sent Interrupt Enable bit This bit masks the TXSFDIF interrupt bit. bit 6 RXSFDIE: Receive SFD Detected Interrupt Enable bit This bit masks the RXSFDIF Interrupt Enable. bit 5 ERRORIE: General Error Interrupt Enable bit This bit masks the ERRORIF interrupt bit. bit 4 WARNIE: Warning Interrupt Enable bit This bit masks the WARNIF interrupt bit. bit 3 EDCCAIE: Energy Detect/CCA Done Interrupt Enable bit This bit masks the EDCCAIF interrupt bit. bit 2 GPIO2IE: GPIO2 Interrupt Enable bit This bit masks the GPIO2IF interrupt bit. bit 1 GPIO1IE: GPIO1 Interrupt Enable bit This bit masks the GPIO1IF interrupt bit. bit 0 GPIO0IE: GPIO0 Interrupt Enable bit This bit masks the GPIO0IF interrupt bit. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 27 MRF24XA REGISTER 2-11: PINCON (PIN CONFIGURATION REGISTER) ADDRESS: 0x0C R-0 R/W-1 R-0 R-1 R/W-0000 r GIE r IRQIF GPIOMODE<3:0> bit 7 bit 0 Legend: R = Readable bit -n = Value at POR W = Writable bit ‘1’ = Bit is set U = Unimplemented bit, read as ‘0’ ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 Reserved: Maintain as ‘0’ bit 6 GIE: General Interrupt Enable bit This bit enables to output IRQIF on INT pin. Note that the polarity of INT pin is active-low. bit 5 Reserved: Maintain as ‘0’ bit 4 IRQIF: Interrupt Request Pending bit This bit is the OR relationship of the enabled interrupt flags. bit 3-0 GPIOMODE <3:0>: GPIO Mode Field bits This field enables redefining the functionality of the GPIO pins Encoding: 11xx = Reserved 1011 = GPIO pins are used for Receive streaming (RXSTREAM). Pins GPIO<2:0> are used to output {RXWRBUF, BUSRDBUF, RXBUFFUL} 1010 = GPIO pins are used for Transmit streaming (TXSTREAM). Pins GPIO<2:0> are used to output {TXRDBUF, BUSWRBUF, TXBUFEMPTY} 1001 = Reserved 1000 = Reserved 0111 = Reserved 0110 = Reserved 0101 = Intended for supporting Precise Network Time Synchronization (TIMESYN). GPIO<0> is used to output TX, while GPIO<1> to output RX SFD indication pulses. GPIO<2> is used in “NORMAL” operation mode. 0100 = GPIO pins are used for Radio monitoring (RFMON). Pins GPIO<2:0> are used to output RFOP<2:0>. 0011 = GPIO pins are used for MAC monitoring (MACMON). Pins GPIO<2:0> are used to output MACOP<3:1>. 0010 = GPIO pins are used for RXFSM monitoring (RXFSMMON). Pins GPIO<2:0> are used to output receiver state-machine. 000 = Preamble search 001 = Hi-rate SFD search 010 = Mid-rate SFD search 011 = Low-rate SFD search 100 = Legacy Length field processing 101 = Payload processing 0001 = GPIO pins are used for AGC monitoring (AGCMON). Pins GPIO<2:0> are used to output {AGCHOLD, GAIN<1:0>} where AGCHOLD is an internal flag set when a receiver detects a preamble and clears when the AGC is set free after the end of the frame. 0000 = GPIO pins are used as General Purpose I/O’s by the host MCU (NORMAL). DS70005023C-page 28 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-12: GPIO (GENERAL PURPOSE I/O REGISTER) ADDRESS: 0x0D R/W-0 R/W-1 R/W-1 R/W-1 R-0 R/W-0 R/W-0 R/W-0 GPIOEN TRISGPIO2 TRISGPIO1 TRISGPIO0 r GPIO2 GPIO1 GPIO0 bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7 GPIOEN: GPIO Enable bit This bit enables the GPIO’s control, if GPIOMODE is configured into Normal mode. The other GPIOMODE Configuration automatically controls GPIO pins. bit 6 TRISGPIO2: Tri-state Control for GPIO 2 Pin bit If set, the pin is configured into Input mode. Value reads from GPIO2 bit. If cleared, the pin is configured into Output mode. Value sets through the GPIO2 bit. bit 5 TRISGPIO1: Tri-state Control for GPIO 1 Pin bit If set, the pin is configured into Input mode. Value reads from GPIO1 bit. If cleared, the pin is configured into Output mode. Value sets through the GPIO1 bit. bit 4 TRISGPIO0: Tri-state Control for GPIO 0 Pin bit If set, the pin is configured into Input mode. Value reads from GPIO0 bit. If cleared, the pin is configured into Output mode. Value sets through the GPIO0 bit. bit 3 Reserved: Maintain as ‘0’ bit 2 GPIO2: GPIO 2 Value bit This bit represents the value on the GPIO 2 pin. bit 1 GPIO1: GPIO 1 Value bit This bit represents the value on the GPIO 1 pin. bit 0 GPIO0: GPIO 0 Value bit This bit represents the value on the GPIO 0 pin. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 29 MRF24XA REGISTER 2-13: STGPIO (SCHMITT TRIGGER GENERAL PURPOSE I/O REGISTER) ADDRESS: 0x0E R-0 R/W-0 R/W-0 R/W-0 R-0 r GPIO2P GPIO1P GPIO0P r R/W-0 R/W-0 R/W-0 STENGPIO2 STENGPIO1 STENGPIO0 bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7 Reserved: Maintain as ‘0’ bit 6 GPIO2P: GPIO 2 Polarity bit This bit controls GPIO2IF polarity when configured into Input mode. 1 = Rising edge 0 = Falling edge bit 5 GPIO1P: GPIO 1 Polarity bit This bit controls GPIO1IF polarity when configured into Input mode. 1 = Rising edge 0 = Falling edge bit 4 GPIO0P: GPIO 0 Polarity bit This bit controls GPIO0IF polarity when configured into Input mode. 1 = Rising edge 0 = Falling edge bit 3 Reserved: Maintain as ‘0’ bit 2 STENGPIO2: Schmitt Trigger Enable GPIO 2 bit This bit enables Schmitt-trigger circuit on GPIO 2 pad and turns off by default. 1 = Schmitt trigger enabled 0 = Schmitt trigger disabled bit 1 STENGPIO1: Schmitt Trigger Enable GPIO 1 bit This bit enables Schmitt-trigger circuit on GPIO 1 pad and turns off by default. 1 = Schmitt trigger enabled 0 = Schmitt trigger disabled bit 0 STENGPIO0: Schmitt Trigger Enable GPIO 0 bit This bit enables Schmitt-trigger circuit on GPIO 0 pad and turns off by default. 1 = Schmitt trigger enabled 0 = Schmitt trigger disabled DS70005023C-page 30 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-14: PULLGPIO (PULL CONTROL GENERAL PURPOSE I/O REGISTER) ADDRESS: 0x0F R-0 R/W-0 R/W-0 R/W-0 R-0 R/W-1 R/W-1 R/W-1 r PULLDIR GPIO2 PULLDIR GPIO1 PULLDIR GPIO0 r PULLEN GPIO2 PULLEN GPIO1 PULLEN GPIO0 bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7 Reserved: Maintain as ‘0’ bit 6 PULLDIRGPIO2: Pull Direction on GPIO 2 bit These bits control the 75 kOhm weak-pull circuit direction on GPIO 2 pin. 1 = Pull-up 0 = Pull-down bit 5 PULLDIRGPIO1: Pull Direction on GPIO 1 bit These bits control the 75 kOhm weak-pull circuit direction on GPIO 1 pin. 1 = Pull-up 0 = Pull-down bit 4 PULLDIRGPIO0: Pull Direction on GPIO 0 bit These bits control the 75 kOhm weak-pull circuit direction on GPIO 0 pin. 1 = Pull-up 0 = Pull-down bit 3 Reserved: Maintain as ‘0’ bit 2 PULLENGPIO2: Pull enable on GPIO 2 bit This bit enables the weak-pull circuit in GPIO 2 pin. Note that when pin is configured to output, weak-pull circuit is automatically disabled. 1 = Pull enabled 0 = Pull disabled bit 1 PULLENGPIO1: Pull enable on GPIO 1 bit This bit enables the weak-pull circuit in GPIO 1 pin. Note that when pin is configured to output, weak-pull circuit is automatically disabled. 1 = Pull enabled 0 = Pull disabled bit 0 PULLENGPIO0: Pull enable on GPIO 0 bit This bit enables the weak-pull circuit in GPIO 0 pin. Note that when pin is configured to output, weak-pull circuit is automatically disabled. 1 = Pull enabled 0 = Pull disabled 2015 Microchip Technology Inc. Preliminary DS70005023C-page 31 MRF24XA REGISTER 2-15: MACCON1 (MAC CONTROL 1 REGISTER) ADDRESS: 0x10 R/W-00 R/W-001 R/W-1 R/W-0 R/W-0 TRXMODE<1:0> ADDRSZ<2:0> CRCSZ FRMFMT SECFLAGOVR bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-6 TRXMODE<1:0>: TX/RX Mode Select Field bits 11 = Reserved 10 = TX-Streaming mode. In this mode, use both buffers for packet transmission. When issuing TRXMODE = 10, RXEN is cleared. SPI addresses 0x200 to 0x27F access Buffer 1 or Buffer 2 in alternation. Access to 0x37F through 0x383 has non-defined effect. 01 = RX-Streaming mode. In this mode, use both buffers for packet reception. When issuing TRX MODE = 01, TXST and TXENC/RXDEC bits are cleared and RXEN is set. SPI addresses 0x300 to 0x383 access Buffer 1 or Buffer 2 in alternation. In this mode, Proprietary mode packets other than streaming type are automatically discarded. Access to 0x200 through 0x283 has nondefined effect. 00 = Packet mode. In this mode, Buffer 1 is used as a Transmit while Buffer 2 as a Receive packet buffer. SPI addresses from 0x200 to 0x27F access Buffer 1. SPI addresses 0x300 to 0x383 access Buffer 2. TRXMODE = 00 is mandatory when FRMFMT = 0. bit 5-3 ADDRSZ<2:0>: Source/Destination Address Size Field bits(1, 2) The size of the Source and Destination addresses for Proprietary packet. Note that this field has no effect on the processing IEEE 802.15.4 frames. 111 110 101 100 011 010 001 000 bit 2 = 8 octets = 7 octets = 6 octets = 5 octets = 4 octets = 3 octets = 2 octets = 1 octet CRCSZ: CRC Size bit This bit indicates the size of the CRC field in each packet 1 = 2 octets 0 = 0 octet FRMFMT: MAC Frame Format bit adopted by the network(3) bit 1 This bit determines the frame format used in the network. 1 = Proprietary 0 = IEEE 802.15.4 standard compliant. Note 1: 2: 3: Zero-length address occurs when the corresponding DAddrPrsnt/SAddrPrsnt bits of the packet Frame Control field are set to ‘0’. Use ADDRSZ field while receiving and transmitting, and must not be modified while RXEN or TXST is set. Use FRMFMT field while receiving and transmitting, and must not be modified while RXEN or TXST is set. In Debug mode, use this register bit to determine the frame format for both TX/RX frame in the packet buffers. DS70005023C-page 32 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-15: bit 0 MACCON1 (MAC CONTROL 1 REGISTER) (CONTINUED) ADDRESS: 0x10 SECFLAGOVR: Security Flag Override bit The user can override security flags used in the CCM-CTR, CBC-MAC and CCM operation, otherwise the device uses the standard (2003/2006) definition. Note 1: 2: 3: Zero-length address occurs when the corresponding DAddrPrsnt/SAddrPrsnt bits of the packet Frame Control field are set to ‘0’. Use ADDRSZ field while receiving and transmitting, and must not be modified while RXEN or TXST is set. Use FRMFMT field while receiving and transmitting, and must not be modified while RXEN or TXST is set. In Debug mode, use this register bit to determine the frame format for both TX/RX frame in the packet buffers. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 33 MRF24XA REGISTER 2-16: MACCON2 (MAC CONTROL 2 REGISTER) ADDRESS: 0x11 R/W-0000 R/W/HS-0000 CHANNEL<3:0> SECSUITE<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-4 CHANNEL<3:0>: TX/RX operating channel bits These register bits are used as the current operating channel for TX/RX operation(1). 0x0 = Channel 11 0x1 = Channel 12 • • • 0xF = Channel 26 bit 3-0 Note 1: 2: SECSUITE<3:0>: Security suite bits(2) 1111 = AES-CBC-MAC-32 (Authentication with a 32-bit MAC, but no Encryption/Decryption) 1110 = AES-CBC-MAC-64 (Authentication with a 64-bit MAC, but no Encryption/Decryption) 1101 = AES-CBC-MAC-128 (Authentication with a 128-bit MAC, but no Encryption/Decryption) 1100 = Reserved 1011 = Reserved 1010 = Reserved 1001 = AES-CTR (Encryption/Decryption, but no Authentication) 1000 = AES-ECB (Encryption only) 0111 = AES-ENC-MIC-128 (Authentication with a 128-bit MAC and Encryption/Decryption) 0110 = AES-ENC-MIC-64 (Authentication with a 64-bit MAC and Encryption/Decryption) 0101 = AES-ENC-MIC-32 (Authentication with a 32-bit MAC and Encryption/Decryption) 0100 = AES-ENC (Encryption/Decryption, but no Authentication) 0011 = AES-MIC-128 (Authentication with a 128-bit MAC, but no Encryption/Decryption) 0010 = AES-MIC-64 (Authentication with a 64-bit MAC, but no Encryption/Decryption) 0001 = AES-MIC-32 (Authentication with a 32-bit MAC, but no Encryption/Decryption) 0000 = No security services enabled, or security is handled by upper protocol layers; ignore the setting of the SecEn bit (if value is ‘0’) Use this field while receiving and transmitting, and must not be modified while RXEN or TXST is set. In 15.4-2006 Standard mode MAC layer security processing, the Register field is automatically set based on the SecLvl bits of the AuxSecHdr Control field. DS70005023C-page 34 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-17: TXCON (TRANSMIT CONTROL REGISTER) ADDRESS: 0x12 R/W/HC-0 R/W-0 R/W/HC-0 R/HS/HC-1 R/W-1 R/W-011 TXST DTSM TXENC TXBUFEMPTY CSMAEN DR<2:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 x = Bit is unknown TXST: Transmit Start bit 1 = Starts the transmission of the next TX packet(1, 2) 0 = Termination of current TX operation, which may result in the transmission of an incomplete packet Hardware Clear: • Once the packet is successfully transmitted (including all attempted retransmissions, if any), the hardware clears this bit and sets the TXIF and IDLEIF. • If the packet transmission fails due to a CSMA failure, this bit is cleared, and TXCSMAIF is set. • If Acknowledge is requested (AckReq bit field in the transmitted frame is set) and not received after the configured number of retransmissions (TXRETMCNT), then TXST bit is cleared, and TXACKIF is set. • In TX-Streaming mode (TRXMODE), TXST is set even when it is already set, resulting in a posted start. When the current TX operation completes, the posted start immediately starts afterward. Clearing of the TXST bit clears both the current and the posted (pending) TX starts. TXOVFIF is set when TXST = 1, a posted start is present and a Host Controller write to the packet buffer occurs. Outside of TX-Streaming mode, writes to TXST when TXST is already set is ignored. Clearing this bit aborts the current operation in these cases: • • • • When transmitting a packet in Packet mode or in TX-Streaming mode When waiting for an ACK packet after a transmission During the CSMA CA algorithm When transmitting a repeated frame This field is read at any time to determine if TX operation is in progress. DTSM: Do Not Touch Security Materials bit(2) 1 = Device does not change the security material configured by the host MCU 0 = Device tries to configure the security material related registers bit 6 MCU must fill the following registers: SECNONCE, SECHDRINDX, SECPAYINDX and SECENDINDX. bit 5 TXENC: TX Encryption Setting this bit starts the TX security processing (authentication or encryption, or both) of the packet in the buffer it was last written. TXENC is cleared and TXENCIF is set when the processing is complete. TXENC must be issued when NWK layer security needs to be processed. 802.15.4-2003/2006 MAC layer security operation is automatically performed when TXST bit is set. Note that this field must not be modified while TXST is set. Note 1: 2: Transmission may include automatic security processing, CRC appending, CSMA-CA channel access, Acknowledge reception and retransmissions depending on the register Configuration and the Frame Control field of the frame to be transmitted. DTSM has no relevance in reception as the host can always reconfigure the security material before setting RXDEC. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 35 MRF24XA REGISTER 2-17: bit 4 TXCON (TRANSMIT CONTROL REGISTER) (CONTINUED) ADDRESS: 0x12 TXBUFEMPTY: TX Buffer Empty bit TXBUFEMPTY = 1 indicates that the Host MCU can safely start writing a new frame to the buffer without overwriting any content that is in use. Writing a single byte to the buffer clears this bit. TXBUFEMPTY = 0 does not prevent the host from writing further bytes to the buffer. TXBUFEMPTY is set by the device when transmission is complete. 1 = MCU can safely start writing a new frame to the buffer 0 = Buffer is full, or being written to When TRXMODE = 00: Packet mode is configured then TXBUFEMPTY is set at the same time as TXST is cleared and an interrupt is generated. Therefore, this bit provides no extra information. When TRXMODE = 10: TX-Streaming mode is configured then TXBUFEMPTY is set at the same time as one of the buffers becomes free, while TXST may be set. Therefore, the host MCU uses TXBUFEMPTY to ensure that the next frame starts loading to the buffers, without overwriting a packet being sent (TXOVFIF). bit 3 CSMAEN: CSMA-CA Enable bit This bit enables CSMA-CA algorithm before transmission. 1 = CSMA-CA enabled 0 = CSMA-CA disabled bit 2-0 DR<2:0>: Transmit Data Rate Field bits 111 = Reserved 110 = 2 Mbps 101 = 1 Mbps 100 = 500 kbps 011 = 250 kbps 010 = 125 kbps 001 = Reserved 000 = Reserved When transmitting an Auto-ACK frame with Adaptive Data Rate in response to a received frame, the AckDataRate field in the received frame automatically determines the data rate of the PHY, and not by this Register field. In all other cases, use this Register field as the current PHY data rate when transmitting. The PHY automatically determines the data rate for all received frames regardless of this Register field and the Adaptive Data Rate Configuration. For more information, refer to Register 2-43. Note 1: 2: Transmission may include automatic security processing, CRC appending, CSMA-CA channel access, Acknowledge reception and retransmissions depending on the register Configuration and the Frame Control field of the frame to be transmitted. DTSM has no relevance in reception as the host can always reconfigure the security material before setting RXDEC. DS70005023C-page 36 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-18: R/W-0 RXACKWAIT (RX ACKNOWLEDGE WAIT REGISTER) R/W-1 R/W/HC-1 R/W-0 R/W-0 ADDRESS: 0x13 R/W-0 R/W-0 R/W-0 RXACKWAIT<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear bit 7-0 x = Bit is unknown RXACKWAIT<7:0>: Auto Acknowledge Wait Field bits This field indicates the number of Base time units that the device must Wait after receiving a packet with AckReq = 1, before transmitting the corresponding ACK packet. This field is only used when AUTOACKEN = 1. For more information on Base time units, see Section 4.1 “MAC Architecture”. REGISTER 2-19: RETXCOUNT (RETRANSMISSION COUNT REGISTER) ADDRESS: 0x14 R/W-0011 R-0000 RETXMCNT<3:0> RETXCCNT<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-4 RETXMCNT<3:0>: Retransmission Max Count Field bits(1, 2) The maximum number of retries allowed after a transmission failure. 1111 = 15 retries • • • 0001 = 1 retry 0000 = Transmitter does not Wait for ACK bit 3-0 RETXCCNT<3:0>: Retransmission Current Count Field bits This read-only field indicates the current retransmit attempt number. When RETXCCNT<3:0> = RETXMCNT<3:0> and the TX attempt fails, the transmission is aborted, generating TXACKIF interrupt. Note 1: Use this field during transmission, and must be unmodified while TXST is set. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 37 MRF24XA REGISTER 2-20: RXCON1 (MAC RECEIVE CONTROL 1 REGISTER) ADDRESS: 0x15 R/W/HC/HS-0 R/W-0 R/W/HC-0 R/W-0 R/W-0 RXEN NOPA RXDEC RSVLQIEN RSVRSSIEN R/W-0 R/W-0 R-0 RSVCHDREN RSVCFOEN r bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set x = Bit is unknown bit 7 RXEN: Receive Enable Field bit This bit enables/disables the packet reception. If an RX packet is currently being received, clearing this bit causes that packet to be discarded. 1 = RX enabled 0 = RX disabled Hardware clear/set when: • Cleared when TRXMODE is set to TX-Streaming mode • Set when TRXMODE is set to RX-Streaming mode Clearing this bit aborts the current operation in the following cases: • Receiving a packet in Packet mode or in RX-Streaming mode Changes to most RX related settings must be only done when this bit is cleared. Note that the clear channel assessment (CSMAEN) and ACK-frame reception does not require RXEN = 1, as the device turns the radio into RX when needed, irrespective of the status of the RXEN bit. bit 6 NOPA: No Parsing bit This bit disables packet parsing. Only CRC is checked, if it is enabled. This feature is useful in Sniffer mode. 1 = Disable packet parsing 0 = Enable packet parsing bit 5 RXDEC: RX Decryption bit Setting this bit starts the RX security processing (authentication or decryption, or both) on the last received packet. 1 = RX security processing started/in process. RXDECIF or RXTAGIF is set. 0 = RX security processing inactive or complete This bit clears itself after RX decryption is completed. bit 4 RSVLQIEN: Receive Status Vector LQI Enable bit If bit is set, the measured Link Quality is appended after the received frame in the packet buffer. 1 = Append LQI field 0 = Do not append LQI field bit 3 RSVRSSIEN: Receive Status Vector RSSI Enable bit If bit is set, the measured RSSI is appended after the received frame in the packet buffer. 1 = Append RSSI field 0 = Do not append RSSI field bit 2 RSVCHDREN: Receive Status Vector Channel/MAC Type/Data Rate Enable bit If bit is set, Channel, MAC type and Data Rate Configurations used with the received frame are appended after the received frame in the packet buffer, using the encoding specified for CH<3:0>, FRMFMT and DR<2:0> (concatenated in this order when most significant bit (MSb) is first). 1 = Append Channel, MAC type and Data Rate fields 0 = Do not append Channel, MAC type and Data Rate fields DS70005023C-page 38 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-20: RXCON1 (MAC RECEIVE CONTROL 1 REGISTER) (CONTINUED) ADDRESS: 0x15 bit 1 RSVCFOEN: Receive Status Vector CFO Enable bit If bit is set, the estimated Carrier Frequency Offset of the received frame is appended after the received frame in the packet buffer, using the same encoding as CFOMEAS register. 1 = Append CFO estimation 0 = Do not append estimated CFO bit 0 Reserved: Maintain as ‘0’ REGISTER 2-21: RXCON2 (MAC RECEIVE CONTROL 2 REGISTER) ADDRESS: 0x16 R/C/HS-0 R/W-0 R-0 RXBUFFUL IDENTREJ ACKRXFP R/W-0 R/W-0 R/W-0 R/W-0 ACKTXFP AUTORPTEN AUTOACKEN ADPTCHEN R/W-0 ADPTDREN bit 7 bit 0 Legend: R = Readable bit -n = Value at POR W = Writable bit U = Unimplemented bit, read as ‘0’ ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 RXBUFFUL: RX Buffer Full bit Host MCU clears this bit to indicate that the RX packet is processed. If this bit is uncleared before the next valid RX packet is detected (packet is not a duplicate, pass RX filter, and so on), then the device sets RXOVFIF and the buffer content is unmodified, where RXBUFFUL = 1 locks write access by a new frame. Moreover, the host can both read and write to the buffer or perform security processing. In TRXMODE = 00 (PACKET) mode: 1 = Receive buffer content is yet to be read by the host or processed, and cannot be overwritten by a new frame 0 = Receive buffer is free for receiving a new frame In TRXMODE = 01 (RX-STREAMING) mode: 1 = Current buffer being read from the bus contains a valid RX Packet 0 = Current buffer being read from the bus is empty bit 6 IDENTREJ: Reject Identical Packet bit Setting this bit enables the user to reject an incoming packet, in case its source address and sequence number is the same as the previously received packet. This bit is used whenever a packet is received and ACK is transmitted, but the ACK is never received that the sender resends the TX packet. When this happens, triggers for RXIF is avoided for the second time for the same packet, thus, the second packet is ignored. This bit is also used when a packet is repeated and the next repeater repeats the same packet back. This packet is received, but ignored. 1 = Any packet received with the same source address and sequence number as the last packet successfully received is discarded and RXIDNTIF is thrown 0 = Duplicated packets are processed further same as non-duplicated packets Note 1: 2: Use ADPTCHEN field while receiving and transmitting a packet, and must be unmodified while RXEN or TXST is set. Use ADPTDREN field while receiving and transmitting a packet, and must be unmodified while RXEN or TXST is set. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 39 MRF24XA REGISTER 2-21: RXCON2 (MAC RECEIVE CONTROL 2 REGISTER) (CONTINUED) ADDRESS: 0x16 bit 5 ACKRXFP: ACK RX Frame Pending bit This read-only Status bit reflects the value of the FrameCtrl (FramePend) bit in the last received 802.15.4 compatible ACK frame. bit 4 ACKTXFP: ACK TX Frame Pending bit The value of this bit is transmitted in the FrameCtrl (FramePend) bit slot when the MAC sends out an ACK packet in 802.15.4 Compatibility mode. bit 3 AUTORPTEN: Auto-Repeat Enable bit If this bit is set, the MAC automatically transmits a packet whenever a packet is received, and its Repeat bit is set. 1 = Auto-Repeat feature is enabled 0 = Auto-Repeat feature is disabled bit 2 AUTOACKEN: Auto-Acknowledge Enable bit If this bit is set, then the device automatically transmits an ACK packet whenever a packet is received, and its AckReq bit is set. 1 = Automatic Acknowledge processing enabled 0 = Automatic Acknowledge processing disabled ADPTCHEN: Adaptive Channel Enable bit(1) bit 1 Setting this bit enables the MAC in Proprietary mode to set the transmitting channel for the ACK packet based on the AckInfo field (Proprietary packet) of the received packet, rather than the CH<3:0> register bits. 1 = Adaptive Channel feature is enabled 0 = Adaptive Channel feature is disabled This feature is also known as Channel Agility. For more information, see Section 7.1 “Channel Agility”. ADPTDREN: Adaptive Data Rate Enable bit(2) bit 0 Setting this bit enables the MAC in Proprietary mode to set the transmission data rate for the ACK packet based on the AckInfo field (Proprietary packet) of the received packet, rather than the DR<2:0> register bits. 1 = Adaptive Data Rate feature is enabled 0 = Adaptive Data Rate feature is disabled This feature is also known as Channel Agility. For more information, see Section 7.1 “Channel Agility”. Note 1: 2: Use ADPTCHEN field while receiving and transmitting a packet, and must be unmodified while RXEN or TXST is set. Use ADPTDREN field while receiving and transmitting a packet, and must be unmodified while RXEN or TXST is set. DS70005023C-page 40 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-22: TXACKTO (TX ACKNOWLEDGE TIME-OUT REGISTER) ADDRESS: 0x17 R/W-10000000 TXACKTO<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-0 TXACKTO<7:0>: TX Acknowledge Time-Out Field bits(1) The maximum time in Base time units that the device must Wait for receiving an ACK packet. 0x00 = Wait 1 Base time unit before retransmitting, implying that the device continually retransmits RETXMCNT<3:0> times. For more information on Base time units, see Section 4.1 “MAC Architecture”. 0x01 = Wait 1 Base time unit before retransmitting • • • 0x7F = Wait 127 Base time units before retransmitting Note 1: Use TXACKTO field during transmission, and it must be unmodified while TXST is set. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 41 MRF24XA REGISTER 2-23: RXFILTER (RX FILTER REGISTER) ADDRESS: 0x18 R/W-0 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 PANCRDN CRCREJ CMDREJ DATAREJ UNIREJ NOTMEREJ BCREJ NSTDREJ bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7 PANCRDN: PAN Coordinator bit Setting this bit enables the node to accept DAMode = 00 type packets if it is a CMD or DATA frame. 1 = Disable rejection 0 = Reject all DATA and CMD packets when DAMode = 00 CRCREJ: CRC Error Reject Enable bit(1) bit 6 Setting this bit enables the user to reject all packets that contains an invalid CRC, provided that it is present (CRCSZ = 1). Clearing this bit enables the user to accept all packets that contains an invalid CRC, provided that it is present (CRCSZ = 1), skipping any further filtering. When CRC is not present then this bit has no effect (CRCSZ = 0). 1 = Reject all packets having an invalid CRC 0 = Accept all packets having an invalid CRC without further filtering bit 5 CMDREJ: Command Frame Reject Enable bit Setting this bit enables the user to reject all packets with FrameCtrl (Type) equal to Command. 1 = Reject all Command packets 0 = Disable Command Frame Rejection bit 4 DATAREJ: Data Frame Reject Enable bit Setting this bit enables the user to reject all packets with FrameCtrl (Type) equal to Data. 1 = Reject all Data packets 0 = Disable Data Frame Rejection UNIREJ: Unicast Reject Enable bit(2) bit 3 Setting this bit enables the user to reject all unicast packets as in: 802.15.4 Mode: PAN Identifier matches with the PANID<15:0> or 0xFFFF, and Destination Address matches the address in the ADDR<63:0> or SHADDR<15:0> register, which the DAMode selects. Proprietary Mode: Destination Address matches the address in ADDR<ADDRSZ<2:0>*8-1:0> register, provided that DAddrPrsnt Frame Control field is set(1). 1 = Reject all Unicast packets addressed to this node 0 = Disable Unicast Rejection Note 1: 2: 3: 4: In Proprietary mode (FRMFMT = 1), when CRCREJ = 1 is used to reject unicast frames not addressed to this node. NOTMEREJ = 1 does not reject these frames. UNIREJ does not affect the frames using implied destination addressing in 802.15.4 mode and inferred destination addressing in Proprietary mode. NOTMEREJ does not affect the frames using implied destination addressing in 802.15.4 mode and inferred destination addressing in Proprietary mode. NSTDREJ does not affect the Proprietary frames in Proprietary mode. DS70005023C-page 42 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-23: RXFILTER (RX FILTER REGISTER) (CONTINUED) ADDRESS: 0x18 NOTMEREJ: Not Me Unicast Reject Enable bit(3) bit 2 Setting this bit enables the user to reject all unicast packets as in: 802.15.4 Mode: Destination PAN Identifier does not match PANID<15:0> and is not 0xFFFF (broadcast) or Destination Address does not match the address in the ADDR<63:0> register or the SHADDR<15:0> register, which the DAMode selects. Proprietary Mode: Destination Address matches the address in ADDR<ADDRSZ<2:0>*8-1:0> register, provided that DAddrPrsnt Frame Control field is set(1). 1 = Reject all Unicast packets NOT addressed to this node 0 = Disable Not Me Unicast Rejection Filtering bit 1 BCREJ: Broadcast Rejection bit 802.15.4 Mode: Setting this bit enables the user to reject all Broadcast packets of type Data or Command. A Data or Command packet is broadcast when Short Destination Addressing is used (DAMode = 10) and Short Address is equal 0xFFFF. Proprietary Mode: Setting this bit enables the user to reject all Broadcast packets of type Data or Command (or Streaming). A packet is broadcast when FrameCtrl[Broadcast] is set. 1 = Reject Broadcast Packets 0 = Disable Broadcast Rejection NSTDREJ: Non-Standard Frame Reject bit(4) bit 0 This bit enables the user to reject all 802.15.4 frames having 01 for the DAMode or SAMode fields or having the MSb (bit 2) in the Type field set (1) or having the MSb (bit 1) in the Frame Version field set to(1). 1 = Reject all Non-Standard 802.15.4 packets 0 = Disable Non-Standard Rejection Note 1: 2: 3: 4: In Proprietary mode (FRMFMT = 1), when CRCREJ = 1 is used to reject unicast frames not addressed to this node. NOTMEREJ = 1 does not reject these frames. UNIREJ does not affect the frames using implied destination addressing in 802.15.4 mode and inferred destination addressing in Proprietary mode. NOTMEREJ does not affect the frames using implied destination addressing in 802.15.4 mode and inferred destination addressing in Proprietary mode. NSTDREJ does not affect the Proprietary frames in Proprietary mode. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 43 MRF24XA REGISTER 2-24: TMRCON (TIMER CONTROL REGISTER) ADDRESS: 0x19 R/W-100 R/W-00010 BOMCNT<2:0> BASETM<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-5 BOMCNT<2:0>: CSMA-CA Back-off Maximum Count bits The maximum number of back-off attempts the CSMA-CA algorithm attempts before declaring a channel access failure. 111 = Reserved 110 = Reserved 101 = 5 attempts 100 = 4 attempts 011 = 3 attempts 010 = 2 attempts 001 = 1 attempts 000 = 0 attempt bit 4-0 BASETM<4:0>: Base Time Field bits The number of 1 µs clock cycles that a Base time unit represents in all register settings. For more information on Base time units, see Section 4.1 “MAC Architecture”. DS70005023C-page 44 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-25: CSMABE (CSMA-CA BACK-OFF EXPONENT CONTROL REGISTER) ADDRESS: 0x1A R/W-0101 R/W-0011 MAXBE<3:0> MINBE<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-4 MAXBE<3:0>: CSMA-CA Back-off Maximum Count Field bits The maximum value of the Back-off exponent (BE), in the CSMA-CA algorithm. The back-off time is (2BE-1) units. 1111 = Reserved • • • 1001 = Reserved 1000 28-1 = 255 maximum units of back-off time • • • 0000 20-1 = No back-off time bit 3-0 MINBE<3:0>: CSMA-CA Back-off Minimum Count bits The minimum value of the back-off exponent (BE), in the CSMA-CA algorithm. The back-off time is (2BE-1) units. 1111 = Reserved • • • 1001 = Reserved 1000 28-1 = 255 maximum units of back-off time • • • 0000 20-1 = No back-off time 2015 Microchip Technology Inc. Preliminary DS70005023C-page 45 MRF24XA REGISTER 2-26: BOUNIT (BACK-OFF TIME UNIT REGISTER) ADDRESS: 0x1B R/W-10100000 BOUNIT<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-0 BOUNIT<7:0>: CSMA-CA Back-off Period Unit Field bits The number of Base time units for the basic back-off time unit used by CSMA-CA algorithm. 11111111 = 256 Base time units • • • 00000000 = 1 Base time unit REGISTER 2-27: STRMTOH/STRMTOL (STREAM TIME-OUT REGISTER) ADDRESS: 0x1C – 0x1D R/W-11111111 STRMTO<15:8> bit 15 bit 8 R/W-11111111 STRMTO<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 15-0 STRMTO<15:0>: Stream Time-Out bits The STRMTO<15:0> bits indicate the maximum number of allowed Base time units between the end of one RX Stream packet and the successful reception of the next. If no RX Stream packet is successfully received within this time, STRMIF is set. DS70005023C-page 46 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-28: OFFTM (OFF-TIMER REGISTER) ADDRESS: 0x1E R/W-00000000 OFFTM<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-0 OFFTM<7:0>: OFF-Timer Field bits This value sets the minimum PLL OFF time in 1 µs resolution. Minimum OFF Time = OFFTM<7:0> * 32 If this register is set to 0xFF, PLL remains off. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 47 MRF24XA REGISTER 2-29: ADDR (ADDRESS REGISTER) ADDRESS: 0x1F – 0x26 R/W-00000000 ADDR<63:56> bit 63 bit 56 R/W-00000000 ADDR<55:48> bit 55 bit 48 R/W-00000000 ADDR<47:40> bit 47 bit 40 R/W-00000000 ADDR<39:32> bit 39 bit 32 R/W-00000000 ADDR<31:24> bit 31 bit 24 R/W-00000000 ADDR<23:16> bit 23 bit 16 R/W-00000000 ADDR<15:8> bit 15 bit 8 R/W-00000000 ADDR<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 63-0 ADDR<63:0>: Long Address Field bits Current device’s long address (LSB stored). For Proprietary frames, the number of address bytes is defined in ADDRSZ<2:0>. For addresses less than 8 octets, use the least significant bits of this register. DS70005023C-page 48 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-30: SHADDRH/SHADDRL (SHORT ADDRESS REGISTER) ADDRESS: 0x27 – 0x28 R/W-00000000 SHADDR<15:8> bit 15 bit 8 R/W-00000000 SHADDR<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 15-0 SHADDR<15:0>: Short Address Field bits Current device’s short address (LSB stored). Only used in 802.15.4 mode. REGISTER 2-31: PANIDH/PANIDL (PAN IDENTIFIER REGISTER) ADDRESS: 0x29 – 0x2A R/W-00000000 PANID<15:8> bit 15 bit 8 R/W-00000000 PANID<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 15-0 PANID<15:0>: PAN Identifier Field bits Current device’s PAN Identifier (LSB stored). Only used in 802.15.4 mode. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 49 MRF24XA REGISTER 2-32: SECHDRINDX (SECURITY HEADER INDEX REGISTER) R-0 R/W/HS-0000000 r SECHDRINDX<6:0> ADDRESS: 0x2B bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HS = Hardware Set bit 7 Reserved: Maintain as ‘0’ bit 6-0 SECHDRINDX<6:0>: Security Header Index Field bits x = Bit is unknown This field defines the portion of the header which performs the authentication operations. For MAC layer security, SECHDRINDX<6:0> is defined as the address offset of the MAC header from the beginning of the frame, as stored in the buffer (0 = Length field, 1 = FrameCtrl field, and so on), and is automatically loaded for both 802.15.4 and Proprietary frames(1). For Network layer security, SECHDRINDX<6:0> is defined as the address offset of the Network Header from the beginning of the frame and the Host Controller loads it only for 802.15.4 frames. Note that for Proprietary frames, the MAC automatically loads it. Note 1: Setting the DTSM bit disables the automatic computation of this field in TX mode. REGISTER 2-33: SECPAYINDX (SECURITY PAYLOAD INDEX REGISTER) R-0 R/W/HS-0000000 r SECPAYINDX<6:0> ADDRESS: 0x2C bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HS = Hardware Set bit 7 Reserved: Maintain as ‘0’ bit 6-0 SECPAYINDX<6:0>: Security Payload Index Field bits x = Bit is unknown This field defines the portion of the payload, which the encryption/decryption operations are performed. For MAC layer security, SECPAYINDX<6:0> is defined as the address offset of the MAC payload from the beginning of the frame, as stored in the buffer (0 = Length field, 1 = FrameCtrl field, and so on), and is automatically loaded for both 802.15.4 and Proprietary frames(1). For Network layer security, SECPAYINDX<6:0> is defined as the address offset of the payload from the beginning of the frame and the Host Controller loads it only for 802.15.4 frames. Note that for Proprietary frames, the MAC automatically loads it. Note 1: Setting the DTSM bit disables the automatic computation of this field in TX mode. DS70005023C-page 50 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-34: SECENDINDX (SECURITY END INDEX REGISTER) R-00 R/W/HS-0000000 r SECENDINDX<6:0> ADDRESS: 0x2D bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HS = Hardware Set bit 7 Reserved: Maintain as ‘0’ bit 6-0 SECENDINDX<6:0>: Security End Index Field bits(1) x = Bit is unknown This field defines the end of the payload, which the security operations are performed. Note 1: Setting the DTSM bit disables the automatic computation of this field in TX mode. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 51 MRF24XA REGISTER 2-35: MACDEBUG (MAC DEBUG CONTROL REGISTER) R/W/HC-0 R/W/HC-0 R/W-0 R/W-0 R/HS/HC-0 R/HS/HC-0 BUF1TXPP BUF2TXPP BUF1RXPP BUF2RXPP TXRDBUF RXWRBUF ADDRESS: 0x2E R/HS/HC-0 R/HS/HC-0 BUSRDBUF BUSWRBUF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 x = Bit is unknown BUF1TXPP: Buffer 1 TX Process Packet bit Setting this bit performs all of the processing (CRC generation and security) on BUF1 that is normally done before transmitting a packet, but without actually transmitting the packet. bit 6 BUF2TXPP: Buffer 2 TX Process Packet bit Setting this bit performs all of the processing (CRC generation and security) on BUF2 that is normally done before transmitting a packet, but without actually transmitting the packet. bit 5 BUF1RXPP: Buffer 1 RX Process Packet bit Setting this bit performs all of the processing (CRC checking and security) on BUF1 that is normally done when receiving a packet, but without actually receiving the packet. This bit must be asserted while downloading security materials and so on during debug. bit 4 BUF2RXPP: Buffer 2 RX Process Packet bit Setting this bit performs all of the processing (CRC checking and security) on BUF2 that is normally done when receiving a packet, but without actually receiving the packet. This bit must be asserted while downloading security materials and so on, during debug. bit 3 TXRDBUF: TX Read Buffer Flag bit Indicates the physical buffer number (0 = BUF1, 1 = BUF2) that the TX hardware is reading. bit 2 RXWRBUF: RX Write Buffer Flag bit Indicates the physical buffer number (0 = BUF1, 1 = BUF2) that the RX hardware is writing to. bit 1 BUSRDBUF: Bus Read Buffer Flag bit Indicates the physical buffer number (0 = BUF1, 1 = BUF2) that the SFR bus is reading. This bit is only used in RX-Streaming mode. bit 0 BUSWRBUF: Bus Write Buffer Flag bit Indicates the physical buffer number (0 = BUF1, 1 = BUF2) that the SFR bus is writing to. This bit is only used in TX-Streaming mode. DS70005023C-page 52 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-36: CCACON1 (CCA CONTROL 1 REGISTER) R/HS/HC-0 R/W/HC-0 R/W-001100 CCABUSY CCAST RSSITHR<5:0> ADDRESS: 0x2F bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 x = Bit is unknown CCABUSY: Clear Channel Assessment Busy Flag bit This bit represents the result of the latest CCA measurement. 1 = Medium is busy 0 = Medium is silent CCAST: Clear Channel Assessment Start bit(1) bit 6 Setting this register bit triggers MCU to start a new CCA measurement. The hardware clears this bit when the CCA measurement is done (EDCCAIF is set) and CCABUSY is valid. RSSITHR<5:0>: RSSI Threshold bits(2) bit 5-0 This threshold is used in CCA operation when Energy detect or Energy and Carrier Sense mode is selected. Representation: resolution of 2 dB/LSB, RSSITHR = 0x10 represents ca. -75 dBm noise level. Note that this threshold may be different with other matching network or antenna. Note 1: 2: RX chain must be turned on (RXEN = 1) to perform this measurement. Packet reception is not disabled during the measurement, main purpose is testing. In the corresponding CCA modes the radio measures EDMEAN<7:0>. If EDMEAN<7:2> is greater than RSSITHR<5:0>, CCABUSY is set. Example: To set the RSSI threshold where the chip measures 0x30 EDMEAN, RSSITHR<5:0> must be 0x0C. REGISTER 2-37: CCACON2 (CCA CONTROL 2 REGISTER) ADDRESS: 0x30 R-0 R/W-01 R/W-01 CSTHR<3:0> CCALEN<1:0> CCAMODE<1:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-4 CSTHR<3:0>: Carrier Sense Threshold Field bits. This threshold is used in CCA operation when Carrier Sense mode is selected. bit 3-2 CCALEN<1:0>: Clear Channel Assessment Length bits(1) Value N indicates duration of 2^N * 32 µs. CCAMODE<1:0>: Clear Channel Assessment Mode Field bits(2) 11 = CCA Mode 3/a in the IEEE 802.15.4 standard: Energy AND Carrier Sense Threshold 10 = CCA Mode 2 in the IEEE 802.15.4 standard: Carrier Sense Threshold 01 = CCA Mode 1 in the IEEE 802.15.4 standard: Energy Detect Threshold (default) 00 = CCA Mode 3/b in the IEEE 802.15.4 standard: Energy OR Carrier Sense Threshold bit 1-0 Note 1: 2: The IEEE 802.15.4 standard requires 128 µs, but shorter length is recommended when using higher rates with optimized Preamble mode (RATECON.OPTIMAL = 1). The measured RSSI result is stored in EDMEAN<7:0> register in all modes except Mode 2. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 53 MRF24XA REGISTER 2-38: EDCON (ENERGY DETECT CONTROL REGISTER)(1)) ADDRESS: 0x31 R-00 R/W-0 R/W/HC-0 R/W-1110 r EDMODE EDST EDLEN<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear x = Bit is unknown bit 7-6 Reserved: Maintain as ‘0’ bit 5 EDMODE: Energy Detect Mode Select bit 1 = Energy Detect Sampling Mode. ED duration is 128 µs. A single atomic RSSI-peak measurement is accomplished. The result is stored in EDPEAK<7:0> register. 0 = Energy Detect Scan Mode. EDLEN<3:0> sets the ED duration. The result is stored in EDMEAN<7:0> register. bit 4 EDST: Energy Detect Measurement Start bit Setting this register bit trigers MCU to start a new ED measurement. The hardware clears this bit when the ED measurement is done (EDCCAIF is unchanged) and values in EDMEAN<7:0> and EDPEAK<7:0> are valid. If the ED measurement is aborted (RX state changes, or the MCU clears the EDST bit), then EDCCAIF is unchanged. EDLEN<3:0>: Energy Detect Measurement Length Field bits(2) bit 3-0 Value M indicates a sequence of (M + 1) * 8 atomic RSSI-peak measurements, each having the duration of 128 µs. At the end of the aggregate measurement, the mean and the peak value of the sequence are available in EDMEAN<7:0> and EDPEAK<7:0>. Note 1: 2: The RX chain must be turned on (RXEN = 1) to perform this measurement. Packet reception is disabled during the measurement. When EDLEN<3:0> = M = 0xE, the 128 μs atomic measurements are preformed 120 times, which is equal to the a BaseSuperFrameDuration parameter in the IEEE 802.15.4 standard. REGISTER 2-39: EDMEAN (ENERGY DETECT MEAN INDICATION REGISTER) ADDRESS: 0x32 R/HS/HC-00000000 EDMEAN<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7-0 x = Bit is unknown EDMEAN<7:0>: Energy Detect Mean Indication Field bits Measured mean signal strength during ED/CCA measurement. DS70005023C-page 54 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-40: EDPEAK (ENERGY DETECT PEAK INDICATION REGISTER) ADDRESS: 0x33 R/HS/HC-00000000 EDPEAK<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7-0 x = Bit is unknown EDPEAK<7:0>: Energy Detect Peak Indication Field bits Measured peak signal strength during ED measurement. Computation: The gain-compensated RSSI value is averaged over intervals of 128 μs. The peak value obtained from a sequence of such measurements is stored in EDPEAK when EDMODE = 1. REGISTER 2-41: CFOCON (CFO PRE COMPENSATION REGISTER) ADDRESS: 0x34 R/W-0000 R/W-0000 CFOTX<3:0> CFORX<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-4 CFOTX<3:0>: TX Carrier Frequency Offset Field bits The host writes this value to compensate for the Carrier Frequency Offset of the node during transmission. Pre-compensation allows using crystals with wider tolerances. Frequency Offset Unit is: 13 ppm/LSB. Two’s complement encoding. bit 3-0 CFORX<3:0>: RX Carrier Frequency Offset Field bits The host writes this value to pre-compensate the Carrier Frequency Offset estimation window (±55 ppm). Frequency Offset Unit is: 13 ppm/LSB. Two’s complement encoding. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 55 MRF24XA REGISTER 2-42: CFOMEAS (CFO MEASUREMENT INDICATION REGISTER) ADDRESS: 0x35 R/W-00000000 CFOMEAS<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-0 CFOMEAS<7:0>: CFO Measurement Field bits If AFCOVR bit is cleared, then this register is written and valid when RXSFDIF is set with the value of the Carrier Frequency Offset that was estimated during the acquisition of the packet. The host may use this value together with the LQI as a preamble quality indication (LQI is measured over the CFO compensated payload). If AFCOVR bit is set, this receiver compensates the Carrier Frequency Offset. Note that in this case, the CFO estimation algorithm is disabled, thus ±13 ppm CFO is tolerated. CFORX has no effect when AFCOVR is set. Frequency Offset Unit is: ~1.62 ppm/LSB of the 2.4 GHz carrier. Two’s complement encoding is used. DS70005023C-page 56 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-43: RATECON (RATE CONFIGURATION REGISTER) ADDRESS: 0x36 R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-1 R/W-1 DIS2000 DIS1000 DIS500 DIS250 DISSTD DIS125 OPTIMAL PSAV bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7 DIS2000: Disable 2 Mbps Frame Reception bit If this bit is set, then reception of 2 Mbps frames is disabled. bit 6 DIS1000: Disable 1 Mbps Frame Reception bit If this bit is set, then reception of 1 Mbps frames is disabled. bit 5 DIS500: Disable 500 kbps Frame Reception bit If this bit is set, then reception of 500 kbps frames is disabled. bit 4 DIS250: Disable 250 kbps Frame Reception bit If this bit is set, then reception of 250 kbps frames with non-standard-compliant SFD patterns is disabled. bit 3 DISSTD: Disable IEEE 802.15.4 compliant Frame Reception bit If this bit is set, then reception of 250 kbps frames with IEEE 802.15.4 compliant SFD patterns is disabled. bit 2 DIS125: Disable 125 kbps Frame Reception bit If this bit is set, then reception of 125 kbps frames is disabled. bit 1 OPTIMAL: Optimized Preamble Selection bit When this bit is set, then optimized preamble is used instead of legacy. 1 = Optimized preamble 0 = Legacy preamble bit 0 PSAV: Power-Save Mode Selection bit If this bit is set, frame detection is dependent on the RSSI signal, and the receive signal processor is turned on when a sudden and significant increase (PSAVTHR<3:0>) is detected in the signal strength or the signal strength is above an absolute level (DESENSTHR<3:0>). 1 = Power-Save mode 0 = Hi-Sensitivity mode 2015 Microchip Technology Inc. Preliminary DS70005023C-page 57 MRF24XA REGISTER 2-44: POWSAVE (POWER-SAVE CONFIGURATION REGISTER) R/W-1010 R/W-1010 DESENSTHR<3:0> PSAVTHR<3:0> ADDRESS 0x37 bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-4 DESENSTHR<3:0>: Desensitization Threshold Field bits This field defines an absolute level on the RSSI signal to activate receive signal processor if PSAV = 1. Unit is 4 dB/LSB. Unsigned encoding is used. bit 3-0 PSAVTHR<3:0>: Frame Detection Threshold Register Field bits This field defines a relative (relative to the last 4 µs RSSI value) threshold level on the RSSI signal to activate receive signal processor, if PSAV = 1. Unit is 0.5 dB/LSB. Unsigned encoding is used. DS70005023C-page 58 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-45: BBCON (BASEBAND CONFIGURATION REGISTER) ADDRESS 0x38 R/W-0 R/W-0 R/W-11 R/W-0 R/W-001 RNDMOD AFCOVR RXGAIN<1:0> PRMBHOLD PRMBSZ<2:0> bit 7 Legend: bit 0 W = Writable bit -n = Value at POR R = Readable bit U = Unimplemented bit, read as ‘0’ ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 RNDMOD: Random modulation bit If this bit is set, the transmitter randomly transmits DSSS symbols or MSK chips if PRMBHOLD bit is set. The purpose of this register is only for testing. bit 6 AFCOVR: AFC override bit If this bit is set, the receiver uses CFOMEAS register as the CFO in reception. bit 5-4 RXGAIN<1:0>: Receiver Gain Register Field bits If this bit is set, the AGC operation is inhibited in the receiver and the receiver radio gain Configuration is selected between three different gain levels. Encoding: 11 = AGC operation is enabled (default value) 10 = High gain 01 = Middle gain 00 = Low gain This feature is used for testing and streaming purposes. To reduce the required interframe-gap, the RXGAIN must be set to one of the fixed gain options when the MAC is in Streaming mode. bit 3 PRMBHOLD: Preamble Hold Enable bit Effect: Appends extra bytes to the transmitted preamble in endless repetition until it is cleared. Details: The hardware checks this bit during transmission before finishing the preamble. The DR<2:0> and the register OPTIMAL determine the appropriate preamble byte and applies the modulation format. When this flag is released, the transmission of the current preamble byte is completed followed by transmitting the LENGTH field and the payload. 1 = Enable endless preamble repetition 0 = Disable/stop endless preamble repetition bit 2-0 PRMBSZ<2:0>: Preamble Size Adjustment Field bits Allows adjusting the transmitted preamble length when OPTIMAL = 1. Encoding: 500 kbps preamble length = (PRMBSZ<2> + 4) units, where unit = 16 μs (1 octet at 500 kbps) 1 Mbps preamble length = (PRMBSZ<1:0> + 8) units, where unit = 4 μs (1 octet at 2 Mbps) 2 Mbps preamble length = (PRMBSZ<1:0> + 8) units, where unit = 4 μs (1 octet at 2 Mbps) Legacy frames and 125/250 kbps optimized frames are not affected by this Register field. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 59 MRF24XA REGISTER 2-46: IFGAP (INTER FRAME CONFIGURATION REGISTER) ADDRESS 0x39 R-000 R/W-10111 r IFGAP<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-5 Reserved: Maintain as ‘0’ bit 4-0 IFGAP<4:0>: TX Interframe-Gap Field bits This field allows configuring a TX interframe-gap ranging from 0 to 30 μs. This duration is enforced as a minimum separation between the last sample of a transmitted frame and the start of the preamble for a potential subsequent frame transmission. Unit is 2 μs/LSB. REGISTER 2-47: TXPOW (TRANSMIT POWER CONFIGURATION REGISTER) R/W-000 R/W-11111 CHIPBOOST<2:0> TXPOW<4:0> ADDRESS 0x3A bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-5 CHIPBOOST<2:0>: TX Chip Boosting Field bits This field modifies the spectrum of the OQPSK transmission. bit 4-0 TXPOW<4:0>: TX Power Register Field bits This field allows configuring a TX power ranging from -19 to 1 dBm. Encoding: 11111 = +1 dBm • • • 00001 = -19 dBm 00000 = PA OFF DS70005023C-page 60 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-48: TX2IDLE (TRANSMIT POWER-DOWN TO IDLE CONFIGURATION REGISTER) ADDRESS 0x3B R-0 R/W-00011 r TX2IDLE<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-5 Reserved: Maintain as ‘0’ bit 4-0 TX2IDLE<4:0>: Transmit Power-Down to Idle Duration Field bits Defines the duration of the interval while PLL cannot be tuned (turned off or change channel) following that the transmitter and external PA (if PAE = 1) are turned down together. Representation: 1 μs/1 LSB. No offset. REGISTER 2-49: TX2TXMA (TRANSMIT POWER-UP TO MEDIUM ACCESS CONFIGURATION REGISTER) ADDRESS 0x3C R-0 R/W-00011 r TX2TXMA<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-5 Reserved: Maintain as ‘0’ bit 4-0 TX2TXMA<4:0>: Transmit Power-Up to Medium Access Configuration Field bits Defines the time interval between turning on the internal transmitter of the device and the start time of medium access (start of the PHY-layer frame). TX_TO_TXMA = The transient time of the transmitter, in the following scenarios: PAEN = 0 PAEN = 1, but the PA is turned on first. PA_TO_TXMA = TX_TO_TXMA + PA transient time. PAEN = 1, but the TX and PA transients are NOT sequenced. TX_TO_TXMA = The transient time of the transmitter + PA_TO_TXMA: PAEN = 1, and the transmitter is turned on first (transients are sequenced). Representation: 1 μs/1 LSB. No offset. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 61 MRF24XA REGISTER 2-50: EXTPA (EXTERNAL POWER AMPLIFIER CONFIGURATION REGISTER) ADDRESS 0x3D R-0 R/W-0 R/W-0 R/W-00100 r EXTPAP PAEN PA2TXMA<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7 Reserved: Maintain as ‘0’ bit 6 EXTPAP: External Power Amplifier Polarity bit 1 = 3.3V turns Power Amplifier ON 0 = GND turns Power Amplifier ON bit 5 PAEN: External Power Amplifier Enable bit This bit enables the PA pin to output the control signal for external Power Amplifier. bit 4-0 PA2TXMA<4:0>: External Power Amplifier Power-Up to Medium Access Configuration Field bits Defines the time interval between turning on the external PA of the device and the start time of medium access (start of the PHY-layer frame). PA_TO_TXMA = The transient time of the external PA, in the following scenarios: PAEN = 1, and the transmitter is turned on first. TX_TO_TXMA = PA_TO_TXMA + TX transient time. PAEN = 1, but the TX and PA transients are NOT sequenced. PA_TO_TXMA = The transient time of the PA + TX_TO_TXMA: PAEN = 1, and the external power amplifier is turned on first (transients are sequenced). Representation: 1 μs/1 LSB. No offset REGISTER 2-51: EXTLNA (EXTERNAL LOW-NOISE AMPLIFIER CONFIGURATION REGISTER) ADDRESS 0x3E R-0 R/W-0 R/W-0 R/W-00100 r EXTLNAP LNAEN LNADLY<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7 Reserved: Maintain as ‘0’ bit 6 EXTLNAP: External Low Noise Amplifier Polarity bit 1 = 3.3V turns Low-Noise Amplifier ON 0 = GND turns Low-Noise Amplifier ON bit 5 LNAEN: External Low-Noise Power Amplifier Enable bit This bit enables the LNA pin to output the control signal for external Low-Noise Amplifier. bit 4-0 LNADLY<4:0>: External Low-Noise Amplifier Power-Up Transient Delay Field bits Defines the duration between the LNA is turned on and the reception is valid. LNA and internal receiver are turned on together. The longer transient is awaited before input signal is accepted as valid. Representation: 1 μs/1 LSB. No offset. DS70005023C-page 62 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-52: BATMON (BATTERY MONITOR CONFIGURATION REGISTER) ADDRESS: 0x3F R-0 R/W-1 R/W-11111 r BATMONPD BATMON<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-6 Reserved: Maintain as ‘0’ bit 5 BATMONPD: Battery Monitor Power-Down bit If battery monitor is working and battery voltage drops below the threshold by BATMON<4:0>, then WARNIF is set. 1 = Battery monitor is OFF 0 = Battery monitor is working bit 4-0 BATMON<4:0>: Battery Monitor Threshold Field bits VTHRESHOLD = 3.6 - 0.071 * BATMON<4:0> (V) REGISTER 2-53: SECKEY (SECURITY KEY REGISTER) ADDRESS: 0x40 – 0x4F R/W-00000000 SECKEY<127:120> bit 127 bit 120 R/W-00000000 SECKEY<119:112> bit 119 bit 112 R/W-00000000 SECKEY<111:104> bit 111 bit 104 R/W-00000000 SECKEY<103:96> bit 103 bit 96 R/W-00000000 SECKEY<95:88> bit 95 bit 88 R/W-00000000 SECKEY<87:80> bit 87 bit 80 R/W-00000000 SECKEY<79:72> bit 79 2015 Microchip Technology Inc. bit 72 Preliminary DS70005023C-page 63 MRF24XA REGISTER 2-53: SECKEY (SECURITY KEY REGISTER) (CONTINUED) ADDRESS: 0x40 – 0x4F R/W-00000000 SECKEY<71:64> bit 71 bit 64 R/W-00000000 SECKEY<63:56> bit 63 bit 56 R/W-00000000 SECKEY<55:48> bit 55 bit 48 R/W-00000000 SECKEY<47:40> bit 47 bit 40 R/W-00000000 SECKEY<39:32> bit 39 bit 32 R/W-00000000 SECKEY<31:24> bit 31 bit 24 R/W-00000000 SECKEY<23:16> bit 23 bit 16 R/W-00000000 SECKEY<15:8> bit 15 bit 8 R/W-00000000 SECKEY<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 127-0 SECKEY<128:0>: Security Key Field bits Security key used in security operation. DS70005023C-page 64 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-54: SECNONCE (SECURITY NONCE REGISTER) ADDRESS: 0x50 – 0x5C R/W/HS/HC-00000000 SECNONCE<103:96> bit 103 bit 96 R/W-00000000 SECNONCE <95:88> bit 95 bit 88 R/W-00000000 SECNONCE<87:80> bit 87 bit 80 R/W-00000000 SECNONCE<79:72> bit 79 bit 72 R/W-00000000 SECNONCE<71:64> bit 71 bit 64 R/W-00000000 SECNONCE<63:56> bit 63 bit 56 R/W-00000000 SECNONCE<55:48> bit 55 bit 48 R/W-00000000 SECNONCE<47:40> bit 47 bit 40 R/W-00000000 SECNONCE<39:32> bit 39 bit 32 R/W-00000000 SECNONCE<31:24> bit 31 bit 24 R/W-00000000 SECNONCE<23:16> bit 23 bit 16 R/W-00000000 SECNONCE<15:8> bit 15 2015 Microchip Technology Inc. bit 8 Preliminary DS70005023C-page 65 MRF24XA REGISTER 2-54: SECNONCE (SECURITY NONCE REGISTER) (CONTINUED) ADDRESS: 0x50 – 0x5C R/W-00000000 SECNONCE<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 103-0 x = Bit is unknown SECNONCE<103:0>: Security Nonce Field bits The register represents security nonce used in security operation. This field is deterministic in both 802.15.4-2003 and 802.15.4-2006 standards. Device can automatically calculate this field. REGISTER 2-55:SFD1 (START FRAME DELIMITER PATTERN 1 CONFIGURATION REGISTER) ADDRESS: 0x60 R/W-00100001 SFD1<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-0 SFD1<7:0>: Start Frame Delimiter Pattern 1 Register Field bits This octet is used as SFD pattern with 2 Mbps rate when OPTIMAL = 0, and as the MSB of the SFD pattern with 2 Mbps rate when OPTIMAL = 1. When OPTIMAL = 0: The hexadecimal digits must be different from 0x0 and different from the corresponding digits in SFD<k>, k = 2, 3, 4, 6, and the value 0xA7 is forbidden. When OPTIMAL = 1: The hexadecimal digits must be different from 0x0 and different from the corresponding digits of SFD2. DS70005023C-page 66 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-56: SFD2 (START FRAME DELIMITER PATTERN 2 CONFIGURATION REGISTER) ADDRESS: 0x61 R/W-11110001 SFD2<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-0 SFD2<7:0>: Start Frame Delimiter Pattern 2 Register Field bits This octet is used as SFD pattern with 1 Mbps rate when OPTIMAL = 0, and as the MSB of the SFD pattern with 1 Mbps rate when OPTIMAL = 1. When OPTIMAL = 0: The hexadecimal digits must be different from 0x0 and different from the corresponding digits in SFD<k>, k = 1, 3, 4, 6, and the value 0xA7 is forbidden. When OPTIMAL = 1: The hexadecimal digits must be different from 0x0 and different from the corresponding digits of SFD2. REGISTER 2-57: SFD3 (START FRAME DELIMITER PATTERN 3 CONFIGURATION REGISTER) ADDRESS: 0x62 R/W-00111011 SFD3<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-0 SFD3<7:0>: Start Frame Delimiter Pattern 3 Register Field bits This octet is used as SFD pattern with 500 kbps rate. When OPTIMAL = 0: The hexadecimal digits must be different from 0x0 and different from the correspond digits in SFD<k>, k = 1, 2, 4, 6, and the value 0xA7 is forbidden. When OPTIMAL = 1: The hexadecimal digits must be different from 0x0. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 67 MRF24XA REGISTER 2-58: SFD4 (START FRAME DELIMITER PATTERN 4 CONFIGURATION REGISTER) ADDRESS: 0x63 R/W-11100101 SFD4<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-0 SFD4<7:0>: Start Frame Delimiter Pattern 4 Register Field bits This octet is used as SFD pattern with 250 kbps rate when proprietary MAC is in use. Otherwise, the 0xA7 pattern defined in the standard is used instead. The hexadecimal digits must be different from 0x0 and from the corresponding digits in SFD<k>, where k = 6 or 1, 2, 3. When OPTIMAL = 0, the value 0xA7 is forbidden. REGISTER 2-59: SFD5 (START FRAME DELIMITER PATTERN 5 CONFIGURATION REGISTER) ADDRESS: 0x64 R/W-01001101 SFD5<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-0 SFD5<7:0>: Start Frame Delimiter Pattern 5 Register Field bits This octet is used as the MSB of the SFD pattern with 125 kbps rate. DS70005023C-page 68 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 2-60: SFD6 (START FRAME DELIMITER PATTERN 6 CONFIGURATION REGISTER) ADDRESS: 0x65 R/W-10101000 SFD6<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-0 SFD6<7:0>: Start Frame Delimiter Pattern 6 Register Field bits When OPTIMAL = 1: This octet is used as the LSB of the SFD pattern with 2 Mbps rate. This octet is used as the LSB of the SFD pattern with 125 kbps rate. When OPTIMAL = 0: The value 0xA7 is forbidden.The hexadecimal digits must be different from 0x0 and different from the corresponding digits in SFD<k>, k = 4 or 1, 2, 3 . REGISTER 2-61: SFD7 (START FRAME DELIMITER PATTERN 7 CONFIGURATION REGISTER) ADDRESS: 0x66 R/W-11001000 SFD7<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-0 SFD7<7:0>: Start Frame Delimiter Pattern 7 Register Field bits When OPTIMAL = 1, this octet is used as the LSB of the SFD pattern with 1 Mbps rate. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 69 MRF24XA NOTES: DS70005023C-page 70 Preliminary 2015 Microchip Technology Inc. MRF24XA 3.0 FUNCTIONAL DESCRIPTION 3.1 Reset MRF24XA has three reset types: • Power-On Reset (POR) – MRF24XA has built-in POR circuitry that automatically resets all control registers when power is applied. After POR, MRF24XA starts the internal Calibration process. RDYIF interrupt is set when the device is ready to use. • RESET Pin – Th host MCU can reset MRF24XA by asserting the RESET pin18 low. All control registers are reset to default value. If the RESET pin is deasserted, MRF24XA starts the internal Calibra- tion process. RDYIF interrupt is set when the device is ready to use. • Software Reset – The host MCU can perform the Software Reset through the SPI interface. REGRST register (0x00) provides reset signals for the Configuration registers, while FSMRST register (0x01) provides reset functionality for the internal state machines. The reset signals are asynchronous and the level is evaluated immediately without any internal synchronization. The recommended reset sequences: - FSMRST = 0x1F - REGRST = 0x3F - REGRST = 0x00 REGRST (CONFIGURATION RESET)(1) REGISTER 3-1: ADDRESS: 0x00 R-00 R/W-000000 r REGRST<5:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-6 Reserved: Maintain as ‘0’ bit 5-0 REGRST<5:0>: Asynchronous Register Reset Field bits 111111 = Reset Configuration registers to default 000000 = Release from reset Note 1: After setting the field, the host MCU must also clear it to release the device from reset. FSMRST (CONTROLLER RESET)(1) REGISTER 3-2: ADDRESS: 0x01 R-000 R/W-00000 r FSMRST<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-5 Reserved: Maintain as ‘0’ bit 4-0 FSMRST<4:0>: Asynchronous Functional Reset Field bits 11111 = Reset state machines to default 00000 = Release from reset Note 1: After setting the field, the host MCU must clear it to release the device from reset. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 71 MRF24XA TABLE 3-1: REGISTERS ASSOCIATED WITH RESET Name Bit 7 REGRST Bit 6 Bit 5 Bit 4 r FSMRST Bit 3 Bit 2 Bit 1 Bit 0 REGRST<5:0> r FSMRST<4:0> Legend: r = Reserved, read as ‘0’. 3.2 Interrupts MRF24XA has one interrupt (INT), pin 13 that signals interrupt events to the host MCU. Interrupt sources are enabled through PIE1 (0x08) to PIE4 (0x0B) register bits. All interrupts are enabled or disabled using GIE bit (PINCON<6>). If GIE bit is cleared, all interrupts are disabled and INT pin remains in inactive state. Despite having the interrupts cleared by GIE bit clearing, the interrupt flags of the enabled interrupt sources are set. REGISTER 3-3: Interrupt flags are located in the PIR1 (0x04) to PIR4 (0x07) registers. The PIRX register bits clears-to-zero upon read. Therefore, the host MCU must read and store the value of the PIRX registers and check the bits to determine which interrupt occurred. The INT pin continues to signal an interrupt until all active interrupts flags in PIRX registers are read. PINCON (PIN CONFIGURATION REGISTER) ADDRESS: 0x0C R-0 R/W-1 R-0 R-x R/W-0000 r GIE r IRQIF GPIOMODE<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7 Reserved: Maintain as ‘0’ bit 6 GIE: General Interrupt Enable bit This bit enables to output IRQIF on INT pin. Note that the polarity of INT pin is active-low. bit 5 Reserved: Maintain as ‘0’ bit 4 IRQIF: Interrupt Request Pending bit This bit is the OR relationship of the enabled interrupt flags. bit 3-0 GPIOMODE <3:0>: GPIO Mode Field bits This bit field is out of scope. DS70005023C-page 72 Preliminary 2015 Microchip Technology Inc. MRF24XA 3.2.1 PIEx - INTERRUPT ENABLE REGISTERS Register bits of PIE1 to PIE4 registers enable the appropriate interrupt sources to generate interrupts to the host MCU through INT pin. The interrupt is enabled when the appropriate bit is set to ‘1’. REGISTER 3-4: PIE1 (PERIPHERAL INTERRUPT ENABLE 1) ADDRESS: 0x08 R-0 R/W-1 R/W-1 R-0 R/W-1 R/W-1 R-0 r RDYIE IDLEIE r CALSOIE CALHAIE r bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-6 Reserved: Maintain as ‘0’ bit 5 RDYIE: Ready Interrupt Enable bit This bit masks the RDYIF interrupt bit. bit 4 IDLEIE: Idle Interrupt Enable bit This bit masks the IDLEIF interrupt bit. bit 3 Reserved: Maintain as ‘0’ bit 2 CALSOIE: Calibration Soft Interrupt Enable bit This bit masks the CALSOIF interrupt bit. bit 1 CALHAIE: Calibration Hard Interrupt Enable bit This bit masks the CALHAIF interrupt bit. bit 0 Reserved: Maintain as ‘0’ 2015 Microchip Technology Inc. Preliminary DS70005023C-page 73 MRF24XA REGISTER 3-5: PIE2 (PERIPHERAL INTERRUPT ENABLE 2) ADDRESS: 0x09 R/W-1 R/W-1 R/W-0 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 TXIE TXENCIE TXMAIE TXACKIE TXCSMAIE TXSZIE TXOVFIE FRMIE bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7 TXIE: Transmit Interrupt Enable This bit masks the TXIF interrupt register. bit 6 TXENCIE: Transmit Encryption and Authentication Interrupt Enable bit This bit masks the TXENCIF interrupt register. bit 5 TXMAIE: Transmitter Medium Access Interrupt Enable bit This bit masks the TXMAIF interrupt register. bit 4 TXACKIE: Transmission Unacknowledged Failure Interrupt Enable bit This bit masks the TXACKIF interrupt register. bit 3 TXCSMAIE: Transmitter CSMA Failure Interrupt Enable bit This bit masks the TXCSMAIF interrupt register. bit 2 TXSZIE: Transmit Packet Size Error Interrupt Enable bit This bit masks the TXSZIF interrupt register. bit 1 TXOVFIE: Transmitter Overflow Interrupt Enable bit This bit masks the TXOVFIF interrupt register. bit 0 FRMIE: Frame Format Error Interrupt Flag bit This bit masks the FRMIF interrupt register. DS70005023C-page 74 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 3-6: PIE3 (PERIPHERAL INTERRUPT ENABLE 3) ADDRESS: 0x0A R/W-1 R/W-1 R/W-1 R-0 R/W-0 R/W-0 R/W-1 R/W-1 RXIE RXDECIE RXTAGIE r RXIDENTIE RXFLTIE RXOVFIE STRMIE bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7 RXIE: Received Successful Interrupt Enable bit This bit masks the RXIF interrupt register. bit 6 RXDECIE: Receiver Decryption/Authentication Passed Interrupt Enable bit This bit masks the RXDECIF interrupt register. bit 5 RXTAGIE: Receiver Decryption/Authentication Failure Interrupt Enable bit This bit masks the RXTAGIF interrupt register. bit 4 Reserved: Maintain as ‘0’ bit 3 RXIDENTIE: Received Packet Identical Interrupt Enable bit This bit masks the RXIDENTIF interrupt register. bit 2 RXFLTIE: Received Packet Filtered Interrupt Enable bit This bit masks the RXFLTIF interrupt register. bit 1 RXOVFIE: Receiver Overflow Interrupt Enable bit This bit masks the RXOVFIF interrupt register. bit 0 STRMIE: Receive Stream Time-Out Error Interrupt Enable bit This bit masks the STRMIF interrupt register. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 75 MRF24XA REGISTER 3-7: PIE4 (PERIPHERAL INTERRUPT ENABLE 4) ADDRESS: 0x0B R/W-0 R/W-0 R/W-1 R/W-1 R/W-1 R/W-0 R/W-0 R/W-0 TXSFDIE RXSFDIE ERRORIE WARNIE EDCCAIE GPIO2IE GPIO1IE GPIO0IE bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7 TXSFDIE: Transmit SFD Sent Interrupt Enable bit This bit masks the TXSFDIF interrupt register. bit 6 RXSFDIE: Receive SFD Detected Interrupt Enable bit bit 5 ERRORIE: General Error Interrupt Enable bit This bit masks the RXSFDIF Interrupt Enable. This bit masks the ERRORIF interrupt register. bit 4 WARNIE: Warning Interrupt Enable bit This bit masks the WARNIF interrupt register. bit 3 EDCCAIE: Energy Detect/CCA Done Interrupt Enable bit This bit masks the EDCCAIF interrupt register. bit 2 GPIO2IE: GPIO2 Interrupt Enable bit bit 1 GPIO1IE: GPIO1 Interrupt Enable bit bit 0 GPIO0IE: GPIO0 Interrupt Enable bit This bit masks the GPIO2IF interrupt register. This bit masks the GPIO1IF interrupt register. This bit masks the GPIO0IF interrupt register. DS70005023C-page 76 Preliminary 2015 Microchip Technology Inc. MRF24XA 3.2.2 PIRX- PERIPHERAL INTERRUPT REGISTERS Register bits of PIR1 to PIR4 registers indicates the source of the interrupt. The interrupt must be enabled when the appropriate bit is set to ‘1’ in the corresponding PIEx register. MRF24XA automatically clears the contents of the PIRX registers when the host MCU reads the content of the register. MCU must store the PIRX register values in the firmware as needed . REGISTER 3-8: PIR1 (PERIPHERAL INTERRUPT REGISTER 1) ADDRESS: 0x04 R/HS-1 R-0 R/HS-0 R/W/HC-0 R-0 R/W/HS-0 R/W/HS-0 R-0 VREGIF r RDYIF IDLEIF r CALSOIF CALHAIF r bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 x = Bit is unknown VREGIF: Voltage regulator On Interrupt Flag bit(1) This is a nonpersistent bit. The register bit initializes to 1 on 1.2V reset except when RESET is used and only cleared when PIR1 is read. Note that the corresponding IE bit is not implemented. bit 6 Reserved: Maintain as ‘0’ bit 5 RDYIF: Ready state Interrupt Flag bit Set each time when READY state is reached: • When Calibration ended (CALST = 0) • When initialization ended (INITDONESF = 1) • When crystal is ramped up (XTALSF = 1) This bit is cleared when PIR1 is read. bit 4 IDLEIF: Idle state Interrupt Flag bit Set each time the IDLESF is set and if MCU did not trigger this change. This is unchanged when MCU aborts an action by clearing either of TXST, TXENC, RXDEC, EDST or CCA bits. This bit is cleared when PIR1 is read. bit 3 Reserved: Maintain as ‘0’ bit 2 CALSOIF: Calibration Soft Interrupt Flag bit This flag indicates that maybe Calibration is needed (CALST) although the radio is still functional. It also warns of a possible degradation in signal quality and current consumption, and a risk of CALHAIF interrupt. This bit is cleared when PIR1 is read. bit 1 CALHAIF: Calibration Hard Interrupt Flag bit This flag indicates that immediate Calibration (CALST) is mandatory, otherwise the radio is not functional. The device enters into malfunction state. This bit is cleared when PIR1 is read. bit 0 Note 1: Reserved: Maintain as ‘0’ Generated non-maskable interrupt is gated off until the 1.2V reset is released. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 77 MRF24XA REGISTER 3-9: PIR2 (PERIPHERAL INTERRUPT REGISTER 2) ADDRESS: 0x05 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 TXIF TXENCIF TXMAIF TXACKIF TXCSMAIF TXSZIF TXOVFIF FRMIF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7 TXIF: Transmission Done Interrupt Flag bit The current TX operation (TXST) is successfully completed. This event becomes unchanged when a hardware generated ACK packet completed the transmission or when a packet is repeated. Nonpersistent, cleared by SPI read. bit 6 TXENCIF: Transmit Encoding Interrupt Flag bit The TX packet was successfully encrypted or complemented, or both with a Message Integrity Code (MIC). Set by the device after TXENC = 1, when TXENC is cleared. Nonpersistent, cleared by SPI read. bit 5 TXMAIF: Transmitter Medium Access Interrupt Flag bit Set by the device when the medium is accessed, specifically when the first sample in the preamble is transmitted into the air. Nonpersistent, cleared by SPI read. bit 4 TXACKIF: Transmission Unacknowledged Failure Interrupt Flag bit Set by the device when Acknowledge is not received after the configured maximum number of transmission retries RETXMCNT<3:0>, provided that the Frame Control field of the transmitted frame indicates AckReq = 1 and AUTOACKEN = 1. Nonpersistent, cleared by SPI read. bit 3 TXCSMAIF: Transmitter CSMA Failure Interrupt Flag bit Set by the device when CSMA-CA finds the channel busy for BOMCNT<2:0> number of times, provided that CSMAEN = 1 is configured. Nonpersistent, cleared by SPI read. bit 2 TXSZIF: Transmit Packet Size Error Interrupt Flag bit Following TXST is set the packet size (including MIC tags and CRC) is found to be zero or to be greater than the maximum size that the buffers can support. Nonpersistent, cleared by SPI read. bit 1 TXOVFIF: Transmitter Overflow Interrupt Flag bit The Host Controller attempted to write a TX buffer that was not empty (TXBUFEMPTY = 0). Nonpersistent, cleared by SPI read. bit 0 FRMIF: Frame Format Error Interrupt Flag bit Set if the transmitter/receiver fails to parse the frame in the buffer (it is not as it must be or it is corrupted in demodulation). Nonpersistent, cleared by SPI read. DS70005023C-page 78 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 3-10: PIR3 (PERIPHERAL INTERRUPT REGISTER 3) R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 RXIF RXDECIF RXTAGIF R-0 ADDRESS: 0x06 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 r RXIDENTIF RXFLTIF RXOVFIF STRMIF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 x = Bit is unknown RXIF: Received Successful Interrupt Flag bit Set by the device when a frame passed packet filtering and accepted, refer to Register 5-1. This interrupt flag is only set once for a packet and is not set when the packet is the duplicate of a repeated transmission (sequence number matches with the previously received frame). Nonpersistent, cleared by SPI read. bit 6 RXDECIF: Receiver Decryption/Authentication Passed Interrupt Flag bit Set by the device when decryption/authentication finished without error. Nonpersistent, cleared by SPI read. bit 5 RXTAGIF: Receiver Decryption/Authentication Failure Interrupt Flag bit Set by the device when decryption/authentication finished with error. Nonpersistent, cleared by SPI read. bit 4 Reserved: Maintain as ‘0’ bit 3 RXIDENTIF: Received Packet Identical Interrupt Flag bit Set by the device when the packet is the duplicate of a repeated transmission (sequence number, source address matches with the previously received frame). Nonpersistent, cleared by SPI read. bit 2 RXFLTIF: Received Packet Filtered Interrupt Flag bit Set by the device when a packet was received, but rejected by one or more RX filters, refer to Register 5-1. Nonpersistent, cleared by SPI read. bit 1 RXOVFIF: Receiver Overflow Error Interrupt Flag bit Set by the device to indicate that a packet was received, but all RX buffers were full. Consequently the packet was not received, but was discarded instead(1). Nonpersistent, cleared by SPI read. bit 0 STRMIF: Receive Stream Time-Out Error Interrupt Flag bit Set by the device to indicate the duration specified in STRMTO elapsed since the last received packet while in RX-Streaming mode, and the MAC clears the stored sequence number. Nonpersistent, cleared by SPI read. Note 1: In Packet mode, use a single buffer for received frames. In RX-Streaming mode, use both buffers for reception. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 79 MRF24XA REGISTER 3-11: PIR4 (PERIPHERAL INTERRUPT REGISTER 4) ADDRESS: 0x07 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 TXSFDIF RXSFDIF ERRORIF WARNIF EDCCAIF GPIO2IF GPIO1IF GPIO0IF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 x = Bit is unknown TXSFDIF: Transmit SFD Sent Interrupt Flag bit Set by the device when the last sample of the SFD field is sent into the air. Nonpersistent, cleared by SPI read. bit 6 RXSFDIF: Receive SFD Detected Interrupt Flag bit Set by the device when the SFD field of the received frame is detected(1). Nonpersistent, cleared by SPI read. bit 5 ERRORIF: General Error Interrupt Flag bit Set by the device, when malfunction state is reached. bit 4 WARNIF: Warning Interrupt Flag bit Set by the device when one of the following is occurred: • Battery voltage drops below the threshold by BATMON<4:0> at 0x3F • Indicating that resistor is missing or not connected well bit 3 EDCCAIF: Energy Detect/CCA Done Interrupt Flag bit Set by the device when Energy-detect or CCA measurement is complete (following that the host MCU sets the EDST/CCAST bit to start the measurement and the device is clearing it in on completion). Nonpersistent. Cleared by SPI read. bit 2 GPIO2IF: GPIO2 Interrupt Flag bit Set by the device if the GPIOMODE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. bit 1 GPIO1IF: GPIO1 Interrupt Flag bit Set by the device if the GPIOMODE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. bit 0 GPIO0IF: GPIO0 Interrupt Flag bit Set by the device if the GPIOMODE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. Note 1: The detection latency (0…1 µs after the last sample of the SFD). Note that the SFD may trigger on noise or interference. Note that the CFOMEAS<7:0> indication becomes valid when RXSFDIF is asserted. TABLE 3-2: REGISTERS ASSOCIATED WITH INTERRUPTS Name Bit 7 PIR1 VREGIF r RDYIF PIR2 TXIF TXENCIF TXMAIF PIR3 RXIF RXDECIF RXTAGIF PIR4 TXSFDIF RXSFDIF ERRORIF RDYIE TXIE TXENCIE TXMAIE PIE3 RXIE RXDECIE RXTAGIE PIE4 TXSFDIE RXSFDIE ERRORIE r GIE r IRQIF PIE1 PIE2 PINCON Legend: Bit 6 r Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 IDLEIF r CALSOIF CALHAIF r TXACKIF TXCSMAIF TXSZIF TXOVFIF FRMIF r RXIDENTIF RXFLTIF RXOVFIF STRMIF WARNIF EDCCAIF GPIO2IF GPIO1IF GPIO0IF IDLEIE r CALSOIE CALHAIE r TXACKIE TXCSMAIE TXSZIE TXOVFIE FRMIE r RXIDENTIE RXFLTIE RXOVFIE STRMIE WARNIE EDCCAIE GPIO2IE GPIO1IE GPIO0IE GPIOMODE<3:0> r = Reserved. DS70005023C-page 80 Preliminary 2015 Microchip Technology Inc. MRF24XA 3.3 GPIO Functions and GPIO Interrupts GPIO data is read or written to through the GPIO bits (0x0D<2:0>). Refer to Register 3-17 for more information on GPIO monitoring. GPIO lines can have active pull-up or pull-down. PULLENGPIOx (0x0F<2:0>) bits enable line pulling function. Setting PULLENGPIOx bit to ‘1’ enables active pull-up or pull-down circuit. PULLDIRGPIOx bit (0x0F<6:4>) sets the pull direction. Setting PULLDIRGPIOx bit to ‘1’ defines pull-up, while clearing the bit defines pull-down on the appropriate GPIO line. 3.3.1 3.3.2 MRF24XA has three GPIO pins, GPIO2 pin 12, GPIO1 pin 11 and GPIO0 pin 10. GPIO pins are used as general purpose IO pins or GPIOs can monitor internal states. GPIO GENERAL IO FUNCTIONALITIES To operate MRF24XA GPIOx pins in general purpose IO mode, set GPIOEN bit (0x0D<7>) to ‘1’ and set GPIOMODE<3:0> bits (0x0C<3:0>) to ‘0000’. The TRISGPIOx bits (0x0D<6:4>) configures the input or output selection of GPIOs. Clearing the TRISGPIOx bit sets the appropriate GPIO line to Output mode. Input the default GPIO line direction after POR. GPIO lines in Input mode are used with Schmitt Trigger input buffers. STENGPIOx bits (0x0E<2:0>) enables the Schmitt Triggers. Setting the STENGPIOx bit to ‘1’ enables Schmitt Trigger input of the appropriate pin. 2015 Microchip Technology Inc. GPIO INTERRUPT HANDLING GPIO lines can also generate interrupts. To use GPIO interrupts, set the appropriate GPIOxIE bit (0x0B<2:0>) to ‘1’ to enable the interrupt generation. To enable interrupt generation on INT pin, set GIE bit (0x0C<6>) to ‘1’ . The GPIO interrupt polarity is selected through GPIOxP bits (0x0E<6:4>). Setting GPIOxP bit to ‘1’ triggers interrupt logic at the rising edge of the input signal. While clearing the bit enables interrupt generation on the falling edge of the input pin. Preliminary DS70005023C-page 81 MRF24XA REGISTER 3-12: PIR4 (PERIPHERAL INTERRUPT REGISTER 4) ADDRESS: 0x07 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 TXSFDIF RXSFDIF ERRORIF WARNIF EDCCAIF GPIO2IF GPIO1IF GPIO0IF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-3 Out of scope bit 2 GPIO2IF: GPIO2 Interrupt Flag bit Set by the device if the GPIOMODE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. bit 1 GPIO1IF: GPIO1 Interrupt Flag bit Set by the device if the GPIOMODE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. bit 0 GPIO0IF: GPIO0 Interrupt Flag bit Set by the device if the GPIOMODE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. REGISTER 3-13: PIE4 (PERIPHERAL INTERRUPT ENABLE 4) ADDRESS: 0x0B R/W-0 R/W-0 R/W-1 R/W-1 R/W-1 R/W-0 R/W-0 R/W-0 TXSFDIE RXSFDIE ERRORIE WARNIE EDCCAIE GPIO2IE GPIO1IE GPIO0IE bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-3 Out of scope bit 2 GPIO2IE: GPIO2 Interrupt Enable bit This bit masks the GPIO2IF interrupt register. bit 1 GPIO1IE: GPIO1 Interrupt Enable bit This bit masks the GPIO1IF interrupt register. bit 0 GPIO0IE: GPIO0 Interrupt Enable bit This bit masks the GPIO0IF interrupt register. DS70005023C-page 82 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 3-14: GPIO (GENERAL PURPOSE I/O REGISTER) ADDRESS: 0x0D R/W-0 R/W-1 R/W-1 R/W-1 R-0 R/W-0 R/W-0 R/W-0 GPIOEN TRISGPIO2 TRISGPIO1 TRISGPIO0 r GPIO2 GPIO1 GPIO0 bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7 GPIOEN: GPIO Enable bit This bit enables the GPIO’s control, if GPIOMODE is only configured into Normal mode. The other GPIOMODE Configuration automatically controls GPIO pins. bit 6 TRISGPIO2: Tri-state Control for GPIO 2 Pin bit If set, the pin is configured into Input mode. Value reads from GPIO2 bit. If cleared, the pin is configured into Output mode. Value sets through the GPIO2 bit. bit 5 TRISGPIO1: Tri-state Control for GPIO 1 Pin bit If set, the pin is configured into Input mode. Value reads from GPIO1 bit. If cleared, the pin is configured into Output mode. Value sets through the GPIO1 bit. bit 4 TRISGPIO0: Tri-state Control for GPIO 0 Pin bit If set, the pin is configured into Input mode. Value reads from GPIO0 bit. If cleared, the pin is configured into Output mode. Value sets through the GPIO0 bit. bit 3 Reserved: Maintain as ‘0’ bit 2 GPIO2: GPIO 2 Value bit This bit represents the value on the GPIO 2 pin. bit 1 GPIO1: GPIO 1 Value bit This bit represents the value on the GPIO 1 pin. bit 0 GPIO0: GPIO 0 Value bit This bit represents the value on the GPIO 0 pin. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 83 MRF24XA REGISTER 3-15: STGPIO (SCHMITT TRIGGER GENERAL PURPOSE I/O REGISTER) ADDRESS: 0x0E R-0 R/W-0 R/W-0 R/W-0 R-0 R/W-0 R/W-0 R/W-0 r GPIO2P GPIO1P GPIO0P r STENGPIO2 STENGPIO1 STENGPIO0 bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7 Reserved: Maintain as ‘0’ bit 6 GPIO2P: GPIO 2 Polarity bit This bit controls GPIO2IF polarity when configured into Input mode. 1 = Rising edge 0 = Falling edge bit 5 GPIO1P: GPIO 1 Polarity bit This bit controls GPIO1IF polarity when configured into Input mode. 1 = Rising edge 0 = Falling edge bit 4 GPIO0P: GPIO 0 Polarity bit This bit controls GPIO0IF polarity when configured into Input mode. 1 = Rising edge 0 = Falling edge bit 3 Reserved: Maintain as ‘0’ bit 2 STENGPIO2: Schmitt Trigger Enable GPIO 2 This bit enables Schmitt-trigger circuit on GPIO 2 pad and turns off by default. 1 = Schmitt trigger enabled 0 = Schmitt trigger disabled bit 1 STENGPIO1: Schmitt Trigger Enable GPIO 1 This bit enables Schmitt-trigger circuit on GPIO 1 pad and turns off by default. 1 = Schmitt trigger enabled 0 = Schmitt trigger disabled bit 0 STENGPIO0: Schmitt Trigger Enable GPIO 0 This bit enables Schmitt-trigger circuit on GPIO 0 pad and turns off by default. 1 = Schmitt trigger enabled 0 = Schmitt trigger disabled DS70005023C-page 84 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 3-16: PULLGPIO (PULL CONTROL GENERAL PURPOSE I/O REGISTER) ADDRESS: 0x0F R-0 R/W-0 R/W-0 R/W-0 R-0 R/W-0 R/W-0 R/W-0 r PULLDIRGPIO2 PULLDIRGPIO1 PULLDIRGPIO0 r PULLENGPIO2 PULLENGPIO1 PULLENGPIO0 bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7 Reserved: Maintain as ‘0’ bit 6 PULLDIRGPIO2: Pull Direction on GPIO 2 bit These bits control the 75 kOhm weak-pull circuit direction on GPIO 2 pin. 1 = Pull-up 0 = Pull-down bit 5 PULLDIRGPIO1: Pull Direction on GPIO 1 bit These bits control the 75 kOhm weak-pull circuit direction on GPIO 1 pin. 1 = Pull-up 0 = Pull-down bit 4 PULLDIRGPIO0: Pull Direction on GPIO 0 bit These bits control the 75 kOhm weak-pull circuit direction on GPIO 0 pin. 1 = Pull-up 0 = Pull-down bit 3 Reserved: Maintain as ‘0’ bit 2 PULLENGPIO2: Pull Enable on GPIO 2 bit This bit enables to weak-pull circuit in GPIO 2 pin. Note that when pin is configured to output, weak-pull circuit automatically disables. 1 = Pull enabled 0 = Pull disabled bit 1 PULLENGPIO1: Pull Enable on GPIO 1 bit This bit enables to weak-pull circuit in GPIO 1 pin. Note that when pin is configured to output, weak-pull circuit automatically disables. 1 = Pull enabled 0 = Pull disabled bit 0 PULLENGPIO0: Pull Enable on GPIO 0 bit This bit enables to weak-pull circuit in GPIO 0 pin. Note that when pin is configured to output, weakpull circuit automatically disables. 1 = Pull enabled 0 = Pull disabled 2015 Microchip Technology Inc. Preliminary DS70005023C-page 85 MRF24XA REGISTER 3-17: PINCON (PIN CONFIGURATION REGISTER) ADDRESS: 0x0C R-0 R/W-1 R-0 R-1 R/W-0000 r GIE r IRQIF GPIOMODE<3:0> bit 7 bit 0 Legend: R = Readable bit -n = Value at POR W = Writable bit ‘1’ = Bit is set U = Unimplemented bit, read as ‘0’ ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 Reserved: Maintain as ‘0’ bit 6 GIE: General Interrupt Enable bit This bit enables to output IRQIF on INT pin. Note that the polarity of INT pin is active-low. bit 5 Reserved: Maintain as ‘0’ bit 4 IRQIF: Interrupt Request Pending bit This bit is the OR relationship of the enabled interrupt flags. bit 3-0 GPIOMODE <3:0>: GPIO Mode Field bit This field allows redefining the functionality of the GPIO pins Encoding: 11xx = Reserved 1011 = GPIO pins are used for Receive streaming (RXSTREAM). Pins GPIO<2:0> are used to output {RXWRBUF, BUSRDBUF, RXBUFFUL}. 1010 = GPIO pins are used for Transmit streaming (TXSTREAM). Pins GPIO<2:0> are used to output {TXRDBUF, BUSWRBUF, TXBUFEMPTY}. 1001 = Reserved 1000 = Reserved 0111 = Reserved 0110 = Reserved 0101 = Intended for supporting Precise Network Time Synchronization (TIMESYN). GPIO<0> is used to output TX, while GPIO<1> to output RX SFD indication pulses. GPIO<2> is used in “NORMAL” operation mode. 0100 = GPIO pins are used for Radio monitoring (RFMON). Pins GPIO<2:0> are used to output RFOP<2:0>. 0011 = GPIO pins are used for MAC monitoring (MACMON). Pins GPIO<2:0> are used to output MACOP<3:1>. 0010 = GPIO pins are used for RXFSM monitoring (RXFSMMON). Pins GPIO<2:0> are used to output receiver state-machine 000 = Preamble search 001 = Hi-rate SFD search 010 = Mid-rate SFD search 011 = Low-rate SFD search 100 = Legacy length field processing 101 = Payload processing 0001 = GPIO pins are used for AGC monitoring (AGCMON). Pins GPIO<2:0> are used to output {AGCHOLD, GAIN<1:0>} where AGCHOLD is an internal flag set when a receiver detects a preamble and clears when the AGC is set free after the end of the frame. 0000 = GPIO pins are used as General Purpose I/O’s by the host MCU (NORMAL). DS70005023C-page 86 Preliminary 2015 Microchip Technology Inc. MRF24XA TABLE 3-3: Name REGISTERS ASSOCIATED WITH GPIO FUNCTIONALITIES Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 PIR4 TXSFDIF RXSFDIF ERRORIF WARNIF EDCCAIF GPIO2IF GPIO1IF GPIO0IF PIE4 TXSFDIE RXSFDIE ERRORIE WARNIE EDCCAIE GPIO2IE GPIO1IE GPIO0IE GPIO GPIOEN TRISGPIO2 TRISGPIO1 TRISGPIO0 r GPIO2 GPIO1 GPIO0 STGPIO r GPIO2P GPIO1P GPIO0P r STENGPIO2 STENGPIO1 STENGPIO0 PULLGPIO r r PULLENGPIO2 PULLENGPIO1 PULLENGPIO0 PINCON r Legend: 3.4 PULLDIRGPIO2 PULLDIRGPIO1 PULLDIRGPIO0 GIE r IRQIF GPIOMODE<3:0> r = Reserved, read as ‘0’. PA and LNA Outputs 3.5 MRF24XA has a Power Amplifier (PA) control pin (pin 20) and a Low Noise Amplifier (LNA) control pin (pin 21). These pins are capable of handling external PAs and LNAs or external antenna switch circuits. MRF24XA can also tolerate different start-up times of different external circuits by sending or accepting data if the external circuits completes their ramp up. MRF24XA can handle both active-high or active-low control signal sensitive circuits. Battery Monitor The voltage level on the battery is monitored. If the battery monitoring is enabled and the voltage level drops below a threshold, voltage interrupt (WARNIF) is asserted. Refer to Register 3-18 for more information on the battery. For more information, refer to Section 9.13 “External PowerAmplifier(PA)/Low-NoiseAmplifier(LNA)” . REGISTER 3-18: BATMON (BATTERY MONITOR CONFIGURATION REGISTER) ADDRESS: 0x3F R-0 R/W-1 R/W-11111 r BATMONPD BATMON<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-6 Reserved: Maintain as ‘0’ bit 5 BATMONPD: Battery Monitor Power-Down bit If battery monitor is working and battery voltage drops below the threshold by BATMON<4:0> then WARNIF is set. 1 = Battery monitor is OFF 0 = Battery monitor is working bit 4-0 BATMON<4:0>: Battery Monitor Threshold Field bits VTHRESHOLD = 3.6 - 0.071 * BATMON<4:0> (V) 2015 Microchip Technology Inc. Preliminary DS70005023C-page 87 MRF24XA NOTES: DS70005023C-page 88 Preliminary 2015 Microchip Technology Inc. MRF24XA 4.0 GENERAL TRANSCEIVER OPERATIONS The host MCU can only access the Receive Buffer when RXBUFFUL is set (1). To free up the buffer, the host clears RXBUFFUL (0). 4.1 MAC Architecture If the frame is encrypted or contains an authentication tag (MIC), the host MCU must run the decrypt/ authenticate operation before it reads the payload and frees up the buffer. The architecture of MAC layer processing is illustrated in Figure 4-1. In reception, the receive signal processor acquires the synchronization header of the frame on-air, and demodulates the frame starting from the LENGTH field. The demodulated data is written directly into the Receiver Buffer (Default, Buffer 2) if the targeted buffer is declared empty (RXBUFFUL = 0). After LENGTH number of bytes are received into the buffer and RSV data are appended, the frame is parsed according to the selected Framing mode (IEEE 802.15.4 or proprietary). The Frame Control Sequence (FCS) is checked to detect corruption by noise. Corrupted frames or frames not addressed to this node are rejected (discarded), which the host configures. Rejection means that reception is completed now and the Receive Buffer status remains empty (RXBUFFUL = 0). It is configurable whether the frame is discarded silently or generates an interrupt to the host. If a frame is accepted and Acknowledge is requested for the frame, then the radio turns to transmit and sends an Acknowledgment. As other features, automatic ACK-sending are enabled or bypassed. If the frame is the duplicate of a previously received and accepted frame then the frame is discarded (following Acknowledgment). Otherwise, the frame is the first copy of an accepted frame, which must be reported to the host. To lock the buffer from being overwritten by a new frame, RXBUFFUL is automatically set (1). RXIF interrupt is generated for the host, which completes the reception. 2015 Microchip Technology Inc. When sending, the host MCU constructs the frame and downloads it to the transmit buffer (Default, Buffer 0), and triggers transmission after the last byte. The device processes the content of the buffer in-place. After parsing, a security processing takes place if required, finally an FCS is generated and appended to the frame. The LENGTH is adjusted each time an authentication tag (MIC) or FCS is appended to the frame. After in-place frame processing the medium is accessed using the Carrier Sense Multiple Access with Collision Avoidance (CSMA-CA). The RF transmit chain is only enabled when the channel is free, or if CSMA is bypassed. As soon as the RF can transmit, the Transmit Signal Processor starts sending the Synchronization Header (SHR) and followed by the buffer content up the FCS. If an Acknowledgment is requested then the RF chain is turned into receive. If ACK is not received before the expiration of a time-out, the transmission can automatically start over from CSMA through SHR-transmission, and then transmitting the SHR-transmission frame if configured. After successful sending an interrupt is generated to the host MCU. Only either the TX MAC or the RX MAC is active at a time. Preliminary DS70005023C-page 89 MRF24XA FIGURE 4-1: 4.2 4.2.1 MAC FUNCTIONAL BLOCK DIAGRAM Operations Overview 4.2.3 TERMINOLOGY Node denotes the wireless communication node that is formed by a MRF24XA device and a host MCU. Device denotes the MRF24XA device. Software/SW denotes the software running in the Host MCU. The device does not contain a processor core that runs software. Frame and Packet are used interchangeably. 4.2.2 HOST INTERFACE The host MCU controls the device over SPI (max. 10 MHz), whereas the device indicates task completion or failure events, and frames received over the air by raising an interrupt. Most interrupt flags are masked, which means that these are still set on the respective event, but cannot activate the interrupt pin on the device. The host services the interrupts through reading the interrupt register. The interrupt bytes are self-cleared on SPI-read. Using the convention, the “IF” suffix in mnemonics refers to “Interrupt Flag”. For example, TXIF and RXIF. For software troubleshooting, the host can set the interrupt flags. DS70005023C-page 90 BUFFERS The device has two frame buffers (128 bytes each). SPI allows accessing each byte in the frame buffer at its own address. As the default, the buffer starting at address 0x200 is used for transmission (BUF1) and the buffer starting at address 0x300 is used for reception (BUF2). 4.2.4 OPERATING STATES The Figure 4-3 chart describes the top-level state machine of MRF24XA, including the valid state transitions. Note that the register access can also perform the other transitions, however these may result in an unexpected behavior. For more information on the MRF24XA Power modes on power consumption in each state, refer to Table 2-1. 4.2.4.1 Description of Each State • RADIO IN PIN RESET: MCU keeps nRST pin low. Radio is in reset, functions are unavailable. • POWER OFF: Voltage on 3V3 pin is 0V. Radio is shut down. Preliminary 2015 Microchip Technology Inc. MRF24XA • INIT (RST = 1): Internal state. Radio performs automatic initialization after Power or Pin Reset. In this state, SPI is active and TX buffer can be pre-loaded. Register access is limited to 0x00 0x07. • INIT (RST = 0): Internal state. Radio performs automatic initialization to recover from Deep Sleep. In this state, SPI is active and TX buffer can be pre-loaded. Register access is limited to 0x00 - 0x07. • DEEP SLEEP: The radio is in an extremely lowpower state. Current consumption is 40 nA. All parts, including the 1V2 on-chip regulator, is turned off. 3V3 backup memory is only powered to keep the register settings. To maintain the settings, the chip must not be powered down completely. • INITIAL CALIBRATION: After reset, some internal circuits must be calibrated. The radio automatically performs these calibrations . In case some problem occurs during Calibration, the chip remains in this state. • RADIO OFF: This is the first stable state after power cycle or pin reset. The radio is ready for all operations, every register is accessible. Even if crystal is running, it takes 50 µs for the synthesizer to ramp up before RX or TX mode gets enabled. • IDLE: Radio is up and all registers are accessible. Crystal and synthesizer are up and running to reduce transition to RX or TX. • SLEEP: Only the regulator is powered on, crystal is not running. This state may be used for preloading register values or TX buffer. No other functionality are available. • RX Listen and RX Listen Power Save: Radio awaits for packets to arrive and to be received. All registers are accessible and TX buffer may be loaded. Even if PSAV is enabled, the operation remains the same. The difference displays in power consumption and sensitivity. • RX FRAME: Temporary internal state for the actual packet reception process. • TX FRAME: Temporary internal state for sending out a packet from TX buffer. 4.2.4.2 Detailed Transition Description 1: MCU releases nRST. Radio moves into INIT (RST = 1) mode. In case there were no power cycles, POR bit retains its state. 2: Radio gets powered on. POR bit sets to 1 and VREGIF is set when the 1V2 regulator is up. VREGIF is not maskable. 3: To start recovery from Deep Sleep mode, a dummy SPI read operation (at least four changes on SDI line) is required from the MCU. The first interrupt after wakeup is VREGIF, which indicates the start of the on-chip 2015 Microchip Technology Inc. 1.2V regulator. The SPI is operational at this point that enables the MCU to service the interrupt by reading the interrupt source register. POR flag retains its state before Deep Sleep mode. Transmit buffers are accessible for preloads. After the crystal oscillator becomes stabilized (1-3 ms; 1,4 ms typical), the device sets the RDYIF interrupt without going through recalibration, and then all the registers become accessible. Previously stored Configuration is retained during Deep Sleep, thus Calibration is not necessary. 4: In case radio was started with any kind of reset, Calibration is needed. Transition from INIT state and the initial Calibration are automatically done. 5: Theoretically, it is possible that Calibration fails. In that case, the chip remains in this internal state. Further information in STATUS register description. 6. Automatic transition to Radio OFF after successful Calibration. 7: Radio automatically turns to OFF mode after the register values are restored and RX is disabled before Deep Sleep. 8: In case RX is enabled before Deep Sleep, radio automatically turns back to RX or RX Power Save mode. 9, 12: To initiate transition to Sleep mode, MCU must set XTALDIS bit. Note that Sleep mode is only accessible from Idle and Radio OFF mode. 10: To recover from Sleep mode MCU must clear XTALDIS bit. Afterwards crystal ramps up and radio turns back to OFF modes. 11. Transferring to Deep Sleep mode. MCU must clear POR bit and all interrupt registers and set DSLEEP bit afterwards. 13, 14: RX mode is accessible from Radio OFF and Idle mode. The only difference is in transition time: from OFF mode user must Wait for synthesizer to ramp up. 15: MCU clears RXEN bit to go back to Idle. For further information on transition, see check point 20. 16, 17 and 18: MCU sets TXST to transmit packet from buffer. The difference is in transition time: from OFF mode user must Wait for synthesizer to ramp up. 19, 21: Radio turns back to Idle mode (if started from Idle or OFF mode) after the packet is sent or the MCU clears the TXST bit. Transition to RX takes place if RXEN bit is set on high before setting TXST. 20: Transition depends on OFFTM register settings. When TXST or RXEN bits are cleared, radio waits OFFTM number of Base time units and then it turns to OFF mode to save power. To disable automatic transition, set OFFTM to 0xFF. 22: Automatic transition if radio detects a packet being transmitted over air. Preliminary DS70005023C-page 91 MRF24XA 23: Transition after packet reception is over or MCU clears RXEN bit TABLE 4-1: . TRANSITION TIMES Starting State Destination State Radio internal tasks Typ. Transition Time. Power OFF Radio OFF Regulator, XTAL ramp up and Calibra- 1.6 ms(1) tion Pin Reset Radio OFF XTAL ramp up, Calibration 1.4 ms(1) Radio OFF, IDLE, RX DEEP SLEEP Save registers, shut down 1V2 LDO 45 ms(2) DEEP SLEEP Radio OFF Regulator and XTAL ramp up, register 1.6 ms(1) recovery DEEP SLEEP RX Regulator and XTAL ramp up, register 1.65 ms(1) recovery, synthesizer on Radio OFF RX Listen Synthesizer ramp up, Power on RX front end 57 µs Radio OFF TX Frame Synthesizer ramp up, Power on TX front end 52 µs IDLE RX Listen Power on RX front end 6.8 µs IDLE TX Frame Power on TX front end 1.3 µs Radio OFF SLEEP Crystal power off 25 µs SLEEP Radio OFF Crystal ramp up 1.4 ms(1) Note 1: XTAL ramp up time is depending on temperature. Minimum values 1 ms, typical value 1.4 ms, maximum value 3 ms 2: This time is referring to the complete discharge time on the internally regulated 1V2 bus and may depend on the actual capacitance on this network. FIGURE 4-2: TRANSITION FROM DEEP SLEEP TO RX LISTEN POWER-SAVE MODE LNA ramp up: 6 µsec at 13,5mA RX Listen Synthesiser ON: 50 µsec at 7mA XTAL ramp up: 1400 µsec at 1,1mA 1V2 regulator ramp up: 200 µsec at 0,3mA Deep Sleep: 40nA DS70005023C-page 92 Preliminary 2015 Microchip Technology Inc. MRF24XA FIGURE 4-3: MRF24XA TOP LEVEL STATE MACHINE (SIMPLIFIES STATE TRANSITION CHART) Legend: Internal substate RADIO IN PIN RESET automatic transition POWER OFF 1. MCU releases RST 2. Power is turned on user initiated transition DEEP SLEEP 3. SPI-read causes wake-up INIT (RST=0) INIT (RST=1) 4. 5. 8. (if RXEN=1) 7. (if RXEN=0) INITIAL CALIBRATION 11. MCU sets DSLEEP 6. 9. MCU sets XTALDIS SLEEP 11. 11. RADIO OFF RXLISTEN Receiver ON Frame Acquisition 10. MCU clears XTALDIS 12. MCU sets XTALDIS 20. 15. MCU clears RXEN 13 se . MC ts RX U EN RX Listen or RX Listen PSAV IDLE 14. MCU sets RXEN 16. MCU sets TXST 19. 21. 23. 22. 17. MCU sets TXST 18. MCU sets TXST TX FRAME Note: RX FRAME See Section 4.2.4.2 “Detailed Transition Description” for details on the interrupts in connection with state transitions. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 93 MRF24XA Frame sending/reception involves the following steps as shown in the Figure 4-4. (Note: Sending = originator, Receiving = recipient) 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. Originator and Recipient Nodes apply the previously shared (negotiated/global) configurations. Recipient MCU enables reception in the device when the RXEN (1) control bit in the RXCON1 register is set. Originator MCU constructs the payload. Originator MCU constructs the MAC frame header applying the per frame configurations. Originator MCU loads the MAC frame to the device. Originator MCU starts transmit operation when the TXST (1) control bit (MACCON1 register) in the device is set. MAC layer encryption is automatically applied while for network layer encryption Originator device executes in-place processing on the frame. For example, encryption and FCS appending, and checks the Configuration of the frame header that affects the per frame device behavior for this frame (whether an Acknowledge is requested from the recipient). Originator device attempts to send the message to the receiver device. Prior accessing the medium, ensure that no other device is using it on the same channel frequency, or jammed by interferers before sending. The applied procedure is called CSMA-CA. When the channel is clear, it sends the frame. Finally, the device waits for an Acknowledge as the frame is configured to request one. Recipient device receives the frame and parses it. The frame is accepted. The frame can also be rejected due to destination address or FCS mismatch. Recipient device sends an ACK. Recipient device generates an RXIF (1) interrupt to its host MCU when ACK-sending is complete. Since the frame is accepted and acknowledged, RXBUFFUL is set (1) by the device. This protects the frame from being overwritten by a subsequent different frame. Recipient MCU may trigger in-place processing (for example, decryption by setting RXDEC) on the frame after servicing the interrupt. Originator device fails to receive the ACK-frame. Therefore, it starts over transmitting the same frame (retransmission) through CSMA-CA first and then sending follows. DS70005023C-page 94 14. Recipient device receives the retransmitted frame and finds out it is a duplicate. It still sends another ACK-frame to it, but discards the duplicate frame. 15. Originator device receives the ACK and generates a TXIF (1) interrupt to confirm the successful sending to its host MCU. It also clears the TXST (0) control/Status bit. Originator device returns to Reception mode if RXEN = 1 is configured, otherwise it turns to TRXOFF. 16. MCU services the interrupt (TXIF) to learn the confirmation. Transaction is successfully completed. 17. Recipient device completes the in-place decryption of the frame and generates a RXDECIF (1) interrupt to indicate status to its host MCU. 18. Recipient MCU reads the decrypted frame from the buffer and unlocks the buffer when the control/status flag RXBUFFUL (0) of the device is cleared. Preliminary 2015 Microchip Technology Inc. MRF24XA FIGURE 4-4: WIRELESS SENDING: EXAMPLE SCENARIO (MESSAGE SEQUENCE CHART) Originator Node TX Host MCU Medium TX Device TX Configuration (AUTOACKEN=1) 1 2 SPI, INTn Recipient Node RX Device SPI, INTn RX Host MCU RX Configuration (AUTOACKEN=1) = When ACK required then device handles it 1 payload RXEN 4 MHR (SecEn=1) (AckReq=1) 5 1 3 AckReq = Acknowledge required for this frame Wait for RXIF interrupt Load buffer Security Key 6 TXST 1 7 Get AckReq, SecEn Wait for confirmation interrupt Encrypt FCS Append 8 CSMA, Send 9 FCS Check (Accepted) ? Send ACK 10 RXIF RXBUFFULL=1 11 ACK time-out 13 CSMA, Resend 12 Read MHR SecEn=1 14 Duplicate ! Send ACK ACK received 16 Confirmation done TXIF=1, TXST (Interrupt Serviced) 0 RXEC, Security Key 15 New state depends on RXEN Wait for RXDEC interrupt Decrypt Decryption complete 17 RXDECIF Interrupt Serviced Read Payload Buffer unlocked Wait for new frame In-place processing (whether transmitting or receivingside) is tested using a single node. This is useful in device testing or software troubleshooting. Figure 4-5 illustrates the procedure of in-place test using a single node. Note that the Originator and the Recipient node can be the same hardware. 2015 Microchip Technology Inc. RXBUFFULL 18 0 Free the buffer Wait for new frame TXBUF1PP triggers the processing that TXST originally performs. TXIF interrupt is generated at the end of in-place processing, without attempting to physically send the frame. The device clears TXBUF1PP at the same time. Preliminary DS70005023C-page 95 MRF24XA Buffer 1 holds the processed (encrypted, FCSappended) frame. If RXBUF1PP is set, frame filtering is performed and RXIF interrupt is generated. Alternatively, the processing is performed in Buffer 2 (the normal receive buffer) using TXBUF2PP and RXBUF2PP. Note that unlike TXBUF1PP and TXBUF2PP, RXBUF1PP and RXBUF2PP do not automatically clears when RXIF is set but selects which buffer must be processed when RXDEC is issued. FIGURE 4-5: IN-PLACE TEST USING A SINGLE NODE: EXAMPLE SCENARIO (MESSAGE SEQUENCE CHART) Node in Originator Role TX Host MCU TX Device TX Configuration (AUTOACKEN=1) 1 2 SPI, INTn Same Node in Recipient Role RX Device SPI, INTn RX Host MCU AUTOACKEN is ’Don’t Care’ payload 4 MHR (SecEn=1) (AckReq=1) 5 AckReq is ’Don’t Care’ Load buffer Security Key 6 TXBUF1PP 1 7 Get AckReq, SecEn Wait for confirmation interrupt 16 Confirmation done Encrypt Encrypted frame in TX buffer FCS Append (Interrupt Serviced) RX Configuration (AUTOACKEN=x) 8 TXIF Change Role 15 1 13 RXEN 3 1 RXBUF1PP 1 Process TX buffer as if frame was received 9 FCS Check (Accepted) Wait for RXIF interrupt ? RXIF 10 11 14 12 Read MHR SecEn=1 RXEC, Security Key Wait for RXDEC interrupt Decrypt Decryption complete 17 RXDECIF Interrupt Serviced Read Payload Buffer unlocked Wait for new frame DS70005023C-page 96 Preliminary RXBUFFULL 18 0 Free the buffer Wait for new frame 2015 Microchip Technology Inc. MRF24XA 4.3 Global vs. Per Node vs. Per Packet Configurations For certain configurable parameters, the selected options apply to all nodes in a network. The following are the global attributes: • The MAC frame format used in the network (FRMFMT register bit configuration) • The FCS appending and checking method (refer to CRCSZ register bit) • The medium access (CSMAEN register bit configuration 4.3.1 GLOBAL CONFIGURATIONS Global attributes are negotiated through management information travelling in the MAC payload (of the current frame or a previous frame). For example, • Address size in Proprietary MAC framing mode • Network Layer security enabling and security material in IEEE 802.15.4-compliant MAC framing mode These global attributes are shared between all nodes of the network as all the nodes can access the same medium, and the sending and recipient sides must process the frame consistently. 4.3.2 PER PACKET CONFIGURATIONS As opposed to global configurations, per packet attributes vary from packet to packet. For example, • Acknowledge Requested for the current frame (AckReq) • Security Processing enabled for the current frame (SecEn) These attributes must be shared between the originator and the recipient of the frame and must travel with the packet. Prior sending a frame, the originator MCU applies the desired attributes when the respective frame control bits (for example, AckReq, SecEn) in the MAC header of the frame are configured. When the send operation is triggered, the sending device checks these attributes and adapts its (frame processing and sending) behavior accordingly. The receiver device does the same on reception. 4.3.3 PER NODE CONFIGURATION It applies to specific nodes in the network, having a specific role. The auto-repeater functionality (in proprietary MAC mode) is a typical example. Another case is how a node filters frames. A sniffer node must have different Configuration than an ordinary node. This Configuration may also be different since the sniffer must not send acknowledge. 2015 Microchip Technology Inc. 4.4 Features Overview The device supports two Framing modes: • IEEE 802-15.4 standard compliant, see Section 5.0 “IEEE 802.15.4™ Compliant Frame Format and Frame Processing” format • Proprietary format, see Section 6.0 “Proprietary Frame Format and Frame Processing” Hardware support is provided for both the features, but a network must only use one of these in all the nodes. A compromise is offered through Bridging, see Section 8.0 “Bridging”. For the discussion it is helpful to distinguish between Protocol Agnostic and Protocol Dependent. Configuration Options: • The availability and Configuration format of Protocol Dependent options are conditioned on the selected framing protocol whether IEEE 802.15.4compliant or proprietary network operation is required. • In contrast, the availability, behavior and Configuration format of other options are Protocol Agnostic from a device point of view, which means that the Configuration occurs similarly for framing protocol. All Protocol Agnostic options can freely combined with any of the “protocol-dependent” configurations as far as the device constrains it. To comply with the IEEE 802.15.4 protocol, the constraints specified in the standards must be followed, see Table 4-3. Figure 4-6 lists the higher level (MAC layer) Configuration features. • FCS method: Hardware supports the 2-byte long CRC sequence adopted by IEEE 802-15.4. This must be adequate for most applications. In the contrary case, the CRC appending and checking are disabled if CRCSZ = 0. If CRCSZ = 0 then AUTOACKEN = 0 and RXFILTER = 0x00 is required. CRCSZ = 1 is assumed in the discussion. • CSMA is described in Section 4.11 “Carrier Sense Multiple Access-Collision Avoidance (CSMA-CA)” and only requires Packet mode. • Automatic Acknowledgement Reception and Sending is configured as specified in Section 4.12 “Clear Channel Assessment (CCA)”, Section 4.14 “Acknowledge Sending by Recipient” and Section 4.15 “Acknowledge Reception by Originator”. Preliminary DS70005023C-page 97 MRF24XA • In both framing configurations, the device offers support for: frame parsing, frame filtering, frame types, addressing modes applicable to multi-cast and uni-cast frames and security processing. Standard mode operation is described in Section 5.0 “IEEE 802.15.4™ Compliant Frame Format and Frame Processing”. Proprietary mode is described in Section 6.0 “Proprietary Frame Format and Frame Processing” through Section 7.0 “Advanced Link Behavior in Proprietary Packet Mode”. • The following modes are only available in Proprietary modes: Bridging, Link Agility, see Section 7.1 “Channel Agility”, and Auto- FIGURE 4-6: Repeater, see Section 7.3 “Auto-Repeater”. Table 4-2 lists a summary of possible node behaviors and node types. Section 5.0 “IEEE 802.15.4™ Compliant Frame Format and Frame Processing” focuses on the general processing of IEEE 802.15.4compliant and proprietary-format non-streaming frames when the node is non-streaming configured in Packet mode. Differences to this behavior are specified for the other scenarios in the respective sections. MAC LAYER CONFIGURATION OVERVIEW COMMUNICATION ASPECTS AVAILABLE OPTIONS PER PACKET or PER NODE or GLOBAL? PROTOCOLAGNOSTIC: Trailer FCS by HW: yes/no? Global option (typically, but not enforced) Acknowledge Request: yes/no? (if yes, # of retransmissions?) Per packet option Automatic ACK response: yes/no? Per node option CSMA: yes/no? Per packet option Frame Error Detection Link Reliability Multiple Access PROTOCOLDEPENDENT: Frame Parsing IEEE 802.15.4 vs. Proprietary? Frame Filtering Filters by validity, type, address Per node option Type: Data/CMD/ACK/Beacon...? Per packet option Broadcast/Unicast Destination? Per packet option Frame Type Multi-cast Frames Global option (exept for „bridging”) Address Format Dest. Address/Src. Address format? Per packet – in IEEE 802.15.4 Global – in Proprietary mode MAC Layer Security Privacy: yes/no? Frame authenticity: yes/no, MIC-tag size? Per packet enabling option NWK Layer Security Privacy: yes/no? Frame authenticity: yes/no, MIC-tag size? Per packet – in Proprietary mode PROPRIETARY MODE ONLY: Link Agility Air-Data-Rate Adaptation: yes/no? Adapt channel between TX/RX? Per packet option Buffer Handling Packet vs. Streaming Buffer Mode Per packet option Auto-Repeater DS70005023C-page 98 Auto-Repeat Mode Preliminary Per packet and per RX node option 2015 Microchip Technology Inc. MRF24XA TABLE 4-2: SUMMARY OF NODE CONFIGURATION OPTIONS NODE CONFIGURATION Packet Mode TRXMODE (00: Packet Mode) IEEE 802.15.4™ Proprietary Proprietary Repeater 00 00 00 Propr. TX Stream Propr. RX Stream 10 01 FRMFMT (Std:0, Proprietary:1) 0 1 1 1 1 AUTORPTEN (Repeater Node:1) 0 0 1 0 0 FEATURE/FRAME CSMAEN (CSMA enable:1) CRCSZ (CRC 2 bytes: 1, none: 0) AUTOACKEN (Auto-ACK enable:1) (3) Retransmission capability NODE CAPABILITY 0 or 1 0 or 1 0 or 1 0 No TX 1 (or 0) 0 or 1 0 or 1 0 or 1 0 or 1 0 or 1 0 or 1 0 (or 1(1)) 0 0, ignore 1 Yes Yes No No No 1 RX, 1 TX 1 RX, 1 TX 2 TRX 2 TX 2 RX With IEEE 802.15.4 Frames, capability to: TX, RX RX (TX) (4) (bridging) discard n/a discard With Proprietary Non-Streaming Type of Frames (Repeat:0/1), capability to: discard TX, RX Repeat if Repeat = 1 n/a discard With Proprietary Streaming Type of Frames, capability to: discard RX (sets on RXStreaming) discard TX RX Available Available None No Yes Buffer Handling Security Processing Channel Agility Support for ACK-ing PHY-features n/a available but impractical n/a n/a Same for all Available Data Rates All(2) All All All All On-the-fly receiver rate adaptation Yes Yes Yes Yes Yes DSSS Yes Yes Yes Yes Yes Note 1: 2: 3: 4: Proprietary frames requesting both Acknowledge and repeat are not recommended if any of the repeaters has AUTOACKEN = 0, and vice versa. Setting all of these may cause issues. Although 250 kbps is the only data rate that ensures compliance to the IEEE 802.15.4 standard, however as an extension, the other data rates can also be used with the standard MAC format, which may be easier to integrate with the legacy software. CRCSZ = 0 has no practical use in Standard-Format mode. If CRCSZ = 0 then AUTOACKEN = 0 and RXFILTER = 0x00 is required. Acknowledge sending is solved. To send a frame, the transmitter changes FRMFMT for the sending. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 99 MRF24XA REGISTER 4-1: MACCON1 (MAC CONTROL 1 REGISTER) ADDRESS: 0x10 R/W-00 R/W-001 R/W-1 R/W-0 R/W-0 TRXMODE<1:0> ADDRSZ<2:0> CRCSZ FRMFMT SECFLAGOVR bit 7 bit 0 Legend: R = Readable bit -n = Value at POR W = Writable bit U = Unimplemented bit, read as ‘0’ ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-6 TRXMODE<1:0>: TX/RX Mode Select Field bits 11 = Reserved 10 = TX-Streaming mode. In this mode, use both buffers for packet transmission. When issuing TRXMODE = 10, RXEN is cleared. SPI addresses 0x200 to 0x27F access Buffer 1 or Buffer 2 in alternation. Access to 0x37F through 0x383 has non-defined effect. 01 = RX-Streaming mode. In this mode, use both buffers for packet reception. When issuing TRXMODE = 01, TXST and TXENC/RXDEC bits are cleared and RXEN is set. SPI addresses 0x300 to 0x383 access Buffer 1 or Buffer 2 in alternation. In this mode, Proprietary mode packets other than streaming type are automatically discarded. Access to 0x200 through 0x283 has non-defined effect. 00 = Packet mode. In this mode, Buffer 1 is used as a transmit and Buffer 2 is used as a receive packet buffer. SPI addresses from 0x200 to 0x27F access Buffer 1. SPI addresses 0x300 to 0x383 access Buffer 2. TRXMODE = 00 is mandatory when FRMFMT = 0. ADDRSZ<2:0>: Source/Destination Address Size Field bits(1, 2) bit 5-3 The size of the Source and Destination addresses for Proprietary packet. Note that this field has no effect on the processing IEEE 802.15.4 frames. 111 = 8 octets 110 = 7 octets 101 = 6 octets 100 = 5 octets 011 = 4 octets 010 = 3 octets 001 = 2 octets 000 = 1 octet bit 2 CRCSZ: CRC Size bit This bit indicates the size of the CRC field in each packet. 1 = 2 octets 0 = 0 octet FRMFMT: MAC Frame Format Adopted by the Network bit(3) bit 1 This bit determines the frame format used in the network. 1 = Proprietary 0 = IEEE 802.15.4 standard compliant bit 0 SECFLAGOVR: Security Flag Override bit The user can override security flags used in the CCM-CTR, CBC-MAC and CCM operation, otherwise the device uses the standard (2003/2006) definition. Note 1: 2: 3: Zero-length address occurs when the corresponding DAddrPrsnt/SAddrPrsnt bits of the packet Frame Control field are set to ‘0’. Use the ADDRSZ field while receiving and transmitting, and must not be modified while RXEN or TXST is set. Use the FRMFMT field while receiving and transmitting, and must not be modified while RXEN or TXST is set. In Debug mode, this register bit is used to determine the frame format for both Tx/Rx frame in the packet buffers. DS70005023C-page 100 Preliminary 2015 Microchip Technology Inc. MRF24XA 4.5 Protocol Selection and Constraints In category 1, the Proprietary Features are not used. The constraints listed in Table 4-3 must be applied. A significant limitation is that IEEE 802.15.4 only allows using a single air-data-rate, 250 kbps. Applications typically fall into two categories: • Category 1: Standard compliant operation is required exclusively • Category 2: Standard compliant operation is not required, capability to form a gateway to standard network is sufficient: - Green-field development. Proprietary MAC framing is optimal. - Legacy software is better served when the standard MAC frame format is applied, although the network is not required to use IEEE 802.15.4 standard modulation formats over the air. TABLE 4-3: In category 2, these constraints are relieved and the network may either adopt the proprietary (FRMFMT = 1) or the IEEE 802.15.4 MAC (FRMFMT = 0) frame formats which fits better with the conditions. In either options, the network can use all the air-data-rates. A gateway to a standard network is formed through Bridging, see Section 8.0 “Bridging”. The Physical Layer Configuration is described in Section 9.0 “Physical layer Functions”. THE IEEE 802.15.4™ STANDARD CONSTRAINTS Register Field Default on Reset Frame Format FRMFMT 0 0 (std. frame format) Buffer Handling TRXMODE 00 00 (Packet mode) DR<2:0> 011 RATECON<7:2> 000000 (all enabled) Parameter Description Sender Data Rate Receiver Data Rate Reject Filter (otherwise data rate is adapted on-the-fly, per frame) FCS (CRC) size (0 or 2 bytes) IEEE 802.15.4™ constraint/recommendation 011 (TX 250 kbps) 111101 (only enable: RX 250 kbps, SFD = 0xA7) CRCSZ 1 1 (2 byte CRC appended) CRCREJ 1 1 (CRC match enforced) Frame rejection filter RXFILTER<7:0> 0x7F Duplicate Rejection IDENTREJ 0 Frame rejection on CRC mismatch 0x40 (frame rejection only on CRC mismatch) 1 (discard duplicates) Automatic Acknowledge Handling (send/receive) AUTOACKEN 0 Base time units applied by TXACKWAIT and RXACKWAIT BASETM<4:0> 00010 (2 µs) RXACKWAIT<7:0> 0x60 0x0C (must be >= 192 µs) TXACKTO<7:0> 0x80 (256 µs) 0x36 (must be >= 864 µs) Wait duration (in base units) before Acknowledge sending (by the data frame recipient) Time-out duration (in base units) for Acknowledge reception (by the data originator) 1 (Auto ACK enabled) 10000 (must be a divisor of 16 µs) CSMA medium access enabled CSMAEN 1 1 (CSMA enabled) CCA Mode (energy vs. carrier) CCAMODE(1) 01 01 (4 options allowed) CCALEN(1) 01 10 (128 µs) EDthreshold(1) 0x32 (-88 dBm) EDMODE(1) 0 EDLEN(1) 0xE CCA Measurement Duration CCA Energy Threshold Energy Detect Mode (1: 128 us, 0: variable duration) Energy Detect Duration Note 1: Note: 0x46 (-78 dBm; must be <-75 dBm 0 (EDLEN applies) 0xE (15.360 ms; must be repeated multiple times) For more information on Physical Layer Configuration, see Section 9.0 “Physical layer Functions”. “Proprietary” is not equivalent to “full-custom”. The LENGTH field and Frame Control field must be used as described. (The transmitter processing of the FrameCtrl.SecEn bit cannot be disabled.) The payload portion can still carry customized management information that is processed in software. It is recommended that FRMFMT = 1 be used with NSTDREJ = 1 if a gateway is not required. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 101 MRF24XA 4.6 Frame-On-Air/Air-Data-Rate The Recipient sends the Acknowledge using the same frame format as the acknowledged frame, except for the agility, see Section 7.1 “Channel Agility”. The Originator must set RATECON<7:2> adequately to receive the ACK frame. In the Originator of the frame, FRMFMT and DR<2:0> select the air-data-rate and the frame format. The PRMBHLD bit indefinitely holds out the preamble. For more information on register definitions, refer to Register 4-2. RATECON<1> selects between Legacy and Optimal PHY frame format. This is set independently from the rate or the MAC protocol using the MAC operation. The recipient of the frame can receive the frame formats that FRMFMT and RATECON<7:2> selects. FIGURE 4-7: FRAME-ON-AIR/AIR-DATA-RATE PRMBHLD Preambulum SFD MAC Frame Length Preamble type: DS70005023C-page 102 FRMFMT: Legacy: 192 µs fix 0 IEEE 802.15.4™ standard compliant Optimal: Duration scales reciprocally with DR 1 Proprietary Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 4-2: RATECON (RATE CONFIGURATION REGISTER) ADDRESS: 0x36 R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-1 R/W-1 DIS2000 DIS1000 DIS500 DIS250 DISSTD DIS125 OPTIMAL PSAV bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7 DIS2000: Disable 2 Mbps Frame Reception bit If this bit is set, then reception of 2 Mbps frames is disabled. bit 6 DIS1000: Disable 1 Mbps Frame Reception bit If this bit is set, then reception of 1 Mbps frames is disabled. bit 5 DIS500: Disable 500 kbps Frame Reception bit If this bit is set, then reception of 500 kbps frames is disabled. bit 4 DIS250: Disable 250 kbps Frame Reception bit If this bit is set, then reception of 250 kbps frames with non-standard-compliant SFD patterns is disabled. bit 3 DISSTD: Disable IEEE 802.15.4 compliant Frame Reception bit If this bit is set, then reception of 250 kbps frames with IEEE 802.15.4 compliant SFD patterns is disabled. bit 2 DIS125: Disable 125 kbps Frame Reception bit If this bit is set, then reception of 125 kbps frames is disabled. bit 1 OPTIMAL: Optimized Preamble Selection bit When this bit is set, then optimized preamble is used instead of legacy. 1 = Optimized preamble 0 = Legacy preamble bit 0 PSAV: Power-Save Mode Selection bit When this bit is set, frame detection is dependent on the RSSI signal, and the receive signal processor is turned on when a sudden and significant increase (PSAVTHR<3:0>) is detected in the signal strength or the signal strength is above an absolute level (DESENSTHR<3:0>). 1 = Power-Save mode 0 = Hi-Sensitivity mode 2015 Microchip Technology Inc. Preliminary DS70005023C-page 103 MRF24XA REGISTER 4-3: MACCON1 (MAC CONTROL 1 REGISTER) ADDRESS: 0x10 R/W-00 R/W-001 R/W-1 R/W-0 R/W-0 TRXMODE<1:0> ADDRSZ<2:0> CRCSZ FRMFMT SECFLAGOVR bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-6 TRXMODE<1:0>: TX/RX Mode Select Field bits 11 = Reserved 10 = TX-Streaming mode. In this mode, use both buffers for packet transmission. When issuing TRXMODE = 10, RXEN is cleared. SPI addresses 0x200 to 0x27F access Buffer 1 or Buffer 2 in alternation. Access to 0x37F through 0x383 has non-defined effect. 01 = RX-Streaming mode. In this mode, use both buffers for packet reception. When issuing TRX MODE = 01, TXST and TXENC/RXDEC bits are cleared and RXEN is set. SPI addresses 0x300 to 0x383 access Buffer 1 or Buffer 2 in alternation. In this mode, Proprietary mode packets other than streaming type are automatically discarded. Access to 0x200 through 0x283 has non-defined effect. 00 = Packet mode. In this mode, Buffer 1 is used as a Transmit while Buffer 2 as a Receive packet buffer. SPI addresses from 0x200 to 0x27F access Buffer 1. SPI addres ses 0x300 to 0x383 access Buffer 2. TRXMODE = 00 is mandatory when FRMFMT = 0. bit 5-3 ADDRSZ<2:0>: Source/Destination Address Size Fields bits(1, 2) The size of the Source and Destination addresses for Proprietary packet. Note that this field has no effect on the processing IEEE 802.15.4 frames. 111 = 8 octets 110 = 7 octets 101 = 6 octets 100 = 5 octets 011 = 4 octets 010 = 3 octets 001 = 2 octets 000 = 1 octet bit 2 CRCSZ: CRC Size bit This bit indicates the size of the CRC field in each packet. 1 = 2 octets 0 = 0 octet bit 1 FRMFMT: MAC frame format bit adopted by the network bit(3) This bit determines the frame format used in the network. 1 = Proprietary 0 = IEEE 802.15.4 standard compliant. bit 0 SECFLAGOVR: Security Flag Override bit The user can override security flags used in the CCM-CTR, CBC-MAC and CCM operations, otherwise the device uses the standard (2003/2006) definition. Note 1: 2: 3: Zero-length address occurs when the corresponding DAddrPrsnt/SAddrPrsnt bits of the packet Frame Control field are set to ‘0’. Use ADDRSZ field while receiving and transmitting, and must not be modified while RXEN or TXST is set. Use FRMFMT field while receiving and transmitting, and must not be modified while RXEN or TXST is set. In Debug mode, this register bit is used to determine the frame format for both Tx/Rx frame in the packet buffers. DS70005023C-page 104 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 4-4: BBCON (BASEBAND CONFIGURATION REGISTER) R/W-0 R/W-0 RNDMOD AFCOVR R/W-11 R/W-0 ADDRESS 0x38 R/W-001 RXGAIN<1:0> PRMBHOLD PRMBSZ<2:0> bit 7 Legend: bit 0 W = Writable bit -n = Value at POR R = Readable bit U = Unimplemented bit, read as ‘0’ ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 RNDMOD: Random Modulation bit If this bit is set, the transmitter randomly transmits DSSS symbols or MSK chips if PRMBHOLD bit is set. The purpose of this register is only for testing. bit 6 AFCOVR: AFC Override bit If this bit is set, the receiver uses CFOMEAS register as the CFO in reception. bit 5-4 RXGAIN<1:0>: Receiver Gain Register Field bits If this bit is set, the AGC operation is inhibited in the receiver and the receiver radio gain Configuration is selected between three different gain levels. Encoding: 11 = AGC operation is enabled (default value) 10 = High gain 01 = Middle gain 00 = Low gain This feature is used for test and streaming purposes. To reduce the required interframe-gap, the RXGAIN must set to one of the fixed gain options when the MAC is in Streaming mode. bit 3 PRMBHOLD: Preamble Hold Enable bit Effect: Appends extra bytes to the transmitted preamble in endless repetition until it is cleared. Details: The hardware checks this bit during transmission before finishing the preamble. The DR<2:0> and the register OPTIMAL determine the appropriate preamble byte and applies the modulation format. When this flag is released the transmission of the current preamble byte is completed followed by transmitting the LENGTH field and the payload. 1 = Enable endless preamble repetition 0 = Disable/stop endless preamble repetition bit 2-0 PRMBSZ<2:0>: Preamble Size Adjustment Field bits Enables adjusting the transmitted preamble length when OPTIMAL = 1. Encoding: 500 kbps preamble length = (PRMBSZ<2> + 4) units, where unit = 16 μs (1 octet at 500 kbps) 1 Mbps preamble length = (PRMBSZ<1:0> + 8) units, where unit = 4 μs (1 octet at 2 Mbps) 2 Mbps preamble length = (PRMBSZ<1:0> + 8) units, where unit = 4 μs (1 octet at 2 Mbps) This register field does not affect the Legacy frames and 125/250 kbps optimized frames. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 105 MRF24XA 4.7 Security Suites MRF24XA provides extensive hardware support for security suites defined in 802.15.4-2003/2006 standard. The security suites are based on the AES-128 block cipher transformation. Block ciphers are ciphers that work on a plaintext block of a fixed length to produce a ciphertext block of the same length. Given a particular Key (K), there is a 1-to-1 correspondence between the Plaintext Block (P) and the Ciphertext Block (C). • Encryption operation: Ci = EK(Pi ) Ciphertext block (i) is produced by Encrypting Plaintext block (i) using key K. • Decryption operation: Pi = DK(Ci ) Plaintext block (i) is produced by Decrypting Ciphertext block (i) using key K. 4.7.1 ELECTRONIC CODE BOOK MODE (ECB) The simple usage of the block cipher is known as ECB mode. There are several issues in using a block cipher in ECB mode to encrypt data. Each plaintext block is encrypted to the same ciphertext block and it is possible to associate the ciphertext block with an event without knowing that the plaintext block itself. To trigger the event, user can resend the ciphertext block, a process known as Replay Attack. In addition, most block cipher algorithms in ECB mode do nothing to scramble repetitive data, making the plaintext block reversible from the ciphertext block. 4.7.2 COUNTER MODE (CTR) In CTR mode, each chipertext block is produced by XOR'ing, the plaintext block with the encrypted version of a counter input. The initial value of the counter serves as the Initialization Vector (IV) for the message block, and may be changed for each message block. Although the term “counter” is used, this does not mandate the use of a true counter. An easy-to-compute function, which is practically non-repeating (at least for a long time) may be used. CTR mode may be 100% parallelized for both encryption and decryption. Where, ENCFLAGS is defined by the standard (0x82), SECNONCE is defined in the standards and CTRi is a 2 byte block counter. If the last block of the plaintext is not 16 byte, it is zero-padded and only the required number of MSB bytes is used in the XOR operation. The host can override ENCFLAGS field when the SECFLAGOVR bit in MACCON1 register is enabled, and the new flags through SECENCFLAG register is set. The host can overwrite the SECNONCE register anytime through SECNONCE1..13 registers. 802.15.4-2006 does not define CTR mode. 4.7.3 CIPHER BLOCK CHAINING MODE (CBC) In CBC mode, each plaintext block is XOR’ed with the result of the previous block encryption operation before being encrypted. In this way all plaintext blocks depend on the previous block, making it difficult to remove, add or change individual blocks without detection. In addition, the encryption for the first block is performed using XOR of the plaintext block and an Initial Value (IV). This initial value changes for each message, making it more resistant to Replay Attacks. MRF24XA does not support CBC mode. 4.7.4 CIPHER BLOCK CHAINING MESSAGE AUTHENTICATION CODE MODE (CBC-MAC) A CBC-MAC protects the authenticity of a message, and therefore implicitly its integrity. The algorithm takes the variable length input message and a secret key, and produces a MIC TAG (MIC and MAC terms are often used interchangeably). Any change to the content of the message results in a change of the MIC tag, which guarantees the integrity of the message. As the same message with a different secret key also produces a different MIC tag, a MAC mode also provides protection of authenticity. 802.15.4-2003 defines CBC-MAC mode as follows: P = {LENGTH, MACHDR, MACPAYLOAD} O1 = EK(P1) Loop on each 16 byte block of plaintext 802.15.4-2003 defines CTR mode as follows: Oi = EK(Pi xor Oi -1) CTR0 = 0 End Loop on each 16 byte block of plaintext MICTAG is the leftmost M bit of Oend Ci = Pi xor EK({ENCFLAGS, SECNONCE, CTRi}) CTRi+1 = CTRi+1 Where LENGTH is the number of bytes to be authenticated (MAC header and payload). End 802.15.4-2006 does not define CBC-MAC mode. DS70005023C-page 106 Preliminary 2015 Microchip Technology Inc. MRF24XA 4.7.5 4.8 AUTHENTICATE AND ENCRYPT BLOCK CIPHER MODE (CCM*) Buffer Processing in Non-Secured Sending This mode is a combination of CTR mode (encryption) and CBC-MAC mode (authentication). Initially, CBCMAC is applied to compute the MIC tag. CTR mode (encryption) is only performed on a selected portion of the authenticated message and the MIC tag. Different combination of authentication and encryption are formed. General Frame processing as shown in Figure 4-8, applies when AUTORPTEN = 0. Unsecured frame (SecEn = 0) is not an Acknowledgement and CRCSZ = 1. Acknowledgement is transmitted or received by software (AUTOACKEN = 0) and CRCSZ = 1 (ACK may contain piggyback data in the payload, at the discretion of the host software). 802.15.4-2003/2006 defines CCM* mode as follows: In Figure 4-8, note the following: P = {AUTHENTICATION FLAG, NONCE, LENGTH, MACHEADER, MACPAYLOAD} • Transmit buffer is the buffer starting at 0x200, whereas the Receive Buffer is the buffer starting at address 0x300 (this also applies for Streaming mode). • In the Transmit Buffer, FCS is automatically appended to the frame, and the LENGTH field is also automatically incremented. • The Receive buffer holds the FCS appended frame, and the according LENGTH. RSV is appended to the frame. Note the ordering of the RSV fields. RSV appending does not affect the LENGTH field. O1 = EK(P1) Loop on each 16 byte block of plaintext Oi = EK(Pi xor Oi -1 ) End MICTAG is the leftmost M bit of Oend AUTHENTICATION FLAG: Reserved || Adata || M || L The following cases are not described in this data sheet: • Processing of secured frames (SecEn = 1) is presented in Section 5.3 “Security Material”. • When AckReq = 1 (implying TXRXMODE = 00, CRCSZ = 1), then the Acknowledge frame is generated or accepted on-the-fly: without writing or reading the buffers (If CRCSZ = 0 then the CRC appending does not take place and Acknowledge is always processed by software: AUTOACKEN = 0). • Repeater mode is described in Section 7.3 “Auto-Repeater”. FIGURE 4-8: GENERAL FRAME PROCESSING TX buffer loaded: Length MHR Payload Length MHR Payload /LENGTH up to payload TXST set by host TX buffer processed: /LENGTH up to CRC CRC / if CRCSZ = 1 in Transmitter RXIF interrupt received, RXBUFFUL is set. (RSV appending enabled in: RXCON2) RX buffer holds Length MHR Payload CRC RSV /LENGTH up to CRC / if CRCSZ = 1 in Receiver MAC Frame 2015 Microchip Technology Inc. Preliminary DS70005023C-page 107 MRF24XA 4.9 Frame Transmission in Packet Mode FIGURE 4-9: TRANSMITTER PROCESSING IN PACKET MODE TXST 1 BUF1TXPP 1 Select BUF1 Select BUF1 BUF2TXPP 1 In place processing test Select BUF2 TX MHR parsing Fail (invalid format) Parsable? FRMIF 1 Pass Figure 5-7 Tx Security Figure 5-9 Processing if required if CRCSZ = 1 FCS appending 1 TXSZIF Size run over 127 bytes: TXSZIF = 1 0 0 (In-place test only) TXST TXIF 1 1 TXRETCCNT 0 Reset retransmission count CSMA-CA 1 TXCSMAIF 0 ACK required? Medium access failure: TXCSMAIF = 1 No (Sending complete) TXIF 1 TXIF 1 TXIF 1 AckReq = 1 Yes Figure 4-12 Acknowledge Reception ACK received? Yes (success) No Increment TXRETCCNT No TXRETCCNT >= TXRETMCNT Yes (failure) Max. retransmissions reached BUF1TXPP 0 BUF2TXPP 0 TXST 0 TXBUFEMPTY 1 Interrupt Service DS70005023C-page 108 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 4-5: TXCON (TRANSMIT CONTROL REGISTER) ADDRESS: 0x12 R/W/HC-0 R/W-0 R/W/HC-0 R/HS/HC-1 R/W-1 R/W-011 TXST DTSM TXENC TXBUFEMPTY CSMAEN DR<2:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 x = Bit is unknown TXST: Transmit Start bit 1 = Starts the transmission of the next TX packet(1, 2). 0 = Termination of current TX operation, which may result in the transmission of an incomplete packet Hardware clear: • After the packet is successfully transmitted (including all attempted retransmissions, if any), the hardware clears this bit and sets the TXIF and IDLEIF. • If the packet transmission fails due to a CSMA failure, then this bit is cleared, and TXCSMAIF is set. • If Acknowledge is requested (AckReq bit field in the transmitted frame is set) and not received after the configured number of retransmissions (TXRETMCNT), then TXST bit is cleared and a TXACKIF is set. • In TX-Streaming mode (TRXMODE), TXST is set even when it is already set, resulting in a posted start. When the current TX operation completes, the posted start immediately starts afterward. Clearing of the TXST bit clears both the current and the posted (pending) TX starts. TXOVFIF is set when TXST = 1, a posted start is present and a Host Controller write to the packet buffer occurs. Outside of TX-Streaming mode, writes to TXST when TXST is already set is ignored. Clearing this bit aborts the current operation in the following cases: • • • • When transmitting a packet in Packet mode or in TX-Streaming mode When waiting for an ACK packet after a transmission During the CSMA CA algorithm When transmitting a repeated frame This field is read at any time to determine if the TX operation is in progress. DTSM: Do Not Touch Security Material bits(2) 1 = Device do not change the security material configured by the host MCU 0 = Device tries to configure the security material related registers bit 6 MCU must fill the following registers: SECNONCE, SECHDRINDX, SECPAYINDX and SECENDINDX. bit 5 TXENC: TX Encryption Setting this bit starts TX security processing (authentication or encryption, or both) of the packet in the buffer it was last written. TXENC is cleared and TXENCIF is set when the processing is complete. TXENC must be issued when NWK layer security must be processed. 802.15.4-2003/2006 MAC layer security operation is automatically performed when TXST bit is set. This field must not be modified while TXST is set. Note 1: 2: Transmission may include automatic security processing, CRC appending, CSMA-CA channel access, Acknowledge reception and retransmissions depending on the register Configuration and the Frame Control field of the frame to be transmitted. Setting TXST bit in either Sleep/RFOFF state, device transits to TX state for packet transmission. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 109 MRF24XA REGISTER 4-5: bit 4 TXCON (TRANSMIT CONTROL REGISTER) (CONTINUED) ADDRESS: 0x12 TXBUFEMPTY: TX Buffer Empty bit TXBUFEMPTY = 1 indicates that the host MCU can safely start writing a new frame to the buffer without overwriting any content that is in use. Writing a single byte to the buffer causes this bit to be cleared. TXBUFEMPTY = 0 does not prevent the host from writing further bytes to the buffer. TXBUFEMPTY is set by the device when transmission is complete. 1 = MCU can safely start writing a new frame to the buffer 0 = Buffer is full, or being written to When TRXMODE = 00: (PACKET) mode is configured then TXBUFEMPTY is set at the same time as TXST is cleared. An interrupt is also generated. Therefore, this bit provides no extra information. When TRXMODE = 10: (TXSTREAMING) mode is configured then TXBUFEMPTY is set at the same time as one of the buffers becomes free, while TXST may be set. Therefore, the host MCU uses TXBUFEMPTY to ensure that it can start loading the next frame to the buffers without overwriting a packet being sent (TXOVFIF). bit 3 CSMAEN: CSMA-CA Enable bit This bit enables CSMA-CA algorithm before transmission. 1 = CSMA-CA enabled 0 = CSMA-CA disabled bit 2-0 DR<2:0>: Transmit Data Rate Field bits 111 = Reserved 110 = 2 Mbps 101 = 1 Mbps 100 = 500 kbps 011 = 250 kbps 010 = 125 kbps 001 = Reserved 000 = Reserved When transmitting an Auto-ACK frame with Adaptive Data Rate in response to a received frame, the AckDataRate field in the received frame automatically determines the data rate of the PHY, and not by this Register field. In all other cases, use this Register field as the current PHY data rate when transmitting. The PHY determines the data rate for all received frames regardless of this Register field and the Adaptive Data Rate Configuration. For more information, refer to Register 4-2. Note 1: 2: Transmission may include automatic security processing, CRC appending, CSMA-CA channel access, Acknowledge reception and retransmissions depending on the register Configuration and the Frame Control field of the frame to be transmitted. Setting TXST bit in either Sleep/RFOFF state, device transits to TX state for packet transmission. DS70005023C-page 110 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 4-6: PIR2 (PERIPHERAL INTERRUPT REGISTER 2) ADDRESS: 0x05 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 TXIF TXENCIF TXMAIF TXACKIF TXCSMAIF TXSZIF TXOVFIF FRMIF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set x = Bit is unknown bit 7 TXIF: Transmission Done Interrupt Flag bit The current TX operation (TXST) his successfully completed. This event is unchanged when a hardware generated ACK packet is transmitted or when a packet is repeated. Nonpersistent, cleared by SPI read. bit 6 TXENCIF: Transmit Encoding Interrupt Flag bit The TX packet was successfully encrypted or complemented, or both with a Message Integrity Code (MIC). Set by the device after TXENC = 1, when TXENC is cleared. Nonpersistent, cleared by SPI read. bit 5 TXMAIF: Transmitter Medium Access Interrupt Flag bit Set by the device when the medium is accessed, specifically when the first sample in the preamble is transmitted into the air. Nonpersistent, cleared by SPI read. bit 4 TXACKIF: Transmission Unacknowledged Failure Interrupt Flag bit Set by the device when Acknowledge is not received after the configured maximum number of transmission retries RETXMCNT<3:0>, provided that the Frame Control field of the transmitted frame indicates AckReq = 1. Nonpersistent, cleared by SPI read. bit 3 TXCSMAIF: Transmitter CSMA Failure Interrupt Flag bit Set by the device when CSMA-CA finds the channel busy for BOMCNT<2:0> number of times, provided that CSMAEN = 1 is configured. Nonpersistent, cleared by SPI read. bit 2 TXSZIF: Transmit Packet Size Error Interrupt Flag bit Following TXST is set the packet size (including MIC tags and CRC) is found to be zero or to be greater than the maximum size that the buffers can support. Nonpersistent, cleared by SPI read. bit 1 TXOVFIF: Transmitter Overflow Interrupt Flag bit The Host Controller attempted to write a TX buffer that was not empty (TXBUFEMPTY = 0). Nonpersistent, cleared by SPI read. bit 0 FRMIF: Frame Format Error Interrupt Flag bit Set if the transmitter/receiver fails to parse the frame in the buffer (it is not as it must be or it is corrupted in demodulation). 2015 Microchip Technology Inc. Preliminary DS70005023C-page 111 MRF24XA REGISTER 4-7: PIR4 (PERIPHERAL INTERRUPT REGISTER 4) ADDRESS: 0x07 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 TXSFDIF RXSFDIF ERRORIF WARNIF EDCCAIF GPIO2IF GPIO1IF GPIO0IF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 x = Bit is unknown TXSFDIF: Transmit SFD Sent Interrupt Flag bit Set by the device when the last sample of the SFD field is sent into the air. Nonpersistent, cleared by SPI read. bit 6 RXSFDIF: Receive SFD Detected Interrupt Flag bit Set by the device when the SFD field of the received frame is detected. Nonpersistent, cleared by SPI read. bit 5 ERRORIF: General Error Interrupt Flag bit Set by the device, when malfunction state is reached. bit 4 WARNIF: Warning Interrupt Flag bit Set by the device when one of the following occurred: • Battery voltage drops below the threshold given by BATMON<4:0> • Resistor on pin 28 is missing or not connected well bit 3 EDCCAIF: Energy Detect/CCA Done Interrupt Flag bit Set by the device when Energy-detect or CCA measurement is complete (following that the host MCU has set the EDST/CCAST bit to start the measurement and the device is clearing it in on completion). Nonpersistent. Cleared by SPI read. bit 2 GPIO2IF: GPIO2 Interrupt Flag bit Set by the device if the GPIOMODE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. bit 1 GPIO1IF: GPIO1 Interrupt Flag bit Set by the device if the GPIOMODE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. bit 0 GPIO0IF: GPIO0 Interrupt Flag bit Set by the device if the GPIOMODE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. DS70005023C-page 112 Preliminary 2015 Microchip Technology Inc. MRF24XA 4.10 Frame Reception in Packet Mode FIGURE 4-10: RECEIVER OPERATION (IF AUTORPTEN = 0) MCU:RXEN 1 while TXST = 0 TXST 0 while RXEN = 1 RXListen Operation Frame acquired? No Yes RXSFDIF 1 Frame Reception Abort Events MCU:EDST/CCAST while in RxListen 1 Abort RXLISTEN or Frame Reception MCU:RXEN Abort RXLISTEN or Frame Reception Enter RXListen Operation disabling Acquisition 2015 Microchip Technology Inc. MCU:TXST 1 while in RxListen Abort RXLISTEN or Frame Reception Do Transmission Do ED/CCA measurement EDCCAIF 0 TXST 0 by device Or abortion: TXST 0 by host 1 Preliminary DS70005023C-page 113 MRF24XA FIGURE 4-11: FRAME RECEPTION IN PACKET MODE (TRXMODE = 00) Frame loaded to buffer for debug Frame received over the Medium RXSFDIF 1 by device BUF1RXPP BUF2 selected Yes 1 BUF2RXPP BUF1 selected 1 BUF2 selected 1 duplicate? RXBUFFUL? No RXOVFIF 0 1 Exit with failure. Packet discarded. Earlier packet kept. (RXBUFFUL = 1) Acknowledge sending is always bypassed in debug LENTGH and MAC frame written into buffer RSV appending MHR parsing Fail FRMIF Parsable? 1 Pass FCS-check RXFILTER Figure 4-13 Yes (discard) Rejected? RXFLTIF 1 No (accepted) RXIDENTIF 1 if duplicate RXIDENTIF 1 No ACK Required? Acknowledge must be sent for duplicated frames if AckReq = 1. AckReq = 0 OR AUTOACKEN = 0 OR debug (BUF1RXPP or BUF2RXPP) Yes Auto ACK-sending 1 RXIDENTIF 0 Figure 5-15 Security Material Retrieval support RXBUFFUL RXIF 1 1 Exit with success (RXBUFFUL = 1) DS70005023C-page 114 Preliminary Exit with failure Packet discarded (RXBUFFUL = 0) Software reads the buffer content, may decide on proceeding to security processing ( Figure 5-16 ); finally, frees up the buffer by clearing RXBUFFUL. 2015 Microchip Technology Inc. MRF24XA REGISTER 4-8: RXCON1 (MAC RECEIVE CONTROL 1 REGISTER) R/W/HC/HS-0 R/W-0 R/W/HC-0 R/W-1 R/W-1 RXEN NOPA RXDEC RSVLQIEN RSVRSSIEN ADDRESS: 0x15 R/W-1 R/W-1 R-0 RSVCHDREN RSVCFOEN bit 7 r bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set x = Bit is unknown bit 7 RXEN: Receive Enable Field bit This bit Enables/Disables the packet reception. If an RX packet is currently being received, clearing this bit causes that packet to be discarded. 1 = RX enabled 0 = RX disabled Hardware clear/set when: • Cleared when TRXMODE is set to TX-Streaming mode • Set when TRXMODE is set to RX-Streaming mode Clearing this bit aborts the current operation in the following cases: • Receiving a packet in Packet mode or in RX-Streaming mode Changes to most RX related settings must be only done when this bit is cleared. The clear channel assessment (CSMAEN) and ACK-frame reception does not require RXEN = 1 as the device turns the radio into RX when needed, irrespective of the status of the RXEN bit. bit 6 NOPA: No Parsing bit This bit disables packet parsing. Only CRC is checked if it is enabled. This feature is useful in Sniffer mode. 1 = Disable packet parsing 0 = Enable packet parsing bit 5 RXDEC: RX Decryption bit Setting this bit starts RX security processing (authentication or decryption, or both) on the last received packet. 1 = RX security processing started/in process. RXDECIF or RXTAGIF is set. 0 = RX security processing inactive or complete This bit clears itself after RX decryption is completed. bit 4 RSVLQIEN: Receive Status Vector LQI Enable bit If this bit is set, the measured Link Quality is appended after the received frame in the packet buffer. 1 = Append LQI field 0 = Do not append LQI field bit 3 RSVRSSIEN: Receive Status Vector RSSI Enable bit If this bit is set, the measured RSSI is appended after the received frame in the packet buffer. 1 = Append RSSI field 0 = Do not append RSSI field bit 2 RSVCHDREN: Receive Status Vector Channel/MAC Type/Data Rate Enable bit If this bit is set, Channel, MAC type and Data Rate configurations used with the received frame are appended after the received frame in the packet buffer, using the encoding specified for CH<3:0>, FRMFMT and DR<2:0> (concatenated in this order when most significant bit (MSb) is first). 1 = Append Channel, MAC type and Data Rate fields 0 = Do not append Channel, MAC type and Data Rate fields bit 1 RSVCFOEN: Receive Status Vector CFO Enable bit If this bit is set, the estimated Carrier Frequency Offset of the received frame is appended after the received frame in the packet buffer, using the same encoding as CFOMEAS register. 1 = Append CFO estimation 0 = Do not append estimated CFO bit 0 Reserved: Maintain as ‘0’ 2015 Microchip Technology Inc. Preliminary DS70005023C-page 115 MRF24XA REGISTER 4-9: RXCON2 (MAC RECEIVE CONTROL 2 REGISTER) ADDRESS: 0x16 R/C/HS-0 R/W-0 R-0 RXBUFFUL IDENTREJ ACKRXFP R/W-0 R/W-0 R/W-0 R/W-0 ACKTXFP AUTORPTEN AUTOACKEN ADPTCHEN R/W-0 ADPTDREN bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 RXBUFFUL: RX Buffer Full bit Host MCU clears this bit to indicate that the RX packet is processed. If this bit is uncleared before the next valid RX packet is detected (packet is not a duplicate, pass RX filter, and so on), then the device sets RXOVFIF and the buffer content is unmodified, where RXBUFFUL = 1 locks write access by a new frame. Moreover, the host can both read and write to the buffer or perform security processing. In TRXMODE = 00 (PACKET) mode: 1 = Receive buffer content is yet to be read by the host or processed, and cannot be overwritten by a new frame 0 = Receive buffer is free for receiving a new frame In TRXMODE = 01 (RXSTREAMING) mode: 1 = Current buffer being read from the bus contains a valid RX Packet 0 = Current buffer being read from the bus is empty bit 6 IDENTREJ: Reject Identical Packet bit Setting this bit enables the user to reject an incoming packet, in case its source address and sequence number is the same as the previously received packet. This bit is used whenever a packet is received and ACK is transmitted, but the ACK is never received that the sender resends the TX packet. When this happens, triggers for RXIF is avoided for the second time for the same packet, thus, the second packet is ignored. This bit is also used when a packet is repeated and the next repeater repeats the same packet back. This packet is received, but ignored. 1 = Any packet received with the same source address and sequence number as the last packet successfully received is discarded and RXIDNTIF is thrown 0 = Duplicated packets are processed further same as non-duplicated packets bit 5 ACKRXFP: ACK RX Frame Pending bit This read-only Status bit reflects the value of the FrameCtrl (FramePend) bit in the last received 802.15.4 compatible ACK frame. bit 4 ACKTXFP: ACK TX Frame Pending bit The value of this bit is transmitted in the FrameCtrl (FramePend) bit slot when the MAC sends an ACK packet in 802.15.4 Compatibility mode. bit 3 AUTORPTEN: Auto-Repeat Enable bit If this bit is set, the MAC automatically transmits a packet whenever a packet is received and its Repeat bit is set. 1 = Auto-Repeat feature is enabled 0 = Auto-Repeat feature is disabled Note 1: 2: Use ADPTCHEN field while receiving and transmitting, and must be unmodified while RXEN or TXST is set. Use ADPTDREN field while receiving and transmitting, and must be unmodified while RXEN or TXST is set. DS70005023C-page 116 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 4-9: bit 2 RXCON2 (MAC RECEIVE CONTROL 2 REGISTER) (CONTINUED) ADDRESS: 0x16 AUTOACKEN: Auto-Acknowledge Enable bit Setting this bit enables the device to automatically transmit an ACK packet whenever a packet is received and its AckReq bit is set. 1 = Automatic Acknowledge processing enabled 0 = Automatic Acknowledge processing disabled ADPTCHEN: Adaptive Channel Enable bit(1) bit 1 Setting this bit enables the MAC in Proprietary mode to set the transmitting channel for the ACK packet based on the AckInfo field (Proprietary packet) of the received packet, rather than the CH<3:0> register bits. 1 = Adaptive Channel feature is enabled 0 = Adaptive Channel feature is disabled This feature is also known as Channel Agility. For more information, see Section 7.1 “Channel Agility”. ADPTDREN: Adaptive Data Rate Enable bit(2) bit 0 Setting this bit enables the MAC in Proprietary mode to set the transmission data rate for the ACK packet based on the AckInfo field (Proprietary packet) of the received packet, rather than the DR<2:0> register bits. 1 = Adaptive Data Rate feature is enabled 0 = Adaptive Data Rate feature is disabled This feature is also known as Channel Agility. For more information, see Section 7.1 “Channel Agility”. Note 1: 2: Use ADPTCHEN field while receiving and transmitting, and must be unmodified while RXEN or TXST is set. Use ADPTDREN field while receiving and transmitting, and must be unmodified while RXEN or TXST is set. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 117 MRF24XA REGISTER 4-10: PIR3 (PERIPHERAL INTERRUPT REGISTER 3) R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 RXIF RXDECIF RXTAGIF R-0 ADDRESS: 0x06 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 r RXIDENTIF RXFLTIF RXOVFIF STRMIF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 x = Bit is unknown RXIF: Received Successful Interrupt Flag bit Set by the device when a frame passed the packet filtering and accepted, refer to Register 2-23. This interrupt flag is set only once for a packet and is not set when the packet is the duplicate of a repeated transmission (sequence number matches with the previously received frame). Nonpersistent, cleared by SPI read. bit 6 RXDECIF: Receiver Decryption/Authentication Passed Interrupt Flag bit Set by the device when decryption/authentication finished without error. Nonpersistent, cleared by SPI read. bit 5 RXTAGIF: Receiver Decryption/Authentication Failure Interrupt Flag bit Set by the device when decryption/authentication finished with error. Nonpersistent, cleared by SPI read. bit 4 Reserved: Maintain as ‘0’ bit 3 RXIDENTIF: Received Packet Identical Interrupt Flag bit Set by the device when the packet is the duplicate of a repeated transmission (sequence number and source address matches with the previously received frame). Nonpersistent, cleared by SPI read. bit 2 RXFLTIF: Received Packet Filtered Interrupt Flag bit Set by the device when a packet was received, but rejected by one or more RX Filters, refer to Register 2-23. Nonpersistent, cleared by SPI read. bit 1 RXOVFIF: Receiver Overflow Error Interrupt Flag bit Set by the device to indicate that a packet was received, but all RX buffers are full. Consequently, the packet was not received, but was discarded instead(1). Nonpersistent, cleared by SPI read. bit 0 STRMIF: Receive Stream Time-Out Error Interrupt Flag bit Set by the device to indicate that the duration specified in STRMTO elapsed since the last received packet while in RX-Streaming mode, and the MAC clears the stored sequence number. Nonpersistent, cleared by SPI read. Note 1: In Packet mode, use a single buffer for received frames. In RX-Streaming mode, use both buffers for reception. DS70005023C-page 118 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 4-11: PIR4 (PERIPHERAL INTERRUPT REGISTER 4) ADDRESS: 0x07 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 TXSFDIF RXSFDIF ERRORIF WARNIF EDCCAIF GPIO2IF GPIO1IF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 GPIO0IF x = Bit is unknown TXSFDIF: Transmit SFD Sent Interrupt Flag bit Set by the device when the last sample of the SFD field has been sent into the air. Nonpersistent, cleared by SPI read. bit 6 RXSFDIF: Receive SFD Detected Interrupt Flag bit Set by the device when the SFD field of the received frame is detected. Nonpersistent, cleared by SPI read. bit 5 ERRORIF: General Error Interrupt Flag bit Set by the device, when malfunction state is reached. bit 4 WARNIF: Warning Interrupt Flag bit Set by the device when one of the following occurred: • Battery voltage drops below the threshold given by BATMON<4:0> • Resistor on pin 28 is missing or not connected well bit 3 EDCCAIF: Energy Detect/CCA Done Interrupt Flag bit Set by the device when Energy-detect or CCA measurement is complete (following that the host MCU has set the EDST/CCAST bit to start the measurement and the device is clearing it in on completion). Nonpersistent. Cleared by SPI read. bit 2 GPIO2IF: GPIO2 Interrupt Flag bit Set by the device if the GPIOMODE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. bit 1 GPIO1IF: GPIO1 Interrupt Flag bit Set by the device if the GPIOMODE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. bit 0 GPIO0IF: GPIO0 Interrupt Flag bit Set by the device if the GPIOMODE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 119 MRF24XA REGISTER 4-12: PIR2 (PERIPHERAL INTERRUPT REGISTER 2) R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 TXIF TXENCIF TXMAIF TXACKIF TXCSMAIF TXSZIF ADDRESS: 0x05 R/W/HS/HC-0 R/W/HS/HC-0 TXOVFIF FRMIF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7-1 Out of scope bit 0 FRMIF: Frame Format Error Interrupt Flag bit x = Bit is unknown Set if the transmitter/receiver fails to parse the frame in the buffer (it is not as it must be or it is corrupted in demodulation). For example, reserved values found in the MAC header fields. Nonpersistent, cleared by SPI read. DS70005023C-page 120 Preliminary 2015 Microchip Technology Inc. MRF24XA 4.11 Carrier Sense Multiple AccessCollision Avoidance (CSMA-CA) Carrier Sense Multiple Access-Collision Avoidance (CSMA-CA) is performed before transmitting a packet to increase the odds that the packet is successfully received without interference from other transmitting devices nearby. When enabled (CSMAEN = 1), the MAC automatically performs CSMA-CS using the underlying Clear Channel Assessment (CCA) operation. CSMA-CA is only performed before transmitting a packet (excluding ACK packets automatically transmitted during AutoAcknowledge) in Packet and Repeater mode. 4.11.1 1. The following register bits are used in the Configuration of CSMA-CA: CSMAEN BOMCNT<2:0> BOUNIT<7:0> MINBE<3:0> MAXBE<3:0> 2015 Microchip Technology Inc. CSMA-CA BACK-OFF ALGORITHM Wait a random number of Base time units between 0 and (2MINBE-1) * BOUNIT<7:0>. Note: 2. 3. 4. CSMA-CA CONFIGURATION Setting the CSMAEN register bit enables CSMA-CA. CSMA-CA is automatically executed when the TXST register bit is set before the packet is transmitted. CSMA-CA is considered part of a transmission operation and it is aborted when the TXST register bit is cleared, and not when the RXEN register bit is cleared. • • • • • 4.11.2 5. 6. If MINBE = 0, the first iteration of the CSMA algorithm performs a CCA operation immediately without any backoff time. Perform a Clear Channel Assessment (CCA) operation. If CCA fails, then wait for a random number of Base time units between 0 and (2(MINBE+1)-1) * BOUNIT<7:0>. Repeat above two steps until CCA passes, incrementing the back-off exponent each time, until the maximum back-off time becomes (2MAXBE-1) * BOUNIT<7:0>, or until the number of attempts is greater than BOMCNT<2:0>. If CCA is failed, but the number of attempts is less than BOMCNT<2:0>, keep trying with a back-off time of (2MAXBE-1) * BOUNIT<7:0> Base time units until the number of attempts is greater than BOMCNT<2:0>, or CCA passes. If CCA still fails, the TX CSMA Error event is generated. MRF24XA automatically controls an external LNA if enabled. Preliminary DS70005023C-page 121 MRF24XA REGISTER 4-13: TMRCON (TIMER CONTROL REGISTER) ADDRESS: 0x19 R/W-100 R/W-00010 BOMCNT<2:0> BASETM<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-5 BOMCNT<2:0>: CSMA-CA Back-off Maximum Count Field bits The maximum number of back-off attempts that the CSMA-CA algorithm tries before declaring a channel access failure. 111 = Reserved 110 = Reserved 101 = 5 attempts 100 = 4 attempts 011 = 3 attempts 010 = 2 attempts 001 = 1 attempts 000 = 0 attempt bit 4-0 BASETM<4:0>: Base Time Field bits The number of 1 µs clock cycles that a Base time unit represents in all register settings. For more information, see Section 4.1 “MAC Architecture”. DS70005023C-page 122 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 4-14: CSMABE (CSMA-CA BACK-OFF EXPONENT CONTROL REGISTER) ADDRESS: 0x1A R/W-0101 R/W-0011 MAXBE<3:0> MINBE<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-4 MAXBE<3:0>: CSMA-CA Back-off Maximum Count Fields The maximum value of the Back-off exponent (BE) is in the CSMA-CA algorithm. The back-off time is (2BE-1) units. 1111 = Reserved • • • 1001 = Reserved 1000 28-1 = 255 maximum units of back-off time • • • 0000 20-1 = No back-off time bit 3-0 MINBE<3:0>: CSMA-CA Back-off Minimum Count bit The minimum value of the back-off exponent (BE) is in the CSMA-CA algorithm. The back-off time is (2BE-1) units. 1111 = Reserved • • • 1001 = Reserved 1000 28-1 = 255 maximum units of back-off time • • • 0000 20-1 = No back-off time 2015 Microchip Technology Inc. Preliminary DS70005023C-page 123 MRF24XA REGISTER 4-15: BOUNIT (BACK-OFF TIME UNIT REGISTER) ADDRESS: 0x1B R/W-10100000 BOUNIT<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-0 BOUNIT<7:0>: CSMA-CA Back-off Period Unit Field bits The number of Base time units for the basic back-off time unit used by CSMA-CA algorithm. 11111111 = 256 Base time units • • • 00000000 = 1 Base time unit FIGURE 4-12: CSMA-CA ALGORITHM NB = 0 BE = MINBE <3:0> Delay for a Random number of Back-off Periods between 0 and 2^BE -1 Perform CCA Yes Channel Idle? No NB = NB +1 BE = min (BE + 1, MAXBE <3:0>) Yes NB > BOMCNT <2:0>? No (Failure) DS70005023C-page 124 Preliminary Transmit Pending Packet (Success) 2015 Microchip Technology Inc. MRF24XA 4.12 Clear Channel Assessment (CCA) 4.13 Clear Channel Assessment (CCA) is a function within CSMA/CA to determine whether the wireless medium is ready and able to receive data, thus the transmitter can start sending it. Condition for Hardware Acknowledgement Figure 4-12 illustrates the condition for hardware acknowledgement as examined in Figure 4-9 and Figure 4-11. The AUTOACKEN = 0 case, when Acknowledgement is done by software. Both acknowledgement mechanisms (AUTOACKEN = 0/1) are described for the originator and the recipient. CCA is implemented outside of the MAC. This enables the radio to transmit in the presence of interference from other wireless protocols that operate on the same frequency. CCA may be performed using either Energy Detection (ED), Carrier Sense (CS), or a combination of both. For more information on register description, see Section 9.6 “Clear Channel Assessment (CCA)” . FIGURE 4-13: ACK REQUIREMENT DECISION “ACK Required?” The sender of the frame does not request an ACK to it. AckReq = 1 No Yes Packet Mode (TRXMODE = 00) and non-streaming frames are only considered since streaming type of frames always contain AckReq, and RX-Streaming nodes discard non-streaming type of frames. No ACK is handled by software. AUTOACKEN = 1 Yes AUTOACKEN = 1 is forbidden in Repeater Nodes, thus AUTORPTEN = 0 is implied. The required and sufficient condition for Acknowledge sending is TRXMODE = 00 AND AUTORPTEN = 0 AND AUTOACKEN = 1 AND AckReq = 1. Evaluates to FALSE Evaluates to TRUE If the transmitter (TXST = 1) of the frame having AckReq = 1 is configured as TRXMODE = 00 AND AUTOACK = 1 then it must receive a valid ACK to the sent frame to report successful sending. If the receiver (TXST = 0) of the frame having AckReq = 1 is configured as TRXMODE = 00 AND AUTOACK = 1 then it must transmit an ACK to the received frame and all of the subsequent duplicates that arrive before the MHR is overwritten in the frame buffer. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 125 MRF24XA REGISTER 4-16: RXCON2 (MAC RECEIVE CONTROL REGISTER 2) R/C/HS-0 R/W-0 R-0 R/W-0 RXBUFFUL IDENTREJ ACKRXFP ACKTXFP R/W-0 R/W-0 AUTORPTEN AUTOACKEN ADDRESS: 0x16 R/W-0 R/W-0 ADPTCHEN ADPTDREN bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HS = Hardware Set C = Clearable bit bit 7-3 Out of scope bit 2 AUTOACKEN: Auto-Acknowledge Enable bit x = Bit is unknown Recipient of a data frame: If this bit is set, the device automatically transmits an ACK packet whenever a packet is received and its AckReq bit is set. Originator of a data frame: If this bit is set, the device awaits an ACK packet after the transmission of a packet (and after each retransmissions), and automatically processes the received ACKnowledge packet without writing it to the buffer. Setting this bit is required to enable automatic retransmissions of the device. The host MCU must clear AUTOACKEN to disable the automatic processing of acknowledge frames and enable writing to the buffer. 1 = Automatic Acknowledge processing enabled 0 = Automatic Acknowledge processing disabled bit 1-0 Out of scope DS70005023C-page 126 Preliminary 2015 Microchip Technology Inc. MRF24XA 4.14 Acknowledge Sending by Recipient A TXIF is not generated when an ACK packet completes transmission. However, TXSFDIF and TXMAIF are set. ACK sending must never use CSMA whether AUTOACKEN = 1 or 0. FIGURE 4-14: AUTOMATIC ACKNOWLEDGE SENDING (AUTOACKEN = 1 AND ACKREQ = 1) Enter RXEN = 1 FrameCtrl.AckReq = 1 must hold for entry (Default) RXChannel = TXChannel = CH<3:0>. For the exception, refer to Section 7.1 “Channel Agility” on agility. Receiver turned OFF, transmitter remains ON Yes Proprietary frame carrying AckInfo. FRMFMT = 1 0 ADPTCHEN No 1 Await RXACKWAIT Base time units. (start transition to TX just in time) Use AckInfo field of the received frame to select the transmitting channel for the ACK frame Start transmitting the preamble in the frame (without doing CSMA) 0 (when SFD is sent: TXSFDIF 1) ADPTDREN 1 Generate ACKNOWLEDGE frame MHR without writing to buffer. If FRMFMT = 0 then FrameCtrl.FramePend ACKTXFP. SEQUENCE received frame sequence Use AckInfo field of the received frame to select the transmitting data rate for the ACK frame Append FCS (on-the-fly) CH<3:0> selected as receive channel Return to RX Exit 2015 Microchip Technology Inc. Preliminary DS70005023C-page 127 MRF24XA TABLE 4-4: IDENTICAL PACKET REJECTION SCENARIO RXBUFFULL IDENTREJ AutoAck AckReg 0 0 0 0 0 0 0 1 0 0 1 0 Description No ACK is sent, RXBUFFULL<1 0 0 1 1 0 1 0 0 0 1 0 1 0 1 1 0 0 1 1 1 Store sequence number and source address (SA + PID) ACK is sent, RXBUFFULL<- 1 1 0 X X No ACK is sent, RXOVFIF<- 1 1 1 0 0 1 1 0 1 1 1 1 0 No ACK is sent, if stored sequence number and source address match with the received one, then RXIDENTIF<- 1 otherwise, RXOVFIF<- 1 1 1 1 1 DS70005023C-page 128 ACK is sent, RXBUFFULL<- 1 Store sequence number and source address (SA + PID) No ACK is sent, RXBUFFULL<- 1 If stored sequence number and source address match with the received one, ACK is sent and RXIDENTIF <- 1 Otherwise, RXOVFIF<- 1 Preliminary 2015 Microchip Technology Inc. MRF24XA 4.15 Acknowledge Reception by Originator After the reception of a valid ACK packet (Sequence field matches with transmitted Frame Sequence field), RXSFDIF and TXIF interrupts are generated (the RXIF is not generated while receiving an ACK frame). If the maximum number of retransmissions is reached (TXRETCCNT >= TXRETMCNT), for example, no valid acknowledge received, TXACKIF interrupt is generated. FIGURE 4-15: ACKNOWLEDGE RECEPTION AND RETRANSMISSION CONTROL Enter Figure 4-9 TRANSMITTER PROCESSING IN PACKET MODE TXST = 1 Entered when ACK Required Receiver turned OFF RXChannel selected (Default) RXChannel = TXChannel = CH<3:0>. For the exception, refer to Section 7.1 “Channel Agility” on agility. Radio to RX TXST = 1 Start time-out counter Frame received? Yes RXSFDIF No No 1 Frame parsed without writing to buffer Timer reached TXACKTO Base time units? Valid ACK frame received with SEQUENCE field matching the transmitted frame? Yes Receiver turned OFF TXChannel selected Yes No Yes TXRETCCNT >= TXRETMCNT? success failure No TXACKIF 1 Update ACKRXFP Increment TXRETCCNT retransmit Receiver turned OFF TXChannel selected Exit 2015 Microchip Technology Inc. Preliminary DS70005023C-page 129 MRF24XA 4.16 Base Time Units Writing the BASETM<4:0> register bits selects the desired Base time. Each increment of BASETM<4:0> is equal to 1 µs. TABLE 4-5: The RXACKWAIT<7:0>, TXACKTO<7:0>, BOUNIT<7:0>, STRMTO<15:0> and OFFTM<7:0>(3) fields are specified in terms of Base time units. The BASETM<4:0> bits must be unchanged while RXEN = 1 or TXST = 1. The Base time is used in all modes for all types of packets. BASE TIME UNITS Range of Timer with BASETM<4:0> = 0x01 (1 µs resolution) Range of Timer with BASETM<4:0> = 0x02 (2 µs resolution) Range of Timer with BASETM<4:0> = 0x04 (4 µs resolution) Time to Wait before transmitting an ACK packet (RXACKWAIT<7:0>) 0-128 µs 0-256 µs 0-512 µs Maximum time to look for an ACK packet before issuing a TX ACK Error or before retransmitting (TXACKTO<7:0>) 0-256 µs 0-512 µs 0-1024 µs CSMA Backoff Time (0 - (2BE - 1) * BOUNIT<7:0>) — BOUNIT<7:0> = 160(1, 2) (320 µs) BOUNIT<7:0> = 80(2) (320 µs) Function/Timer BE = 0 — 0 BE = 1 — 0-320 µs BE = 2 — 0-960 µs BE = 3 — 0-2.24 ms BE = 4 — 0-4.8 ms BE = 5 — 0-9.92 ms BE = 6 — 0-20.16 ms BE = 7 — 0-40.64 ms BE = 8 — 0-81.6 ms RX Stream Timeout (STRMTO<15:0>) 0-65 ms 0-131 ms 0-131 ms Minimum OFF Time (OFFTM<7:0> * 32)(3) 0-8 ms 0-16 ms 0-32 ms Note 1: 2: 3: The maximum delay that MAC can support is 131 ms. Values outside this range may be set, but results in truncation of the number to one that is less than or equal to 131 ms. The value of 320 µs is chosen as it is the value referenced in the 802.15.4-2006 specification. Other values are possible, but may break 802.15.4 compliance. Note that the OFFTM<7:0> register is the only timer value that is expressed not directly in BASETM units, but rather is expressed in BASETM * 32 units. DS70005023C-page 130 Preliminary 2015 Microchip Technology Inc. MRF24XA 4.17 Initialization sequence To reach optimal RX and TX parameters, some private register values must be changed after every reset. Note that all results in this document were measured with this initialization sequence. Initiate HW Reset; Wait for Ready IF; MRF24XA_WriteByte(0xFF, 0x5A); MRF24XA_WriteByte(0xB7, 0xC0); MRF24XA_WriteByte(0x80, 0x87); MRF24XA_WriteByte(0x81, 0x84); MRF24XA_WriteByte(0x82, 0x8A); MRF24XA_WriteByte(0x83, 0x5E); MRF24XA_WriteByte(0x84, 0xA5); MRF24XA_WriteByte(0x8A, 0x2B); MRF24XA_WriteByte(0x8B, 0x30); MRF24XA_WriteByte(0x8C, 0x30); MRF24XA_WriteByte(0x97, 0xD0); MRF24XA_WriteByte(0xA3, 0x37); MRF24XA_WriteByte(0xA5, 0x14); MRF24XA_WriteByte(0xAA, 0x54); MRF24XA_WriteByte(0xAB, 0x0B); Note: MRF24XA_WriteByte (unsigned short address, unsigned char value) writes the given value to the selected address. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 131 MRF24XA NOTES: DS70005023C-page 132 Preliminary 2015 Microchip Technology Inc. MRF24XA 5.0 IEEE 802.15.4™ COMPLIANT FRAME FORMAT AND FRAME PROCESSING Figure 5-1 shows the general MAC header structure. The specific format of the Acknowledge frame is provided in Figure 5-2. The frame buffer is written in the following sequence: (1) LENGTH field byte, (2) Byte 0 of the FrameCtrl field, (3) Byte 1 of the FrameCtrl field, and (4) SEQUENCE. FIGURE 5-1: IEEE.802.15.4™ MAC HEADER STRUCTURE MHR: MAC Header (IEEE 802.15.4™) Sequence (1 octet) FrameCtrl (2 octets) DestPID (0/2 octets) SrcPID (0/2 octets) DestAddr (0/2/8 octets) Destination (0/4/10 octets) SrcAddr (0/2/8 octets) AuxSecHdr (0-14 octets) Source(0/2/4/8/10 octets) FrameCtrl (IEEE 802.15.4) Byte 1 Byte 0 7 Rsvd. (1 bit) 6 5 PIDCmp AckReq (1 bit) (1 bit) 4 3 2:0 7:6 5:4 3:2 1:0 FramePend (1 bit) SecEn (1 bit) Type (3 bits) SAMode (2 bits) FrameVer (2 bits) DAMode (2 bits) Rsvd. (2 bits) • Type<2:0>: Indicates the frame type. For more information, see Section 5.1 “Frame Types in IEEE 802.15.4-Compliant Framing Mode”. • SecEn: Security Enable bit. For more information, see Section 5.3 “Security Material” and Section 5.4 “Security Material Retrieval with IEEE 802.15.4 Compliant Frames”. • FramePend: This bit of the ACK frame must be set when ACKTXFP = 1 and the frame being ACK’d is an 802.15.4 Data Request Command Frame (FrameCtrl.Type = 011 AND CMDType = 0x04), and cleared otherwise. CSMA-CA is not performed before sending out ACK packets. 2015 Microchip Technology Inc. • AckReq: ACK Request. For more information, see Section 4.12 “Clear Channel Assessment (CCA)”. • PIDCmp: PAN Identifier Compare. For more information, see Section 5.2 “Addressing in IEEE 802.15.4 Compliant Framing Mode”. • DAMode: Destination Address Mode. For more information, see Section 5.2 “Addressing in IEEE 802.15.4 Compliant Framing Mode”. • SAMode: Source Address Mode. For more information, see Section 5.2 “Addressing in IEEE 802.15.4 Compliant Framing Mode”. Preliminary DS70005023C-page 133 MRF24XA FIGURE 5-2: IEEE.802.15.4™ ACKNOWLEDGE FRAME STRUCTURE Acknowledge Frame (IEEE 802.15.4™) MHR FrameCtrl (2 octets) Length (1 octet) Sequence (1 octet) FCS (2 octets) FrameCtrl (IEEE 802.15.4 ACK frame) Byte 1 = 00h or 10h 0x02 or 0x12 Byte 0 = 02h or 12h 0x00 or 0x10 7 Rsvd. 0 6 5 PIDCmp AckReq 0 0 FIGURE 5-3: DS70005023C-page 134 4 3 2:0 7:6 5:4 3:2 1:0 FramePend 0/1 SecEn 0 Type 010 SAMode 00 FrameVer 00/01 DAMode 00 Rsvd. 00 EXAMPLE: PACKET MODE WITHOUT SECURITY Preliminary 2015 Microchip Technology Inc. MRF24XA Transmitter Side: 1 2 3 4 Description TX Configuration: SECEN = 0 CSMAEN = 0 Example ShortAddress: 0x1A1B PID: 0x2C2D Description Construct, download unprocessed frame Example 0C | 01 98 | A8 | 2C 2D | FF FF | 2C 2D | 1A 1B | FF | (no CRC) Length = 12d + 2d (CRC) = 14d = 0x0E FrameCtrl = 0x01 0x98 = lsb_0000_0001_1001_1000 (Data, SEC = 0, DA, SA Short Addresses, ver2006) Sequence = 0xA8 SA/DA PID = 0x2D2C DA = 0xFFFF (broadcast) SA = 0x1B1A (unicast) MAC Payload = 0xFF Description Set TXST: Launches transmission. CRC is appended. Length is incremented accordingly. Example 0E | 01 98 | A8 | 2C 2D | FF FF | 2C 2D | 1A 1B | FF | A7 8E CRC: 0xA7 0x8E Description End of Transmission (No ACK Request, No CSMA): TXIF received. TXBUFEMPTY = 1 Receiver Side: 1 Description RX Configuration: SECEN = 0 (NWK), Security Suite Example Address: Don’t care. 2 Description RXSFDIF = 1 unless RXBUFFUL = 1 (If RXBUFFUL= 1 then RXSFDIF = 1; RXOVFIF = 1; no writing to buffer 3 Description RX Parsing and Filtering when frame reception is complete. If duplicated packet then silently discarded Else if packet filtered then RXFLTIF, Otherwise RXIF = 1 (since SECEN = 0) Example RXFILTER(@0x18) = 0x45 4 Description RXIF = 1. CRC is not valid for the decrypted frame. Example 0E | 01 98 | A8 | 2C 2D | FF FF | 2C 2D | 1A 1B | FF | A7 8E||RSVs 2015 Microchip Technology Inc. Preliminary DS70005023C-page 135 MRF24XA FIGURE 5-4: EXAMPLE: PACKET MODE WITH NKW-LAYER SECURITY Legend: Data Flow direction Initiator Event or Control Flow Sending Node TX Host MCU 1 Construct frame 2 3 4 5 SPI, INT Unprocessed Frame (FR) Responder Receiving Node TX Device Medium RX Device SPI, INT RX Host MCU TXBUFEMPTY=0 RX Configuration TX Configuration 1 Key, Nonce, Indices Set TXENC TXENCIF=1, TXENC=0 TX security processing Processed Frame (PRFR) Read TX buffer Check PRFR-optional 6 If RXBUFFULL=1 when Set TXST Frame Sending Frame Started on Air TXSFDIF=1 SHR (SFD) finished RXSFDIF=1 then RXOVFIF=1 and drops packet RXSFDIF=1 2 7 TXIF=1, TXBUFEMPTY=1 Buffer is written to if no RXOVFIF Frame Complete RX Frame Filter RXFLTIF=1 or RXIF=1 3 4 Read RX buffer Key, Nonce, Indices Set RXDEC RX security processing RXDECIF=1 or RXTAGIF=1 Read RX buffer DS70005023C-page 136 Preliminary Check PRFR Retrieve Key,... 4 5 6 Check FR 2015 Microchip Technology Inc. MRF24XA Transmitter Side: 1 Description Construct, download unprocessed frame Example 2 Description TX Configuration: NWK layer security Example 3 12 | 01 98 | A8 | 2C 2D | FF FF | 2C 2D | 1A 1B | 01 02 03 04 05 06 | FF | (No MIC, no CRC) Length = 18d + 4d (MIC-32) + 2d (CRC) = 24d = 0x18 FrameCtrl = 0x01 0x98 = lsb_0000_0001_1001_1000 (SEC = 0, DA, SA Short Addresses, ver2006) Sequence = 0xA8 SA/DA PID = 0x2D2C DA = 0xFFFF (broadcast) SA = 0x1B1A (unicast) Network Header = 0x01 0x02 0x03 0x04 0x05 0x06 Network Payload = 0xFF Security Suite = MIC-32 Description TX Configuration: Key, Nonce, Payload Index, Header Index Example Short Address = 0x1B1A PID = 0x2D2C Header Index (@0x2B) = 12d Payload Index (@0x2C) = 18d MRF24XA register content Key<i> = 0x0F0E0D0C0B0A09080706050403020100 Nonce<i> = 0x50 + <i>, i = 0…12 0x20 22 33 44 55 66 77 88 1A 0x28 1B 2C 2D 0C 12 00 00 00 0x40 MRF24XA register content 00 01 02 03 04 05 06 07 0x48 0x50 08 60 09 61 0A 62 0B 0C 0D 0E 63 64 65 66 0F 67 0x58 68 69 6A 6B 00 6C 00 00 4 Description Issue TXENC: Launches CCM authentication and encryption. 5 Description Security Processing Done: TXENCIF = 1, TXENC = 0. Optionally, TX buffer is read. Processed Frame PRFR is compared to the result of the receiver security processing or to the calculated expected outcome. Example 6 Description Set TXST: Launches transmission. CRC is appended. Example 7 Expected buffer content: 16 | 01 98 | A8 | 2C 2D | FF FF | 2C 2D | 1A 1B | 01 02 03 04 05 06 | 46 | 78 C3 22 32 | (no CRC) Encrypted payload (0xFF): 0x46 MIC-32: 0x{78 C3 22 32} CRC: 0xA7 0x8E 18 | 01 98 | A8 | 2C 2D | FF FF | 2C 2D | 1A 1B | 01 02 03 04 05 06 | 46 | 78 C3 22 32 | A7 8E CRC: 0xA7 0x8E Description End of Transmission (No ACK Request, No CSMA): TXIF received. TXBUFEMPTY= 1 2015 Microchip Technology Inc. Preliminary DS70005023C-page 137 MRF24XA Receiver Side: 1 Description RX Configuration: Security Suite Example Security Suite = MIC-32 2 Description If RXBUFFUL is 0 then RXSFDIF = 1 If RXBUFFUL is 1 then RXSFDIF = 1 RXOVFIF = 1 (no writing to buffer) 3 Description RX Parsing and Filtering when frame reception is complete. If packet filtered then RXFLTIF, Otherwise = 1 (Network secured frame received since SECEN = 0) 4 Description Read RX buffer containing PRFR + CRC. CRC is valid for the encrypted frame and, LQI, RSSI (RSVs) appended to the frame. Example Example RXFILTER(@0x18) = 0x45 18 | 01 98 | A8 | 2C 2D | FF FF | 2C 2D | 1A 1B | 01 02 03 04 05 06 | 46 | 78 C3 22 32 | A7 8E || RSVs CRC: 0xA7 0x8E 5 Description RXDEC = 1 launches decryption and authenticity checking. 6 Description If authenticity is approved (success): RXDECIF = 1. CRC is not valid for the decrypted frame. Otherwise RXTAGIF = 1. Example 5.1 1A | 01 98 | A8 | 2C 2D | FF FF | 2C 2D | 1A 1B | 01 02 03 04 05 06 | FF | 78 C3 22 32 | A7 8E |6C 42 RSSI: 0x6C LQI: 0x42 Frame Types in IEEE 802.15.4-Compliant Framing Mode The Type<2:0> bit field in FrameCtrl uses the encoding in Table 5-1. TABLE 5-1: IEEE 802.15.4™ FRAME TYPES TYPE Field b2,b1,b0 Frame Type 000 Beacon Related Hardware Features Beacons are a specific type of broadcast frames. This device does not provide support for MHR-parsing on Beacon frames. Beacon frames are always accepted as valid frames. 001 Data 010 Acknowledge This is filtered by setting DATAREJ. Must be generated by the receiver (from SW or HW), if AckReq = 1 in the last received frame, and must contain the same Sequence value. This is generated by hardware (AUTOACKEN = 1). In this case it is not loaded to the TX frame buffer. AUTOACKEN = 1 requires CRCSZ = 1 on both the transmitter and the receiver side. 011 Command This is filtered by CMDREJ. First byte of payload (Command) is never encrypted. See command encoding in Table 82 in Section 7.3 of IEEE 802.15.4™-2006. 1xx Reserved — If SecEn bit in FrameCtrl is set, the hardware parses the frame to construct the security material (both at sending and after reception). In the case of Beacon frames, it is the responsibility of the host MCU to set the security materials before transmission (TXST) and after reception (RXIF). For Beacon frames, the Frame Version subfield must be set to ‘1’ if the Security Enabled subfield is set to ‘1’. DS70005023C-page 138 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 5-1: RXFILTER (RX FILTER REGISTER) ADDRESS: 0x18 R/W-0 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 PANCRDN CRCREJ CMDREJ DATAREJ UNIREJ NOTMEREJ BCREJ NSTDREJ bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-6 Out of Scope bit 5 CMDREJ: Command Frame Reject Enable bit Setting this bit enables the user to reject all packets with FrameCtrl<Type> equal to Command. 1 = Reject all Command packets 0 = Disable Command Frame Rejection bit 4 DATAREJ: Data Frame Reject Enable bit Setting this bit enables the user to reject all packets with FrameCtrl<Type> equal to Data. 1 = Reject all Data packets 0 = Disable Data Frame Rejection bit 3-0 Out of Scope 2015 Microchip Technology Inc. Preliminary DS70005023C-page 139 MRF24XA 5.2 Addressing in IEEE 802.15.4 Compliant Framing Mode The Destination Addressing Mode (DAMode) and Source Addressing Mode (SAMode) bit fields of FrameCrtl defines the Address format used in MHR, see Figure 5-1. DAMode subfield encodes the length of the DestPID and DestAddr fields as listed in Table 5-3. SAMode subfield encodes the length of the SrcPID and SrcAddr fields as listed in Table 5-3. TABLE 5-2: IEEE 802.15.4™ DESTINATION ADDRESSING MODES DAMode b1, b0 Destination Addressing Mode DestPID | DestAddr format 11 16-bit DestPID and 64-bit Dest. Long Address XXXXh | XXXX_ XXXX_ XXXX_ XXXXh 10 16-bit DestPID and 16-bit Dest. Short Address XXXXh | XXXXh 01 Reserved — 00 DestPID and DestAddr are not present — TABLE 5-3: IEEE 802.15.4™ SOURCE ADDRESSING MODES SAMode b1, b0 Source Addressing Mode SrcPID | SrcAddr Format If DAMode<1> = 1 and PIDCmp = 1, then only 64-bit Source Long Address (SrcPID is implied by DestPID) else, 16-bit SrcPID and 64-bit Source Long Address 11 10 If DAMode<1> = 1 and PIDCmp = 1, then only 16-bit Source Short Address (SrcPID is implied by DestPID) else, 16-bit SrcPID and 16-bit Source Short Address 01 Reserved 00 SrcPID and SrcAddr are not present XXXXh | XXXX_XXXX_XXXX_XXXXh - |XXXXh XXXXh | XXXXh — On reception of a frame, each node compares its own SHADDR, ADDR, PANID Configuration, see Table 5-4, to the appropriate destination addressing fields in the received frame. A valid frame is identified if a match is found. TABLE 5-4: - |XXXX_XXXX_XXXX_XXXXh — Additionally, rules apply for broadcast frames and for implied unicast addressing as explained in the sequel. RELEVANT REGISTERS FOR IEEE 802.15.4™-MODE ADDRESSING ADDR. RESGISTER Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 0x1F ADDR1 ADDR<7:0> 0x20 ADDR2 ADDR<15:8> 0x21 ADDR3 ADDR<23:16> 0x22 ADDR4 ADDR<31:24> 0x23 ADDR5 ADDR<39:32> 0x24 ADDR6 ADDR<47:40> 0x25 ADDR7 ADDR<55:48> 0x26 ADDR8 ADDR<63:56> 0x27 SHADDRL SHADDR<7:0> 0x28 SHADDRH SHADDR<15:8> 0x29 PANIDL PANID<7:0> 0x2A PANIDH PANID<15:8> DS70005023C-page 140 Preliminary Bit 2 Bit 1 Bit 0 2015 Microchip Technology Inc. MRF24XA If DAMode subfield is equal to zero and the Frame Type subfield does not specify that this frame is an acknowledgment or Beacon frame, then the SAMode subfield must be non-zero, implying that the frame is directed to the PAN coordinator with the PAN identifier as specified in the Source PAN Identifier field. This addressing option is referred to as ‘implied’. Acknowledge frames are broadcast frames and always use DAMode = 00 and SAMode = 00. Beacon frames are broadcast frames and always use DAMode = 00, PIDCmp = 0 with SAMode = 01 or 10. Table 5-6 and Table 5-7 show the examples for destination and source addressing, using the TX and RX node configurations in Table 5-5. Broadcast frames of type data or command must always use DAMode = 01 and DestAddr = FFFFh. TABLE 5-5: EXAMPLE CONFIGURATION TX (Source) Configuration ADDR = 0x080706050403020100 SHADDR = 0x1211 PANID = 0xD2D1 RX (Destination) Configuration ADDR = 0xA8A7A6A5A4A3A2A1A0 SHADDR = 0xB2B1 PANID = 0xB2B1 MHR FrameCtrl | Sequence | DestPID | DestAddr| SrcPID | SrcAddr FrameCtrl FrameCtrl<7:0> = 0 | PIDCmp | X | X | X | Type<2:0> FrameCtrl<15:8> = SAMode<1:0> | 0 | X | DAMode<1:0> | 0 | 0 where, Type is not Acknowledge and X is either of {0,1} TABLE 5-6: DESTINATION ADDRESSING OPTIONS (IEEE 802.15.4™) USING THE EXAMPLE Broadcast Unicast Options Command (or Data) Beacon Long Short Implied to Coordin. DestPID | DestAddr XX,XX | FF, FF — D1,D2 | A1, A2,…, A8 D1,D2 | B1, B2 — TYPE xxx 000 xxx xxx not 000 DAMode 10 00 11 10 00 Address Filter BCREJ — Note 1: NOTMEREJ, UNIREJ — DAMode = 01 is reserved and is rejected by NSTDREJ = 1. TABLE 5-7: SOURCE ADDRESSING OPTIONS (IEEE 802.15.4™) USING THE EXAMPLE Long (Explicit SrcPID) Long (Implied SrcPID) Short (Explicit SrcPID) Short (Implied SrcPID) None SrcPID | SrcAddr D1,D2 | 01, 02, 03,…, 08 01, 02, 03,…, 08 D1, D2 | 11, 12 11, 12 — Options TYPE xxx xxx xxx xxx xxx SAMode 11 11 10 10 00 DAMode xx 1x xx 1x xx PIDCmp 0 1 0 1 x Note 1: SAMode = 01, is reserved, and is rejected by NSTDREJ = 1. The valid address formats are summarized in Table 5-8 for all frame types. Broadcast and unicast cases are distinguished in the case of command and data frames. 2015 Microchip Technology Inc. Unicast frames are either addressed to the receiving node or to a different node. UNIREJ and NOTMEREJ are sensitive to the former or the latter case, respectively. Broadcast command and data frames are filtered when BCREJ is set. The parser does not filter the Beacon frames. Preliminary DS70005023C-page 141 MRF24XA REGISTER 5-2: RXFILTER (RX FILTER) – WHEN IEEE 802.15.4™ MODE ADDRESS: 0x18 R/W-0 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 PANCRDN CRCREJ CMDREJ DATAREJ UNIREJ NOTMEREJ BCREJ NSTDREJ bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-4 Out of scope bit 3 UNIREJ: Unicast Reject Enable bit(2) Setting this bit enables the user to reject all unicast packets as in: 802.15.4 Mode: PAN Identifier matches with the PANID<15:0> or 0xFFFF, and Destination Address matches the address in the ADDR<63:0> or SHADDR<15:0> register, which the DAMode selects. Proprietary Mode: Destination Address matches the address in ADDR<ADDRSZ<2:0>*8-1:0> register, provided that DAddrPrsnt Frame Control field is set(1). 1 = Reject all Unicast packets addressed to this node 0 = Disable Unicast Rejection NOTMEREJ: Not Me Unicast Reject Enable bit(3) bit 2 Setting this bit enables the user to reject all unicast packets as in: 802.15.4 Mode: Destination PAN Identifier does not match PANID<15:0> and is not 0xFFFF (broadcast) or Destination Address does not match the address in the ADDR<63:0> register or the SHADDR<15:0> register, which the DAMode selects. Proprietary Mode: Destination Address matches the address in ADDR<ADDRSZ<2:0>*8-1:0> register, provided that DAddrPrsnt Frame Control field is set(1). 1 = Reject all Unicast packets NOT addressed to this node 0 = Disable Not Me Unicast Rejection Filtering bit 1 BCREJ: Broadcast Rejection bit 802.15.4 Mode: Setting this bit enables the user to reject all Broadcast packets of type Data or Command. A Data or Command packet is broadcast when Short Destination Addressing is used (DAMode = 10) and Short Address is equal 0xFFFF. Proprietary Mode: Setting this bit enables the user to reject all Broadcast packets of type Data or Command (or Streaming). A packet is broadcast when FrameCtrl[Broadcast] is set. 1 = Reject Broadcast Packets 0 = Disable Broadcast Rejection NSTDREJ: Non-Standard Frame Reject bit(4) bit 0 This bit enables the user to reject all 802.15.4 frames having 01 for the DAMode or SAMode fields or having the most significant bit (MSb) (bit 2) in the Type field set (1) or having the MSb (bit 1) in the Frame Version field set to(1). 1 = Reject all Non-Standard 802.15.4 packets 0 = Disable Non-Standard Rejection Note 1: 2: 3: 4: In Proprietary mode (FRMFMT = 1), when CRCREJ = 1 is used to reject unicast frames not addressed to this node. NOTMEREJ = 1 does not reject these frames. UNIREJ does not affect the frames using implied destination addressing in 802.15.4 mode and inferred destination addressing in Proprietary mode. NOTMEREJ does not affect the frames using implied destination addressing in 802.15.4 mode and inferred destination addressing in Proprietary mode. NSTDREJ does not affect the Proprietary frames in Proprietary mode. DS70005023C-page 142 Preliminary 2015 Microchip Technology Inc. MRF24XA When a valid frame gets filtered, RXFLTIF is set, otherwise, RXIF terminates the successful reception. For more information, refer to Register 5-1. Invalid addressing formats are produced if: • Either DAMode or SAMode are set to the reserved value of ‘01’. • DAMode or SAMode values are used with an incompatible Type field value. For example, - Beacon with DAMode = 1x - DAMode = 00, SAMode = 00 used with Type of Beacon/Command / Data. • PIDCmp is set on an inconsistent way to DAMode and SAMode. • SrcPID or SrcAddr holds ‘FFFF’, or if DestPID holds ‘FFFF’ while DAMode = 11. • LENGTH field is less than the MHR length computed from FrameCtrl. TABLE 5-8: DA The device checks the first condition and FRMIF is generated. The device does not check the second condition, therefore one out of RXIF, RXFLTIF, FRMIF is expected. The hardware checks the third condition and PIDCmp value is handled as 0. The hardware does not check the fourth condition and RXIF is expected. All other invalid formats also produces one out of RXIF, RXFLTIF, and FRMIF. IEEE 802.15.4™ TEST CASES: VALID ADDRESSING FORMATS PID SA COMP DEST(2) Field TYPES(3) Sizes in Octets(4) Description(5) 00 0(1) 00 BC3 A 0|0|0|0 Acknowledge Frame (no Auto-ACK) 10 0(1) 00 BC1 C,D 2|2|0|0 Short destination (xxxx|FFFF), No Source 10 0(1) 00 BC2 C,D 2|2|0|0 Short destination (FFFF|xxxx), No Source 10 0 (1) 00 UNI C,D 2|2|0|0 Short destination, No Source 10 0(1) 00 NOTME C,D 2|2|0|0 Short destination, No Source 11 0(1) 00 UNI C,D 2|8|0|0 Long destination, No Source 11 0(1) 00 NOTME C,D 2|8|0|0 Long destination, No Source 00 0(1) 10 BC3 B 0|0|2|2 Beacon frame sent by the Coordinator 00 0 (1) 10 UNI2, PANCRDN C,D 0|0|2|2 Implied addressing to Coordinator node. UNI2 for Coordinator. 00 0(1) 10 NOTME2, PANCRDN C,D 0|0|2|2 Implied addressing to Coordinator node. NOTME2 for all nodes other. 00 0(1) 11 BC3 B 0|0|2|8 Beacon frame sent by the Coordinator 00 0(1) 11 — C,D 0|0|2|8 Implied addressing to Coordinator node. UNI2 for Coordinator. 00 0(1) 11 NOTME2, PANCRDN C,D 0|0|2|8 Implied addressing to Coordinator node. NOTME2 for all nodes other. 10 0(1) 10 BC1 C,D 2|0|2|2 Short destination (xxxx | FFFF), Short source 10 0(1) 10 BC2 C,D 2|0|2|2 Short destination (FFFF | xxxx), Short source 10 0 10 UNI C,D 2|0|2|2 Short destination, Short source 10 0 10 NOTME C,D 2|2|2|2 Short destination, Short source 10 1 10 BC1 C,D 2|2|0|2 Short destination(xxxx | FFFF), Short source (PID compression) 10 1 10 UNI C,D 2|2|0|2 Short destination, Short source (PID compression) 10 1 10 NOTME C,D 2|2|0|2 Short destination, Short source (PID compression) 10 0 11 BC1 C,D 2|2|2|8 Short destination (xxxx | FFFF), Long source 10 0 11 BC2 C,D 2|2|2|8 Short destination (FFFF | xxxx), Long source 10 0 11 UNI C,D 2|2|2|8 Short destination, Long source 10 0 11 NOTME C,D 2|2|2|8 Short destination, Long source 10 1 11 BC1 C,D 2|2|0|8 Short destination (xxxx | FFFF), Long source (PID compression) 10 1 11 UNI C,D 2|2|0|8 Short destination, Long source (PID compression) 2015 Microchip Technology Inc. Preliminary DS70005023C-page 143 MRF24XA TABLE 5-8: DA IEEE 802.15.4™ TEST CASES: VALID ADDRESSING FORMATS (CONTINUED) PID SA COMP DEST(2) Field TYPES(3) Sizes in Octets(4) Description(5) 10 1 11 NOTME C,D 2|2|0|8 11 0 10 UNI C,D 2|8|2|2 Long destination, Short source 11 0 10 NOTME C,D 2|8|2|2 Long destination, Short source 11 1 10 UNI C,D 2|8|0|2 Long destination, Short source (PID compression) 11 1 10 NOTME C,D 2|8|0|2 Long destination, Short source (PID compression) 11 0 11 UNI C,D 2|8|2|8 Long destination, Long source 11 0 11 NOTME C,D 2|8|2|8 Long destination, Long source 11 1 11 UNI C,D 2|8|0|8 Long destination, Long source (PID compression) 11 1 11 NOTME C,D 2|8|0|8 Long destination, Long source (PID compression) Note 1: The standard requires 0 in the cases marked by (1); yet, 1 is handled as 0 in such cases by the device parser (without erroring out). ‘BC1’- Broadcast addr,’BC2’- Broadcast pid, ‘BC3’- Broadcast no daddr, ‘UNI’- Unicast to this node, ‘UNI2’- Unicast to this node when no destination address is present, ‘NOTME’- Unicast to different node, ‘NOTME2’- Unicast to different node when no destination address is present. Frame Types Legend: ‘A’-acknowledge, ‘B’-beacon, ‘C’-command, ‘D’-data. DESTPID | DESTADDR | SRCPID | SRCADDR. In the descriptions, ‘xxxx’ represents a 4-digit hexa number different from ‘FFFF’. 2: 3: 4: 5: 5.3 Short destination, Long source (PID compression) Security Material The security material required for CBC-MAC, CTR, and CCM are the inputs configured to the registers as listed in Table 5-10. • SECSUITE<3:0> selects the security suite consisting of encryption or authentication, or both, see Table 5-9. • SECHDRINDX<6:0> is the byte index where authentication must start. • SECPAYINDX<6:0> is the byte index where encryption/decryption must start. • SECENDINDX<6:0> points at the last byte of the payload (before MIC and FCS). • SECKEY<127:0> holds the symmetric Key. • SECNONCE<103:0> holds a Nonce value that is unique for each frame while a specific Key is in use. This ensures sequence freshness (for protection against repeat-attack) and protects the key from being deciphered based on the encoded messages. The transmitter generates the information required to generate the Nonce and then sends to the Receiver as plain text as part of the frame. TABLE 5-9: Section 5.4 “Security Material Retrieval with IEEE 802.15.4 Compliant Frames” describes how the security level is selected and whether the device or software fills out the above registers before the security operation is launched. DEVICE/HOST fills in these registers and the Authentication appends a MIC tag to the frame (before FCS is appended), after the position pointed at by SECENDINDX. Encryption/ decryption alters the “payload” stored in the buffer from SECPAYINDX through SECENDINDX. The range defined for “Payload” does not necessarily coincide with the MAC payload as explained in the sequel. Figure 5-2 to Figure 5-9 illustrate the order of all the security operations, which is valid for both 2003/2006 Compliant Framing modes. SECURITY LEVEL: MODE OF OPERATION Security Level(1) Payload MIC Tag of Octets 0000 Plain text No Authentication 0001 Plain text 4 bytes CCM operation. Only defined in 2006. 0010 Plain text 8 bytes CCM operation. Only defined in 2006. 0011 Plain text 16 bytes CCM operation. Only defined in 2006. DS70005023C-page 144 Comment — Preliminary 2015 Microchip Technology Inc. MRF24XA TABLE 5-9: SECURITY LEVEL: MODE OF OPERATION (CONTINUED) Security Level(1) Payload MIC Tag of Octets 0100 Encrypted No Authentication 0101 Encrypted 4 bytes CCM operation. Only defined in 2003/2006. 0110 Encrypted 8 bytes CCM operation. Only defined in 2003/2006. 0111 Encrypted 16 bytes CCM operation. Only defined in 2003/2006. 1000 Encrypted No Authentication ECB operation. Not defined in 2003/2006 (only encryption) 1001 Encrypted No Authentication CTR operation. Only defined in 2003. 1010 Reserved — — 1011 Reserved — — 1100 Reserved — 1101 Plain text 16 bytes CBC-MAC operation. Only defined in 2003. 1110 Plain text 8 bytes CBC-MAC operation. Only defined in 2003. 1111 Plain text 4 bytes CBC-MAC operation. Only defined in 2003. Note 1: CCM operation. Only defined in 2006. — In 2006 compliant framing, the security level is traveling with the frame, while in 2003 it must be set globally. TABLE 5-10: ADDR. Comment SECURITY MATERIAL INPUTS TO CBC-MAC, CTR AND CCM RESGISTER 0x10 MACCON1 0x11 MACCON2 Bit 7 Bit 6 TRXMODE<1:0> Bit 5 Bit 4 Bit 3 ADDRSZ<2:0> Bit 2 SECSUITE<3:0> 0x2B SECHDRINDX SECHDRINDX<6:0> SECPAYINDX SECPAYINDX<6:0> 0x2D SECENDINDX SECENDINDX<6:0> 0x40 through 0x4F SECKEY1 SECKEY<7:0> <2,3,4…,15> … SECKEY16 SECKEY<127:120> SECNONCE1 SECNONCE<7:0> <2,3,4…,12> … SECNONCE13 SECNONCE<103:96> 0x5D SECENCFLAG SECENCFLAG<7:0> 0x5E SECAUTHFLAG SECAUTHFLAG<7:0> 2015 Microchip Technology Inc. Bit 0 CRCSZ FRMFMT SECFLAGOVR CHANNEL<3:0> 0x2C 0x50 through 0x5C Bit 1 Preliminary DS70005023C-page 145 MRF24XA FIGURE 5-5: TX Buffer CCM*/CBC-MAC AUTHENTICATION OPERATION (TX) Length MHR MAC Payload Updating Length Authentication MHR Updating Transmitted Length MAC Payload Tag MAC Payload Tag CRC Generation MHR CRC into the air Exception Handling: TXSZIF: Transmit Packet Size Error Interrupt Flag TXST is set when the packet size (including MIC tags and CRC) is found to be zero or to be greater than the maximum size that the buffers can support. FRMIF: Frame Format Error Interrupt Flag Set if the transmitter/receiver fails to parse the frame in the buffer (it is not as it must be or it is corrupted in demodulation). For example, reserved values are found in the MAC header fields. DS70005023C-page 146 Preliminary 2015 Microchip Technology Inc. MRF24XA FIGURE 5-6: CCM*/CBC-MAC DE-AUTHENTICATION OPERATION (RX)(1, 2) Received from the air Length MHR MAC Payload Tag CRC Data/CMD Payload Tag CRC Data/CMD Payload Tag CRC CRC Check Length MHR MIC Compare RX Buffer Note 1: 2: Length MHR The Length field above refers to the total number of octets as reported by the Baseband, and therefore includes the Tag (MIC), but excludes any RSV octets. If present, RSV octets are placed after the Tag, as these are only received when the complete frame is received. It is the responsibility of software to determine the address of the RSV in the buffer (RSV Address = Length + 1), and to discard/ignore the Tag octets. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 147 MRF24XA FIGURE 5-7: CCM*/CTR/ECB ENCRYPTION OPERATION (TX) TX Buffer Length MHR Data/CMD Payload Encryption Length MHR Updating Encrypted Payload CRC Generation Transmitted into the air Length MHR Encrypted Payload CRC Exception handling: TXSZIF: Transmit Packet Size Error Interrupt Flag TXST is set when the packet size (including MIC tags and CRC) is found to be zero or to be greater than the maximum size that the buffers can support. FRMIF: Frame Format Error Interrupt Flag Set if the transmitter/receiver fails to parse the frame in the buffer (it is not as it must be or it is corrupted in demodulation). For example, reserved values are found in the MAC header fields. DS70005023C-page 148 Preliminary 2015 Microchip Technology Inc. MRF24XA FIGURE 5-8: Received from the air CCM*/CTR/ECB DECRYPTION OPERATION (TX)(1, 2) Length MHR Encrypted Payload CRC Encrypted Payload CRC CRC Check Length MHR Decryption RX Buffer Length MHR Data/CMD Payload CRC Exception Handling: RXTAGIF: Receiver Decryption/Authentication Failure Interrupt Flag Set by the device when decryption/authentication finished with error. Note 1: 2: The Length field above refers to the total number of octets as reported by the Baseband, and therefore includes the Tag (MIC), but excludes any RSV octets. If present, RSV octets are placed after the Tag, as these are only received when the complete frame is received. It is the responsibility of software to determine the address of the RSV in the buffer (RSV Address = Length + 1), and to discard/ignore the Tag octets. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 149 MRF24XA FIGURE 5-9: TX Buffer CCM* ENCRYPTION AND AUTHENTICATION OPERATION (TX) Length MHR MAC Payload Updating Length Authentication MHR MAC Payload Tag Encryption Length MHR Updating Transmitted Length Encrypted Payload Encrypted Tag Encrypted Payload Encrypted Tag CRC Generation MHR into the air CRC Exception handling: TXSZIF: Transmit Packet Size Error Interrupt Flag TXST is set when the packet size (including MIC tags and CRC) is found to be zero or to be greater than the maximum size that the buffers can support. FRMIF: Frame Format Error Interrupt Flag Set if the transmitter/receiver fails to parse the frame in the buffer (it is not as it must be or it is corrupted in demodulation). For example, reserved values are found in the MAC header fields. DS70005023C-page 150 Preliminary 2015 Microchip Technology Inc. MRF24XA FIGURE 5-10: CCM* DECRYPTION AND DE-AUTHENTICATION OPERATION (RX)(1, 2, 3) Received from the air Length MHR Encrypted Payload Encrypted Tag CRC Encrypted Payload Encrypted Tag CRC Data/CMD Payload Tag CRC Data/CMD Payload Tag CRC CRC Check Length MHR Decryption Length MHR MIC Compare RX Buffer Length MHR Exception Handling: RXTAGIF: Receiver Decryption/Authentication Failure Interrupt Flag Set by the device when decryption/authentication finished with error. Note 1: 2: 3: The Length field above refers to the total number of octets as reported by the Baseband, and therefore includes the Tag (MIC), but excludes any RSV octets. If present, RSV octets are placed after the Tag, as these are only received when the complete frame is received. It is the responsibility of software to determine the address of the RSV in the buffer (RSV Address = Length + 1), and to discard/ignore the Tag octets. The Message and Tag decryption operations do not depend on each other, and may be computed in any order. All other factors being equal, the Tag decryption operation must be performed first, as it uses the starting counter value. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 151 MRF24XA 5.4 Security Material Retrieval with IEEE 802.15.4 Compliant Frames This section explains how the security material, see Section 5.3 “Security Material”, is retrieved when the MAC frame is formatted to the IEEE 802.15.4 specification (either FRMFMT = 0 or “bridging”) and security is applied either at the MAC layer or at the NWK layer, or both. Table 5-10 indicates the relevant Configuration registers (SECSUITE<3:0>). Figure 5-11 represents the relevant security fields (SecEn, SecLvl<2:0>, FrameVer<1:0>, FrameCnt, KeyIDMode, KeySrc, KeyIndex). The IEEE 802.15.4 standard enables five different security scenarios. The difference among these scenarios are shown in Table 5-13. If SecEn = 1, then the MAC layer security is enabled. In case NWK layer security is also enabled, then it is calculated before MAC layer security. MAC layer security material retrieval differs in the 2006 and the 2003 versions of the standard. Distinction is possible based on the FrameVer<1:0> field. The device does not support the Security Material retrieval for Beacon frames. The Type<2:0> field distinguishes the Beacon frames. If 2006-MAC layer security is applied, use the FrameCnt, SecLvl, and 8-byte source address to construct the Nonce, see Figure 5-12. If 2003 MAC layer security is applied, use the FrameCnt, KeySeqCnt, and source address to construct the Nonce field, see Figure 5-13. When the frame contains a short source address, the device cannot set the Nonce correctly. Similarly, if the frame is of Type = Beacon, then the SECPAYINDX is set incorrectly. In these cases, the registers must be configured from software. On the RX side, this is easily done before launching the security processing (RXDEC = 1). On the TX-side, set DTSM to prevent the device from overwriting the Nonce and Indexes that the software configures. Only the MAC layer security contains specific indexes as the Network layer security configures the software: In MAC layer security, SECHDRINDX is always the first byte of the MHR. In MAC layer security applied for frames of type Data and Streaming, SECPAYINDX is the first byte of the payload. For Command frames, SECPAYINDX is the second byte of the payload. SECPAYINDX can take different values for Beacon frames, which the software must always specify. KeyIDMode, KeySrc, KeyIndex in the AuxSecHdr are done by software for the retrieval of the MAC layer Symmetric Key, the details are out of scope. DS70005023C-page 152 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 5-3: SECHDRINDX (SECURITY HEADER INDEX REGISTER) R-0 R/W/HS-0000000 r SECHDRINDX<6:0> ADDRESS: 0x2B bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HS = Hardware Set bit 7 Reserved: Maintain as ‘0’ bit 6-0 SECHDRINDX<6:0>: Security Header Index bits x = Bit is unknown This field defines the portion of the header which performs the authentication operations. For MAC layer security, SECHDRINDX<6:0> is defined as the address offset of the MAC header from the beginning of the frame, as stored in the buffer (0 = Length field, 1 = FrameCtrl field, and so on), and is automatically loaded for both 802.15.4 and Proprietary frames. For Network layer security, SECHDRINDX<6:0> is defined as the address offset of the Network Header from the beginning of the MAC Payload, and the Host Controller loads it only for 802.15.4 frames. Note that for Proprietary frames, the MAC automatically loads it(1). Note 1: The setting DTSM in TX mode disables automatic computation of this field. REGISTER 5-4: SECPAYINDX (SECURITY PAYLOAD INDEX REGISTER) R-0 R/W/HS-0000000 r SECPAYINDX<6:0> ADDRESS: 0x2C bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HS = Hardware Set bit 7 Reserved: Maintain as ‘0’ bit 6-0 SECPAYINDX<6:0>: Security Payload Index bits x = Bit is unknown This field defines the portion of the payload which performs the Encryption/Decryption operations. For MAC layer security, SECPAYINDX<6:0> is defined as the address offset of the MAC Payload from the beginning of the frame, as stored in the buffer (0 = Length field, 1 = FrameCtrl field, and so on), and is automatically loaded for both 802.15.4 and Proprietary frames. For Network layer security, SECPAYINDX<6:0> is defined as the address offset of the Network Header from the beginning of the MAC Payload, and the Host Controller loads it only for 802.15.4 frames. Note that for Proprietary frames, the MAC automatically loads it(1). Note 1: The setting DTSM in TX mode disables automatic computation of this field. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 153 MRF24XA REGISTER 5-5: SECENDINDX (SECURITY END INDEX REGISTER) R-0 R/W/HS-0000000 r SECENDINDX<6:0> ADDRESS: 0x2D bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HS = Hardware Set bit 7 Reserved: Maintain as ‘0’ bit 6-0 SECENDINDX<6:0>: Security End Index bits x = Bit is unknown This field defines the end of the payload which performs the security operations(1). Note 1: The setting DTSM in TX mode disables automatic computation of this field. DS70005023C-page 154 Preliminary 2015 Microchip Technology Inc. MRF24XA Figure 5-11 illustrates the construction of the Nonce in 802.15.4-mode. FIGURE 5-11: IEEE.802.15.4™ SECURITY CONTROL FIELDS MHR: MAC Header (IEEE 802.15.4™) Sequence (1 octet) FrameCtrl (2 octets) DestAddr (0/2/8 octets) DestPID (0/2 octets) SrcPID (0/2 octets) SrcAddr (0/2/8 octets) AuxSecHdr (0-14 octets) Source(0/2/4/8/10 octets) Destination (0/4/10 octets) FrameCtrl (IEEE 802.15.4 2003) Byte 1 Byte 0 7 6 5 Rsvd. PIDCmp (1 bit) (1 bit) 0 4 3 AckReq FramePend SecEn (1 bit) (1 bit) (1 bit) x x x 1/0 2:0 7:6 5:4 3:2 1:0 Type (3 bits) SAMode (2 bits) FrameVer (2 bits) DAMode (2 bits) Rsvd. (2 bits) Beacon/ Data/ Command xx xx 00 2003-00 / 2006-01 AuxSecHdr (IEEE 802.15.4™–2006) FrameCnt 4 octets SecCtr 1 octet KeySrc 0/4/8 octets KeyIndex 0/1 octet AuxSecHdr (IEEE 802.15.4™–2003) KeySeqCnt 1 octet FrameCnt 4 octets SecCtr (IEEE 802.15.4) 7:5 4:3 Reserved KeyIDMode (3 bits) (2 bits) NONCE<103:0> 2:0 SecLvl (3 bits) KeyIDMode KeySrc # Octets 00 0 01 0 10 11 4 8 KeyIDMode KeyIndex # Octets 00 0 01,10,11 1 SECSUITE<2:0> in MACCON2 (SECSUITE<3> 0) 8-byte SrcAddr 2015 Microchip Technology Inc. Preliminary DS70005023C-page 155 MRF24XA FIGURE 5-12: 63:56 802.15.4 CCM NONCE (ONLY MAC LAYER SECURITY)-2006 55:48 47:40 39:32 31:24 23:16 15:8 7:0 SrcAddr (8 Octets) 31:24 23:16 15:8 7:0 7:0 {5'b00000, SecLvl} (1 Octet) FrameCtr (4 Octets) 13 Octets Note: The originator device automatically fills in SrcAddr field using the values of registers ADDR8 through ADDR1 irrespective of the SAMode. The recipient host must fill in the nonce if SAMode is different from ‘11’. FIGURE 5-13: 7:0 802.15.4 CCM NONCE (ONLY MAC LAYER SECURITY)-2003 15:8 23:16 31:24 39:32 47:40 55:48 63:56 SrcAddr (8 Octets) 7:0 15:8 FrameCtr (4 Octets) 23:16 31:24 7:0 KeySeqCnt (1 Octet) 13 Octets Note: The originator device automatically fills in SrcAddr field using the values of registers ADDR8 through ADDR1 irrespective of the SAMode. The recipient host must fill in the nonce if SAMode is different from ‘11’. DS70005023C-page 156 Preliminary 2015 Microchip Technology Inc. MRF24XA 5.5 Transmit Security Processing of IEEE 802.15.4 Compliant Frames Setting TXST triggers automatic MAC layer security processing and frame sending as an uninterrupted sequence, see Figure 5-14. (network layer) which is triggered by TXENC is applied, where TXENCIF must be awaited before other operation. FIGURE 5-14: BUF1TXPP, BUF2TXPP, TXENC, and TXST can trigger security functions as shown in Figure 5-12 and Figure 5-14, where BUF1TXPP and BUF2TXPP are both used for debug. The respective interrupts are generated on completion and the device automatically clears the aforementioned triggering bits. In Figure 512, the device shows the conditions for security material retrieval and the operation of the DTSM bit. TRANSMIT SECURITY PROCESSING WHEN FRMFMT = 0 (IEEE 802.15.4™ FORMAT) Before launching the transmit processing (Figure 4-9): • SW always configures SECKEY • SW may configure SECSUITE, SECNONCE, SECHDRINDX, SECPAYINDX, SECENDINDX Enter MHR Parsed 0 SecEn 1 MAC Security 0 SAMode DTSM 1 Parse AHR no security Configure SECSUITE, SECNONCE, SECHDRINDX, SECPAYINDX, SECENDINDX. CTR, CBC-MAC, CCM* LENTGH is incremented when a MIC tag is attached. TXSZIF is set when LENGTH>0x7F. Exit 2015 Microchip Technology Inc. Preliminary DS70005023C-page 157 MRF24XA FIGURE 5-15: TRANSMITTER TXENC PROCESSING WHEN FRMFMT = 0 (IEEE 802.15.4™ FORMAT) SW configured SECKEY, SECSUITE, SECNONCE, SECHDRINDX, SECPAYINDX and SECENDINDX. TXENC is only required for NWK layer security processing. TXENC 1 CTR, CBC-MAC and CCM LENTGH is incremented when a MIC tag is attached. New LENGTH must not exceed 0x7F. Otherwise TXSZIF is set. 0 TXSZIF? 1 TXENC TXENCIF 0 1 TXENC 0 Interrupt Service Length is affected. MAC MAC/NWK. Exception Handling: TXSZIF: Transmit Packet Size Error Interrupt Flag TXST is set when the packet size (including MIC tags and CRC) is found to be zero or to be greater than the maximum size that the buffers can support. FRMIF: Frame Format Error Interrupt Flag DS70005023C-page 158 Preliminary 2015 Microchip Technology Inc. MRF24XA 5.6 Security Processing of Received IEEE 802.15.4 Compliant Frames Receive security is always performed when RXDEC is set and awaits RXDECIF or RXTAGIF as it is not automatically triggered . If both MAC and NWK layer security are applied, then both must be processed in this order when RXDEC is set for a second time after updating the security material correctly. FIGURE 5-16: Figure 5-17 shows the security functions triggered by RXDEC. The device automatically clears the respective interrupts generated on completion and RXDEC. SECURITY MATERIAL RETRIEVAL SUPPORT IN RECEIVE PROCESSING WHEN FRMFMT = 0 (IEEE 802.15.4™ FORMAT) Enter MHR Parsed SecEn 0 1 MAC Security Parse AHR Configure SECSUITE, SECNONCE, SECHDRINDX, SECPAYINDX, SECENDINDX. For Beacon frames, the Configuration must be overridden by SW. Exit After RXIF is asserted: • SW always configures SECKEY. • SW may need to configure SECSUITE, SECNONCE, SECHDRINDX, SECPAYINDX, SECENDINDX. Length is affected. MAC MAC/NWK. Exception Handling: FRMIF: Frame Format Error Interrupt Flag The bit is set if the transmitter/receiver fails to parse the frame in the buffer (it is not as it must be or it is corrupted in demodulation). For example, reserved values found in the MAC header fields. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 159 MRF24XA FIGURE 5-17: RECEIVER RXDEC PROCESSING WHEN FRMFMT = 0 (IEEE 802.15.4™-MODE) The valid frame is available in BUF2 in Mission mode, or in the buffer selected by BUF1RXPP or BUF2RXPP during debug. Device and SW have both parsed the frame. Figure 5-16 illustrates the security material retrieval support. SW has configured SECKEY as required for the frame, and can also overwrite the configurations in SECSUITE, SECNONCE, SECHDRINDX, SECPAYINDX, SECENDINDX. RXDEC 1 AES-CCM Authentication failed MIC tag mismatch? Success RXDEC RXDECIF RXDEC RXTAGIF 0 1 0 1 Interrupt Service DS70005023C-page 160 Preliminary 2015 Microchip Technology Inc. MRF24XA 5.7 Security Procedure for IEEE 802.15.4 Compliant Frames For more information about the frame format, refer to Table 5-12 through Table 5-14 and Figure 5-3. TABLE 5-11: Name MACCON1 RELEVANT REGISTER BITS FOR SECURITY CONTROL WITH IEEE 802.15.4™ FRAMES Bit 7 Bit 6 Bit 5 TRXMODE<1:0> Bit 4 Bit 3 ADDRSZ<2:0> Bit 2 Bit 1 Bit 0 CRCSZ FRMFMT SECFLAGOVR Legend: r = Reserved, read as ‘0’. TABLE 5-12: DEFINITION OF SECURITY SUPPORT CATEGORIES (IEEE 802.15.4™ FRAMES) Security Support Category SecEn FrameVer <1:0> Type<2:0> (and SAMode) 0 0 0x Data/CMD/Beacon/ACK No security A 1 0x Data/CMD 2003/2006 MAC layer security Description B 1 0x Beacon 2003/2006 MAC layer secured beacon C 0 0x Data/(CMD)/Beacon NWK layer security D 1 0x Data/CMD NWK + 2003/2006 MAC layer security E 1 0x Beacon NWK + 2003/2006 MAC layer security for Beacon frames 2015 Microchip Technology Inc. Preliminary DS70005023C-page 161 MRF24XA TABLE 5-13: # SECURED FRAME TRANSMISSION (IEEE 802.15.4™ MAC FORMAT) Processing Step Steps per each Security Case A B C D E SecEn = 1 FrameVer = 0x (either) SecEn = 1 FrameVe = 0x (either) SecEn = 0 FrameVer = 0x (either) SecEn = 1 FrameVer = 0x (either) SecEn = 1 FrameVer = 0x (either) SECKEY SECSUITE SEC*INDX(1) NONCE SECKEY SECSUITE SEC*INDX NONCE SECKEY SECSUITE SEC*INDX NONCE 1 Host MCU constructs the frame and loads the buffer. 2 For NWK security processing, Host MCU configures: 3 Host MCU triggers security processing without sending. TXENC ← 1 TXENC ← 1 TXENC ← 1 4 Device performs the security processing for NWK layer if TXENC is set. LENGTH and SECENDINDX are updated if MIC takg is appended. TXSZIF if size run over 127 bytes. NWK layer security LENGTH, SECENDINDX NWK layer security LENGTH, SECENDINDX NWK layer security LENGTH, SECENDINDX 5 Host MCU awaits TXENCIF interrupt, indicating completion. Device clears TXENC. TXENCIF ← 1 TXENC ← 0 TXENCIF ← 1 TXENC ← 0 TXENCIF ← 1 TXENC ← 0 6 For MAC security processing, Host MCU configures: SECKEY (+NONCE, if SAMode is not 11) (+SECSUITE, if FRAMEVER=2003) SECKEY SECSUITE SEC*INDX NONCE No MAC security SECKEY (+NONCE, if SAMode is not 11) (+SECSUITE, if FRAMEVER=200 3) SECKEY SECSUITE SEC*INDX NONCE 7 Host MCU sets DTSM to inhibit the hardware from overwriting just configured SECSUITE, SEC*INDX and NONCE registers. DTSM = 0 (=1, if SAMode is not 11) DTSM = 1 DTSM = x DTSM = 0 (=1, if SAMode is not 11) DTSM = 1 8 Host MCU triggers Security processing and sending. TXST ← 1 TXST ← 1 TXST ← 1 TXST ← 1 TXST ← 1 9 If SecEn = 1 and DTSM = 0, then the device configures the SECSUITE, SEC*INDX and NONCE registers. SECSUITE SEC*INDX NONCE — — SECSUITE SEC*INDX NONCE — MAC layer security LENGTH, if MIC added MAC layer security LENGTH, if MIC added — MAC layer security LENGTH, if MIC added MAC layer security LENGTH, if MIC added 10 Device performs the security processing for MAC layer: LENGTH is adjusted if MIC tag is appended. TXSZIF if size runs over 127 bytes. 11 LENGTH is adjusted as CRC is appended (if CRCSZ = 1). TXSZIF if size runs over 127 bytes. 12 Frame is sent. Note 1: No NWK layer security. LENGTH, CRC TXIF (if no TXSZIF or FRMIF) TXST ← 0 SEC*INDX denotes SECHDRINDX, SECPAYINDX and SECENDINDX. DS70005023C-page 162 Preliminary 2015 Microchip Technology Inc. MRF24XA TABLE 5-14: # SECURED FRAME RECEPTION (IEEE 802.15.4™ MAC FORMAT) Processing Step Steps per each security case A B C D E -2 Device parses the SecEn bit in the FrameCtrl. SecEn = 1 SecEn = 1 SecEn = 0 SecEn = 1 SecEn = 1 -1 For MAC security processing, the device configures (correctly or incorrectly) the following: SECSUITE SEC*INDX NONCE incorrect Configuration No MAC layer security SECSUITE SEC*INDX NONCE incorrect Configuration 0 Valid frame received on air and accepted by RXFILTER. 1 Host MCU has the opportunity to check the SecEn, FrameVer and SAMode bits in the MAC header. FrameVer = 0x (either) FrameVer = 0x (either) 2 For MAC security processing, the Host MCU must load the following: SECKEY (+NONCE if SAMode is not 11) 3 Host MCU starts MAC security processing by setting RXDEC. 4 RXIF = 1, RXBUFFUL = 1, (RXSFDIF = 1) FrameVer = 0x (either) FrameVer = 0x (either) SECKEY SECSUITE SEC*INDX NONCE SECKEY (+NONCE if SAMode is not 11) SECKEY SECSUITE SEC*INDX NONCE RXDEC ← 1 RXDEC ← 1 RXDEC ← 1 RXDEC ← 1 Device performs MAC layer security processing as illustrated in Figure 5-4 through Figure 5-9. MAC layer MAC layer MAC layer MAC layer 5 If Authentication fails then RXTAGIF is generated. Otherwise, the security operation is successful and RXDECIF is generated. RXDECIF (or RXTAGIF) RXDECIF (or RXTAGIF) RXDECIF (or RXTAGIF) RXDECIF (or RXTAGIF) 6 SW examines RXTAGIF, if set, SW aborts further processing and frees the buffer by clearing RXBUFFUL.. RXTAGIF ← 1 RXTAGIF ← 1 RXTAGIF ← 1 RXTAGIF ← 1 7 For NWK security processing, the Host MCU must load the following: SECKEY SECSUITE SEC*INDX NONCE SECKEY SECSUITE SEC*INDX NONCE SECKEY SECSUITE SEC*INDX NONCE 8 Host MCU starts NWK security processing by setting RXDEC. RXDEC ← 1 RXDEC ← 1 RXDEC ← 1 9 Device performs NWK layer security processing. (No figure) NWK layer security NWK layer security NWK layer security RXDECIF (or RXTAGIF) RXDEC ← 0 RXDECIF (or RXTAGIF) RXDEC ← 0 RXDECIF (or RXTAGIF) RXDEC ← 0 10 No NWK layer security If Authentication fails , RXTAGIF is generated. Otherwise, the security operation is successful and RXDECIF is generated. The device clears RXDEC. FrameVer = 0x (either) No MAC layer Security 11 SW examines RXTAGIF, if set, SW aborts further processing and frees the buffer by clearing RXBUFFUL. 12 SW reads the entire frame from the buffer. — 13 SW clears the RXBUFFUL to free the buffer. — 2015 Microchip Technology Inc. For the length Preliminary DS70005023C-page 163 MRF24XA 5.8 Security Examples The following section provides examples for the usage of MRF24XA security. 5.8.1 802.15.4-2006 COMPLIANT FRAME ANNEX C.2.2 (TYPE A) 12. MRF24XA transmits the packet to the medium. MRF24XA is waiting for an ACKnowledge frame. Different IF is received based on the register settings (for example, TX with CSMA). TX Buffer (0x200) content: 20 || 69 DC 84 21 43 02 00 00 00 00 48 DE AC 01 00 00 00 00 48 DE AC || 04 05 00 00 00 || D4 3E 02 2B || E0 18 Configuration: • Network Configuration: Extended address, PAN Compression, and ACKReq • Source address: 0xACDE480000000001, where 01 is at address 0x1F • Destination address: 0xACDE480000000002 • PANID 0x4321, where 21 is at address 0x29 • Payload: 61 62 63 64 • Frame counter: 0x00000005 • Security level: 0x04 • Packet: Data packet. 5.8.1.1 1. compliant, follow 2. these Host MCU constructs the frame and loads the buffer: 3. 1E || 69 DC 84 21 43 02 00 00 00 00 48 DE AC 01 00 00 00 00 48 DE AC || 04 05 00 00 00 || 61 62 63 64 2. 3. 4. 5. 6. — — — — Host MCU configures SECKEY. 0xC0C1C2C3C4C5C6C7C8C9CACBCCCDCECF, where LSB (0xCF) is at address 0x40 7. 8. 9. Host MCU clears DTSM. Host MCU issues TXST. MRF24XA configures: - SECSUITE to 0x04 - SECNONCE to 0xACDE4800000000010000000504, where MSB (0xAC) is at address 0x5C - SECHDRINDX to 0x01 - SECPAYINDX to 0x1B - SECENDINDX to 0x1E. 10. MRF24XA performs CCM* encryption, where Reception MRF24XA receives the following packet through the antenna: 20 || 69 DC 84 21 43 02 00 00 00 00 48 DE AC 01 00 00 00 00 48 DE AC || 04 05 00 00 00 || D4 3E 02 2B || E0 18 Transmission For 802.15.4-2006 transmission flow: 1. 5.8.1.2 4. 5. MRF24XA configures: - SECSUITE to 0x04 - SECNONCE to 0xACDE4800000000010000000504, where MSB (0xAC) is at address 0x5C - SECHDRINDX to 0x01 - SECPAYINDX to 0x1B - SECENDINDX to 0x1E. MRF24XA asserts RXIF (RXSFDIF): - Packet accepted by RX filter - ACK frame: 05 || 02 10 84 || 05 E2 sent to medium (asserts TXSFD, TXMAIF). — Host MCU downloads SECKEY 0xC0C1C2C3C4C5C6C7C8C9CACBCCCDCEC F, where LSB (0xCF) is at address 0x40. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. Host MCU issues RXDEC. MRF24XA performs CCM* decryption, D4 3E 02 2B is decrypted to 61 62 63 64. MRF24XA asserts RXDECIF (and IDLEIF). — — — — — — SW read the entire frame from the Rx Buffer (0x300): 20 || 69 DC 84 21 43 02 00 00 00 00 48 DE AC 01 00 00 00 00 48 DE AC || 04 05 00 00 00 || 61 62 63 64 || E0 18 || RSVs 61 62 63 64 is encrypted to D4 3E 02 2B. 11. MRF24XA appends CRC: 0x18E0 . DS70005023C-page 164 Preliminary 2015 Microchip Technology Inc. MRF24XA 5.8.2 802.15.4-2006 COMPLIANT FRAME ANNEX C.2.3 (TYPE A) • Network Configuration: Extended address, ACKReq • Source address: 0xACDE480000000001, where 01 is at address 0x1F • Source PANID: 0X4321, where 21 is at address 0x29 • Destination address: 0xACDE480000000002 • Destination PANID: 0xFFFF • Payload: 01 CE • Frame counter: 0x00000005 • Security level: 0x06 • Packet: Command packet 5.8.2.1 1. 12. MRF24XA transmits the packet to the medium. MRF24XA is waiting for an ACK frame. Different IF is received based on the register settings (for example, TX with CSMA). TX Buffer (0x200) content: 28 || 2B DC 84 21 43 02 00 00 00 00 48 DE AC FF FF 01 00 00 00 00 48 DE AC || 06 05 00 00 00 || 01 D8 || 4F DE 52 90 61 F9 C6 F1 || E4 4F 5.8.2.2 1. 2. Transmission Host MCU constructs the frame and loads the buffer: — — — — Host MCU configures SECKEY 3. 0xC0C1C2C3C4C5C6C7C8C9CACBCCCDCECF, where LSB (0xCF) is at address 0x40. 7. 8. 9. 4. 5. Host MCU clears DTSM register. Host MCU issues TXST. MRF24XA configures: - SECSUITE to 0x06 - SECNONCE to 0xACDE4800000000010000000504, where MSB (0xAC) is at address 0x5C - SECHDRINDX to 0x01 - SECPAYINDX to 0x1E (remember when Type = CMD, first octet of payload is not encrypted) - SECENDINDX to 0x1E. 10. MRF24XA performs CCM* authentication with encryption, where 01 CE is encrypted to 01 D8, and the following MIC tag is attached: MRF24XA configures: - SECSUITE to 0x06 - SECNONCE to 0xACDE4800000000010000000504, where MSB (0xAC) is at address 0x5C - SECHDRINDX to 0x01 - SECPAYINDX to 0x1E - SECENDINDX to 0x26. MRF24XA asserts RXIF (RXSFDIF): - Packet accepted by RX filter - ACK frame: 05 || 02 10 84 || 05 E2 sent to medium (asserts TXSFD, TXMAIF). — Host MCU downloads SECKEY 0xC0C1C2C3C4C5C6C7C8C9CACBCCCDCECF, where LSB (0xCF) is at address 0x40. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 4F DE 52 90 61 F9 C6 F1 Host MCU issues RXDEC. MRF24XA performs CCM* de-authentication and decryption, where the MIC tag is compared against the received one, and 01 D8 is decrypted to 01 CE. MRF24XA asserts RXDECIF (and IDLEIF). — — — — — — SW can read the entire frame from Rx Buffer (0x300): 28 || 2B DC 84 21 43 02 00 00 00 00 48 DE AC FF FF 01 00 00 00 00 48 DE AC || 06 05 00 00 00 || 01 CE || 4F DE 52 90 61 F9 C6 F1 || E4 4F || RSVs 11. MRF24XA appends CRC: 0x4FE4. 2015 Microchip Technology Inc. MRF24XA receives the following packet through the antenna: 28 || 2B DC 84 21 43 02 00 00 00 00 48 DE AC FF FF 01 00 00 00 00 48 DE AC || 06 05 00 00 00 || 01 D8 || 4F DE 52 90 61 F9 C6 F1 || E4 4F 1E || 2B DC 84 21 43 02 00 00 00 00 48 DE AC FF FF 01 00 00 00 00 48 DE AC || 06 05 00 00 00 || 01 CE 2. 3. 4. 5. 6. Reception Preliminary DS70005023C-page 165 MRF24XA 5.8.3 • • • • • • • • • NWK LAYER SECURITY (TYPE C) Network Configuration: Extended address Source address: N/A Source PANID: N/A Destination address: 0x9897969594939291 Destination PANID: 0xD2D1 Network header: 41 41 Network payload: 14 14 Network security level: 0x06 Packet: Data packet 5.8.3.1 1. 1. 3. 4. 2. 3. Transmission Host MCU constructs the frame and loads the buffer: Host MCU configures security materials: - SECSUITE register to 0x06 - SECNONCE register to 0xFDFCFBFAF9F8F7F6F5F4F3F2F1, where MSB (0xFD) is at address 0x5C - SECKEY register to 0x0F0E0D0C0B0A0908070605040302010, where LSB (0x00) is at address 0x40 - SECHDRINDX register to 0x0E - SECPAYINDX register to 0x10 - SECENDINDX register to 0x11. Host MCU issues TXENC. MRF24XA performs CCM* authentication with encryption, where 14 14 is encrypted to 14 DA, and the following MIC tag is attached: 53 99 39 A1 55 C5 D3 F6 5. 6. 7. 8. 9. 10. 11. 12. Reception MRF24XA receives the following packet through the antenna: 1B || 01 0C 14 D1 D2 91 92 93 94 95 96 97 98 || 41 41 14 DA 53 99 39 A1 55 C5 D3 F6 || C9 9B 11 || 01 0C 14 D1 D2 91 92 93 94 95 96 97 98 || 41 41 14 14 2. 5.8.3.2 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. MRF24XA asserts TXENCIF (and IDLEIF). — — Host MCU issues TXST. — — MRF24XA appends CRC: 0x9BC9. MRF24XA transmits the packet to the medium. Different IF is received based on the register settings (for example, TX with CSMA). — MRF24XA asserts RXIF (RXSFDIF): Packet accepted by RX filter. — — — — — — Host MCU configures security materials: - SECSUITE to 0x06 - SECNONCE to 0xFDFCFBFAF9F8F7F6F5F4F3F2F1, where MSB (0xFD) is at address 0x5C - SECKEY to 0x0F0E0D0C0B0A0908070605040302010, where 00 is at address 0x40 - SECHDRINDX to 0x0E - SECPAYINDX to 0x10. Host MCU issues RXDEC. MRF24XA performs CCM* de-authentication and decryption, where the MIC tag is compared against the received one and 14 DA is decrypted to 14 14. MRF24XA asserts RXDECIF (and IDLEIF). — SW can read the entire frame from Rx Buffer (0x300): 1B || 01 0C 14 D1 D2 91 92 93 94 95 96 97 98 || 41 41 14 14 53 99 39 A1 55 C5 D3 F6 || C9 9B || RSVS TX Buffer (0x200) content: 1B || 01 0C 14 D1 D2 91 92 93 94 95 96 97 98 || 41 41 14 DA 53 99 39 A1 55 C5 D3 F6 || C9 9B DS70005023C-page 166 Preliminary 2015 Microchip Technology Inc. MRF24XA 5.8.4 802.15.4-2006 COMPLIANT FRAME WITH NWK LAYER SECURITY (TYPE D) • Network Configuration: Extended address • Source address: 0x0807060504030201, where LSB (0x01) is at address 0x1F • Source PANID: 0xC2C1, where LSB (0xC1) is at address 0x29 • Destination address: 0x9897969594939291 • Destination PANID: 0xD2D1 • Network header: 41 41 • Network payload: 14 14 • Network security level: 0x06 • Frame counter: 0x55555555 • Security level: 0x07 • Packet: Command packet 5.8.4.1 1. Transmission Host MCU constructs the frame and loads the buffer: 9. MRF24XA configures: - SECSUITE to 0x07 - SECNONCE to 0x08070605040302015555555507, where MSB (0x08) is at address 0x5C - SECHDRINDX to 0x01 - SECPAYINDX to 0x1D - SECENDINDX to 0x38. 10. MRF24XA performs CCM* authentication with encryption, where 41 41 14 DA 53 99 39 A1 55 C5 D3 F6 is encrypted to C9 87 C6 D8 7F E4 BD A2 A4 00 89 9F, and the following MIC tag is attached: B4 E6 9C B1 54 7F 9B B3 4089 77 FB 93 34 E2 D6 11. MRF24XA appends CRC: 0x1AA8. 12. MRF24XA transmits the packet to the medium. Different IF is received based on the register settings (for example, TX with CSMA). TX Buffer (0x200) content: 3A || 09 DC 14 D1 D2 91 92 93 94 95 96 97 98 C1 C2 01 02 03 04 05 06 07 08 || 07 55 55 55 55 || C9 87 C6 D8 7F E4 BD A2 A4 00 89 9F B4 E6 9C B1 54 7F 9B B3 40 89 77 FB 93 34 E2 D6 || A8 1A 20 || 09 DC 14 D1 D2 91 92 93 94 95 96 97 98 C1 C2 01 02 03 04 05 06 07 08 || 07 55 55 55 55 || 41 41 14 14 2. 3. 4. 5. 6. Host MCU configures security materials for NWK: - SECSUITE register to 0x06 - SECNONCE register to 0xFDFCFBFAF9F8F7F6F5F4F3F2F1, where MSB (0xFD) is at address 0x5C - SECKEY register to 0x0F0E0D0C0B0A0908070605040302010, where LSB (0x00) is at address 0x40 - SECHDRINDX register to 0x1D - SECPAYINDX register to 0x1F - SECENDINDX register to 0x20. Host MCU issues TXENC. MRF24XA performs CCM* authentication with encryption, where 41 41 14 14 is encrypted to 41 41 14 DA, and the following MIC tag is attached: 53 99 39 A1 55 C5 D3 F6 MIC-TAG. MRF24XA asserts TXENCIF (and IDLEIF). Host MCU downloads SECKEY 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40. 7. 8. Host MCU clears DTSM register. Host MCU issues TXST. 5.8.4.2 1. MRF24XA receives the following packet through the antenna: 3A || 09 DC 14 D1 D2 91 92 93 94 95 96 97 98 C1 C2 01 02 03 04 05 06 07 08 || 07 55 55 55 55 || C9 87 C6 D8 7F E4 BD A2 A4 00 89 9F B4 E6 9C B1 54 7F 9B B3 40 89 77 FB 93 34 E2 D6 || A8 1A 2. 3. 4. 5. MRF24XA configures: - SECSUITE to 0x07 - SECNONCE to 0x08070605040302015555555507, where MSB (0x08) is at address 0x5C - SECHDRINDX to 0x01 - SECPAYINDX to 0x1D - SECENDINDX to 0x38. MRF24XA asserts RXIF (RXSFDIF): Packet accepted by RX filter. — Host MCU configures SECKEY 0xC0C1C2C3C4C5C6C7C8C9CACBCCCDCECF, where LSB (0xCF) is at address 0x40. 6. 7. 2015 Microchip Technology Inc. Reception Preliminary Host MCU issues RXDEC. MRF24XA performs CCM* de-authentication and decryption, where the MIC tag is compared against the received one, and C9 87 C6 D8 7F E4 BD A2 A4 00 89 9F is decrypted to 41 41 14 DA 53 99 39 A1 55 C5 D3 F6 DS70005023C-page 167 MRF24XA 8. MRF24XA asserts RXDECIF (and IDLEIF). 9. — 10. Host MCU configures security materials: - SECSUITE to 0x06 - SECNONCE to 0xFDFCFBFAF9F8F7F6F5F4F3F2F1, where MSB (0xFD) is at address 0x5C - SECKEY to 0x0F0E0D0C0B0A0908070605040302010, where LSB (0x00) is at address 0x40 - SECHDRINDX to 0x1D - SECPAYINDX to 0x1F. 11. Host MCU issues RXDEC. 12. MRF24XA performs CCM* de-authentication and decryption, where the MIC tag is compared against the received one, and 14 DA is decrypted to 14 14. 13. MRF24XA asserts RXDECIF (and IDLEIF). 14. — 15. SW can read the entire frame from the RxBuffer (0x300): 3A || 09 DC 14 D1 D2 91 92 93 94 95 96 97 98 C1 C2 01 02 03 04 05 06 07 08 || 07 55 55 55 55 || 41 41 14 14 53 99 39 A1 55 C5 D3 F6 B4 E6 9C B1 54 7F 9B B3 40 89 77 FB 93 34 E2 D6 || A8 1A || RSVs 5.8.5 802.15.4-2003 COMPLIANT FRAME (TYPE A) • Network Configuration: Extended address, PAN compression • Source address: 0x0807060504030201, where 01 is at address 0x1F • Destination address: 0xAAAAAAAAAAAAAAAA • PANID: 0x3412 where 12 is at address 0x29 • Payload: FF • Frame counter: 0x0403020100 • Key sequence counter: 0x12 • Security level: CCM-32 (SecLevel: 0x05) • Packet: Data packet 5.8.5.1 1. Transmission Host MCU constructs the frame and loads the buffer: 1B || 49 CC 01 12 34 AA AA AA AA AA AA AA AA 01 02 03 04 05 06 07 08 || 01 02 03 04 05 || FF 2. 3. 4. 5. 6. — — — — Host MCU configures SECKEY: 0x000102030405060708090A0B0C0D0E0F, where LSB (0x0F) is at address 0x40. 7. 8. 9. Host MCU clears DTSM. Host MCU issues TXST. MRF24XA configures: - SECNONCE to 0x01020304050607080102030405, where MSB (0x01) is at address 0x5C - SECHDRINDX to 0x01 - SECPAYINDX to 0x1B - SECENDINDX to 0x1B. 10. MRF24XA performs CCM* authentication with encryption, where FF is encrypted to AC, and the following MIC tag is attached: FC 30 DB BD 11. MRF24XA appends CRC: 0xEB32. 12. MRF24XA transmits the packet to the medium. Different IF is received based on the register settings (for example, TX with CSMA). TX Buffer (0x200) content: 21 || 49 CC 01 12 34 AA AA AA AA AA AA AA AA 01 02 03 04 05 06 07 08 01 02 03 04 05 || AC FC 30 DB BD || 32 EB DS70005023C-page 168 Preliminary 2015 Microchip Technology Inc. MRF24XA 6.0 PROPRIETARY FRAME FORMAT AND FRAME PROCESSING 6.1 Proprietary MAC Frame Configuration Figure 6-1 shows the proprietary MAC header structure. Figure 6-2 shows the specific format of Acknowledge frame. The frame buffer is written first with the LENGTH field byte, and then followed by the FrameCtrl field. An optional Acknowledge Info field is sent before the SEQUENCE. FIGURE 6-1: PROPRIETARY MAC HEADER STRUCTURE MHR: MAC Header (Proprietary) FrameCtrl (1 octets) AckInfo (0-1 octets) Sequence DestAddr (0-8 octets) Destination SrcAddr (0-8 octets) AuxSecHdr (0-3 octets) Source 1 byte of FrameCtrl (Proprietary) 7 SAddrPrsnt (1 bit) 6.2 6 5 4 DAddrPrsnt (1 bit) AckReq (1 bit) Repeat (1 bit) 3 1:0 2 SecEn (1 bit) Type (2 bits) Broadcast (1 bit) Frame Types TABLE 6-1: Frame Type FRAME TYPES (BOTH PROTOCOLS) IEEE Mi-Wi Data 001 01 Filtered by DATAREJ Command 011 11 Filtered by CMDREJ First byte of payload (Command) is never encrypted. Ack 010 10 Acknowledge Frame Must be generated by the receiver (from SW or HW) if AckReq = 1 in the last received frame, using the same sequence number. Acknowledge Frame is generated by hardware (AUTOACKEN = 1). If this is the case, it is not loaded to the TX frame buffer. AUTOACKEN = 1 requires CRCSZ = 1 on both the transmitter and the receiver side. 000 (limited HW support) N/A Filtered by BCREJ Otherwise, this device does not provide support for parsing on Beacon frames. Security processing requires adjusting the payload index (SECPAYINDX). Beacon frames are only used with broadcast addressing. Beacon 2015 Microchip Technology Inc. Description Preliminary DS70005023B-page 169 MRF24XA TABLE 6-1: FRAME TYPES (BOTH PROTOCOLS) (CONTINUED) Frame Type Streaming IEEE Mi-Wi Description N/A 00 TRXMODE= 01 by transmitter TRXMODE= 10 by receiver The two buffers are handled by alternating between the two to service a single direction. Security parsing makes no distinction between Streaming frames and Data frames. Streaming frames are never acknowledged. FIGURE 6-2: PROPRIETARY MAC HEADER STRUCTURE: ACKNOWLEDGE FRAME Acknowledge Frame (Proprietary) MHR Length (1 octet) FrameCtrl (1 octet) Sequence (1 octet) FCS (2 octets) 1 byte of FrameCtrl (Proprietary) = 0x06 7 SAddrPrsnt (1 bit) 0 6.3 5 6 DAddrPrsnt (1 bit) 4 3 AckReq (1 bit) Repeat (1 bit) SecEn (1 bit) 0 0 0 0 2 Broadcast (1 bit) 1 1:0 Type (2 bits) 10 Addressing in Proprietary Framing Mode The following fields are handled using these examples: • • • • • • Header Sequence number Address Data/Command CRC Inferred Destination Addressing: The Destination Address participates in the CRC computation as part of the frame, but it is omitted from the frame that is sent into the air. DS70005023B-page 170 Preliminary 2015 Microchip Technology Inc. MRF24XA TABLE 6-2: RELEVANT REGISTERS FOR PROPRIETARY MODE ADDRESSING ADDR. REGISTER Bit 7 Bit 6 0x10 MACCON1 TRXMODE<1:0> 0x1F ADDR1 Bit 5 Bit 4 Bit 3 ADDRSZ<2:0> Bit 2 Bit 1 Bit 0 CRCSZ FRMFMT SECFLAGOVR ADDR<7:0> 0x20 ADDR2 ADDR<15:8> 0x21 ADDR3 ADDR<23:16> 0x22 ADDR4 ADDR<31:24> 0x23 ADDR5 ADDR<39:32> 0x24 ADDR6 ADDR<47:40> 0x25 ADDR7 ADDR<55:48> 0x26 ADDR8 ADDR<63:56> Legend: r = Reserved, read as ‘0’. TABLE 6-3: EXAMPLE CONFIGURATION TX and RX Common ADDRSZ<2:0>= 101 => (means that ADDR<63:40> is not used) TX (Source) Configuration ADDR<63:0>= 0xxxxx060504030201 (4 MSBs not used) SHADDR<15:0> = xx xx (not used) PANID <15:0> = xx xx (not used) RX (Destination) Configuration ADDR<63:0>= 0xxxxx969594939291 (4 MSBs not used) SHADDR<15:0> = xx xx (not used) PANID <15:0> = xx xx (not used) FrameCtrl Type<1:0> | Broadcast| 0 | 0 | 0 | DAPrsnt | SAPrsnt Type is not Acknowledge (not = 00) Frame Length | FrameCtrl | Sequence++ | DEST | SRC | Payload | (CRC) TABLE 6-4: LEGAL DESTINATION ADDRESSING OPTIONS USING THE EXAMPLE Unicast Options: Broadcast ADDRSZ<2:0> Inferred Example DEST. — 0x969594939291 — Type xx xx xx Broadcast 1 0 0 DAPrsn x 1 0 ADDRSZ<2:0> xxx 3'b101 xxx CRCSZ x xx 1 TABLE 6-5: LEGAL SOURCE ADDRESSING OPTIONS USING THE EXAMPLE Options: Unicast ADDRSZ<2:0> Inferred Example SRC. 0x060504030201 — Type xx xx SAPrsnt 0 0 ADDRSZ<2:0> 3'b101 xxx 2015 Microchip Technology Inc. Preliminary DS70005023B-page 171 MRF24XA REGISTER 6-1: RXFILTER (RX FILTER REGISTER) ADDRESS: 0x18 R/W-0 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 PANCRDN CRCREJ CMDREJ DATAREJ UNIREJ NOTMEREJ BCREJ NSTDREJ bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-6 Out of Scope bit 5 CMDREJ: Command Frame Reject Enable bit Setting this bit enables the user to reject all packets with FrameCtrl<Type> equal to Command. 1 = Reject all Command packets 0 = Disable Command Frame Rejection bit 4 DATAREJ: Data Frame Reject Enable bit Setting this bit enables the user to reject all packets with FrameCtrl<Type> equal to Data. 1 = Reject all Data packets 0 = Disable Data Frame Rejection bit 3-0 Out of Scope DS70005023B-page 172 Preliminary 2015 Microchip Technology Inc. MRF24XA 6.3.1 INFERRED DESTINATION ADDRESSING Inferred destination addressing is indicated in the Proprietary frame format through the combination of DAddrPresent = 0 and Broadcast = 0 flags in the frame header (FrameControl field) and CRCSZ = 1 in the MACCON1 register. The transmitter calculates the CRC over the complete frame, see Figure 6-3, but drops the Destination Address (DAddr) from the transmitted one, see Figure 6-4. The receiver checks the CRC with its own address inserted. In the case of a match the frame is FIGURE 6-3: As the framing overhead becomes shorter, the dutycycle of the radio gets decreased or the throughput gets increased. Therefore, the energy consumed by sending a single byte can outweigh the energy budget of hundreds of MCU byte-operations, the impact on battery life is straightforward. Note that in case of Inferred DA, the ACKINFO field is mandatory when AckReq = 1. Otherwise, the ACKINFO field is only mandatory if ADPTDREN = 1 or ADPTCHEN = 1. INFERRED DESTINATION ADDRESS MODE Transmitter constructs the frame FrameCtrl accepted, otherwise it is silently discarded. This way CRC filtering takes over the role of Address-Match filtering. SeqNo (1) DAddr SAddr Payload Payload CRC CRC DAddr present = False Frame sent into the air without the DAddr field FrameCtrl SeqNo SAddr = Receiver checks the CRC using its own node address FrameCtrl SeqNo NAddr SAddr Payload CRC . Note 1: The indicated frame format is arbitrary to some extent. SeqNo and SAddr refer to sequence number and source address respectively. 2015 Microchip Technology Inc. Preliminary DS70005023B-page 173 MRF24XA 6.4 Security Material Retrieval Support with Proprietary Frames FIGURE 6-4: PROPRIETARY MAC AUXSECHDR OCTETS (ONLY PRESENT WHEN SECEN = 1) SecLayer = 00 (MAC layer security only) 7:2 1:0 MacPayIndex (6 bits) SecLayer (2 bits) 1-byte SecLayer = 01 (NWK layer security only) 15:9 8:2 1:0 NetPayIndex (7 bits) NetHdrIndex (7 bits) SecLayer (2 bits) 2 bytes SecLayer = 10 (MAC and NWK layer security) 23 22:16 15 14:8 7:2 1:0 0 NetPayIndex (7 bits) 0 NetHdrIndex (7 bits) MacPayIndex (6 bits) SecLayer (2 bits) 3 bytes Note: Always encode Security Indices with DA present (Inferred DA mode). As the MacPayIndex and NetPayIndex fields can point anywhere in the frame (within the range of pointer representation), it is the arbitrary choice of the application weather the Nonce and the Security Suite is included in the frame or not. DS70005023B-page 174 Preliminary 2015 Microchip Technology Inc. MRF24XA 6.5 Security Processing of Transmitted Proprietary Frames TXENCIF must be awaited, then MAC security is configured and TXST is set to launch the MAC security processing and sending. Setting TXST triggers automatic security processing and frame sending as an uninterrupted sequence as shown in Figure 6-5. which is triggered by TXENC is only required when both NWK layer and MAC layer security are applied, see Figure 6-6. In this case, TXENC is set to perform NWK layer security and FIGURE 6-5: BUF1TXPP, BUF2TXPP, TXENC, and TXST can trigger security functions as shown in Figure 6-5 and Figure 6-6, where BUF1TXPP and BUF2TXPP are both used for debug. The respective interrupts are generated on completion and the device automatically clears the aforementioned triggering bits. Figure 6-5 illustrates the conditions for security material retrieval. TRANSMIT SECURITY PROCESSING WHEN FRMFMT = 1 (PROPRIETARY– FORMAT) Before launching the transmit processing (Figure 4-9) - SW always configures SECKEY, SECSUITE, SECNONCE. - SW must never configure SECHDRINDX, SECPAYINDX, SECENDINDX, except if DTSM = 1. MHR parsed already Enter 0 SecEn 1 1 DTSM 0 AHR parsed No SecLayer = 00 OR SecLayer = 10 No MAC security left to do SecLayer = 01 Yes SecLayer = 11 is undefined SECHDRINDX 1 SECPAYINDX MACPayIndex Yes No security NWK security to do only SECHDRINDX SECPAYINDX NetHdrIndex NetPayIndex CTR, CBC-MAC, CCM* Exit 2015 Microchip Technology Inc. Preliminary DS70005023B-page 175 MRF24XA FIGURE 6-6: TRANSMITTER TXENC PROCESSING WHEN FRMFMT = 1 (PROPRIETARY – FORMAT) SW configured SECKEY, SECSUITE and SECNONCE. TXENC TXENC is only required for NWK layer security processing in the case when SecLayer = 10 (implying that MAC layer security is applied on setting TXST). 1 No SecLayer = 10 NWK+MAC layer Yes 1 DTSM 0 SECHDRINDX SECPAYINDX Do NWK layer NetHdrIndex NetPayIndex Unintended use: SECHDRINDX, SECPAYINDX and SECENDINDX configured for MAC layer CTR, CBC-MAC, CCM* TXENC 0 Interrupt Service DS70005023B-page 176 Preliminary 2015 Microchip Technology Inc. MRF24XA 6.6 Security Processing of Received Proprietary Frames Figure 6-7 shows the security functions triggered by RXDEC. The respective interrupts are generated on completion and the device automatically clears the RXDEC. Receive security is always performed when RXDEC is set and awaits RXDECIF or RXTAGIF as it is not automatically triggered. If both MAC and NWK layer security are applied, then both must be processed in this order when RXDEC is set for a second time after updating the security material correctly. FIGURE 6-7: RECEIVER RXDEC PROCESSING WHEN FRMFMT = 1 (PROPRIETARY) The valid frame is available in BUF2 in Mission mode, or in the buffer selected by BUF1RXPP or BUF2RXPP during debug. Device and SW have both parsed the frame. Refer to Figure 6-4 for security material retrieval support. SW has configured SECKEY SECSUITE, SECNONCE as required for the frame, and can also overwrite the configurations in SECHDRINDX, SECPAYINDX RXDEC 1 CTR, CBC-MAC, CCM* No Match MIC tag match? Yes SecLayer =10? No Yes SECHDRINDX SECPAYINDX SECENDNDX NetHdrIndex NetPayIndex MIC-tag length Authentication failed Success Upon successful MAC layer processing, if Network layer is also secured, the indexes are retrieved. SW must update SECKEY, SECNONCE, SECSUITE RXDEC RXDECIF 0 1 RXDEC RXTAGIF 0 1 Interrupt Service 2015 Microchip Technology Inc. Preliminary DS70005023B-page 177 MRF24XA 6.7 Security Procedure for Proprietary Frames Provided that SecEn is set (1) in the MHR, three levels of security processing are possible, based on the SecLayer<1:0> bits carried in the AuxSecHdr<1:0> field of a given frame: 00-MAC only, 01-NWK only, 10-MAC and NWK. TABLE 6-6: SECURED FRAME TRANSMISSION (PROPRIETARY MAC FORMAT) # Steps per each Security Case Processing Step MAC only NWK only MAC + NWK layer 1 Host MCU constructs the frame and loads the buffer. SecEn = 1 SecEn = 1 SecEn = 1 2 For NWK security processing, Host MCU configures: No NWK layer security SECKEY SECSUITE NONCE SECKEY SECSUITE NONCE No TXENC. Host: TXENC ← 1 3 Host MCU triggers security processing without sending. 4 Device performs the security processing for NWKlayer if TXENC is set. SECPAYINDX, SECHDRINDX are filled in from NetHdrIndex, NetPayIndex, respectively. SECENDINDX initially points at the last payload byte. LENGTH and SECENDINDX are updated if MIC tag is appended. TXSZIF if size runs over 127 bytes. NWK layer security SECPAYINDX SECHDRINDX LENGTH, SECENDINDX 5 Host MCU awaits TXENCIF interrupt, indicating completion. Device clears TXENC. TXENCIF ←1 TXENC ← 0 6 For MAC security processing, Host MCU configures: SECKEY SECSUITE NONCE No MAC security. SECKEY SECSUITE NONCE 7 Host MCU triggers Security processing and sending. Host: TXST ←1 Host: TXST ←1 Host: TXST ←1 8 If SecEn = 1 and DTSM = 0 then the device configures the SEC*INDX registers using MacPayIndex, MacHdrIndex and the LENGTH field. SECHDRINDX SECPAYINDX SECENDINDX — SECHDRINDX SECPAYINDX SECENDINDX 9 Device performs the security processing for the indicated layer: LENGTH is adjusted if MAC or NWK layer MIC tag is appended. TXSZIF if size run over 127 bytes. MAC layer security LENGTH if MIC added NWK layer security LENGTH if MIC added MAC layer security LENGTH if MIC added 10 LENGTH is adjusted as CRC is appended (if CRCSZ = 1). TXSZIF if size run over 127 bytes. 11 Frame is sent. DS70005023B-page 178 LENGTH, CRC TXIF (if no TXSZIF or FRMIF) TXST ← 0 Preliminary 2015 Microchip Technology Inc. MRF24XA TABLE 6-7: # SECURED FRAME RECEPTION (PROPRIETARY MAC FORMAT) Steps per each Security Case Processing Step -2 Device parses the SecEn bit in the FrameCtrl. -1 For MAC security processing, the device configures the SECHDRINDX, SECPAYINDX based on the Auxiliary Security Header, as well as the SECENDINDX based on the LENGTH field. MAC only NWK only MAC + NWK layer SecEn = 1 SecEn = 1 SecEn = 1 SEC*INDX from MacHdrIndex, MacPayIndex and the LENGTH SEC*INDX from NetHdrIndex, NetPayIndex and the LENGTH SEC*INDX from MacHdrIndex, MacPayIndex and the LENGTH 0 Valid frame received and accepted by RXFILTER. 1 Host MCU reads the frame header to check SecEn, SecLayer, source address, and so on. RXIF = 1, RXBUFFUL = 1, (RXSFDIF = 1) 2 For MAC security processing, the Host MCU must load the following: SECKEY NONCE SECSUITE 3 Host MCU starts MAC security processing by setting RXDEC. Host: RXDEC ←1 Host: RXDEC ←1 4 Device performs MAC layer security. MAC layer security MAC layer security 5 If SecLayer = 10 then SEC*INDX are filled in preparation for network layer security processing following in the sequel. — SEC*INDX from NetHdrIndex, NetPayIndex and the MAC layer MIC-position (if present) 6 If Authentication fails then RXTAGIF is generated otherwise the security operation is successful and RXDECIF is generated. Device clears RXDEC. RXDECIF (or RXTAGIF) RXDEC ← 0 RXDECIF (or RXTAGIF) RXDEC ← 0 7 SW examines RXTAGIF. If set, SW aborts further processing and frees the buffer by clearing RXBUFFUL. RXTAGIF ←1 RXTAGIF ←1 8 For NWK security processing, the Host MCU must No load the following: NWK layer security 9 Read frame header from buffer. No MAC layer security SECKEY NONCE SECSUITE SECKEY SECSUITE NONCE SECKEY SECSUITE NONCE Host MCU starts NWK security processing by setting RXDEC. Host: RXDEC ←1 Host: RXDEC ←1 10 Device performs NWK layer security processing. (No figure). NWK layer security NWK layer security 11 If Authentication fails then RXTAGIF is generated. Otherwise, the security operation is successful and RXDECIF is generated. Device clears RXDEC. RXDECIF (or RXTAGIF) RXDEC ← 0 RXDECIF (or RXTAGIF) RXDEC ← 0 12 SW examines RXTAGIF. If set, SW aborts further processing and frees the buffer by clearing RXBUFFUL. RXTAGIF ←1 RXTAGIF ←1 13 SW reads the payload from the buffer. — — 14 SW clears the RXBUFFUL to free the buffer. 2015 Microchip Technology Inc. RXBUFFUL ← 0 Preliminary DS70005023B-page 179 MRF24XA 6.8 Security Examples This section provides examples for Proprietary mode framing. 6.8.1 1. TX Buffer (0x200) content: MAC LAYER SECURITY EXAMPLE 1 • Network Configuration: Address size is 8 bytes • Source address: 0x0807060504030201, where LSB (0x01) is at address 0x1F • Destination address: 0x9897969594939291 • Payload: BA BA • MAC security level: 0x04 • MAC security indices: Only encode from the second payload • Packet: Data packet 6.8.1.1 11. MRF24XA transmits the packet to the medium. Different IF is received based on the register settings (for example, TX with CSMA). 17 || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 54 || BA F7 || 0A 9D 6.8.1.2 1. MRF24XA receives the following packet through the antenna: 17 || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 54 || BA F7 || 0A 9D 2. Transmission Host MCU constructs the frame and loads the buffer: 3. 15 || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 54 || BA BA 4. 5. — — — — Host MCU configures: - SECSUITE to 0x04 - SECKEY to 0x0F0E0D0C0B0A0908070605040302010, where LSB (0x00) is at address 0x40 - SECNONCE to 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c. 7. Host MCU sets the TXST register 8. MRF24XA configures: - SECHDRINDX to 0x01 - SECPAYINDX to 0x15 - SECENDINDX to 0x15. 9. MRF24XA performs CCM* encryption, where BA BA is encrypted to BA F7. 10. MRF24XA appends CRC: 0x9D0A. Reception 2. 3. 4. 5. 6. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. MRF24XA configures: - SECHDRINDX to 0x01 - SECPAYINDX to 0x15 - SECENDINDX to 0x15. MRF24XA asserts RXIF (RXSFDIF): Packet accepted by RX filter. — Host MCU configures: - SECSUITE to 0x04 - SECKEY to 0x0F0E0D0C0B0A0908070605040302010, where LSB (0x00) is at address 0x40 - SECNONCE to 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c. Host MCU issues RXDEC. MRF24XA performs CCM* decryption, where BA F7 is decrypted to BA BA. MRF24XA asserts RXDECIF (and IDLEIF). — — — — — — — SW read the entire frame from RX Buffer (0x300): 17 || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 54 || BA BA || 0A 9D || RSVs DS70005023B-page 180 Preliminary 2015 Microchip Technology Inc. MRF24XA 6.8.2 MAC LAYER SECURITY EXAMPLE 2 • Network Configuration: Address size is 8 bytes, Inferred destination addressing • Source address: 0x0807060504030201, where LSB (0x01) is at address 0x1F • Destination address: 0x9897969594939291 • Payload: BA BA • MAC security level: 0x07 • MAC security indices: Only encode from the second payload • Packet: Data packet 6.8.2.1 1. Transmission 9. TX Buffer (0x200) content: 1F || 09 55 91 92 93 94 95 96 97 98 || 34 || BA F7 || 00 11 6C 8C 59 02 66 AC 5B DC 2D 30 21 1E D0 0C || D2 A2 6.8.2.2 — — — — Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c. Host MCU issues TXST. MRF24XA configures - SECHDRINDX to 0x01 - SECPAYINDX to 0x0D - SECENDINDX to 0x0D. MRF24XA performs CCM* authentication with encryption, where BA BA is encrypted to BA F7, and the following MIC tag is attached: 00 11 6C 8C 59 02 66 AC 5B DC 2D 30 21 1E D0 0C 10. MRF24XA appends CRC: 0xA2D2. Reception MRF24XA receives the following packet through the antenna: Host MCU constructs the frame and loads the buffer: Always encode Security Indices with DA present in AUXSECHDR! 7. 8. 17 || 09 55 || 34 || BA F7 || 00 11 6C 8C 59 02 66 AC 5B DC 2D 30 21 1E D0 0C || D2 A2 1. 15 || 09 55 91 92 93 94 95 96 97 98 || 34 || BA BA 2. 3. 4. 5. 6. 11. MRF24XA transmits the packet to the medium. Different IF is received based on the register settings (for example, TX with CSMA). Packet transmitted to the medium: 17 || 09 55 || 34 || BA F7 || 00 11 6C 8C 59 02 66 AC 5B DC 2D 30 21 1E D0 0C || D2 A2 2. 3. 4. 5. - - 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. MRF24XA configures: - SECHDRINDX to 0x01 - SECPAYINDX to 0x0D (inferred DA is considered) - SECENDINDX to 0x15. MRF24XA asserts RXIF (RXSFDIF): Packet accepted by RX filter. — Host MCU configures: SECSUITE to 0x07 SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 SECNONCE to 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c. Host MCU issues RXDEC. MRF24XA performs CCM* de-authentication and decryption, where the MIC tag is compared against the received one, and BA F7 is decrypted to BA BA. MRF24XA asserts RXDECIF (and IDLEIF). — — — — — — SW read the entire frame from RX Buffer (0x300): 17 || 09 55 || 34 || BA BA || 00 11 6C 8C 59 02 66 AC 5B DC 2D 30 21 1E D0 0C || D2 A2 || RSVs 2015 Microchip Technology Inc. Preliminary DS70005023B-page 181 MRF24XA 6.8.3 MAC LAYER SECURITY EXAMPLE 3 • Network Configuration: Address size is 1 byte, Inferred destination addressing • Source address: 0x01 (is at address 0x1F) • Destination address: 0x91 • Payload: BA BA • MAC security level: 0x07 • MAC security indices: Only encode from the second payload • Packet: Data packet 6.8.3.1 1. 2. 3. 4. 5. 6. 7. 8. 9. 6.8.3.2 1. Host MCU constructs the frame and loads the buffer: 06 || 09 55 91 || 18 || BA BA. Always encode security indices with DA present in AUXSECHDR! — — — — Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c. Host MCU issues TXST. MRF24XA configures: - SECHDRINDX to 0x01 - SECPAYINDX to 0x06 - SECENDINDX to 0x06. MRF24XA performs CCM* authentication with encryption, where BA BA is encrypted to BA F7, and the following MIC tag is attached: MRF24XA receives the following packet through the antenna: 17 || 09 55 || 18 || BA F7 || 35 84 FC 4F 1B 92 36 D2 8F D5 D8 B6 68 79 6A 13 || A9 23 2. 3. Transmission Reception 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 35 84 FC 4F 1B 92 36 D2 8F D5 D8 B6 68 79 6A 13 MRF24XA configures: - SECHDRINDX to 0x01 - SECPAYINDX to 0x06 (inferred DA is considered) - SECENDINDX to 0x15. MRF24XA asserts RXIF (RXSFDIF): Packet accepted by RX filter. — Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE to 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c. Host MCU issues RXDEC. MRF24XA performs CCM* de-authentication and decryption, where the MIC tag is compared against the received one, and BA F7 is decrypted to BA BA. MRF24XA asserts RXDECIF (and IDLEIF). — — — — — — SW read the entire frame from RX Buffer (0x300): 17 || 09 55 || 18 || BA BA || 35 84 FC 4F 1B 92 36 D2 8F D5 D8 B6 68 79 6A 13 || A9 23 || RSVs 10. MRF24XA appends CRC: 0x23A9. 11. MRF24XA transmits the packet to the medium. Different IF is received based on the register settings (for example, TX with CSMA). Packet transmitted to the medium: 17 || 09 55 || 18 || BA F7 || 35 84 FC 4F 1B 92 36 D2 8F D5 D8 B6 68 79 6A 13 || A9 23 TX Buffer (0x200) content: 18 || 09 55 91 || 18 || BA F7 || 35 84 FC 4F 1B 92 36 D2 8F D5 D8 B6 68 79 6A 13 || A9 23 DS70005023B-page 182 Preliminary 2015 Microchip Technology Inc. MRF24XA 6.8.4 NWK LAYER SECURITY EXAMPLE 1 6.8.4.2 1. • Network Configuration: Address size is 8 bytes • Source address: 0x0807060504030201, where LSB (0x01) is at address 0x1F • Destination address: 0x9897969594939291 • Network header: BA BA • Network payload: AB AB • NET security level: 0x01 • Packet: Data packet 6.8.4.1 1. 3. 4. 5. 6. 7. 8. 9. MRF24XA receives the following packet through the antenna: 1E || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 55 2E || BA BA FB 17 32 26 || 70 AA 2. 3. Transmission Host MCU constructs the frame and loads the buffer: 15 || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 55 2E || BA BA AB AB 2. Reception Host MCU configures: - SECSUITE to 0x01 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c. — — — — Host MCU issues TXST. MRF24XA configures: - SECHDRINDX to 0x15 - SECPAYINDX to 0x17 - SECENDINDX to 0x18. MRF24XA performs CCM* authentication, where the following MIC tag is attached: 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. FB 17 32 26 10. MRF24XA appends CRC: 0xAA70. 11. MRF24XA transmits the packet to the medium. Different IF is received based on the register settings (for example, TX with CSMA). MRF24XA configures: - SECHDRINDX to 0x15 - SECPAYINDX to 0x17 - SECENDINDX to 0x18. MRF24XA asserts RXIF (RXSFDIF): Packet accepted by RX filter. — — — — — — — Host MCU configures: - SECSUITE to 0x04 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE to 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c. Host MCU issues RXDEC. MRF24XA performs CCM* de-authentication, where the MIC tag is compared against the received one. MRF24XA asserts RXDECIF (and IDLEIF). — SW read the entire frame from RX Buffer (0x300): 1E || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 55 2E || BA BA FB 17 32 26 || 70 AA || RSVs TX Buffer (0x200) content: 1E || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 55 2E || BA BA FB 17 32 26 || 70 AA 2015 Microchip Technology Inc. Preliminary DS70005023B-page 183 MRF24XA 6.8.5 NWK LAYER SECURITY EXAMPLE 2 2A || 89 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 55 2E || BA BA E6 E5 77 FE 46 E2 D4 0E 1D C6 34 D9 34 36 4F 28 2F D8 || C1 55 • Network Configuration: Address size is 8 bytes, Inferred destination addressing • Source address: 0x0807060504030201 where LSB (0x01) is at address 0x1F • Destination address: 0x9897969594939291 • Network header: BA BA • Network payload: AB AB • Security level: 0x07 • Packet: Data packet 6.8.5.1 1. 6.8.5.2 1. 22 || 89 55 01 02 03 04 05 06 07 08 || 55 2E || BA BA E6 E5 77 FE 46 E2 D4 0E 1D C6 34 D9 34 36 4F 28 2F D8 || C1 55 2. Transmission Host MCU constructs the frame and loads the buffer: 15 || 89 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 55 2E || BA BA AB AB 2. 3. 4. 5. 6. 7. 8. 9. Reception MRF24XA receives the following packet through the antenna: Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c. — — — — Host MCU issues TXST. MRF24XA configures: - SECHDRINDX to 0x15 - SECPAYINDX to 0x17 - SECENDINDX to 0x18. MRF24XA performs CCM* authentication and encryption, where BA BA AB AB is encrypted to BA BA E6 E5, and the following MIC tag is attached: 77 FE 46 E2 D4 0E 1D C6 34 D9 34 36 4F 28 2F D8 10. MRF24XA appends CRC: 0x55C1. 11. MRF24XA transmits the packet to the medium. Different IF is received based on the register settings (for example, TX with CSMA). Packet transmitted to the medium: 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 22 || 89 55 01 02 03 04 05 06 07 08 || 55 2E || BA BA E6 E5 77 FE 46 E2 D4 0E 1D C6 34 D9 34 36 4F 28 2F D8 || C1 55 MRF24XA configures: - SECHDRINDX to 0x15 (inferred DA is considered) - SECPAYINDX to 0x17 (inferred DA is considered) - SECENDINDX to 0x20. MRF24XA asserts RXIF (RXSFDIF): Packet accepted by RX filter. — — — — — — — Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE to 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c. Host MCU issues RXDEC. MRF24XA performs CCM* de-authentication and decryption, where the MIC tag is compared against the received one, and BA BA E6 E5 is decrypted to BA BA AB AB. MRF24XA asserts RXDECIF (and IDLEIF). — SW read the entire frame from RX Buffer (0x300): 22 || 89 55 01 02 03 04 05 06 07 08 || 55 2E || BA BA AB AB 77 FE 46 E2 D4 0E 1D C6 34 D9 34 36 4F 28 2F D8 || C1 55 || RSVs TX Buffer (0x200) content: DS70005023B-page 184 Preliminary 2015 Microchip Technology Inc. MRF24XA 6.8.6 NWK LAYER EXAMPLE 3 6.8.6.2 • Network Configuration: Address size is 1 byte, Inferred destination addressing • Source address: 0x01 (is at address 0x1F) • Destination address: 0x91 • Network header: BA BA • Network payload: AB AB • Security level: 0x07 • Packet: Data packet 6.8.6.1 1. 2. 3. 4. 5. 6. 7. 8. 9. 1. Reception MRF24XA receives the following packet through the antenna: 1B || 89 55 01 || 1D 12 || BA BA E6 E5 77 FE 46 E2 D4 0E 1D C6 34 D9 34 36 4F 28 2F D8 || 05 CD 2. Transmission Host MCU constructs the frame and loads the buffer: 0A || 89 55 91 01 || 1D 12 || BA BA AB AB Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c. — — — — Host MCU issues TXST. MRF24XA configures: - SECHDRINDX to 0x07 - SECPAYINDX to 0x09 - SECENDINDX to 0x0A. MRF24XA performs CCM* authentication and encryption, where BA BA AB AB is encrypted to BA BA E6 E5, and the following MIC tag is attached: 77 FE 46 E2 D4 0E 1D C6 34 D9 34 36 4F 28 2F D8 10. MRF24XA appends CRC: 0xCD05. 11. MRF24XA transmits the packet to the medium. Different IF is received based on the register settings (for example, TX with CSMA). Packet transmitted to the medium: 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. MRF24XA configures: - SECHDRINDX to 0x07 (inferred DA is considered) - SECPAYINDX to 0x09 (inferred DA is considered) - SECENDINDX to 0x19. MRF24XA asserts RXIF (RXSFDIF): Packet accepted by RX filter. — — — — — — — Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE to 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c. Host MCU issues RXDEC. MRF24XA performs CCM* de-authentication and decryption, where the MIC tag is compared against the received one, and BA BA E6 E5 is decrypted to BA BA AB AB. MRF24XA asserts RXDECIF (and IDLEIF). — SW read the entire frame from the RX Buffer (0x300): 1B || 89 55 01 || 1D 12 || BA BA BA BA 77 FE 46 E2 D4 0E 1D C6 34 D9 34 36 4F 28 2F D8 || 05 CD || RSVs 1B || 89 55 01 || 1D 12 || BA BA E6 E5 77 FE 46 E2 D4 0E 1D C6 34 D9 34 36 4F 28 2F D8 || 05 CD TX Buffer (0x200) content: 1C || 89 55 91 01 || 1D 12 || BA BA E6 E5 77 FE 46 E2 D4 0E 1D C6 34 D9 34 36 4F 28 2F D8 || 05 CD 2015 Microchip Technology Inc. Preliminary DS70005023B-page 185 MRF24XA 6.8.7 MAC AND NWK LAYER SECURITY EXAMPLE 1 • Network Configuration: Address size is 8 bytes • Source address: 0x0807060504030201, where LSB (0x01) is at address 0x1F • Destination address: 0x9897969594939291 • Payload: BA BA • Network header: AB • Network payload: AB • Network security level: 0x07 • MAC security level: 0x03 • MAC security indices: Only encode from the second payload • Packet: Data packet 6.8.7.1 1. 3. 4. 5. 8. 05 15 AB 5F 6C 7D 5C 70 6C 96 91 C0 34 E5 18 0D 11. MRF24XA appends CRC: 0x717B. 12. MRF24XA transmits the packet to the medium. Different IF is received based on the register settings (for example, TX with CSMA). TX Buffer (0x200) content: 3B || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 5E 18 19 || BA BA AB E6 AB 4B 03 7B B7 30 98 B1 E5 93 CA D7 86 81 8A 2D 05 15 AB 5F 6C 7D 5C 70 6C 96 91 C0 34 E5 18 0D || 7B 71 Host MCU constructs the frame and loads the buffer: Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c. Host MCU issues TXENC. MRF24XA configures: - SECHDRINDX to 0x18 - SECPAYINDX to 0x19 - SECENDINDX to 0x19. MRF24XA performs CCM* authentication with encryption, where AB AB is encrypted to AB E6, and the following MIC tag is attached: AB 4B 03 7B B7 30 98 B1 E5 93 CA D7 86 81 8A 2D 6. 7. MRF24XA configures: - SECHDRINDX to 0x01 - SECPAYINDX to 0x17 - SECENDINDX to 0x29. 10. MRF24XA performs CCM* authentication, where the following MIC tag is attached: Transmission 19 || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 5E 18 19 || BA BA AB AB 2. 9. MRF24XA asserts TXENCIF (and IDLEIF). Host MCU configures: - SECSUITE to 0x03 - SECKEY to 0xFFFEFDFCFBFAF9F8F7F6F5F4F3F2F1F0, where LSB (0xF0) is at address 0x40 - SECNONCE 0xF8F7F6F5F4F3F2F15555555506, where (0xF8) is at address 0x5c. Host MCU issues TXST. DS70005023B-page 186 6.8.7.2 1. Reception MRF24XA receives the following packet through the antenna: 3B || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 5E 18 19 || BA BA AB E6 AB 4B 03 7B B7 30 98 B1 E5 93 CA D7 86 81 8A 2D 05 15 AB 5F 6C 7D 5C 70 6C 96 91 C0 34 E5 18 0D || 7B 71 2. MRF24XA configures: - SECHDRINDX to 0x01 - SECPAYINDX to 0x17 - SECENDINDX to 0x39. 3. MRF24XA asserts RXIF (RXSFDIF): Packet accepted by RX filter. 4. — 5. Host MCU configures: - SECSUITE to 0x03 - SECKEY to 0xFFFEFDFCFBFAF9F8F7F6F5F4F3F2F1F0, where LSB (0xF0) is at address 0x40 - SECNONCE 0xF8F7F6F5F4F3F2F15555555506, where MSB (0xF8) is at address 0x5c. 6. Host MCU issues RXDEC. 7. MRF24XA performs CCM* de-authentication, where the MIC tag is compared against the received one. 8. MRF24XA configures: - SECHDRINDX to 0x18 - SECPAYINDX to 0x19 - SECENDINDX to 0x29. 9. MRF24XA asserts RXDECIF (and IDLEIF). 10. — Preliminary 2015 Microchip Technology Inc. MRF24XA 11. Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE to 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c. 12. Host MCU issues RXDEC. 13. MRF24XA performs CCM* de-authentication and decryption, where the MIC tag is compared against the received one, and AB E6 is decrypted to AB AB. 14. MRF24XA asserts RXDECIF (and IDLEIF). 15. — 16. SW read the entire frame from the RX Buffer (0x300): 3B || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 5E 18 19 || BA BA AB AB AB 4B 03 7B B7 30 98 B1 E5 93 CA D7 86 81 8A 2D 05 15 AB 5F 6C 7D 5C 70 6C 96 91 C0 34 E5 18 0D || 7B 71 || RSVs 6.8.8 MAC AND NWK LAYER SECURITY EXAMPLE 2 • Network Configuration: Address size is 4 bytes, Inferred destination addressing • Source address: 0x04030201 where LSB (0x01) is at address 0x1F • Destination address: 0x94939291 • Payload: BA BA • Network header: AB • Network payload: AB • Network security level: 0x07 • MAC security level: 0x07 • MAC security indices: Only encode from the second payload • Packet: Data packet 6.8.8.1 1. Transmission Host MCU constructs the frame and loads the buffer: 11 || 89 55 91 92 93 94 01 02 03 04 || 3E 10 11 || BA BA AB AB 2. 3. 4. 5. Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c. Host MCU issues TXENC. MRF24XA configures: - SECHDRINDX to 0x10 - SECPAYINDX to 0x11 - SECENDINDX to 0x11. MRF24XA performs CCM* authentication with encryption, where AB AB is encrypted to AB E6, and the following MIC tag is attached: AB 4B 03 7B B7 30 98 B1 E5 93 CA D7 86 81 8A 2D 6. 7. 8. 2015 Microchip Technology Inc. Preliminary MRF24XA asserts TXENCIF (and IDLEIF). Host MCU configures: - SECSUITE to 0x03 - SECKEY to 0xFFFEFDFCFBFAF9F8F7F6F5F4F3F2F1F0, where LSB (0xF0) is at address 0x40 - SECNONCE 0xF8F7F6F5F4F3F2F15555555506, where (0xF8) is at address 0x5c. Host MCU issues TXST. DS70005023B-page 187 MRF24XA 9. MRF24XA configures: - SECHDRINDX to 0x01 - SECPAYINDX to 0x0F - SECENDINDX to 0x21 10. MRF24XA performs CCM* authentication with encryption, where BA BA AB E6 AB 4B 03 7B B7 30 98 B1 E5 93 CA D7 86 81 8A 2D is encrypted to BA A2 6D 3C 78 90 8F 99 BB E6 6B 29 CC AF A1 6F 14 9B 0D 7A, and the following MIC tag is attached: 23 EB C5 73 E8 44 DA 0E 8D D7 9C E7 06 E1 BD C2 11. MRF24XA appends CRC: 0xF9B3. 12. MRF24XA transmits the packet to the medium. Different IF is received based on the register settings (for example, TX with CSMA). Packet transmitted to the medium: 7. BA A2 6D 3C 78 90 8F 99 BB E6 6B 29 CC AF A1 6F 14 9B 0D 7A is decrypted to BA BA AB E6 AB 4B 03 7B B7 30 98 B1 E5 93 CA D7 86 81 8A 2D 8. 9. 10. 11. 2F || 89 55 01 02 03 04 || 3E 10 11 || BA A2 6D 3C 78 90 8F 99 BB E6 6B 29 CC AF A1 6F 14 9B 0D 7A 23 EB C5 73 E8 44 DA 0E 8D D7 9C E7 06 E1 BD C2 || B3 F9 TX Buffer (0x200) content: 33 || 89 55 91 92 93 94 01 02 03 04 || 3E 10 11 || BA A2 6D 3C 78 90 8F 99 BB E6 6B 29 CC AF A1 6F 14 9B 0D 7A 23 EB C5 73 E8 44 DA 0E 8D D7 9C E7 06 E1 BD C2 || B3 F9 6.8.8.2 1. Reception MRF24XA receives the following packet through the antenna: 12. 13. 14. 15. 16. 2F || 89 55 01 02 03 04 || 3E 10 11 || BA A2 6D 3C 78 90 8F 99 BB E6 6B 29 CC AF A1 6F 14 9B 0D 7A 23 EB C5 73 E8 44 DA 0E 8D D7 9C E7 06 E1 BD C2 || B3 F9 2. 3. 4. 5. 6. MRF24XA performs CCM* de-authentication, where the MIC tag is compared against the received one, and MRF24XA configures: - SECHDRINDX to 0x10 - SECPAYINDX to 0x11 - SECENDINDX to 0x1D. MRF24XA asserts RXDECIF (and IDLEIF). — Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0x0F0E0D0C0B0A0908070605040302010, where LSB (0x00) is at address 0x40 - SECNONCE to 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c. Host MCU issues RXDEC. MRF24XA performs CCM* de-authentication and decryption, where the MIC tag is compared against the received one, and AB E6 is decrypted to AB AB. MRF24XA asserts RXDECIF (and IDLEIF). — SW read the entire frame from RX Buffer (0x300): 2F || 89 55 01 02 03 04 || 3E 10 11 || BA BA AB AB AB 4B 03 7B B7 30 98 B1 E5 93 CA D7 86 81 8A 2D 23 EB C5 73 E8 44 DA 0E 8D D7 9C E7 06 E1 BD C2 || B3 F9 || RSVs MRF24XA configures: - SECHDRINDX to 0x01 - SECPAYINDX to 0x0F (inferred DA is considered) - SECENDINDX to 0x2D. MRF24XA asserts RXIF (RXSFDIF): Packet accepted by RX filter. — Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0xFFFEFDFCFBFAF9F8F7F6F5F4F3F2F1F0, where LSB (0xF0) is at address 0x40 - SECNONCE 0xF8F7F6F5F4F3F2F15555555506, where (0xF8) is at address 0x5c. Host MCU issues RXDEC. DS70005023B-page 188 Preliminary 2015 Microchip Technology Inc. MRF24XA 7.0 ADVANCED LINK BEHAVIOR IN PROPRIETARY PACKET MODE 7.1 Channel Agility Note that in case of Inferred DA, the ACKINFO field is mandatory when AckReq=1. Otherwise the ACKINFO field is mandatory if ADPTDREN = 1 or ADPTCHEN = 1. In some communication environments, where several nodes use the same medium, it is necessary to choose different channels for the communicating nodes. It introduces difficulties in ACK receiving. Figure 7-1 illustrates the example of channel agility. To prevent higher MCU load on channel changing, MRF24XA handles the channel change for the automatic sending of ACK. This feature is enabled by ADPTCHEN bit that must be enabled for all the nodes within the same network. Figure 4-13 describes the ACK sending mechanism. FIGURE 7-1: CHANNEL AGILITY EXAMPLE Interfering Node Interfering Node Channel: 7 Channel: 10 Node B Node A RX Channel: 10 RX Channel: 7 EXAMPLE 7-1: A AUTO ACK EXAMPLE WITH CHANNEL AGILITY B: B: A: CHANNEL = 10(1) CHANNEL = 10(2) RXIF TXST CHANNEL = 7 CHANNEL = 7 Sending ACK back to A CHANNEL = 10 Note 1: 2: Node A knows the frequency channel that Node B uses for receiving. However, Node B knows the RX channel of Node A, as AUTOACK = 1 the ACK must immediately sent back, and there is no time for MCU interactions. Channel Agility is based on AckInfo field of the Proprietary MAC header. Proprietary MAC header is described in Figure 6-1. FIGURE 7-2: PROPRIETARY MAC ACKINFO<7:0> OCTET (ONLY PRESENT WHEN ACKREQ = 1) 7:4 3:0 ACKDataRate (4 bits) ACKChannel (4 bits) 1 Octet AckDataRate: When ADPTDREN = 1 and AckReq = 1, this field determines the TX Data Rate for the ACK packet, regardless of the setting of the DR<3:0> Register field. AckChannel: When ADPTCHEN = 1 and AckReq = 1, this field determines the TX Channel for the ACK packet, regardless of the setting of the CH<3:0> register field. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 189 MRF24XA REGISTER 7-1: RXCON2 (MAC RECEIVE CONTROL 2 REGISTER) R/C/HS-0 R/W-0 R-0 RXBUFFUL IDENTREJ ACKRXFP R/W-0 R/W-0 R/W-0 ADDRESS: 0x16 R/W-0 R/W-0 ACKTXFP AUTORPTEN AUTOACKEN ADPTCHEN ADPTDREN bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HS = Hardware Set C = Clearable bit bit 7-2 Out of scope bit 1 ADPTCHEN: Adaptive Channel Enable bit(1) x = Bit is unknown Setting this bit enables the MAC to set the transmitting channel for the ACK packet based on the AckInfo field (Proprietary packet) of the received packet, rather than the CH<3:0> register bits. 1 = Adaptive Channel feature is enabled 0 = Adaptive Channel feature is disabled bit 0 Note 1: Out of scope Use ADPTCHEN field while receiving and transmitting, and must be unmodified while RXEN or TXST is set. DS70005023C-page 190 Preliminary 2015 Microchip Technology Inc. MRF24XA 7.2 Data Rate Agility Similar to Channel Agility as described in Figure 7.1, ACK is sent at different data rates within different nodes. It may provide more robust ACK sending mechanism in busier networking environments. Data Rate Agility is enabled by the ADPTDREN bit that must be set for all the nodes within the same network. Data Rate Agility is based on AckInfo field of the Proprietary MAC header. Proprietary MAC header is described in Figure 6-1. AckInfo field is described in Figure 7-1. Figure 4-13 describes the ACK sending mechanism. REGISTER 7-2: RXCON2 (MAC RECEIVE CONTROL 2 REGISTER) R/C/HS-0 R/W-0 R-0 RXBUFFUL IDENTREJ ACKRXFP R/W-0 R/W-0 R/W-0 ADDRESS: 0x16 R/W-0 R/W-0 ACKTXFP AUTORPTEN AUTOACKEN ADPTCHEN ADPTDREN bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HS = Hardware Set C = Clearable bit bit 7-1 Out of scope bit 0 ADPTDREN: Adaptive Data Rate Enable bit(1) x = Bit is unknown Setting this bit enables the MAC to set the transmission data rate for the ACK packet based on the AckInfo field (Proprietary packet) of the received packet, rather than the DR<2:0> register bits. 1 = Adaptive Data Rate feature is enabled 0 = Adaptive Data Rate feature is disabled Note 1: Use ADPTDREN field while receiving and transmitting, and must be unmodified while RXEN or TXST is set. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 191 MRF24XA 7.3 Auto-Repeater The Auto-Repeat feature enables to automatically (without Host Controller intervention) repeat any packets that request it (FrameCtrl[Repeat] = 1). Auto-Repeat is not available in RX- or TX- Streaming modes as these modes are designed to provide maximum throughput rather than reliable transport. Only Data and Command frames are repeated with Auto-Repeat. If MRF24XA receives a Data or Command frame with its FrameCtrl[Repeat] bit set, the frame may be repeated without MCU intervention when AUTORPTEN register bit is set. If the packet is a Unicast packet, and its Destination Address (explicit or inferred) matches the ADDR<63:0> register, then the packet is not repeated, but received as a normal packet instead. If the packet is a Broadcast packet, or is a Unicast packet with a nonmatching address, the packet is received into the buffer, and then retransmitted (repeated) without modification (no CRC generation or encryption steps are performed). It is recommended to use this function together with the CSMA/CA algorithm to avoid the collision with the IDENTREJ = 1 function. Therefore, packet received more than twice is not repeated. DS70005023C-page 192 Preliminary 2015 Microchip Technology Inc. MRF24XA 7.4 Streaming 7.4.1 The Streaming feature provides the maximum throughput between two nodes. In this mode, the two packet buffers are used to transmit/receive packets by alternating between the two. The main advantage of this mode is that MCU can perform buffer RW while the packet is being transmitted over the air. Auto-ACK and Auto-Retransmission are unavailable in this mode. Additionally, CSMA-CA operation is skipped to provide the maximum throughput. TX After the initial negotiation (channel, power, security key, and so on), the TX node sets the TRXMODE<1:0> register to 2’b10. The MCU shall write the packets to address 0x200. The switching is handled internally. Note that MCU must write MRF24XA if the TXBUFFEMPTY flag is set. To maximize throughput, “WRITE and set TXST” SPI framing format is recommended. Note that TXRDBUF, BUSWRBUF, and TXBUFEMPTY signals are the output on the GPIO pins with GPIOMODE = 1010 settings. Handling buffer empty flag by an additional interrupt is recommended to avoid constant polling over SPI. FIGURE 7-3: STREAMING MODE TX TIMELINE 2015 Microchip Technology Inc. Preliminary DS70005023C-page 193 MRF24XA 7.4.2 RX After the initial negotiation (channel, power, security key, and so on), the RX node sets the TRXMODE<1:0> register to 2’b01. The MCU must read the packets from address 0x300. The switching is handled internally. Note that MCU must read MRF24XA when the RXBUFFULL flag is set. In Streaming mode receiving packets after RXIF do not work. To maximize throughput, “READ and clear RXBUFFULL” SPI framing format is recommended. FIGURE 7-4: DS70005023C-page 194 Note that RXWRBUF, BUSRDBUF, and RXBUFFUL signals are the output on the GPIO pins with GPIOMODE = 1011 settings. Handling buffer full flag by an additional interrupt is recommended to avoid constant polling over SPI. To reach optimal sensitivity, turn Power Save (PSAV) off. STREAMING RX TIMELINE Preliminary 2015 Microchip Technology Inc. MRF24XA 7.4.3 STREAM RX TIMEOUT The radio sets STRMIF to indicate that the time defined in STRMTO register has elapsed. REGISTER 7-3: PIR3 (PERIPHERAL INTERRUPT REGISTER 3) R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 RXIF RXDECIF RXTAGIF R-0 r ADDRESS: 0x06 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 RXIDENTIF RXFLTIF RXOVFIF STRMIF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7-1 Out of Scope bit 0 STRMIF: Receive Stream Time-Out Error Interrupt Flag bit x = Bit is unknown Set by the device to indicate that the duration specified in STRMTO elapsed since the last received packet while in RX-Streaming mode, and the MAC clears the stored sequence number. Nonpersistent, cleared by SPI read. Note 1: In Packet mode, use a single buffer for received frames. In RX-Streaming mode, use both buffers for reception. REGISTER 7-4: TRMTOH/STRMTOL (STREAM TIME-OUT REGISTER) ADDRESS: 0x1C – 0x1D R/W-11111111 STRMTO<15:8> bit 15 bit 8 R/W-11111111 STRMTO<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 15-0 STRMTO<15:0>: Stream Time-Out bits The STRMTO<15:0> bits indicate the maximum number of allowed Base time units between the end of one RX Stream packet and the successful reception of the next. If no RX Stream packet is successfully received within this time, STRMIF is set. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 195 MRF24XA NOTES: DS70005023C-page 196 Preliminary 2015 Microchip Technology Inc. MRF24XA 8.0 BRIDGING Any member of a Proprietary node may run two stacks and be part of a 15.4 network. This enables the node to act as a gateway between the two networks. As the default configuration, NWFRMFMT = 1. This setting is overriden when it receives a 15.4 frame, but switches back temporarily when it needs to send. The network is configurable to use proprietary or standard (IEEE 802.15.4) MAC. However, a proprietary network must also be able to send and receive frames to/ from standard-compliant networks. This capability is referred to as Bridging. The Bridging node must implement both the proprietary and the standard compliant MAC framing protocols. Each time a 250 kbps frame is received through the Bridging node, it must decide which MAC protocol to use for parsing the incoming frame. FIGURE 8-1: The problem of Bridging is that the 802.15.4 MAC Frame Control field will not allow for distinction in the case of 250 kbps frames. Therefore, the selected SFD is used for distinction. Standard compliant SFD pattern is selected when Standard MAC is used with 250 kbps frame, otherwise, a different SFD value is used. When the Host MCU (or MAC) selects the 250 kbps airdata-rate for transmission, it also indicates which MAC is used by a sideband signal. The transmitter baseband selects the SFD accordingly. If proprietary MAC is selected, the SFD is read from a host configurable register, otherwise, the standard defined pattern is used (0xA7). Additionally, if proprietary is used, the length and payload fields are scrambled. On the receiver side, the 250 kbps preamble and the SFD are detected first. This determines which MAC protocol is used to parse the PHY payload. BRIDGING 2015 Microchip Technology Inc. Preliminary DS70005023C-page 197 MRF24XA NOTES: DS70005023C-page 198 Preliminary 2015 Microchip Technology Inc. MRF24XA 9.0 PHYSICAL LAYER FUNCTIONS 9.1 Synthesizer Power-Up, Power Off MRF24XA provides an OFF-Timer to optimize the power consumption by managing the ON time of the on-chip synthesizer. Before the synthesizer is switched off, RXEN or TXST turns to ‘0’ from ‘1’, the user must set OFFTM<7:0>. The value of the register is interpreted as an OFF time counter. As the counter runs out, synthesizer is started regardless of the state of RXEN and TXST bits. Table 2-1 illustrates MRF24XA power modes, while Figure 4-3 illustrates the operation states. RFOFF state is the state when most of the RF circuits are powered off. As Table 2-1 illustrates, RFOFF state is divided into two sub-states. In Crystal ON state, only 16 MHz on-chip crystal oscillator is powered on and the synthesizer is switched off. In Synthesizer ON state, both the on-chip crystal oscillator and the synthesizer are powered on. REGISTER 9-1: OFFTM (OFF-TIMER REGISTER) ADDRESS: 0x1E R/W-00000000 OFFTM<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-0 OFFTM<7:0>: OFF-Timer Field bits This value sets the minimum PLL OFF time. Minimum OFF Time = OFFTM<7:0> * 32 s If this register is set to 0xFF, PLL remains off. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 199 MRF24XA REGISTER 9-2: RXCON1 (MAC RECEIVE CONTROL 1 REGISTER) ADDRESS: 0x15 R/W/HC/HS-0 R/W-0 R/W/HC-0 R/W-0 R/W-0 RXEN NOPA RXDEC RSVLQIEN RSVRSSIEN R/W-0 R/W-0 R-0 RSVCHDREN RSVCFOEN bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 r x = Bit is unknown RXEN: Receive Enable Field bit This bit enables/disables the packet reception. If an RX packet is being received, clearing this bit will causes that packet to be discarded. 1 = RX enabled 0 = RX disabled Hardware clear/set when: • Cleared when TRXMODE is set to TX-Streaming mode • Set when TRXMODE is set to RX-Streaming mode Clearing this bit aborts the current operation in the following cases: • Receiving a packet in Packet mode or in RX-Streaming mode Changes to most RX related settings must be only done when this bit is cleared. The clear channel assessment (CSMAEN) and ACK-frame reception does not require RXEN = 1 as the device turns the radio into RX when required, irrespective of the status of the RXEN bit. bit 6 NOPA: No Parsing bit This bit disables packet parsing. Only CRC is checked, if it is enabled. This feature is useful in Sniffer mode. 1 = Disable packet parsing 0 = Enable packet parsing bit 5 RXDEC: RX Decryption bit Setting this bit starts RX security processing (authentication or decryption, or both) on the last received packet. 1 = RX security processing started/in process. RXDECIF or RXTAGIF is set. 0 = RX security processing inactive or complete This bit clears itself after RX decryption has completed. bit 4 RSVLQIEN: Receive Status Vector LQI Enable bit If this bit is set, the measured Link Quality is appended after the received frame in the packet buffer. 1 = Append LQI field 0 = Do not append LQI field bit 3 RSVRSSIEN: Receive Status Vector RSSI Enable bit If this bit is set, the measured RSSI is appended after the received frame in the packet buffer. 1 = Append RSSI field 0 = Do not append RSSI field bit 2 RSVCHDREN: Receive Status Vector Channel/MAC Type/Data Rate Enable bit If this bit is set, Channel, MAC type and Data Rate configurations used with the received frame are appended after the received frame in the packet buffer, using the encoding specified for CH<3:0>, FRMFMT and DR<2:0> (concatenated in this order when most significant bit (MSb) is first). 1 = Append Channel, MAC type and Data Rate fields 0 = Do not append Channel, MAC type and Data Rate fields DS70005023C-page 200 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 9-2: bit 1 RXCON1 (MAC RECEIVE CONTROL 1 REGISTER) (CONTINUED) ADDRESS: 0x15 RSVCFOEN: Receive Status Vector CFO Enable bit If bit is set, the estimated Carrier Frequency Offset of the received frame is appended after the received frame in the packet buffer, using the same encoding as CFOMEAS register. 1 = Append CFO estimation 0 = Do not append estimated CFO bit 0 Reserved: Maintain as ‘0’ REGISTER 9-3: TXCON (TRANSMIT CONTROL REGISTER) ADDRESS: 0x12 R/W/HC -0 R/W-0 R/W/HC-0 R/HS/HC-1 R/W-1 R/W-011 TXST DTSM TXENC TXBUFEMPTY CSMAEN DR<2:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set x = Bit is unknown TXST: Transmit Start bit. This is set or cleared by the host MCU bit(1, 2) 1 = Starts the transmission of the next TX packet 0 = Termination of current TX operation, which may result in the transmission of an incomplete packet. bit 7 Hardware Clear: • After the packet is successfully transmitted (including all attempted retransmissions, if any), the hardware clears this bit and sets the TXIF and IDLEIF. • If the packet transmission fails due to a CSMA failure, then this bit is cleared, and TXCSMAIF is set. • If Acknowledge is requested (AckReq bit field in the transmitted frame and AUTOACKEN register bit are both set) and not received after the configured number of retransmissions (TXRETMCNT), then TXST bit is cleared and a TXACKIF is set. • In TX-Streaming mode (TRXMODE), TXST is set even when it is already set, resulting in a “posted start”. When the current TX operation completes, the “posted start” immediately starts afterward. Clearing of the TXST bit clears both the current and the posted (pending) TX starts. TXOVFIF is unchanged when TXST = 1, a posted start is present and a Host Controller write to the packet buffer occurs. Outside of TX-Streaming mode, writes to TXST when TXST is already set is ignored. Clearing this bit aborts the current operation in the following cases: • When transmitting a packet in Packet mode or in TX-Streaming mode • When waiting for an ACK packet after a transmission • During the CSMA CA algorithm • When transmitting a repeated frame This field is read at any time to determine if the TX operation is in progress. bit 6-0 Out of scope Note 1: 2: Transmission may include automatic security processing, CRC appending, CSMA-CA channel access, Acknowledge reception and retransmissions depending on the register Configuration and the Frame Control field of the frame to be transmitted. By setting the TXST bit in either Sleep/RFOFF state, the device transits to TX state for packet transmission. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 201 MRF24XA TABLE 9-1: Names REGISTERS ASSOCIATED WITH OFF PLL POWER-UP, POWER OFF Bit 7 Bit 6 Bit 5 Bit 4 NOPA RXDEC RSVLQIEN DTSM TXENC TXBUFEMPTY OFFTM Bit 3 Bit 2 Bit 1 Bit 0 OFFTM<7:0> RXCON1 RXEN TXCON TXST RSVRSSIEN RSVCHDREN RSVCFOEN CSMAEN r DR<2:0> Legend: r = Reserved, read as ‘0’. 9.2 Operating Channel MRF24XA is capable of selecting one of sixteen channel frequencies in the 2.4 GHz band. The desired channel is selected by configuring the CHANNEL<3:0> bits in the MACCON2 register. Refer to Table 9-2 for the MACCON2 register setting for channel number and frequency. REGISTER 9-4: If Channel Agility is not used, all nodes share the same channel both in RX and TX modes. The channel is defined by CHANNEL<3:0> as indicated below. For more information on Channel Agility, Section 7.1 “Channel Agility”. MACCON2 (MAC CONTROL 2 REGISTER) see ADDRESS: 0x11 R/W-0000 R/W/HS-0000 CHANNEL<3:0> SECSUITE<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved CHANNEL<3:0>: TX/RX Operating Channel field bits(1) bit 7-4 These register bits are used as the current operating channel for TX/RX operation. 0x0 = Channel 11 0x1 = Channel 12 • • • 0xF = Channel 26 bit 3-0 Out of scope Note 1: Use this field while receiving and transmitting, and must be unmodified while RXEN or TXST is set. TABLE 9-2: CHANNEL SELECTION MACCON2 (0x11) REGISTER SETTING CHANNEL<3:0> Bits in MACCON2 Channel Number Channel Frequency 0x0 11 2.405 GHz 0x1 12 2.410 GHz 0x2 13 2.415 GHz 0x3 14 2.420 GHz 0x4 15 2.425 GHz 0x5 16 2.430 GHz 0x6 17 2.435 GHz DS70005023C-page 202 CHANNEL<3:0> Bits in MACCON2 Channel Number Channel Frequency 0x7 18 2.440 GHz 0x8 19 2.445 GHz 0x9 20 2.450 GHz 0xA 21 2.455 GHz Preliminary 0xB 22 2.460 GHz 0xC 23 2.465 GHz 0xD 24 2.470 GHz 0xE 25 2.475 GHz 0xF 26 2.480 GHz 2015 Microchip Technology Inc. MRF24XA REGISTER 9-5: RXCON1 (MAC RECEIVE CONTROL 1 REGISTER) R/W/HC/HS-0 R/W-0 R/W/HC-0 R/W-0 RXEN NOPA RXDEC RSVLQIEN R/W-0 ADDRESS: 0x15 R/W-0 R/W-0 RSVRSSIEN RSVCHDREN RSVCFOEN R-0 r bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 x = Bit is unknown RXEN: Receive Enable bit(1, 2) This bit Enables/Disables the packet reception. If an RX packet is being received, clearing this bit causes that packet to be discarded. 1 = RX enabled 0 = RX disabled Hardware clear/set when: • Cleared when TRXMODE is set to TX-Streaming mode • Set when TRXMODE is set to RX-Streaming mode Clearing this bit aborts the current operation in the following cases: • Receiving a packet in Packet mode or in RX-Streaming mode • Transmitting an ACK packet for a received frame during an Auto-Acknowledge operation bit 6-0 Note 1: 2: Out of scope Changes to most RX related settings must be only done when this bit is cleared. Clear channel assessment (CSMAEN) and ACK-frame reception does not require RXEN = 1 as the device turns the radio into RX when needed, irrespective of the status of the RXEN bit. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 203 MRF24XA REGISTER 9-6: RXCON2 (MAC RECEIVE CONTROL 2 REGISTER) R/C/HS-0 R/W-0 R-0 R/W-0 RXBUFFUL IDENTREJ ACKRXFP R/W-0 ACKTXFP AUTORPTEN ADDRESS: 0x16 R/W-0 R/W-0 AUTOACKEN R/W-0 ADPTCHEN ADPTDREN bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HS = Hardware Set C = Clearable bit bit 7-2 Out of scope bit 1 ADPTCHEN: Adaptive Channel Enable bit(1) x = Bit is unknown Setting this bit enables the MAC to set the transmitting channel for the ACK packet based on the AckInfo field (Proprietary packet) of the received packet, rather than the CH<3:0> register bits. 1 = Adaptive Channel feature is enabled 0 = Adaptive Channel feature is disabled ADPTDREN: Adaptive Data Rate Enable bit(1) bit 0 Setting this bit enables the MAC to set the transmission data rate for the ACK packet based on the AckInfo field (Proprietary packet) of the received packet, rather than the DR<2:0> register bits. 1 = Adaptive Data Rate feature is enabled 0 = Adaptive Data Rate feature is disabled Note 1: Use this field while receiving and transmitting, and must be unmodified while RXEN or TXST is set. TABLE 9-3: Names REGISTERS ASSOCIATED WITH CHANNEL SELECTION Bit 7 MACCON2 RXCON1 RXCON2 Legend: 9.3 Bit 6 Bit 5 Bit 4 Bit 3 RXEN NOPA RXDEC Bit 1 Bit 0 SECSUITE<3:0> CHANNEL<3:0> RXBUFFUL IDENTREJ ACKRXFP Bit 2 RSVLQIEN RSVRSSIEN RSVCHDREN RSVCFOEN ACKTXFP AUTORPTEN AUTOACKEN ADPTCHEN r ADPTDREN r = Reserved, read as ‘0’. RXLISTEN Operations The air-data-rate is detected in two stages: 1. 2. Simultaneously monitoring the presence of 2 Mbps, 500 kbps, 250 kbps modulated preambles until one of these is detected with sufficient reliability. Searching for a Start Frame Delimiter that may further distinguish between air-data-rates. Figure 9-1 and Figure 9-2 show the order of processing steps and decisions for the Optimal and Legacy frame formats. DS70005023C-page 204 Preliminary 2015 Microchip Technology Inc. MRF24XA FIGURE 9-1: DATA RATE SELECTION IN THE RECEIVER WHEN OPTIMAL FRAMING MODE IS CONFIGURED Start RX Signal Processing 2 Mbps preamble? No No Yes Yes Yes Signal path to 2 Mbps bit- and byte-aligned demodulation/decoding Signal path to 500 kbps bit- and byte-aligned demodulation/decoding Signal path to 250 kbps bit- and byte-aligned demodulation/decoding Search for two different 16-chip SFD patterns (at 2 Mbps) Search for 8-bit SFD pattern Search for two different 16-chip SFD patterns (at 250 kbps) 16-bit exact match to pattern_2000 8-bit exact match to pattern_500 No 16-bit tolerant match to pattern_1000 Yes 802.155.4 Frame Yes No IEEE Yes No 250 kbps preamble? 500 kbps preamble? Yes No 8-bit exact match to 0xA7 No No 8-bit exact match to pattern_250 No 8-bit exact match to pattern_125 Yes Yes Continue 2 Mbps reception Switch to 1 Mbps reception Continue 500 kbps reception Continue 250 kbps reception as in the standard Switch to 250 kbps reception Switch to 125 kbps reception Receive Length field Receive Payload bytes DS70005023C-page 205 Preliminary 2015 Microchip Technology Inc. MRF24XA FIGURE 9-2: DATA RATE SELECTION IN THE RECEIVER WHEN LEGACY FRAMING MODE IS CONFIGURED Start RXSignal Processing No 250 kbps preamble? Yes Switch signal path to 250 kbps bit- and byte-aligned demodulation and decoding Yes 8-bit exact match to pattern_L2000 Search for two different 16-bit SFD patterns (at 2 Mbps) No Yes 8-bit exact match to pattern_L1000 Yes 802.155.4 Frame No 8-bit exact match to pattern_L500 IEEE No Yes Yes 8-bit exact match to 0xA7 No 8-bit exact match to pattern_250 No Start descrambler Start descrambler No 16-bit tolerant match to pattern_125 Start descrambler Yes After LENGTH field switch to 2 Mbps reception After LENGTH field switch to 1 Mbps reception After LENGTH field switch to 500 kbps reception Continue 250 kbps reception Continue 250 kbps reception Switch to 125 kbps reception: LLR mapping, DE-interleaving, FEC decoding Start descrambler Receive LENGTH field Receive Payload bytes DS70005023C-page 206 Preliminary 2015 Microchip Technology Inc. MRF24XA FIGURE 9-3: PHYSICAL RECEIVER OPERATION: OVERVIEW Abort/Reset from upper layer Gain Change Switch Signal Flow to bit- and byte-aligned demodulation at the detected Preamble Air-Data -Rate; Start SFD detectors; AGC must hold the gain Start AGC Yes Preamble Loss? Start Digital Demodulator Init SFD time-out No Yes SFD detected? Preamble Acquired? Yes No No No SFD time-out? Yes Switch the signal path to the detected payload data rate Transfer bytes to MAC No AGC Level Triggered? No Yes Last byte done? Yes 2015 Microchip Technology Inc. Preliminary DS70005023C-page 207 MRF24XA 9.4 Automatic Gain Control (AGC) AGC circuit can provide automatic gain adjustment according to the Received field strength. AGC gain is set in four steps. REGISTER 9-7: BBCON (BASEBAND CONFIGURATION REGISTER) ADDRESS 0x38 R/W-0 R/W-0 R/W-11 R/W-0 R/W-001 RNDMOD AFCOVR RXGAIN<1:0> PRMBHOLD PRMBSZ<2:0> bit 7 Legend: bit 0 W = Writable bit -n = Value at POR R = Readable bit ‘1’ = Bit is set U = Unimplemented bit, read as ‘0’ ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 Out of scope bit 6 Out of scope bit 5-4 RXGAIN<1:0>: Receiver Gain Register Field bits By setting this bit, the AGC operation is inhibited in the receiver and the receiver radio gain Configuration is selected between three different gain levels. Encoding: 11 = AGC operation is enabled (default value) 10 = High gain 01 = Middle gain 00 = Low gain This feature is used for test and streaming purposes. To reduce the required interframe-gap, the RXGAIN must be set to one of the fixed gain options when the MAC is in Streaming mode. bit 3-0 Out of scope DS70005023C-page 208 Preliminary 2015 Microchip Technology Inc. MRF24XA 9.5 Energy Detection The Received Signal Strength Indicator (RSSI) is an estimate of the received signal power within the bandwidth of a particular channel, and obtained by the user using Energy Detection (ED). MRF24XA has the capability to measure the received signal power for a userdefined number of symbols, and to report back the measured RSSI value. The mapping between the RSSI value returned and the input power level is shown in Figure 9-4. This aggregates all the AGC curves, hence user does not require to calculate with any other settings. The curve is directly used. The RSSI value associated with a received packet may also be automatically stored as part of the packet’s Receive Status Vector (RSV). FIGURE 9-4: RSSI VALUE VS. RECEIVED POWER EQUATION 9-1: RSSI VALUE VS. RECEIVED POWER EQUATION Pin = 0.5 * Energy Detect Code(1) - 112 <dBm>(2) Note 1: Energy Detect Code is read from EDMEAN<7:0> field. 2: Equation 9-1 is valid for EDMEAN<7:0> from 40 to 184 decimal values. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 209 MRF24XA REGISTER 9-8: RXCON1 (MAC RECEIVE CONTROL 1 REGISTER) ADDRESS: 0x15 R/W/HC/HS-0 R/W-0 R/W/HC-0 R/W-0 R/W-0 RXEN NOPA RXDEC RSVLQIEN RSVRSSIEN R/W-0 R/W-0 R-0 RSVCHDREN RSVCFOEN bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 r x = Bit is unknown RXEN: Receive Enable Field bit This bit Enables/Disables the packet reception. If an RX packet is currently being received, clearing this bit causes that packet to be discarded. 1 = RX enabled 0 = RX disabled Hardware clear/set when: • Cleared when TRXMODE is set to TX-Streaming mode • Set when TRXMODE is set to RX-Streaming mode Clearing this bit aborts the current operation in the following cases: • Receiving a packet in Packet mode or in RX-Streaming mode Changes to most RX related settings must be only done when this bit is cleared. The clear channel assessment (CSMAEN) and ACK-frame reception does not require RXEN = 1 as the device turns the radio into RX when needed, irrespective of the status of the RXEN bit. bit 6 NOPA: No Parsing bit This bit disables packet parsing. Only CRC is checked, if it is enabled. This feature is useful in Sniffer mode. 1 = Disable packet parsing 0 = Enable packet parsing bit 5 RXDEC: RX Decryption bit Setting this bit starts RX security processing (authentication or decryption, or both) on the last received packet. 1 = RX security processing started/in process. RXDECIF or RXTAGIF is set. 0 = RX security processing inactive or complete This bit clears itself after RX decryption is completed. bit 4 RSVLQIEN: Receive Status Vector LQI Enable bit If this bit is set, the measured Link Quality is appended after the received frame in the packet buffer. 1 = Append LQI field 0 = Do not append LQI field bit 3 RSVRSSIEN: Receive Status Vector RSSI Enable bit If this bit is set, the measured RSSI is appended after the received frame in the packet buffer. 1 = Append RSSI field 0 = Do not append RSSI field DS70005023C-page 210 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 9-8: bit 2 RXCON1 (MAC RECEIVE CONTROL 1 REGISTER) (CONTINUED) ADDRESS: 0x15 RSVCHDREN: Receive Status Vector Channel/MAC Type/Data Rate Enable bit If this bit is set, Channel, MAC type and Data Rate configurations used with the received frame are appended after the received frame in the packet buffer, using the encoding specified for CH<3:0>, FRMFMT and DR<2:0> (concatenated in this order when MSb is first). 1 = Append Channel, MAC type and Data Rate fields 0 = Do not append Channel, MAC type and Data Rate fields bit 1 RSVCFOEN: Receive Status Vector CFO Enable bit If bit is set, the estimated Carrier Frequency Offset of the received frame is appended after the received frame in the packet buffer, using the same encoding as CFOMEAS register. 1 = Append CFO estimation 0 = Do not append estimated CFO bit 0 Reserved: Maintain as ‘0’ REGISTER 9-9: CCACON1 (CCA CONTROL 1 REGISTER) R/HS/HC-0 R/W/HC-0 R/W-001100 CCABUSY CCAST RSSITHR<5:0> ADDRESS: 0x2F bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 x = Bit is unknown CCABUSY: Clear Channel Assessment Busy Flag bit This bit represents the result of the latest CCA measurement. 1 = Medium is busy 0 = Medium is silent CCAST: Clear Channel Assessment Start bit(1) bit 6 Setting this register bit triggers MCU to start a new CCA measurement. The hardware clears this bit when the CCA measurement is done (EDCCAIF is set) and CCABUSY is valid. RSSITHR<5:0>: RSSI Threshold bits(2) bit 5-0 This threshold is used in CCA operation when Energy detect or Energy and Carrier Sense mode is selected. Representation: resolution of 2 dB/LSB, RSSITHR = 0x10 represents ca. -75 dBm noise level. Note that this threshold may be different with other matching network or antenna. Note 1: 2: RX chain must be turned on (RXEN = 1) to perform this measurement. Packet reception is not disabled during the measurement, its main purpose is testing. In the corresponding CCA modes the radio measures EDMEAN<7:0>. If EDMEAN<7:2> is greater than RSSITHR<5:0>, CCABUSY is set. Example: To set the RSSI threshold where the chip measures 0x30 EDMEAN, RSSITHR<5:0> must be 0x0C. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 211 MRF24XA REGISTER 9-10: EDCON (ENERGY DETECT CONTROL REGISTER)(1, 2) ADDRESS: 0x31 R-00 R/W-0 R/W/HC-0 R/W-1110 r EDMODE EDST EDLEN<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear x = Bit is unknown bit 7-6 Reserved: Maintain as ‘0’ bit 5 EDMODE: Energy Detect Mode Select bit 1 = Energy Detect Sampling Mode. ED duration is 128 µs. A single atomic RSSI-peak measurement is accomplished. The result is stored in EDPEAK<7:0> register. 0 = Energy Detect Scan Mode. EDLEN<3:0> sets the ED duration. The result is stored in EDMEAN<7:0> register. bit 4 EDST: Energy Detect Measurement Start bit Setting this register bit triggers MCU to start a new CCA measurement. The hardware clears this register bit when the ED measurement is done (EDCCAIF is unchanged) and values in EDMEAN<7:0> and EDPEAK<7:0> are valid. If the ED measurement is aborted (RX state is changed, or the MCU clears the EDST bit) then EDCCAIF is unchanged. bit 3-0 EDLEN<3:0>: Energy Detect Measurement Length Field bits Value M indicates a sequence of (M + 1) * 8 atomic RSSI-peak measurements, each having the duration of 128 µs. At the end of the aggregate measurement, the mean and the peak value of the sequence are available in EDMEAN<7:0> and EDPEAK<7:0>. Note 1: 2: The RX chain must be turned on (RXEN = 1) to perform this measurement. Packet reception is disabled during the measurement. When EDLEN<3:0> = M = 0xE, then the 128 μs atomic measurements are preformed 120 times, which is equal to the a BaseSuperFrameDuration parameter in the IEEE 802.15.4 standard. REGISTER 9-11: EDMEAN (ENERGY DETECT MEAN INDICATION REGISTER) ADDRESS: 0x32 R/HS/HC-00000000 EDMEAN<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7-0 x = Bit is unknown EDMEAN<7:0>: Energy Detect Mean Indication Field bits Measured mean signal strength during ED/CCA measurement. DS70005023C-page 212 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 9-12: EDPEAK (ENERGY DETECT PEAK INDICATION REGISTER) ADDRESS: 0x33 R/HS/HC-00000000 EDPEAK<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7-0 x = Bit is unknown EDPEAK<7:0>: Energy Detect Peak Indication Field bits Measured peak signal strength during ED measurement. Computation: The gain-compensated RSSI value is averaged over intervals of 128 μs. The peak value obtained from a sequence of such measurements is stored in EDPEAK, when EDMODE = 1. TABLE 9-4: REGISTERS ASSOCIATED WITH RSSI AND ED Names Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 RXCON1 RXEN NOPA RXDEC RXVLQIEN RSVRSSIEN CCACON1 EDCON CCABUSY CCAST r Bit 2 Bit 1 RSVCHDREN RSVCFOEN Bit 0 r RSSITHR<5:0> EDMODE EDST EDMEAN EDMEAN<7:0> EDPEAK EDPEAK<7:0> EDLEN<3:0> Legend: r = Reserved, read as ‘0’. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 213 MRF24XA 9.6 Clear Channel Assessment (CCA) Clear Channel Assessment is a function within CSMA/ CA to determine whether the wireless medium is ready and able to receive data, therefore the transmitter can start sending the data. CCA is implemented outside of the MAC. This enables the radio to transmit in the presence of interference from other wireless protocols that operate on the same frequency. CCA may be performed using either Energy Detection (ED), Carrier Sense (CS) or a combination of both. 9.6.1 CCA CONFIGURATION CCA is automatically executed (potentially multiple times) as part of the CSMA-CA procedure when the TXST register bit is set and CSMA-CA is enabled. The following register bits are used in the Configuration of CCA: • • • • CCAMODE<1:0> CCALEN<1:0> CSTHR<3:0> RSSITHR<5:0> 9.6.1.1 9.6.1.2 When CCAMODE<1:0> = 01, the CCA reports a busy medium upon detecting of a signal with particular modulation and spreading characteristics. To use this method of CCA, the following Configuration must be used: • CCALEN<1:0> = Measurement duration • CCAMODE<1:0> = 01 • CSTHR<3:0> = Carrier sense threshold 9.6.1.3 • • • • CCALEN<1:0> = Measurement duration CCAMODE<1:0> = 11 RSSITHR<5:0> = RSSI threshold value CSTHR<3:0> = Carrier sense threshold Energy Detection (ED) When CCAMODE<1:0> = 10, the CCA reports a busy medium upon detecting energy above the energy detection threshold defined in the RSSITHR<5:0> register bits. • CCALEN<1:0> = Measurement duration • CCAMODE<1:0> = 10 • RSSITHR<5:0> = RSSI threshold value Carrier Sense with Energy Detection When CCAMODE<1:0> = 11, the CCA reports a busy medium upon detecting of a signal with particular modulation and spreading characteristics and energy above the energy detection threshold defined in the RSSITHR<5:0> register bits. To use this method of CCA, the following Configuration must be used: Note: To use this method of CCA, the following Configuration must be used: Carrier Sense (CS) 9.6.2 In the corresponding CCA modes the radio measures EDMEAN<7:0>. If EDMEAN<7:2> is greater than RSSITHR<5:0>, CCABUSY is set. Example: To set the RSSI threshold where the chip measures 0x30 EDMEAN, RSSITHR<5:0> must be 0x0C. CCA OPERATION MRF24XA automatically initiates CCA as part of the CSMA-CA algorithm. CCA operation is requested independently for software CSMA-CA, or for test purpose through the CCAST bit. The mapping between the RSSITHR threshold and the power level is shown in Figure 9-4 and Equation 9-1. DS70005023C-page 214 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 9-13: R-0 OPSTATUS (OPERATION STATUS)(3) R/HS/HC-0 R/HS/HC-0 r R/HS/HC-0 R/HS/HC-0 ADDRESS: 0x2 R/HS/HC-0 MACOP<3:0> R/HS/HC-0 R/HS/HC-0 RFOP<2:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 Reserved: Maintain as ‘0’ bit 6-3 MACOP <3:0>: MAC Operation Register Field bits(1, 2) x = Bit is unknown Provides status information on the current state of the MAC state machine. Encoding on MACOP<3:1>: 111 = Transmitting Acknowledge (TXACK) 110 = Receiving a packet (RXBUSY) 101 = Receiver listening to the channel waiting for packet (RX) 100 = Receiving (or waiting for) Acknowledge (RXACK) 011 = Transmitting a packet (TX) 010 = Performing Clear Channel Assessment (CCA) 001 = Back-off before repeated CCA (BO) 000 = MAC does not perform any operation (IDLE) bit 2-0 RFOP <2:0>: Radio Operation Register Field bits Provides status information on the current Radio state. Encoding on RFOP<2:0>: 111 = TX with external PA is turned on (TX+PA) 110 = RX with external LNA is turned on (RX+LNA) 101 = Synthesizer and external PA or LNA is turned on (SYNTH+PA/LNA) 100 = Radio calibrates if the host MCU sets the CALST, otherwise, device malfunction occurs (CAL/MAL) 011 = Analog transmit chain is activated (TX) 010 = Analog receiver chain is active (RX). (Digital may be partially shut off) 001 = Synthesizer is steady or ramping up or channel change is issued (SYNTH) 000 = Only the crystal oscillator is ON(OFF), (except when XTALSF = 1) Note 1: 2: 3: GPIO<2:0> is dedicated to output MACOP<3:1> or RFOP<2:0>. Refer to PINCON register, which specifies the pin Configuration. MACOP<0> is connected to RXBUFFUL register bit. It cannot be output over GPIO’s. OPSTATUS register is sent on the SDO pin during all SPI operation. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 215 MRF24XA REGISTER 9-14: CCACON1 (CCA CONTROL 1 REGISTER) R/HS/HC-0 R/W/HC-0 R/W-001100 CCABUSY CCAST RSSITHR<5:0> ADDRESS: 0x2F bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 x = Bit is unknown CCABUSY: Clear Channel Assessment Busy Flag bit This bit represents the result of the latest CCA measurement. 1 = Medium is busy 0 = Medium is silent CCAST: Clear Channel Assessment Start bit(1) bit 6 Setting this register bit triggers MCU to start a new CCA measurement. The hardware clears this bit when the CCA measurement is done (EDCCAIF is set) and CCABUSY is valid. RSSITHR<5:0>: RSSI Threshold bits(2) bit 5-0 This threshold is used in CCA operation when Energy detect or Energy and Carrier Sense mode is selected. Representation: resolution of 2 dB/LSB, RSSITHR = 0x10 represents ca. -75 dBm noise level. Note that this threshold may be different with other matching network or antenna. Note 1: 2: RX chain must be turned on (RXEN = 1) to perform this measurement. Packet reception is not disabled during the measurement, and main purpose is testing. In the corresponding CCA modes the radio measures EDMEAN<7:0>. If EDMEAN<7:2> is greater than RSSITHR<5:0>, CCABUSY is set. Example: To set the RSSI threshold where the chip measures 0x30 EDMEAN, RSSITHR<5:0> must be 0x0C. REGISTER 9-15: CCACON2 (CCA CONTROL 2 REGISTER) ADDRESS: 0x30 R-0 R/W-01 R/W-01 CSTHR<3:0> CCALEN<1:0> CCAMODE<1:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-4 CSTHR<3:0>: Carrier Sense Threshold Field bits bit 3-2 CCALEN<1:0>: Clear Channel Assessment Length bits(1) bit 1-0 CCAMODE<1:0>: Clear Channel Assessment Mode Field bits(2) 11 = CCA Mode 3/a in the std. <1>: Energy AND Carrier Sense Threshold 10 = CCA Mode 2 in the std. <1>: Carrier Sense Threshold 01 = CCA Mode 1 in the std. <1>: Energy Detect Threshold (default) 00 = CCA Mode 3/b in the std.<1>: Energy OR Carrier Sense Threshold Value N indicates duration of 2^N * 32 µs. Note 1: 2: The IEEE 802.15.4 standard requires 128 µs. But shorter length is recommended when using higher rates with optimized Preamble mode (RATECON.OPTIMAL = 1). The measured RSSI result is stored in EDMEAN<7:0> register in all modes except in Mode 2. DS70005023C-page 216 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 9-16: EDMEAN (ENERGY DETECT MEAN INDICATION REGISTER) ADDRESS: 0x32 R/HS/HC-00000000 EDMEAN<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7-0 x = Bit is unknown EDMEAN<7:0>: Energy Detect Mean Indication Field bits Measured mean signal strength during ED/CCA measurement. TABLE 9-5: REGISTERS ASSOCIATED WITH CCA Names Bit 7 OPSTATUS r CCACON1 CCABUSY Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 MACOP<3:0> CCAST CCACON2 Bit 0 RFOP<2:0> RSSITHR<5:0> CSTHR<3:0> EDMEAN Bit 1 CCALEN<1:0> CCAMODE<1:0> EDMEAN<7:0> Legend: r = Reserved, read as ‘0’. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 217 MRF24XA 9.7 Physical Framing Physical frame durations for the different data rates are shown in Table 9-6. Duration is expressed in payload byte time. TABLE 9-6: FRAME DURATION Frame Formats T [µs/byte] Duration expressed in payload byte time (T) Preamble SFD Length PHY payload Proprietary 125 kbps 64 4 1 1 N Standard 250 kbps 32 4 1 1 N Proprietary 500 kbps 16 4 1 1 N Proprietary 1 Mbps 8 4 1 1 N Proprietary 2 Mbps 4 8 2 1 N Different frame data rates are recognized and processed based on the recognized SFD field of the PHY frame. Figure 4-7 describes the basic PHY frame structure. RATECON<7:2> bits can disable the reception of the unwanted data rate frames. TABLE 9-7: USED SFD FIELDS FOR VARIOUS DATA RATES Preamble Type Data Rate Pattern Used SFD Field Fault Tolerance Optimal Pattern_2000 <SFD1, SFD6> Exact match required Pattern_1000 <SFD2, SFD7> Maximally two non-contiguous two-element burst error Pattern_500 SFD3 Exact match required Pattern_250 proprietary SFD4 Exact match required Pattern_250 standard 0xA7 Exact match required Pattern_125 <SFD5, SFD6> Maximally two faulty nibbles from four Legacy Pattern_2000 SFD1 Exact match required Pattern_1000 SFD2 Exact match required Pattern_500 SFD3 Exact match required Pattern_250 proprietary SFD4 Exact match required Pattern_250 standard 0xA7 Exact match required Pattern_125 <SFD5, SFD6> — DS70005023C-page 218 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 9-17: RATECON (RATE CONFIGURATION REGISTER) ADDRESS: 0x36 R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-1 R/W-1 DIS2000 DIS1000 DIS500 DIS250 DISSTD DIS125 OPTIMAL PSAV bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 DIS2000: Disable 2 Mbps Frame Reception bit If this bit is set, then reception of 2 Mbps frames is disabled. bit 6 DIS1000: Disable 1 Mbps Frame Reception bit If this bit is set, then reception of 1 Mbps frames is disabled. bit 5 DIS500: Disable 500 kbps Frame Reception bit If this bit is set, then reception of 500 kbps frames is disabled. bit 4 DIS250: Disable 250 kbps Frame Reception bit If this bit is set, the reception of 250 kbps frames with non-standard-compliant SFD patterns is disabled. bit 3 DISSTD: Disable IEEE 802.15.4 compliant Frame Reception bit If this bit is set, then reception of 250 kbps frames with IEEE 802.15.4 compliant SFD patterns is disabled. bit 2 DIS125: Disable 125 kbps Frame Reception bit If this bit is set, then reception of 125 kbps frames is disabled. bit 1 OPTIMAL: Optimized Preamble Selection bit When this bit is set, then optimized preamble is used instead of legacy. 1 = Optimized preamble 0 = Legacy preamble bit 0 Out of scope 2015 Microchip Technology Inc. Preliminary DS70005023C-page 219 MRF24XA REGISTER 9-18: SFD1 (START FRAME DELIMITER PATTERN 1 CONFIGURATION REGISTER) ADDRESS: 0x60 R/W-00100001 SFD1<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-0 SFD1<7:0>: Start Frame Delimiter Pattern 1 Register Field bits This octet is used as SFD pattern with 2 Mbps rate when OPTIMAL = 0, and as the MSB of the SFD pattern with 2 Mbps rate when OPTIMAL = 1. When OPTIMAL = 0: The hexadecimal digits must be different from 0x0 and different from the corresponding digits in SFD<k>, k = 2, 3, 4, 6, and the value 0xA7 is forbidden. When OPTIMAL = 1: The hexadecimal digits must be different from 0x0 and different from the corresponding digits of SFD2. REGISTER 9-19: SFD2 (START FRAME DELIMITER PATTERN 2 CONFIGURATION REGISTER ADDRESS: 0x61 R/W-11110001 SFD2<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-0 SFD2<7:0>: Start Frame Delimiter Pattern 2 Register Field bits This octet is used as SFD pattern with 1 Mbps rate when OPTIMAL = 0, and as the MSB of the SFD pattern with 1 Mbps rate when OPTIMAL = 1. When OPTIMAL = 0: The hexadecimal digits must be different from 0x0 and different from the corresponding digits in SFD<k>, k = 1, 3, 4, 6, and the value 0xA7 is forbidden. When OPTIMAL = 1: The hexadecimal digits must be different from 0x0 and different from the corresponding digits of SFD1. DS70005023C-page 220 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 9-20: SFD3 (START FRAME DELIMITER PATTERN 3 CONFIGURATION REGISTER) ADDRESS: 0x62 R/W-00111011 SFD3<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-0 SFD3<7:0>: Start Frame Delimiter Pattern 3 Register Field bits This octet is used as SFD pattern with 500 kbps rate. When OPTIMAL = 0: The hexadecimal digits must be different from 0x0 and different from the corresponding digits in SFD<k>, k = 1, 2, 4, 6, and the value 0xA7 is forbidden. When OPTIMAL = 1: The hexadecimal digits must be different from 0x0. REGISTER 9-21: SFD4 (START FRAME DELIMITER PATTERN 4 CONFIGURATION REGISTER) ADDRESS: 0x63 R/W-11100101 SFD4<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-0 SFD4<7:0>: Start Frame Delimiter Pattern 4 Register Field bits This octet is used as SFD pattern with 250 kbps rate when proprietary MAC is in use, otherwise, the 0xA7 pattern defined in the standard <1> is used instead. The hexadecimal digits must be different from 0x0 and from the corresponding digits in SFD<k>, where, k = 1, 2, 3, 6 when OPTIMAL = 0. The value 0xA7 is forbidden. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 221 MRF24XA REGISTER 9-22: SFD5 (START FRAME DELIMITER PATTERN 5 CONFIGURATION REGISTER) ADDRESS: 0x64 R/W-01001101 SFD5<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-0 SFD5<7:0>: Start Frame Delimiter Pattern 5 Register Field bits This octet is used as the MSB of the SFD pattern with 125 kbps rate. REGISTER 9-23: SFD6 (START FRAME DELIMITER PATTERN 6 CONFIGURATION REGISTER) ADDRESS: 0x65 R/W-10101000 SFD6<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-0 SFD6<7:0>: Start Frame Delimiter Pattern 6 Register Field bits This octet is used as the LSB of the SFD pattern with 125 kbps rate. When OPTIMAL = 1, this octet is used as the LSB of the SFD pattern with 2 Mbps rate. The hexadecimal digits must be different from 0x0 and different from the corresponding digits in SFD<k>, k = 1, 2, 3, 4 when OPTIMAL = 0. The value 0xA7 is forbidden. REGISTER 9-24: SFD7 (START FRAME DELIMITER PATTERN 7 CONFIGURATION REGISTER) ADDRESS: 0x66 R/W-11001000 SFD7<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-0 SFD7<7:0>: Start Frame Delimiter Pattern 7 Register Field bits When OPTIMAL = 1, this octet is used as the LSB of the SFD pattern with 1 Mbps rate. DS70005023C-page 222 Preliminary 2015 Microchip Technology Inc. MRF24XA 9.8 Start-of-Frame Delimiter (SFD) Detection 9.8.2 The following sections describe the SFD detection mechanism for the different data rates. Header processing is required to work at least as reliably as the demodulation. To meet this requirement, longer preamble and 16-bit SFD is defined for frames where the payload data rate is lower than the air-datarate of the preamble. 9.8.1 SFD DETECTION AT 125 kbps The input contains a nibble of bits decoded from the received DSSS symbol. This input is updated on every new DSSS symbol received. In each update, the latest four received nibbles are compared against the nibbles contained in the 16-bit SFD pattern that the host MC configures. At least three out of four nibbles must match to trigger an SFD_FOUND event. SFD_TIMEOUT occurs if the latest five nibbles are different from “0000” (preamble lost) while SFD_FOUND is not triggered. Reception is reset on SFD_TIMEOUT. For the 125 kbps data rate the last decoded four nibbles and the nibbles of pattern_125 must match in at least three nibble positions. SFD DETECTION AT 1 Mbps The input contains a byte, which is updated on every new byte received after the first preamble byte has been detected (this identifies the byte boundary). The two latest received bytes form a Word of 16 bits is denoted by W. SFD_FOUND event is reported if W exactly matches the host configured 16-bit preamble pattern (SFD), or if an approximate match is found with the following error patterns: • SFD XOR W = 110...0110…0 (two error bursts of length 2) • SFD XOR W = 10...0110…01 (single error burst of length 2, and single error on either or both ends) SFD XOR W = 0...0110…0 (single error burst of length 2) • SFD XOR W = 0...010…0 (single error) The rationale behind selecting these patterns is that the maximum-likelihood demodulator tends to produce error bursts of length 2 due to the trellis of the MSK modulation (this particular tolerance scheme seems to be novel). SFD_TIMEOUT event is reported if the latest three octets are different from 0x0F0F0F, while SFD_FOUND is not triggered. Reception is reset on SFD_TIMEOUT. At 1 Mbps the match tolerates single bit or maximum 2 non-contiguous 2-bit burst differences in the comparison of the last received 16 bits and pattern_1000 (simultaneously isolated single bit mismatches at both ends of the pattern constitute a single 2-bit mismatch burst). 2015 Microchip Technology Inc. Preliminary DS70005023C-page 223 MRF24XA 9.9 Physical Transmissions For more information on this mode, see Section 9.13 “External Power Amplifier (PA)/Low-Noise Amplifier (LNA)”. MCU sets TXST and transmission starts when TXST is set to ‘1’. TXMAIF, TXSFDIF and RXSFDIF flags are handled. RXSFDIF is handled even with ACK. External PA/LNA is automatically handled. REGISTER 9-25: Channel, data rate and link adaptation is based on retransmission, and the information is from the receiver. TXPOW (TRANSMIT POWER CONFIGURATION REGISTER) R/W-000 R/W-11111 CHIPBOOST<2:0> TXPOW<4:0> ADDRESS 0x3A bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-5 CHIPBOOST<2:0>: TX Chip Boosting Field bits This field modifies the spectrum of the OQPSK transmission. bit 4-0 TXPOW<4:0>: TX Power Register Field bits This field enables configuring the TX power ranging from -19 to 1 dBm. Encoding: 11111 = +1 dBm • • • 00001 = -19 dBm 00000 = PA OFF FIGURE 9-5: 1 6 OUTPUT POWER IN FUNCTION OF TXPOW 11 16 21 26 FIGURE 9-6: 31 TX CURRENT IN FUNCTION OF TXPOW 31 26 Current (mA) Output Power (dBm) 0 -5 -10 21 16 -15 11 1 -20 TXPOW register (decimal) Note: 6 11 16 21 26 31 TXPOW register (decimal) Some variance is expected due to a different matching network. DS70005023C-page 224 Preliminary 2015 Microchip Technology Inc. MRF24XA 9.10 Signal Detection (Power-Save Listen Mode) TABLE 9-8: In Power-Save Listen Mode, only the RX front end circuit is powered, the baseband is switched off. In this mode, approximately 3 mA receive current is saved. To use this mode, set the PSAV bit to ‘1’. Note: In this mode, MRF24XA consumes less current that causes sensitivity degradation. REGISTER 9-26: RECOMMENDED SETTINGS FOR POWER-SAVE LISTEN MODE 125/250/ Legacy 500 kbps DesensThr 0x3 0x4 0x5 0x5 PsavThr 0x9 0xC 0xF 0xF Thresholds RATECON (RATE CONFIGURATION REGISTER) 1 Mbps 2 Mbps ADDRESS: 0x36 R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-1 R/W-1 DIS2000 DIS1000 DIS500 DIS250 DISSTD DIS125 OPTIMAL PSAV bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-1 Out of scope. bit 0 PSAV: Power-Save Mode Selection bit When this bit is set, frame detection is dependent on the RSSI signal, and the receive signal processor is turned on when a sudden and significant increase (PSAVTHR<3:0>) is detected in the signal strength or the signal strength is above an absolute level (DESENSTHR<3:0>). 1 = Power-Save mode 0 = Hi-Sensitivity mode 2015 Microchip Technology Inc. Preliminary DS70005023C-page 225 MRF24XA REGISTER 9-27: POWSAVE (POWER-SAVE CONFIGURATION REGISTER) ADDRESS 0x37 R/W-1010 R/W-1010 DESENSTHR<3:0> PSAVTHR<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-4 DESENSTHR<3:0>: Desensitization Threshold Field bits This field defines an absolute level on the RSSI signal to activate receive signal processor if PSAV = 1. Unit is: 4 dB/LSB. Unsigned encoding is used. bit 3-0 PSAVTHR<3:0>: Frame Detection Threshold Register Field bits This field defines a relative (relative to the last 4 s RSSI value) threshold level on the RSSI signal to activate receive signal processor if PSAV = 1. Unit is 0.5 dB/LSB. Unsigned encoding is used. TABLE 9-9: Name RATECON REGISTERS ASSOCIATED WITH POWER-SAVE LISTEN MODE Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 DIS2000 DIS1000 DIS500 DIS250 DISSTD DIS125 OPTIMAL PSAV POWSAVE DESENSTHR<3:0> PSAVTHR<3:0> Legend: r = Reserved, read as ‘0’. DS70005023C-page 226 Preliminary 2015 Microchip Technology Inc. MRF24XA 9.11 AFC AFC circuit of MRF24XA measures Carrier Frequency Offset (CFO), for all the received packets. The measured value is interpreted as the frequency offset between the two communicating nodes. Note: AFC circuit stores CFO value in CFOMEAS field after the SFD is detected and clears the field as the frame processing is finished and RXIF interrupt is generated. CFOTX is used as digital CFO compensation for transmitting. CFORX is used as digital CFO compensation for receiving. REGISTER 9-28: CFOCON (CFO PRE COMPENSATION REGISTER) ADDRESS: 0x34 R/W-0000 R/W-0000 CFOTX<3:0> CFORX<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-4 CFOTX<3:0>: TX Carrier Frequency Offset Field bits The host writes this value to compensate for the Carrier Frequency Offset of the node during transmission. Pre-compensation enables using crystals with wider tolerances. Frequency Offset Unit is: 13 ppm/LSB. Two’s complement encoding. bit 3-0 CFORX<3:0>: RX Carrier Frequency Offset Field bits The host writes this value to pre-compensate the Carrier Frequency Offset estimation window (±55 ppm). Frequency Offset Unit is: 13 ppm/LSB. Two’s complement encoding. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 227 MRF24XA REGISTER 9-29: CFOMEAS (CFO MEASUREMENT INDICATION REGISTER) ADDRESS: 0x35 R/W-00000000 CFOMEAS<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-0 CFOMEAS<7:0>: CFO Measurement Field bits If AFCOVR bit is cleared, then this register is written and valid when RXSFDIF is set with the value of the Carrier Frequency Offset that was estimated during the acquisition of the packet. The host may use this value together with the LQI as a preamble quality indication (the LQI is measured over the CFO compensated payload). If AFCOVR bit is set, this receiver compensates the Carrier Frequency Offset. Note that in this case, the CFO estimation algorithm is disabled, thus ±13 ppm CFO is tolerated. CFORX has no effect when AFCOVR is set. Frequency Offset Unit is: ~1.62 ppm/LSB of the 2.4 GHz carrier. Two’s complement encoding is used. 9.12 Receive Status Vector (RSV)(1, 2) The Receive Status Vector (RSV) can extend the received packet that gives extra information about the link. RSV bits are individually enabled. Note 1: RSV does not affect the LENGTH field of the packet. 2: LQI, RSSI, CHDR and CFO are the order of appending the CRC. DS70005023C-page 228 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 9-30: RXCON1 (MAC RECEIVE CONTROL 1 REGISTER) ADDRESS: 0x15 R/W/HC/HS-0 R/W-0 R/W/HC-0 R/W-0 R/W-0 RXEN NOPA RXDEC RSVLQIEN RSVRSSIEN R/W-0 R/W-0 R-0 RSVCHDREN RSVCFOEN r bit 7 bit 0 Legend: R = Readable bit W = Writable bit -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 U = Unimplemented bit, read as ‘0’ x = Bit is unknown RXEN: Receive Enable Field bit This bit enables/disables the packet reception. If an RX packet is currently being received, clearing this bit causes that packet to be discarded. 1 = RX enabled 0 = RX disabled Hardware clear/set when: • Cleared when TRXMODE is set to TX-Streaming mode • Set when TRXMODE is set to RX-Streaming mode Clearing this bit aborts the current operation in the following cases: • Receiving a packet in Packet mode or in RX-Streaming mode Changes to most RX related settings must be only done while this bit is cleared. The clear channel assessment (CSMAEN) and ACK-frame reception does not require RXEN = 1 as the device turns the radio into RX when needed, irrespective of the status of the RXEN bit. bit 6 NOPA: No Parsing bit This bit disables packet parsing. Only CRC is checked, if it is enabled. This feature is useful in Sniffer mode. 1 = Disable packet parsing 0 = Enable packet parsing bit 5 RXDEC: RX Decryption bit Setting this bit starts RX security processing (authentication or decryption, or both) on the last received packet. 1 = RX security processing started/in process. RXDECIF or RXTAGIF is set. 0 = RX security processing inactive or complete This bit clears itself after RX decryption has completed. bit 4 RSVLQIEN: Receive Status Vector LQI Enable bit If bit is set, the measured Link Quality is appended after the received frame in the packet buffer. 1 = Append LQI field 0 = Do not append LQI field bit 3 RSVRSSIEN: Receive Status Vector RSSI Enable bit If bit is set, the measured RSSI is appended after the received frame in the packet buffer. 1 = Append RSSI field 0 = Do not append RSSI field 2015 Microchip Technology Inc. Preliminary DS70005023C-page 229 MRF24XA REGISTER 9-30: bit 2 RXCON1 (MAC RECEIVE CONTROL 1 REGISTER) (CONTINUED) ADDRESS: 0x15 RSVCHDREN: Receive Status Vector Channel/MAC Type/Data Rate Enable bit If bit is set, Channel, MAC type and Data Rate configurations used with the received frame are appended after the received frame in the packet buffer, using the encoding specified for CH<3:0>, FRMFMT and DR<2:0> (concatenated in this order when MSb is first). 1 = Append Channel, MAC type and Data Rate fields 0 = Do not append Channel, MAC type and Data Rate fields bit 1 RSVCFOEN: Receive Status Vector CFO Enable bit If bit is set, the estimated Carrier Frequency Offset of the received frame is appended after the received frame in the packet buffer, using the same encoding as CFOMEAS register. 1 = Append CFO estimation 0 = Do not append estimated CFO bit 0 9.13 Reserved: Maintain as ‘0’ External Power Amplifier (PA)/ Low-Noise Amplifier (LNA) MRF24XA has a PA control pin (pin 20) and an LNA control pin (pin 21) to handle external PAs and LNAs or external antenna switch circuits. MRF24XA can also tolerate different start-up times of different external circuits by sending or accepting data if the external circuits completes their ramp up. MRF24XA can handle both active-high or active-low control signal sensitive circuits. 9.13.1 PA2TXMA<4:0>, External Power Amplifier Power-Up to Medium Access Configuration, defines the time delay that MRF24XA waits after powering on the external PA before sending any data to transmit. Figure 9-7 illustrates the management of MRF24XA. method of PA time EXTERNAL PA HANDLING MRF24XA can automatically switch ON and OFF external PA circuits as the internal functionalities require to transmit any signal. PA pin is automatically set to its preset active state as external PA is needed and set back to its inactive state if PA is not needed. To enable external PA handling, set PAEN bit of EXTPA register to ‘1’. EXTPAP bit sets the active state of PA control line. The current value of EXTPAP bit is the active state of the PA line. RFOP<2:0>, field of the Radio Operation Register shows the status of the radio and external PA. 9.13.1.1 PA Switch Time Management MRF24XA is used with various external PA circuits. Different PA circuits may have different start-up time constraints to reach the steady state. MRF24XA can manage to start transmitting if both the internal and external PA circuits are ready to operate. TX2TXMA<4:0>, Transmit Power-Up to Medium Access Configuration, defines the time delay that MRF24XA waits after powering on the internal PA before sending any data to transmit. Its POR default value is calculated to cover most of the cases, but user can redefine its value if needed. DS70005023C-page 230 Preliminary 2015 Microchip Technology Inc. MRF24XA FIGURE 9-7: PA ACCESS TIME MANAGEMENT Switching ON Switching ON Internal PA External PA T0 - TX2TXMA Start Transmitting T0 - PA2TXMA 2015 Microchip Technology Inc. T0 Preliminary DS70005023C-page 231 MRF24XA 9.13.2 EXTERNAL LNA HANDLING MRF24XA can automatically switch ON and OFF external LNA circuit as the internal functionalities require receiving. LNA pin is automatically set to its predefined active state as external LNA circuit is needed, and set back to its inactive state if LNA is not needed. To enable external LNA handling, set LNAEN bit of the EXTLNA register to ‘1’. EXTLNAP bit sets the active state of LNA line. The actual value of EXTLNAP bit is the active state of the LNA line. REGISTER 9-31: R-0 MRF24XA is programmed to delay signal receiving after powering on the external LNA circuit. It enables to optimize the power consumption to the startup time of the external LNA circuit. LNADLY<4:0> defines the time delay between LNA power-up and the start of signal reception. The time base is 1 µs. Higher LNADLY value means longer Wait before starting reception. RFOP<2:0> field of the Radio Operation register shows the status of the radio and external LNA. OPSTATUS (OPERATION STATUS) R/HS/HC-0 r R/HS/HC-0 R/HS/HC-0 R/HS/HC-0 Address: 0x02 R/HS/HC-0 MACOP<3:0> R/HS/HC-0 R/HS/HC-0 RFOP<2:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 Reserved: Maintain as ‘0’ bit 6-3 Out of scope bit 2-0 RFOP <2:0>: Radio Operation Register Field bits x = Bit is unknown Provides status information on the current Radio state. Encoding on RFOP<2:0>: 111 = TX with external PA is turned on (TX+PA) 110 = RX with external LNA is turned on (RX+LNA) 101 = Synthesizer and external PA or LNA is turned on (SYNTH+PA/LNA) DS70005023C-page 232 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 9-32: TX2TXMA (TRANSMIT POWER-UP TO MEDIUM ACCESS CONFIGURATION REGISTER) ADDRESS 0x3C R-0 R/W-00011 r TX2TXMA<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7-5 Reserved: Maintain as ‘0’ bit 4-0 TX2TXMA<4:0>: Transmit Power-Up to Medium Access Configuration Field bits Defines the time interval between turning on the transmitter of the device and the start time of medium access (start of the PHY-layer frame). TX_TO_TXMA = The transient time of the transmitter, in the following scenarios: PAEN = 0 PAEN = 1, but the PA is turned on first. PA_TO_TXMA = TX_TO_TXMA + PA transient time. PAEN = 1, but the TX and PA transients are NOT sequenced. TX_TO_TXMA = The transient time of the transmitter + PA_TO_TXMA: PAEN = 1, and the transmitter is turned on first (transients are sequenced). Representation: 1 s/1 LSB. No offset. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 233 MRF24XA REGISTER 9-33: EXTPA (EXTERNAL POWER AMPLIFIER CONFIGURATION REGISTER) ADDRESS 0x3D R-0 R/W-0 R/W-0 R/W-00100 r EXTPAP PAEN PA2TXMA<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7 Reserved: Maintain as ‘0’ bit 6 EXTPAP: External Power Amplifier Polarity bit 1 = 3.3V turns Power Amplifier ON 0 = GND turns Power Amplifier ON bit 5 PAEN: External Power Amplifier Enable bit This bit enables the PA pin to output the control signal for external Power Amplifier. bit 4-0 PA2TXMA<4:0>: External Power Amplifier Power-Up to Medium Access Configuration Field bits Defines the time interval between turning on the external PA of the device and the start time of medium access (start of the PHY-layer frame). PA_TO_TXMA = The transient time of the external PA, in the following scenarios: PAEN = 1, and the transmitter is turned on first. TX_TO_TXMA = PA_TO_TXMA + TX transient time. PAEN = 1, but the TX and PA transients are NOT sequenced. PA_TO_TXMA = The transient time of the PA + TX_TO_TXMA: PAEN = 1, and the external power amplifier is turned on first (Transients are sequenced). Representation: 1 s/1 LSB. No offset DS70005023C-page 234 Preliminary 2015 Microchip Technology Inc. MRF24XA REGISTER 9-34: EXTLNA (EXTERNAL LOW-NOISE AMPLIFIER CONFIGURATION REGISTER ADDRESS 0x3E R-0 R/W-0 R/W-0 R/W-00100 r EXTLNAP LNAEN LNADLY<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘0’ = Bit is cleared ‘1’ = Bit is set x = Bit is unknown r = Reserved bit 7 Reserved: Maintain as ‘0’ bit 6 EXTLNAP: External Low Noise Amplifier Polarity bit 1 = 3.3V turns Low-Noise Amplifier ON 0 = GND turns Low-Noise Amplifier ON bit 5 LNAEN: External Low-Noise Power Amplifier Enable bit This bit enables the LNA pin to output the control signal for external Low-Noise Amplifier. bit 4-0 LNADLY<4:0>: External Low-Noise Amplifier Power-Up Transient Delay Field bits Defines the duration between turning on the LNA and the time when the reception is valid. LNA and receiver are turned on together. The longer transient is awaited before input signal is accepted as valid. Representation: 1 s/1 LSB. No offset. TABLE 9-10: REGISTERS ASSOCIATED WITH EXTERNAL PA AND LNA 7 OPSTATUS 6 r 5 4 MACOP<3:0> TX2TXMA r 3 2 1 0 RFOP<2:0> TX2TXMA<4:0> EXTPA r EXTPAP PAEN PA2TXMA<4:0> EXTLNA r EXTLNAP LNAEN LNADLY<4:0> Legend: r = Reserved, read as ‘0’. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 235 MRF24XA NOTES: DS70005023C-page 236 Preliminary 2015 Microchip Technology Inc. MRF24XA 10.0 BATTERY LIFE OPTIMIZATION In a battery-operated application, the device only wakes up when it must transmit or requires to poll for data. Polling is used for data reception as a means to synchronize the remotely transmitting node to the wake-up event in the receiver. Between transmission and reception the device must be held in Deep Sleep mode drawing less current than the battery self-discharge, which is about 1 µA. Register contents and internal Calibration state are maintained in Deep Sleep mode for efficient power mode changes. Long battery life is achieved through low currents in each state of the device and a series of system features that contribute to minimize the duration required for transmit or receive. The following enhanced features are used to minimize radio ON time: • High air-data-rates to minimize the packet duration • Automatic, on-the-fly, per frame, air-data-rate adaptation in the receiver, allowing the transmitter to select the highest data rate that fits the quality of the link • Minimized framing overheads in both the PHY and the MAC layers • Minimized ramp-up and turnaround times • Short, still reliable channel assessment • Automatically handled TX and RX signal paths • Inferred destination addressing On-the-fly, per frame air-data-rate detection is the capability of the receiver to synchronize to the transmitter data rate without knowing the sender of the frame and the expected data rate in advance. On-the-fly, per frame, air-data-rate detection gives the following advantages: • Each low-power node can use the highest data rate allowed by its link quality to save its battery charge. The evaluation of the link quality requires MCU interaction. • Multiple data rates are used within the same network. As opposed to conventional protocols supporting the simultaneous use of multiple air-data-rates in the network traffic, the frame header, which encodes the payload data rate, does not use the lowest data rate. Without this feature either the worst link defines the airdata-rate that all nodes must use, or each node must use the lowest data rate for the frame header, which can severely compromise the throughput and battery efficiency of the highest rates. Passive listening, channel assessment and the duration of the turnaround between transmit and receive contribute to the power consumption. 2015 Microchip Technology Inc. In this regard, MRF24XA excels by minimized TX-toRX turnaround durations, fast but reliable channel assessment and short PLL and AGC ramp-up durations. Power modes are automatically sequenced during CSMA sending by the internal state machines of the device without interaction from the MCU. These mechanisms can optionally control external PA and LNA. The Message Chart in Figure 10-1 illustrates a typical wake-up cycle: 1. 2. 3. 4. 5. 6. 7. While the low-power device is in Deep Sleep mode, the coordinator listens to the channel and buffers any messages addressed to the low-power node. The low-power node wakes up when must transmit, or periodically to poll the coordinator for any pending data. First, the low-power node sends a poll command to the coordinator and any data it must send. Low-power node can go back to Deep Sleep mode as soon as it gets an ACK unless the coordinator has buffered pending data. This condition is indicated in a specific bit field of the acknowledge frame that the coordinator is sending. In the case of pending data, the low-power node may want to turn off the radio for a predetermined duration allowing the coordinator to retrieve the pending data for sending. Finally, the coordinator turns to Receive mode to get the pending data. On successful reception, it turns to transmit to send an ACK and returns to Deep Sleep mode. Time-outs ensure that the low-power node does not stay powered-up forever in the case when the coordinator fails to respond in any of the transactions above. Figure 10-1 shows that all the radio activities are minimized to immediately return to Deep Sleep mode. As a result, the average current consumption is reduced by multiple factors in comparison to the standard IEEE 802.15.4 operation. The comparison is done for three corner cases as follows: • Table 10-1 for polling without pending data • Table 10-2 for polling with 80 octets pending data • Table 10-3 for the transmission of 80 octets A combination of the three cases allow evaluating the energy budget of complex scenarios. A yearly 10 mAh is to be added for battery self-discharge and Deep Sleep mode. Equation 10-1 shows the self discharge current calculation. The consumption of the MCU and any sensors, displays must be added. Preliminary DS70005023C-page 237 MRF24XA The enhanced MAC and PHY feature set also compresses the frame header time to achieve the shortest possible radio ON time. EQUATION 10-1: To reduce leakage current, ensure that GPIO weak pull up is turned off in case it is not needed in Deep Sleep mode. BATTERY SELF-DISCHARGE The discharge caused by 1 µA average current over one year: 1µA x 1 year = 8.76 mAh POLLING FOR PENDING DATA – NO PENDING DATA IS AVAILABLE(1) TABLE 10-1: Wake-up Consumed Battery Charge Unit Mode Period 2 Mbps Extended Data Rate 802.15.4 Compliant Mode Single wake-up per wake-up 4480 17450 mA*µs = nC Yearly average while waking up regularly in every 1s 39.3 152.9 mAh/year = µA 20s 2 7.6 mAh/year = µA 1 min 0.7 2.5 mAh/year = µA 5 min 0.1 0.5 mAh/year = µA Note 1: The calculations are strongly depended on the used protocol. It may happen that a given protocol cannot produce the listed battery life values. POLLING FOR PENDING DATA – 80 OCTETS OF PENDING DATA RECEIVED(1) TABLE 10-2: Wake-up Consumed Battery Charge Unit Mode Period 2 Mbps Extended Data Rate 802.15.4 Compliant Mode Single wake-up per wake-up 12030 62620 mA*us = nC Yearly average while waking up regularly in every 1s 163.7 936.7 mAh/year = µA Note 1: 20s 8.2 46.8 mAh/year = µA 1 min 2.7 15.6 mAh/year = µA 5 min 0.5 3.1 mAh/year = µA The calculations are strongly depended on the used protocol. It may happen that a given protocol cannot produce the listed battery life values. TABLE 10-3: POLLING FOR PENDING DATA – TRANSMITTING 80 OCTETS TO COORDINATOR (AS PIGGYBACK DATA – NO PENDING RECEIVED DATA)(1) Wake-up Consumed Battery Charge Mode Period 2 Mbps Extended Data Rate 802.15.4 Compliant Mode Unit Single wake-up per wake-up 10560 66090 mA*us = nC Yearly average while waking up regularly in every 1s 92.5 579 mAh/year = µA 20s 4.6 28.9 mAh/year = µA 1 min 1.5 9.6 mAh/year = µA 5 min 0.3 1.9 mAh/year = µA Note 1: The calculations are strongly depended on the used protocol. It may happen that a given protocol cannot produce the listed battery life values. DS70005023C-page 238 Preliminary 2015 Microchip Technology Inc. MRF24XA FIGURE 10-1: MRF24XA POWER MODES DURING DATA POLLING (MESSAGE SEQUENCE CHART) Coordinator (mains powered) Low-power (battery-powered) Listen/ Receive Duration is... Deep Sleep maximized Wake-up minimized Clear channel assessment minimized by sensitive detector minimized by zeroIF architecture RX-to-TX POLL for pending data (+ optional piggyback data) minimized by high data rate and low framing overhead Transmit minimized by zero-IF architecture TX-to-RX Acknowledge + indicate if data is pending TX/RX OFF minimized by high data rate and low framing overhead Listen/ Receive If data is NOT pending then Deep Sleep else Waits for data retrieval (fixed duration) MCU retrieves the data to send and loads it for transmission TX/RX OFF TRXOFF-to-RX (start PLL) Pending DATA Listen/ Receive minimized by high data rate and low framing overhead RX-to-TX minimized by zeroIF architecture Transmit minimized by high data rate and low framing overhead Acknowledge Listen/Receive 2015 Microchip Technology Inc. Preliminary DS70005023C-page 239 MRF24XA NOTES: DS70005023C-page 240 Preliminary 2015 Microchip Technology Inc. MRF24XA 11.0 ELECTRICAL CHARACTERISTICS Absolute Maximum Ratings Ambient temperature under bias.............................................................................................................. -40°C to +85°C Storage temperature .............................................................................................................................. -40°C to +125°C Voltage on any digital or analog pin with respect to VSS (except VDD) ......................................... -0.3V to (VDD + 0.3V) Voltage on VDD with respect to VSS ............................................................................................................... -0.3V to 6V Maximum output current sunk by GPIO0-GPIO2 pins .......................................................................... 2mA at 0.3xVDD Maximum output current sourced by GPIO0-GPIO2 pins ..................................................................... 2mA at 0.3xVDD Note: Stresses above those listed under “Absolute Maximum Ratings” may cause permanent damage to the device. This is a stress rating only and functional operation of the device at those or any other conditions above those indicated in the operation listings of this specification is not implied. Exposure to maximum rating conditions for extended periods may affect device reliability. TABLE 11-1: RECOMMENDED OPERATING CONDITIONS Parameter Min. Typ Max. Units Ambient Operating Temperature -40 +25 +85 °C Supply Voltage for RF, analog (AVDD) and digital circuits (DVDD) 1.08 1.2 1.32 V Supply Voltage for LDO Input (pin 30) and digital I/O (pin 23) 1.5 3.3 3.6 V Input High Voltage (VIH) 0.65 x VDD — VDD +0.3 V Input Low Voltage (VIL) -0.3 — 0.35 x VDD V TABLE 11-2: CURRENT CONSUMPTION Typical Values: TA = 25°C, VDD = 3.3V Operating mode Deep Sleep Condition Min. Typ Max. Units All GPIO pins are grounded — 40 — nA Sleep — — 0.3 — mA Crystal ON — — 1.1 — mA Synthesizer ON — — 7 — mA RX Listen Power-Save All data rates — 13.5 — mA RX Listen All data rates — 16.5 — mA RX Packet Demodulation 1 Mbps or 2 Mbps — 15.5 — mA RX Packet Demodulation 500 kbps, 250 kbps or 125 kbps — 16.5 — mA — 30 — mA TX Note 1: at maximum power( 1) For further details, see Figure 9-5 and Figure 9-6. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 241 MRF24XA TABLE 11-3: RECEIVER CHARACTERISTICS Typical Values: TA = 25°C, VDD = 3.3V Parameters Condition Min. Typ Max. Units RF Input Frequency — 2.405 — 2.480 GHz dBm RF Sensitivity Data Rate: 250 kbps, PER 1% — -95 — 125 kbps at 0 ppm CFO — -103 — at +/- 110 ppm CFO — -100 — — -100 — at +/- 110 ppm CFO — -99 — 500 kbps: Legacy and Optimal framing — — — 250 kbps at 0 ppm CFO at 0 ppm CFO — -97 — at +/- 110 ppm CFO — -96 — 1 Mbps: Legacy framing — — — at 0 ppm CFO — -92 — at +/- 110 ppm CFO — -92 — — — — at 0 ppm CFO — -91 — at +/- 85 ppm CFO — -89 — Optimal framing 2 Mbps: Legacy framing — — — at 0 ppm CFO — -88 — at +/- 110 ppm CFO — -88 — — — — at 0 ppm CFO — -87 — at +/- 85 ppm CFO — -86 — Optimal framing Maximum RF Input LO Leakage — Maximal leakage when radio is in RX, measured after balun — -10 — dBm — -51.8 — dBm Adjacent Channel Rejection at ±5 MHz — 32 — dB Alternate Channel Rejection at ±10 MHz — 45 — dB RSSI Range — — 75 — dB RSSI Error — — — ±5 dB TABLE 11-4: TRANSMITTER CHARACTERISTICS Typical Values: TA = 25°C, VDD = 3.3V Parameters RF Carrier Frequency Condition Min. Typ Max. Units — 2.405 — 2.480 GHz Maximum RF Output Power — — 1 — dBm RF Output Power Control Range — — 20 — dB TX Spectrum Mask for O-QPSK Signal Offset frequency >3.5 MHz, at 0 dBm output power — -35 — dBm — 17 23 30 % TX EVM DS70005023C-page 242 Preliminary 2015 Microchip Technology Inc. MRF24XA FIGURE 11-1: TABLE 11-5: EXAMPLE SPI SLAVE MODE TIMING EXAMPLE SLAVE MODE REQUIREMENTS Parameter Number Symbol Characteristic Min. Max. Units 70 TSSL2SCH CS ↓ to SCK ↑ Input 50 — ns 71 TSCH SCK Input High Time 50 — ns 72 TSCL SCK Input Low Time 50 — ns 74 TSCH2DIL Hold Time of SDI Data Input to SCK Edge 25 — ns 75 TDOR SDO Data Output Rise Time — 25 ns 76 TDOF SDO Data Output Fall Time — 25 ns 78 TSCR SCK Output RiseTime — 25 ns 80 TSCH2DOV, TSCL2DOV SDO Data Output Valid after SCK Edge 50 — ns 82 TSSL2DOV SDO Data Output Valid after NCS ↓ Edge 50 — ns 83 TSSL2SSH NCS ↑ after SCK Edge 50 — ns 11.1 Matching Network Due to some innovative RF solutions built into the chip, the conventional way of matching network design does not work with this radio. For further information, contact support or your sales representative. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 243 MRF24XA NOTES: DS70005023C-page 244 Preliminary 2015 Microchip Technology Inc. MRF24XA 12.0 PACKAGING INFORMATION 12.1 Package Marking Information 32-Lead Very Thin Plastic Quad Flat, No Lead Package (MQ) - 5x5x0.9 mm Body [VQFN] Note: For the most current package drawings, please see the Microchip Packaging Specification located at http://www.microchip.com/packaging D A B N 1 2 NOTE 1 E (DATUM B) (DATUM A) 2X 0.20 C 2X TOP VIEW 0.20 C 0.10 C (A3) A1 C A SEATING PLANE 32X SIDE VIEW 0.10 0.08 C C A B D2 0.10 C A B E2 e 2 2 1 NOTE 1 32X K N 32X L 32X b 0.10 0.05 e C A B C BOTTOM VIEW Microchip Technology Drawing C04-160A Sheet 1 of 2 2015 Microchip Technology Inc. Preliminary DS70005023C-page 245 MRF24XA 32-Lead Very Thin Plastic Quad Flat, No Lead Package (MQ) - 5x5x0.9 mm Body [VQFN] Note: For the most current package drawings, please see the Microchip Packaging Specification located at http://www.microchip.com/packaging ALTERNATE EXPOSED PAD CONFIGURATION Units Dimension Limits Number of Pins N e Pitch Overall Height A Standoff A1 A3 Terminal Thickness Overall Width E E2 Exposed Pad Width Overall Length D D2 Exposed Pad Length Terminal Width b Terminal Length L K Terminal-to-Exposed-Pad MIN 0.80 0.00 3.70 3.70 0.18 0.30 0.20 MILLIMETERS NOM 32 0.50 BSC 0.90 0.02 0.20 REF 5.00 BSC 5.00 BSC 0.25 0.40 - MAX 1.00 0.05 3.90 3.90 0.30 0.50 - Notes: 1. Pin 1 visual index feature may vary, but must be located within the hatched area. 2. Package is saw singulated 3. Dimensioning and tolerancing per ASME Y14.5M BSC: Basic Dimension. Theoretically exact value shown without tolerances. REF: Reference Dimension, usually without tolerance, for information purposes only. Microchip Technology Drawing C04-160A Sheet 2 of 2 DS70005023C-page 246 Preliminary 2015 Microchip Technology Inc. MRF24XA 32-Lead Ultra Thin Plastic Quad Flat, No Lead Package (MQ) - 5x5x0.9 mm Body [VQFN] Note: For the most current package drawings, please see the Microchip Packaging Specification located at http://www.microchip.com/packaging C1 X2 32 1 2 C2 Y2 G1 Y1 X1 SILK SCREEN E RECOMMENDED LAND PATTERN Units Dimension Limits E Contact Pitch Optional Center Pad Width X2 Optional Center Pad Length Y2 Contact Pad Spacing C1 Contact Pad Spacing C2 Contact Pad Width (X32) X1 Contact Pad Length (X32) Y1 Contact Pad to Center Pad (X32) G1 MIN MILLIMETERS NOM 0.50 BSC MAX 3.70 3.70 5.00 5.00 0.30 0.80 0.20 Notes: 1. Dimensioning and tolerancing per ASME Y14.5M BSC: Basic Dimension. Theoretically exact value shown without tolerances. Microchip Technology Drawing C04-2160A 2015 Microchip Technology Inc. Preliminary DS70005023C-page 247 MRF24XA NOTES: DS70005023C-page 248 Preliminary 2015 Microchip Technology Inc. MRF24XA APPENDIX A: REVISION HISTORY Revision A (August 2011) This is the initial released version of the document. Revision B (March 2013) Incorporated major formatting and text updates throughout the document. Revision C (March 2015) The following lists the modifications: • Incorporated major formatting • Revised a few sentences throughout the document • Added Chapter 12 “Packaging Information” • Updated PULLDIRGPIOx bit description to add 75 kOhm information • Updated Product Identification System section to add package information • Revised Table 2-3 and Figure 2-3. 2015 Microchip Technology Inc. Preliminary DS70005023C-page 249 MRF24XA NOTES: DS70005023C-page 250 Preliminary 2015 Microchip Technology Inc. MRF24XA THE MICROCHIP WEB SITE CUSTOMER SUPPORT Microchip provides online support via our WWW site at www.microchip.com. This web site is used as a means to make files and information easily available to customers. Accessible by using your favorite Internet browser, the web site contains the following information: Users of Microchip products can receive assistance through several channels: • Product Support – Data sheets and errata, application notes and sample programs, design resources, user’s guides and hardware support documents, latest software releases and archived software • General Technical Support – Frequently Asked Questions (FAQ), technical support requests, online discussion groups, Microchip consultant program member listing • Business of Microchip – Product selector and ordering guides, latest Microchip press releases, listing of seminars and events, listings of Microchip sales offices, distributors and factory representatives • • • • Distributor or Representative Local Sales Office Field Application Engineer (FAE) Technical Support Customers should contact their distributor, representative or Field Application Engineer (FAE) for support. Local sales offices are also available to help customers. A listing of sales offices and locations is included in the back of this document. Technical support is available through the web site at: http://microchip.com/support CUSTOMER CHANGE NOTIFICATION SERVICE Microchip’s customer notification service helps keep customers current on Microchip products. Subscribers will receive e-mail notification whenever there are changes, updates, revisions or errata related to a specified product family or development tool of interest. To register, access the Microchip web site at www.microchip.com. Under “Support”, click on “Customer Change Notification” and follow the registration instructions. 2015 Microchip Technology Inc. DS70005023C-page 251 MRF24XA NOTES: DS70005023C-page 252 2015 Microchip Technology Inc. MRF24XA PRODUCT IDENTIFICATION SYSTEM To order or obtain information, for example, on pricing or delivery, refer to the factory or the listed sales office. M. PART NO. Device X module T Tape and Reel MRF24XA; VDD range 1.5V to 3.6V Temperature Range: I Package: Example: a) Module Type Device: = -X MRF24XA -I/ = Industrial temp. tray. Temperature Range -40º C to +85º C (Industrial) MQ = Very Thin Plastic Quad Flat (5X5 mm Body), 32-lead MQ = Ultra Thin Plastic Quad Flat, No-Lead (5X5X0.9 mm Body), 32-lead 2015 Microchip Technology Inc. Preliminary DS70005023C-page 253 MRF24XA NOTES: DS70005023C-page 254 Preliminary 2015 Microchip Technology Inc. MRF24XA INDEX A Absolute Maximum Ratings .............................................. 241 Agility ................................................................................ 189 C Channel Agility .................................................................. 191 Customer Change Notification Service ............................. 251 Customer Notification Service........................................... 251 Customer Support ............................................................. 251 D Deep Sleep mode ............................................................. 237 E Electrical Characteristics................................................... 241 Errata .................................................................................... 3 I Internet Address................................................................ 251 L Low Dropout (LDO) ............................................................... 7 M Microchip Internet Web Site .............................................. 251 MRF24XA ............................................................................. 5 P Packaging Information ...................................................... 245 PIE2 .................................................................................... 25 PIE3 .................................................................................... 26 Power-Saving Features .................................................... 210 proprietary MAC ................................................................ 169 R Received Signal Strength Indicator (RSSI) ........................... 7 Recommended Operating Conditions ............................... 241 RXLISTEN ........................................................................ 204 S Synthesizer ....................................................................... 199 W WWW Address.................................................................. 251 WWW, On-Line Support ....................................................... 3 2015 Microchip Technology Inc. Preliminary DS70005023C-page 255 MRF24XA NOTES: DS70005023C-page 256 Preliminary 2015 Microchip Technology Inc. Note the following details of the code protection feature on Microchip devices: • Microchip products meet the specification contained in their particular Microchip Data Sheet. • Microchip believes that its family of products is one of the most secure families of its kind on the market today, when used in the intended manner and under normal conditions. • There are dishonest and possibly illegal methods used to breach the code protection feature. All of these methods, to our knowledge, require using the Microchip products in a manner outside the operating specifications contained in Microchip’s Data Sheets. Most likely, the person doing so is engaged in theft of intellectual property. • Microchip is willing to work with the customer who is concerned about the integrity of their code. • Neither Microchip nor any other semiconductor manufacturer can guarantee the security of their code. Code protection does not mean that we are guaranteeing the product as “unbreakable.” Code protection is constantly evolving. We at Microchip are committed to continuously improving the code protection features of our products. Attempts to break Microchip’s code protection feature may be a violation of the Digital Millennium Copyright Act. If such acts allow unauthorized access to your software or other copyrighted work, you may have a right to sue for relief under that Act. Information contained in this publication regarding device applications and the like is provided only for your convenience and may be superseded by updates. It is your responsibility to ensure that your application meets with your specifications. MICROCHIP MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND WHETHER EXPRESS OR IMPLIED, WRITTEN OR ORAL, STATUTORY OR OTHERWISE, RELATED TO THE INFORMATION, INCLUDING BUT NOT LIMITED TO ITS CONDITION, QUALITY, PERFORMANCE, MERCHANTABILITY OR FITNESS FOR PURPOSE. Microchip disclaims all liability arising from this information and its use. Use of Microchip devices in life support and/or safety applications is entirely at the buyer’s risk, and the buyer agrees to defend, indemnify and hold harmless Microchip from any and all damages, claims, suits, or expenses resulting from such use. No licenses are conveyed, implicitly or otherwise, under any Microchip intellectual property rights. Trademarks The Microchip name and logo, the Microchip logo, dsPIC, FlashFlex, flexPWR, JukeBlox, KEELOQ, KEELOQ logo, Kleer, LANCheck, MediaLB, MOST, MOST logo, MPLAB, OptoLyzer, PIC, PICSTART, PIC32 logo, RightTouch, SpyNIC, SST, SST Logo, SuperFlash and UNI/O are registered trademarks of Microchip Technology Incorporated in the U.S.A. and other countries. The Embedded Control Solutions Company and mTouch are registered trademarks of Microchip Technology Incorporated in the U.S.A. Analog-for-the-Digital Age, BodyCom, chipKIT, chipKIT logo, CodeGuard, dsPICDEM, dsPICDEM.net, ECAN, In-Circuit Serial Programming, ICSP, Inter-Chip Connectivity, KleerNet, KleerNet logo, MiWi, MPASM, MPF, MPLAB Certified logo, MPLIB, MPLINK, MultiTRAK, NetDetach, Omniscient Code Generation, PICDEM, PICDEM.net, PICkit, PICtail, RightTouch logo, REAL ICE, SQI, Serial Quad I/O, Total Endurance, TSHARC, USBCheck, VariSense, ViewSpan, WiperLock, Wireless DNA, and ZENA are trademarks of Microchip Technology Incorporated in the U.S.A. and other countries. SQTP is a service mark of Microchip Technology Incorporated in the U.S.A. Silicon Storage Technology is a registered trademark of Microchip Technology Inc. in other countries. GestIC is a registered trademarks of Microchip Technology Germany II GmbH & Co. KG, a subsidiary of Microchip Technology Inc., in other countries. All other trademarks mentioned herein are property of their respective companies. © 2015, Microchip Technology Incorporated, Printed in the U.S.A., All Rights Reserved. ISBN: 978-1-63277-137-7 QUALITYMANAGEMENTSYSTEM CERTIFIEDBYDNV == ISO/TS16949== 2015 Microchip Technology Inc. Microchip received ISO/TS-16949:2009 certification for its worldwide headquarters, design and wafer fabrication facilities in Chandler and Tempe, Arizona; Gresham, Oregon and design centers in California and India. The Company’s quality system processes and procedures are for its PIC® MCUs and dsPIC® DSCs, KEELOQ® code hopping devices, Serial EEPROMs, microperipherals, nonvolatile memory and analog products. In addition, Microchip’s quality system for the design and manufacture of development systems is ISO 9001:2000 certified. Preliminary DS70005023C-page 257 Worldwide Sales and Service AMERICAS ASIA/PACIFIC ASIA/PACIFIC EUROPE Corporate Office 2355 West Chandler Blvd. Chandler, AZ 85224-6199 Tel: 480-792-7200 Fax: 480-792-7277 Technical Support: http://www.microchip.com/ support Web Address: www.microchip.com Asia Pacific Office Suites 3707-14, 37th Floor Tower 6, The Gateway Harbour City, Kowloon Hong Kong Tel: 852-2943-5100 Fax: 852-2401-3431 China - Xiamen Tel: 86-592-2388138 Fax: 86-592-2388130 China - Zhuhai Tel: 86-756-3210040 Fax: 86-756-3210049 Austria - Wels Tel: 43-7242-2244-39 Fax: 43-7242-2244-393 Denmark - Copenhagen Tel: 45-4450-2828 Fax: 45-4485-2829 India - Bangalore Tel: 91-80-3090-4444 Fax: 91-80-3090-4123 France - Paris Tel: 33-1-69-53-63-20 Fax: 33-1-69-30-90-79 India - New Delhi Tel: 91-11-4160-8631 Fax: 91-11-4160-8632 Germany - Dusseldorf Tel: 49-2129-3766400 Atlanta Duluth, GA Tel: 678-957-9614 Fax: 678-957-1455 Austin, TX Tel: 512-257-3370 Boston Westborough, MA Tel: 774-760-0087 Fax: 774-760-0088 Chicago Itasca, IL Tel: 630-285-0071 Fax: 630-285-0075 Cleveland Independence, OH Tel: 216-447-0464 Fax: 216-447-0643 Australia - Sydney Tel: 61-2-9868-6733 Fax: 61-2-9868-6755 China - Beijing Tel: 86-10-8569-7000 Fax: 86-10-8528-2104 China - Chengdu Tel: 86-28-8665-5511 Fax: 86-28-8665-7889 China - Chongqing Tel: 86-23-8980-9588 Fax: 86-23-8980-9500 China - Dongguan Tel: 86-769-8702-9880 China - Hangzhou Tel: 86-571-8792-8115 Fax: 86-571-8792-8116 India - Pune Tel: 91-20-3019-1500 Japan - Osaka Tel: 81-6-6152-7160 Fax: 81-6-6152-9310 Japan - Tokyo Tel: 81-3-6880- 3770 Fax: 81-3-6880-3771 Korea - Daegu Tel: 82-53-744-4301 Fax: 82-53-744-4302 China - Hong Kong SAR Tel: 852-2943-5100 Fax: 852-2401-3431 Korea - Seoul Tel: 82-2-554-7200 Fax: 82-2-558-5932 or 82-2-558-5934 China - Nanjing Tel: 86-25-8473-2460 Fax: 86-25-8473-2470 Malaysia - Kuala Lumpur Tel: 60-3-6201-9857 Fax: 60-3-6201-9859 Detroit Novi, MI Tel: 248-848-4000 China - Qingdao Tel: 86-532-8502-7355 Fax: 86-532-8502-7205 Malaysia - Penang Tel: 60-4-227-8870 Fax: 60-4-227-4068 Houston, TX Tel: 281-894-5983 China - Shanghai Tel: 86-21-5407-5533 Fax: 86-21-5407-5066 Philippines - Manila Tel: 63-2-634-9065 Fax: 63-2-634-9069 China - Shenyang Tel: 86-24-2334-2829 Fax: 86-24-2334-2393 Singapore Tel: 65-6334-8870 Fax: 65-6334-8850 China - Shenzhen Tel: 86-755-8864-2200 Fax: 86-755-8203-1760 Taiwan - Hsin Chu Tel: 886-3-5778-366 Fax: 886-3-5770-955 China - Wuhan Tel: 86-27-5980-5300 Fax: 86-27-5980-5118 Taiwan - Kaohsiung Tel: 886-7-213-7828 Dallas Addison, TX Tel: 972-818-7423 Fax: 972-818-2924 Indianapolis Noblesville, IN Tel: 317-773-8323 Fax: 317-773-5453 Los Angeles Mission Viejo, CA Tel: 949-462-9523 Fax: 949-462-9608 New York, NY Tel: 631-435-6000 San Jose, CA Tel: 408-735-9110 Canada - Toronto Tel: 905-673-0699 Fax: 905-673-6509 China - Xian Tel: 86-29-8833-7252 Fax: 86-29-8833-7256 Germany - Munich Tel: 49-89-627-144-0 Fax: 49-89-627-144-44 Germany - Pforzheim Tel: 49-7231-424750 Italy - Milan Tel: 39-0331-742611 Fax: 39-0331-466781 Italy - Venice Tel: 39-049-7625286 Netherlands - Drunen Tel: 31-416-690399 Fax: 31-416-690340 Poland - Warsaw Tel: 48-22-3325737 Spain - Madrid Tel: 34-91-708-08-90 Fax: 34-91-708-08-91 Sweden - Stockholm Tel: 46-8-5090-4654 UK - Wokingham Tel: 44-118-921-5800 Fax: 44-118-921-5820 Taiwan - Taipei Tel: 886-2-2508-8600 Fax: 886-2-2508-0102 Thailand - Bangkok Tel: 66-2-694-1351 Fax: 66-2-694-1350 01/27/15 DS70005023C-page 258 2015 Microchip Technology Inc.