CC 2520
CC 2520
CC 2520
4/ZIGBEE RF TRANSCEIVER
SWRS068 DECEMBER 2007
APPLICATIONS IEEE 802.15.4 systems ZigBee systems Industrial monitoring and control Home and building automation Automatic Meter Reading Low-power wireless sensor networks Set-top boxes and remote controls Consumer electronics KEY FEATURES State-of-the-art selectivity/co-existence Adjacent channel rejection: 49 dB Alternate channel rejection: 54 dB Excellent link budget (103dB) 400 m Line-of-sight range Extended temp range (-40 to +125C) Wide supply range: 1.8 V 3.8 V Extensive IEEE 802.15.4 MAC hardware support to offload the microcontroller AES-128 security module CC2420 interface compatibility mode
Radio IEEE 802.15.4 compliant DSSS baseband modem with 250 kbps data rate Excellent receiver sensitivity (-98 dBm) Programmable output power up to +5 dBm RF frequency range 2394-2507 MHz Suitable for systems targeting compliance with worldwide radio frequency regulations: ETSI EN 300 328 and EN 300 440 class 2 (Europe), FCC CFR47 Part 15 (US) and ARIB STD-T66 (Japan) Microcontroller Support Digital RSSI/LQI support Automatic clear channel assessment for CSMA/CA Automatic CRC 768 bytes RAM for flexible buffering and security processing Fully supported MAC security 4 wire SPI 6 configurable IO pins Interrupt generator Frame filtering and processing engine Random number generator
Low Power RX (receiving frame, -50 dBm) 18.5 mA TX 33.6 mA @ +5 dBm TX 25.8 mA @ 0 dBm <1A in power down General Clock output for single crystal systems RoHS compliant 5 x 5 mm QFN28 (RHD) package
Development Tools Reference design IEEE 802.15.4 MAC software ZigBee stack software Fully equipped development kit Packet sniffer support in hardware
DESCRIPTION The CC2520 is TI's second generation ZigBee / IEEE 802.15.4 RF transceiver for the 2.4 GHz unlicensed ISM band. This chip enables industrial grade applications by offering state-of-the-art selectivity/co-existence, excellent link budget, operation up to 125C and low voltage operation. In addition, the CC2520 provides extensive hardware support for frame handling, data buffering, burst transmissions, data encryption, data authentication, clear channel assessment, link quality indication and frame timing information. These features reduce the load on the host controller. In a typical system, the CC2520 will be used together with a microcontroller and a few additional passive components.
26 VREG_EN
27 DCOUPL
25 RESETn
22 AVDD4 21 NC 20 AVDD1 19 RF_N 18 NC 17 RF_P 16 AVDD2 15 NC AVDD3 14 AGND exposed die attached pad
CC2520
Please be aware that an important notice concerning availability, standard warranty, and use in critical applications of Texas Instruments semiconductor products and disclaimers threto appear at the end of this datasheet. ZigBee is a registered trademark owned by ZigBee Alliance, Inc.
Copyright 2007, Texas Instruments Incorporated
23 RBIAS
28 SCLK
WWW.TI.COM
TABLE OF CONTENTS
1 2 3 4 5
Abbreviations ............................................................................................................................... 5 References................................................................................................................................... 7 Features....................................................................................................................................... 8 Absolute Maximum Ratings ....................................................................................................... 10 Electrical Characteristics............................................................................................................ 11 5.1 Recommended Operating Conditions ............................................................................ 11 5.2 DC Characteristics ......................................................................................................... 11 5.3 Wake-Up and Timing ..................................................................................................... 11 5.4 Current Consumptions ................................................................................................... 11 5.5 Receive Parameters....................................................................................................... 12 5.6 Frequency Synthesizer Parameters ............................................................................... 12 5.6.1 Transmit Parameters.................................................................................................. 12 5.7 RSSI/CCA Parameters................................................................................................... 13 5.8 FREQEST Parameters................................................................................................... 13 5.9 Typical Performance Curves .......................................................................................... 14 5.10 Low-Current Mode RX.................................................................................................... 19 5.10.1 Low-Current RX Mode Parameters ............................................................................ 19 5.11 Optional Temperature Compensation of TX................................................................... 20 5.11.1 Using the Temperature Sensor .................................................................................. 21 6 Crystal Specific Parameters....................................................................................................... 22 6.1 Crystal Requirements..................................................................................................... 22 6.2 On-chip Crystal Frequency Tuning................................................................................. 22 7 Pinout......................................................................................................................................... 23 8 Functional Introduction............................................................................................................... 25 8.1 Integrated 2.4 GHz IEEE 802.15.4 Compliant Radio ..................................................... 25 8.2 Comparison to CC2420.................................................................................................. 25 8.3 Block Diagram ................................................................................................................ 26 9 Application Circuit ...................................................................................................................... 29 9.1 Input / Output Matching .................................................................................................. 29 9.2 Bias Resistor .................................................................................................................. 30 9.3 Crystal ............................................................................................................................ 30 9.4 Digital Voltage Regulator................................................................................................ 30 9.5 Power Supply Decoupling and Filtering ......................................................................... 30 9.6 Board Layout Guidelines ................................................................................................ 30 9.7 Antenna Considerations ................................................................................................. 31 9.8 Choosing the Most Suitable Interconnection with a Microcontroller............................... 31 9.9 Interfacing CC2520 and MSP430F2618 ........................................................................ 31 10 Serial Peripheral Interface (SPI) ................................................................................................ 33 10.1 CSn ................................................................................................................................ 33 10.2 SCLK .............................................................................................................................. 33 10.3 SI.................................................................................................................................... 33 10.4 SO .................................................................................................................................. 34 10.5 SPI Timing Requirements .............................................................................................. 34 11 GPIO .......................................................................................................................................... 35 11.1 Reset Configuration of GPIO Pins.................................................................................. 35 11.2 GPIO as Input ................................................................................................................ 35 11.3 GPIO as Output.............................................................................................................. 36 11.4 Switching Direction on GPIO.......................................................................................... 36 11.5 GPIO Configuration ........................................................................................................ 36 12 Power Modes ............................................................................................................................. 40 12.1 Switching Between Power Modes .................................................................................. 40 12.2 Power Up Sequence Using RESETn (recommended)................................................... 41
WWW.TI.COM
12.3 Power Up With SRES .................................................................................................... 41 13 Instruction Set ............................................................................................................................ 43 13.1 Definitions ...................................................................................................................... 43 13.2 Instruction Descriptions .................................................................................................. 43 13.3 Instruction Set Summary ................................................................................................ 51 13.4 Status Byte ..................................................................................................................... 53 13.5 Command Strobes ......................................................................................................... 53 13.6 Command Strobe Buffer ................................................................................................ 53 14 Exceptions ................................................................................................................................. 55 14.1 Exceptions on GPIO Pins............................................................................................... 56 14.2 Predefined Exception Channels ..................................................................................... 56 14.3 Binding Exceptions to Instructions (command strobes) ................................................. 57 15 Memory Map .............................................................................................................................. 59 15.1 FREG ............................................................................................................................. 60 15.2 SREG ............................................................................................................................. 60 15.3 TX FIFO ......................................................................................................................... 60 15.4 RX FIFO ......................................................................................................................... 60 15.5 MEM ............................................................................................................................... 60 15.6 Frame Filtering and Source Matching Memory Map ...................................................... 60 16 Frequency and Channel Programming ...................................................................................... 62 17 IEEE 802.15.4-2006 Modulation Format.................................................................................... 63 18 IEEE 802.15.4-2006 Frame Format........................................................................................... 65 18.1 PHY Layer ...................................................................................................................... 65 18.2 MAC Layer ..................................................................................................................... 65 19 Transmit Mode ........................................................................................................................... 67 19.1 TX Control ...................................................................................................................... 67 19.2 TX State Timing ............................................................................................................. 67 19.3 TX FIFO Access ............................................................................................................. 67 19.3.1 Retransmission........................................................................................................... 68 19.3.2 Error Conditions ......................................................................................................... 68 19.4 TX Flow Diagram ........................................................................................................... 69 19.5 Frame Processing .......................................................................................................... 70 19.5.1 Synchronization Header ............................................................................................. 70 19.5.2 Frame Length Field .................................................................................................... 70 19.5.3 Frame Check Sequence............................................................................................. 70 19.6 Exceptions...................................................................................................................... 71 19.7 Clear Channel Assessment............................................................................................ 71 19.8 Output Power Programming........................................................................................... 71 19.9 Tips And Tricks .............................................................................................................. 72 20 Receive Mode ............................................................................................................................ 73 20.1 RX Control...................................................................................................................... 73 20.2 RX State Timing ............................................................................................................. 73 20.3 Frame Processing .......................................................................................................... 73 20.3.1 Synchronization Header And Frame Length Fields.................................................... 74 20.3.2 Frame Filtering ........................................................................................................... 74 20.3.3 Source Address Matching .......................................................................................... 77 20.3.4 Frame Check Sequence............................................................................................. 80 20.3.5 Acknowledgement Transmission................................................................................ 81 20.4 RX FIFO Access ............................................................................................................ 82 20.4.1 Using the FIFO and FIFOP Signals............................................................................ 82 20.4.2 Error Conditions ......................................................................................................... 83 20.5 RSSI ............................................................................................................................... 83 20.6 Link Quality Indication .................................................................................................... 84
WWW.TI.COM
21 Radio Control State Machine ..................................................................................................... 85 22 Crystal Oscillator........................................................................................................................ 87 23 External Clock Output ................................................................................................................ 88 24 Random Number Generation..................................................................................................... 89 25 Memory Management Instructions............................................................................................. 91 25.1 RXBUFMOV ................................................................................................................... 92 25.2 TXBUFCP ...................................................................................................................... 92 25.3 MEMCP .......................................................................................................................... 92 25.4 MEMCPR ....................................................................................................................... 92 25.5 MEMXCP ....................................................................................................................... 92 26 Security Instructions................................................................................................................... 93 26.1 Decoding of the Flags Field in CC2520.......................................................................... 93 26.2 INC ................................................................................................................................. 94 26.3 ECB ................................................................................................................................ 94 26.4 ECBO ............................................................................................................................. 95 26.5 ECBX ............................................................................................................................. 95 26.6 CTR / UCTR ................................................................................................................... 96 26.7 CBC-MAC ...................................................................................................................... 97 26.8 CCM / UCCM ................................................................................................................. 97 26.8.1 Inputs to the CCM and UCCM Instructions ................................................................ 97 26.9 Examples from IEEE802.15.4-2006 ............................................................................... 98 26.9.1 Authentication Only Using CCM* ............................................................................... 99 26.9.2 Encryption Only Using CCM* ..................................................................................... 99 26.9.3 Combination of Encryption and Authentication Using CCM*.................................... 100 27 Packet Sniffing ......................................................................................................................... 101 28 Registers.................................................................................................................................. 102 28.1 Register Settings Update ............................................................................................. 103 28.2 Register Access Modes................................................................................................ 103 28.3 Register Descriptions ................................................................................................... 105 29 Datasheet Revision History...................................................................................................... 126 30 Packaging Information ............................................................................................................. 127 30.1 Mechanical Data .......................................................................................................... 128
WWW.TI.COM
Abbreviations
AAF ACK ADC ADI AES AGC AM ARIB BER BIST CBC-MAC CCA CCM CDM CFR CHP CMOS CRC CSMA-CA CTR CW DAC DC DPU DSSS ECB ESD ESR ETSI EU EVM FCC FCF FCS FFCTRL FIFO FS FSM GPIO HBM HSSD I/O I/Q IEEE IF ISM ITU-T kbps LB LF LNA LO LPF LPM Anti Aliasing Filter Acknowledge Analog to Digital Converter Analog-Digital Interface Advanced Encryption Standard Automatic Gain Control Active Mode Association of Radio Industries and Businesses Bit Error Rate Built In Self Test Cipher Block Chaining Message Authentication Code Clear Channel Assessment Counter mode + CBC-MAC Charged Device Model Code of Federal Regulations Charge Pump Complementary Metal Oxide Semiconductor Cyclic Redundancy Check Carrier Sense Multiple Access with Collision Avoidance Counter mode (encryption) Continuous Wave Digital to Analog Converter Direct Current Data Processing Unit Direct Sequence Spread Spectrum Electronic Code Book (mode of AES operation) Electro Static Discharge Equivalent Series Resistance European Telecommunications Standards Institute European Union Error Vector Magnitude Federal Communications Commission Frame Control Field Frame Check Sequence FIFO and Frame Control First In First Out Frequency Synthesizer Finite State Machine General Purpose Input/Output Human Body Model High Speed Serial Debug Input / Output In-phase / Quadrature-phase Institute of Electrical and Electronics Engineers Intermediate Frequency Industrial, Scientific and Medical International Telecommunication Union Telecommunication Standardization Sector kilo bits per second Loop Back Loop Filter Low-Noise Amplifier Local Oscillator Low Pass Filter Low-Power Mode
WWW.TI.COM
LQI LSB LUT MAC MCU MFR MHR MIC MISO MM MOSI MPDU MSB MSDU NA NC O-QPSK PA PAN PCB PD PER PHR PHY PLL PQFP PSDU PUE QLP RAM RBW RF RHD RISC RoHS ROM RSSI RX SFD SHR SI SO SPI S-PQFP T/R TBD TX UI VCO VGA XOSC LR NaN
Link Quality Indication Least Significant Bit / Byte Look-Up Table Medium Access Control Micro Controller Unit MAC Footer MAC Header Message Integrity Code Master In Slave Out Machine Model Master Out Slave In MAC Protocol Data Unit Most significant Bit / Byte MAC Service Data Unit Not Available Not Connected Offset - Quadrature Phase Shift Keying Power Amplifier Personal Area Network Printed Circuit Board Power Down, Phase Detector Packet Error Rate PHY Header Physical Layer Phase Locked Loop Plastic Quad FlatPack PHY Service Data Unit Pull-Up Enable Quad Leadless Package Random Access Memory Resolution BandWidth Radio Frequency Not actually an acronym. This is the package name used in TI. Reduced Instruction Set Computer Restriction of Hazardous Substances Directive Read Only Memory Received Signal Strength Indicator Receive Start of Frame Delimiter Synchronization Header Serial In Serial Out Serial Peripheral Interface Plastic Quad Flat Pack Transmit / Receive To Be Decided / To Be Defined Transmit User Interface Voltage Controlled Oscillator Variable Gain Amplifier Crystal Oscillator Low Rate Not any Number
WWW.TI.COM
References
[1] IEEE std. 802.15.4 - 2003: Wireless Medium Access Control (MAC) and Physical Layer (PHY) specifications for Low Rate Wireless Personal Area Networks (LR-WPANs) http://standards.ieee.org/getieee802/download/802.15.4-2003.pdf IEEE std. 802.15.4 - 2006: Wireless Medium Access Control (MAC) and Physical Layer (PHY) specifications for Low Rate Wireless Personal Area Networks (LR-WPANs) http://standards.ieee.org/getieee802/download/802.15.4-2006.pdf CC2420 datasheet http://www.ti.com/lit/pdf/swrs041 NIST FIPS Pub 197: Advanced Encryption Standard (AES), Federal Information Processing Standards Publication 197, US Department of Commerce/N.I.S.T., November 26, 2001. http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf CC2520 reference designs http://focus.ti.com/docs/prod/folders/print/cc2520.html#applicationnotes CC2520 Errata note http://www.ti.com/lit/pdf/swrz024 CC2520 Product folder http://focus.ti.com/docs/prod/folders/print/cc2520.html NIST software package for randomness testing: http://csrc.nist.gov/rng/ The diehard software package for randomness testing: http://stat.fsu.edu/~geo/diehard.html
[2]
[3] [4]
[10] MSP430F2618 Product folder http://focus.ti.com/docs/prod/folders/print/msp430f2618.html [11] 2.4 GHz Inverted F Antenna http://www.ti.com/lit/pdf/swru120 [12] Antenna selection guide http://www.ti.com/lit/pdf/swra161
WWW.TI.COM
Features
2394-2507MHz transceiver DSSS transceiver 250kbps data rate, 2 MChip/s chip rate O-QPSK with half sine pulse shaping modulation Very low current consumption RX (receiving frame, -50 dBm): 18.5 mA RX (waiting for frame): 22.3 mA TX (+5 dBm output power): 33.6 mA TX (0 dBm output power): 25.8 mA Three flexible power modes for reduced power consumption Low power fully static CMOS design Very good sensitivity (-98dBm) High adjacent channel rejection (49 dB) High alternate channel rejection (54 dB) On chip VCO, LNA, PA and filters. Low supply voltage (1.8 - 3.8 V) Programmable output power up to +5 dBm I/Q direct conversion transceiver Small Size QFN 28 (RHD) package, 5 x 5 mm Very few external components o minimized number of passives o Only reference crystal needed Clock output for other ICs to limit the number of crystals needed in a system No external filters needed. Easy and Flexible User Interface 4-wire SPI Serial clock up to 8 MHz 6 GPIO pins with full flexibility Interrupt generator Full control of automatic responses to different events Embedded packet sniffer mode CC2420 compatibility mode Data Processing Unit For Advanced Data Handling Spacious (768 byte) on-chip RAM allows powerful on-chip frame processing 128 byte transmit data FIFO 128 byte receive data FIFO Full read and write access to RAM 128 bit AES IEEE 802.15.4 MAC Hardware Support Automatic preamble generator Synchronization word insertion and detection CRC-16 computation and verification over the MAC payload Frame filtering Automatic ACK and setting of the pending-bit Clear Channel Assessment (CCA) Energy detection / RSSI Link Quality Indication (LQI) Fully automatic MAC security (CTR, CBC-MAC, CCM)
WWW.TI.COM
Development Tools See product folder [7] Suited For Use in Systems That Target Compliance to the Following Standards IEEE 802.15.4 PHY ETSI EN 300 328 ETSI EN 300 440 class 2 FCC CFR47 part 15 ARIB STD-T66
WWW.TI.COM
over operating free-air temperature range unless otherwise noted (1) PARAMETER Supply voltage (2) Voltage on any digital pin Voltage on 1.8 V pins Input RF level Storage temperature range Reflow soldering temperature ESD HBM ESD CDM ESD MM
1)
2)
Stresses beyond those listed under absolute maximum ratings may cause permanent damage to the device. These are stress ratings only, and functional operation of the device at these or any other conditions beyond those indicated under recommended operating conditions is not implied. Exposure to absolute-maximum-rated conditions for extended periods may affect device reliability. All voltage values are with respect to network ground terminal.
This device has limited built-in gate protection. The leads should be shorted together or the device placed in conductive foam during storage or handling to prevent electrostatic damage to the MOS gates.
10
WWW.TI.COM
Electrical Characteristics
Note that these characteristics are only valid when using the recommended register settings presented in section 28.1. 5.1 Recommended Operating Conditions MIN 1.8 -40 NOM MAX 3.8 125 UNIT V C
5.2
DC Characteristics CONDITIONS
Valid for all pads (both GPIOs and fixed-input pads) Valid for all pads (both GPIOs and fixed-input pads) Only for fixed-input pads like RESET_N, CSn etc Input equals 0V Input equals VDD -25 -25 30% 0.5 25 25
TA =25C, VDD=3.0 V, fc=2440 MHz if nothing else stated. All parameters measured on Texas Instruments CC2520 EM 2.1 reference design with 50 load.
PARAMETER
Logic "1" input voltage Logic "0" input voltage Input pad hysteresis Logic "0" input current Logic "1" input current
MIN
TYP
MAX
80%
UNIT
of VDD of VDD V nA nA
5.3
TA =25C, VDD=3.0 V, fc =2440 MHz if nothing else stated. All parameters measured on Texas Instruments CC2520 EM 2.1 reference design with 50 load.
PARAMETER
LPM2 LPM1 AM AM AM time AM time RX time TX time
MIN
TYP
0.3 0.2
MAX
UNIT
ms ms
s s s s kbps MChip/s
RX/TX turnaround time TX/RX turnaround time Radio bit rate Radio chip rate
5.4
TA =25C, VDD=3.0 V, fc =2440 MHz if nothing else stated. All parameters measured on Texas Instruments CC2520 EM 2.1 reference design with 50 load.
PARAMETER
Receive current
MIN
TYP
22.3
MAX
24.8 26.3
UNIT
mA mA mA mA mA mA mA mA mA
Transmit current
XOSC on, digital regulator on. TA=-40 to 125C, VDD=1.8 to 3.8 V, fc =2394 to 2507 MHz
WWW.TI.COM
11
PARAMETER
LPM1 current
CONDITIONS
XOSC off, digital regulator on. State retention. TA=-40 to 125C, VDD=1.8 to 3.8 V, fc =2394 to 2507 MHz XOSC off, digital regulator off. No state retention. TA=-40 to 125C, VDD=1.8 to 3.8 V, fc =2394 to 2507 MHz
MIN
TYP
175
MAX
250 1000
UNIT
A A nA A
LPM2 current
30
120 4.5
5.5
TA =25C, VDD=3.0 V, fc =2440 MHz if nothing else stated. All parameters measured on Texas Instruments CC2520 EM 2.1 reference design with 50 load.
PARAMETER
Receiver sensitivity Saturation
MIN
-99
TYP
-98
MAX
-95 -88
UNIT
dBm dBm dBm
Interferer Rejection 10 MHz from wanted signal. [2] requires 30 dB 20MHz or above. Wanted signal at -82dBm. Maximum Spurious Emission
Conducted measurement in a 50 single ended load. Complies with EN 300 328, EN 300 440 class 2, FCC CFR47, Part 15 and ARIB STD-T-66
30 1000 MHz
1 12.75 GHz
-56
dBm
+/-400 -24
kHz dBm
5.6
TA =25C, VDD=3.0 V, fc =2440 MHz if nothing else stated. All parameters measured on Texas Instruments CC2520 EM 2.1 reference design with 50 load.
PARAMETER
Phase noise. Unmodulated carrier RF Frequency range
MIN
TYP
-111 -118 -128
MAX
UNIT
dBc/Hz dBc/Hz dBc/Hz
2507
MHz
5.6.1
TA =25C, VDD=3.0 V, fc =2440 MHz if nothing else stated. All parameters measured on Texas Instruments CC2520 EM 2.1 reference design with 50 load.
PARAMETER
Output power
Note: to reduce the output power variation over temperature, it is suggested that different settings are used at different temperatures. The on-chip temperature sensor can be used for this purpose. Please see section 5.11 for more information.
MIN
-3 2 -3 -4 -6 -9
TYP
1 5
MAX
5 7 8 8 8 8
UNIT
dBm dBm dBm dBm dBm dBm
12
WWW.TI.COM
PARAMETER
Largest spurious emission at maximum output power.
Texas Instruments CC2520 EM reference design complies with EN 300 328, EN 300 440, FCC CFR47 Part 15 and ARIB STDT-66. Transmit on 2480 MHz under FCC at +5 dBm is supported by duty-cycling, or by reducing output power. The peak conducted spurious emission might violate ETSI and FCC restricted band limits at frequencies below 1GHz. All radiated spurious emissions are within the limits of ETSI/FCC/ARIB. Applications that must pass conducted requirements are suggested to use a simple 50 high pass filter between matching network and RF connector.
CONDITIONS
25 MHz 1 GHz (outside restricted bands)
MIN
TYP
-40
MAX
UNIT
dBm
-53
dBm
-42
dBm
-56
dBm
5150 MHz-5300 MHz (ETSI restricted band) At 2483.5 MHz and above (FCC restricted band) fc=2480 MHz, +5 dBm fc=2480 MHz, 0 dBm
-54
dBm
-37 -41
dBm dBm
-54
dBm
[2] requires max. 35%. Measured as defined by [2]. Error Vector Magnitude (EVM) +5 dBm setting. fc =IEEE 802.15.4 channels 0 dBm setting. fc =IEEE 802.15.4 channels 6 2 % %
5.7
TA =25C, VDD=3.0 V, fc =2440 MHz if nothing else stated. All parameters measured on Texas Instruments CC2520 EM 2.1 reference design with 50 load.
PARAMETER
RSSI range RSSI/CCA accuracy RSSI/CCA offset LSB value
MAX
UNIT
dB dB dB dB
5.8
TA =25C, VDD=3.0 V, fc =2440 MHz if nothing else stated. All parameters measured on Texas Instruments CC2520 EM 2.1 reference design with 50 load.
PARAMETER
FREQEST range FREQEST accuracy FREQEST offset LSB value
MAX
UNIT
kHz kHz kHz kHz
WWW.TI.COM
13
5.9
TA =25C, VDD=3.0 V, fc =2440 MHz if nothing else stated. All parameters measured on Texas Instruments CC2520 EM 2.1 reference design with 50 load.
SENSITIVITY VS TEMPERATURE -92 -90.0 SENSITIVITY VS EVM
SENSITIVITY (dBm)
-94
-92.0
-94.0
-96
-96.0
-98
-98.0
-100
-100.0 0%
10 %
20 %
30 %
40 %
50 %
60 %
-94
-96
-80.0
-98
-120.0 -1000
-500
500
1000
SENSITIVITY (dBm)
-96
0dBm (0x32)
-98
-4
-100 2394
2414
2434
2454
2474
2494
FREQUENCY (MHz)
14
WWW.TI.COM
AM CURRENT VS TEMPERATURE
5dBm (0xF7)
CURRENT (mA)
1.8
1.7
0dBm (0x32)
1.6
300
CURRENT (mA)
34
CURRENT (uA)
200
33
100
RX CURRENT VS TEMPERATURE 25 2
1.2
23
0.8
22
0.4
WWW.TI.COM
15
33 CURRENT (mA) CURRENT (uA) 1.8 2.3 2.8 VOLTAGE (V) 3.3 3.8 200
32.5
100
32
31.5
22
40
21.6
CURRENT (uA)
1.7
CURRENT (mA)
21
1.6
18
15 -100
-80
-60
-40
-20
16
WWW.TI.COM
50
60
25
40
20
-25 2400
2420
2440
2460
2480
0 2412
2422
2432
2442
2452
2462
2472
2482
50
ACR (dB)
45
60
40
40
35
20
30 -95 -90 -85 -80 -75 -70 -65 -60 CARRIER LEVEL (dBm)
0 2412
2422
2432
2442
2452
2462
2472
2482
INTERFERER FREQUENCY (MHz) INTERFERER REJECTION VS 802.11g CARRIER AT -82dBm/2405MHz 80 INTERFERER REJECTION (dB)
1000
FALSE PACKET RATE AND SENSITIVITY vs CORRELATION THRESHOLD -91 -92 FALSE PACKETS PER MIN. 100 SENSITIVITY (dBm) False packets/min 10 -93 -94 -95 -96 0.1 Sensitivity 0.01 0x0B 0x0F 0x13 0x17 CORRELATION THRESHOLD (MDMCTRL1) -97 -98
60
40
20
0 2412
2422
2432
2442
2452
2462
2472
2482
WWW.TI.COM
17
TEMPERATURE SENSOR OUTPUT VS SUPPLY VOLTAGE (TEMPERATURE = 25C) 0.820 TEMPERATURE SENSOR (V)
0.810
0.800
0.790
0.780
-300 -100 100 300 500
1.8
2.3
3.3
3.8
CORRELATION VALUE VS ERROR VECTOR MAGNITUDE OF INPUT SIGNAL 112 CORRELATION VALUE (decimal) 108 104 100 96 92 0%
-80
-60
-40
-20
10 %
20 %
30 %
40 %
50 %
60 %
70 %
EVM (% RMS)
TEMPERATURE SENSOR OUTPUT VS TEMPERATURE (SUPPLY VOLTAGE = 3V) 1.100 TEMP SENSOR VOLTAGE (V) 1.000 0.900 0.800 0.700 0.600 -40 10 60 TEMPERATURE (C) 110
18
WWW.TI.COM
5.10 Low-Current Mode RX Applications that spend more time waiting for an input signal than actually receiving it, might benefit from using the special low-current RX mode. This mode draws less current at the expense of sensitivity. Note that when using this mode, neither RSSI nor CCA is valid. This means that these settings can not be used in conjunction with STXONCCA, for instance. Also note that the interferer rejection will drop at stronger input signal levels compared to when using the regular recommended settings.
60 INTERFERER REJECTION (dB)
40
20
Important: The low-current RX mode is only valid from -40 to 85C ! 5.10.1 Low-Current RX Mode Parameters
TA =25C, VDD=3.0 V, fc=2440 MHz if nothing else stated. All parameters measured on Texas Instruments CC2520 EM 2.1 reference design with 50 load.
PARAMETER
RX current Sensitivity
CONDITIONS
Wait for sync [2] requires -85 dBm Wanted signal 3 dB above the sensitivity level, 802.15.4 modulated interferer at 802.15.4 channels:
MIN
TYP
18.8 -90
MAX
UNIT
mA dBm
Interferer Rejection
5 MHz from wanted signal. [2] requires 0 dB 10 MHz from wanted signal. [2] requires 30 dB 20MHz or above.
52 54 55
dB dB dB
WWW.TI.COM
19
5.11 Optional Temperature Compensation of TX Using the on-chip temperature sensor (or any other sensor), it is possible to adapt the settings to the actual temperature. This will reduce the variation in output power over temperature, which in the range -40C to 125C can be significant. For this purpose, a TX setting only suited for high-temperature operation has been found (F7125deg). This setting should only be used above 70 degrees, but will significantly reduce the drop in output power at high temperatures. Table 2: F7125deg setting, only suited for high temperature operation (only changes from recommended settings shown)
Register TXCTRL FSCTRL Setting (hex) 94 7B Comment Increased output power at high temperatures. Increased output power at high temperatures.
MINIMUM OUTPUT POWER WITH AND WITHOUT TEMPERATURE COMPENSATION 8.0 4.0 0.0 -4.0 -8.0 -12.0 Without compensation (+5dBm setting) With compensation
0.0
-40
10
60 TEMPERATURE (C)
110
20
WWW.TI.COM
5.11.1 Using the Temperature Sensor The on-chip temperature sensor can be accessed via the GPIO0 and GPIO1 pins by following this procedure: Configure GPIO0 and GPIO1 as inputs by writing 0x80 to the GPIOCTRL0 and GPIOCTRL1 registers. Enable analog output functionality for these two pins by setting GPIOCTRL.GPIO_ACTRL=1. Select temperature sensor output by writing 0x01 to the ATEST register. This will make GPIO1 output GND and GPIO0 will output a voltage proportional to the temperature. Use an ADC in the microcontroller to measure the output voltage on GPIO0 and then calculate the temperature. The output from the temperature sensor is shown in graph form in section 5.9, but as a basis for calculating the temperature, the following numbers can be used:
Tc=-40 125C, VDD=1.8 3.8 V
Parameter Temp sensor voltage at 25C Temp. sens. output vs temperature Temp. sens. output vs supply voltage Temp. sens accuracy no calibration (at fixed voltage) Temp, sens. accuracy with 1-point calibration (at fixed voltage) Min Typ 0.8 25 6 +/-12 +/-1 Max Unit V mV/10C mV/V C C
WWW.TI.COM
21
6
6.1
ESR C0 CL
60 7 16
Ohm pF pF
6.2
PARAMETER Crystal tuning range (Ctune) Crystal tuning step size Crystal tuning drift
In % of applied tuning
CRYSTAL TUNING USING CC2520 EM 2.1 REFERENCE DESIGN (NX3225DA, CL = 16 pF) : Start-up time Crystal tuning step size Crystal tuning range NDK crystal NX3225DA, CL=16 pF
3 -45
CRYSTAL TUNING USING OTHER CRYSTALS, ALL NUMBERS ARE ESTIMATES : Start-up time Crystal tuning step size Crystal tuning range Start-up time Crystal tuning step size Crystal tuning range NDK crystal NX5032SA, CL=10 pF NDK crystal NX4025DA, CL=13 pF
22
WWW.TI.COM
Pinout
24 AVDD_GUARD
26 VREG_EN
27 DCOUPL
25 RESETn
22 AVDD4 21 NC 20 AVDD1 19 RF_N 18 NC 17 RF_P 16 AVDD2 15 NC AVDD3 14 AGND exposed die attached pad
CC2520
23 RBIAS
28 SCLK
WWW.TI.COM
23
AVDD_GUARD DCOUPL
Power supply connection for digital noise isolation and digital voltage regulator. 1.6 V to 2.0 V digital power supply output for decoupling. Note: this pin can not be used to supply any external devices.
DVDD AGND
8 Die pad
24
WWW.TI.COM
8
8.1
Functional Introduction
Integrated 2.4 GHz IEEE 802.15.4 Compliant Radio
CC2520 features a Direct Conversion Transceiver operating in the 2.4 GHz band with excellent receiver sensitivity and robustness to interferers. The CC2520 radio complies with the IEEE 802.15.4 PHY specification. The radio has 250 kbps data rate, 2 Mchip/s chip rate, and is suitable for systems targeting compliance with worldwide radio frequency regulations covered by ETSI EN 300 328 and EN 300 440 class 2 (Europe), FCC CFR47 Part 15 (US) and ARIB STD-T66 (Japan). 8.2 Comparison to CC2420
CC2520 represents significant improvement over the CC2420 features and performance. A comparison is given in the table below. Table 5: Comparison of CC2420 and CC2520
Feature Standard Maximum output power Typical sensitivity General clock output User interface CC2420 IEEE 802.15.4-2003 0 dB -95 dBm No Command strobes and configuration registers. All user control goes through the SPI. CC2520 IEEE 802.15.4-2006 +5 dB -98 dBm Yes, configurable frequency 1-16MHz Instruction set (which includes the command strobes as a subset) and configuration registers. Command strobes may be triggered by GPIO pins, which gives excellent timing control. Improved status information. Only possible when crystal oscillator is running. Schmitt triggers on all digital inputs. Highly flexible and configurable XOSC starts automatically after reset (by reset_n pin). Manual start of XOSC after SRES instruction. 32 MHz Hardware support for non-intrusive sniffing of both transmitted and received frames. 8 MHz 768 byte 1.8 3.8 V 125C Highly flexible security instructions. More RAM available allows more flexible processing. QFN 28 (RHD), 5x5 mm 2394-2507 MHz
Possible without crystal oscillator running. No Schmitt triggers Fixed configuration Manual start of XOSC
Crystal frequency Packet sniffing Maximum SPI clock speed RAM size Operating voltage Maximum operating temperature Security
16 MHz No hardware support 10 MHz 364 byte 2.1 3.6 V 85C Limited flexibility
WWW.TI.COM
25
8.3
Block Diagram
VREG_EN DCOUPL RESETn
SO SI CSn
SPI
Vreg
Clock/ reset
BIAS
Bus controller
Instruction decoder
AGC
FSM
Synthesizer
Demod
Modulator RF_core
Exception controller
RAM
AAF
PS
LPF
RX MIX Atest
FS
TX MIX
PA LNA
RBIAS
SCLK
XOSC
REF DIV
RF_N RF_P
XOSC32M_Q2
Figure 2: CC2520 block diagram CC2520 is typically controlled by a microcontroller connected to the SPI and some GPIOs. The microcontroller will send instructions to CC2520 and it is the responsibility of the instruction decoder to execute the instructions or pass them on to other modules. The execution of an instruction or external events (e.g. reception of a frame) may result in one or more exceptions. The exceptions provide a very flexible mechanism for automating tasks. They can for instance be used to trigger execution of other instructions or they can be routed out to GPIO pins and used as interrupt signals to the microcontroller. The exception controller is responsible for handling of the exceptions.
26
XOSC32M_Q1
WWW.TI.COM
GPIO1
GPIO0
The microcontroller will typically be connected to one or more of the GPIO pins. The function of each pin is independently controlled by the IO module based on register settings. It is possible to observe a large number of internal signals on the GPIO pins. The GPIO pins can also be configured as inputs and used to trigger the execution of certain instructions. This would typically be used when the microcontroller needs to precisely control the timing of an instruction. The RAM module contains memory which is used for receive and transmit FIFOs (in fixed address ranges) and temporary storage for other data. There are separate instructions for general memory access and FIFO access. The data processing unit (DPU) is responsible for execution of the more advanced instructions. The DPU includes an AES core, which is used while executing the security instructions. Memory management (copying, incrementing etc.) is also performed by the DPU. The Clock/Reset module generates the internal clocks and reset signals. The RF core contains several submodules that support and control the analog radio modules. The FSM submodule controls the RF transceiver state, the transmitter and receiver FIFOs and most of the dynamically controlled analog signals such as power up / down of analog modules. The FSM is used to provide the correct sequencing of events (such as performing an FS calibration before enabling the receiver). Also, it provides step by step processing of incoming frames from the demodulator: reading the frame length, counting the number of bytes received, checks the FCS, and finally, optionally handles automatic transmission of ACK frames after successful frame reception. It performs similar tasks in TX including performing an optional CCA before transmission and automatically going to RX after the end of transmission to receive an ACK frame. Finally, the FSM controls the transfer of data between modulator/demodulator and the TXFIFO/RXFIFO in RAM. The modulator transforms raw data into I/Q signals to the transmitter DAC. This is done in compliance with the IEEE 802.15.4 standard. The demodulator is responsible for retrieving the sent data from the received signal. The amplitude information from the demodulator is used by the automatic gain control (AGC). The AGC adjusts the gain of the analog LNA so that the signal level within the receiver is approximately constant.. The frame filtering and source matching supports the FSM in RF_core by performing all operations needed in order to do frame filtering and source address matching, as defined by IEEE 802.15.4. The xosc module interfaces the crystal which is connected to the XOSC32M_Q1 and XOSC32M_Q2 pins. The xosc module generates a clock for the digital part and RF system, and implements the programmable crystal frequency tuning. The BIAS module generates voltage and current references. It relies on a high precision (1%) 56k external resistor which is shown in the application circuit in Figure 3. The TX DACs convert the digital baseband signal to analog signals. After LPF the signal is fed to the TXMIX module, which is an up-converting complex mixer. The PA amplifies the RF signal up to a maximum of ~5dBm during TX. The LNA amplifies the received RF signal. The gain is controlled by the digital AGC module so that optimum sensitivity and interferer rejection is achieved. The RXMIX module is a complex down-mixer that converts the RF signal to a baseband signal. A passive anti-aliasing filter (AAF) low pass filters the signal after down mixing. The low pass filtered I and Q signals and digitized by the ADC.
WWW.TI.COM
27
The frequency synthesizer (FS) generates the carrier wave for the RF signal. The voltage regulator (Vreg) provides a 1.8V supply voltage to the digital core. It contains a current limiter, which is enabled for currents above ~32mA.
28
WWW.TI.COM
Application Circuit
Very few external components are required for the operation of CC2520. A typical application circuit is shown in Figure 4. Note that it does not show how the board layout should be done. The board layout will greatly influence the RF performance of CC2520. This section is meant as an introduction only. For further details, see the reference design, which includes complete board layouts and bill of materials with manufacturer and part numbers. The reference design can be downloaded from the CC2520 product folder [7]. Note that decoupling capacitors are not shown in the figure below. See the reference design for complete bill of materials.
SCLK 28
DCOUPL 27
VREG_EN 26
RESETn 25
AVDD_GUARD 24
RBIAS 23 13 XOSC32M_Q1
Digital interface
12 XOSC32M_Q2
11 AVDD5
Figure 3: Typical application circuit with transmission line balun for single-ended operation See the antenna selection guide [12] for further details on other compact and low-cost alternatives. 9.1 Input / Output Matching
The RF input/output is high impedance and differential. When using an unbalanced antenna such as a monopole, a balun should be used in order to optimize performance. The balun can be implemented using low-cost discrete inductors and capacitors only or in combination with transmission lines replacing the discrete inductors. Figure 4 shows the balun implemented in a two-layer reference design. It consists of three transmission lines (L1, L2 and L3) and the discrete components C191, C171, C192, C173 and C174. The circuit will present the optimum RF termination to CC2520 with a 50 load on the antenna connection.
14 AVDD3
9 GPIO1
10 GPIO0
8 DVDD
AVDD4 22
WWW.TI.COM
29
SMA connector
C172
Figure 4: Actual board layout of the RF section of the reference design (rev 2.1).
9.2
Bias Resistor
The bias resistor R231 is used to set an accurate bias current. A high precision (1%) 56k resistor should be used. 9.3 Crystal
An external 32MHz crystal with two loading capacitors (C121 and C131) is used for the crystal oscillator. It is possible to feed a single-ended signal to the XOSC32M_Q1 pin and thus not use a crystal. 9.4 Digital Voltage Regulator
The on chip voltage regulator supplies 1.8 V to the digital part of CC2520. C271 is a decoupling capacitor for the voltage regulator. Note that this should not be used to provide power to other ICs. 9.5 Power Supply Decoupling and Filtering
Proper power supply decoupling must be used for optimum performance. This is shown as a lumped capacitor C1 in Figure 4. The placement and size of the decoupling capacitors and the power supply filtering are very important to achieve the best performance in an application. TI provides a compact reference design that should be followed very closely. 9.6 Board Layout Guidelines
It is highly recommended to copy the board layout from the reference design [5]. It is recommended to use star topology for the power supplies to CC2520. The power supply decoupling capacitor C1 is a lumped component. On the actual board layout there should be separate decoupling capacitors as close to each of the power pins as possible. The balun is highly layout sensitive. The inductors in Figure 4 are actually transmission lines embedded in the PCB and their values must be adapted according to the board layout. The values of the capacitors C192, C172, C173 and C174 must also be adapted to the actual board layout. The GPIO pins can be configured to use internal pull-up resistors. They are not enabled after a reset or in LPM2. Remember to take the default GPIO configuration into consideration when connecting these signals, because there will be some time before the MCU is able to change the configuration. In LPM2 GPIO5 (which is configured as an input) should be connected to either
30
WWW.TI.COM
ground or VDD. The other GPIO pins should be grounded or high impedance. Failing to do this, will result in significantly higher current consumption than necessary. The SO pin is configured as an input when CSn is high or the device is in reset or LPM2. This makes it possible to connect multiple SPI slaves to one SPI master. This pin should not be left floating when in LPM2, as this will draw more current than necessary. If the voltage level can not be controlled in any other way, use a 1MOhm pull-down resistor. The crystal input lines should be routed as far away from each other as practically possible. The NC pins can be left floating. Glitches on the digital inputs may create serious issues in a system design. The digital input pads have Schmitt-triggers to help make them less sensitive to glitches, but the board layout should still avoid routing the digital input lines close to other noisy signals.
9.7
Antenna Considerations
The reference design contains two antenna options. As default, the SMA connector is connected to the balun through a 0 resistor. This resistor can be soldered off and rotated 90 clockwise in order to connect to the PCB antenna, which is a planar inverted F antenna (PIFA). Note that all testing and characterization has been done using the SMA connector. The PCB antenna has only been functionally tested by establishing a link between two EMs. In our experiment, the PCB antenna gave approximately the same range as when using an antenna connected to the SMA connector. Please refer to the antenna selection guide [12] and the Inverted F antenna app note [11] for further details.
9.8
Choosing the Most Suitable Interconnection with a Microcontroller Connect the 4 SPI signals; CSn, SCLK, SI and SO to the microcontroller. These signals are required in order to configure CC2520 and exchange data with it. Connect RESETn to the microcontroller. Using the RESETn signal is the recommended way to reset CC2520 for instance after powering up. If saving a pin is critical, the RESETn pin can be connected to VDD. The CC2520 can still be reset with the SRES command strobe. This will also require a manual start of the crystal oscillator by issuing a SXOSCON command strobe. Connecting VREG_EN to the microcontroller will make it possible to put CC2520 into LPM2 to save power. VREG_EN may be connected to VDD and thus always leave the regulator on. If power saving is not important in the target application, this may be an acceptable way of saving a pin. Connecting one or more of the GPIOs to the microcontroller is optional. The number of GPIOs to connect depends on the application. Connecting more GPIOs to the microcontroller generally gives more flexibility and less SPI traffic because it reduces the need to keep reconfiguring the GPIOs for different uses. If CC2520 will be providing clock to the microcontroller, GPIO0 should be connected to the clock input of the microcontroller. After reset, GPIO0 will output a 1MHz clock signal with 50/50 duty cycle.
9.9
The MSP430F2618 is well suited for use with the CC2520. The suggested interfacing of these two chips is given in Table 5. The interconnections shown in Table 6 are exactly the same as is used in the CC2520 development kit [5].
WWW.TI.COM
31
A simplified drawing of the interconnection of MSP430F2618 and CC2520 is shown in Figure 8. For further details on the MSP430F2618, please refer to [10].
RESETn VREG_EN
4 SPI 6 GPIO
32
WWW.TI.COM
10.1 CSn CSn is an input enable signal for the SPI and is controlled by the external MCU. The CSn signal is used as an asynchronous active high reset to the SPI module. CSn must be held low during all SPI operations and must also be held low for more than two periods of XOSC before the first positive edge of SCLK and more than two periods of XOSC after the last negative edge of SCLK. When CSn is high it must be held high for at least 2 periods of XOSC. CSn can be held low between SPI operations in the case where the last instruction completed has a constant number of bytes, but this will result in unnecessary power consumption since parts of the instruction controller will then be running. The instructions that have a constant number of bytes can be found in the instruction summary table in section 15.3. I.e. SRXON (1 byte) and RXMASKAND (3 bytes) has constant number of bytes and REGRD (2 bytes or more) has user controlled number of bytes indicated in the table by three dots () in the byte column after the last required byte of the instruction command (Byte 3 for REGRD). Instructions that have user controlled number of bytes are ended by rising CSn. Status is output as the first byte on SO during the first byte of all instructions. When instructions are transferred consecutively without rising CSn between them, the status byte on SO may not contain the correct current status. However, the status will be updated for the second byte of an instruction so i.e RXMASKAND which outputs status also during the second instruction byte will then output the correct status during the second byte. When pulling CSn low after power-up, SO outputs the internal XOSC stable signal combinatorically, so no edge on SCLK is necessary to find the XOSC stable status. In any case where CSn is pulled low and SO is low it means that XOSC is still not stable and thus there is no clock in the digital part. The maximum time from power up to XOSC should be stable is described in section 5.3.
10.2 SCLK SCLK is controlled by an external MCU and is an input clock to CC2520. SCLK is asynchronous to the internal XOSC clock in CC2520. The maximum SCLK frequency is 8 MHz. There is no minimum frequency requirement.
10.3 SI SI is the serial data input from the microcontroller to CC2520. Data shall be sent with MSB first (bit 7 in each byte of instruction commands). Data should be set up on the negative edge of SCLK and will be clocked into CC2520 by the next positive edge of SCLK.
WWW.TI.COM
33
10.4 SO SO is serial data out from CC2520 to an external MCU. Data is clocked out on the negative edge of SCLK, so the SO signal should be sampled on the following rising edge of SCLK. MSB (bit 7 in register definitions) will be clocked out first. SO is configured as an input when CSn is high or RESETn is low. Note that the SO pin should not be left floating while in LPM1 or LPM2, as this will result in higher current consumption than necessary.
tsclkh
tsclkl
Figure 6: SPI timing relationships The following table and figure shows required timing relations between an external microcontroller and the SPI interface on CC2520. Table 7: SPI timing requirements
PARAMETER tcscks tcsckh tcsnh tsclk tsclkh tsclkl tsis tsih tsod DESCRIPTION CSn to SCLK setup time SCLK to CSn hold time CSn high SCLK period SCLK high time SCLK low time SI to SCLK setup time SI to SCLK hold time SCLK to SO delay MIN 62.5 62.5 62.5 125 62.5 62.5 31 31 31 TYP MAX UNIT ns ns ns ns ns ns ns ns ns
34
WWW.TI.COM
11 GPIO
CC2520 has 6 GPIO pins that can be individually configured as inputs, outputs and activate pull-up resistors. Each GPIO has an associated register, GPIOCTRLn, where the MSB configure the pin to either input or output. The GPIOCTRL register control pull-up for each individual GPIO pin, extra drive strength for all pins and analog function for pin 0 and 1. See section 30 for details about test functionality and observability through GPIO. Note that GPIO5, which is configured as an input in LPM2, should be tied either to ground or VDD when entering LPM2. If GPIO5 (or any other input) is left floating, the current consumption will be unpredictable.
11.1 Reset Configuration of GPIO Pins The reset setting for GPIO pins are as shown in the table below. This is also the configuration that is used when the device is in LPM2. If a different GPIO setup is required, the GPIOs have to be re-configured every time CC2520 has been in LPM2. This particular reset configuration was selected so that CC2520 looks as much like CC2420 as possible. Table 8: GPIO reset state
GPIO Dir pin 0 1 2 Out Out Out Value Pull up 0 0 0 No No No Extra drive No No No Polarity Positive Positive Positive Signal clock fifo fifop GPIOCTRLn value (hex) 0x00 0x27 0x28 Description 1MHz clock signal with 50/50 duty cycle. High when one or more bytes are in the RX FIFO. Low during RX FIFO overflow. High when the number of bytes in the RX FIFO exceeds the programmable threshold or at least one complete frame is in the RX FIFO. Also high during RX FIFO overflow. Clear channel assessment. See FSMSTAT1 register for details on how to configure the behavior of this signal. Pin is high when SFD has been received or transmitted. Cleared when leaving RX/TX respectively. No function
Out
No
No
Positive
cca
0x29
Out
No
No
Positive
sfd
0x2A
In
No
Positive
0x90
11.2 GPIO as Input When configured as input, the GPIO pin can be used to trigger one of 16 different command strobes (See section 15) as shown in the GPIO configuration table in section 12.6. These command strobes are a subset of all the SPI instructions available. The command strobe is triggered by applying a rising or falling edge to the GPIO pin depending on the setting in the GPIOPOLARITY register. Which command strobe the pin triggers is set by the 7 LSBs in GPIOCTRLn. Example: Set up GPIO2 to run SACK instruction on rising edge. Set GPIOPOLARITY[2] to 1. GPIO pin 2 set to rising edge active. Set GPOICTRL2[7:0] to 1000 0101 . GPIO pin 2 is now an input and connected to the SACK instruction.
WWW.TI.COM
35
11.3 GPIO as Output When a GPIO pin is configured as an output, the signal corresponding to the CTRLn setting in GPIOCTRLn register (CTRLn values are shown in Table 8 in section 12.6). The polarity of the pin is set in the GPIOPOLARITY register. Example: Set up GPIO3 to output sniff_data with active high level indication. Set GPIOPOLARITY[3] to 1. GPIO pin 3 set to active high level indication. Set GPIOCTRL3[7:0] to 0011 0010. GPIO pin 3 is now an output and outputs sniff_data.
11.4 Switching Direction on GPIO When switching from output to input, care must be taken so that command strobes are not triggered unintentionally. Changing GPIOn to a command strobe triggering input (one of the first 16 entries in Table 8) needs to be done using the following procedure to avoid changing direction while the pin is high: 1. Write 0x7E to GPIOCTRLn to make it output a constant 0. 2. Drive a 0 from the microcontroller to the GPIO pin. 3. Write for instance 0x88 to GPIOCTRLn to change to input that triggers the STXON command strobe.
11.5 GPIO Configuration Table 8 summarizes the signals that are available as output on any GPIO pin. The CTRLn column shows the configuration value that needs to be written to any one of the GPIOCTRL0-GPIOCTRL5 registers in order to get the described functionality. The IN column in Table 8 shows which command strobe that will be executed if the GPIO is configured as input and an edge (with the correct polarity) is applied. The OUT column shows the name of the internal signal that is observable on the pin if the GPIO is configured as an output.
36
WWW.TI.COM
WWW.TI.COM
37
Complementary exception channel A Complementary exception channel B Predefined exception channel for RX related errors.
0x26
0x27 0x28
0x29 0x2A
cca sfd
rand_i rand_q rand_xor_ i_q sniff_clk sniff_data mod_serial_clk mod_serial_data Reserved rx_active
Indicates that FFCTRL is in one of the RX states. Active high. Note: This signal might have glitches, because it has no output flip-flop and is based on the current state register of the FFCTRL FSM.
0x44
tx_active
Indicates that FFCTRL is in one of the TX states. Active high. Note: This signal might have glitches, because it has no output flip-flop and is based on the current state register of the FFCTRL FSM.
Reserved dpu_core_activepri(0) dpu_core_activepri(1) High when the DPU is busy processing a low priority thread. High when the DPU is busy processing a high priority thread.
38
WWW.TI.COM
WWW.TI.COM
39
12 Power Modes
CC2520 has three power modes as described below. In all these power modes the supply voltage is applied to the circuit. In Low Power Mode 2 (LPM2) the digital voltage regulator is turned off (VREG_EN=0) and no clocks are running. No data is retained. All analog modules are in power down state. In Low Power Mode 1 (LPM1) the digital voltage regulator is on (VREG_EN=1), but no clocks are running. Data is retained. The power down signals to the analog modules are controlled by the digital part. In Active mode the digital voltage regulator is on (VREG_EN=1) and the crystal oscillator clock is running. The power down signals to the analog modules are controlled by the digital part.
12.1 Switching Between Power Modes When the device has been in LPM2, all register content is lost. To bring the device up to active mode, a reset is required or the device will be in an unknown state. The reset can be applied either by setting the RESETn pin low, or issuing a reset instruction (SRES) over the SPI. It is recommended that the RESETn method is used, because it will give a controlled start and automatic start of the crystal oscillator. Before entering LPM2, it is strongly recommended that the device is reset. This way, the configuration will always be the same when the power to the digital part is removed, and it is less likely that there will be issues with current spikes or other side effects of the power being removed.
Set RESETn=1 Set VREG_EN=1 Wait until regulator has stabilized. Use a timeout.
LPM2
Set RESETn=0 Set VREG_EN=1 Set VREG_EN=0 Set GPIO5=0 Wait until regulator has stabilized. Use a timeout. Set RESETn=1 Set CSn=0 SRES
SXOSCON SNOP
SRES
Set CSn=0
Set CSn=1
LPM1
SXOSCON SNOP
SXOSCOFF (Radio must be idle) Set CSn=0 and wait until SO=1
Active mode
Set CSn=1
40
WWW.TI.COM
12.2 Power Up Sequence Using RESETn (recommended) When the RESETn pin is used it must be held low until the internal regulator has stabilized. This typically takes 0.1 ms. When the RESETn pin is set high, the crystal oscillator (in the CC2520 reference design) uses typically 0.2 ms to start. See section 6 for crystal specific parameters. The GPIO pins are configured according to Table 8: GPIO reset state when power is applied to the chip and RESETn is held low.
VDD VREG_EN
I I Tdres
I O I I [5..0] IO Txr
Internal XOSC SO
O O
Figure 8: Power up sequence using RESETn 12.3 Power Up With SRES If one prefers to use the SRES command strobe to reset the device after powering up, the CSn signal must be set low and SRES must be issued after the internal regulator has stabilized. Until the SRES command strobe has been issued, the chip will be in an unknown state. Note that this means it could theoretically for instance be transmitting. The time from power is applied to the XOSC has started depends on the clock frequency used on the SPI (max 8MHz) and the startup time for the crystal. Note that the crystal oscillator does not necessarily start automatically when the SRES command strobe is issued. That means one also has to issue an SXOSCON command strobe to be sure that the oscillator starts. Unlike the RESETn pin, the SRES command strobe will not influence the state of the crystal oscillator, so if the oscillator accidentally comes up in the off state, issuing a SRES will not make it start.
VDD VREG_EN RESETn I I I Tdres CSn SCLK SI GPIO O I I [5..0] IO Txr SRES B0 SRES B1 SXOSCON SNOP
Internal XOSC SO
WWW.TI.COM
41
42
WWW.TI.COM
13 Instruction Set
The CC2520 has a comprehensive instruction set. The instructions are transferred to CC2520 via the SPI, and can consist of one or more bytes. The first byte contains the unique op-code and the following bytes are parameters needed to execute the selected instruction. In the following sections, every instruction and parameter is described in detail.
13.1 Definitions All parameters and data are transferred over the SPI with their most significant bit first and their least significant bit last. For instructions that read data from CC2520, the data byte will replace the status byte on the SO pin. Address parameters point to the least significant byte in a block of data. The address A+1 contains the next but least significant byte and so on. When CC2520 automatically increments addresses, it will wrap around when incrementing beyond the highest possible address (0xFFF). An instruction is ended by either sending the complete instruction (for finite instructions) or raising CSn (For infinite instructions, indicated by ... in the instructions summary). Once an instruction is ended a new instruction can be started. If an instruction is ended before it is complete or if the instruction is not recognized, an OPERAND_ERROR exception is raised. If the user sets parameter bits explicitly marked as 0 in instruction summary table to 1 an OPERAND_ERROR exception is raised. When an instruction is aborted an error exception is raised and the SPI interface ceases to receive further data until CSn has been set high then low again. The instruction that was aborted may have made changes to memory contents before it was aborted. If the SPI interface is reset (by pulling CSn high) in the middle of an SPI byte transfer (i.e. not between bytes) an SPI_ERROR exception is raised.
13.2 Instruction Descriptions The codes shown below are used in the descriptions of the instructions. They represent bits selectable by the user. A sequence of bits thus represented by the same letter, even when spanning multiple bytes represents a word with a width equal to the number of repeated letters and with MSB the leftmost bit in the first byte transferred with this encoding. Such words may be represented in the text as a capital letter of the encoding letter in which case they shall be interpreted as a positive integer encoded by the bits represented in the encoding by the same letter only in lower-case. Note that the bits that refer to one such integer need not be continuous in the encoding. So the encoding aaaaeeee aaaaaaaa eeeeeeee represents two 12 bit words transferred in three bytes with the most significant bits of each word transferred in the first byte. Table 11: Codes used in instruction set description
Code a, e, k, n b i d s p m c, f Description Address data Bit address Instruction Data Status byte Priority Security parameter Count Dont care
WWW.TI.COM
43
44
WWW.TI.COM
BCLR
a[7:3] b[2:0]
s[7:0]
MEMADDR_ERROR
MEMRD
a[11:0]
MEMADDR_ERROR
MEMWR
MEMADDR_ERROR
REGRD
a[5:0]
WWW.TI.COM
45
MEMXWR
MEMADDR_ERROR
46
WWW.TI.COM
The SPI interface will output the number of bytes, C, in TXBUF. The priority of the instruction is defined by P, which is either low (if P=0) or high (if P=1). If TXBUF fills before the operation is completed a TX_OVERFLOW exception is raised. The remaining bytes to be moved is available in status register. A DPU_DONE_L or DPU_DONE_H exception is raised when the operation completes, depending on the priority of the instruction. This happens regardless of whether the operation was successful or not. A USAGE_ERROR exception is raised if an instruction is already active with the requested priority level (high or low).
MEMCP
s[7:0]
Copy data from one memory block to another. Copies the block of C bytes of data from the memory location starting at address A to the memory location starting at address E. The priority of the instruction is defined by P, which is either low (if P=0) or high (if P=1). A DPU_DONE_L or DPU_DONE_H exception is raised when the operation completes, depending on the priority of the instruction. This happens regardless of whether the operation was successful or not. A USAGE_ERROR exception is raised if an instruction is already active with the requested priority level (high or low).
MEMCPR
s[7:0]
Copy data from one memory block to another, and revert endianess. Copies the block of C bytes of data from the memory location starting at address A to the memory location starting at address E, while reverting the endianess of the data block. I.e., data from memory location (A+n) is written to memory location (E+C-1-n). The priority of the instruction is defined by P, which is either low (if P=0) or high (if P=1). A DPU_DONE_L or DPU_DONE_H exception is raised when the operation completes, depending on the priority of the instruction. This happens regardless of whether the operation was successful or not. A USAGE_ERROR exception is raised if an instruction is already active with the requested priority level (high or low).
MEMXCP
s[7:0]
XOR one memory block with another memory block. The input to the instruction are two memory blocks, both of size C bytes, starting at address A and E respectively. The output is the bitwise XOR of the two memory blocks, written to the memory location starting at address E. The priority of the instruction is defined by P, which is either low (if P=0) or high (if P=1). A DPU_DONE_L or DPU_DONE_H exception is raised when the operation completes, depending on the priority of the instruction. This happens regardless of whether the operation was successful or not. A USAGE_ERROR exception is raised if an instruction is already active with the requested priority level (high or low).
WWW.TI.COM
47
Possible exceptions
48
WWW.TI.COM
CBCMAC
s[7:0]
Authentication instruction using CBC-MAC security. Process C bytes of plaintext starting at address A, using the key stored at address (16K), storing the output starting at address E.
T T
The priority of the instruction is defined by P, which is either low (if P=0) or high (if P=1). If the destination address E provided in the instruction equals zero, the destination address E is set equal to (A + C), thereby writing the output directly following the plaintext input data. The output is 4, 8, or 16 bytes of integrity code for instructions M[1:0] equals 1, 2, or 3 respectively. For M[1:0]=0, no integrity code output is generated. If M[2]=0, the plaintext data to be authenticated is automatically prefixed with C, as used in IEEE 802.15.42003. If M[2]=1, the plaintext data is not prefixed with C. This mode can be used for backwards compatibility with existing systems. A USAGE_ERROR exception is raised if an instruction is already active with the requested priority level (high or low). A DPU_DONE_L or DPU_DONE_H exception is raised when the operation completes, depending on the priority of the instruction. This happens regardless of whether the operation was successful or not.
WWW.TI.COM
49
50
WWW.TI.COM
The priority of the instruction is defined by P, which is either low (if P=0) or high (if P=1). The output is C plaintext bytes. Note that for the authentication part of the instruction to succed, these bytes should be written back to the address the ciphertext was read from (A+F). This can easily be done by setting E=0x000. In addition, the instruction generates 0, 4, 8, or 16 bytes of encrypted integrity code (for M equals 0, 1, 2 or 3 respectively) and compares them to the stored integrity code at address (A+C+F). The result (pass / fail) is stored in the AUTHSH / AUTHSL status bits for high / low priority security operations respectively. A USAGE_ERROR exception is raised if an instruction is already active with the requested priority level (high or low). A USAGE_ERROR exception is also raised if ((C+F) > 128). A DPU_DONE_L or DPU_DONE_H exception is raised when the operation completes, depending on the priority of the instruction. This happens regardless of whether the operation was successful or not. Other
ABORT
c[1:0]
s[7:0]
Abort ongoing data management or security instruction. c[1]=1: Abort high priority data management or security instructions c[0]=1: Abort low priority data management or security instructions c[1]=0: Dont abort high priority data management or security instructions c[0]=0: Dont abort low priority data management or security instructions Once a class of instructions is aborted, the ongoing instruction is immediately ended leaving the device state as it is at that time. Any pending data management instructions are flushed.
SRES
s[7:0]
Reset the device except the SPI interface. This instruction can only be run as the first instruction after CSn has been pulled low.
13.3 Instruction Set Summary A summary of the CC2520 instruction set with op-codes is shown in the table below.
WWW.TI.COM
51
Pin SI SO IBUFLD SI SO SIBUFEX SI SO SSAMPLECCA SI SO SRES SI SO MEMRD SI SO MEMWR SI SO RXBUF SI SO RXBUFCP SI SO RXBUFMOV SI SO TXBUF SI SO TXBUFCP SI SO RANDOM SI SO SXOSCON SI SO STXCAL SI SO SRXON SI SO STXON SI SO STXONCCA SI SO SRFOFF SI SO SXOSCOFF SI SO SFLUSHRX SI SO SFLUSHTX SI SO SACK SI SO SACKPEND SI SO SNACK SI SO SRXMASKBITSET SI SO SRXMASKBITCLR SI SO RXMASKAND SI SO RXMASKOR SI SO MEMCP SI SO MEMCPR SI SO MEMXCP SI SO MEMXWR SI SO BCLR SI SO BSET SI SO CTR / UCTR SI SO CBCMAC SI SO UCBCMAC SI SO CCM SI SO UCCM SI SO ECB SI SO ECBO SI SO ECBX SI SO INC SI SO ABORT SI SO REGRD SI SO REGWR SI SO
Mnemonic SNOP
3 0 s 0 s 0 s 0 s 1 s a s a s 0 s 1 s 0 s 1 s 1 s 1 s 0 s 0 s 0 s 0 s 0 s 0 s 0 s 0 s 1 s 1 s 1 s 1 s 1 s 1 s 1 s 1 s 0 s 0 s 0 s 0 s 1 s 1 s 0 s 0 s 0 s 1 s 1 s 0 s 0 s 0 s 1 s 1 s a s a s
2 0 s 0 s 0 s 1 s 1 s a s a s 0 s 0 s 0 s 0 s 1 s 1 s 0 s 0 s 0 s 0 s 1 s 1 s 1 s 1 s 0 s 0 s 0 s 0 s 1 s 1 s 1 s 1 s 0 s 0 s 1 s 1 s 0 s 0 s 0 s 1 s 1 s 0 s 0 s 0 s 0 s 1 s 0 s 1 s a s a s
1 0 s 1 s 1 s 0 s 1 s a s a s 0 s 0 s 1 s 1 s 1 s 0 s 0 s 0 s 1 s 1 s 0 s 0 s 1 s 1 s 0 s 0 s 1 s 1 s 0 s 0 s 1 s 1 s 0 s 1 s 0 s 1 s 0 s 0 s 0 s 0 s 1 s 0 s 1 s 0 s 1 s 0 s 0 s 1 s a s a s
0 0 s 0 s 1 s 0 s 1 s a s a s 0 s 0 s p s 0 s p s 0 s 0 s 1 s 0 s 1 s 0 s 1 s 0 s 1 s 0 s 1 s 0 s 1 s 0 s 1 s 0 s 1 s p s p s p s 0 s 0 s 1 s p s p s p s p s p s p s p s p s p s 1 s a s a s
i i i i i i i i s s s s s s s s
s a s a s d 0 c c c d c c c -
s a s a s d 0 c c c d c c c -
s a s a s d 0 c c c d c c c -
s a s a s d 0 c c c d c c c -
s a s a s d a c c c d c c c -
s a s a s d a c c c d c c c -
s a s a s d a c c c d c c c -
s a s a s d a c c c d c c c -
- d d d d d d ... ... a a s s 0 0 s s d d s s 0 0 s s - d d
d d d
d d d
d d d
d d d
d d d
d d d
a s 0 s d s 0 s d
a s 0 s d s 0 s d
a s a s d s a s d
a s a s d s a s d
a s a s d s a s d
a s a s d s a s d
d a s
d a s
d a s
d a s
d a s
- ... d ... a s
a a a a a a s s s s s s
d s d s c s c s c s 0 s a s a s k s k s k s k s k s k s k s k s 0 s 0 s d d d
d s d s c s c s c s 0 s a s a s k s k s k s k s k s k s k s k s 0 s 0 s d d d
d s d s c s c s c s 0 s a s a s k s k s k s k s k s k s k s k s c s 0 s d d d
d s d s c s c s c s 0 s a s a s k s k s k s k s k s k s k s k s c s 0 s d d d
d s d s c s c s c s a s a s a s k s k s k s k s k s k s k s k s a s 0 s d d d
d s d s c s c s c s a s b s b s k s k s k s k s k s k s k s k s a s 0 s d d d
d s d s c s c s c s a s b s b s k s k s k s k s k s k s k s k s a s c s d d d
d s d s c s c s c s a s b s b s k s k s k s k s k s k s k s k s a s c s d d d
d s d s a s a s a s a s
d s d s a s a s a s a s
d s d s a s a s a s a s
d s d s a s a s a s a s
d s d s e s e s e s a s
d s d s e s e s e s a s
d s d s e s e s e s a s
d s d s e s e s e s a s
a s a s a s d d
a s a s a s d d
a s a s a s d d
a s a s a s d d
a s a s a s d d
a s a s a s d d
a s a s a s d d
a s a s a s d d
e e s s e e s s e e s s ... ...
e s e s e s
e s e s e s
e s e s e s
e s e s e s
e s e s e s
e s e s e s
0 s 0 s 0 s 0 s 0 s c s c s c s a s
c s c s c s c s c s c s c s c s a s
c s c s c s c s c s c s c s c s a s
c s c s c s c s c s c s c s c s a s
c s c s c s c s c s a s a s a s a s
c s c s c s c s c s a s a s a s a s
c s c s c s c s c s a s a s a s a s
c s c s c s c s c s a s a s a s a s
n s a s 0 s n s n s a s a s a s
n s a s 0 s n s n s a s a s a s
n s a s 0 s n s n s a s a s a s
n s a s 0 s n s n s a s a s a s
n s e s a s n s n s a s a s a s
n s e s a s n s n s a s a s a s
n s e s a s n s n s a s a s a s
n s e s a s n s n s a s a s a s
a s a s a s a s a s 0 s
a s a s a s a s a s 0 s
a s a s a s a s a s 0 s
a s a s a s a s a s 0 s
e s a s a s e s e s e s
e s a s a s e s e s e s
e s a s a s e s e s e s
e s a s a s e s e s e s
a s e s 0 s a s a s e s
a s e s 0 s a s a s e s
a s e s 0 s a s a s e s
a s e s 0 s a s a s e s
a s e s 0 s a s a s e s
a a a e s s s s e e e 0 s s s s mmm s s s a a a e s s s s a a a e s s s s e e e s s s
e s 0 s
e s 0 s
e s 0 s
e s 0 s
e e e s s s mmm s s s
e s e s
e s e s
e s e s
e s e s
e s e s
e s e s
e s e s
0 s 0 s
f s f s
f s f s
f s f s
f s f s
f s f s
f s f s
f s f s
0 s 0 s
0 s 0 s
0 s 0 s
0 s 0 s
0 s 0 s
0 s 0 s
mm s s mm s s
0 0 0 0e e e e e e e e e e e e s s s s s s s s s s s s s s s s
52
WWW.TI.COM
13.4 Status Byte All instructions sent over the SPI to CC2520 result in a status byte being output on SO when the first byte of the instruction is clocked in on SI. The status byte is latched internally when a falling edge is detected on CSn and on the last falling edge of SCLK within each byte. The latched status value is then shifted out on the following falling SCLK edges. The SNOP instruction can be used to read the status byte without causing any side effects. Table 13: Status byte contents
Status byte (MSB clocked out first) Bit no 7 6 5 Signal XOSC stable and running RSSI valid EXCEPTION channel A Description 0: XOSC off or not yet stable 1: XOSC stable and running (Digital part has clock) 0: RSSI value is not valid 1: RSSI value is valid 0: No exceptions selected in EXCMASKAn has corresponding flag in EXCFLAGn set 1: At least one exception selected in EXCMASKAn has corresponding flag EXCFLAGn set 0: No exceptions selected in EXCMASKBn has corresponding flag in EXCFLAGn set 1: At least one exception selected in EXCMASKBn has corresponding flag EXCFLAGn set 0: No high priority DPU instruction is currently active. 1: A high priority DPU instruction is currently active. 0: No low priority DPU instruction is currently active. 1: A low priority DPU instruction is currently active. 0: Device is not in TX mode 1: Device is in TX mode 0: Device is not in RX mode 1: Device is in RX mode
EXCEPTION channel B
3 2 1 0
13.5 Command Strobes Most of the instructions in section 15.3 that are only one byte long are referred to as command strobes. There are two exceptions to this: SNOP and SXOSCON. SNOP is used to read the status byte without causing any side effects. SXOSCON turns on the crystal oscillator and must be run via the SPI. It is not possible to load SXOSCON into the instruction buffer using IBUFLD and then execute it using IBUFEX. The command strobes can be executed by configuring GPIO pins as input in accordance to GPIO configuration table in section 12.6 and be triggered with a selected edge in the GPIOPOLARITY register. Thus SPI traffic can be omitted for command strobes. There are also two channels, X and Y, for binding exceptions to the command strobes, so that CC2520 may automatically react to different internal events. This feature is described in more detail in section 16.1.
13.6 Command Strobe Buffer The command strobe buffer provides another mechanism for execution of command strobes. The buffer is loaded with the help of the IBUFLD instruction sent via SPI. Once the buffer is loaded, the instruction is executed when CC2520 receives the SIBUFX strobe. The SIBUFX strobe can be triggered from any of the triggering sources (SPI, GPIO, exceptions bound to SIBUFX instruction). When the instruction in the instruction buffer has been executed, it is replaced by a SNOP instruction. If both the SIBUFEX strobe and
WWW.TI.COM
53
the IBUFLD instruction are received at the same time, the old command strobe is executed. The new strobe that the user tried to write to the buffer is lost and will never be executed.
54
WWW.TI.COM
14 Exceptions
Exceptions in CC2520 are used to indicate that different events have occurred. Exceptions are used both for error conditions such as incorrect use of the SPI and for events that are perfectly normal and expected such as transmission of a start of frame delimiter (SFD). Exception flags are stored in status registers and can be read over the SPI or observed on GPIO. To clear an exception flag, the user must write 0 to the correct bit in the status register. If the user tries to clear an exception flag in the exact same clock period as the same exception occurs, the flag will not be cleared. Table 14 shows a summary of the available exceptions in CC2520. The NUM column shows how the exceptions are numbered. The number correspond to the bits in the EXCFLAGn registers, and must be used when binding exceptions to instructions. Table 14: Exceptions summary
Mnemonic RF_IDLE Num (hex) 0x00 Description The main radio FSM enters its idle state from any other state. This exception is not generated when the FSM enters the idle state because of a device reset. TX frame successfully transmitted, which means that TX FIFO is empty and no underflow occurred. Exception is not generated when TX is aborted with SRFOFF, SRXON or STXON. ACK frame successfully transmitted. Exception is not generated when the acknowledge transmission is aborted with SRFOFF, SRXON or STXON. Underflow has occurred in the TX FIFO. TX is aborted and the TX FIFO must be flushed. An attempt was made to write to TX FIFO while it is full. The instruction is aborted. An attempt has been made to read the RX FIFO without any bytes available to read. Instruction is aborted. Note that the RX_UNDERFLOW exception should only be used for debugging software, and should not be trusted in a RX FIFO readout routine. In some scenarios the RX_UNDERFLOW exception will not be issued when a reading starts even when the RX_FIFO is empty. An attempt has been made by RF_core to write to RX FIFO while the RX FIFO is full. The byte that was attempted written to the RX FIFO is lost. Reception of data is aborted and the FSM enters the rx_overflow state. Recommended action is to issue a SFLUSHRX command strobe to empty the RX FIFO and restart RX. RX enable register has changed value to all zeros. A complete frame has been received. I.E the number of bytes set by the length field is received. When frame filtering is enabled, this exception is generated when a frame is accepted (happens immediately after receiving the fields required to determine the outcome). When source address matching is enabled, this exception is generated upon completion of source address matching. The exception is generated regardless of the result. If a source match is found, this exception is generated immediately before SRC_MATCH_DONE. The RX FIFO is filled up with bytes that have passed address filtering to the FIFOP threshold value defined in register, or at least one complete frame has been written to the RX FIFO. High when FFCTRL is in the rx_overflow state. Start of frame delimiter received when in RX or start of frame delimiter transmitted when in TX. Low priority DPU operation completed. Will not be issued if operation fails or is aborted.
TX_FRM_DONE
0x01
RX_OVERFLOW
0x06
SRC_MATCH_DONE
0x0A
SRC_MATCH_FOUND FIFOP
0x0B 0x0C
SFD DPU_DONE_L
0x0D 0x0E
WWW.TI.COM
55
SPI_ERROR RF_NO_LOCK
0x13 0x14
14.1 Exceptions on GPIO Pins All exception flags can be routed individually to a GPIO pin by writing the CTRLn value corresponding to the desired exception in Table 8 into the GPIOCTRLn registers. CC2520 has two exception channels, A and B, that let the user select a collection of exceptions to combine to output on a GPIO pin. If any of the selected exceptions goes active, the GPIO pin goes active. It is also possible to output the complementary collection of exceptions of each of the two channels. Example: Collect RF_IDLE and RX_UNDERFLOW in exception channel B and output on GPIO3. Write 0x22 to GPIOCTRL3. Set GPIO3 as output and select exception channel B from the GPIO configuration table in section 12.6. Write 0x21 to EXCMASKB0. Select RF_IDLE and RX_UNDERFLOW exceptions in accordance with table Exceptions overview (section 16). Write 0x00 to EXCMASKB1. Mask all other exceptions. Write 0x00 to EXCMASKB2. Mask all other exceptions.
The complementary exception channel B with the settings in the example above will include all other exceptions than RF_IDLE and RX_UNDERFLOW. This channel can be routed to another GPIO pin by writing 0x24 to the corresponding GPIOCTRLn register. Exceptions linked to GPIO pins separately or as a group in a channel will be consistent with the corresponding bits in the EXCFLAGn registers. EXCFLAGn register bits that are high can only be cleared by writing zero to the bit.
14.2 Predefined Exception Channels There are two predefined exception channels that can be observed on GPIO pins. They are not included in the status byte and no complementary channel is available. The first predefined exception channel is a collection of exceptions that indicate that something has gone wrong during RX. RX_UNDERFLOW RX_OVERFLOW RX_FRM_ABORTED RXBUFMOV_TIMEOUT
56
WWW.TI.COM
The second predefined exception channel includes exceptions that indicate general error conditions. MEMADDR_ERROR USAGE_ERROR OPERAND_ERROR SPI_ERROR Figure 10 shows how the exceptions are linked to the instruction set of CC2520. Note that there are several sources that may trigger instructions. The large or-gate illustrates that it only takes one of these sources to trigger the execution of an instruction.
14.3 Binding Exceptions to Instructions (command strobes) An exception can be bound to trigger a command strobe so that a command strobe can be automatically executed when an exception occurs. There are two possible binding combinations, X and Y, defined in the registers EXCBINDXn and EXCBINDYn. Example Run SACKPEND instruction when RX_FRM_ACCEPTED exception is activated.
Exceptions bus
WWW.TI.COM
57
1. Write 0x06 to EXCBINDX0. This will select SACKPEND as the bound instruction from Table 8: GPIO configuration. 2. Write 0x89 to EXCBINDX1. Enables X-binding and selects RX_FRM_ACCEPTED as the bound exception from Table 14: Exceptions summary. Note Be aware of the offset in numbering in the tables Exceptions summary (section 16) and GPIO configuration (section 12.6) for exceptions. It is for example possible to route the exception RF_IDLE to a GPIO pin in the GPIOCTRLn.CTRLn register bit when the pin is set as output. In this case, the exception RF_IDLE has the numbering 0x01 in accordance to Table 9: GPIO configuration When RF_IDLE is to be bound with an instruction the numbering to be used in EXCBINDX/Y1 is 0x00 in accordance to Table 14: Exceptions summary.
58
WWW.TI.COM
15 Memory Map
The configuration registers in CC2520 are located at addresses from 0x000 to 0x07F. From 0x080 to 0x0FF there is currently a reserved area that is not used. CC2520 contains 768 bytes of physical RAM located at addresses 0x100 to 0x3FF.
WWW.TI.COM
59
15.1 FREG FREG is 128 fast access 8-bit registers that can be reached with REGRD and REGWR instructions. REGRD and REGWR instructions that begin in the FREG memory area can be continued into the SREG and wrap around at 0x07F. FREG can also be accessed with MEMRD and MEMWR instructions which require one extra byte over the SPI with respect to REGRD and REGWR. Registers in FREG between 0x000 and 0x01F are bit wise writeable with the BCLR and BSET instructions. The registers located in FREG are described in section 28. Note that not all 128 addresses are used.
15.2 SREG SREG is 128 8-bit registers that are accessible with MEMRD and MEMWR instructions. The registers located in SREG are described in section 32. Note that not all 128 addresses are used.
15.3 TX FIFO The TX FIFO memory area is located at addresses 0x100 to 0x17F and is thus 128 bytes. Although this memory area is intended for the TX FIFO, it is not protected in any way, so it is still accessible with for instance the MEMWR and MEMRD instructions. Normally, only the designated instructions should be used to manipulate the contents of the TX FIFO. The TX FIFO can only contain one frame at a time. More details on the TX FIFO can be found in section 22.3.
15.4 RX FIFO The RX FIFO memory area is located at addresses 0x180 to 0x1FF and is thus 128 bytes. Although this memory area is intended for the RX FIFO, it is not protected in any way, so it is still accessible with for instance the MEMWR and MEMRD instructions. Normally, only the designated instructions should be used to manipulate the contents of the RX FIFO. The RX FIFO can contain more than one frame at a time.
15.5 MEM The MEM memory area from address 0x200 to 0x37F is 384 bytes long. The two 16-byte temporary areas CBCTEMPH and CBCTEMPL are used for CBCMAC, UCBCMAC, CCM and UCCM instructions, with high and low priority respectively. The remaining MEM area is general purpose memory.
15.6 Frame Filtering and Source Matching Memory Map The frame filtering and source address matching functions use a 128-byte block of CC2520 memory to store local address information and source matching configuration and results. This memory space is described in Table 15. Values that do not fill an entire byte/word are in the least significant part of the byte/word. Table 15: Frame Filtering and Source Matching Memory map
Address REGISTER / Variable Endian Description Reserved 0x3F6-3FF Temporary storage Memory space used for temporary storage of variables. Local address information 0x3F4-0x3F5 0x3F2-0x3F3 0x3EA-0x3F1 SHORT_ADDR PAN_ID EXT_ADDR LE LE LE The short address used during destination address filtering. The PAN ID used during destination address filtering. The IEEE extended address used during destination address filtering.
60
WWW.TI.COM
0x3E5 0x3E4
SRCEXTPENDEN1 SRCEXTPENDEN0 8 LSBs of the 24-bit mask that enables / disables automatic pending for each of the 12 extended addresses. Entry n is mapped SRCEXTPENDEN[2n]. All SRCEXTPENDEN[2n+1] bits are don't care. Source address matching result
0x3E3
SRCRESINDEX
The bit index of the least significant '1' in SRCRESMASK, or 0x3F when there is no source match. Upon a match, bit 5 is '0' when the match is on a short address and '1' when it is on an extended address. Upon a match, bit 6 is '1' when the conditions for automatic pending bit in acknowledgment have been met (see the description of SRCMATCH.AUTOPEND). The bit gives no indication of whether or not the acknowledgment actually is transmitted, and does not take the PENDING_OR register bit and the SACK/SACKPEND/SNACK strobes into account.
24-bit mask that indicates source address match for each individual entry in the source address table. Short address matching: When there is a match on entry panid_n + short_n, bit n will be set in SRCRESMASK. Extended address matching: When there is a match on entry ext_n, bits 2n and 2n+1 will be set in SRCRESMASK. Source address table
ext_11
LE LE LE LE
LE
2 individual short address entries (combination of 16 bit PAN ID and 16 bit short address) or 1 extended address entry.
----0x38E-0x38F 0x38C-0x38D 0x38A-0x38B 0x388-0x389 0x386-0x387 0x384-0x385 0x382-0x383 0x380-0x381 short_03 panid_03 short_02 panid_02 short_01 panid_01 short_00 panid_00 ext_00 ext_01 LE LE LE LE LE LE LE LE LE 2 individual short address entries (combination of 16 bit PAN ID and 16 bit short address) or 1 extended address entry. LE 2 individual short address entries (combination of 16 bit PAN ID and 16 bit short address) or 1 extended address entry.
WWW.TI.COM
61
[MHz]
k [11,26]
For operation in channel k, the FREQCTRL.FREQ register should therefore be set to FREQCTRL.FREQ = 11 + 5 (k-11)
62
WWW.TI.COM
The modulation format is Offset Quadrature Phase Shift Keying (O-QPSK) with half-sine chip shaping. This is equivalent to MSK modulation. Each chip is shaped as a half-sine, transmitted alternately in the I and Q channels with one half chip period offset. This is illustrated for the zero-symbol in Figure 13.
WWW.TI.COM
63
64
WWW.TI.COM
Preamble Sequence
1 1 Start of frame Frame Delimiter Length (SFD) Synchronisation Header PHY Header (SHR) (PHR) 4 11 + (0 to 20) + n PHY Protocol Data Unit (PPDU)
5 + (0 to 20) + n MAC Protocol Data Unit (MPDU) PHY Service Data Unit (PSDU)
Figure 14: Schematic view of the IEEE 802.15.4 Frame Format [1] 18.1 PHY Layer Synchronization Header The synchronization header (SHR) consists of the preamble sequence followed by the start of frame delimiter (SFD). In the IEEE 802.15.4 specification [2], the preamble sequence is defined to be 4 bytes of 0x00. The SFD is one byte with value 0xA7. PHY Header The PHY header consists only of the frame length field. The frame length field defines the number of bytes in the MPDU. Note that the value of the length field does not include the length field itself. It does however include the FCS (Frame Check Sequence), even if this is inserted automatically by CC2520 hardware.
T T
The frame length field is 7 bits long and has a maximum value of 127. The most significant bit in the length field is reserved, and should always be set to zero. PHY Service Data Unit The PHY Service Data Unit contains the MAC Protocol Data Unit (MPDU). It is the MAC layers responsibility to generate/interpret the MPDU, and CC2520 has built in support for processing of some of the MPDU subfields.
18.2 MAC Layer The FCF, data sequence number and address information follows the length field as shown in Figure 14. Together with the MAC data payload and Frame Check Sequence, they form the MPDU. The format of the FCF is shown in Figure 15. For full details, please refer to the IEEE 802.15.4 specification [2].
Bits: 0-2 Frame Type 3 Security Enabled 4 Frame Pending 5 Acknowledge request 6 Intra PAN 7-9 Reserved 10-11 Destination addressing mode 12-13 Reserved 14-15 Source addressing mode
WWW.TI.COM
65
Frame Check Sequence A 2-byte frame check sequence (FCS) follows the last MAC payload byte as shown in Figure 14. The FCS is calculated over the MPDU, i.e. the length field is not part of the FCS. The FCS polynomial defined in [2] is
G( x) = x 16 + x 12 + x 5 + 1
CCC2520 supports automatic calculation/verification of the FCS. See sections 20.3 and 22.1.3 for details.
66
WWW.TI.COM
19 Transmit Mode
This section describes how to control the transmitter, the integrated frame processing and how to use the TX FIFO.
19.1 TX Control CC2520 has many built in features for frame processing and status reporting. Note that CC2520 provides features that make it easy for the microcontroller to have precise control of the timing of outgoing frames. This is very important in an IEEE 802.15.4/ZigBee system, because there are strict timing requirements to such systems. Frame transmission will be started by the following actions: The STXON command strobe o The SAMPLED_CCA signal is not updated. The STXONCCA command strobe, provided that the CCA signal is high. o Aborts ongoing transmission/reception and forces a TX calibration followed by transmission. o The SAMPLED_CCA signal is updated Clear channel assessment is described in detail in section 19.7. Frame transmission will be aborted by the following command actions: The SRXON command strobe o Aborts ongoing transmission and forces a RX calibration The SRFOFF command strobe o Aborts ongoing transmission/reception and forces the FSM to the IDLE state. The STXON command strobe o See above. To enable the receiver after transmission with STXON, the FRMCTRL1.SET_RXENMASK_ON_TX bit should be set. This will set bit 14 in RXENABLE when STXON is executed. When transmitting with STXONCCA, the receiver would be on before the transmission and will be turned back on afterwards (unless the RXENABLE registers have been cleared in the mean time).
19.2 TX State Timing Transmission of preamble begins 192 us after the STXON or STXONCCA command strobe. This is referred to as "TX turnaround time" in [2]. There is an equal delay when returning to receive mode. When returning to idle or receive mode, there is a 2 us delay while the modulator ramps down the signals to the DACs. The down ramping happens automatically after the complete MPDU (as defined by the length byte) has been transmitted or if TX underflow occurs. This affects: The SFD signal, which is stretched by 2 us. The radio FSM transition to the IDLE state, which is delayed by 2 us.
19.3 TX FIFO Access The TX FIFO can hold 128 bytes and only one frame at a time. The frame can be buffered before or after the TX command strobe is executed, as long as it does not generate TX underflow (see the error conditions listed below). Figure 16 illustrates what needs to be written to the TX FIFO (marked blue). Additional bytes are ignored, unless TX overflow occurs (see the error conditions listed below).
WWW.TI.COM
67
Figure 16. Frame data written to the TX FIFO There are three ways to write to the TX FIFO: The TXBUF instruction transfers bytes from the microcontroller to the TX FIFO in CC2520. The TXBUFCP instruction copies bytes from the general RAM in CC2520 into the TX FIFO. Frame buffering always begins at the start of the TX FIFO memory. By enabling the FRMCTRL1.IGNORE_TX_UNDERF bit, it is possible to MEMWR, MEMCP and other memory instructions to write the frame. Note, however, that using dedicated TXBUF and TXBUFCP instructions should be preferred. The number of bytes in the TX FIFO is stored in the TXFIFOCNT register. The TX FIFO can be emptied manually with the SFLUSHTX command strobe. TX underflow will occur If the FIFO is emptied during transmission. 19.3.1 Retransmission In order to support simple retransmission of frames, the CC2520 does not delete TX FIFO contents as they are transmitted. After a frame has been successfully transmitted, the FIFO contents are left unchanged. To retransmit the same frame again, simply restart TX by issuing a STXON or STXONCCA command strobe. If a different frame is to be transmitted, just write the new frame to the TX FIFO. In this case, the TX FIFO is automatically flushed before the actual writing takes place. 19.3.2 Error Conditions There are two error conditions associated with the TX FIFO: Overflow happens when the TX FIFO is full and it is attempted to write another byte. Underflow happens when the TX FIFO is empty and CC2520 attempts to fetch another byte for transmission. TX overflow is indicated by the TX_OVERFLOW exception. When this error occurs, the writing will be aborted, i.e. the data byte that caused the overflow will be lost. The error condition must be cleared with the SFLUSHTX strobe. TX underflow is indicated by the TX_UNDERFLOW exception. When this error occurs, the ongoing transmission is aborted. The error condition must be cleared with the SFLUSHTX strobe. The TX_UNDERFLOW exception can be disabled by setting the FRMCTRL1.IGNORE_TX_UNDERF bit. In this case, the CC2520 will continue transmitting the bytes that happen to be in the TX FIFO memory, until the number of bytes given by the first byte (i.e. the length byte) has been transmitted
68
WWW.TI.COM
19.4 TX Flow Diagram Figure 17 summarizes the previous sections in a flow diagram:
No CSMA-CA Unslotted CSMA-CA Slotted CSMA-CA Data buffering
SSAMPLECCA Write a frame to the TX buffer using: - TXBUF - TXBUFCP - Memory access - A combination of these methods This can be done before, after or in parallel with the TX strobe.
Yes (SAMPLED_CCA = 1)
Success?
STXON
STXONCCA
No (SAMPLED_CCA = 0)
Yes (SAMPLED_CCA = 1)
TX started?
TX completes?
No
Why?
Error condition
Error condition (left side of the flow diagram should be ignored since the TX buffer is corrupted)
Between two transmissions there can be multiple other activities such as frame reception, RX FIFO access and acknowledgment transmission (using SACK, SACKPEND or AUTOACK), or idle periods (random backoffs). This will have no side effects on the state of the TX buffer. The placement of the SFLUSHTX strobe in the diagram shows the latest point in time where this strobe can be executed. If fewer special cases is desired, it is always possible to use the SFLUSHTX strobe and then load or reload TXBUF with the next frame to be transmitted.
Next time... To retransmit or transmit a different frame... To (re)transmit what is currently in the TX buffer...
Restart from the top of the diagram Do not write anything to the TX buffer
Restart from the top of the diagram Write the new frame to the TX buffer (before, after or in parallel with the TX strobe)
SFLUSHTX
Restart from the top of the diagram If anything is written to the TX buffer, it will be appended to the current data.
SFLUSHTX
SFLUSHTX
Restart from the top of the diagram Write the next frame to the TX buffer (before, after or in parallel with the TX strobe)
Restart from the top of the diagram Write the new frame to the TX buffer (before, after or in parallel with the TX strobe)
Restart from the top of the diagram Write the next frame to the TX buffer (before, after or in parallel with the TX strobe)
WWW.TI.COM
69
19.5 Frame Processing CC2520 performs the following frame generation tasks for TX frames:
Transmitted frame
Preamble 1 SFD LEN 2 MHR MAC Payload FCS 3
1. Generation and automatic transmission of the PHY Layer synchronization header which consists of the preamble and the SFD. 2. Transmission of the number of bytes specified by the frame length field. 3. Calculation of and automatic transmission of the FCS (can be disabled). The recommended usage is to write the length field followed by MAC header and MAC payload to the TX FIFO, and let CC2520 handle the rest. Note that the length field must include the two FCS bytes even though CC2520 adds these automatically. 19.5.1 Synchronization Header
Figure 18: Transmitted Synchronisation Header CC2520 has programmable preamble length. The default value is compliant with [2] and changing the value will make the system non-compliant to IEEE 802.15.4.
T T
The preamble sequence length is set by MDMCTRL0.PREAMBLE_LENGTH. Figure 18 shows how the CC2520 synchronization header relates to the IEEE 802.15.4 specification.
T T
When the required number of preamble bytes have been transmitted, CC2520 will automatically transmit the one byte long SFD. The SFD is fixed and it is not possible to change this value from software. 19.5.2 Frame Length Field When the SFD has been transmitted, the modulator in CC2520 will start to read data from the TX FIFO. It expects to find the frame length field followed by MAC header and MAC payload. The frame length field is used to determine how many bytes that is to be transmitted. Note that the minimum frame length is 3 when AUTOCRC=1 and 1 when AUTOCRC=0. 19.5.3 Frame Check Sequence When the FRMCTRL0.AUTOCRC control bit is set, the FCS field is automatically generated by CC2520 and appended to the transmitted frame at the position defined by the length field. The FCS is not written to the TXFIFO, but stored in a separate 16-bit register. It is recommended to always have AUTOCRC enabled, except possibly for debug purposes. If FRMCTRL0.AUTOCRC=0 then the modulator will expect to find the
70
WWW.TI.COM
FCS in the TX FIFO, so software must generate the FCS and write it to the TX FIFO along with the rest of the MPDU. The CC2520 hardware implementation of the FCS calculator is shown in Figure 22. Please refer to [2] for further details.
T T
19.6 Exceptions The SFD exception will be raised when the SFD field of the frame has been transmitted. At the end of the frame, the TX_FRM_DONE exception will be raised when the complete frame has been successfully transmitted. Note that there is a second SFD signal available on GPIO (config value 0x2A) that should not be confused with the SFD exception.
19.7 Clear Channel Assessment The clear channel assessment (CCA) status signal indicates whether the channel is available for transmission or not. The CCA function is used to implement the CSMA-CA functionality specified in the IEEE 802.15.4 specification [2]. The CCA signal is valid when the receiver has been enabled for at least 8 symbol periods. The RSSI_VALID status signal can be used to verify this. The CCA is based on the RSSI value and a programmable threshold. The exact behavior is configurable in the CCACTRL0 and CCACTRL1 registers. There are two variations of the CCA signal, one that is updated at every new RSSI sample and one that is only updated on SSAMPLECCA and STXONCCA command strobes. They are both available in the FSMSTAT1 register. Note that the CCA signal is updated 4 clock cycles (32 MHz) after the RSSI_VALID signal has been set.
19.8 Output Power Programming The RF output power of CC2520 is controlled by the 7 bit value in the TXPOWER register. Table 17 shows the typical output power and current consumption for the recommended settings when the centre frequency is set to 2440 GHz. Note that the recommended settings are only a small subset of all the possible register settings. Using other settings than those in Table 17 might result in very high current consumption and generally poor performance. Please refer to section 5.11 for details on the optional temperature compensated TX.
WWW.TI.COM
71
Table 17: Output power and current consumption measured on the CC2520 reference design @ +3.0 V, +25C, fc=2.440 GHz
TXPOWER register (hex) F7 F2 AB 13 32 81 88 2C 03 Typical output power (dBm) 5 3 2 1 0 -2 -4 -7 -18 Typical current consumption (mA) 33.6 31.3 28.7 27.9 25.8 24.9 23.1 19.9 16.2
19.9 Tips And Tricks Trigger the STXON and STXONCCA strobes from GPIO pins. This gives the microcontroller very accurate control of the timing of the outgoing frame. Use a timer in the microcontroller to capture the timing of the SFD exception. This gives the microcontroller exact knowledge of when the frame was transmitted. Note that there is no requirement to have the complete frame in the TXFIFO before starting a transmission. Bytes may be added to the TX FIFO during transmission. It is possible to make CC2520 transmit non-IEEE 802.15.4 compliant frames by setting MDMTEST1.MODULATION_MODE=1.
72
WWW.TI.COM
20 Receive Mode
This section describes how to control the receiver, integrated RX frame processing, and how use the RX FIFO. 20.1 RX Control The CC2520 receiver is turned on and off with the SRXON and SRFOFF command strobes, and with the RXENABLE registers. The command strobes provide a "hard" on/off mechanism, while RXENABLE manipulation provides a "soft" on/off mechanism. The receiver will be turned on by the following actions: The SRXON strobe: o Sets RXENABLE[15] o Aborts ongoing transmission/reception by forcing a transition to RX calibration. The STXON strobe when FRMCTRL1.SET_RXENMASK_ON_TX is enabled: o Sets RXENABLE[14] o The receiver is enabled after transmission completes. Setting RXENABLE != 0x0000: o Does not abort ongoing transmission/reception. The receiver will be turned off by the following actions: The SRFOFF strobe: o Clears RXENABLE[15:0] o Aborts ongoing transmission/reception by forcing the transition to IDLE mode. Setting RXENABLE = 0x0000 o Does not abort ongoing transmission/reception. Once the ongoing transmission/reception is finished, the CC2520 will return to IDLE state. There are several ways to manipulate the RXENABLE registers: The REGWR and MEMWR instructions The BSET and BCLR instructions The RXENABLEAND and RXENABLEOR instructions The SRXMASKBITSET and SRXMASKBITCLR strobes (affecting RXENABLE[13]) The SRXON, SRFOFF and STXON strobes, including the FRMCTRL1.SET_RXMASK_ON_TX setting
20.2 RX State Timing The receiver is ready 192 us after RX has been enabled by one of the methods described above. This is referred to as "RX turnaround time" in [2]. When returning to receive mode after frame reception, there is by default an interval of 192 us where SFD detection is disabled. This interval can be disabled by clearing FSMCTRL.RX2RX_TIME_OFF.
20.3 Frame Processing CC2520 integrates critical portions of the RX requirements in IEEE 802.15.4-2003 and -2006 in hardware. This reduces the microcontroller interruption rate, simplifies the software that handles frame reception, and provides the results with minimum latency. During reception of a single frame, the CC2520 performs the following frame processing steps:
WWW.TI.COM
73
1. Detection and removal of the received PHY synchronization header (preamble and SFD), and reception of the number of bytes specified by the frame length field. 2. Frame filtering as specified by [1] and [2], section 7.5.6.2, third filtering level. 3. Matching of the source address against a table containing up to 24 short addresses or 12 extended IEEE addresses. The source address table is stored on-chip in RAM. 4. Automatic FCS checking, and attaching this result and other status values (RSSI, LQI and source match result) to received frames. 5. Automatic acknowledgment transmission with correct timing, and correct setting of the frame pending bit, based on the results from source address matching and FCS checking. 20.3.1 Synchronization Header And Frame Length Fields Frame reception starts with detection of a start-of-frame delimiter (SFD), followed by the length byte, which determines when the reception is complete. The SFD signal, which is default output on GPIO4, can be connected to a timer input on a microcontroller to capture the start of received frames:
Figure 20: SFD signal timing Preample and SFD are not written to the RX FIFO. The CC2520 uses a correlator to detect the SFD. The correlation threshold value in MDMCTRL1.CORR_THR determines how closely the received SFD must match an "ideal" SFD. The threshold must be adjusted with care: If set too high, CC2520 will miss lots of actual SFDs, effectively reducing the receiver sensitivity. If set too low, CC2520 will detect lots of false SFDs. Although this does not reduce the receiver sensitivity, the effect will be similar, since false frames might overlap with SFDs of actual frames. It also increases the risk of receiving false frames with correct FCS. In addition to SFD detection, it is also possible to require a number of valid preamble symbols (also above the correlation threshold) prior to SFD detection. Refer to the register descriptions of MDMCTRL0 and MDMCTRL1 for available options and recommended settings. For CC2520 rev. A the default correlation threshold is too low, and must updated after reset (before RX is attempted). 20.3.2 Frame Filtering The frame filtering function rejects non-intended frames as specified by [1] and [2], section 7.5.6.2, third filtering level. In addition, it provides filtering on: The 8 different frame types (see the FRMFILT1 register) The reserved bits in the frame control field (FCF)
The function is controlled by: The FRMFILT0 and FRMFILT1 registers The LOCAL_PAN_ID, LOCAL_SHORT_ADDR and LOCAL_EXT_ADDR values in RAM
74
WWW.TI.COM
Filtering Algorithm The FRMFILT0.FRM_FILTER_EN bit controls whether frame filtering is applied or not. When disabled, the CC2520 will accept all received frames. When enabled (which is the default setting), the CC2520 will only accept frames that fulfill all of the following requirements: The length byte must be equal to or higher than the minimum frame length, which is derived from the source- and destination address mode and PAN ID compression subfields of the FCF. The reserved FCF bits [9:7] anded together with FRMFILT0.FCF_RESERVED_BITMASK must equal 0b000. The value of the frame version subfield of the FCF cannot be higher than FRMFILT0.MAX_FRAME_VERSION. The source and destination address modes cannot be reserved values (1). Destination address: If a destination PAN ID is included in the frame, it must match LOCAL_PANID or must be the broadcast PAN identifier (0xFFFF). If a short destination address is included in the frame, it must match either LOCAL_SHORT_ADDR or the broadcast address (0xFFFF). If an extended destination address is included in the frame, it must match LOCAL_EXT_ADDR. Beacon frames (0) are only accepted when: FRMFILT1.ACCEPT_FT0_BEACON = 1 Length byte >= 9 The destination address mode is 0 (no destination address) The source address mode is 2 or 3 (i.e. a source address is included) The source PAN ID matches LOCAL_PANID, or LOCAL_PANID equals 0xFFFF FRMFILT1.ACCEPT_FT1_DATA = 1 Length byte >= 9 A destination address and/or source address is included in the frame. If no destination address is included in the frame, the FRMFILT0.PAN_COORDINATOR bit must be set and the source PAN ID must equal LOCAL_PANID. FRMFILT1.ACCEPT_FT2_ACK = 1 Length byte = 5 FRMFILT1.ACCEPT_FT3_MAC_CMD = 1 Length byte >= 9 A destination address and/or source address is included in the frame. If no destination address is included in the frame, the FRMFILT0.PAN_COORDINATOR bit must be set and the source PAN ID must equal LOCAL_PANID for the frame to be accepted.. FRMFILT1.ACCEPT_FT4TO7_RESERVED = 1 (default is 0) Length byte >= 9
Frame type:
The following operations are performed before the filtering begins, with no effect on the frame data stored in the RX FIFO: Bit 7 of the length byte is masked out (dont care). If FRMFILT1.MODIFY_FT_FILTER is unlike zero, the MSB of the frame type subfield of the FCF is either inverted or forced to 0 or 1.
WWW.TI.COM
75
If a frame is rejected, CC2520 will only start searching for a new frame after the rejected frame has been completely received (as defined by the length field) to avoid detecting false SFDs within the frame. Note that rejected frames can generate RX overflow if it occurs before the frame is rejected. Exceptions When frame filtering is enabled and the filtering algorithm accepts a received frame, an RX_FRM_ACCEPTED exception will be generated. It will not be generated if frame filtering is disabled or RX_OVERFLOW or RX_FRM_ABORTED is generated before the filtering result is known. Figure 24 illustrates the three different scenarios (not including the overflow and abort error conditions).
Figure 21: Filtering scenarios (exceptions generated during reception) The FSMSTAT1.SFD register bit will go high when start of frame delimiter is completely received and remain high until either the last byte in MPDU is received or the received frame has failed to pass address recognition and been rejected. SFD exception can be routed to a GPIO pin alone or as a part of a group of exceptions in channel A or B. SFD exception should preferably be connected to a timer capture pin on the microcontroller to extract timing information of transmitted and received data frames. SFD exception is also stored in EXCFLAG1 register. The register bit (and possibly the GPIO pin) will go high when the start of frame delimiter has been completely received and will continue to be high until cleared by SW. Tips and Tricks The following register settings must be configured correctly: FRMFILT0.PAN_COORDINATOR must be set if the device is a PAN coordinator, and cleared if not. FRMFILT0.MAX_FRAME_VERSION must correspond to the supported version(s) of the IEEE 802.15.4 standard. The local address information must be loaded into RAM. To completely avoid receiving frames during energy detection scanning, set FRMCTRL0.RX_MODE = 0b11 and then (re)start RX. This will disable symbol search and thereby prevent SFD detection. To resume normal RX mode, set FRMCTRL0.RX_MODE = 0b00 and (re)start RX. During operation in a busy IEEE 802.15.4 environment, CC2520 will receive large numbers of non-intended acknowledgment frames. To effectively block reception of these frames, use the FRMFILT1.ACCEPT_FT2_ACK bit to control when acknowledgment frames should be received:
76
WWW.TI.COM
Set FRMFILT1.ACCEPT_FT2_ACK after successfully starting a transmission with acknowledgment request, and clear the bit again after the acknowledgment frame has been received, or the timeout has been reached. Keep the bit cleared otherwise.
It is not necessary to turn off the receiver while changing the values of the FRMFILT0/1 registers and the local address information stored in RAM. However, if the changes take place between reception of the SFD byte and the source PAN ID (i.e. between the SFD and RX_FRM_ACCEPTED exceptions), the modified values must be considered as dont care for that particular frame (CC2520 will use either the old or the new value). Note that it is possible to make CC2520 ignore all IEEE 802.15.4 incoming frames by setting MDMTEST1.MODULATION_MODE=1. 20.3.3 Source Address Matching CC2520 supports matching of the source address in received frames against a table stored in the on-chip memory. The table is 96 bytes long, and hence it can contain up to: 24 short addresses (2 + 2 bytes each) 12 IEEE extended addresses (8 bytes each). Source address matching will only be performed when frame filtering is also enabled, and the received frame has been accepted. The function is controlled by: The SRCMATCH, SRCSHORTEN0, SRCSHORTEN1, SRCSHORTEN2, SRCEXTEN0, SRCEXTEN1 and SRCEXTEN2 registers The source address table in RAM. Applications Automatic acknowledgment transmission with correct setting of the frame pending bit: When using indirect frame transmission, the devices will send data requests to poll frames stored on the coordinator. To indicate whether it actually has a frame stored for the device, the coordinator must set or clear the frame pending bit in the returned acknowledgment frame. On most 8- and 16-bit MCUs, however, there is not enough time to determine this, and so the coordinator ends up setting the pending bit regardless of whether there are pending frames for the device (as required by IEEE 802.15.4 [2]). This is wasteful in terms of power consumption, because the polling device will have to keep its receiver enabled for a considerable period of time, even if there are no frames for it. By loading the destination addresses in the indirect frame queue into the source address table and enabling the AUTOPEND function, CC2520 will set the pending bit in outgoing acknowledgment frames automatically. This way the operation is no longer timing critical, as the effort done by the microcontroller is when adding or removing frames in the indirect frame queue and updating the source address table accordingly. Security material look-up: To reduce the time needed to process secured frames, the source address table can be set up so the entries match the table of security keys on the microcontroller. A second level of masking on the table entries allows this application to be combined with automatic setting of the pending bit in acknowledgment frames. Other applications: The two previous applications are the main targets for the source address matching function. However, for proprietary protocols that only rely on the basic IEEE 802.15.4 frame format, there are several other useful applications. For instance, by using it together with the exception binding mechanism, it is possible to create firewall functionality where only a specified set of nodes will be acknowledged. The Source Address Table The source address table begins at address 0x380 in RAM as shown in Figure 11. The space is shared between short and extended addresses, and the SRCSHORTEN0/1/2 and SRCEXTEN0/1/2 registers are used to control which entries are enabled. All values in the table are little-endian (as in the received frames). A short address entry starts with the 16-bit PAN ID followed by the 16-bit short address. These entries are stored at address 0x380 + (4 n), where n is a number between 0 and 23.
WWW.TI.COM
77
An extended address entry consists only of the 64-bit IEEE extended address. These entries are stored at address 0x380 + (8 n), where n is a number between 0 and 11.
Address Enable Registers Software is responsible for allocating table entries and for making sure that active short and extended address entries do not overlap. There are separate enable bits for short and extended addresses: Short address entries are enabled in the SRCSHORTEN0, SRCSHORTEN1 and SRCSHORTEN2 registers. Register bit n corresponds to short address entry n. Extended address entries are enabled in the SRCEXTEN0, SRCEXTEN1 and SRCEXTEN2 registers. In this case register bit 2n corresponds to extended address entry n. This mapping is convenient when creating a combined bit vector (of short and extended enable bits) to find unused entries. Moreover, when read, register bit 2n+1 will always have the same value as register bit 2n, since an extended address occupies the same memory as two short address entries.
Figure 22 - Example of enabled table entries Matching Algorithm The SRCMATCH.SRC_MATCH_EN bit controls whether source address matching is enabled or not. When enabled (which is the default setting) and a frame passes the filtering algorithm, the CC2520 will apply one of the algorithms outlined in Figure 22, depending on which type of source address is present. The result is reported in two different forms: A 24-bit vector called SRCRESMASK contains a 1 for each enabled short entry with a match, or two 1s for each enabled extended entry with a match (the bit mapping is the same as for the address enable registers upon read access). A 7-bit value called SRCRESINDEX: When no source address is present in the received frame, or there is no match on the received source address: Bits 6:0: 0x3F Bits 4:0: The index of the first entry (i.e. the one with the lowest index number) with a match, 023 for short addresses or 0-11 for extended addresses. Bit 5: 0 if the match is on a short address, 1 if the match is on an extended address. Bit 6: The result of the AUTOPEND function If there is a match on the received source address:
78
WWW.TI.COM
Extended Source Address (mode 3) Short Source Address (mode 2) The received source PAN ID is called srcPanid. The received extended address is called srcExt. The received short address is called srcShort.
SRCRESMASK = 0x000000; SRCRESINDEX = 0x3F; for (n = 0; n < 24; n++) { bitVector = 0x000001 << n; if (SRCSHORTEN & bitVector) { if ((panid[n] == srcPanid) && (short[n] == srcShort)) { SRCRESMASK |= bitVector; if (SRCRESINDEX == 0x3F) { SRCRESINDEX = n; } } } } SRCRESMASK = 0x000000; SRCRESINDEX = 0x3F; for (n = 0; n < 12; n++) { bitVector = 0x000003 << (2*n); if (SRCEXTEN & bitVector) { if (ext[n] == srxExt) { SRCRESMASK |= bitVector; if (SRCRESINDEX == 0x3F) { SRCRESINDEX = n | 0x20; } } } }
Figure 23 - Matching algorithm for short and extended addresses SRCRESMASK and SRCRESINDEX are written to CC2520 memory as soon as the result is available. SRCRESINDEX is also appended to received frames if the FRMCTRL0.AUTOCRC and FRMCTRL0.APPEND_DATA_MODE bits have been set. The value then replaces the 7-bit LQI value of the 16-bit status word. Exceptions When source address matching is enabled and the matching algorithm completes, a SRC_MATCH_DONE exception will be generated, regardless of the result. If a match is found, a SRC_MATCH_FOUND exception will also be generated, immediately before SRC_MATCH_DONE. Figure 24 illustrates the timing of these exceptions:
WWW.TI.COM
79
Tips and Tricks The source address table can be modified safely during frame reception. If one address replaces another while the receiver is active, the corresponding enable bit should be turned off during the modification. This will prevent CC2520 from using a combination of old and new values, because it will only consider entries that are enabled throughout the whole source matching process. The following measures can be taken to avoid that the next received frame overwrites the results from source address matching: Use the appended SRCRESINDEX result instead of the value written to RAM (this is the recommended approach). Read the results from RAM before RX_FRM_ACCEPTED occurs in the next received frame. For the shortest frame type this will happen after the sequence number, so the total available time (absolute worst-case with a small safety margin) becomes: 16 s (required preamble) + 32 s (SFD) + 128 s (4 bytes) = 176 s To increase the available time, clear the FSMCTRL.RX2RX_TIME_OFF bit. This will add another 192 s, for a total of 368 s. This will also reduce the risk of RX overflow.
20.3.4 Frame Check Sequence In receive mode the FCS is verified by hardware if FRMCTRL0.AUTOCRC is enabled. The user is normally only interested in the correctness of the FCS, not the FCS sequence itself. The FCS sequence itself is therefore not written to the RX FIFO during receive. Instead, when FRMCTRL0.AUTOCRC is set the two FCS bytes are replaced by other more useful values. Which values that are substituted for the FCS sequence is configurable in the FRMCTRL0 register.
Figure 25: Data in RX FIFO for different settings. Field descriptions: The RSSI value is measured over the first 8 symbols following the SFD. The CRC_OK bit indicates whether the FCS is correct (1) or incorrect (0). When incorrect, software is responsible for discarding the frame. The correlation value is the average correlation value over the 8 first symbols following the SFD. SRCRESINDEX is the same value that is written to RAM after completion of source address matching. Calculation of the LQI value used by IEEE 802.15.4 is described in section 20.5.
80
WWW.TI.COM
20.3.5 Acknowledgement Transmission CC2520 includes hardware support for acknowledgment transmission after successful frame reception (i.e. the FCS of the received frame must be correct). Figure 26 shows the format of the acknowledgment frame
T T
Bytes:
1 1 Start of Frame Preamble Frame Delimiter Sequence Length (SFD) Synchronisation Header PHY Header (SHR) (PHR) 4
1 2 Frame Data Control Field Sequence (FCF) Number MAC Header (MHR)
Figure 26. Acknowledge frame format There are three variable fields in the generated acknowledgment frame: The pending bit, which may be controlled with command strobes and the AUTOPEND feature The data sequence number (DSN), which is taken automatically from the last received frame The FCS, which is given implicitly. There are three different sources for setting the pending bit in an ACK frame (i.e. the SACKPEND strobe, the PENDING_OR register bit and the AUTOPEND feature). The pending bit is set if one or more of these sources are set. Transmission Timing Acknowledgment frames can only be transmitted immediately after frame reception. The transmission timing is controlled by the FSMCTRL.SLOTTED_ACK bit:
Figure 27: Acknowledgement timing 802.15.4 requires unslotted mode in non-beacon enabled PANs, and slotted mode for beacon-enabled PANs. Manual Control The SACK, SACKPEND and SNACK command strobes can only be issued during frame reception. If the strobes are issued at any other time, they will have no effect but generating a USAGE_ERROR exception:
Figure 28: Command strobe timing The command strobes may be issued several times during reception, however, only the last strobe will have an effect: No strobe / SNACK / incorrect FCS: No acknowledgment transmission SACK: Acknowledgment transmission with the frame pending bit cleared SACKPEND: Acknowledgment transmission with the frame pending bit set
WWW.TI.COM
81
Automatic Control (AUTOACK) When FRMFILT0.FRM_FILTER_EN and FRMCTRL0.AUTOACK are both enabled, the CC2520 will determine automatically whether or not to transmit acknowledgment frames: The RX frame must be accepted by frame filtering (indicated by the RX_FRM_ACCEPTED exception) The acknowledgment request bit must be set in the RX frame The RX frame must not be a beacon or an acknowledgment frame The FCS of the RX frame must be correct Automatic acknowledgments can be overridden by the SACK, SACKPEND and SNACK command strobes. For instance, if the microcontroller is low on memory resources and cannot store a received frame, the SNACK strobe can be issued during reception and prevent acknowledging the discarded frame. By default, the AUTOACK feature never sets the frame pending bit in the acknowledgment frames. Apart from manual override with command strobes, there are two options: Automatic control, using the AUTOPEND feature Manual control, using the FRMCTRL1.PENDING_OR bit Automatic Setting of the Frame Pending Field (AUTOPEND) When the SRCMATCH.AUTOPEND bit is set, the result from source address matching determines the value of the frame pending field. Upon reception of a frame, the frame pending field in the (possibly) returned acknowledgment will be set, given that: FRMFILT0.FRAME_FILTER_EN is set. SRCMATCH.SRC_MATCH_EN is set. SRCMATCH.AUTOPEND is set. The received frame matches the current SRCMATCH.PEND_DATAREQ_ONLY setting. The received source address matches at least one source match table entry, which is enabled in both SRCSHORTEN and SRCSHORTPENDEN, or SRCEXTEN and SRCEXTPENDEN. If the source matching table runs full, the FRMCTRL1.PENDING_OR bit may be used to override the AUTOPEND feature and temporarily acknowledge all frames with the frame pending field set.
20.4 RX FIFO Access The RX FIFO can hold one or more received frames, provided that the total number of bytes is 128 or less. There are two ways to determine the number of bytes in the RX FIFO: Reading RXFIFOCNT register Using the FIFOP and FIFO signals in combination with the FIFOPCTRL.FIFOPTHR setting There are several ways to access the RX FIFO: The RXBUF instruction transfers received bytes from CC2520 to the microcontroller The RXBUFCP instruction transfers received bytes from CC2520 to the microcontroller and makes a copy of the read bytes in CC2520 RAM The RXBUFMOV instruction transfers received bytes from the RX FIFO to CC2520 RAM The RXFIRST register allows software to peek at the head byte in the RX FIFO The SFLUSHRX command strobe resets the RX FIFO, removing all received frames, and clearing all counters, status signals and sticky error conditions. 20.4.1 Using the FIFO and FIFOP Signals The FIFO and FIFOP signals are useful when reading out received frames in small portions while the frame is received: The FIFO signal (default output on GPIO1) goes high when there is one or more bytes in the RX FIFO, but low when RX overflow has occurred. The FIFOP signal (default output on GPIO2) goes high when
82
WWW.TI.COM
The number of valid bytes in the RX FIFO exceeds the FIFOP threshold value programmed into FIFOPCTRL. When frame filtering is enabled, the bytes in the frame header are not considered as valid until the frame has been accepted. The last byte of a new frame is received, even if the FIFOP threshold is not exceeded. If so, FIFOP will go back low at the next RX FIFO read access.
Received frame SFD
Preamble SFD LEN MPDU (LEN[6:0] bytes)
Accepted frame
Rejected frame
Figure 29: Behavior of FIFO and FIFOP signals. When using the FIFOP signal as an interrupt signal for the microcontroller, the FIFOP threshold should be adjusted by the interrupt service routine to prepare for the next interrupt. When preparing for the last interrupt for a frame, the threshold should match the number of bytes remaining. 20.4.2 Error Conditions There are two error conditions associated with the RX FIFO: Overflow, in which case the RX FIFO is full when another byte is received Underflow, in which case software attempts to read a byte from an empty RX FIFO RX overflow is indicated by the RX_OVERFLOW exception and by the signal values FIFO = 0 and FIFOP = 1. When the error occurs, frame reception will be halted. The frames currently stored in the RX FIFO may be read out before the condition is cleared with the SFLUSHRX strobe. Note that rejected frames can generate RX overflow if the condition occurs before the frame is rejected. RX underflow is indicated by the RX_UNDERFLOW exception. RX underflow is a serious error condition that should not occur in error-free software, and the RX_UNDERFLOW exception should only be used for debugging or in a "watchdog" function. Note that the RX_UNDERFLOW exception will not be generated when the read operation occurs simultaneously with reception of a new byte.
20.5 RSSI CC2520 has a built-in RSSI (Received Signal Strength Indication) which calculates an 8 bit signed digital value that can be read from a register or automatically appended to received frames. The RSSI value is the result of averaging the received power over 8 symbol periods (128 s) as specified by IEEE 802.15.4 [2]. The RSSI value is a 2s complement signed number on a logarithmic scale with 1dB steps. The statusbit RSSI_VALID should be checked before reading the RSSI value register. RSSI_VALID indicates that the RSSI value in the register is in fact valid, which means that the receiver has been enabled for at least 8 symbol periods.
WWW.TI.COM
83
To find the actual signal power P at the RF pins with reasonable accuracy, an offset has to be added to the RSSI value. P = RSSI - OFFSET [dBm] The offset is an empirical value which is found during characterization and is approximately 76 dBm for the CC2520 reference design. E.g. reading a RSSI value of -10 from the RSSI register means that the RF input power is approximately -86 dBm. It is configurable how CC2520 updates the RSSI register after it has first become valid. If FRMCTRL0.ENERGY_SCAN=0 (default), the RSSI register contains the latest value available, but if this bit is set to 1, a peak search is performed and the RSSI register will contain the largest value since the energy scan was enabled.
20.6 Link Quality Indication The link quality indication (LQI) is a measurement of the strength and/or quality of the received frame as defined by the IEEE 802.15.4 standard [2]. The LQI value is required by the IEEE 802.15.4 standard [2] to be limited to the range 0 through 255, with at least 8 unique values. CC2520 does not provide a LQI value directly, but reports several measurements that can be used by the microcontroller to calculate a LQI value. The RSSI value may be used by the MAC software to calculate the LQI value. This approach has the disadvantage that e.g. a narrowband interferer inside the channel bandwidth will increase the RSSI and thus the LQI value although it actually reduces the true link quality. CC2520 therefore also provides an average correlation value for each incoming frame, based on the 8 first symbols following the SFD. This unsigned 7bit value can be looked upon as a measurement of the chip error rate, although CC2520 does not do chip decision. As described in section 20.3.4, the average correlation value for the 8 first symbols is appended to each received frame together with the RSSI and CRC OK/not OK when MDMCTRL0.AUTOCRC is set. A correlation value of ~110 indicates a maximum quality frame while a value of ~50 is typically the lowest quality frames detectable by CC2520. Software must convert the correlation value to the range 0-255 as defined by [2], for instance by calculating: LQI = (CORR - a)b limited to the range 0-255, where a and b are found empirically based on PER measurements as a function of the correlation value. A combination of RSSI and correlation values may also be used to generate the LQI value.
84
WWW.TI.COM
na rxe
ble
=0
idle 0
rxenable != 0
all states
STXON
RX calibration 2
SR XO No r SF
TX calibration 32
LUS HR X
SF LU SH
Timeout 192 s
eo rx u 2r x_ o t 19 2 tim r s e_ of f= 1 '
TX underflow 56
Underflow
TX 34-38
Ti m
SFD detected
RX/RX wait 14
Fr a no me ac com k sc ple he te du d a le nd d
RXFIFO reset 16
TX/RX transit 40
rxenable! = 0
TX final 39
RX 7-13
TX shutdown 26, 57
Overflow
0 rxenmask!=
RX overflow 17
Slotted ACK Unslotted ACK
rxenable = 0
SRFOFF or SRXON
ACK delay 55
ACK calibration 48
Timeour 192 s
ACK 49-54
Figure 30: Main FSM Table 18 shows the mapping from FSM state to the number which can be read from the FSMSTAT0 register. Note that although it is possible to read the state of the FSM, this information should not be used to control the program flow in the application software. The states may change very quickly (every 32 MHz clock cycle) and an 8 MHz SPI is not able to capture all the activities. Table 18: FSM State Mapping
State name Idle RX calibration SFD wait RX RX/RX wait RXFIFO reset RX overflow State number decimal 0 2 3-6 7 - 13 14 16 17 Number hex 0x00 0x02 0x03 0x06 0x07 0x0D 0x0E 0x10 0x11 tx_active 0 0 0 0 0 0 0 rx_active 0 1 1 1 1 1 0
WWW.TI.COM
85
86
WWW.TI.COM
22 Crystal Oscillator
The internal crystal oscillator generates the main frequency reference. The reference frequency must be 32 MHz. Because the crystal frequency is used as reference for the data rate as well as other internal signal processing functions, other frequencies cannot be used. The crystal must be connected between the XOSC32M_Q1 and XOSC32M_Q2 pins. The oscillator is designed for parallel mode operation of the crystal. In addition, loading capacitors (C121 and C131) for the crystal are required. The loading capacitor values depend on the total load capacitance, CL, specified for the crystal. The total load capacitance seen between the crystal terminals should equal CL for the crystal to oscillate at the specified frequency. CC2520 has the ability to add more capacitance in order to tune the oscillator frequency. The amount of extra capacitance is configurable with the FREQTUNE register.
C L = C tune + C parasitic +
1 1 1 + C121 C131
The parasitic capacitance is constituted by pin input capacitance and PCB stray capacitance. The total parasitic capacitance is typically 2 pF - 5 pF. Note that the default value for the FREQTUNE register means no added capacitance, which means that only reduction of the frequency is possible. By reducing the external capacitors (C121 and C131), the default frequency is increased. This way, the actual frequency tuning range can be moved so that both positive and negative tuning around the target frequency is possible. The crystal oscillator is amplitude regulated. This means that a high current is used to start up the oscillations. When the amplitude builds up, the current is reduced to what is necessary to maintain a stable oscillation. This ensures a fast start-up and keeps the drive level to a minimum. The ESR of the crystal must be within the specification in order to ensure a reliable start-up. See section 6 for crystal specific parameters (including tuning).
WWW.TI.COM
87
88
WWW.TI.COM
LSB
SPI
Figure 31: Random bit generation in the demodulator A simple test of the RANDOM instruction shows satisfactory performance for most practical uses. About 20 million bytes were read using the RANDOM instruction. When interpreted as unsigned integers between 0 and 255, the mean value was 127.6518, which indicates that there is a DC component. The FFT of the 214 first bytes is shown in Figure 33. Note that the DC component is clearly visible. A histogram (32 bins) of the 20 million values is shown in Figure 34.
0 -10 -20
x 10
-70 -80
6.05
-3 -2 -1 0 Frequency [rad] 1 2 3
50
100
150
200
250
Figure 33: Histogram of 20 million bytes generated with the RANDOM instruction
For the first 20 million individual bits, the probability of a one is P(1)=0.500602 and P(0)=1-P(1)=0.499398.
WWW.TI.COM
89
Note that to fully qualify the random generator as true random, much more elaborate tests are required. There are software packages available on the internet that may be useful in this respect [8], [9].
90
WWW.TI.COM
WWW.TI.COM
91
25.1 RXBUFMOV The RXBUFMOV instruction reads data from the RX FIFO and places the data at a specified memory location as illustrated in Figure 35.
25.2 TXBUFCP The TXBUFCP instruction copies a block of data starting at a specified memory location into the TX FIFO as illustrated in Figure 35.
25.3 MEMCP The MEMCP instruction copies a block of data starting at a specified memory location into another memory location as illustrated in Figure 35.
25.4 MEMCPR The MEMCPR instruction copies a block of data starting at a specified memory location into another memory location while reversing the endianess. In other words the byte at memory location A+n is copied to memory location E+C-1-n.
25.5 MEMXCP The MEMXCP instruction xors two blocks of data and writes the result back to the memory location of the second block. This is primarily used as a subroutine for some of the security instructions. It can also be used to clear (set to zero) blocks of RAM with one short SPI instruction. By using the same source and target address, the data is xored with itself, which always results in zero being written back to the RAM.
92
WWW.TI.COM
26 Security Instructions
CC2520 has extensive support for security operations defined in IEEE 802.15.4. The latest specification version [2] describes only the CCM* mode of operation. CCM* uses CTR-mode encryption for confidentiality and CBC-MAC for authentication. In CC2520 these operations are available as separate instructions. In addition the basic ECB instruction is available and an instruction for manipulation of the counter used in CTR-mode encryption/decryption. Note that all the different security operations in IEEE802.15.4 only use AES 128bit encryption. Decryption is never used and thus CC2520 only supports encryption. ECB decryption is not supported. Note that for all the security instructions, the key and counter should reside in RAM in reversed byte order compared to the data. This can either be done by reversing the byte order of the key/counter before it is written to the RAM, or the MEMCPR instructions can be used to reverse the byte order of keys/counters that are already in the RAM.
26.1 Decoding of the Flags Field in CC2520 This section defines the security flags used during counter mode encryption and CBC-MAC mode authentication (also includes CCM*) and how these are represented in CC2520 RAM.
m(1:0) 7 Flags byte written to RAM 6 5 4 3 2 CTR Flag CBC Flag bits 7:6 bits 7:6 1 L LUT(m(1:0)) 0
7 Res
6 Res
5 0
4 0
3 0
1 L
7 Res
6 Adata
4 M
1 L
Figure 35: Security flags Figure 36 shows how the most significant byte of the counter in CC2520 RAM represents both the CTR and CBC-MAC security flags. For the CBC-MAC flags, a lookup procedure is used to translate the two least significant bits of the m parameter to the CBCMAC instruction in the M value that is used in the flag byte. The same translation is used for the CBC-MAC part of the CCM instruction. Table 19: Lookup table for M value
m(1:0) 00 01 10 11 M 000 001 011 111
WWW.TI.COM
93
Memory after
A+2C-1 A
2C bytes
Increment
2C bytes 0C2
ECB(P,K,C,A,E)
A+15-C A
E+15 E
16 bytes ciphertext
AES encryption
A+15-C A
16K+15 16K
16K+15 16K
ECBO(P,K,C,A)
A+15-C A
AES encryption
A+15 A
16K+15 16K
16K+15 16K
ECBX(P,K,C,A,E)
E+15-C E
16-C bytes plaintext 16 bytes counter 16 bytes key Figure 36: Simple encryption instructions
AES encryption
E+15-C E
A+15 A
A+15 A
16K+15 16K
16K+15 16K
26.2 INC The INC instruction increments 1, 2 or 4 bytes, with the LSB at address A. Note that C=3 is an illegal parameter value.
26.3 ECB The ECB instruction performs basic block encryption. It is mainly intended as a function used by the more complicated instructions such as CBC-MAC and CCM. ECB by itself is not very useful, because there is no decryption instruction. The cipher text output can not be recovered. This should not be considered as a weakness, because ECB block encryption/decryption is not considered to be a secure form of communicating. The values of the parameters E and C should be selected with care so that the instruction does not overwrite a section of the memory that is already in use. The ECB instruction will work exactly as ECBO if E=A.
94
WWW.TI.COM
26.4 ECBO The ECBO instruction is identical to ECB, except that it will store its output to the same memory locations as the input was read from. It will always output 16 bytes even though the input was not a full 16 bytes.
26.5 ECBX The ECBX instruction is identical to ECB, except that it will bitwise XOR the result from the encryption with the memory contents of the output address. The values of the parameters E and C should be selected with care so that the instruction does not overwrite a section of the memory that is already in use. The ECBX instruction will work exactly as ECBXO if E=A. Note that the terminology from counter mode encryption is used in Figure 37.
WWW.TI.COM
95
Memory after
E+C-1 E
A+C-1 A
16K+15 16K
16K+15 16K
16N+15 16N
16 bytes counter
16N+15 16N
16 bytes counter
CBC-MAC(P,K,C,A,E,M)
blocks of 16 bytes Repeat until C bytes have been consumed
i+1 i truncate last iteration E+[NaN,3,7,15] [0,4,8,16] bytes MIC E A+C-1 i=0 else A
A+C-1 A
16K+15 16K
16K+15 16K
CCM(P,K,C,N,A,E,F,M)
A+F+C-1 A+F A+F-1 A
CBC-MAC
MIC
16N+15 16N
16K+15 16K
16N+15 16N
16K+15 16K
Figure 37: Advanced security instructions 26.6 CTR / UCTR The CTR instruction will perform counter mode encryption on a configurable number C of plaintext bytes. It outputs C ciphertext bytes. The 2 least significant bytes of the counter are incremented after each 16 byte block of plaintext has been processed.
96
WWW.TI.COM
If the last block of plaintext is not 16 bytes long, only the required number of bits (from the MSB end) from the encryption is used in the XOR operation. The UCTR instruction performs counter mode decryption and is absolutely identical to the CTR instruction because counter mode encryption and decryption are symmetrical operations.
26.7 CBC-MAC The CBC-MAC instruction performs authentication. Note that if M[1:0]=0 no authentication code is output. For other values of M[1:0] the number of authentication bytes that are output is 2M[1:0]+1. If M[2]=0 the plaintext data is prefixed with the value of C expanded to 8 bits by concatenation of a 0 at the MSB end.
26.8 CCM / UCCM The CCM instruction uses both CBC-MAC and CTR to perform both authentication and encryption. It supports the CCM* mode of operation as specified in IEEE 802.14.5-2006 [2]. The authentication (CBC-MAC) part calculates a Message Integrity Code (MIC) over the address range A to A+F+C-1. The resulting MIC is encrypted with CTR mode encryption using the counter value with index 0. The encryption (CTR) part encrypts the address range A+F to A+F+C-1 using CTR mode encryption and counter values with index 1 and up, and thus generates C bytes of ciphertext. The output which is the concatenation of the ciphertext and the encrypted MIC is written to memory starting at address E. The UCCM instruction decrypts the ciphertext in the address range A+F to A+F+C-1 using CTR mode decryption. A MIC is then generated in the same way as for the CCM instruction, and compared to the MIC in the input data. The result of the MIC comparison is stored in the DPUSTAT register. 26.8.1 Inputs to the CCM and UCCM Instructions The input parameters to the CCM and UCCM instructions are described in detail in Figure 38 and Figure 39 with notes on how they related to the terminology used in the IEEE 802.15.4 specifications.
WWW.TI.COM
97
26.9 Examples from IEEE802.15.4-2006 This section contains a detailed step-by-step guide to reproducing the CCM* examples given in annex C of IEEE802.15.4-2006 [2]. The addresses that are used in these examples are chosen at random. Other addresses can be used as well. Note that all the parameters to the instructions in the examples use hex notation, and that section 13.3 describes the exact bit order that is required for the SPI communication.
98
WWW.TI.COM
26.9.1 Authentication Only Using CCM* This example uses a MAC beacon frame and demonstrates how to apply authentication using the CCM/UCCM instructions.
//Write frame data to RAM //Start at address 0x200 MEMWR(A={02 00} D={08 d0 84 21 43 01 00 00 00 00 48 de ac 02 05 00 00 00 55 cf 00 00 51 52 53 54}) //Write key to RAM in reverse byte order //Start at address 0x230 MEMWR(A={02 30} D={cf ce cd cc cb ca c9 c8 c7 c6 c5 c4 c3 c2 c1 c0}) //Write concatenation of flags, nonce and counter to RAM in reversed byte order //Start at address 0x240 MEMWR(A={02 40} D={00 00 02 05 00 00 00 01 00 00 00 00 48 de ac 09}) //Do CCM operation with high priority //Append the output to the frame data (by setting the output address E to 0x000) CCM(P={01} K={23} C={00} N={24} A={200} E={000} F={1a} M={02})
The expected output from the CCM instruction is {22 3B C1 EC 84 1A B5 53}. To verify the authentication code in the receiver, the following steps are required. It is assumed that frame data is already present in RAM from address 0x200.
//Write key to RAM in reverse byte order //Start at address 0x230 MEMWR(A={02 30} D={cf ce cd cc cb ca c9 c8 c7 c6 c5 c4 c3 c2 c1 c0}) //Write concatenation of flags, nonce and counter to RAM in reversed byte order //Start at address 0x240 MEMWR(a={02 40} D={00 00 02 05 00 00 00 01 00 00 00 00 48 de ac 09}) //Do UCCM operation with low priority UCCM(P={00} K={23} C={00} N={24} A={200} E={2c0} F={1a} M={02}) //Read DPUSTAT register at address 0x02C to check whether the authentication passed or not REGRD(A={2c})
26.9.2 Encryption Only Using CCM* This example uses a MAC data frame and demonstrates how to apply encryption/decryption of the payload using the CCM/UCCM instructions.
//Write frame data to RAM //Start at address 0x200 MEMWR(A={02 00} D={69 dc 84 21 43 02 00 00 00 00 48 de ac 01 00 00 00 00 48 de ac 04 05 00 00 00 61 62 63 64}) //Write key to RAM in reverse byte order //Start at address 0x230 MEMWR(A={02 30} D={cf ce cd cc cb ca c9 c8 c7 c6 c5 c4 c3 c2 c1 c0}) //Write concatenation of flags, nonce and counter to RAM in reversed byte order //Starting at address 0x240 MEMWR(A={02 40} D={00 00 04 05 00 00 00 01 00 00 00 00 48 de ac 01}) //Do CCM instruction. CCM(P={01} K={23} C={04} N={24} A={200} E={2c0} F={1a} M={00})
The expected output from the CCM instruction is {D4 3E 02 2B}. To decrypt the frame in the receiver, the following steps are required. It is assumed that the packed data is already present in RAM from address 0x200.
//Write key to RAM in reverse byte order //Start at address 0x230 MEMWR(A={02 30} D={cf ce cd cc cb ca c9 c8 c7 c6 c5 c4 c3 c2 c1 c0}) //Write concatenation of flags, nonce and counter to RAM in reversed byte order //Starting at address 0x240 MEMWR(A={02 40} D={00 00 04 05 00 00 00 01 00 00 00 00 48 de ac 01}) //Decrypt the frame data and put the plaintext at address 0x2C0. UCCM(P={01} K={23} C={04} N={24} A={200} E={2c0} F={1a} M={00})
WWW.TI.COM
99
26.9.3 Combination of Encryption and Authentication Using CCM* This example uses a MAC command frame and demonstrates how to apply both encryption/decryption and authentication using the CCM/UCCM instructions.
//Write frame data to RAM //Start at address 0x200 MEMWR(A={02 00} D={2b dc 84 21 43 02 00 00 00 00 48 de ac ff ff 01 00 00 00 00 48 de ac 06 05 00 00 00 01 CE}) //Write key to RAM in reverse byte order //Start at address 0x230 MEMWR(A={02 30} D={cf ce cd cc cb ca c9 c8 c7 c6 c5 c4 c3 c2 c1 c0}) //Write concatenation of flags, nonce and counter to RAM in reversed byte order //Starting at address 0x240 MEMWR(A={02 40} D={00 00 06 05 00 00 00 01 00 00 00 00 48 de ac 09}) //Do CCM instruction. //Replace the last byte in the plaintext frame with the cipehertext and encrypted MIC by setting the output address E to 0x000. CCM(P={01} K={23} C={01} N={24} A={200} E={000} F={1d} M={02})
The expected output from the CCM instruction is {D8 4F DE 52 90 61 F9 C6 F1}. To decrypt the frame in the receiver, the following steps are required. It is assumed that the packed data is already present in RAM from address 0x200.
//Write key to RAM in reverse byte order //Start at address 0x230 MEMWR(A={02 30} D={cf ce cd cc cb ca c9 c8 c7 c6 c5 c4 c3 c2 c1 c0}) //Write concatenation of flags, nonce and counter to RAM in reversed byte order //Starting at address 0x240 MEMWR(A={02 40} D={00 00 06 05 00 00 00 01 00 00 00 00 48 de ac 09}) //Decrypt the frame data and authenticate the MIC. Note that the output address E is set to 0x000. UCCM(P={01} K={23} C={01} N={24} A={200} E={000} F={1d} M={02}) //Read DPUSTAT register at address 0x02C to check whether the authentication passed or not REGRD(A={2c})
100
WWW.TI.COM
27 Packet Sniffing
Packet sniffing is a non-intrusive way of observing data that is either being transmitted or received by CC2520. The packet sniffer outputs a clock and a data signal which should be sampled on the rising edges of the clock. The two packet sniffer signals are observable as GPIO outputs. For accurate time stamping, the SFD signal should also be output. Because CC2520 only supports a data rate of 250kbps, the packet sniffer clock frequency is 250 kHz. The data is output serially with the MSB of each byte first, which is opposite of the actual RF transmission, but more convenient when processing the data. It is possible to use an SPI slave to receive the data stream. When sniffing frames in TX mode, the data that is read from the TX FIFO by the modulator is the same data that is output by the packet sniffer. However, if automatic CRC generation is enabled, the packet sniffer will NOT output these 2 bytes. Instead, it will replace the CRC bytes with 0x8080. This value can never occur as the last two bytes of a received frame (when automatic CRC checking is enabled), and thus it provides a way for the receiver of the sniffed data to separate frames that were transmitted by the CC2520 and frames that were received by the CC2520. When sniffing frames in RX mode, the data that is written to the RX FIFO by the demodulator is the same data that is output by the packet sniffer. In other words, the last two bytes are either the received CRC value or the CRC OK/RSSI/correlation/SRCRESINDEX value that may automatically replace the CRC value, depending on configuration settings. Note that in order to observe the packet sniffing data on GPIO pins, the packet sniffer module must be enabled in the MDMTEST1 register, and the correct GPIO configuration must be written to any of the GPIOn registers.
WWW.TI.COM
101
28 Registers
The table below shows the memory mapping for the configuration registers in CC2520. The FREG registers are accessible with the REGRD and REGWR instructions. Registers in address space 0x000 to 0x01F (marked with gray) are also accessible with the BSET and BCLR instructions. The SREG registers are only accessible with the MEMRD and MEMWR instructions. Please also refer to Figure 11: CC2520 memory map for information on the rest of the address range. Table 20: Register overview
Address (hex) +0x000 +0x001 FREG registers 0x000 0x004 0x008 0x00C 0x010 0x014 0x018 0x01C 0x020 0x024 0x028 0x02C 0x030 0x034 0x038 0x03C FRMFILT0 SRCSHORTEN0 SRCEXTEN0 FRMCTRL0 EXCFLAG0 EXCMASKA0 EXCMASKB0 EXCBINDX0 GPIOCTRL0 GPIOCTRL4 GPIOCTRL DPUSTAT TXPOWER FIFOPCTRL RSSI RXFIRST SREG registers 0x040 0x044 0x048 0x04C 0x050 0x054 0x058 0x05C 0x060 0x064-0x077 0x078 0x07C ACTBIST DPUBIST RAMBIST CHIPID EXTCLOCK FREQEST FSCTRL FSCAL2 AGCCTRL2 ADCTEST2 DACTEST0 PTEST0 DACTEST1 PTEST1 FSCAL3 AGCCTRL3 VERSION MDMCTRL0 RXCTRL FSCAL0 AGCCTRL0 ADCTEST0 MDMTEST0 ATEST RESERVED FSCAL1 AGCCTRL1 ADCTEST1 MDMTEST1 DACTEST2 MDMCTRL1 TXCTRL FSMCTRL RSSISTAT RXFIFOCNT TXFIFOCNT FRMFILT1 SRCSHORTEN1 SRCEXTEN1 FRMCTRL1 EXCFLAG1 EXCMASKA1 EXCMASKB1 EXCBINDX1 GPIOCTRL1 GPIOCTRL5 SRCMATCH SRCSHORTEN2 SRCEXTEN2 RXENABLE0 EXCFLAG2 EXCMASKA2 EXCMASKB2 EXCBINDY0 GPIOCTRL2 GPIOPOLARITY DPUCON FREQCTRL FSMSTAT0 CCACTRL0 FREQTUNE FSMSTAT1 CCACTRL1 EXCBINDY1 GPIOCTRL3 RXENABLE1 +0x002 +0x003
NOTE: When accessing unmapped addresses a MEMADDR_ERROR exception will be generated. This is valid for address space from 0x064 to 0x079 and addresses above 0x07F. Other unmapped addresses like i.e. 0x003 will not generate a MEMADDR_ERROR.
102
WWW.TI.COM
28.1 Register Settings Update This section contains a summary of the register settings that need to be updated from their default value. Note that these values must be written every time CC2520 has been in LPM2 and is being brought back to active mode. Table 21: Registers that need update from their default value
Register name TXPOWER CCACTRL0 MDMCTRL0 MDMCTRL1 Address (hex) 030 036 046 047 New value (hex) 32 F8 85 14 Description Set 0 dBm output power. Use only the values listed in Table 17 in this register. Raises the CCA threshold from about -108dBm to about 84 dBm input level. Makes sync word detection less likely by requiring two zero symbols before the sync word. Make it more likely to detect sync by removing the requirement that both symbols in the SFD must have a correlation value above the correlation threshold, and make sync word detection less likely by raising the correlation threshold. Adjust currents in RX related analog modules. Adjust currents in synthesizer. Adjust currents in VCO. Adjust target value for AGC control loop. Tune ADC performance. Tune ADC performance. Tune ADC performance.
3F 5A 2B 11 10 0E 03
28.2 Register Access Modes The Mode columns in the tables below show what kind of accesses that are allowed for each bit. Table 22 shows the meaning of the different alternatives. Table 22: Register bits access modes
Mode R W R0 R1 W1 W0 R* Description Read Write Read constant zero Read constant one Only possible to write one Only possible to write zero The value read is not the actual register value, but rather the value seen by the module. This is typically used where a configuration value may be generated automatically (through calibration, dynamic control etc.) or manually overridden with a register value. An example structure is shown below for the AGCCTRL2 register.
WWW.TI.COM
103
write_data
AGCCTRL2 register
LNA_CURRENT_OE
rf_input 1
LNA
AGC module
Figure 40: Example hardware structure for the R* register access mode.
104
WWW.TI.COM
28.3 Register Descriptions The heading for each register is built up according to the following pattern: <Register name>, A <address>, R <reset value>, <Short register description> FRMFILT0, A 0x000, R 0x0D, Frame filtering
Bit no. 7 6:4 Bit mnemonic Reset value 0 000 Mode R/W R/W Description Reserved. Always write 0 Used for filtering on the reserved part of the frame control field (FCF). FCF_RESERVED_MASK[2:0] is AND'ed with FCF[9:7]. If the result is non-zero, and frame filtering is enabled, the frame is rejected. Used for filtering on the frame version field of the frame control field (FCF). If FCF[13:12] (the frame version subfield) is higher than MAX_FRAME_VERSION[1:0], and frame filtering is enabled, the frame is rejected. 1
RESERVED FCF_RESERVED_MASK[2:0]
3:2
MAX_FRAME_VERSION[1:0]
11
R/W
PAN_COORDINATOR
R/W
Should be set high when the device is a PAN coordinator, to accept frames with no destination address (as specified in section 7.5.6.2 in 802.15.4(b)) 0 - Device is not PAN coordinator 1 - Device is PAN coordinator
FRAME_FILTER_EN
R/W
Enables frame filtering. When this bit is set, CC2520 will perform frame filtering as specified in section 7.5.6.2 of 802.15.4(b), third filtering level. FRMFILT0[6:1] and FRMFILT1[7:1] together with the local address information, define the behavior of the filtering algorithm. 0 - Frame filtering off. (FRMFILT0[6:1], FRMFILT1[7:1] and SRCMATCH[2:0] are don't care). 1 - Frame filtering on.
WWW.TI.COM
105
ACCEPT_FT_4TO7_RESERVED
ACCEPT_FT_3_MAC_CMD
R/W
Defines whether MAC command frames are accepted or not. MAC command frames have frame type = 011. 0 - Reject 1 - Accept
ACCEPT_FT_2_ACK
R/W
Defines whether acknowledgment frames are accepted or not. Acknowledgement frames have frame type = 010. 0 - Reject 1 - Accept
ACCEPT_FT_1_DATA
R/W
Defines whether data frames are accepted or not. Data frames have frame type = 001. 0 - Reject 1 - Accept.
ACCEPT_FT_0_BEACON
R/W
Defines whether beacon frames are accepted or not. Beacon frames have frame type = 000 0 - Reject 1 - Accept
2:1
MODIFY_FT_FILTER[1:0]
00
R/W
These bits are used to modify the frame type field of a received frame before frame type filtering is performed. The modification does not influence the frame that is written to the RX FIFO. 00 : Leave as it is 01 : Invert MSB 10 : Set MSB to 0 11 : Set MSB to 1
RESERVED
R/W
106
WWW.TI.COM
RESERVED[4:0] PEND_DATAREQ_ONLY
AUTOPEND
R/W
SRC_MATCH_EN
R/W
SHORT_ADDR_EN[7:0]
SHORT_ADDR_EN[15:8]
SHORT_ADDR_EN[23:16]
WWW.TI.COM
107
EXT_ADDR_EN[7:0]
EXT_ADDR_EN[15:8]
EXT_ADDR_EN[23:16]
108
WWW.TI.COM
APPEND_DATA_MODE
AUTOCRC
R/W
In TX: 1: A CRC-16 (ITU-T) is generated in hardware and appended to the transmitted frame. There is no need to write the two last bytes to TXBUF. 0: No CRC-16 is appended to the frame. The two last bytes of the frame must be generated manually and written to TXBUF (if not, TX_UNDERFLOW will occur).
In RX 1: The CRC-16 is checked in hardware, and replaced in the RX FIFO by a 16-bit status word which contains a CRC OK bit. The status word is controllable through APPEND_DATA_MODE 0: The last two bytes of the frame (crc-16 field) are stored in the RXFIFO. The CRC check (if any) must be done manually. Note that this setting does not influence acknowledgment transmission (including AUTOACK) 5
AUTOACK
R/W
Defines whether CC2520 automatically transmits acknowledge frames or not. When autoack is enabled, all frames that are accepted by address filtering, have the acknowledge request flag set and have a valid CRC, are automatically acknowledged 12 symbol periods after being received. 0 - Autoack disabled 1 - Autoack enabled
ENERGY_SCAN
R/W
Defines whether the RSSI register contains the most recent signal strength or the peak signal strength since the energy scan was enabled. 0 - Most recent signal strength 1 - Peak signal strength
3:2
RX_MODE[1:0]
00
R/W
Set RX modes 00: Normal operation, use RXFIFO. 01: Reserved 10: RXFIFO looping ignore overflow in RXFIFO, infinite reception. 11: Same as normal operation except that symbol search is disabled. Can be used for RSSI or CCA measurements when it is undesired to find symbol.
1:0
TX_MODE[1:0]
00
R/W
Set test modes for TX 00: Normal operation, transmit TXFIFO 01: Reserved. Should not be used. 10: TXFIFO looping ignore underflow in TXFIFO and read cyclic, infinite transmission. 11: Send pseudo random data from CRC, infinite transmission.
WWW.TI.COM
109
RESERVED PENDING_OR
IGNORE_TX_UNDERF
R/W
Defines whether TX underflow should be ignored or not. 0 - Normal TX operation. TX underflow is detected and TX is aborted if underflow occurs 1 - Ignore TX underflow. Transmit the number of bytes given by the length field.
SET_RXENMASK_ON_TX
R/W
Defines whether STXON will set bit 14 in the RXENABLE register or leave it unchanged. 0: Do not affect RXENABLE. 1: Set bit 14 in RXENABLE. Used for backwards compatibility with CC2420.
110
WWW.TI.COM
RXENMASK[7:0]
The following strobes can modify RXENMASK: SRXON: Set bit 15 in RXENMASK STXON: Set bit 14 in RXENMASK if SET_RXENMASK_ON_TX = 1 SRFOFF: Clears all bits in RXENMASK
The following instructions modifies RXENMASK: RXMASKAND : Performs a bitwise AND between RXENMASK and the 16 bit parameter given with the instruction RXMASKOR : Performs a bitwise OR between RXENMASK and the 16 bit parameter given with the instruction
RXENABLE can also be written and is bit accessible. BSET and BCLR set and clear any of the 16 bits in RXENMASK. SRXMASKBITSET and SRXMASKBITCLR will set and clear bit 13 in RXENMASK.
There are several sources which might try to modify RXENMASK simultaneously. To handle the case of simultaneous access to RXENMASK from different sources the following rules apply:
- If two sources are not in conflict (they modify different parts of the register) both their requests to modify RXENMASK will be processed. -Data bus has priority over all sources (BSET, BCLR, REGWR, MEMWR)
1 2 3 4 5 6 7
RXENMASK[15:8]
WWW.TI.COM
111
EXCFLAG[7:0]
EXCFLAG[15:8]
112
WWW.TI.COM
EXCFLAG[23:16]
EXCMASKA[7:0]
EXCMASKA[15:8]
EXCMASKA[23:16]
WWW.TI.COM
113
EXCMASKB[7:0]
EXCMASKB[15:8]
R/W
EXCMASKB[23:16]
RESERVED INSTRUCTIONX
BINDX_EN
RESERVED EXCEPTIONX
00 0x12
R0 R/W
Read as zero Exception for channel X Exception number to bind to an instruction. Se table in Exception overview for valid configurations
114
WWW.TI.COM
RESERVED INSTRUCTIONY
BINDY_EN
RESERVED EXCEPTIONY
0 0x12
R0 R/W
Read as zero Exception for channel Y Exception number to bind to an instruction. Se table in Exception overview for valid configurations
IN0
CTRL0
0x00
R/W
GPIO0 Configuration When output: mux selector. See GPIO description for table over all possible signals that can be set as output to the pin. When input: 4 LSBs chose one of 16 instructions to be triggered on the active edge of this GPIO input line. Values above 0x0F have no effect.
IN1
CTRL1
0x27
R/W
WWW.TI.COM
115
IN2
CTRL2
0x28
R/W
IN3
CTRL3
0x29
R/W
IN4
CTRL4
0x2A
R/W
IN5
CTRL5
0x10
R/W
RESERVED POLARITY
116
WWW.TI.COM
SC
GPIO_ACTRL
R/W
Controls analog functionality for GPIO[1:0]. When set both GPIO pin 0 and 1 will be set to analog pads. 0 - Disable analog pads 1 - Enable analog pads Set pull up enable individually on GPIO pads 0 through 5 Pull up is 20 kohm +/- 15% 0 - Pull up disabled 1 - Pull up enabled
5:0
GPIO_PUE
0x00
R/W
RESERVED RXTIMEOUT
RESERVED AUTHSTAT_H
AUTHSTAT_L
Authentication status, low priority Updated when a low priority UCBCMAC or UCCM instruction completes and keep result until a new instruction completes. Reports the result of the last run authentication operation. 0: Authentication check failed. 1: Authentication check passed or no authentication check was performed.
DPUH_ACTIVE
High Priority Active 0: No high priority DPU instruction is currently active. 1: A high priority DPU instruction is currently active.
DPUL_ACTIVE
Low Priority Active 0: No low priority DPU instruction is currently active. 1: A low priority DPU instruction is currently active.
WWW.TI.COM
117
RESERVED FREQ[6:0]
RESERVED XOSC32M_TUNE[3:0]
PA_POWER [7:0]
CAL_DONE
CAL_RUNNING
Frequency synth calibration status. 0 - Calibration done or not started 1 - Calibration in progress. Gives the current state of the FIFO and Frame Control (FFCTRL) finite state machine.
5:0
FSM_FFCTRL_STATE[5:0]
118
WWW.TI.COM
FIFO FIFOP
SFD
In TX: 0: When a complete frame with SFD has been sent or no SFD has been sent 1: SFD has been sent In RX: 0: When a complete frame has been received or no SFD has been received 1: SFD has been received
4 3 2 1 0
0 0 0 0 0
R R R R R
Clear channel assessment. Dependent on CCA_MODE settings. See CCACTRL1 for details. Contains a sampled value of the CCA. The value is updated whenever a SSAMPLECCA or STXONCCA strobe is issued '1' when PLL is in lock, otherwise '0'. Status signal, active when FFCTRL is in one of the transmit states Status signal, active when FFCTRL is in one of the receive states
RESERVED FIFOP_THR[6:0]
RESERVED SLOTTED_ACK
RX2RX_TIME_OFF
R/W
Defines whether or not a 12 symbol time out should be used after frame reception has ended. 0 - No time out. 1 - 12 symbol period time out.
WWW.TI.COM
119
CCA_THR[7:0]
RESERVED CCA_MODE[1:0]
2:0
CCA_HYST[2:0]
010
R/W
RSSI_VAL[7:0]
RESERVED RSSI_VALID
120
WWW.TI.COM
DATA[7:0]
RXFIFOCNT[7:0]
TXFIFOCNT[7:0]
CHIPID[7:0]
VERSION[7:0]
WWW.TI.COM
121
RESERVED EXTCLOCK_EN
EXT_FREQ
0x00
RW
Frequency setting of external clock. Changes of frequencies are glitch free and have 50/50 duty cycle. I.e. a change of frequency will not have effect before a complete period of the current clock setting is finished. Setting 00000 00001 00010 00011 00100 00101 00110 00111 01000 01001 01010 01011 01100 01101 01110 01111 10000 10001 10010 10011 10100 10101 10110 10111 11000 11001 11010 11011 11100 11101 11110 11111 Div. factor 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 2 Frequency [MHz] 1,00 1,03 1,07 1,10 1,14 1,19 1,23 1,28 1,33 1,39 1,45 1,52 1,60 1,68 1,78 1,88 2,00 2,13 2,29 2,46 2,67 2,91 3,20 3,56 4,00 4,57 5,33 6,40 8,00 10,67 16,00 16,00
122
WWW.TI.COM
DEM_NUM_ZEROS[1:0]
DEMOD_AVG_MODE
R/W
Defines the behavior or the frequency offset averaging filter. 0 - Lock average level after preamble match. Restart frequency offset calibration when searching for the next frame. 1 - Continuously update average level.
4:1
PREAMBLE_LENGTH [3:0]
0010
R/W
The number of preamble bytes (2 zero-symbols) to be sent in TX mode prior to the SFD, encoded in steps of 2. The reset value of 2 is compliant with IEEE 802.15.4 0000 - 2 leading zero bytes 0001 - 3 leading zero bytes 0010 - 4 leading zero bytes 1111 - 17 leading zero bytes
TX_FILTER
R/W
Defines what kind of TX filter that is used. The normal TX filter is as defined by the IEEE802.15.4 standard. Extra filtering may be applied in order to lower the out of band emissions. 0 - Normal TX filtering 1 - Enable extra filtering
RESERVED CORR_THR_SFD
CORR_THR[4:0]
0x0E
R/W
Demodulator correlator threshold value, required before SFD search. Threshold value adjusts how the receiver synchronizes to data from the radio. If threshold is set too low sync can more easily be found on noise. If set too high the sensitivity will be reduced but sync will not likely be found on noise. I combination with DEM_NUM_ZEROS the system can be tuned so sensitivity is high with less synch found on noise. NOTE This value should be changed to 0x14 before attempting RX. Testing has shown that too many false frames are received if the reset value is used.
WWW.TI.COM
123
FREQEST[7:0]
MODULATION_MODE
R/W
RESERVED
R/W
Do not write.
124
WWW.TI.COM
The following registers in the address range 0x04A to 0x07F are for performance tuning and test purposes and should generally not be written. The registers that require updates to give the performance described in this datasheet are listed in Table 21: Registers that need update from their default value. RXCTRL, A 0x04A, R 0x29, Test/tuning of RX modules FSCTRL, A 0x04C, R 0x55, Test/tuning of synthesizer FSCAL0, A 0x04E, R 0x24, Test/tuning of synthesizer FSCAL1, A 0x04F, R 0x29, Test/tuning of VCO FSCAL2, A 0x050, R 0x20, Test/tuning of VCO FSCAL3, A 0x051, R 0x2A, Test/tuning of VCO AGCCTRL0, A 0x052, R 0x5F, Test/tuning of AGC AGCCTRL1, A 0x053, R 0x0E, Test/tuning of AGC AGCCTRL2, A 0x054, R 0x00, Test/tuning of LNA AGCCTRL3, A 0x055, R 0x2E, Test/tuning of AGC and AAF ADCTEST0, A 0x056, R 0x66, Test/tuning of ADC ADCTEST1, A 0x057, R 0x0A, Test/tuning of ADC ADCTEST2, A 0x058, R 0x05, Test/tuning of ADC MDMTEST0, A 0x05A, R 0x05, Test/tuning of modem DACTEST0, A 0x05C, R 0x00, Test/tuning of DAC DACTEST1, A 0x05D, R 0x00, Test/tuning of DAC ATEST, A 0x05E, R 0x00, Controls analog test mode DACTEST2, A 0x05F, R 0x00, Test/tuning of DAC PTEST0, A 0x060, R 0x00, Test/tuning of power down signals PTEST1, A 0x061, R 0x00, Test/tuning of power down signals RESERVED, A 0x062, R 0x00, Not currently in use DPUBIST, A 0x07A, R 0x00, Test/tuning of DPU ROM ACTBIST, A 0x07C, R 0x00, Test/tuning of ACT ROM RAMBIST, A 0x07E, R 0x02, Test/tuning of RAM
WWW.TI.COM
125
NOTE: Page and figure numbers refer to the respective document revision.
126
WWW.TI.COM
PACKAGING INFORMATION
Orderable Device CC2520RHDR CC2520RHDRG4 CC2520RHDT CC2520RHDTG4
(1)
Pins Package Eco Plan (2) Qty 28 28 28 28 3000 Green (RoHS & no Sb/Br) 3000 Green (RoHS & no Sb/Br) 250 250 Green (RoHS & no Sb/Br) Green (RoHS & no Sb/Br)
The marketing status values are defined as follows: ACTIVE: Product device recommended for new designs. LIFEBUY: TI has announced that the device will be discontinued, and a lifetime-buy period is in effect. NRND: Not recommended for new designs. Device is in production to support existing customers, but TI does not recommend using this part in a new design. PREVIEW: Device has been announced but is not in production. Samples may or may not be available. OBSOLETE: TI has discontinued the production of the device.
(2)
Eco Plan - The planned eco-friendly classification: Pb-Free (RoHS), Pb-Free (RoHS Exempt), or Green (RoHS & no Sb/Br) - please check http://www.ti.com/productcontent for the latest availability information and additional product content details. TBD: The Pb-Free/Green conversion plan has not been defined. Pb-Free (RoHS): TI's terms "Lead-Free" or "Pb-Free" mean semiconductor products that are compatible with the current RoHS requirements for all 6 substances, including the requirement that lead not exceed 0.1% by weight in homogeneous materials. Where designed to be soldered at high temperatures, TI Pb-Free products are suitable for use in specified lead-free processes. Pb-Free (RoHS Exempt): This component has a RoHS exemption for either 1) lead-based flip-chip solder bumps used between the die and package, or 2) lead-based die adhesive used between the die and leadframe. The component is otherwise considered Pb-Free (RoHS compatible) as defined above. Green (RoHS & no Sb/Br): TI defines "Green" to mean Pb-Free (RoHS compatible), and free of Bromine (Br) and Antimony (Sb) based flame retardants (Br or Sb do not exceed 0.1% by weight in homogeneous material)
(3)
MSL, Peak Temp. -- The Moisture Sensitivity Level rating according to the JEDEC industry standard classifications, and peak solder temperature. Important Information and Disclaimer:The information provided on this page represents TI's knowledge and belief as of the date that it is provided. TI bases its knowledge and belief on information provided by third parties, and makes no representation or warranty as to the accuracy of such information. Efforts are underway to better integrate information from third parties. TI has taken and continues to take reasonable steps to provide representative and accurate information but may not have conducted destructive testing or chemical analysis on incoming materials and chemicals. TI and TI suppliers consider certain information to be proprietary, and thus CAS numbers and other limited information may not be available for release. In no event shall TI's liability arising out of such information exceed the total purchase price of the TI part(s) at issue in this document sold by TI to Customer on an annual basis.
Addendum-Page 1
Device
SPQ
Reel Reel A0 Diameter Width (mm) (mm) W1 (mm) 330.0 330.0 12.4 12.4 5.3 5.3
CC2520RHDR CC2520RHDT
3000 250
Pack Materials-Page 1
Pins 28 28
Pack Materials-Page 2
IMPORTANT NOTICE
Texas Instruments Incorporated and its subsidiaries (TI) reserve the right to make corrections, modifications, enhancements, improvements, and other changes to its products and services at any time and to discontinue any product or service without notice. Customers should obtain the latest relevant information before placing orders and should verify that such information is current and complete. All products are sold subject to TIs terms and conditions of sale supplied at the time of order acknowledgment. TI warrants performance of its hardware products to the specifications applicable at the time of sale in accordance with TIs standard warranty. Testing and other quality control techniques are used to the extent TI deems necessary to support this warranty. Except where mandated by government requirements, testing of all parameters of each product is not necessarily performed. TI assumes no liability for applications assistance or customer product design. Customers are responsible for their products and applications using TI components. To minimize the risks associated with customer products and applications, customers should provide adequate design and operating safeguards. TI does not warrant or represent that any license, either express or implied, is granted under any TI patent right, copyright, mask work right, or other TI intellectual property right relating to any combination, machine, or process in which TI products or services are used. Information published by TI regarding third-party products or services does not constitute a license from TI to use such products or services or a warranty or endorsement thereof. Use of such information may require a license from a third party under the patents or other intellectual property of the third party, or a license from TI under the patents or other intellectual property of TI. Reproduction of TI information in TI data books or data sheets is permissible only if reproduction is without alteration and is accompanied by all associated warranties, conditions, limitations, and notices. Reproduction of this information with alteration is an unfair and deceptive business practice. TI is not responsible or liable for such altered documentation. Information of third parties may be subject to additional restrictions. Resale of TI products or services with statements different from or beyond the parameters stated by TI for that product or service voids all express and any implied warranties for the associated TI product or service and is an unfair and deceptive business practice. TI is not responsible or liable for any such statements. TI products are not authorized for use in safety-critical applications (such as life support) where a failure of the TI product would reasonably be expected to cause severe personal injury or death, unless officers of the parties have executed an agreement specifically governing such use. Buyers represent that they have all necessary expertise in the safety and regulatory ramifications of their applications, and acknowledge and agree that they are solely responsible for all legal, regulatory and safety-related requirements concerning their products and any use of TI products in such safety-critical applications, notwithstanding any applications-related information or support that may be provided by TI. Further, Buyers must fully indemnify TI and its representatives against any damages arising out of the use of TI products in such safety-critical applications. TI products are neither designed nor intended for use in military/aerospace applications or environments unless the TI products are specifically designated by TI as military-grade or "enhanced plastic." Only products designated by TI as military-grade meet military specifications. Buyers acknowledge and agree that any such use of TI products which TI has not designated as military-grade is solely at the Buyer's risk, and that they are solely responsible for compliance with all legal and regulatory requirements in connection with such use. TI products are neither designed nor intended for use in automotive applications or environments unless the specific TI products are designated by TI as compliant with ISO/TS 16949 requirements. Buyers acknowledge and agree that, if they use any non-designated products in automotive applications, TI will not be responsible for any failure to meet such requirements. Following are URLs where you can obtain information on other Texas Instruments products and application solutions: Products Audio Amplifiers Data Converters DLP Products DSP Clocks and Timers Interface Logic Power Mgmt Microcontrollers RFID RF/IF and ZigBee Solutions www.ti.com/audio amplifier.ti.com dataconverter.ti.com www.dlp.com dsp.ti.com www.ti.com/clocks interface.ti.com logic.ti.com power.ti.com microcontroller.ti.com www.ti-rfid.com www.ti.com/lprf TI E2E Community Home Page e2e.ti.com Applications Communications and Telecom www.ti.com/communications Computers and Peripherals Consumer Electronics Energy and Lighting Industrial Medical Security Space, Avionics and Defense Transportation and Automotive Video and Imaging Wireless www.ti.com/computers www.ti.com/consumer-apps www.ti.com/energy www.ti.com/industrial www.ti.com/medical www.ti.com/security www.ti.com/space-avionics-defense www.ti.com/automotive www.ti.com/video www.ti.com/wireless-apps
Mailing Address: Texas Instruments, Post Office Box 655303, Dallas, Texas 75265 Copyright 2011, Texas Instruments Incorporated