Logic IC

MRF24XA

Texas Instruments

Low-Power, 2.4 GHz ISM-Band IEEE 802.15.4??RF Transceiver with Extended Proprietary Features

Manufacturer: Texas Instruments

Document: 250 Pages / 3Mb

Request Quote Download Datasheet Read online HTML view

More from Texas Instruments Browse M parts

Online Datasheet

Read MRF24XA online.

MRF24XA TI1 | Alldatasheet

Document overview

Manufacturer or author: Provided By ALLDATASHEET.COM(FREE DATASHEET DOWNLOAD SITE)
PDF pages: 250

Technical content

Features

IEEE 802.15.4™-2003 and IEEE 802.15.4-2006 Standard Compliant RF transceiver
Multiple air data rates: - 250 kbps (IEEE 802.15.4) - 125, 500, 1000, 2000 kbps, co-existence with standard networks
Configurable TX output power: -17.5 to 0 dBm
Frame header duration scales with the selected data rate
On-the-fly, per-frame air-data-rate detection (link-by-link independent air data rates)
Inferred destination addressing (to further save on framing overheads; optional) Full Featured MCU Support
Hardware frame parser
Hardware CSMA-CA controller, automatic acknowledgement (ACK) and Frame Check Sequence (FCS)
Supports all Clear Channel Assessment (CCA) modes
Reports ED, RSSI, LQI, and CFO
Channel Agility with acknowledgements
Two independent 128 byte frame buffers
Streaming mode to maximize throughput
Automatic Packet retransmit Capability
Hardware Security Engine (AES-128) and configurable Encryption/Decryption mode Low-Power
Extreme minimization of radio ON-time - Highest channel-admissible data rate used - 20%-70% overall reduction through framing
2 Mbps frames can reduce radio ON-time by a factor of 4 to 8 with respect to 250 kbps frames
25 mA TX current (typical at 0 dBm)
13.5 mA RX current in RX Listen Power-Saving mode
15.5-16.5 mA RX current in RX Packet Demodulation mode (data rate and device configuration dependent)
Deep Sleep, Sleep, Crystal ON, RX Listen Power-Saving modes
Memory retention in Deep Sleep (<40 nA typical)
Automated functions minimize MCU ON-time General
Low external component count
Best-in-class battery life preservation
Supply range: 1.5V to 3.6V
Compact 32-pin 5x5 mm 2 QFN package
Temperature range -40oC to +85oC
Certified turnkey-ready solutions available

Applications

IEEE 802.15.4/ZigBee ® systems (RF4CE, and so on)
Industrial monitoring and control
IEEE 1588 precise timing protocol networks
Automatic meter reading
Home building automation
Low-power wireless sensor networks
Consumer electronics, voice and audio Low-Power, 2.4 GHz ISM-Band IEEE 802.15.4™ RF Transceiver with Extended Proprietary Features

DS70005023B-page 2 Advanced  2011-2013 Microchip Technology Inc. Pin Diagram AVDD RFOUTP RFOUTN AVDD RFINP AVSS RFINN AVDD VREGOUT GPIO2 GPIO1 GPIO0 9 10 11 12 13 14 1516 AVSS RBIAS AVDD AVSS OSC2 OSC1 DVDDIO DVDD 32 31 30 29 28 27 26 25 SDI SDO RESET DVSS PA LNA MRF24XA VREGIN AVDD SCK INT CS AVSS

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 3 MRF24XA Table of Contents TO OUR VALUED CUSTOMERS It is our intention to provide our valued customers with the best documentation possible to ensure successful use of your Microchip products. To this end, we will continue to improve our publicat ions to better suit your needs. Our publications will be refined and enhanced as new volumes and updates are introduced. If you have any questions or comments regard ing this publication, please contact the Marketing Communications Department via E-mail at docerrors@microchip.com or fax the Reader Response Form in the back of this data sheet to (480) 792-4150. We welcome your feedback. Most Current Data Sheet To obtain the most up-to-date version of this data sheet, please register at our Worldwide Web site at: http://www.microchip.com You can determine the version of a data sheet by examining its literature number found on the bottom outside corner of any page. The last character of the literature number is the version number, (e.g., DS30000A is version A of document DS30000). Errata An errata sheet, describing minor operational differences from the data sheet and recommended workarounds, may exist for current devices. As device/documentation issues become known to us, we will publish an errata sheet. The errata will specify the revision of silicon and revision of document to which it applies. To determine if an errata sheet exists for a particular device, please check with one of the following:

Microchip’s Worldwide Web site; http://www.microchip.com
Your local Microchip sales office (see last page) When contacting a sales office, please specify which device, revision of silicon and data sheet (include literature number) you are using. Customer Notification System Register on our web site at www.microchip.com to receive the most current information on all of our products.

DS70005023B-page 4 Advanced  2011-2013 Microchip Technology Inc. NOTES:

 2011-2013 Microchip Technology Inc. Advance DS70005023B-page 5 MRF24XA

1.0 DEVICE OVERVIEW

MRF24XA is an IEEE 802.1 5.4™ Standard compliant 2.4 GHz RF transceiver with feature extensions. MRF24XA integrates the PHY and MAC functionality in a single chip solution. MRF24XA implements a low- cost, low-power, high data rate (125 kbps to 2 Mbps) Wireless Personal Area Network (WPAN) device. All the data rates have the same spectral shape requiring identical bandwidth. At 125 kbps data rate Direct Sequence Spread Spectrum (DSSS) is combined with error correction and coding for maximum range and robustness against interference. The 2 Mbps data rate can be used to minimize radio ON-time, therefore extending battery life. Figure 1-1 illustrates a simplified block diagram of a MRF24XA wireless node. MRF24XA interfaces to many popular Microchip PIC microcontrollers through a 4-wire serial SPI interface, interrupt, GPIO, and RESET pins. MRF24XA can also handle external Power Amplifier (PA) and Low Noise Amplifier (LNA). MRF24XA provides hardware support for:

Energy detection
Carrier sense
Four CCA modes
CSMA-CA algorithm
Automatic packet retransmission
Automatic acknowledgement
Independent transmit and receive buffers
Security engine supports encryption and decryption for MAC sublayer and upper layer
Inferred destination addressing
Channel agility with ACKs
Battery monitoring These features reduce the processing load, allowing the use of low-cost 8-bit microcontrollers. MRF24XA is compatible with Microchip’s ZigBee MiWi™ and MiWi P2P software stacks. Each software stack is available as a free download, including source code, from the Microchip web site: http://www.microchip.com/wireless. FIGURE 1-1: MRF24XA WIRE LESS NODE BLOCK DIAGRAM PHY MAC Interface Power Management CS SDI SDO SCK INT RESET RFOUTP RFOUTN RFINP RFINN IO SDO SDI SCK INTX IO MRF24XA PIC MCU Matching network

16 MHz

DS70005023B-page 6 Advance  2011-2013 Microchip Technology Inc. NOTES:

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 7 MRF24XA

2.0 HARDWARE DESCRIPTION

2.1 Overview

MRF24XA is an IEEE 802.15.4 Standard compliant

2.4 GHz RF transceiver wit h extended feature set for

longer battery life, hig her throughput and increased operating range. MRF24XA integrates the PHY and MAC functionality in a single chip solution. Figure 2-1 illustrates a block diagram of the MRF24XA circuitry. The frequency synthesizer is clocked by an external 16 MHz crystal and generates a 2.4 GHz frequency RF carrier. The receiver is a zero-IF ar chitecture consisting of a Low Noise Amplifier, down conversion mixers, channel filters and baseband amplifiers with a Received Signal Strength Indicator (RSSI). The transmitter is a direct conversion architecture with a 0 dBm maximum output (typical) and 17.5 dB power control range. The internal transmitter and receiver circuits have separate RFP and RFN input/output pins. These pins are connected to impedance matching circuitry (balun) and antenna. An external Power Amplifier and/or Low Noise Amplifier can be controlled through the PA and LNA pins. Three general purpose Input/Output (GPIO) pins can be configured for control or monitoring purposes. The power management circuitry consists of an integrated Low Dropout (LDO) voltage regulator and a 5-bit resolution Battery Monitor Block. MRF24XA can be placed into a low-current (<40 nA typical) Deep Sleep mode. The Media Access Controller (MAC) circuitry can sequence the transmit, receive and enable the security operations automatically. The host MCU has detailed control over these mechanisms through register configurations and by the Frame Control (FCtrl) field embedded in the downloaded formatted frames. Three alternative frame formats are supported: IEEE 802.15.4 2003, 2006 compliant MAC frame formats and a flexible and power-efficient advanced MAC frame format, which is proprietary. Before launching transmission, the host must load the buffer with a formatted frame. The hardware can optionally perform encryption and message integrity code appending as configured, then sends the frame appending a Frame Check Sequence (FCS). Acknowledge reception and automatic retransmissions can be sequenced autonomously by the hardware. In reception, the format of the demodulated frame is verified. Depending on t he configurati on, duplicate frames, frames with co rrupted FCS or address mismatch can be discarded. On reception of valid frames, automatic acknowledge sending, decryption and message integrity checking are supported. By default, separate buffers are reserved for transmission and reception. Alternatively, either the Transmit Streaming (TX-St reaming) or the Receive Streaming (RX-Streaming) modes can be selected, whereby buffers are used in ping-pong for servicing a single direction of data flow. The AES-128 engine can be governed to perform network-layer security processing and supports complete security suites such as CTR, CBC-MAC and CCM*. Transceiver can be controlled through a 4-wire SPI, interrupt and RESET pins.

2.2 Operating Modes

Table 2-1 summarizes the operating modes of MRF24XA. TABLE 2-1: MRF24XA POWER MODES Operating Mode Internal Functional Blocks 1.2V LDO Crystal Oscillator Synthesizer RX Front End RX Baseband TX Chain Deep Sleep OFF OFF OFF OFF OFF OFF Sleep ON OFF OFF OFF OFF OFF RFOFF Crystal ON ON ON OFF OFF OFF OFF RFOFF Synthesizer ON ON ON ON OFF OFF OFF RX Listen Power-Save ON ON ON ON OFF OFF RX Listen ON ON ON ON ON OFF TX ON ON ON OFF OFF ON

DS70005023B-page 8 Advanced  2011-2013 Microchip Technology Inc.

2.3 Block Diagram

FIGURE 2-1: MRF24XA ARCH ITECTURE BLOCK DIAGRAM

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 9 MRF24XA

2.4 Pin Descriptions

TABLE 2-2: MRF24XA PIN DESCRIPTIONS Pin Symbol Type Description 1A V DD Power 1.2V supply, normally connected to VREGOUT (pin 29) 2R F O U T P AO Differential RF Output (+) 3R F O U T N AO Differential RF Output (–) 4A V DD Power 1.2V supply, normally connected to VREGOUT (pin 29) (1) 5R F I N P AI Differential RF Input (+) 6A V SS Ground Ground 7R F I N N AI Differential RF Input (–) 8A V DD Power 1.2V supply, normally connected to VREGOUT (pin 29) 9A V SS Power Ground (1)

10 GPIO2 DIO GPIO2

11 GPIO1 DIO GPIO1

12 GPIO0 DIO GPIO0

13 INT DO Interrupt Output, active low

14 CS DI SPI Chip Select Pin, active low

15 SCK DI SPI serial clock

16 SDI DI SPI serial data Input

17 SDO DO SPI serial data Output

18 RESET

DI Reset Input, active low

19 DV SS Ground Digital ground

20 PA DO External PA enable Output

21 LNA DO External LNA enable Output

22 DV DD Power Digital 1.2V supply, normally connected to VREGOUT (pin 29) 23 DV DDIO Power Digital 1.5V – 3.6V supp ly for the IO blocks, normally connected to VREGIN (pin 30)

24 OSC1 AI Crystal oscillator Pin 1, External Clock Input

25 OSC2 AO Crystal oscillator Pin 2

27 AV DD Power 1.2V supply, normally connected to VREGOUT (pin 29)

28 RBIAS AO External resistor reference pin

29 VREGOUT Power 1.2V regulated Output 30 VREGIN Power 1.5V – 3.6V regulator Input 31 AV SS Ground Ground 32 AV DD Power 1.2V supply, normally connected to VREGOUT (pin 29) Legend: A = Analog, D = Digital, I = Input, O = Output Note 1: In case of running out of PCB space, pin 4 and pin 9 can be left unconnected.

DS70005023B-page 10 Advanced  2011-2013 Microchip Technology Inc.

2.4.1 POWER AND GROUND PINS

Recommended bypass capacitors are listed in Table 2-3. VDD pins 29 and 30 are power pins which require different bypass capacitors to ensure sufficient bypass decoupling and stability. Bypass capacitors must have low serial resistance. The 4.7 µF capacitors should be made of ceramic or high performance tantalum. On PCB layout minimize trace length from the VDD pin to the bypass capacitors and connect capacitors to the pads as short as possible. PCB tracks must be wide enough to minimize voltage drop and serial inductance of the power line. Analog and digital power lines must follow a star topol- ogy, where the common point is the bypass capacitor on pin 30. 2.4.2 16 MHz MAIN OSCILLATOR PINS The 16 MHz oscillator is connected to OSC1 and OSC2 pins as shown in Figure 2-2, which provides the reference frequency for the internal RF, MAC and BB circuitry. The crystal parameters are listed in Table 2-4. To minimize parasitic effects on pins, the crystal must be put as close as possible to MRF24XA. It keeps the tracks short. Crystal must be surrounded with ground pour to minimize cross coupling effects. Crystal load capacitors must be placed close to the crystal. TABLE 2-3: RECOMMENDED BYPASS CAPACITOR VALUES VDD Pin Symbol Bypass Capacitor 1A V DD 3.3 pF 4A V DD 3.3 pF 8A V DD 3.3 pF 22 DV DD 3.3 pF 23 DVDDIO 3.3 pF 27 AV DD 3.3 µF 29 VREGOUT 4.7 μF 30 VREGIN 10 nF + 4.7 µF 32 AV DD 3.3 pF TABLE 2-4: 16 MHz CRYSTAL PARAMETERS (1) Parameters Value Frequency 16 MHz Frequency tolerance for 500, 250 and 125 kbps data rates (including manufac- turing aging and temperature) ±60 ppm(1) Frequency tolerance for 2 and 1 Mbps data rates (including manufacturing aging and temperature) ±40 ppm(2) Mode Fundamental Load Capacitance 27 pF ESR 80 Ohm max Note 1: IEEE 802.15.4 defines ±40 ppm. 2: These values are for design guidance only.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 11 MRF24XA FIGURE 2-2: 16 MHz MAIN OSCILLATOR CRYSTAL CIRCUIT

2.4.3 RESET (RESET ) PIN

An external hardware Reset can be performed by asserting the RESET pin 18 low. By de-asserting the RESET pin, MRF24XA will start the internal calibration process. RDYIF interrupt is set when the device is ready to use. The RESET pin has an internal weak pull-up resistor.

2.4.4 INTERRUPT (INT ) PIN

The Interrupt (INT) pin 13 provides an interrupt signal to the host MCU from MRF24XA. The signal is active low polarity. Interrupt sources must be enabled and unmasked before the INT pin is active. Refer to Section 3.2 “Interrupts” for the functional description of interrupts.

2.4.5 GENERAL PURPOSE INPUT/

OUTPUT (GPIO) PINS Three GPIO pins can be configured individually for control or monitoring purposes. Input or output selection is con- figured by the TRISGPIOx bits in the GPIO register (0x0D). GPIO data can be read or written through the GPIO bits of GPIO register. The GPIO interrupt polarity can be selected through GPIOxP bits in the STGPIO (0x0E) register. GPIO lines in Input mode can be used in Schmitt Trigger Input mode. Schmitt Triggers can be enabled by STENGPIOx bits of STGPIO register. GPIOs can also be used to monitor the internal blocks. These monitoring functions can be selected by the GPIOMODE bits <3:0> of the PINCON (0x0C) register.

2.4.6 SERIAL PERIPHERAL INTERFACE

(SPI) PORT PINS MRF24XA communicates with a host MCU through a 4-wire SPI port as a slave device. MRF24XA supports SPI mode 0,0 which requires that SCK idles in a low state. The CS pin must be held low while communicat- ing with MRF24XA. Figure 2-3 illustrates timing for a read and a write operation. Data is received by MRF24XA through the SDI pin and is clocked in on the rising edge of SCK. Data is sent by MRF24XA through the SDO pin and is clocked out on the falling edge of SCK. The SDO lines preserve its HiZ state in Deep Sleep mode.

DS70005023B-page 12 Advanced  2011-2013 Microchip Technology Inc.

2.5 Application Example

Figure 2-3 illustrates the schematic of a recommended application circuit for MRF24XA. FIGURE 2-3: MRF24XA APPLICATION CIRCUIT

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 13 MRF24XA

2.6 Memory Organization

Memory is functionally divided into Special Function Registers (SFR) and data buffers, as shown in Table 2-5. The SFRs provide control, status and device configura- tion addressing for MRF24XA operations. Data buffers serve as temporary buffers for data transmission and reception. Memory is accessed through two addressing methods: Short (1 byte) and Long (2 bytes).

2.6.1 ADDRESS OVERVIEW

Two addressing modes in MRF24XA are:

Short Address Mode: Requires one byte for address, and may be used to access the first 64 on-chip control registers.
Long Address Mode: Requires two bytes for address, and may be used to access all on-chip registers and data buffers. These modes are illustrated in Figure 2-4. TABLE 2-5: MRF24XA MEMORY MAP SYSTEM LEVEL MAC PHY TX and EXTDEV MAC PHY DATA BUFFER 1 DATA BUFFER 2 RESERVED 0x00 ... 0x0F 0x39 0x3A ... 0x30 0x2F ... 0x10 0x3F ... 0x40 ... 0x60 0x70 0x284 0x285 ... 0x200 0x1FF 0x2FF ... 0x385 0x384 0x300 0x3FF ... ... Short AddressingLong Addressing Retained in Deep Sleep PIR4 (0x07) PIE1 (0x08) RESERVED RESERVED ...

DS70005023B-page 14 Advanced  2011-2013 Microchip Technology Inc. TABLE 2-6: SHORT ADDRESS REGI STER SUMMARY FOR MRF24XA Architecture Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 SYSTEM LEVEL 0x00 REGRST r rR E G R S T < 5 : 0 > 0x01 FSMRST r r rF S M R S T < 4 : 0 > 0x02 OPSTATUS r MACOP<3:0> RFOP<2:0> 0x03 STATUS INITDONESF XTALSF REGSF CALST XTALDIS DSLEEP IDLESF POR 0x04 PIR1 VREGIF r RDYIF IDLEIF r CALSOIF CALHAIF r 0x05 PIR2 TXIF TXENCIF TXMAIF TXACKIF TXCSMAIF TXSZIF TXOVFIF FRMIF 0x06 PIR3 RXIF RXDECIF RXTAGIF r RXIDENTIF RXFLTIF RXOVFIF STRMIF 0x07 PIR4 TXSFDIF RXSFDIF ERRORIF WA RNIF EDCCAIF GPIO2IF GPIO1IF GPIO0IF 0x08 PIE1 r r RDYIE IDLEIE r CALSOIE CALHAIE r 0x09 PIE2 TXIE TXENCIE TXMAIE TXACKIE TXCSMAIE TXSZIE TXOVFIE FRMIE 0x0A PIE3 RXIE RXDECIE RXTAGIE r RXIDENTIE RXFLTIE RXOVFIE STRMIE 0x0B PIE4 TXSFDIE RXSFDIE ERRORIE WARNIE EDCCAIE GPIO2IE GPIO1IE GPIO0IE 0x0C PINCON rG I E r IRQIF GPIOMODE<3:0> 0x0D GPIO GPIOEN TRISGPIO2 TRISGPIO1 TRISGPIO0 r GPIO2 GPIO1 GPIO0 0x0E STGPIO r GPIO2P GPIO1P GPIO0P r STENGPIO2 STENGPIO1 STENGPIO0 0x0F PULLGPIO r PULLDIRGPIO2 PULLDIRGPIO1 PULLDIRGPIO0 r PULLENGPIO2 PULLENGPIO1 PULLENGPIO0 MAC 0x10 MACCON1 TRXMODE<1:0> ADDRSZ<2:0> CRCSZ FRMFMT SECFLAGOVR 0x11 MACCON2 CH<3:0> SECSUITE<3:0> 0x12 TXCON TXST DTSM TXENC TXBUFEMPTY CSMAEN DR<2:0> 0x13 RXACKWAIT RXACKWAIT<7:0> 0x14 RETXCOUNT RETXMCNT<3:0> RETXCCNT<3:0> 0x15 RXCON1 RXEN NOPA RXDEC RXVLQIEN RSVRSSIEN RSVCHDREN RSVCFOEN r 0x16 RXCON2 RXBUFFUL IDENTREJ ACKRXFP ACKTXFP AUTORPTEN AUTOACKEN ADPTCHEN ADPTDREN 0x17 TXACKTO TXACKTO<7:0> 0x18 RXFILTER PANCRDN CRCREJ CMDREJ DATAREJ UNIREJ NOTMEREJ BCREJ NSTDREJ 0x19 TMRCON BOMCNT<2:0> BASETM<4:0> 0x1A CSMABE MAXBE<3:0> MINBE<3:0> 0x1B BOUNIT BOUNIT<7:0> 0x1C STRMTOL STRMTO<7:0> 0x1D STRMTOH STRMTO<15:8> 0x1E OFFTM OFFTM<7:0> Legend: r = Reserved, read as ‘0’.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 15 MRF24XA 0x1F ADDR1 ADDR<7:0> 0x20 ADDR2 ADDR<15:8> 0x21 ADDR3 ADDR<23:16> 0x22 ADDR4 ADDR<31:24> 0x23 ADDR5 ADDR<39:32> 0x24 ADDR6 ADDR<47:40> 0x25 ADDR7 ADDR<55:48> 0x26 ADDR8 ADDR<63:56> 0x27 SHADDRL SHADDR<7:0> 0x28 SHADDRH SHADDR<15:8> 0x29 PANIDL PANID<7:0> 0x2A PANIDH PANID<15:8> 0x2B SECHDRINDX r SECHDRINDX<6:0> 0x2C SECPAYINDX r SECPAYINDX<6:0> 0x2D SECENDINDX r SECENDINDX<6:0> 0x2E MACDEBUG BUF1TXPP BUF2TXPP BUF1RXPP BUF2RXPP TXRDBUF RXWRBUF BUSRDBUF BUSWRBUF PHY 0x2F CCACON1 CCABUSY CCAST RSSITHR<5:0> 0x30 CCACON2 CCATHR<3:0> CCALEN<1:0> CCAMODE<1:0> 0x31 EDCON r r EDMODE EDST EDLEN<3:0> 0x32 EDMEAN EDMEAN<7:0> 0x33 EDPEAK EDPEAK<7:0> 0x34 CFOCON CFOTX<3:0> CFORX<3:0> 0x35 CFOMEAS CFOMEAS<7:0> 0x36 RATECON DIS2000 DIS1000 DIS500 DIS250 DISSTD DIS125 OPTIMAL PSAV 0x37 POWSAVE DESENS<3:0> PSAVTHR<3:0> 0x38 BBCON RNDMOD AFCOVR RXGAIN<1:0> PRMBHLD PRMBSZ<2:0> 0x39 IFGAP r r rI F G A P < 4 : 0 > TX AND EXTDEV 0x3A TXPOW CHIPBOOST<2:0> TXPOW<4:0> 0x3B TX2IDLE r r rT X 2 I D L E < 4 : 0 > 0x3C TX2TXMA r r rT X 2 T X M A < 4 : 0 > 0x3D EXTPA r EXTPA_P PAEN PA2TXMA<4:0> 0x3E EXTLNA r EXTLNA_P LNAEN LNADLY<4:0> 0x3F BATMON r r BATMONPD BATMON<4:0> Legend: r = Reserved, read as ‘0’. TABLE 2-6: SHORT ADDRESS REGISTER SUMMARY FOR MRF24XA (CONTINUED) Architecture Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0

DS70005023B-page 16 Advanced  2011-2013 Microchip Technology Inc. TABLE 2-7: LONG ADDRESS REGISTER SUMMARY FOR MRF24XA Address Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 MAC 0x40 SECKEY1 SECKEY<7:0> 0x41 SECKEY2 SECKEY<15:8> 0x42 SECKEY3 SECKEY<23:16> 0x43 SECKEY4 SECKEY<31:24> 0x44 SECKEY5 SECKEY<39:32> 0x45 SECKEY6 SECKEY<47:40> 0x46 SECKEY7 SECKEY<55:48> 0x47 SECKEY8 SECKEY<63:56> 0x48 SECKEY9 SECKEY<71:64> 0x49 SECKEY10 SECKEY<79:72> 0x4A SECKEY11 SECKEY<87:80> 0x4B SECKEY12 SECKEY<95:88> 0x4C SECKEY13 SECKEY<103:96> 0x4D SECKEY14 SECKEY111:104> 0x4E SECKEY15 SECKEY<119:112> 0x4F SECKEY16 SECKEY<127:120> 0x50 SECNONCE1 SECNONCE<7:0> 0x51 SECNONCE2 SECNONCE<15:8> 0x52 SECNONCE3 SECNONCE<23:16> 0x53 SECNONCE4 SECNONCE<31:24> 0x54 SECNONCE5 SECNONCE<39:32> 0x55 SECNONCE6 SECNONCE<47:40> 0x56 SECNONCE7 SECNONCE<55:48> 0x57 SECNONCE8 SECNONCE<63:56> 0x58 SECNONCE9 SECNONCE<71:64> 0x59 SECNONCE10 SECNONCE<79:72> 0x5A SECNONCE11 SECNONCE<87:80> 0x5B SECNONCE12 SECNONCE<95:88> 0x5C SECNONCE13 SECNONCE<103:96> 0x5D SECENCFLAG SECENCFLAG<7:0> 0x5E SECAUTHFLAG SECAUTHFLAG<7:0> 0x5F r PHY 0x60 SFD1 SFD1<7:0> 0x61 SFD2 SFD2<7:0> 0x62 SFD3 SFD3<7:0> 0x63 SFD4 SFD4<7:0> 0x64 SFD5 SFD5<7:0> 0x65 SFD6 SFD6<7:0> 0x66 SFD7 SFD7<7:0> 0x67 r 0x68 r 0x69 r 0x6A r 0x6B r 0x6C r 0x6D r 0x6E SFDTO SFDTIMEOUT<7:0> 0x7F r

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 17 MRF24XA

2.6.2 ADDRESS

When Short Addressing mode is used, the address field is 6 bits wide to reduce framing overhead while accessing the mostly active registers (0x00..0x3F). In Long Addressing mode the address field is 10 bits wide (0x00..0x3FF) thus all the address is available for SPI operation.

2.6.3 AUTOMATIC TX START FEATURE

When a write to TRXBUF is done using Long Address- ing mode, and the 3rd bit of Byte 2 is set, the TXST bit will automatically be set after the CS pin is released, and MRF24XA sends the packet.

2.6.4 AUTOMATIC BUFFER FLUSH

When a read from TRXBUF is done using Long Addressing mode, and the 3rd bit of Byte 2 is set, the BUFFULL bit will automatically be cleared after the CS pin is negated.

2.6.5 ADDRESS AUTO-INCREMENT

After the starting address has been loaded, the first byte of data is read from or written to this address. The second byte (assuming the CS pin is not negated between bytes) is read from or written to the starting address plus one, and so on. If the memory map end is reached, the effective address will roll over to the beginning of the memory map. It is the sole respon sibility of the software to handle this situation correctly. Figure 2-4 illustrates the available address modes. FIGURE 2-4: SPI FRAMING TYPES

DS70005023B-page 18 Advanced  2011-2013 Microchip Technology Inc.

2.7 Register Details

REGISTER 2-1: OPSTATUS (OPERATION STATUS) (3) R-0 R/HS/HC-0 R/HS/HC-0 R/HS/HC-0 R/H S/HC-0 R/HS/HC-0 R/HS/HC-0 R/HS/HC-0 r MACOP<3:0> RFOP<2:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 Reserved: Maintain as ‘0’ bit 6-3 MACOP<3:0>: MAC Operation Register bits(1, 2) Provides status information on the current MAC state machine state. Encoding on MACOP<3:1>: 111 = Transmitting Acknowledge (TXACK) 110 = Receiving a packet (RXBUSY) 101 = Receiver listening to the channel waiting for packet (RX) 100 = Receiving (or waiting for) Acknowledge (RXACK) 011 = Transmitting a packet (TX) 010 = Performing Clear Channel Assessment (CCA) 001 = Back-off before repeated CCA (BO) 000 = MAC does not perform any operation (IDLE) bit 2-0 RFOP<2:0>: Radio Operation Register bits Provides status information on the current radio state. Encoding on RFOP<2:0>: 111 = TX with external PA is turned on (TX+PA) 110 = RX with external LNA is turned on (RX+LNA) 101 = Synthesizer and external PA or LNA is turned on (SYNTH+PA/LNA) 100 = Radio is calibrating if CALST has been set by the host MCU, otherwise device malfunction (CAL/MAL) 011 = Analog transmit chain is activated (TX) 010 = Analog receiver chain is active (RX). Digital may be partially shut off 001 = Synthesizer is steady or ramping up or channel change is issued (SYNTH) 000 = Only the crystal oscillator is ON (OFF), (except when XTALSF = 1) Note 1: GPIO<2:0> can be dedicated to output MACOP<3:1> or RFOP<2:0>. Refer to the PINCON register, which speci- fies the pin configuration. 2: MACOP<0> is connected to the RXBUFFUL register bit. It cannot be output over GPIO’s. 3: The OPSTATUS register is sent on the SDO pin during the first byte of the SPI operation.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 19 MRF24XA REGISTER 2-2: STATUS (DEVICE STATUS) R/HS R/HS R/HS R/W/HC-0 R/W-0 R/W-0 R/HS R/W/HC INITDONESF XTALSF REGSF CAL ST DSLEEP XTALDIS IDLESF POR bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 INITDONESF: Device Initialization Status Flag bit Indicates that the ready state has been reached since the LDO is on, (that is, since VREGIF = 1). INITDONESF is asserted when RDYIF is set for the first time after VREGIF. This bit is cleared only on reset (POR, DEVFRST and PINRST). bit 6 XTALSF: Crystal Status Flag bit XTALSF = 1, indicates that 16 MHz system clock (from t he crystal oscillator) is active. This bit is cleared either when XTALDIS is set or reset (POR, DEVFRST, PINRST). XTALSF = 0, indicates that the crystal oscillator is either powered off (XTALDIS = 1) or is ramping up or has not stabilized yet, and the system clock is inactive. bit 5 REGSF: Configuration Registers Status Flag bit REGSF = 1 indicates that all the 1.2V register content is valid. Either because it holds the default value after reset, and the retention memory does not hold any data to restore, or because the reg- ister configurations have already been restored from the retention memory. REGSF = 0 indicates that registers from 0x08-0x6E are not valid because wake-up procedure from Deep Sleep mode have not finished the register restore operation yet. This bit is cleared only on Reset (POR, DEVFRST, PINRST). bit 4 CALST: Calibration Start bit MCU sets this bit to start calibration procedure after a CALSOIF or CALHAIF interrupt occurred. MCU may not clear it to abort calibration. CALST is cleared by the device when the calibration has com- pleted (CALHAIF = 0 indicates success, CALHAIF = 1 indicates failure). Issuing CALST operation without CALHAIF/CALSOIF will terminate without any effect on the device. bit 3 DSLEEP: Deep-Sleep bit MCU sets this bit to send the device into deep sleep state. Following DSLEEP = 1, the SPI access to the SFR is shut off, and the SPI pins must be quite, unless the host MCU wants to wake-up the device. When DSLEEP is set, the device transitions through register backup (taking cca. 16 µs) before LDO is powered off. bit 2 XTALDIS: Crystal Disable bit MCU sets this bit to send the device into XTAL OFF state (reachable from ready state). XTALSF gets cleared automatically. The SPI register access can be performed when crystal is not working. bit 1 IDLESF: Idle Status Flag bit Indicates device idle state when all of the following bits are de-asserted:

TXBUFEMPTY = 0 since it is transmitted (TXST)
Network layer security finished (TXENC)
Crypto engine finished (RXDEC)
Energy detect operation finished (EDST)
Clear Channel Assessment finished (CCAST) bit 0 POR: Power-on-Reset Flag bit Cleared by host MCU to be able to sense a Brown-out Reset (BOR). Settable for software testing.

DS70005023B-page 20 Advanced  2011-2013 Microchip Technology Inc. REGISTER 2-3: PIR1 (PERIPHERAL INTERRUPT REGISTER 1) R/HS-1 R-0 R/HS-0 R/W/HC-0 R -0 R/W/HS-0 R/W/HS-0 R-0 VREGIF r RDYIF IDLEIF r CALSOIF CALHAIF r bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 VREGIF: Voltage Regulator On Interrupt Flag bit This is a non-persistent bit. The re gister bit is initialized to one on 1.2V reset except for PINRESET and cleared only when PIR1 is read. Note that the corresponding IE bit is not implemented(1). bit 6 Reserved: Maintain as ‘0’ bit 5 RDYIF: Ready State Interrupt Flag bit Set each time when ready state is reached:

when calibration ended (CALST = 0)
when initialization ended (INITDONESF = 1)
when crystal is ramped up (XTALSF = 1) This bit is cleared, when PIR1 is read. bit 4 IDLEIF: Idle State Interrupt Flag bit Set each time when IDLESF is set and only if it was not triggered by the MCU. Not changed when MCU aborts an action by clearing either of TXST, TXENC, RXDEC or EDST bits. This bit is cleared, when PIR1 is read. bit 3 Reserved: Maintain as ‘0’ bit 2 CALSOIF: Calibration Soft Interrupt Flag bit CALSOIF = 1 indicates that calibration is probably needed (CALST) although the radio is still functional. It also warns of a possible deg radation in signal quality and consumption, and a risk of CALHAIF interrupt. This bit is cleared, when PIR1 is read. bit 1 CALHAIF: Calibration Hard Interrupt Flag bit CALHAIF = 1 indicates that immediate calibration (CALST) is mandatory, otherwise the radio is not functional. The device enters into malfunction state. This bit is cleared, when PIR1 is read. bit 0 Reserved: Maintain as ‘0’ Note 1: Generated non-maskable interrupt is gated off until the 1.2V reset is released.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 21 MRF24XA REGISTER 2-4: PIR2 (PERIPHERAL INTERRUPT REGISTER 2) R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 TXIF TXENCIF TXMAIF TXACKIF TXCSMAIF TXSZIF TXOVFIF FRMIF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 TXIF: Transmission Done Interrupt Flag bit The current TX operation (TXST) has successfully completed. This event is not changed when a hardware generated ACK packet has completed transmission or when a packet has been repeated. Non-persistent, cleared by SPI read. bit 6 TXENCIF: Transmit Encryption Interrupt Flag bit The TX packet was successfully encrypted and/or complemented with a Message Integrity Code (MIC). Set by the device after TXENC = 1, when TXENC is cleared. Non-persistent, cleared by SPI read. bit 5 TXMAIF: Transmitter Medium Access Interrupt Flag bit Set by the device when the medium is accessed, th at is, when the first sample in the preamble is transmitted on air. Non-persistent, cleared by SPI read. bit 4 TXACKIF: Transmission Unacknowledged Failure Interrupt Flag bit Set by the device when Acknowledge is not received after the configured maximum number of trans- mission retries RETXMCNT<3:0>, provided that t he frame control field of the transmitted frame indicates AckReq = 1. Non-persistent, cleared by SPI read. bit 3 TXCSMAIF: Transmitter CSMA Failure Interrupt Flag bit Set by the device when CSMA-CA finds the chan nel is busy for BOMCNT<2:0> number of times, provided that CSMAEN = 1 is configured. Non-persistent, cleared by SPI read. bit 2 TXSZIF: Transmit Packet Size Error Interrupt Flag bit Following TXST is set the packet size (including MIC tags and CRC) is found to be zero or to be greater than the maximum size that the buffers can support. Non-persistent, cleared by SPI read. bit 1 TXOVFIF: Transmitter Overflow Interrupt Flag bit The Host Controller attempted to write a TX buffer that was not empty (TXBUFEMPTY = 0). Non-persistent, cleared by SPI read. bit 0 FRMIF: Frame Format Error Interrupt Flag bit Set if the transmitter/receiver fails to parse the frame in the buffer (because it is not as it should or it is corrupted in demodulation).

DS70005023B-page 22 Advanced  2011-2013 Microchip Technology Inc. REGISTER 2-5: PIR3 (PERIPHERAL INTERRUPT REGISTER 3) R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 RXIF RXDECIF RXTAGIF r RXIDENTIF RXFLTIF RXOVFIF STRMIF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 RXIF: Received Successful Interrupt Flag bit Set by the device when a frame has passed packet filtering and has been accepted (refer to Register 2-23). This interrupt flag is only set once for a packet and is not set when the packet is the duplicate of a repeated transmission, (that is, sequence number matches with the previously received frame). Non-persistent, cleared by SPI read. bit 6 RXDECIF: Receiver Decryption/Authentication Passed Interrupt Flag bit Set by the device when decryption/authentication finished without error. Non-persistent, cleared by SPI read. bit 5 RXTAGIF: Receiver Decryption/Authentication Failure Interrupt Flag bit Set by the device when decryption/authentication finished with error. Non-persistent, cleared by SPI read. bit 4 Reserved: Maintain as ‘0’ bit 3 RXIDENTIF: Received Packet Identical Interrupt Flag bit Set by the device when the packet is the duplicat e of a repeated transmission, (that is, sequence number, source address matches with the previously received frame). Non-persistent, cleared by SPI read. bit 2 RXFLTIF: Received Packet Filtered Interrupt Flag bit Set by the device when a packet was received, but rejected by one or more RX Filters (refer to Register 2-23). Non-persistent, cleared by SPI read. bit 1 RXOVFIF: Receiver Overflow Error Interrupt Flag bit Set by the device to indicate that a packet was received, but all RX buffers were full. Consequently the packet was not received, but was discarded instead(1). Non-persistent, cleared by SPI read. bit 0 STRMIF: Receive Stream Time-out Error Interrupt Flag bit Set by the device to indicate that the duration specified in STRMTO has elapsed since the last received packet while in RX-Streaming mode, and the MAC clears the stored sequence number. Non-persistent, cleared by SPI read. Note 1: In Packet mode, a single buffer is used for received frames, whereas in RX-Streaming mode both buffers are used for reception.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 23 MRF24XA REGISTER 2-6: PIR4 (PERIPHERAL INTERRUPT REGISTER 4) (1) R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 TXSFDIF RXSFDIF ERRORIF WARNIF EDCCAIF GPIO2IF GPIO1IF GPIO0IF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 TXSFDIF: Transmit SFD Sent Interrupt Flag bit Set by the device when the last sample of the SFD field has been sent on the air. Non-persistent, cleared by SPI read bit 6 RXSFDIF: Receive SFD Detected Interrupt Flag bit Set by the device when the SFD field of the received frame is detected. Non-persistent, cleared by SPI read. Non-persistent. Cleared by SPI read. bit 5 ERRORIF: General Error Interrupt Flag bit Set by the device, when malfunction state is reached. bit 4 WARNIF: Warning Interrupt Flag bit Set by the device when one of the following occurred:

Battery voltage has dropped below the threshold by BATMON<4:0> at 0x3F
Indicating that resistor is missing or not connected well bit 3 EDCCAIF: Energy Detect/CCA Done Interrupt Flag bit Set by the device when Energy-detect or CCA measurement is complete (following that the host MCU has set the EDST/CCAST bit to start the measurement and the device is clearing it in on completion). Non-persistent. Cleared by SPI read. bit 2 GPIO2IF: GPIO2 Interrupt Flag bit Set by the device if the GPIOMO DE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. bit 1 GPIO1IF: GPIO1 Interrupt Flag bit Set by the device if the GPIOMO DE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. bit 0 GPIO0IF: GPIO0 Interrupt Flag bit Set by the device if the GPIOMO DE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. Note 1: CFOMEAS<7:0> indication becomes valid on SFD found.

DS70005023B-page 24 Advanced  2011-2013 Microchip Technology Inc. REGISTER 2-7: PIE1 (PERIP HERAL INTERRUPT ENABLE 1) R-0 R/W-1 R/W-1 R-0 R/W-1 R/W-1 R-0 r RDYIE IDLEIE r CALSOIE CALHAIE r bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-6 Reserved: Maintain as ‘0’ bit 5 RDYIE: Ready Interrupt Enable bit This bit masks the RDYIF interrupt bit. bit 4 IDLEIE: Idle Interrupt Enable bit This bit masks the IDLEIF interrupt bit. bit 3 Reserved: Maintain as ‘0’ bit 2 CALSOIE: Calibration Soft Interrupt Enable bit This bit masks the CALSOIF interrupt bit. bit 1 CALHAIE: Calibration Hard Interrupt Enable bit This bit masks the CALHAIF interrupt bit. bit 0 Reserved: Maintain as ‘0’

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 25 MRF24XA REGISTER 2-8: PIE2 (PERIP HERAL INTERRUPT ENABLE 2) R/W-1 R/W-1 R/W-0 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 TXIE TXENCIE TXMAIE TXACKIE TXCSMAIE TXSZIE TXOVFIE FRMIE bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 TXIE: Transmit Interrupt Enable bit This bit masks the TXIF interrupt bit. bit 6 TXENCIE: Transmit Encryption and Authentication Interrupt Enable bit This bit masks the TXENCIF interrupt bit. bit 5 TXMAIE: Transmitter Medium Access Interrupt Enable bit This bit masks the TXMAIF interrupt bit. bit 4 TXACKIE: Transmission Unacknowledged Failure Interrupt Enable bit This bit masks the TXACKIF interrupt bit. bit 3 TXCSMAIE: Transmitter CSMA Failure Interrupt Enable bit This bit masks the TXCSMAIF interrupt bit. bit 2 TXSZIE: Transmit Packet Size Error Interrupt Enable bit This bit masks the TXSZIF interrupt bit. bit 1 TXOVFIE: Transmitter Overflow Interrupt Enable bit This bit masks the TXOVFIF interrupt bit. bit 0 FRMIE: Frame Format Error Interrupt Enable bit This bit masks the FRMIF interrupt bit.

DS70005023B-page 26 Advanced  2011-2013 Microchip Technology Inc. REGISTER 2-9: PIE3 (PERIP HERAL INTERRUPT ENABLE 3) R/W-1 R/W-1 R/W-1 R-0 R/W-0 R/W-0 R/W-1 R/W-1 RXIE RXDECIE RXTAGIE r RXIDENTIE RXFLTIE RXOVFIE STRMIE bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 RXIE: Received Successful Interrupt Enable bit This bit masks the RXIF interrupt bit. bit 6 RXDECIE: Receiver Decryption/Authentication Passed Interrupt Enable bit This bit masks the RXDECIF interrupt bit. bit 5 RXTAGIE: Receiver Decryption/Authentication Failure Interrupt Enable bit This bit masks the RXTAGIF interrupt bit. bit 4 Reserved: Maintain as ‘0’ bit 3 RXIDENTIE: Received Packet Identical Interrupt Enable bit This bit masks the RXIDENTIF interrupt bit. bit 2 RXFLTIE: Received Packet Filtered Interrupt Enable bit This bit masks the RXFLTIF interrupt bit. bit 1 RXOVFIE: Receiver Overflow Interrupt Enable bit This bit masks the RXOVFIF interrupt bit. bit 0 STRMIE: Receive Stream Time-out Error Interrupt Enable bit This bit masks the STRMIF interrupt bit.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 27 MRF24XA REGISTER 2-10: PIE4 (PERIPHERAL INTERRUPT ENABLE 4) R/W-0 R/W-0 R/W-1 R/W-1 R/W-1 R/W-0 R/W-0 R/W-0 TXSFDIE RXSFDIE ERRORIE WARNIE EDCCAIE GPIO2IE GPIO1IE GPIO0IE bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 TXSFDIE: Transmit SFD Sent Interrupt Enable bit This bit masks the TXSFDIF interrupt bit. bit 6 RXSFDIE: Receive SFD Detected Interrupt Enable bit This bit masks the RXSFDIF Interrupt Enable. bit 5 ERRORIE: General Error Interrupt Enable bit This bit masks the ERRORIF interrupt bit. bit 4 WARNIE: Warning Interrupt Enable bit This bit masks the WARNIF interrupt bit. bit 3 EDCCAIE: Energy Detect/CCA Done Interrupt Enable bit This bit masks the EDCCAIF interrupt bit. bit 2 GPIO2IE: GPIO2 Interrupt Enable bit This bit masks the GPIO2IF interrupt bit. bit 1 GPIO1IE: GPIO1 Interrupt Enable bit This bit masks the GPIO1IF interrupt bit. bit 0 GPIO0IE: GPIO0 Interrupt Enable bit This bit masks the GPIO0IF interrupt bit.

DS70005023B-page 28 Advanced  2011-2013 Microchip Technology Inc. REGISTER 2-11: PINCON (PIN CONFIGURATION REGISTER) R-0 R/W-1 R-0 R-1 R/W-0000 r GIE r IRQIF GPIOMODE<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 Reserved: Maintain as ‘0’ bit 6 GIE: General Interrupt Enable bit This bit enables to output IRQIF on INT pin. Note that the polarity of INT pin is active low. bit 5 Reserved: Maintain as ‘0’ bit 4 IRQIF: Interrupt Request Pending bit This bit is the OR relationship of the interrupt flags that are enabled. bit 3-0 GPIOMODE <3:0>: GPIO Mode Field bits This field allows redefining the functionality of the GPIO pins Encoding: 11xx = Reserved 1011 = GPIO pins are used for Receive streaming (RXSTREAM). Pins GPIO<2:0> are used to output {RXWRBUF, BUSRDBUF, RXBUFFUL} 1010 = GPIO pins are used for Transmit streaming (TXSTREAM). Pins GPIO<2:0> are used to output {TXRDBUF, BUSWRBUF, TXBUFEMPTY} 1001 = Reserved 1000 = Reserved 0111 = Reserved 0110 = Reserved 0101 = Intended for supporting Precise Network Time Synchronization (TIMESYN). GPIO<0> is used to output TX, while GPIO<1> to output RX SFD indication pulses. GPIO<2> can be used as in “NOR- MAL” operation mode. 0100 = GPIO pins are used for Radio monitoring (RFMON). Pins GPIO<2:0> are used to output RFOP<2:0>. 0011 = GPIO pins are used for MAC monitoring (MA CMON). Pins GPIO<2:0> are used to output MACOP<3:1>. 0010 = GPIO pins are used for RXFSM monitoring (RXFSMMON). Pins GPIO<2:0> are used to output receiver state-machine. 000 = Preamble search 001 = Hi-rate SFD search 010 = Mid-rate SFD search 011 = Low-rate SFD search 100 = Legacy length field processing 101 = Payload processing 0001 = GPIO pins are used for AGC monitoring (AGCMON). Pins GPIO<2:0> are used to output {AGCHOLD, GAIN<1:0>} where AGCHOLD is an internal flag set when a preamble is detected by a receiver, and cleared when the AGC is set free after the end of the frame. 0000 = GPIO pins are used as General Purpose I/O’s by the host MCU (NORMAL)

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 29 MRF24XA REGISTER 2-12: GPIO (GENER AL PURPOSE I/O REGISTER) R/W-0 R/W-1 R/W-1 R/W-1 R-0 R/W-0 R/W-0 R/W-0 GPIOEN TRISGPIO2 TRISGPIO1 TRISGPIO0 r GPIO2 GPIO1 GPIO0 bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 GPIOEN: GPIO Enable bit This bit enables the GPIO’s control, only if GPIOMODE is configured into Normal mode. The other GPIOMODE configuration automatically controls GPIO pins. bit 6 TRISGPIO2: Tri-state Control for GPIO 2 Pin bit If set, the pin is configured into Input mode. Value can be read from GPIO2 bit. If cleared, the pin is configured into Output mode. Value can be set through the GPIO2 bit. bit 5 TRISGPIO1: Tri-state Control for GPIO 1 Pin bit If set, the pin is configured into Input mode. Value can be read from GPIO1 bit. If cleared, the pin is configured into Output mode. Value can be set through the GPIO1 bit. bit 4 TRISGPIO0: Tri-state Control for GPIO 0 Pin bit If set, the pin is configured into Input mode. Value can be read from GPIO0 bit. If cleared, the pin is configured into Output mode. Value can be set through the GPIO0 bit. bit 3 Reserved: Maintain as ‘0’ bit 2 GPIO2: GPIO 2 Value bit This bit represents the value on the GPIO 2 pin. bit 1 GPIO1: GPIO 1 Value bit This bit represents the value on the GPIO 1 pin. bit 0 GPIO0: GPIO 0 Value bit This bit represents the value on the GPIO 0 pin.

DS70005023B-page 30 Advanced  2011-2013 Microchip Technology Inc. REGISTER 2-13: STGPIO (SCHMITT TRIG GER GENERAL PURPOSE I/O REGISTER) R-0 R/W-0 R/W-0 R/W-0 R-0 R/W-0 R/W-0 R/W-0 r GPIO2P GPIO1P GPIO0P r STENGPIO2 STENGPIO1 STENGPIO0 bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 Reserved: Maintain as ‘0’ bit 6 GPIO2P: GPIO 2 Polarity bit This bit controls GPIO2IF polarity when configured into Input mode. 1 = Rising edge 0 = Falling edge bit 5 GPIO1P: GPIO 1 Polarity bit This bit controls GPIO1IF polarity when configured into Input mode. 1 = Rising edge 0 = Falling edge bit 4 GPIO0P: GPIO 0 Polarity bit This bit controls GPIO0IF polarity when configured into Input mode. 1 = Rising edge 0 = Falling edge bit 3 Reserved: Maintain as ‘0’ bit 2 STENGPIO2: Schmitt Trigger Enable GPIO 2 bit This bit enables Schmitt-trigger circuit on GPIO 2 pad. It is turned off by default. 1 = Schmitt trigger enabled 0 = Schmitt trigger disabled bit 1 STENGPIO1: Schmitt Trigger Enable GPIO 1 bit This bit enables Schmitt-trigger circuit on GPIO 1 pad. It is turned off by default. 1 = Schmitt trigger enabled 0 = Schmitt trigger disabled bit 0 STENGPIO0: Schmitt Trigger Enable GPIO 0 bit This bit enables Schmitt-trigger circuit on GPIO 0 pad. It is turned off by default. 1 = Schmitt trigger enabled 0 = Schmitt trigger disabled

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 31 MRF24XA REGISTER 2-14: PULLGPIO (PULL CONT ROL GENERAL PURPOSE I/O REGISTER) R-0 R/W-0 R/W-0 R/W-0 R-0 R/W-1 R/W-1 R/W-1 r PULLDIR GPIO2 PULLDIR GPIO1 PULLDIR GPIO0 r PULLEN GPIO2 PULLEN GPIO1 PULLEN GPIO0 bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 Reserved: Maintain as ‘0’ bit 6 PULLDIRGPIO2: Pull Direction on GPIO 2 bit These bits control the weak-pull circuit direction on GPIO 2 pin. 1 = Pull-up 0 = Pull-down bit 5 PULLDIRGPIO1: Pull Direction on GPIO 1 bit These bits control the weak-pull circuit direction on GPIO 1 pin. 1 = Pull-up 0 = Pull-down bit 4 PULLDIRGPIO0: Pull Direction on GPIO 0 bit These bits control the weak-pull circuit direction on GPIO 0 pin. 1 = Pull-up 0 = Pull-down bit 3 Reserved: Maintain as ‘0’ bit 2 PULLENGPIO2: Pull enable on GPIO 2 bit This bit enables the weak-pull circuit in GPIO 2 pin. Note that when pin is configured to output, weak-pull circuit is automatically disabled. 1 = Pull enabled 0 = Pull disabled bit 1 PULLENGPIO1: Pull enable on GPIO 1 bit This bit enables the weak-pull circuit in GPIO 1 pin. Note that when pin is configured to output, weak-pull circuit is automatically disabled. 1 = Pull enabled 0 = Pull disabled bit 0 PULLENGPIO0: Pull enable on GPIO 0 bit This bit enables the weak-pull circuit in GPIO 0 pin. Note that when pin is configured to output, weak-pull circuit is automatically disabled. 1 = Pull enabled 0 = Pull disabled

DS70005023B-page 32 Advanced  2011-2013 Microchip Technology Inc. REGISTER 2-15: MACCON1 (MAC CONTROL 1 REGISTER) R/W-00 R/W-001 R/W-1 R/W-0 R/W-0 TRXMODE<1:0> ADDRSZ<2:0> CRCSZ FRMFMT SECFLAGOVR bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-6 TRXMODE<1:0>: TX/RX Mode Select Field bits 11 = Reserved 10 = TX-Streaming mode. In this mode both buffers are used for packet transmission. When issuing TRXMODE = 10, RXEN is cleared. SPI addresses 0x200 to 0x27F access Buffer 1 or Buffer 2 in alternation. Access to 0x37F through 0x383 has non-defined effect. 01 = RX-Streaming mode. In this mode both buffers are used for packet reception. When issuing TRX MODE = 01, TXST and TXENC/RXDEC bits are cleared and RXEN is set. SPI addresses 0x300 to 0x383 access Buffer 1 or Buffer 2 in alternation. In this mode, Proprietary mode packets other than streaming type are automat ically discarded. Access to 0x200 through 0x283 has non- defined effect. 00 = Packet mode. In this mode, Buffer 1 is used as a Transmit while Buffer 2 as a Receive packet buffer. SPI addresses from 0x200 to 0x27F access Buffer 1. SPI addresses 0x300 to 0x383 access Buffer 2. TRXMODE = 00 is mandatory when FRMFMT = 0. bit 5-3 ADDRSZ<2:0>: Source/Destination Address Size Field bits (1, 2) The size of the Source and Destin ation addresses for Proprietary packet. Note that this field has no effect on the processing IEEE 802.15.4 frames. 111 = 8 octets 110 = 7 octets 101 = 6 octets 100 = 5 octets 011 = 4 octets 010 = 3 octets 001 = 2 octets 000 = 1 octet bit 2 CRCSZ: CRC Size bit This bit indicates the size of the CRC field in each packet 1 = 2 octets 0 = 0 octet bit 1 FRMFMT: MAC Frame Format bit adopted by the network (3) This bit determines the frame format used in the network. 1 = Proprietary 0 = IEEE 802.15.4 standard compliant. Note 1: Zero-length address occurs when the corresponding DAddrPrsnt/SAddrPrsnt bits of the packet frame control field are set to ‘0’. 2: ADDRSZ field is used while receiving and transmitting, and should not be modified while RXEN or TXST is set. 3: FRMFMT field is used while receiving and transmitting, and should not be modified while RXEN or TXST is set. In Debug mode, this register bit is used to determine the frame format for both TX/RX frame in the packet buffers.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 33 MRF24XA bit 0 SECFLAGOVR: Security Flag Override bit The user can override security flags used in the CCM-CTR, CBC-MAC and CCM operation, otherwise the device will use the standard (2003/2006) definition. REGISTER 2-15: MACCON1 (MAC CONTROL 1 REGISTER) (CONTINUED) Note 1: Zero-length address occurs when the corresponding DAddrPrsnt/SAddrPrsnt bits of the packet frame control field are set to ‘ 0’. 2: ADDRSZ field is used while receiving and transmitting, and should not be modified while RXEN or TXST is set. 3: FRMFMT field is used while receiving and transmitting, and should not be modified while RXEN or TXST is set. In Debug mode, this register bit is used to determine the frame format for both TX/RX frame in the packet buffers.

DS70005023B-page 34 Advanced  2011-2013 Microchip Technology Inc. REGISTER 2-16: MACCON2 (MAC CONTROL 2 REGISTER) R/W-0000 R/W/HS-0000 CHANNEL<3:0> SECSUITE<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-4 CHANNEL<3:0>: TX/RX operating channel bits These register bits are used as the current operating channel for TX/RX operation(1). 0x0 = Channel 11 0x1 = Channel 12 0xF = Channel 26 bit 3-0 SECSUITE<3:0>: Security suite bits (2) 1111 = AES-CBC-MAC-32 (Authentication with a 32-bit MAC, but no Encryption/Decryption) 1110 = AES-CBC-MAC-64 (Authentication with a 64-bit MAC, but no Encryption/Decryption) 1101 = AES-CBC-MAC-128 (Authentication with a 128-bit MAC, but no Encryption/Decryption) 1100 = Reserved 1011 = Reserved 1010 = Reserved 1001 = AES-CTR (Encryption/Decryption, but no Authentication) 1000 = AES-ECB (Encryption only) 0111 = AES-ENC-MIC-128 (Authentication with a 128-bit MAC and Encryption/Decryption) 0110 = AES-ENC-MIC-64 (Authentication with a 64-bit MAC and Encryption/Decryption) 0101 = AES-ENC-MIC-32 (Authentication with a 32-bit MAC and Encryption/Decryption) 0100 = AES-ENC (Encryption/Decryption, but no Authentication) 0011 = AES-MIC-128 (Authentication with a 128-bit MAC, but no Encryption/Decryption) 0010 = AES-MIC-64 (Authentication with a 64-bit MAC, but no Encryption/Decryption) 0001 = AES-MIC-32 (Authentication with a 32-bit MAC, but no Encryption/Decryption) 0000 = No security services enabled, or security is handled by upper protocol layers; ignore the setting of the SecEn bit (assume it is ‘0’) Note 1: This field is used while receiving and transmitting, and should not be modified while RXEN or TXST is set. 2: In 15.4-2006 standard mode MAC-layer security processing, the register field is set automatically based on the SecLvl bits of the AuxSecHdr control field.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 35 MRF24XA REGISTER 2-17: TXCON (TRANSMIT CONTROL REGISTER) R/W/HC-0 R/W-0 R/W/HC-0 R/HS/HC-1 R/W-1 R/W-011 TXST DTSM TXENC TXBUFEMPTY CSMAEN DR<2:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 TXST: Transmit Start bit 1 = Starts the transmission of the next TX packet(1, 2) 0 = Termination of current TX operation, which may result in the transmission of an incomplete packet Hardware Clear: Once the packet has been successful ly transmitted (including all attempted retransmissions, if any) this bit will be cleared by hardware and TXIF and IDLEIF are set. If the packet transmission fails due to a CSMA failure, then this bit will be cleared, and TXCSMAIF is set. If Acknowledge was requested (AckReq bit field in the transmitted frame is set) and not received after the configured number of retransmissions (TXRET MCNT), then TXST bit will be cleared, and a TXACKIF is set. In TX-Streaming mode (TRXMODE), TXST can be se t even when it is already set, resulting in a posted start. When the current TX operation completes, the posted start will start immediately after- wards. Clearing of the TXST bit clears both the current and the posted (pending) TX starts. TXOVFIF is set when TXST = 1, a posted start is present and a Host Controller write to the packet buffer occurs. Outside of TX-Streaming mode, writes to TXST when TXST is already set will be ignored. Clearing this bit will abort the current operation in these cases:

When transmitting a packet in Packet mode or in TX-Streaming mode
When waiting for an ACK packet after a transmission
During the CSMA CA algorithm
When transmitting a repeated frame This field can be read at any time to determine if TX operation is in progress. bit 6 DTSM: Do Not Touch Security Materials bit (2) 1 = Device will not change the security material configured by the host MCU 0 = Device will try to configure the security material related registers The concerned registers are SECNONC E, SECHDRINDX, SECPAYINDX and SECENDINDX registers should be filled by the MCU. bit 5 TXENC: TX Encryption Setting this bit will start TX security processing (authentication and/or encryption) of the packet in the buffer that was last written to. TXENC is clear ed and TXENCIF is set when the processing is com- plete. TXENC should be issued when NWK layer security needs to be processed. 802.15.4-2003/ 2006 MAC layer security operation is automatically performed by setting TXST bit. Note that this field should not be modified while TXST is set. Note 1: Transmission may include automatic security processing, CRC appending, CSMA-CA channel access, Acknowledge reception and retransmissions depending on the register configuration and the frame control field of the frame to be transmitted. 2: DTSM has no relevance in reception, because the host can always reconfigure the security material before setting RXDEC.

DS70005023B-page 36 Advanced  2011-2013 Microchip Technology Inc. bit 4 TXBUFEMPTY: TX Buffer Empty bit TXBUFEMPTY = 1 indicates, that Host MCU can safely start writing a new frame to the buffer without overwriting any content that is in use. Writing a single byte to the buffer will cause this bit to be cleared. TXBUFEMPTY = 0 does not prevent the host from writing further bytes to the buffer. TXBUFEMPTY is set by the device when transmission is complete. 1 = MCU can safely start writing a new frame to the buffer 0 = Buffer is full, or being written to When TRXMODE = 00: Packet mode is configured then TXBUFEMPTY is set at the same time as TXST is cleared and an interrupt is generated. Therefore, this bit provides no extra information. When TRXMODE = 10: TX-Streaming mode is configured then TXBUFEMPTY is set at the same time as one of the buffers becomes free, while TXST may be set. Therefore, TXBUFEMPTY is used by the host MCU to make sure that it can start loading t he next frame to the buffers, without overwriting a packet being sent (TXOVFIF). bit 3 CSMAEN: CSMA-CA Enable bit This bit enables CSMA-CA algorithm before transmission. 1 = CSMA-CA enabled 0 = CSMA-CA disabled bit 2-0 DR<2:0>: Transmit Data Rate Field bits 111 = Reserved 110 = 2 Mbps 101 = 1 Mbps 100 = 500 kbps 011 = 250 kbps 010 = 125 kbps 001 = Reserved 000 = Reserved When transmitting an Auto-ACK frame with Adaptive Data Rate in response to a received frame, the data rate of the PHY is automatically determined by the AckDataRate field in the received frame, and not by this register field. In all other cases, this register field is used as the current PHY data rate when transmitting. The data rate for all received frames is determined automatically by the PHY, regardless of this register field and the Adaptive Data Rate configuration. Refer to Register 2-43 for more information. Note 1: Transmission may include automatic security processing, CRC appending, CSMA-CA channel access, Acknowledge reception and retransmissions depending on the register configuration and the frame control field of the frame to be transmitted. 2: DTSM has no relevance in reception, because the host can always reconfigure the security material before setting RXDEC. REGISTER 2-17: TXCON (TRANSMIT CONTROL REGISTER) (CONTINUED)

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 37 MRF24XA REGISTER 2-18: RXACKWAIT (RX ACKNOWLEDGE WAIT REGISTER) REGISTER 2-19: RETXCON (RETR ANSMISSION CONTROL REGISTER) R/W-0 R/W-1 R/W/HC-1 R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 RXACKWAIT<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear bit 7-0 RXACKWAIT<7:0>: Auto Acknowledge Wait Field bits This field indicates the number of Base time units (see Section 4.1 “MAC Architecture”) that the device should wait after receiving a packet with AckReq = 1, before transmitting the corresponding ACK packet. This field is only used when AUTOACKEN = 1. R/W-0011 R-0000 RETXMCNT<3:0> R ETXCCNT<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-4 RETXMCNT<3:0>: Retransmission Max Count Field bits (1, 2) The maximum number of retries allowed after a transmission failure. 1111 = 15 retries 0001 = 1 retry 0000 = Transmitter will not wait for ACK bit 3-0 RETXCCNT<3:0>: Retransmission Current Count Field bits This read-only field indicates the current retransmit attempt number. When RETXCCNT<3:0> = RETX- MCNT<3:0> and the TX attempt fails, the transmission will be aborted, generating TXACKIF interrupt. Note 1: This field is used during transmission, and should not be modified while TXST is set.

DS70005023B-page 38 Advanced  2011-2013 Microchip Technology Inc. REGISTER 2-20: RXCON1 (MAC RECEIVE CONTROL 1 REGISTER) R/W/HC/HS-0 R/W-0 R/W/HC-0 R/W-0 R/W-0 R/W-0 R/W-0 R-0 RXEN NOPA RXDEC RSVLQIEN RSVRSSIEN RSVCHDREN RSVCFOEN r bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 RXEN: Receive Enable Field bit This bit enables/disables the packet reception. If an RX packet is currently being received, clearing this bit will cause that packet to be discarded. 1 = RX enabled 0 = RX disabled Hardware clear/set when:

Cleared when TRXMODE is set to TX-Streaming mode
Set when TRXMODE is set to RX-Streaming mode Clearing this bit will abort the current operation in the following cases:
Receiving a packet in Packet mode or in RX-Streaming mode Note that the most RX related settings should only be changed while this bit is cleared. Note that the clear channel assessment (CSM AEN) and ACK-frame reception does not require RXEN = 1, because the device will turn the radio into RX when needed, irrespective of the status of the RXEN bit. bit 6 NOPA: No Parsing bit This bit will disable packet parsing. Only CRC will be checked, if it is enabled. This feature is useful in Sniffer mode. 1 = Disable packet parsing 0 = Enable packet parsing bit 5 RXDEC: RX Decryption bit Setting this bit will start RX security processing (authentication and/or decryption) on the last received packet. 1 = RX security processing started/in process. RXDECIF or RXTAGIF is set. 0 = RX security processing inactive or complete This bit will clear itself after RX decryption has completed. bit 4 RSVLQIEN: Receive Status Vector LQI Enable bit If bit is set, the measured Link Quality is appended after the received frame in the packet buffer. 1 = Append LQI field 0 = Do not append LQI field bit 3 RSVRSSIEN: Receive Status Vector RSSI Enable bit If bit is set, the measured RSSI is appended after the received frame in the packet buffer. 1 = Append RSSI field 0 = Do not append RSSI field bit 2 RSVCHDREN: Receive Status Vector Channel/MAC Type/Data Rate Enable bit If bit is set, Channel, MAC type and Data Rate configurations used with the received frame are appended after the received frame in the packet buffer, using the encoding specified for CH<3:0>, FRMFMT and DR<2:0> (concatenated in this order when most significant bit (MSb) is first). 1 = Append Channel, MAC type and Data Rate fields 0 = Do not append Channel, MAC type and Data Rate fields

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 39 MRF24XA bit 1 RSVCFOEN: Receive Status Vector CFO Enable bit If bit is set, the estimated Carrier Frequency Offs et of the received frame is appended after the received frame in the packet buffer, using the same encoding as CFOMEAS register. 1 = Append CFO estimation 0 = Do not append estimated CFO bit 0 Reserved: Maintain as ‘0’ REGISTER 2-20: RXCON1 (MAC RECEIVE CONTROL 1 REGISTER) (CONTINUED) REGISTER 2-21: RXCON2 (MAC RECEIVE CONTROL 2 REGISTER) R/C/HS-0 R/W-0 R-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 RXBUFFUL IDENTREJ ACKRXFP ACKTXFP AU TORPTEN AUTOACKEN ADPTCHEN ADPTDREN bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 RXBUFFUL: RX Buffer Full bit Host MCU clears this bit to indicate that the RX packet has been processed. If this bit is not cleared before the next valid RX packet is detected (packet is not a duplicate, pass RX filter, and so on), then the device sets RXOVFIF and the buffer content is not modified, that is, RXBUFFUL = 1 locks write access by a new frame, meanwhile the host can both read and write to the buffer or perform security processing. In TRXMODE = 00 (PACKET) mode: 1 = Receive buffer content is yet to be read by the host or processed, and cannot be overwritten by a new frame 0 = Receive buffer is free for receiving a new frame In TRXMODE = 01 (RX-STREAMING) mode: 1 = Current buffer being read from the bus contains a valid RX Packet 0 = Current buffer being read from the bus is empty bit 6 IDENTREJ: Reject Identical Packet bit In Packet mode, if this bit is set and a received packet has the same Source address, Source PID and Sequence number as the last packet received RXIDENTIF is set and the packet is discarded. This bit is used, when a packet is used, transmit an ACK, but the ACK is never received. The sender will then re-send the TX packet to us. In this case, we don’t want to trigger RXIF for a second time for the same packet, so we ignore the second packet. This is also used when we repeat a packet, and t he next repeater then repeats the same packet back. We will receive this packet, but we should ignore it. 1 = Any packet received with the same Source Address, Source PID and Sequence number as the last packet successfully received will be discarded and RXIDENTIF is set. 0 = Duplicated packets are processed further same as non-duplicated packets. bit 5 ACKRXFP: ACK RX Frame Pending bit This read-only status bit reflects the value of the FrameCtrl (FramePend) bit in the last received 802.15.4 compatible ACK frame. Note 1: ADPTCHEN field is used while receiving and transmitting a packet, and should not be modified while RXEN or TXST is set. 2: ADPTDREN field is used while receiving and transmitting a packet, and should not be modified while RXEN or TXST is set.

DS70005023B-page 40 Advanced  2011-2013 Microchip Technology Inc. bit 4 ACKTXFP: ACK TX Frame Pending bit The value of this bit is transmitted in the Fram eCtrl (FramePend) bit slot when the MAC sends out an ACK packet in 802.15.4 Compatibility mode. bit 3 AUTORPTEN: Auto-Repeat Enable bit If this bit is set, the MAC will automatically tr ansmit a packet whenever a packet is received, and its Repeat bit is set. 1 = Auto-Repeat feature is enabled 0 = Auto-Repeat feature is disabled bit 2 AUTOACKEN: Auto-Acknowledge Enable bit If this bit is set, then the device will automatically transmit an ACK packet whenever a packet is received, and its AckReq bit is set. 1 = Automatic Acknowledge processing enabled 0 = Automatic Acknowledge processing disabled bit 1 ADPTCHEN: Adaptive Channel Enable bit(1) Setting this bit will enable the MAC in Proprietary mode to set the transmitting channel for the ACK packet based on the AckInfo field (proprietary packet) of the received packet, rather than the CH<3:0> register bits. 1 = Adaptive Channel feature is enabled 0 = Adaptive Channel feature is disabled This feature is also known as Channel Agility. Refer to Section 7.1 “Channel Agility” for more information. bit 0 ADPTDREN: Adaptive Data Rate Enable bit(2) Setting this bit will enable the MAC in Proprietary mode to set the transmission data rate for the ACK packet based on the AckInfo field (proprietary packet) of the received packet, rather than the DR<2:0> register bits. 1 = Adaptive Data Rate feature is enabled 0 = Adaptive Data Rate feature is disabled This feature is also known as Channel Agility. Refer to Section 7.1 “Channel Agility” for more information. REGISTER 2-21: RXCON2 (MAC RECEIVE CONTROL 2 REGISTER) (CONTINUED) Note 1: ADPTCHEN field is used while receiving and transmitting a packet, and should not be modified while RXEN or TXST is set. 2: ADPTDREN field is used while receiving and transmitting a packet, and should not be modified while RXEN or TXST is set.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 41 MRF24XA REGISTER 2-22: TXACKTO (TX ACK NOWLEDGE TIME-OUT REGISTER) R/W-10000000 TXACKTO<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-0 TXACKTO<7:0>: TX Acknowledge Time-out Field bits(1) The maximum time in basetime units that the device will wait for receiving an ACK packet. 0x00 = Wait 1 Base time (see Section 4.1 “MAC Architecture”) unit before retransmitting (implying that the device will continually retransmit RETXMCNT<3:0> times). 0x01 = Wait 1 Base time unit before retransmitting 0x7F = Wait 127 Base time units before retransmitting Note 1: TXACKTO field is used during transmission, and it should not be modified while TXST is set.

DS70005023B-page 42 Advanced  2011-2013 Microchip Technology Inc. REGISTER 2-23: RXFILTER (RX FILTER REGISTER) R/W-0 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 PANCRDN CRCREJ CMDREJ DATAREJ UNIREJ NOTMEREJ BCREJ NSTDREJ bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 PANCRDN: PAN Coordinator bit Setting this bit will allow the node to accept DAMode = 00 type packets if it is a CMD or DATA frame. 1 = Disable rejection 0 = Reject all DATA and CMD packets when DAMode = 00 bit 6 CRCREJ: CRC Error Reject Enable bit(1) Setting this bit allows the user to reject all packets that have an invalid CRC, provided that it is present (CRCSZ = 1). Clearing this bit allows the user to accept all packets that have an invalid CRC, provided that it is present (CRCSZ = 1), skipping any further filtering. When CRC is not present then this bit has no effect (CRCSZ = 0). 1 = Reject all packets having an invalid CRC 0 = Accept all packets having an invalid CRC without further filtering bit 5 CMDREJ: Command Frame Reject Enable bit Setting this bit allows the user to reject all packets with FrameCtrl (Type) equal to Command. 1 = Reject all Command packets 0 = Disable Command Frame Rejection bit 4 DATAREJ: Data Frame Reject Enable bit Setting this bit allows the user to reject all packets with FrameCtrl (Type) equal to Data. 1 = Reject all Data packets 0 = Disable Data Frame Rejection bit 3 UNIREJ: Unicast Reject Enable bit (2) Setting this bit allows the user to reject all unicast packets as in:

802.15.4 Mode: PAN Identifier matches with the PANID<15:0> or 0xFFFF, and Destination Address

matches the address in the ADDR<63:0> or SHADDR<15:0> register, as selected by DAMode. Proprietary Mode: Destination Address matches the a ddress in ADDR<ADDRSZ<2:0>*8-1:0> reg- ister, provided that DAddrPrsnt frame control field is set(1). 1 = Reject all Unicast packets addressed to this node 0 = Disable Unicast Rejection Note 1: In Proprietary mode (FRMFMT = 1), when CRCREJ = 1 is used to reject unicast frames not addressed to this node. NOTMEREJ = 1 will not reject these frames. 2: Frames using implied destination addressing in 802.15.4 mode and inferred destination addressing in Proprietary mode are not affected by UNIREJ. 3: Frames using implied destination addressing in 802.15.4 mode and inferred destination addressing in Proprietary mode are not affected by NOTMEREJ. 4: Proprietary frames in Proprietary mode are not affected by NSTDREJ.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 43 MRF24XA bit 2 NOTMEREJ: Not Me Unicast Reject Enable bit(3) Setting this bit allows the user to reject all unicast packets as in:

802.15.4 Mode: Destination PAN Identifier does not match PANID<15:0> and is not 0xFFFF (broad-

cast) or Destination Address d oes not match the address in the ADDR<63:0> register or the SHADDR<15:0> register, as selected by DAMode. Proprietary Mode: Destination Address matches the a ddress in ADDR<ADDRSZ<2:0>*8-1:0> reg- ister, provided that DAddrPrsnt frame control field is set(1). 1 = Reject all Unicast packets NOT addressed to this node 0 = Disable Not Me Unicast Rejection Filtering bit 1 BCREJ: Broadcast Rejection bit

802.15.4 Mode: Setting this bit allows the user to reject all Broadcast packets of type Data or Com-

mand. A Data or Command packet is broadcast when Short Destination Addressing is used (DAMode = 10) and Short Address is equal 0xFFFF. Proprietary Mode: Setting this bit allows the user to reject all Broadcast packets of type Data or Com- mand (or Streaming). A packet is broadcast when FrameCtrl[Broadcast] is set. 1 = Reject Broadcast Packets 0 = Disable Broadcast Rejection bit 0 NSTDREJ: Non-Standard Frame Reject bit(4) This bit allows the user to reject all 802.15.4 frames having 01 for the DAMode or SAMode fields or having the MSb (bit 2) in the Type field set (1) or having the MSb (bit 1) in the Frame Version field set to(1). 1 = Reject all Non-Standard 802.15.4 packets 0 = Disable Non-Standard Rejection Note 1: In Proprietary mode (FRMFMT = 1), when CRCREJ = 1 is used to reject unicast frames not addressed to this node. NOTMEREJ = 1 will not reject these frames. 2: Frames using implied destination addressing in 802.15.4 mode and inferred destination addressing in Proprietary mode are not affected by UNIREJ. 3: Frames using implied destination addressing in 802.15.4 mode and inferred destination addressing in Proprietary mode are not affected by NOTMEREJ. 4: Proprietary frames in Proprietary mode are not affected by NSTDREJ. REGISTER 2-23: RXFILTER (RX FILTER REGISTER) (CONTINUED)

DS70005023B-page 44 Advanced  2011-2013 Microchip Technology Inc. REGISTER 2-24: TMRCON (TIMER CONTROL REGISTER) R/W-100 R/W-00010 BOMCNT<2:0> BASETM<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-5 BOMCNT<2:0>: CSMA-CA Back-off Maximum Count bits The maximum number of back-off attempts the CS MA-CA algorithm will attempt before declaring a channel access failure. 111 = Reserved 110 = Reserved 101 = 5 attempts 100 = 4 attempts 011 = 3 attempts 010 = 2 attempts 001 = 1 attempts 000 = 0 attempt bit 4-0 BASETM<4:0>: Base time Field bits The number of 1 µs clock cycles that a Base time un it represents in all re gister settings. Refer to Section 4.1 “MAC Architecture” for more information.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 45 MRF24XA REGISTER 2-25: CSMABE (CSMA-CA BA CK-OFF EXPONENT CONTROL REGISTER) R/W-0101 R/W-0011 MAXBE<3:0> MINBE<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-4 MAXBE<3:0>: CSMA-CA Back-off Maximum Count Field bits The maximum value of the Back-off exponent (BE), in the CSMA-CA algorithm. The back-off time is (2BE-1) units. 1111 = Reserved 1001 = Reserved 1000 2 8-1 = 255 maximum units of back-off time 0000 2 0-1 = No back-off time bit 3-0 MINBE<3:0>: CSMA-CA Back-off Minimum Count bits The minimum value of the back-off exponent (BE), in the CSMA-CA algorithm. The back-off time is (2BE-1) units. 1111 = Reserved 1001 = Reserved 1000 2 8-1 = 255 maximum units of back-off time 0000 2 0-1 = No back-off time

DS70005023B-page 46 Advanced  2011-2013 Microchip Technology Inc. REGISTER 2-26: BOUNIT (BACK- OFF TIME UNIT REGISTER) REGISTER 2-27: STRMTOH/STRMTOL (STREAM TIME-OUT REGISTER) R/W-10100000 BOUNIT<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-0 BOUNIT<7:0>: CSMA-CA Back-off Period Unit Field bits The number of Base time units for the basic back-off time unit used by CSMA-CA algorithm. 11111111 = 256 Base time units 00000000 = 1 Base time unit R/W-11111111 STRMTO<15:8> bit 15 bit 8 R/W-11111111 STRMTO<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 15-0 STRMTO<15:0>: Stream Time-Out bits The STRMTO<15:0> bits indicate the maximum number of allowed Base time units between the end of one RX Stream packet and the successful reception of the next. If no RX Stream packet is successfully received within this time, STRMIF is set.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 47 MRF24XA REGISTER 2-28: OFFTM (OFF-TIMER REGISTER) R/W-00000000 OFFTM<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-0 OFFTM<7:0>: OFF-Timer Field bits This value sets the minimum PLL OFF time in 1 µs resolution. Minimum OFF Time = OFFTM<7:0> * 32 If this register is set to 0xFF, PLL will remain off.

DS70005023B-page 48 Advanced  2011-2013 Microchip Technology Inc. REGISTER 2-29: ADDR (ADDRESS REGISTER) R/W-00000000 ADDR<63:56> bit 63 bit 56 R/W-00000000 ADDR<55:48> bit 55 bit 48 R/W-00000000 ADDR<47:40> bit 47 bit 40 R/W-00000000 ADDR<39:32> bit 39 bit 32 R/W-00000000 ADDR<31:24> bit 31 bit 24 R/W-00000000 ADDR<23:16> bit 23 bit 16 R/W-00000000 ADDR<15:8> bit 15 bit 8 R/W-00000000 ADDR<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 63-0 ADDR<63:0>: Long Address Field bits Current device’s long address (LSB stored). For propr ietary frames, the number of address bytes is defined in ADDRSZ<2:0>. For addresses less than 8 octets, the least significant bits of this register will be used.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 49 MRF24XA REGISTER 2-30: SHADDRH/SHADDRL (SHORT ADDRESS REGISTER) REGISTER 2-31: PANIDH/PANIDL (PAN IDENTIFIER REGISTER) R/W-00000000 SHADDR<15:8> bit 15 bit 8 R/W-00000000 SHADDR<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 15-0 SHADDR<15:0>: Short Address Field bits Current device’s short address (LSB stored). Only used in 802.15.4 mode. R/W-00000000 PANID<15:8> bit 15 bit 8 R/W-00000000 PANID<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 15-0 PANID<15:0>: PAN Identifier Field bits Current device’s PAN Identifier (LSB stored). Only used in 802.15.4 mode.

DS70005023B-page 50 Advanced  2011-2013 Microchip Technology Inc. REGISTER 2-32: SECHDRINDX (SEC URITY HEADER INDEX REGISTER) REGISTER 2-33: SECPAYINDX (SEC URITY PAYLOAD INDEX REGISTER) R-0 R/W/HS-0000000 r SECHDRINDX<6:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HS = Hardware Set bit 7 Reserved: Maintain as ‘0’ bit 6-0 SECHDRINDX<6:0>: Security Header Index Field bits This field defines the portion of the header on that authentication operations are performed. For MAC layer security, SECHDRINDX<6:0> is defined as the address offset of the MAC Header from the beginning of the frame, as stored in the buffer (that is, 0 = Length field, 1 = FrameCtrl field, and so on), and is loaded automatically for both 802.15.4 and proprietary frames(1). For Network layer security, SECHDRINDX<6:0> is defined as the address offset of the Network Header from the beginning of the frame and must be loaded by the Host Controller for 802.15.4 frames only (for proprietary frames, the MAC automatically loads it). Note 1: Setting the DTSM bit will disable the automatic computation of this field in TX mode. R-0 R/W/HS-0000000 r SECPAYINDX<6:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HS = Hardware Set bit 7 Reserved: Maintain as ‘0’ bit 6-0 SECPAYINDX<6:0>: Security Payload Index Field bits This field defines the portion of the payload over which encryption/decryption operations are performed. For MAC layer security, SECPAYINDX<6:0> is defined as the address offset of the MAC payload from the beginning of the frame, as stored in the buffer (that is, 0 = Length field, 1 = FrameCtrl field, and so on), and is loaded automatically for both 802.15.4 and proprietary frames(1). For Network layer security, SECPAYINDX<6:0> is defined as the address offset of the payload from the beginning of the frame and must be loaded by the Host Controller for 802.15.4 frames only (for propri- etary frames, the MAC automatically loads it). Note 1: Setting the DTSM bit will disable the automatic computation of this field in TX mode.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 51 MRF24XA REGISTER 2-34: SECENDINDX ( SECURITY END INDEX REGISTER) R-00 R/W/HS-0000000 r SECENDINDX<6:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HS = Hardware Set bit 7 Reserved: Maintain as ‘0’ bit 6-0 SECENDINDX<6:0>: Security End Index Field bits(1) This field defines the end of the payload over which security operations are performed. Note 1: Setting the DTSM bit will disable the automatic computation of this field in TX mode.

DS70005023B-page 52 Advanced  2011-2013 Microchip Technology Inc. REGISTER 2-35: MACDEBUG (MAC DEBUG CONTROL REGISTER) R/W/HC-0 R/W/HC-0 R/W-0 R/W-0 R/HS/HC -0 R/HS/HC-0 R/HS/HC-0 R/HS/HC-0 BUF1TXPP BUF2TXPP BUF1RXPP BUF2R XPP TXRDBUF RXWRBUF BUSRDBUF BUSWRBUF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 BUF1TXPP: Buffer 1 TX Process Packet bit Setting this bit will perform all of the processing (CRC generation and security) on BUF1 that would nor- mally be done before transmitting a packet, but without actually transmitting the packet. bit 6 BUF2TXPP: Buffer 2 TX Process Packet bit Setting this bit will perform all of the processing (CRC generation and security) on BUF2 that would nor- mally be done before transmitting a packet, but without actually transmitting the packet. bit 5 BUF1RXPP: Buffer 1 RX Process Packet bit Setting this bit will perform all of the processing (CRC checking and security) on BUF1 that would normally be done when receiving a packet, but without actually receiving the packet. This bit should be asserted while downloading security materials and so on during debug. bit 4 BUF2RXPP: Buffer 2 RX Process Packet bit Setting this bit will perform all of the processing (CRC checking and security) on BUF2 that would normally be done when receiving a packet, but without actually receiving the packet. This bit should be asserted while downloading security materials and so on, during debug. bit 3 TXRDBUF: TX Read Buffer Flag bit Indicates the physical buffer number (0 = BUF1, 1 = BUF2) that the TX hardware is reading. bit 2 RXWRBUF: RX Write Buffer Flag bit Indicates the physical buffer number (0 = BUF1, 1 = BUF2) that the RX hardware is writing to. bit 1 BUSRDBUF: Bus Read Buffer Flag bit Indicates the physical buffer number (0 = BUF1, 1 = BUF2) that the SFR bus is reading. This bit is only used in RX-Streaming mode. bit 0 BUSWRBUF: Bus Write Buffer Flag bit Indicates the physical buffer number ( 0 = BUF1, 1 = BUF2) that the SFR bus is writing to. This bit is only used in TX-Streaming mode.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 53 MRF24XA REGISTER 2-36: CCACON1 (CCA CONTROL 1 REGISTER) REGISTER 2-37: CCACON2 (CCA CONTROL 2 REGISTER) R/HS/HC-0 R/W/HC-0 R/W-001100 CCABUSY CCAST RSSITHR<5:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 CCABUSY: Clear Channel Assessment Busy Flag bit This bit represents the result of the latest CCA measurement. 1 = Medium is busy 0 = Medium is silent bit 6 CCAST: Clear Channel Assessment Start bit (1) By setting this register bit, the MCU triggers st arting a new CCA measurement. This register bit is cleared by the hardware when the CCA measurement is done (EDCCAIF is set) and CCABUSY is valid. bit 5-0 RSSITHR<5:0>: RSSI Threshold bits This threshold is used in CCA operation when Ener gy detect or Energy and Carrier Sense mode is selected. Representation: resolution of 2 dB/LSB Note 1: RX chain should be turned on (RXEN = 1) to perform this measurement. Packet reception is not disabled during the measurement, main purpose is testing. R-0 R/W-01 R/W-01 CSTHR<3:0> CCALEN<1:0> CCAMODE<1:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-4 CSTHR<3:0>: Carrier Sense Threshold Field bits bit 3-2 CCALEN<1:0>: Clear Channel Assessment Length bits(1) Value N indicates duration of 2^N * 32 µs. bit 1-0 CCAMODE<1:0>: Clear Channel Assessment Mode Field bits(2) 11 = CCA Mode 3/a in the IEEE 802.15.4 standard: Energy AND Carrier Sense Threshold 10 = CCA Mode 2 in the IEEE 802.15.4 standard: Carrier Sense Threshold 01 = CCA Mode 1 in the IEEE 802.15.4 standard: Energy Detect Threshold (default) 00 = CCA Mode 3/b in the IEEE 802.15.4 standard: Energy OR Carrier Sense Threshold Note 1: The IEEE 802.15.4 standard requires 128 µs, but shorter length is recommended when using higher rates with optimized preamble mode (RATECON.OPTIMAL = 1). 2: The measured RSSI result is stored in EDMEAN<7:0> register in all modes except Mode 2.

DS70005023B-page 54 Advanced  2011-2013 Microchip Technology Inc. REGISTER 2-38: EDCON (ENERGY DETECT CONTROL REGISTER) (1)) REGISTER 2-39: EDMEAN (ENERGY DE TECT MEAN INDICATION REGISTER) R-00 R/W-01 R/W/HC-0 R/W-1110 r EDMODE EDST EDLEN<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear bit 7-6 Reserved: Maintain as ‘0’ bit 5 EDMODE: Energy Detect Mode Select bit 1 = Energy Detect Sampling Mode. ED duration is 128 µs. A single atomic RSSI-peak measurement is accomplished. The result is stored in EDPEAK<7:0> register. 0 = Energy Detect Scan Mode. ED duration is set by EDLEN<3:0>. The result is stored in EDMEAN<7:0> register. bit 4 EDST: Energy Detect Measurement Start bit By setting this register bit, the MCU triggers starting a new ED measurement. This register bit is cleared by the hardware when the ED measurement is done (EDCCAIF is not changed) and values in EDMEAN<7:0> and EDPEAK<7:0> are valid. If the ED measurement is aborted (RX state is changed, or the EDST bit is cleared by the MCU), then EDCCAIF is not changed. bit 3-0 EDLEN<3:0>: Energy Detect Measurement Length Field bits(2) Value M indicates a sequence of (M + 1) * 8 atomic RSSI-peak measurements, each having the duration of 128 µs. At the end of the aggregate measurement, the mean and the peak value of the sequence are available in EDMEAN<7:0> and EDPEAK<7:0>. Note 1: The RX chain should be turned on (RXEN = 1) to perform this measurement. Packet reception is disabled during the measurement. 2: When EDLEN<3:0> = M = 0xE, then the 128 μs atomic measurements are preformed 120 times, which is equal to the a BaseSuperFrameDuration parameter in the IEEE 802.15.4 standard. R/HS/HC-00000000 EDMEAN<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7-0 EDMEAN<7:0>: Energy Detect Mean Indication Field bits Measured mean signal strength during ED/CCA measurement.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 55 MRF24XA REGISTER 2-40: EDPEAK (ENERGY DETECT PEAK INDICATION REGISTER) REGISTER 2-41: CFOCON (CFO PRE COMPENSATION REGISTER) R/HS/HC-00000000 EDPEAK<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7-0 EDPEAK<7:0>: Energy Detect Peak Indication Field bits Measured peak signal strength during ED measurement. Computation: The gain-compensated RSSI value is averaged over intervals of 128 μs. The peak value obtained from a sequence of such measurements is stored in EDPEAK when EDMODE = 1. R/W-0000 R/W-0000 CFOTX<3:0> CFORX<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-4 CFOTX<3:0>: TX Carrier Frequency Offset Field bits This value can be written by the host to compensate for the carrier frequency offset of the node during transmission. Pre-compensation allows using crystals with wider tolerances. Frequency Offset Unit is: 13 ppm/LSB. Two’s complement encoding. bit 3-0 CFORX<3:0>: RX Carrier Frequency Offset Field bits This value can be written by the host to pre-compensate the Carrier Frequency Offset estimation window (±55 ppm). Frequency Offset Unit is: 13 ppm/LSB. Two’s complement encoding.

DS70005023B-page 56 Advanced  2011-2013 Microchip Technology Inc. REGISTER 2-42: CFOMEAS (CFO MEASUREMENT INDICATION REGISTER) R/W-00000000 CFOMEAS<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-0 CFOMEAS<7:0>: CFO Measurement Field bits If AFCOVR bit is cleared, then this register is written and valid when RXSFDIF is set with the value of the carrier frequency offset that was estimated during the acquisition of the packet. The host may use this value together with the LQI as a preamble quality indication. (The LQI is measured over the CFO compensated payload). If AFCOVR bit is set, this receiver will compensate the carrier frequency offset. Note that in this case, the CFO estimation algorithm is disabled, thus ±13 ppm CFO can be tolerated. CFORX has no effect when AFCOVR is set. Frequency Offset Unit is: ~1.62 ppm/LSB of the 2.4 GHz carrier. Two’s complement encoding is used.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 57 MRF24XA REGISTER 2-43: RATECON ( RATE CONFIGURATION REGISTER) R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-1 R/W-1 DIS2000 DIS1000 DIS500 DIS250 DISSTD DIS125 OPTIMAL PSAV bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 DIS2000: Disable 2 Mbps Frame Reception bit If this bit is set, then reception of 2 Mbps frames is disabled. bit 6 DIS1000: Disable 1 Mbps Frame Reception bit If this bit is set, then reception of 1 Mbps frames is disabled. bit 5 DIS500: Disable 500 kbps Frame Reception bit If this bit is set, then reception of 500 kbps frames is disabled. bit 4 DIS250: Disable 250 kbps Frame Reception bit If this bit is set, then reception of 250 kbps frames with non-standard-compliant SFD patterns is disabled. bit 3 DISSTD: Disable IEEE 802.15.4 compliant Frame Reception bit If this bit is set, th en reception of 250 kbps frames with IEEE 802.15.4 compliant SFD patterns is disabled. bit 2 DIS125: Disable 125 kbps Frame Reception bit If this bit is set, then reception of 125 kbps frames is disabled. bit 1 OPTIMAL: Optimized Preamble Selection bit When this bit is set, then optimized preamble is used instead of legacy. 1 = Optimized preamble 0 = Legacy preamble bit 0 PSAV: Power-Save Mode Selection bit If this bit is set, frame detecti on is dependent on the RSSI signal, and the receive signal processor is turned on when a sudden and significant increase (PSAVTHR<3:0>) is detected in the signal strength or the signal strength is above an absolute level (DESENSTHR<3:0>). 1 = Power-Save mode 0 = Hi-Sensitivity mode

DS70005023B-page 58 Advanced  2011-2013 Microchip Technology Inc. REGISTER 2-44: POWSAVE (POWER-SAVE CONFIGURATION REGISTER) R/W-1010 R/W-1010 DESENSTHR<3:0> PSAVTHR<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-4 DESENSTHR<3:0>: Desensitization Threshold Field bits This field defines an absolute level on the RSSI signal to activate receive signal processor if and only if PSAV = 1. Unit is 4 dB/LSB. Unsigned encoding is used. bit 3-0 PSAVTHR<3:0>: Frame Detection Threshold Register Field bits This field defines a relative (relative to the last 4 µs RSSI value) threshold level on the RSSI signal to activate receive signal processor, if PSAV = 1. Unit is 0.5 dB/LSB. Unsigned encoding is used.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 59 MRF24XA REGISTER 2-45: BBCON (BASEBAND CONFIGURATION REGISTER) R/W-0 R/W-0 R/W-11 R/W-0 R/W-001 RNDMOD AFCOVR RXGAIN<1:0> PRMBHOLD PRMBSZ<2:0> bit 7 bit 0 Legend: W = Writable bit R = Readable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 RNDMOD: Random modulation bit By setting this bit, the transmitter will randomly transmit DSSS symbols or MSK chips if PRMBHOLD bit is set. The purpose of this register is only for testing. bit 6 AFCOVR: AFC override bit By setting this bit, receiver will use CFOMEAS register as the CFO in reception. bit 5-4 RXGAIN<1:0>: Receiver Gain Register Field bits By setting this bit, the AGC operation can be inhibi ted in the receiver and the receiver radio gain configuration can be selected between three different gain levels. Encoding: 11 = AGC operation is enabled (default value) 10 = High gain 01 = Middle gain 00 = Low gain This feature can be used for testing and streaming purposes. To reduce the required interframe-gap, the RXGAIN should be set to one of the fixed gain options when the MAC is in Streaming mode. bit 3 PRMBHOLD: Preamble Hold Enable bit Effect: Appends extra bytes to the transmitted preamble in endless repetition until it is cleared. Details: The hardware checks this bit during tr ansmission before finish ing the pream ble. The appropriate preamble byte and modulation format is applied as determined by DR<2:0> and the register OPTIMAL. When this flag is released the transmissi on of the current preamble byte is completed followed by transmitting the LENGTH field and the payload. 1 = Enable endless preamble repetition 0 = Disable/stop endless preamble repetition bit 2-0 PRMBSZ<2:0>: Preamble Size Adjustment Field bits Allows adjusting the transmitted preamble length when OPTIMAL = 1. Encoding: 500 kbps preamble length = (PRMBSZ<2> + 4) units, where unit = 16 μs (1 octet at 500 kbps)

1 Mbps preamble length = (PRMBSZ<1:0> + 8) units, where unit = 4 μs (1 octet at 2 Mbps)

2 Mbps preamble length = (PRMBSZ<1:0> + 8) units, where unit = 4 μs (1 octet at 2 Mbps)

Legacy frames, and 125/250 kbps optimized frames are not affected by this register field.

DS70005023B-page 60 Advanced  2011-2013 Microchip Technology Inc. REGISTER 2-46: IFGAP (INTER FRAME CONFIGURATION REGISTER) REGISTER 2-47: TXPOW (TRANSMIT POWER CONFIGURATION REGISTER) R-000 R/W-10111 r IFGAP<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-5 Reserved: Maintain as ‘0’ bit 4-0 IFGAP<4:0>: TX Interframe-Gap Field bits This field allows configuring a TX interframe-gap ranging from 0 to 30 μs. This duration is enforced as a minimum separation between the last sample of a transmitted frame and the start of the preamble for a potential subsequent frame transmission. Unit is 2 μs/LSB. R/W-000 R/W-11111 CHIPBOOST<2:0> TXPOW<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-5 CHIPBOOST<2:0>: TX Chip Boosting Field bits This field modifies the spectrum of the OQPSK transmission. bit 4-0 TXPOW<4:0>: TX Power Register Field bits This field allows configuring a TX power ranging from -17.5 to 0 dBm. Encoding: 10101 = 0 dBm 00001 = -17.5 dBm 00000 = PA OFF

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 61 MRF24XA REGISTER 2-48: TX2IDLE (TRANSMIT POWER DOWN TO IDLE CONFIGURATION REGISTER) REGISTER 2-49: TX2TXMA (TRANSMIT POWE R-UP TO MEDIUM ACCESS CONFIGURATION REGISTER) R-0 R/W-00011 r TX2IDLE<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-5 Reserved: Maintain as ‘0’ bit 4-0 TX2IDLE<4:0>: Transmit Power Down to Idle Duration Field bits Defines the duration of the interval while PLL cannot be tuned (turned off or change channel) following that the transmitter and external PA (if PAE = 1) are turned down together. Representation: 1 μs/1 LSB. No offset. R-0 R/W-00011 r TX2TXMA<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-5 Reserved: Maintain as ‘0’ bit 4-0 TX2TXMA<4:0>: Transmit Power-Up to Medium Access Configuration Field bits Defines the time interval between turning on the internal transmitter of the device and the start time of medium access (start of the PHY-layer frame). TX_TO_TXMA = The transient time of the transmitter, in the following scenarios: PAEN = 0 PAEN = 1, but the PA is turned on first. PA_TO_TXMA = TX_TO_TXMA + PA transient time. PAEN = 1, but the TX and PA transients are NOT sequenced. TX_TO_TXMA = The transient time of the transmitter + PA_TO_TXMA: PAEN = 1, and the transmitter is turned on first (transients are sequenced). Representation: 1 μs/1 LSB. No offset.

DS70005023B-page 62 Advanced  2011-2013 Microchip Technology Inc. REGISTER 2-50: EXTPA (EXTERNAL POWE R AMPLIFIER CONFIGURATION REGISTER) REGISTER 2-51: EXTLNA (EXTERNAL LOW-NO ISE AMPLIFIER CONFIGURATION REGISTER) R-0 R/W-0 R/W-0 R/W-00100 r EXTPAP PAEN PA2TXMA<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 Reserved: Maintain as ‘0’ bit 6 EXTPAP: External Power Amplifier Polarity bit 1 = 3.3V turns Power Amplifier ON 0 = GND turns Power Amplifier ON bit 5 PAEN: External Power Amplifier Enable bit This bit enables the PA pin to output the control signal for external Power Amplifier. bit 4-0 PA2TXMA<4:0>: External Power Amplifier Power-up to Medium Access Configuration Field bits Defines the time interval between turning on the external PA of the device and the start time of medium access (start of the PHY-layer frame). PA_TO_TXMA = The transient time of the external PA, in the following scenarios: PAEN = 1, and the transmitter is turned on first. TX_TO_TXMA = PA_TO_TXMA + TX transient time. PAEN = 1, but the TX and PA transients are NOT sequenced. PA_TO_TXMA = The transient time of the PA + TX_TO_TXMA: PAEN = 1, and the external power amplifier is turned on first (transients are sequenced). Representation: 1 μs/1 LSB. No offset R-0 R/W-0 R/W-0 R/W-00100 r EXTLNAP LNAEN LNADLY<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 Reserved: Maintain as ‘0’ bit 6 EXTLNAP: External Low Noise Amplifier Polarity bit 1 = 3.3V turns Low-Noise Amplifier ON 0 = GND turns Low-Noise Amplifier ON bit 5 LNAEN: External Low-Noise Power Amplifier Enable bit This bit enables the LNA pin to output the control signal for external Low-Noise Amplifier. bit 4-0 LNADLY<4:0>: External Low-Noise Amplifier Power-Up Transient Delay Field bits Defines the duration between the LNA is turned on and the reception is valid. LNA and internal receiver are turned on together. The longer transient is awaited before input signal is accepted as valid. Representation: 1 μs/1 LSB. No offset.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 63 MRF24XA REGISTER 2-52: BATMON (BATTERY MONITOR CONFIGURATION REGISTER) R-0 R/W-1 R/W-11111 r BATMONPD BATMON<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-6 Reserved: Maintain as ‘0’ bit 5 BATMONPD: Battery Monitor Power Down bit If battery monitor is working and battery voltage has dropped below the threshold by BATMON<4:0>, then WARNIF is set. 1 = Battery monitor is OFF 0 = Battery monitor is working bit 4-0 BATMON<4:0>: Battery Monitor Threshold Field bits VTHRESHOLD = 3.6 - 0.071 * BATMON<4:0> (V) REGISTER 2-53: SECKEY ( SECURITY KEY REGISTER) R/W-00000000 SECKEY<127:120> bit 127 bit 120 R/W-00000000 SECKEY<119:112> bit 119 bit 112 R/W-00000000 SECKEY<111:104> bit 111 bit 104 R/W-00000000 SECKEY<103:96> bit 103 bit 96 R/W-00000000 SECKEY<95:88> bit 95 bit 88 R/W-00000000 SECKEY<87:80> bit 87 bit 80 R/W-00000000 SECKEY<79:72> bit 79 bit 72

DS70005023B-page 64 Advanced  2011-2013 Microchip Technology Inc. R/W-00000000 SECKEY<71:64> bit 71 bit 64 R/W-00000000 SECKEY<63:56> bit 63 bit 56 R/W-00000000 SECKEY<55:48> bit 55 bit 48 R/W-00000000 SECKEY<47:40> bit 47 bit 40 R/W-00000000 SECKEY<39:32> bit 39 bit 32 R/W-00000000 SECKEY<31:24> bit 31 bit 24 R/W-00000000 SECKEY<23:16> bit 23 bit 16 R/W-00000000 SECKEY<15:8> bit 15 bit 8 R/W-00000000 SECKEY<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 127-0 SECKEY<128:0>: Security Key Field bits Security key that is used in security operation. REGISTER 2-53: SECKEY (SECURIT Y KEY REGISTER) (CONTINUED)

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 65 MRF24XA REGISTER 2-54: SECNONCE ( SECURITY NONCE REGISTER) R/W/HS/HC-00000000 SECNONCE<103:96> bit 103 bit 96 R/W-00000000 SECNONCE <95:88> bit 95 bit 88 R/W-00000000 SECNONCE<87:80> bit 87 bit 80 R/W-00000000 SECNONCE<79:72> bit 79 bit 72 R/W-00000000 SECNONCE<71:64> bit 71 bit 64 R/W-00000000 SECNONCE<63:56> bit 63 bit 56 R/W-00000000 SECNONCE<55:48> bit 55 bit 48 R/W-00000000 SECNONCE<47:40> bit 47 bit 40 R/W-00000000 SECNONCE<39:32> bit 39 bit 32 R/W-00000000 SECNONCE<31:24> bit 31 bit 24 R/W-00000000 SECNONCE<23:16> bit 23 bit 16 R/W-00000000 SECNONCE<15:8> bit 15 bit 8

DS70005023B-page 66 Advanced  2011-2013 Microchip Technology Inc. REGISTER 2-55: SFD1 (START FRAME DELI MITER PATTERN 1 CONFIGURATION REGISTER) R/W-00000000 SECNONCE<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 103-0 SECNONCE<103:0>: Security Nonce Field bits The register represents security nonce that is used in security operation. automatically calculate this field. REGISTER 2-54: SECNONCE (SECURIT Y NONCE REGISTER) (CONTINUED) R/W-00100001 SFD1<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-0 SFD1<7:0>: Start Frame Delimiter Pattern 1 Register Field bits This octet is used as SFD pattern with 2 Mbps rate when OPTIMAL = 0, and as the MSB of the SFD pattern with 2 Mbps rate when OPTIMAL = 1. When OPTIMAL = 0: The hexadecimal digits must be different from 0x 0 and different from the corresponding digits in SFD<k>, k = 2, 3, 4, 6, and the value 0xA7 is forbidden. When OPTIMAL = 1: The hexadecimal digits must be different from 0x0 and different from the corresponding digits of SFD2.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 67 MRF24XA REGISTER 2-56: SFD2 (START FRAME DELIMITER PATTERN 2 CONFIGURATION REGISTER) REGISTER 2-57: SFD3 (START FRAME DELI MITER PATTERN 3 CONFIGURATION REGISTER) R/W-11110001 SFD2<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-0 SFD2<7:0>: Start Frame Delimiter Pattern 2 Register Field bits This octet is used as SFD pattern with 1 Mbps rate when OPTIMAL = 0, and as the MSB of the SFD pattern with 1 Mbps rate when OPTIMAL = 1. When OPTIMAL = 0: The hexadecimal digits must be different from 0x 0 and different from the corresponding digits in SFD<k>, k = 1, 3, 4, 6, and the value 0xA7 is forbidden. When OPTIMAL = 1: The hexadecimal digits must be different from 0x0 and different from the corresponding digits of SFD2. R/W-00111011 SFD3<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-0 SFD3<7:0>: Start Frame Delimiter Pattern 3 Register Field bits This octet is used as SFD pattern with 500 kbps rate. When OPTIMAL = 0: The hexadecimal digits must be different from 0x0 and different from the correspond digits in SFD<k>, k = 1, 2, 4, 6, and the value 0xA7 is forbidden. When OPTIMAL = 1: The hexadecimal digits must be different from 0x0.

DS70005023B-page 68 Advanced  2011-2013 Microchip Technology Inc. REGISTER 2-58: SFD4 (START FRAME DELI MITER PATTERN 4 CONFIGURATION REGISTER) REGISTER 2-59: SFD5 (START FRAME DELI MITER PATTERN 5 CONFIGURATION REGISTER) R/W-11100101 SFD4<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-0 SFD4<7:0>: Start Frame Delimiter Pattern 4 Register Field bits This octet is used as SFD pattern with 250 kbps rate when proprietary MAC is in use, otherwise the pattern defined in the standard is used instead, that is, 0xA7. The hexadecimal digits must be different from 0x0 and from the corresponding digits in SFD<k>, where k = 6 or 1, 2, 3. When OPTIMAL = 0, the value 0xA7 is forbidden. R/W-01001101 SFD5<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-0 SFD5<7:0>: Start Frame Delimiter Pattern 5 Register Field bits This octet is used as the MSB of the SFD pattern with 125 kbps rate.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 69 MRF24XA REGISTER 2-60: SFD6 (START FRAME DELI MITER PATTERN 6 CONFIGURATION REGISTER) REGISTER 2-61: SFD7 (START FRAME DELI MITER PATTERN 7 CONFIGURATION REGISTER) R/W-10101000 SFD6<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-0 SFD6<7:0>: Start Frame Delimiter Pattern 6 Register Field bits When OPTIMAL = 1: This octet is used as the LSB of the SFD pattern with 2 Mbps rate. This octet is used as the LSB of the SFD pattern with 125 kbps rate. When OPTIMAL = 0: The value 0xA7 is forbidden.The hexadecimal digits must be different from 0x0 and different from the corresponding digits in SFD<k>, k = 4 or 1, 2, 3. R/W-11001000 SFD7<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-0 SFD7<7:0>: Start Frame Delimiter Pattern 7 Register Field bits When OPTIMAL = 1, this octet is used as the LSB of the SFD pattern with 1 Mbps rate.

DS70005023B-page 70 Advanced  2011-2013 Microchip Technology Inc. NOTES:

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 71 MRF24XA

3.0 FUNCTIONAL DESCRIPTION

3.1 Reset

MRF24XA has three reset types:

Power-On Reset (POR) – MRF24XA has built-in POR circuitry that automati cally resets all control registers when power is applied. After POR MRF24XA will start the internal calibration pro- cess. RDYIF inte rrupt is set when the device is ready to use.
RESET Pin – MRF24XA can be reset by the host MCU by asserting the RESET pin18 low. All control registers are reset to default value. By de-asserting the RESET pin, MRF24XA will start the internal calibration process. RDYIF interrupt is set when the device is ready to use.
Software Reset – Software Reset can be performed by the host MCU through the SPI interface. REGRST register (0x00) provides reset signals for the configuration registers, while FSMRST register (0x 01) provides reset functionality for the internal state machines. The reset signals are asynchronous, their level is evaluated immediately without any internal synchronization. The recommended reset sequences: - FSMRST = 0x1F - REGRST = 0x3F - REGRST = 0x00 - FSMRST = 0x00 REGISTER 3-1: REGRST (CONFIGURATION RESET) (1) REGISTER 3-2: FSMRST (CONTROLLER RESET)(1) R-00 R/W-000000 r REGRST<5:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-6 Reserved: Maintain as ‘0’ bit 5-0 REGRST<5:0>: Asynchronous Register Reset Field bits 111111 = Reset configuration registers to default 000000 = Release from reset Note 1: After setting the field, the host MCU must also clear it to release the device from reset. R-000 R/W-00000 r FSMRST<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-5 Reserved: Maintain as ‘0’ bit 4-0 FSMRST<4:0>: Asynchronous Functional Reset Field bits 11111 = Reset state machines to default 00000 = Release from reset Note 1: After setting the field, the host MCU must clear it to release the device from reset.

DS70005023B-page 72 Advanced  2011-2013 Microchip Technology Inc. TABLE 3-1: REGISTERS ASSOCIATED WITH RESET

3.2 Interrupts

MRF24XA has one interrupt (INT ), pin 13 that signals interrupt events to the host MCU. Interrupt sources are enabled through PIE1 (0x08) to PIE4 (0x0B) register bits. All interrupts can be enabled or disabled by GIE bit (PINCON<6>). If GIE bit is cleared, all interrupts are disabled, and INT pin remains in inactive state. Despite interrupts are cleared by GIE bit clearing, the interrupt flags of the enabled interrupt sources are set. Interrupt flags are located in the PIR1 (0x04) to PIR4 (0x07) reg- isters. The PIRX register bits clears-to-zero upon read. Therefore, the host MCU should read and store the value of the PIRX registers and check the bits to determine which interr upt occurred. The INT pin will continue to signal an interrupt until all active interrupts flags in PIRX registers are read. REGISTER 3-3: PINCON (PIN CONFIGURATION REGISTER) Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 REGRST r REGRST<5:0> FSMRST r FSMRST<4:0> Legend: r = Reserved, read as ‘0’. R-0 R/W-1 R-0 R-x R/W-0000 rG I E r IRQIF GPIOMODE<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 Reserved: Maintain as ‘0’ bit 6 GIE: General Interrupt Enable bit This bit enables to output IRQIF on INT pin. Note that the polarity of INT pin is active low. bit 5 Reserved: Maintain as ‘0’ bit 4 IRQIF: Interrupt Request Pending bit This bit is the OR relationship of the interrupt flags that are enabled. bit 3-0 GPIOMODE <3:0>: GPIO Mode Field bits This bit field is out of scope.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 73 MRF24XA

3.2.1 PIEx - INTERRUPT ENABLE

Register bits of PIE1 to PIE4 registers enable the appropriate interrupt sources to generate interrupts to the host MCU through INT pin. The interrupt is enabled by setting the appropriate bit to ‘1’. REGISTER 3-4: PIE1 (PERIP HERAL INTERRUPT ENABLE 1) R-0 R/W-1 R/W-1 R-0 R/W-1 R/W-1 R-0 r RDYIE IDLEIE r CALSOIE CALHAIE r bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-6 Reserved: Maintain as ‘0’ bit 5 RDYIE: Ready Interrupt Enable bit This bit masks the RDYIF interrupt bit. bit 4 IDLEIE: Idle Interrupt Enable bit This bit masks the IDLEIF interrupt bit. bit 3 Reserved: Maintain as ‘0’ bit 2 CALSOIE: Calibration Soft Interrupt Enable bit This bit masks the CALSOIF interrupt bit. bit 1 CALHAIE: Calibration Hard Interrupt Enable bit This bit masks the CALHAIF interrupt bit. bit 0 Reserved: Maintain as ‘0’

DS70005023B-page 74 Advanced  2011-2013 Microchip Technology Inc. REGISTER 3-5: PIE2 (PERIP HERAL INTERRUPT ENABLE 2) R/W-1 R/W-1 R/W-0 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 TXIE TXENCIE TXMAIE TXACKIE TXCSMAIE TXSZIE TXOVFIE FRMIE bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 TXIE: Transmit Interrupt Enable This bit masks the TXIF interrupt register. bit 6 TXENCIE: Transmit Encryption and Authentication Interrupt Enable bit This bit masks the TXENCIF interrupt register. bit 5 TXMAIE: Transmitter Medium Access Interrupt Enable bit This bit masks the TXMAIF interrupt register. bit 4 TXACKIE: Transmission Unacknowledged Failure Interrupt Enable bit This bit masks the TXACKIF interrupt register. bit 3 TXCSMAIE: Transmitter CSMA Failure Interrupt Enable bit This bit masks the TXCSMAIF interrupt register. bit 2 TXSZIE: Transmit Packet Size Error Interrupt Enable bit This bit masks the TXSZIF interrupt register. bit 1 TXOVFIE: Transmitter Overflow Interrupt Enable bit This bit masks the TXOVFIF interrupt register. bit 0 FRMIE: Frame Format Error Interrupt Flag bit This bit masks the FRMIF interrupt register.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 75 MRF24XA REGISTER 3-6: PIE3 (PERIP HERAL INTERRUPT ENABLE 3) R/W-1 R/W-1 R/W-1 R-0 R/W-0 R/W-0 R/W-1 R/W-1 RXIE RXDECIE RXTAGIE r RXIDENTIE RXFLTIE RXOVFIE STRMIE bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 RXIE: Received Successful Interrupt Enable bit This bit masks the RXIF interrupt register. bit 6 RXDECIE: Receiver Decryption/Authentication Passed Interrupt Enable bit This bit masks the RXDECIF interrupt register. bit 5 RXTAGIE: Receiver Decryption/Authentication Failure Interrupt Enable bit This bit masks the RXTAGIF interrupt register. bit 4 Reserved: Maintain as ‘0’ bit 3 RXIDENTIE: Received Packet Identical Interrupt Enable bit This bit masks the RXIDENTIF interrupt register. bit 2 RXFLTIE: Received Packet Filtered Interrupt Enable bit This bit masks the RXFLTIF interrupt register. bit 1 RXOVFIE: Receiver Overflow Interrupt Enable bit This bit masks the RXOVFIF interrupt register. bit 0 STRMIE: Receive Stream Time-out Error Interrupt Enable bit This bit masks the STRMIF interrupt register.

DS70005023B-page 76 Advanced  2011-2013 Microchip Technology Inc. REGISTER 3-7: PIE4 (PERIP HERAL INTERRUPT ENABLE 4) R/W-0 R/W-0 R/W-1 R/W-1 R/W-1 R/W-0 R/W-0 R/W-0 TXSFDIE RXSFDIE ERRORIE WARNIE ED CCAIE GPIO2IE GPIO1IE GPIO0IE bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 TXSFDIE: Transmit SFD Sent Interrupt Enable bit This bit masks the TXSFDIF interrupt register. bit 6 RXSFDIE: Receive SFD Detected Interrupt Enable bit This bit masks the RXSFDIF Interrupt Enable. bit 5 ERRORIE: General Error Interrupt Enable bit This bit masks the ERRORIF interrupt register. bit 4 WARNIE: Warning Interrupt Enable bit This bit masks the WARNIF interrupt register. bit 3 EDCCAIE: Energy Detect/CCA Done Interrupt Enable bit This bit masks the EDCCAIF interrupt register. bit 2 GPIO2IE: GPIO2 Interrupt Enable bit This bit masks the GPIO2IF interrupt register. bit 1 GPIO1IE: GPIO1 Interrupt Enable bit This bit masks the GPIO1IF interrupt register. bit 0 GPIO0IE: GPIO0 Interrupt Enable bit This bit masks the GPIO0IF interrupt register.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 77 MRF24XA

3.2.2 PIRX- PERIPH ERAL INTERRUPT

Register bits of PIR1 to PIR4 registers are indicating the source of the interrupt. The interrupt must be enabled by setting the appropriate bit to ‘1’ in the cor- responding PIEx register . The contents of the PIRX registers are automatically cleared by MRF24XA upon the host MCU reads the content of the register. MCU must store the PIRX register values as needed in the firmware. REGISTER 3-8: PIR1 (PERIPHERAL INTERRUPT REGISTER 1) R/HS-1 R-0 R/HS-0 R/W/HC-0 R-0 R/W/HS-0 R/W/HS-0 R-0 VREGIF r RDYIF IDLEIF r CALSOIF CALHAIF r bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 VREGIF: Voltage regulator On Interrupt Flag bit(1) This is a NON-persistent bit. The register bit is initialized to 1 on 1.2V reset except when RESET is used and cleared only when PIR1 is read. Note that the corresponding IE bit is not implemented. bit 6 Reserved: Maintain as ‘0’ bit 5 RDYIF: Ready state Interrupt Flag bit Set each time when READY state is reached:

When calibration ended (CALST = 0)
When initialization ended (INITDONESF = 1)
When crystal is ramped up (XTALSF = 1) This bit is cleared, when PIR1 is read. bit 4 IDLEIF: Idle state Interrupt Flag bit Set each time when IDLESF is set if it was not triggered by the MCU. Not changed when MCU aborts an action by clearing either of TX ST, TXENC, RXDEC, EDST or CCA bits. This bit is cleared, when PIR1 is read. bit 3 Reserved: Maintain as ‘0’ bit 2 CALSOIF: Calibration Soft Interrupt Flag bit This flag indicates that calibration is probably needed (CALST) although the radio is still functional. It also warns of a possible degradation in signal quality and current consumption, and a risk of CALHAIF interrupt. This bit is cleared, when PIR1 is read. bit 1 CALHAIF: Calibration Hard Interrupt Flag bit This flag indicates that immediate calibration (CALST ) is mandatory, otherwise the radio is not func- tional. The device enters into malfunction state. This bit is cleared, when PIR1 is read. bit 0 Reserved: Maintain as ‘0’ Note 1: Generated non-maskable interrupt is gated off until the 1.2V reset is released.

DS70005023B-page 78 Advanced  2011-2013 Microchip Technology Inc. REGISTER 3-9: PIR2 (PERIPHERAL INTERRUPT REGISTER 2) R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 TXIF TXENCIF TXMAIF TXACKIF TX CSMAIF TXSZIF TXOVFIF FRMIF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 TXIF: Transmission Done Interrupt Flag bit The current TX operation (TXST) has successfully completed. This event is not changed when a hardware generated ACK packet has completed transmission or when a packet has been repeated. Non-persistent, cleared by SPI read. bit 6 TXENCIF: Transmit Encoding Interrupt Flag bit The TX packet was successfully encrypted and/or complemented with a Message Integrity Code (MIC). Set by the device after TXENC = 1, when TXENC is cleared. Non-persistent, cleared by SPI read. bit 5 TXMAIF: Transmitter Medium Access Interrupt Flag bit Set by the device when the medium is accessed, t hat is, when the first sample in the preamble is transmitted on air. Non-persistent, cleared by SPI read. bit 4 TXACKIF: Transmission Unacknowledged Failure Interrupt Flag bit Set by the device when Acknowledge is not receiv ed after the configured maximum number of trans- mission retries RETXMCNT<3:0>, provided that the frame control field of t he transmitted frame indi- cates AckReq = 1 and AUTOACKEN = 1. Non-persistent, cleared by SPI read. bit 3 TXCSMAIF: Transmitter CSMA Failure Interrupt Flag bit Set by the device when CSMA-CA finds the channel busy for BOMCNT<2:0> number of times, provided that CSMAEN = 1 is configured. Non-persistent, cleared by SPI read. bit 2 TXSZIF: Transmit Packet Size Error Interrupt Flag bit Following TXST is set the packet size (including MIC tags and CRC) is found to be zero or to be greater than the maximum size that the buffers can support. Non-persistent, cleared by SPI read. bit 1 TXOVFIF: Transmitter Overflow Interrupt Flag bit The Host Controller attempted to write a TX buffer that was not empty (TXBUFEMPTY = 0). Non-persistent, cleared by SPI read. bit 0 FRMIF: Frame Format Error Interrupt Flag bit Set if the transmitter/receiver fails to parse the frame in the buffer (because it is not as it should be or it is corrupted in demodulation). Non-persistent, cleared by SPI read.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 79 MRF24XA REGISTER 3-10: PIR3 (PERIPHE RAL INTERRUPT REGISTER 3) R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 RXIF RXDECIF RXTAGIF r RXIDENTIF RXFLTIF RXOVFIF STRMIF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 RXIF: Received Successful Interrupt Flag bit Set by the device when a frame has passed packet filtering and has been accepted (refer to Register 5-1). This interrupt flag is only set once for a packet and is not set when the packet is the duplicate of a repeated transmission, (that is, sequence number matches with the previously received frame). Non-persistent, cleared by SPI read. bit 6 RXDECIF: Receiver Decryption/Authentication Passed Interrupt Flag bit Set by the device when decryption/authentication finished without error. Non-persistent, cleared by SPI read. bit 5 RXTAGIF: Receiver Decryption/Authentication Failure Interrupt Flag bit Set by the device when decryption/authentication finished with error. Non-persistent, cleared by SPI read. bit 4 Reserved: Maintain as ‘0’ bit 3 RXIDENTIF: Received Packet Identical Interrupt Flag bit Set by the device when the packet is the duplicate of a repeated transmission (that is, sequence num- ber, source address matches with the previously received frame). Non-persistent, cleared by SPI read. bit 2 RXFLTIF: Received Packet Filtered Interrupt Flag bit Set by the device when a packet was received, but rejected by one or more RX filters (refer to Register 5-1). Non-persistent, cleared by SPI read. bit 1 RXOVFIF: Receiver Overflow Error Interrupt Flag bit Set by the device to indicate that a packet was received, but all RX buffers were full. Consequently the packet was not received, but was discarded instead (1). Non-persistent, cleared by SPI read. bit 0 STRMIF: Receive Stream Time-out Error Interrupt Flag bit Set by the device to indicate the duration specifie d in STRMTO has elapsed since the last received packet while in RX-Streaming mode, and the MAC clears the stored sequence number. Non-persistent, cleared by SPI read. Note 1: In packet-mode one buffer is used for received frames, whereas in RX-Streaming mode both buffers are used for reception.

DS70005023B-page 80 Advanced  2011-2013 Microchip Technology Inc. REGISTER 3-11: PIR4 (PERIPHERAL INTERRUPT REGISTER 4) TABLE 3-2: REGISTERS ASSOCIATED WITH INTERRUPTS R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 TXSFDIF RXSFDIF ERRORIF WARNIF EDCCAIF GPIO2IF GPIO1IF GPIO0IF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 TXSFDIF: Transmit SFD Sent Interrupt Flag bit Set by the device when the last sample of the SFD field has been sent on the air. Non-persistent, cleared by SPI read. bit 6 RXSFDIF: Receive SFD Detected Interrupt Flag bit Set by the device when the SFD field of the received frame is detected (1). Non-persistent, cleared by SPI read. bit 5 ERRORIF: General Error Interrupt Flag bit Set by the device, when malfunction state is reached. bit 4 WARNIF: Warning Interrupt Flag bit Set by the device when one of the following is occurred:

Battery voltage has dropped below the threshold by BATMON<4:0> at 0x3F
Indicating that resistor is missing or not connected well bit 3 EDCCAIF: Energy Detect/CCA Done Interrupt Flag bit Set by the device when Energy-detect or CCA measurement is complete (following that the host MCU has set the EDST/CCAST bit to start the measurement and the device is clearing it in on completion). Non-persistent. Cleared by SPI read. bit 2 GPIO2IF: GPIO2 Interrupt Flag bit Set by the device if the GPIOMODE register is set to normal oper ation, the GPIO is enabled and configured to input and the level matches with the polarity. bit 1 GPIO1IF: GPIO1 Interrupt Flag bit Set by the device if the GPIOMODE register is set to normal oper ation, the GPIO is enabled and configured to input and the level matches with the polarity. bit 0 GPIO0IF: GPIO0 Interrupt Flag bit Set by the device if the GPIOMODE register is set to normal oper ation, the GPIO is enabled and configured to input and the level matches with the polarity. Note 1: The detection latency (0…1 µs after the last sample of the SFD). Note that the SFD may trigger on noise or interference. Note that the CFOMEAS<7:0> indication becomes valid when RXSFDIF is asserted. Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 PIR1 VREGIF r RDYIF IDLEIF r CALSOIF CALHAIF r PIR2 TXIF TXENCIF TXMAIF TXACKIF TXCSMAIF TXSZIF TXOVFIF FRMIF PIR3 RXIF RXDECIF RXTAGIF r RXIDENTIF RXFLTIF RXOVFIF STRMIF PIR4 TXSFDIF RXSFDIF ERRORIF WARNI F EDCCAIF GPIO2IF GPIO1IF GPIO0IF PIE1 r RDYIE IDLEIE r CALSOIE CALHAIE r PIE2 TXIE TXENCIE TXMAIE TXACKIE TXCSMAIE TXSZIE TXOVFIE FRMIE PIE3 RXIE RXDECIE RXTAGIE r RXIDENTIE RXFLTIE RXOVFIE STRMIE PIE4 TXSFDIE RXSFDIE ERRORIE WARNI E EDCCAIE GPIO2IE GPIO1IE GPIO0IE PINCON r GIE r IRQIF GPIOMODE<3:0> Legend: r = Reserved.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 81 MRF24XA

3.3 GPIO Functions and GPIO

MRF24XA has three GPIO pins, GPIO2 pin 12, GPIO1 pin 11 and GPIO0 pin 10. GPIO pins can be used as general purpose IO pins or GPIOs can monitor internal states. Refer to Register 3-17 for more information on GPIO monitoring.

3.3.1 GPIO GENERAL IO

To operate MRF24XA GPIOx pins in general purpose IO mode, GPIOEN bit (0x0D<7>) must be set to ‘1’ and GPIOMODE<3:0> bits (0x0 C<3:0>) must be set to ‘0000’. Input or output selection of GPIOs are configured by the TRISGPIOx bits (0x0D<6:4>). Clearing the TRIS- GPIOx bit sets the appropriate GPIO line to output mode. The default GPIO line direction is input after POR. GPIO lines in input mode can be used with Schmitt Trigger input buffers. Schmitt Triggers can be enabled by STENGPIOx bits (0x0E<2:0>). Setting the STENGPIOx bit to ‘1’ enables Schmitt Trigger input of the appropriate pin. GPIO data can be read or written to through the GPIO bits (0x0D<2:0>). GPIO lines can have active pull-up or pull-down. PULLENGPIOx (0x0F<2:0>) bits enable line pulling function. Setting PULLENGPIOx bit to ‘ 1’ enables active pull up or pull down circuit. Pull direction can be set by PULLDIRGPIOx bi t (0x0F<6:4>). Setting PULLDIRGPIOx bit to ‘1’ defines pull-up, while clearing the bit defines pull-down on the appropriate GPIO line.

3.3.2 GPIO INTERRUPT HANDLING

GPIO lines can also generate interrupts. To use GPIO interrupts, the appropriate GPIOxIE bit (0x0B<2:0>) must be set to ‘ 1’ to enable the interrupt generation. GIE bit (0x0C<6>) must also be set to ‘ 1’ to enable interrupt generation on INT pin. The GPIO interrupt polarity can be selected through GPIOxP bits (0x0E<6:4>). Setting GPIOxP bit to ‘1’ triggers interrupt logic at the rising edge of the input signal. While clear- ing the bit enables interrupt generation on the falling edge of the input pin.

DS70005023B-page 82 Advanced  2011-2013 Microchip Technology Inc. REGISTER 3-12: PIR4 (PERIPHERAL INTERRUPT REGISTER 4) REGISTER 3-13: PIE4 (PERIPHERAL INTERRUPT ENABLE 4) R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 TXSFDIF RXSFDIF ERRORIF WARNIF EDCCAIF GPIO2IF GPIO1IF GPIO0IF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-3 Out of scope bit 2 GPIO2IF: GPIO2 Interrupt Flag bit Set by the device if the GPIOMODE register is se t to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. bit 1 GPIO1IF: GPIO1 Interrupt Flag bit Set by the device if the GPIOMODE register is se t to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. bit 0 GPIO0IF: GPIO0 Interrupt Flag bit Set by the device if the GPIOMODE register is se t to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. R/W-0 R/W-0 R/W-1 R/W-1 R/W-1 R/W-0 R/W-0 R/W-0 TXSFDIE RXSFDIE ERRORIE WARNIE EDCCAIE GPIO2IE GPIO1IE GPIO0IE bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-3 Out of scope bit 2 GPIO2IE: GPIO2 Interrupt Enable bit This bit masks the GPIO2IF interrupt register. bit 1 GPIO1IE: GPIO1 Interrupt Enable bit This bit masks the GPIO1IF interrupt register. bit 0 GPIO0IE: GPIO0 Interrupt Enable bit This bit masks the GPIO0IF interrupt register.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 83 MRF24XA REGISTER 3-14: GPIO (GENER AL PURPOSE I/O REGISTER) R/W-0 R/W-1 R/W-1 R/W-1 R-0 R/W-0 R/W-0 R/W-0 GPIOEN TRISGPIO2 TRISGPIO1 TRISGPIO0 r GPIO2 GPIO1 GPIO0 bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 GPIOEN: GPIO Enable bit This bit enables the GPIO’s control, only if GPIOMODE is configured into Normal mode. The other GPI- OMODE configuration automatically controls GPIO pins. bit 6 TRISGPIO2: Tri-state Control for GPIO 2 Pin bit If set, the pin is configured into input mode. Value can be read from GPIO2 bit. If cleared, the pin is configured into output mode. Value can be set through the GPIO2 bit. bit 5 TRISGPIO1: Tri-state Control for GPIO 1 Pin bit If set, the pin is configured into input mode. Value can be read from GPIO1 bit. If cleared, the pin is configured into output mode. Value can be set through the GPIO1 bit. bit 4 TRISGPIO0: Tri-state Control for GPIO 0 Pin bit If set, the pin is configured into input mode. Value can be read from GPIO0 bit. If cleared, the pin is configured into output mode. Value can be set through the GPIO0 bit. bit 3 Reserved: Maintain as ‘0’ bit 2 GPIO2: GPIO 2 Value bit This bit represents the value on the GPIO 2 pin. bit 1 GPIO1: GPIO 1 Value bit This bit represents the value on the GPIO 1 pin. bit 0 GPIO0: GPIO 0 Value bit This bit represents the value on the GPIO 0 pin.

DS70005023B-page 84 Advanced  2011-2013 Microchip Technology Inc. REGISTER 3-15: STGPIO (SCHMITT TRIG GER GENERAL PURPOSE I/O REGISTER) R-0 R/W-0 R/W-0 R/W-0 R-0 R/W-0 R/W-0 R/W-0 r GPIO2P GPIO1P GPIO0P r STENGPIO2 STENGPIO1 STENGPIO0 bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 Reserved: Maintain as ‘0’ bit 6 GPIO2P: GPIO 2 Polarity bit This bit controls GPIO2IF polarity when configured into input mode. 1 = Rising edge 0 = Falling edge bit 5 GPIO1P: GPIO 1 Polarity bit This bit controls GPIO1IF polarity when configured into input mode. 1 = Rising edge 0 = Falling edge bit 4 GPIO0P: GPIO 0 Polarity bit This bit controls GPIO0IF polarity when configured into input mode. 1 = Rising edge 0 = Falling edge bit 3 Reserved: Maintain as ‘0’ bit 2 STENGPIO2: Schmitt Trigger Enable GPIO 2 This bit enables Schmitt-trigger circuit on GPIO 2 pad. It is turned off by default. 1 = Schmitt trigger enabled 0 = Schmitt trigger disabled bit 1 STENGPIO1: Schmitt Trigger Enable GPIO 1 This bit enables Schmitt-trigger circuit on GPIO 1 pad. It is turned off by default. 1 = Schmitt trigger enabled 0 = Schmitt trigger disabled bit 0 STENGPIO0: Schmitt Trigger Enable GPIO 0 This bit enables Schmitt-trigger circuit on GPIO 0 pad. It is turned off by default. 1 = Schmitt trigger enabled 0 = Schmitt trigger disabled

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 85 MRF24XA REGISTER 3-16: PULLGPIO (PULL CONT ROL GENERAL PURPOSE I/O REGISTER) R-0 R/W-0 R/W-0 R/W-0 R-0 R/W-0 R/W-0 R/W-0 r PULLDIRGPIO2 PULLDIRGPIO1 PULLDIRGPIO0 r PULLENGPIO2 PULLENG PIO1 PULLENGPIO0 bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 Reserved: Maintain as ‘0’ bit 6 PULLDIRGPIO2: Pull Direction on GPIO 2 bit These bits control the weak-pull circuit direction on GPIO 2 pin. 1 = Pull-up 0 = Pull-down bit 5 PULLDIRGPIO1: Pull Direction on GPIO 1 bit These bits control the weak-pull circuit direction on GPIO 1 pin. 1 = Pull-up 0 = Pull-down bit 4 PULLDIRGPIO0: Pull Direction on GPIO 0 bit These bits control the weak-pull circuit direction on GPIO 0 pin. 1 = Pull-up 0 = Pull-down bit 3 Reserved: Maintain as ‘0’ bit 2 PULLENGPIO2: Pull Enable on GPIO 2 bit This bit enables to weak-pull circuit in GPIO 2 pin. Note that when pin is configured to output, weak-pull circuit is automatically disabled. 1 = Pull enabled 0 = Pull disabled bit 1 PULLENGPIO1: Pull Enable on GPIO 1 bit This bit enables to weak-pull circuit in GPIO 1 pin. Note that when pin is configured to output, weak-pull circuit is automatically disabled. 1 = Pull enabled 0 = Pull disabled bit 0 PULLENGPIO0: Pull Enable on GPIO 0 bit This bit enables to weak-pull circuit in GPIO 0 pin. Note that when pin is configured to output, weak- pull circuit is automatically disabled. 1 = Pull enabled 0 = Pull disabled

DS70005023B-page 86 Advanced  2011-2013 Microchip Technology Inc. REGISTER 3-17: PINCON (PIN CONFIGURATION REGISTER) R-0 R/W-1 R-0 R-1 R/W-0000 r GIE r IRQIF GPIOMODE<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 Reserved: Maintain as ‘0’ bit 6 GIE: General Interrupt Enable bit This bit enables to output IRQIF on INT pin. Note that the polarity of INT pin is active low. bit 5 Reserved: Maintain as ‘0’ bit 4 IRQIF: Interrupt Request Pending bit This bit is the OR relationship of the interrupt flags that are enabled. bit 3-0 GPIOMODE <3:0>: GPIO Mode Field bit This field allows redefining the functionality of the GPIO pins Encoding: 11xx = Reserved 1011 = GPIO pins are used for Receive streaming (R XSTREAM). Pins GPIO<2:0> are used to output {RXWRBUF, BUSRDBUF, RXBUFFUL}. 1010 = GPIO pins are used for Transmit streaming (T XSTREAM). Pins GPIO<2:0> are used to output {TXRDBUF, BUSWRBUF, TXBUFEMPTY}. 1001 = Reserved 1000 = Reserved 0111 = Reserved 0110 = Reserved 0101 = Intended for supporti ng Precise Network Time Synchronization (TIMESYN). GPIO<0> is used to output TX, while GPIO<1> to output RX SFD in dication pulses. GPIO<2> can be used as in “NORMAL” operation mode. 0100 = GPIO pins are used for Radio monitoring (R FMON). Pins GPIO<2:0> are used to output RFOP<2:0>. 0011 = GPIO pins are used for MAC monitoring (M ACMON). Pins GPIO<2:0> are used to output MACOP<3:1>. 0010 = GPIO pins are used for RXFSM monitoring (R XFSMMON). Pins GPIO<2:0> are used to output receiver state-machine 000 = Preamble search 001 = Hi-rate SFD search 010 = Mid-rate SFD search 011 = Low-rate SFD search 100 = Legacy length field processing 101 = Payload processing 0001 = GPIO pins are used for AGC monitoring (AGCMON). Pins GPIO<2:0> are used to output {AGCHOLD, GAIN<1:0>} where AGCHOLD is an internal flag set when a preamble is detected by a receiver, and cleared when the AGC is set free after the end of the frame. 0000 = GPIO pins are used as General Purpose I/O’s by the host MCU (NORMAL).

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 87 MRF24XA

3.4 PA and LNA Outputs

MRF24XA has a Power Amplifier (PA) control pin (pin 20) and a Low Noise Amplifier (LNA) control pin (pin 21). These pins are capable of handling external PAs and LNAs or external antenna switch circuits. MRF24XA can also tolerate different start up times of different external circuits by sending or accepting data if the external circuits have completed their ramp up. MRF24XA can handle both active high or active low control signal sensitive circuits. Refer to Section 9.13 “External Power Amplifier (PA)/Low-Noise Amplifier (LNA)” for more information.

3.5 Battery Monitor

The voltage level on the battery can be monitored. If the battery monitoring is enabled and the voltage level drops below a threshold, voltage interrupt (WARNIF) is asserted. Refer to Register 3-18 for more information on the battery. REGISTER 3-18: BATMON (BATTERY MONITOR CONFIGURATION REGISTER) TABLE 3-3: REGISTERS ASSOCIATED WITH GPIO FUNCTIONALITIES Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 PIR4 TXSFDIF RXSFDIF ERRORIF WARNIF EDCCAIF GPIO2IF GPIO1IF GPIO0IF PIE4 TXSFDIE RXSFDIE ERRORIE WARNIE EDCCAIE GPIO2IE GPIO1IE GPIO0IE GPIO GPIOEN TRISGPIO2 TRISGPIO1 TRISGPIO0 r GPIO2 GPIO1 GPIO0 STGPIO r GPIO2P GPIO1P GPIO0P r STENGPIO2 STENGPIO1 STENGPIO0 PULLGPIO r PULLDIRGPIO2 PULLDIRGPIO1 PULLDIRGPIO0 r PULLENGPIO2 PULLENGPIO1 PULLENGPIO0 PINCON r GIE r IRQIF GPIOMODE<3:0> Legend: r = Reserved, read as ‘0’. R-0 R/W-1 R/W-11111 r BATMONPD BATMON<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-6 Reserved: Maintain as ‘0’ bit 5 BATMONPD: Battery Monitor Power-Down bit If battery monitor is working and battery voltage has dropped below the threshold by BATMON<4:0> then WARNIF is set. 1 = Battery monitor is OFF 0 = Battery monitor is working bit 4-0 BATMON<4:0>: Battery Monitor Threshold Field bits VTHRESHOLD = 3.6 - 0.071 * BATMON<4:0> (V)

DS70005023B-page 88 Advanced  2011-2013 Microchip Technology Inc. NOTES:

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 89 MRF24XA

4.0 GENERAL TRANSCEIVER

4.1 MAC Architecture

The architecture of MAC-layer processing is illustrated in Figure 4-1. In reception, the receive signal processor acquires the synchronization header of the frame on-air, and demod- ulates the frame starting from the LENGTH field. The demodulated data is written directly into the Receiver Buffer (Buffer 2 by default) if the targeted buffer is declared empty (RXBUFFUL = 0). After LENGTH num- ber of bytes are received into the buffer (and RSV data are appended), the frame is parsed according to the selected framing mode (IEEE 802.15.4 or proprietary). The Frame Control Sequenc e (FCS) is checked to detect corruption by noise. Corrupted frames or frames not addressed to this node are rejected (discarded) as configured by the host. Rejection means that reception is completed now and the Receive Buffer status remains empty (RXBUFFUL = 0). It is configurable whether the frame is discarded silently or generates an interrupt to the host. If a frame is accepted and Acknowledge is requested for the frame, then the radio turns to transmit and sends an Acknowledgement. As other features, automatic ACK-sending can be enabled or bypassed. If the frame is the duplicate of a previously received and accepted frame then the frame is discarded (following Acknowledgement). Otherwise, the frame is the first copy of an acc epted frame, which must be reported to the host. To lock the buffer from overwriting by a new frame RXBUFFUL is set (1) automatically. RXIF interrupt is generated for the host, which completes the reception. The host MCU will only access the Receive Buffer when RXBUFFUL is set (1). To free up the buffer, the host will clear RXBUFFUL (0). If the frame has been encrypted or contains an authentication tag (MIC) then the Host MCU shall run the decrypt/authenticate operation before it reads the payload and frees up the buffer. When sending, the host MCU constructs the frame, downloads it to the transmit buffer (Buffer 0 by default), and triggers transmission after the last byte. The device processes the content of the buffer in-place. After pars- ing, a security processing takes place if required, finally an FCS is generated and appended to the frame. The LENGTH is adjusted each time an authentication tag (MIC) or FCS is appended to the frame. After in-place frame processing the medium is accessed using the Carrier Sense Multiple Access with Collision Avoidance (CSMA-CA). The RF transmit chain can only be enabled when the channel is free, or if CSMA is bypassed. As soon as the RF can transmit, the Transmit Signal Processor starts sending the Synchronization Header (SHR). This is followed by the buffer content up the FCS. If an Acknowledgement is requested then the RF chain is turned into receive. If ACK is not received before the expiration of a time-out then the transmission can automatically start over from CSMA through SHR- transmission and transmitting the SHR-transmission frame if configured so. After successful sending an interrupt is generated to the host MCU. Only either the TX MAC or the RX MAC is active at a time.

DS70005023B-page 90 Advanced  2011-2013 Microchip Technology Inc. FIGURE 4-1: MAC FUNCTIONAL BLOCK DIAGRAM

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 91 MRF24XA

4.2 Operations Overview

4.2.1 TERMINOLOGY

Node denotes the wireless communication node formed by a MRF24XA device and a host MCU. Device denotes the MRF24XA device. Software/SW denotes the software running in the Host MCU. The device does not contain a processor core that would run software. Frame and Packet are used interchangeably.

4.2.2 HOST INTERFACE

The host MCU controls t he device over SPI (max. 10 MHz), whereas the device indicates task completion or failure events, and frames received over the air by rais- ing an interrupt. Most interrupt flags can be masked, that means they are still set on the respective event, but cannot activate the interrupt pin on the device. The host services the interrupts through reading the inter- rupt register. (The interrupt bytes are self-cleared on SPI-read.) By convention, the “IF” suffix used in mne- monics refers to “Interrupt Flag”. For example, TXIF and RXIF. For software troubleshooting, the interrupt flags can be set by the host.

4.2.3 BUFFERS

The device has two frame buffers (128 bytes each). SPI allows accessing each byte in the frame buffer at its own address. By default, the buffer starting at address 0x200 is used for transmission (BUF1) and the buffer starting at address 0x300 is used for reception (BUF2).

4.2.4 OPERATING STATES

The state transitions described in the following section can also be referred in the state transition chart in Figure 4-2. After the battery change, the device powers up. The first interrupt after power-up is VREGIF, indicating that the 1.2V regulator has started in the device. The SPI is operational from this point on, so that the MCU can service the interrupt by reading the interrupt source registers (Register 2-3 to Register 2-6 are not accessible). By reading the POR flag (1) in the STATUS register the SW will identify that the device has gone through Power-on Reset, and must be reconfigured. After the crystal oscillator has stabilized (1-3 ms) and initial calibration is complete RDYIF interrupt is set by the device. All the registers are accessible now, and the device is in RFOFF state, that means the transmit and re ceive chains are powered- down, however the synthesizer is remained running. The MCU applies the initial configurations to the device by writing its registers through the SPI. As a last update, the MCU clears the POR (0) flag. When ready, the software may, for example, send the device to Deep Sleep mode by setting its DSLEEP (1) bit. Most of the mission-time of a low-power node, the device will be in Deep Sleep mode. In this power mode, the 1.2V on-chip regulator and the core are powered off completely, but the device must get a stable unregulated (1.8-3.6V) rail to retain device draws about 40 nA in this mode. By doing a dummy SPI read operation (at least four changes on SDI line is necessary) the MCU wakes up the device from Deep Sleep mode when needed. The first interrupt after wake-up is VREGIF, indicating that the 1.2V regulator has started in the device. The SPI is operational from this point on, so that the MCU can service the interrupt: reading the interrupt source register. POR flag retains its status before Deep Sleep mode (0). The transmit buffers are accessible for pre- load. After the crystal oscillator has stabilized (1-3 ms) RDYIF interrupt is set by the device, without going through re-calibration. All the registers are accessible now. Previously stored configuration has been retained during Deep Sleep, thus calibration is not necessary. If, for example, the device is configured to enable RX mode (RXEN = 1), then the device will start the synthesizer immediately after RDYIF and when the RF carrier is stable (cca. 90 µs), the receiver is turned ON (cca. 20 µs) automatically. (All state transitions sequenced between transmit, receive, and OFF states are automatic and can also handle additional external LNA and/or PA components, if associated settings were completed.) The device is waiting for a frame in the reached Receiver state. When a frame is received the device sends an RXIF interrupt to the device and locks the RX buffer from overwriting it by setting RXBUFFUL (1). The MCU frees the buffer after reading the frame. Automatic Acknowledge is sent in response to the frame if required. Refer to Section 4.10 “Frame Reception in Packet Mode” for more information on the Receive State machine, control/status bits and the interrupts. To transmit, the MCU sets the TXST flag (1) in the device. This flag is cleared by the device when sending is complete. Sending may involve listening into the channel before transmission doing back-off when the channel is busy (CSMA-CA), and requesting an Acknowledge for the frame. If either the frame or the Acknowledge gets corrupted over the medium then re- transmissions can be performed. Completion is only confirmed when the Acknowledge is received. Either success or abortion is indicated through respective interrupts (TXIF/TXCSMAIF/TXACKIF) when TXST is deasserted (0). The device returns to receive. Refer to Section 4.9 “Frame Transmission in Packet Mode” for more informati on on the Receive State machine, control/status bits and the interrupts. In the message sequence chart in Figure 4-3, both the MCU and the device can be followed, for transmit and receive nodes simultaneously, in a possible scenario.

DS70005023B-page 92 Advanced  2011-2013 Microchip Technology Inc. FIGURE 4-2: MRF24XA TOP LEVEL STATE M ACHINE (SIMPLIFIES STATE TRANSITION CHART) RF_OFF: Crystal, SPI alive RXEN=0 Used for: Buffer Read/Write MCU: RXEN 1

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 93 MRF24XA Frame sending/reception involves the following steps as shown in the Figure 4-3. (Note: Sending = originator, Receiving = recipient) 1. Originator and Recipient Nodes apply the previ- ously shared (negotiated/global) configurations. 2. Recipient MCU enables reception in the device by setting the RXEN (1) control bit in the RXCON1 register. 3. Originator MCU constructs the payload. 4. Originator MCU constructs the MAC frame header applying the per-frame configurations. 5. Originator MCU loads the MAC frame to the device. 6. Originator MCU starts transmit operation by setting the TXST (1) control bit (MACCON1 register) in the device. MAC layer encryption is automatically applied while for network layer encryption 7. Originator device executes in-place processing on the frame. For example, encryption and FCS appending, and checks the configuration of the frame header that affects the per-frame device behavior for this frame (for example, whether an Acknowledge is requested from the recipient). 8. Originator device attempts to send the message to the receiver device. Before accessing the medium it may be required to check that the medium is not used by another device (on the same channel frequency) or jammed by interfer- ers before sending. The applied procedure is called CSMA-CA. When the channel is clear, it sends the frame. Finally, the device waits for an Acknowledge, (the frame was configured to request one). 9. Recipient device receives the frame and parses it. The frame is accepted (The frame could be rejected. For example, due to destination address or FCS mismatch). 10. Recipient device sends an ACK. 11. Recipient device generates an RXIF (1) inter- rupt to its host MCU, when ACK-sending is complete. Since the frame has been accepted and acknowledged, RXBUFFUL is set (1) by the device. This protects the frame from being over- written by a subsequent different frame. 12. Recipient MCU may trigger in-place processing (for example, decryption by setting RXDEC) on the frame after servicing the interrupt. 13. Originator device fails to receive the ACK-frame. Therefore, it starts ov er transmitting the same frame (re-transmission) by doing CSMA-CA first, then sending. 14. Recipient device receives the re-transmitted frame and finds out it is a duplicate. It still sends another ACK-frame to it, but discards the duplicate frame. 15. Originator device receives the ACK and con- firms the successful sending to its host MCU by generating a TXIF (1) interrupt. It also clears the TXST (0) control/status bit. Originator device returns to reception mode if RXEN = 1 is configured, otherwise it goes to TRXOFF. 16. MCU services the interrupt (TXIF) to learn the confirmation. Transaction is completed with success. 17. Meanwhile, recipient device has completed the in-place decryption of the frame, and indicates this to its host MCU by generating a RXDECIF (1) interrupt. 18. Recipient MCU reads the decrypted frame from the buffer and unlocks the buffer by clearing the control/status flag RXBUFFUL (0) of the device.

DS70005023B-page 94 Advanced  2011-2013 Microchip Technology Inc. FIGURE 4-3: WIRELESS SENDING: EXAMPL E SCENARIO (MESSAGE SEQUENCE CHART) In-place processing (whether transmitting or receiving- side) can be tested using a single node. This is useful in device testing or software troubleshooting. Figure 4-4 illustrates the procedure of in-place test using a single node. Note that the Originator and the Recipient node can be the same hardware. The processing originally triggered by TXST is now trig- gered by TXBUF1PP . TXIF interrupt is generated at the end of in-place processing, without attempting to phys- ically send the frame. T XBUF1PP is cleared by the device at the same time.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 95 MRF24XA Buffer 1 holds the processed (encrypted, FCS- appended) frame. By setting RXBUF1PP, frame filtering is performed and RXIF interrupt is generated. Alternatively, the processing can be performed in Buffer 2 (the normal receive buffer) using TXBUF2PP and RXBUF2PP. Note that an unlike TXBUF1PP and TXBUF2PP, RXBUF1PP and RXBUF2PP are not self- cleared when RXIF is set. Instead they select which buffer needs to be processed when RXDEC is issued. FIGURE 4-4: IN-PLACE TEST USING A SI NGLE NODE: EXAMPLE SCENARIO (MESSAGE SEQUENCE CHART)

DS70005023B-page 96 Advanced  2011-2013 Microchip Technology Inc. 4.3 Global vs. Per-Node vs. Per-Packet Configurations For certain configurable parameters, the selected options apply to all nodes in a network. The global attributes are:

The MAC frame format used in the network (configured by the FRMFMT register bit)
The FCS appending and checking method (refer to CRCSZ register bit)
The medium access (configured by the CSMAEN register bit)

4.3.1 GLOBAL CONFIGURATIONS

Sometimes global attributes can be negotiated through management information travelling in the MAC payload (of the current frame or a previous frame). For example,

Address size in Proprietary MAC-framing mode
Network Layer security enabling and security material in IEEE 802.15.4-compliant MAC-framing mode The mentioned global attributes are shared between all nodes of the network, because all the nodes access the same medium, and the sending and recipient sides must process the frame consistently.

4.3.2 PER-PACKET CONFIGURATIONS

As opposed to global configurations, per-packet attributes vary from packet to packet. For example,

Acknowledge Requested for the current frame (AckReq)
Security Processing enabled for the current frame (SecEn) These attributes must be shared between the originator and the recipient of the frame. Therefore, they must travel with the packet. Before sending a frame, the orig- inator MCU applies the desired attributes by configur- ing the respective frame control bits (for example, AckReq, SecEn) in the MAC header of the frame. When the send operation is triggered, the sending device checks these attribut es and adapts its (frame processing and sending) behavior accordingly. The receiver device does the same on reception.

4.3.3 PER-NODE CONFIGURATION

It applies to specific nodes in the network, having a specific role. The auto-r epeater functionality (in proprietary MAC-mode) is a typical example. Another case is how a node filters frames. A sniffer node should have different configurati on in this respect than an ordinary node. Since the sniffer must not send acknowledge, that configuration may also be different.

4.4 Features Overview

The device supports two framing modes:

IEEE 802-15.4 standard compliant ( Section 5.0 “IEEE 802.15.4™ Compliant Frame Format and Frame Processing”) format
Proprietary format ( Section 6.0 “Proprietary Frame Format and Frame Processing”) Hardware support is provided for both the features, but a network should only use one of them in all the nodes. (A compromise is offered by bridging, described in Section 8.0 “Bridging”). For the discussion it is helpful to distinguish between “Protocol Agnostic” and “Protocol Dependent”. Configuration Options:
The availability and configuration format of “Proto- col Dependent” options are conditioned on the selected framing protocol, i. e., whether IEEE 802.15.4-compliant or proprietary network operation is required.
In contrast, the availability, behavior and configu- ration format of other options are “Protocol Agnostic” from a device point of view, that means that the configuration occurs similarly for framing protocol. All “Protocol Agnostic” options could be freely combined with any of the “protocol-dependent” configurations, as far the device constrains it. Never- theless, to comply with the IEEE 802.15.4 protocol, the constraints specified by the standard must be respected (see Table 4-2). Figure 4-5 lists the higher level (MAC-layer) configuration features.
FCS method: The 2-byte long CRC sequence adopted by IEEE 802-15. 4 is supported from hardware. This should be adequate for most applications. In the contrary case, the CRC appending and checking can be disabled by CRCSZ = 0. If CRCSZ = 0 then AUTOACKEN = 0 and RXFILTER = 0x00 is required. CRCSZ = 1 is assumed in the discussion.
CSMA is described in Section 4.11 “Carrier Sense Multiple Access-Collision Avoidance (CSMA-CA)”, and only requires Packet-Mode.
Automatic Acknowledgement Reception and Sending is configured as specified in Section 4.12 “Clear Channel Assessment (CCA)”, Section 4.14 “Acknowledge Sending by Recipient” and Section 4.15 “Acknowledge Reception by Originator”.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 97 MRF24XA

In both framing configurations, the device offers support for: frame parsing, frame filtering, frame types, addressing modes applicable to multi-cast and uni-cast frames and security processing. Standard mode operation is described in Section 5.0 “IEEE 802.15.4™ Compliant Frame Format and Frame Processing”. Proprietary mode is described in Section 6.0 “Proprietary Frame Format and Frame Processing” through Section 7.0 “Advanced Link Behavior in Proprietary Packet Mode”.
Link agility ( Section 7.1 “Channel Agility”), bridging, auto-repeater (Section 7.3 “Auto-Repeater”) modes are only available in proprietary modes. Table 4-1 lists a summary of possible node behaviors and node types. The focus of Section 5.0 “IEEE 802.15.4™ Compliant Frame Format and Frame Processing” is the general processing of IEEE 802.15.4-compliant and proprietary-format non- streaming frames, when t he node is non-streaming configured in packet mode. Differences to this behavior are specified for the other scenarios in the respective sections. FIGURE 4-5: MAC-LAYER CONFIGURATION OVERVIEW

DS70005023B-page 98 Advanced  2011-2013 Microchip Technology Inc. TABLE 4-1: SUMMARY OF NODE CONFIGURATION OPTIONS NODE CONFIGURATION Packet Mode Propr. TX Stream Propr. RX StreamIEEE 802.15.4™ Proprietary Proprietary Repeater TRXMODE (00: Packet Mode) 00 00 00 10 01 FRMFMT (Std:0, Proprietary:1) 0 1 1 1 1 AUTORPTEN (Repeater Node:1) 0 0 1 0 0 FEATURE/FRAME NODE CAPABILITY CSMAEN (CSMA enable:1) 0 or 1 0 or 1 0 or 1 0 No TX CRCSZ (CRC 2 bytes: 1, none: 0) 1 (or 0) 0 or 1 0 or 1 0 or 1 0 or 1 AUTOACKEN (Auto-ACK enable:1) (3) 0 or 1 0 or 1 0 (or 1 (1))0 0 , ignore 1 Retransmission capability Yes Yes No No No Buffer Handling 1 RX, 1 TX 1 RX, 1 TX 2 TRX 2 TX 2 RX With IEEE 802.15.4 Frames, capability to: TX, RX RX (TX) (4) (bridging) discard n/a discard With Proprietary non-Streaming Type of Frames (Repeat:0/1), capability to: discard TX, RX Repeat if Repeat = 1 n/a discard With Proprietary Streaming Type of Frames, capability to: discard RX (sets on RX- Streaming) discard TX RX Security Processing Available Available None available but impractical Channel Agility Support for ACK-ing No Yes n/a n/a n/a PHY-features Same for all Available Data Rates All (2) All All All All On-the-fly receiver rate adaptation Yes Yes Yes Yes Yes DSSS Yes Yes Yes Yes Yes Note 1: Proprietary frames requesting both Acknowledge and repeat are not recommended if any of the repeaters has AUTOACKEN = 0, and vice versa. If all are set, it may cause issues. 2: Although 250 kbps is the only data rate that ensures compliance to the IEEE 802.15.4 standard, however as an extension, the other data rates can also be used with the standard MAC format, which may be easier to integrate with the legacy software. 3: CRCSZ = 0 has not practical use in standard-format mode. If CRCSZ = 0 then AUTOACKEN = 0 and RXFILTER = 0x00 is required. 4: Acknowledge sending is solved. To send a frame, the transmitter changes FRMFMT for the sending.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 99 MRF24XA REGISTER 4-1: MACCON1 (MAC CONTROL 1 REGISTER) R/W-00 R/W-001 R/W-1 R/W-0 R/W-0 TRXMODE<1:0> ADDRSZ<2:0> CRCSZ FRMFMT SECFLAGOVR bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-6 TRXMODE<1:0>: TX/RX Mode Select Field bits 11 = Reserved 10 = TX-Streaming mode. In this mode both buffers are used for packet transmission. When issuing TRX- MODE = 10, RXEN is cleared. SPI addresses 0x200 to 0x27F access Buffer 1 or Buffer 2 in alternation. Access to 0x37F through 0x383 has non-defined effect. 01 = RX-Streaming mode. In this mode both buffers are used for packet reception. When issuing TRX- MODE = 01, TXST and TXENC/RXDEC bits are cleared and RXEN is set. SPI addresses 0x300 to 0x383 access Buffer 1 or Buffer 2 in alternation. In this mode, Proprietary mode packets other than streaming type are automatically discarded. Access to 0x200 through 0x283 has non-defined effect. 00 = Packet mode. In this mode, Buffer 1 is used as a transmit and Buffer 2 is used as a receive packet buffer. SPI addresses from 0x200 to 0x27F access Buffer 1. SPI addresses 0x300 to 0x383 access Buffer 2. TRXMODE = 00 is mandatory when FRMFMT = 0. bit 5-3 ADDRSZ<2:0>: Source/Destination Address Size Field bits(1, 2) The size of the Source and Destination addresses for Proprietary packet. Note that this field has no effect on the processing IEEE 802.15.4 frames. 111 = 8 octets 110 = 7 octets 101 = 6 octets 100 = 5 octets 011 = 4 octets 010 = 3 octets 001 = 2 octets 000 = 1 octet bit 2 CRCSZ: CRC Size bit This bit indicates the size of the CRC field in each packet. 1 = 2 octets 0 = 0 octet bit 1 FRMFMT: MAC Frame Format Adopted by the Network bit(3) This bit determines the frame format used in the network. 1 = Proprietary 0 = IEEE 802.15.4 standard compliant bit 0 SECFLAGOVR: Security Flag Override bit The user can override security flags used in the CCM-CTR, CBC-MAC and CCM operation, otherwise the device will use the standard (2003/2006) definition. Note 1: Zero-length address occurs when the corresponding DAddrPrsnt/SAddrPrsnt bits of the packet frame control field are set to ‘0’. 2: ADDRSZ field is used while receiving and transmitting, and should not be modified while RXEN or TXST is set. 3: FRMFMT field is used while receiving and transmitting, and should not be modified while RXEN or TXST is set. In Debug mode, this register bit is used to determine the frame format for both Tx/Rx frame in the packet buffers.

DS70005023B-page 100 Advanced  2011-2013 Microchip Technology Inc.

4.5 Protocol Selection and

Applications typically fall into two categories:

Category 1: Standard compliant operation is required exclusively
Category 2: Standard compliant operation is not required, capability to form a gateway to standard network is sufficient: - Green-field development. Proprietary MAC framing is optimal. - Legacy software is better served by applying the standard MAC-frame format, although the network does not need to use IEEE 802.15.4 standard modulation formats over the air. In category 1, the Proprieta ry Features are not used. The constraints listed in Table 4-2 shall be applied. A significant limitation is that IEEE 802.15.4 allows using a single air data rate, 250 kbps, only. In category 2, these constraints are relieved, and the network may either adopt the proprietary (FRMFMT = 1) or the IEEE 802.15.4 MAC (FRMFMT = 0) frame for- mats as it fits better with the conditions. In either options, the network can use all the air data rates. A gateway to a standard network can be formed by bridg- ing (see Section 8.0 “Bridging”). The Physical layer configuration is described in Section 9.0 “Physical layer Functions”. TABLE 4-2: CONSTRAINTS IMPOSED BY THE IEEE 802.15.4™ STANDARD Parameter Description Register Field Default on Reset IEEE 802.15.4™ constraint/recommendation Frame Format FRMFMT 0 0 (std. frame format) Buffer Handling TRXMODE 00 00 (packet mode) Sender Data Rate DR<2:0> 011 011 (TX 250 kbps) Receiver Data Rate Reject Filter (otherwise data rate is adapted on-the-fly, per-frame) RATECON<7:2> 000000 (all enabled) 111101 (only enable: RX 250 kbps, SFD = 0xA7) FCS (CRC) size (0 or 2 bytes) CRCSZ 1 1 (2 byte CRC appended) Frame rejection on CRC mismatch CRCREJ 1 1 (CRC match enforced) Frame rejection filter RXFILTER<7:0 > 0x7F 0x40 (frame rejection on CRC mismatch only) Duplicate Rejection IDENTREJ 0 1 (discard duplicates) Automatic Acknowledge Handling (send/ receive) AUTOACKEN 0 1 (Auto ACK enabled) Base time units applied by TXACKWAIT and RXACKWAIT BASETM<4:0> 00010 (2 µs) 10000 (should be a divisor of 16 µs) Wait duration (in base units) before Acknowledge sending (by the data frame recipient) RXACK- WAIT<7:0> 0x60 0x0C (shall be >= 192 µs) Time-out duration (in base units) for Acknowledge reception (by the data originator) TXACKTO<7:0> 0x80 (256 µs) 0x36 (shall be >= 864 µs) CSMA medium access enabled CSMAEN 1 1 (CSMA enabled) CCA Mode (energy vs. carrier) CCAMODE (1) 01 01 (4 options allowed) CCA Measurement Duration CCALEN (1) 01 10 (128 µs) CCA Energy Threshold EDthreshold (1) 0x32 (-88 dBm) 0x46 (-78 dBm; shall be <-75 dBm Energy Detect Mode (1: 128 us, 0: variable duration) EDMODE(1) 0 0 (EDLEN applies) Energy Detect Duration EDLEN (1) 0xE 0xE (15.360 ms; shall be repeated multiple times) Note 1: For more information on Physical layer configuration, refer to Section 9.0 “Physical layer Functions”. Note: “Proprietary” is not equivalent to “full-custom”. The LENGTH field and Frame Control Field should be used as described. (The transmitter processing of the FrameCtrl.SecEn bit cannot be disabled.) The payload por- tion can still carry customized management information that is processed in software. It is recommended that FRMFMT = 1 be used with NSTDREJ = 1 if a gateway is not required.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 101 MRF24XA

4.6 Frame-On-Air/Air Data Rate

In the Originator of the frame FRMFMT and DR<2:0> select the air data rate and the frame format. The preamble can be hold out indefinitely by PRMBHLD bit. For more information on register definitions, refer to Register 4-2. The recipient of the frame can receive the frame formats selected by FRMFMT and RATECON<7:2>. Acknowledge is sent by the Recipient using the same frame format as the acknowledged frame (except for the agility described at the end of Section 7.1 “Channel Agility” ). The Originator must set RATECON<7:2> adequately to receive the ACK frame. RATECON<1> selects between Legacy and Optimal PHY frame format. This can be set independently from the rate, or the MAC protocol as far the MAC operation is concerned. FIGURE 4-6: FRAME-ON-AIR/AIR DATA RATE Preambulum SFD MAC FrameLength Preamble type: Legacy: 192 µs fix Optimal: Duration scales reciprocally with DR FRMFMT: 0 IEEE 802.15.4™ standard compliant

1 Proprietary

DS70005023B-page 102 Advanced  2011-2013 Microchip Technology Inc. REGISTER 4-2: RATECON (RAT E CONFIGURATION REGISTER) R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-1 R/W-1 DIS2000 DIS1000 DIS500 DIS250 DISSTD DIS125 OPTIMAL PSAV bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 DIS2000: Disable 2 Mbps Frame Reception bit If this bit is set, then reception of 2 Mbps frames is disabled. bit 6 DIS1000: Disable 1 Mbps Frame Reception bit If this bit is set, then reception of 1 Mbps frames is disabled. bit 5 DIS500: Disable 500 kbps Frame Reception bit If this bit is set, then reception of 500 kbps frames is disabled. bit 4 DIS250: Disable 250 kbps Frame Reception bit If this bit is set, then reception of 250 kbps frames with non-standard-compliant SFD patterns is disabled. bit 3 DISSTD: Disable IEEE 802.15.4 compliant Frame Reception bit If this bit is set, th en reception of 250 kbps frames with IEEE 802.15.4 compliant SFD patterns is disabled. bit 2 DIS125: Disable 125 kbps Frame Reception bit If this bit is set, then reception of 125 kbps frames is disabled. bit 1 OPTIMAL: Optimized Preamble Selection bit When this bit is set, then optimized preamble is used instead of legacy. 1 = Optimized preamble 0 = Legacy preamble bit 0 PSAV: Power-Save Mode Selection bit When this bit is set, frame detection is dependent on the RSSI signal, and the receive signal processor is turned on when a sudden and significant increase (PSAVTHR<3:0>) is detected in the signal strength or the signal strength is above an absolute level (DESENSTHR<3:0>). 1 = Power-Save mode 0 = Hi-Sensitivity mode

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 103 MRF24XA REGISTER 4-3: MACCON1 (MAC CONTROL 1 REGISTER) R/W-00 R/W-001 R/W-1 R/W-0 R/W-0 TRXMODE<1:0> ADDRSZ<2:0> CRCSZ FRMFMT SECFLAGOVR bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘ 0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-6 TRXMODE<1:0>: TX/RX Mode Select Field bits 11 = Reserved 10 = TX-Streaming mode. In this mode both buffers are used for packet transmission. When issuing TRXMODE = 10, RXEN is cleared. SPI addresses 0x200 to 0x27F access Buffer 1 or Buffer 2 in alternation. Access to 0x37F through 0x383 has non-defined effect. 01 = RX-Streaming mode. In this mode both buffers are used for packet reception. When issuing TRX MODE = 01, TXST and TXENC/RXDEC bits are cleared and RXEN is set. SPI addresses 0x300 to 0x383 access Buffer 1 or Buffer 2 in alternat ion. In this mode, Proprietary mode packets other than streaming type are automatically discarded. Access to 0x200 through 0x283 has non-defined effect. 00 = Packet mode. In this mode, Buffer 1 is used as a Transmit while Buffer 2 as a Receive packet buffer. SPI addresses from 0x200 to 0x27F access Buffer 1. SPI addresses 0x300 to 0x383 access Buffer 2. TRXMODE = 00 is mandatory when FRMFMT = 0. bit 5-3 ADDRSZ<2:0>: Source/Destination Address Size Fields bits(1, 2) The size of the Source and Destination addresses for Proprietary packet. Note that this field has no effect on the processing IEEE 802.15.4 frames. 111 = 8 octets 110 = 7 octets 101 = 6 octets 100 = 5 octets 011 = 4 octets 010 = 3 octets 001 = 2 octets 000 = 1 octet bit 2 CRCSZ: CRC Size bit This bit indicates the size of the CRC field in each packet. 1 = 2 octets 0 = 0 octet bit 1 FRMFMT: MAC frame format bit adopted by the network bit (3) This bit determines the frame format used in the network. 1 = Proprietary 0 = IEEE 802.15.4 standard compliant. bit 0 SECFLAGOVR: Security Flag Override bit The user can override security flags used in the CCM-CTR, CBC-MAC and CCM operations, otherwise the device will use the standard (2003/2006) definition. Note 1: Zero-length address occurs when the corresponding DAddrPrsnt/SAddrPrsnt bits of the packet frame control field are set to ‘0’. 2: ADDRSZ field is used while receiving and transmitting, and should not be modified while RXEN or TXST is set. 3: FRMFMT field is used while receiving and transmitting, and should not be modified while RXEN or TXST is set. In Debug mode, this register bit is used to determine the frame format for both Tx/Rx frame in the packet buffers.

DS70005023B-page 104 Advanced  2011-2013 Microchip Technology Inc. REGISTER 4-4: BBCON (BASEBAND CONFIGURATION REGISTER) R/W-0 R/W-0 R/W-11 R/W-0 R/W-001 RNDMOD AFCOVR RXGAIN<1:0> PRMBHOLD PRMBSZ<2:0> bit 7 bit 0 Legend: W = Writable bit R = Readable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 RNDMOD: Random Modulation bit By setting this bit, the transmitter will randomly transmit DSSS symbols or MSK chips if PRMBHOLD bit is set. The purpose of this register is only for testing. bit 6 AFCOVR: AFC Override bit By setting this bit, receiver will use CFOMEAS register as the CFO in reception. bit 5-4 RXGAIN<1:0>: Receiver Gain Register Field bits By setting this bit, the AGC operation can be inhibi ted in the receiver and the receiver radio gain configuration can be selected between three different gain levels. Encoding: 11 = AGC operation is enabled (default value) 10 = High gain 01 = Middle gain 00 = Low gain This feature can be used for test and streaming pu rpose. To reduce the required interframe-gap, the RXGAIN should be set to one of the fixed gain options when the MAC is in Streaming mode. bit 3 PRMBHOLD: Preamble Hold Enable bit Effect: Appends extra bytes to the transmitted preamble in endless repetition until it is cleared. Details: The hardware checks this bit during tr ansmission before finish ing the pream ble. The appropriate preamble byte and modulation format is applied as determined by DR<2:0> and the register OPTIMAL. When this flag is released the transmi ssion of the current preamble byte is completed followed by transmitting the LENGTH field and the payload. 1 = Enable endless preamble repetition 0 = Disable/stop endless preamble repetition bit 2-0 PRMBSZ<2:0>: Preamble Size Adjustment Field bits Allows adjusting the transmitted preamble length when OPTIMAL = 1. Encoding: 500 kbps preamble length = (PRMBSZ<2> + 4) units, where unit = 16 μs (1 octet at 500 kbps) Legacy frames and 125/250 kbps optimized frames are not affected by this register field.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 105 MRF24XA

4.7 Security Suites

MRF24XA provides extensive hardware support for security suites defined in 802.15.4-2003/2006 stan- dard. The security suites are based on the AES-128 block cipher transformation. Block ciphers are ciphers that work on a plaintext bl ock of a fixed length to pro- duce a ciphertext block of the same length. Given a particular Key ( K), there is a 1-to-1 correspondence between the Plaintext Block ( P) and the Ciphertext Block (C).

Encryption operation: C i = EK(Pi) Ciphertext block ( i) is produced by Encrypting Plaintext block (i) using key K.
Decryption operation: Pi = DK(Ci) Plaintext block ( i) is produced by Decrypting Ciphertext block (i) using key K.

4.7.1 ELECTRONIC CODE BOOK MODE

(ECB) The simple usage of the block cipher is known as ECB mode. There are several problems with simply using a block cipher in ECB mode to encrypt data. Because each plaintext block is encrypted to the same ciphertext block every time, it is possible to associate the cipher- text block with an event without ever knowing the plain- text block itself. To trigger the event, user can resend the ciphertext block, a process known as Replay Attack. In addition, most block cipher algorithms in ECB mode do nothing to scramble repetitive data, making the plaintext block reversible from the ciphertext block.

4.7.2 COUNTER MODE (CTR)

In CTR mode, each chipertext block is produced by XOR'ing, the plaintext block with the encrypted version of a counter input. The initial value of the counter serves as the Initialization Vector (IV) for the message block, and may be changed for each message block. Although the term “counter” is used, this does not man- date the use of a true counter. An easy-to-compute function which is practically non-repeating (at least for a long time) may be used. CTR mode may be 100% parallelized for both encryption and decryption. 802.15.4-2003 defines CTR mode as follows: CTR 0 = 0 Loop on each 16 byte block of plaintext C i = Pi xor EK({ENCFLAGS, SECNONCE, CTRi}) CTRi+1 = CTRi+1 End Where, ENCFLAGS is defined by the standard (0x82), SECNONCE is defined in the standards and CTRi is a 2 byte block counter. If the last block of the plaintext is not 16 byte, it is zero padded and only the required number of MSB bytes is used in th e XOR operation. The host can override ENCFLAGS field by enabling SECFLAGOVR bit in MACCON1 register, and setup the new flags through SECENCFLAG register. SECNONCE register can be overwritten anytime by the host through SECNONCE1..13 registers. 802.15.4-2006 does not define CTR mode.

4.7.3 CIPHER BLOCK CHAINING MODE

(CBC) In CBC mode, each plaintext block is XOR’ed with the result of the previous block encryption operation before being encrypted. In this way all plaintext blocks depend on the previous block, making it difficult to remove, add or change individual blocks without detection. In addi- tion, the encryption for the first block is performed using XOR of the plaintext block and an Initial Value (IV). This initial value can be changed for each message, making it more resistant to Replay Attacks. MRF24XA does not support CBC mode.

4.7.4 CIPHER BLOCK CHAINING

CODE MODE (CBC-MAC) A CBC-MAC protects the authenticity of a message, and therefore implicitly its integrity. The algorithm takes the variable length input message and a secret key, and produces a MIC TAG (the terms MIC and MAC are often used interchangeably). Any change to the content of the message will result in a change of the MIC tag, thereby guaranteeing the integrity of the message. As the same message with a different secret key will also produce a different MIC tag, a MAC mode also provides protection of authenticity. 802.15.4-2003 defines CBC-MAC mode as follows: P = {LENGTH, MACHDR, MACP AYLOAD} O 1 = EK(P1) Loop on each 16 byte block of plaintext O i = EK(Pi xor Oi -1) End MICTAG is the leftmost M bit of O end Where LENGTH is the number of bytes to be authenti- cated (MAC header and payload). 802.15.4-2006 does not define CBC-MAC mode.

DS70005023B-page 106 Advanced  2011-2013 Microchip Technology Inc.

4.7.5 AUTHENTICATE AND ENCRYPT

BLOCK CIPHER MODE (CCM*) This mode is a combination of CTR mode (encryption) and CBC-MAC mode (authent ication). Initially, CBC- MAC is applied to compute the MIC tag. CTR mode (encryption) is performed only on a selected portion of the authenticated message and the MIC tag. Different combination of authentication and encryption can be formed. 802.15.4-2003/2006 defines CCM* mode as follows: P = {AUTHENTICATION FLAG , NONCE, LENGTH, MACHEADER, MACP AYLOAD} O 1 = EK(P1) Loop on each 16 byte block of plaintext O i = EK(Pi xor Oi-1 ) End MICTAG is the leftmost M bit of O end AUTHENTICATION FLAG: Reserved || Adata || M || L

4.8 Buffer Processing in Non-Secured

General Frame processing, as shown in Figure 4-7, applies when AUTORPTEN = 0. Unsecured frame (SecEn = 0) is not an Acknowledgement and CRCSZ = 1. Acknowledgement is transmitted or received by software (AUTOACKEN = 0) and CRCSZ = 1 (ACK may contain piggyback data in the payload, at the discretion of the host software). In Figure 4-7, note the following:

Transmit buffer is the buffer starting at 0x200, whereas the Receive Buffer is the buffer starting at address 0x300 (this also applies for Streaming mode).
In the Transmit Buffer FCS is appended automati- cally to the frame, and the LENGTH field is also incremented automatically.
The Receive buffer holds the FCS appended frame, and the according LENGTH. RSV is appended to the frame. Note the ordering of the RSV fields. The LENGTH field is not affected by RSV appending. The following cases are not described in this data sheet:
Processing of secured frames (SecEn = 1) is pre- sented in Section 5.3 “Security Material”.
When AckReq = 1 (implying TXRXMODE = 00, CRCSZ = 1), then the Acknowledge frame is gen- erated or accepted on-the- fly: without writing or reading the buffers (If CRCSZ = 0 then the CRC appending does not take place and Acknowledge is always processed by software: AUTOACKEN = 0).
Repeater Mode is described in Section 7.3 “Auto-Repeater”. FIGURE 4-7: GENERAL FRAME PROCESSING TX buffer loaded: TX buffer processed: TXST set by host Length MHR Payload Length MHR Payload CRC RXIF interrupt received, RXBUFFUL is set. (RSV appending enabled in: RXCON2) Length MHR Payload CRCRX buffer holds RSV /LENGTH up to payload /LENGTH up to CRC / if CRCSZ = 1 in Transmitter /LENGTH up to CRC / if CRCSZ = 1 in Receiver MAC Frame

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 107 MRF24XA

4.9 Frame Transmission in Packet Mode

FIGURE 4-8: TRANSMITTER PR OCESSING IN PACKET MODE TXST 1 Select BUF1 TX MHR parsing Parsable? Tx Security Processing FCS appending TXSZIF TXST TXRETCCNT 0 CSMA-CA ACK required? ACK received? Acknowledge Reception TXCSMAIF Increment TXRETCCNT TXRETCCNT >= TXRETMCNT BUF1TXPP 1 BUF2TXPP 1 Select BUF2 In place processing test FRMIF 1 if CRCSZ = 1

1 Size run over 127 bytes: TXSZIF = 1

No (Sending complete) TXIF 1 Reset retransmission count

1 Medium access failure: TXCSMAIF = 1

Yes (success) TXIF 1 Yes (failure) Max. retransmissions reached No BUF1TXPP 0 BUF2TXPP 0 TXST 0 TXBUFEMPTY 1 Interrupt Service AckReq = 1 Fail (invalid format) if required 0 (In-place test only) TXIF 1 Yes No Select BUF1 Figure 5-7 Figure 5-9 Figure 4-11 Pass

DS70005023B-page 108 Advanced  2011-2013 Microchip Technology Inc. REGISTER 4-5: TXCON (TRANSMIT CONTROL REGISTER) R/W/HC-0 R/W-0 R/W/HC-0 R/HS/HC-1 R/W-1 R/W-011 TXST DTSM TXENC TXBUFEMPTY CSMAEN DR<2:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 TXST: Transmit Start bit 1 = Starts the transmission of the next TX packet (1, 2). 0 = Termination of current TX operation, which may result in the transmission of an incomplete packet Hardware clear:

After the packet has been successfully transmitted (including all attempted re-transmissions, if any) this bit will be cleared by hardware and TXIF and IDLEIF are set.
If the packet transmission fails due to a CSMA failure, then this bit will be cleared, and TXCSMAIF is set.
If Acknowledge was requested (AckReq bit field in the transmitted frame is set) and not received after the configured number of retransmissions (TXRETMCNT), then TXST bit will be cleared and a TXACKIF is set.
In TX-Streaming mode (TRXMODE), TXST can be set even when it is already set, resulting in a posted start. When the current TX operation completes, the posted start will start immediately afterwards. Clearing of the TXST bit clears both the current and the posted (pending) TX starts. TXOVFIF is set when TXST = 1, a posted start is present and a Host Controller write to the packet buffer occurs. Outside of TX-Streaming mode, writes to TXST when TXST is already set will be ignored. Clearing this bit will abort the current operation in the following cases:
When transmitting a packet in Packet mode or in TX-Streaming mode
When waiting for an ACK packet after a transmission
During the CSMA CA algorithm
When transmitting a repeated frame This field can be read at any time to determine if the TX operation is in progress. bit 6 DTSM: Do Not Touch Security Material bits (2) 1 = Device will not change the security material configured by the host MCU 0 = Device will try to configure the security material related registers The concerned registers are SECNONCE, SECHDRINDX, SECPAYINDX and SECENDINDX. These registers should be filled by the MCU. bit 5 TXENC: TX Encryption Setting this bit will start TX security processing (authentication and/or encryption) of the packet in the buffer that was last written to . TXENC is cleared and TXENCIF is set when the processing is com- plete. TXENC should be issued when NWK layer security needs to be processed. 802.15.4-2003/ 2006 MAC layer security operation is automatically pe rformed by setting TXST bit. This field should not be modified while TXST is set. Note 1: Transmission may include automatic security processing, CRC appending, CSMA-CA channel access, Acknowledge reception and retransmissions depending on the register configuration and the frame control field of the frame to be transmitted. 2: By setting TXST bit in either Sleep/RFOFF state, device will transit to TX state for packet transmission.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 109 MRF24XA bit 4 TXBUFEMPTY: TX Buffer Empty bit TXBUFEMPTY = 1 indicates that the host MCU can safely start writing a new frame to the buffer with- out overwriting any content that would be in use. Writing a single byte to the buffer will cause this bit to be cleared. TXBUFEMPTY = 0 does not prevent the host from writ ing further bytes to the buffer. TXBUFEMPTY is set by the device when transmission is complete. 1 = MCU can safely start writing a new frame to the buffer 0 = Buffer is full, or being written to When TRXMODE = 00: (PACKET) mode is configured then TXBUFEMPTY is set at the same time as TXST is cleared. An interrupt is also generated. Therefore, this bit provides no extra information. When TRXMODE = 10: (TXSTREAMING) mode is configured then TXBUFEMPTY is set at the same time as one of the buf- fers becomes free, while TXST may be set. Ther efore, TXBUFEMPTY is used by the host MCU to ensure that it can start loading the next frame to the buffers without overwriting a packet being sent (TXOVFIF). bit 3 CSMAEN: CSMA-CA Enable bit This bit enables CSMA-CA algorithm before transmission. 1 = CSMA-CA enabled 0 = CSMA-CA disabled bit 2-0 DR<2:0>: Transmit Data Rate Field bits 111 = Reserved 110 = 2 Mbps 101 = 1 Mbps 100 = 500 kbps 011 = 250 kbps 010 = 125 kbps 001 = Reserved 000 = Reserved When transmitting an Auto-ACK frame with Adaptive Data Rate in response to a received frame, the data rate of the PHY is automatically determined by the AckDataRate field in the received frame, and not by this register field. In all other cases, this register field is used as the current PHY data rate when transmitting. The data rate for all received frames is determined by the PHY, regardless of this register field and the Adaptive Data Rate configuration. Refer to Register 4-2 for more information. Note 1: Transmission may include automatic security processing, CRC appending, CSMA-CA channel access, Acknowledge reception and retransmissions depending on the register configuration and the frame control field of the frame to be transmitted. 2: By setting TXST bit in either Sleep/RFOFF state, device will transit to TX state for packet transmission. REGISTER 4-5: TXCON (TRANSMIT CONTROL REGISTER) (CONTINUED)

DS70005023B-page 110 Advanced  2011-2013 Microchip Technology Inc. REGISTER 4-6: PIR2 (PERIPHERAL INTERRUPT REGISTER 2) R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 TXIF TXENCIF TXMAIF TXACKIF TXCSMAIF TXSZIF TXOVFIF FRMIF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 TXIF: Transmission Done Interrupt Flag bit The current TX operation (TXST) has been successfully completed. This event is not changed when a hardware generated ACK packet has been transmitted or when a packet has been repeated. Non-per- sistent, cleared by SPI read. bit 6 TXENCIF: Transmit Encoding Interrupt Flag bit The TX packet was successfully encrypted and/or complemented with a Message Integrity Code (MIC). Set by the device after TXENC = 1, when TXENC is cleared. Non-persistent, cleared by SPI read. bit 5 TXMAIF: Transmitter Medium Access Interrupt Flag bit Set by the device when the medium is accessed, th at is, when the first sample in the preamble is transmitted on air. Non-persistent, cleared by SPI read. bit 4 TXACKIF: Transmission Unacknowledged Failure Interrupt Flag bit Set by the device when Acknowledge is not received after the configured maximum number of trans- mission retries RETXMCNT<3:0>, pr ovided that the frame control field of the transmitted frame indicates AckReq = 1. Non-persistent, cleared by SPI read. bit 3 TXCSMAIF: Transmitter CSMA Failure Interrupt Flag bit Set by the device when CSMA-CA finds the channel busy for BOMCNT<2:0> number of times, provided that CSMAEN = 1 is configured. Non-persistent, cleared by SPI read. bit 2 TXSZIF: Transmit Packet Size Error Interrupt Flag bit Following TXST is set the packet size (including MIC tags and CRC) is found to be zero or to be greater than the maximum size that the buffers can support. Non-persistent, cleared by SPI read. bit 1 TXOVFIF: Transmitter Overflow Interrupt Flag bit The Host Controller attempted to write a TX buffer that was not empty (TXBUFEMPTY = 0). Non- persistent, cleared by SPI read. bit 0 FRMIF: Frame Format Error Interrupt Flag bit Set if the transmitter/receiver fails to parse the frame in the buffer (because it is not as it should be or it is corrupted in demodulation).

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 111 MRF24XA REGISTER 4-7: PIR4 (PERIPHERAL INTERRUPT REGISTER 4) R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 TXSFDIF RXSFDIF ERRORIF WARNIF EDCCAIF GPIO2IF GPIO1IF GPIO0IF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 TXSFDIF: Transmit SFD Sent Interrupt Flag bit Set by the device when the last sample of the SFD field has been sent on the air. Non-persistent, cleared by SPI read. bit 6 RXSFDIF: Receive SFD Detected Interrupt Flag bit Set by the device when the SFD field of the received frame is detected. Non-persistent, cleared by SPI read. bit 5 ERRORIF: General Error Interrupt Flag bit Set by the device, when malfunction state is reached. bit 4 WARNIF: Warning Interrupt Flag bit Set by the device when one of the following occurred:

Battery voltage has dropped below the threshold given by BATMON<4:0>
Resistor on pin 28 is missing or not connected well bit 3 EDCCAIF: Energy Detect/CCA Done Interrupt Flag bit Set by the device when Energy-detect or CCA measurement is complete (following that the host MCU has set the EDST/CCAST bit to start the measurement and the device is clearing it in on completion). Non-persistent. Cleared by SPI read. bit 2 GPIO2IF: GPIO2 Interrupt Flag bit Set by the device if the GPIOMO DE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. bit 1 GPIO1IF: GPIO1 Interrupt Flag bit Set by the device if the GPIOMO DE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. bit 0 GPIO0IF: GPIO0 Interrupt Flag bit Set by the device if the GPIOMO DE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity.

DS70005023B-page 112 Advanced  2011-2013 Microchip Technology Inc.

4.10 Frame Reception in Packet Mode

FIGURE 4-9: RECEIVER OPERATION (IF AUTORPTEN = 0) MCU:RXEN 1 while TXST = 0 TXST 0 while RXEN = 1 RXListen Operation Frame acquired? RXSFDIF 1 Frame Reception MCU:EDST/CCAST 1 while in RxListen MCU:RXEN 0 MCU:TXST 1 while in RxListen Abort RXLISTEN or Frame Reception Enter RXListen Operation disabling Acquisition Do ED/CCA measurement EDCCAIF 1 Abort RXLISTEN or Frame Reception Abort RXLISTEN or Frame Reception Do Transmission TXST 0 by device Or abortion: TXST 0 by host No Yes Abort Events

DS70005023B-page 114 Advanced  2011-2013 Microchip Technology Inc. REGISTER 4-8: RXCON1 (MAC RECEIVE CONTROL 1 REGISTER) R/W/HC/HS-0 R/W-0 R/W/HC-0 R/W-1 R/W-1 R/W-1 R/W-1 R-0 RXEN NOPA RXDEC RSVLQIEN RSVRSSIEN RSVCHDREN RSVCFOEN r bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 RXEN: Receive Enable Field bit This bit Enables/Disables the packet reception. If an RX packet is currently being received, clearing this bit will cause that packet to be discarded. 1 = RX enabled 0 = RX disabled Hardware clear/set when:

Cleared when TRXMODE is set to TX-Streaming mode
Set when TRXMODE is set to RX-Streaming mode Clearing this bit will abort the current operation in the following cases:
Receiving a packet in Packet mode or in RX-Streaming mode Most RX related settings should only be changed while this bit is cleared. The clear channel assessment (CSMAEN) and AC K-frame reception does not require RXEN = 1, because the device will turn the radio into RX when needed, irrespective of the status of the RXEN bit. bit 6 NOPA: No Parsing bit This bit will disable packet parsing. Only CRC will be checked if it is enabled. This feature is useful in Sniffer mode. 1 = Disable packet parsing 0 = Enable packet parsing bit 5 RXDEC: RX Decryption bit Setting this bit will start RX security processing (authentication and/or decryption) on the last received packet. 1 = RX security processing started/in process. RXDECIF or RXTAGIF is set. 0 = RX security processing inactive or complete This bit will clear itself after RX decryption has completed. bit 4 RSVLQIEN: Receive Status Vector LQI Enable bit If this bit is set, the measured Link Quality is appended after the received frame in the packet buffer. 1 = Append LQI field 0 = Do not append LQI field bit 3 RSVRSSIEN: Receive Status Vector RSSI Enable bit If this bit is set, the measured RSSI is appended after the received frame in the packet buffer. 1 = Append RSSI field 0 = Do not append RSSI field bit 2 RSVCHDREN: Receive Status Vector Channel/MAC Type/Data Rate Enable bit If this bit is set, Channel, MAC type and Data Rate configurations used with the received frame are appended after the received frame in the packet buffer, using the encoding specified for CH<3:0>, FRMFMT and DR<2:0> (concatenated in this order when most significant bit (MSb) is first). 1 = Append Channel, MAC type and Data Rate fields 0 = Do not append Channel, MAC type and Data Rate fields bit 1 RSVCFOEN: Receive Status Vector CFO Enable bit If this bit is set, the estimated Carrier Frequency Offset of the received frame is appended after the received frame in the packet buffer, using the same encoding as CFOMEAS register. 1 = Append CFO estimation 0 = Do not append estimated CFO bit 0 Reserved: Maintain as ‘0’

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 115 MRF24XA REGISTER 4-9: RXCON2 (MAC RECEIVE CONTROL 2 REGISTER) R/C/HS-0 R/W-0 R-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 RXBUFFUL IDENTREJ ACKRXFP ACKTXFP AU TORPTEN AUTOACKEN ADPTCHEN ADPTDREN bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 RXBUFFUL: RX Buffer Full bit Host MCU clears this bit to indicate that the RX packet has been processed. If this bit is not cleared before the next valid RX packet is detected (packet is not a duplicate, pass RX filter, and so on), then the device sets RXOVFIF and the buffer content is not modified, that is, RXBUFFUL = 1 locks write access by a new frame, meanwhile the host can both read and write to the buffer or perform security processing. In TRXMODE = 00 (PACKET) mode: 1 = Receive buffer content is yet to be read by the host or processed, and cannot be overwritten by a new frame 0 = Receive buffer is free for receiving a new frame In TRXMODE = 01 (RXSTREAMING) mode: 1 = Current buffer being read from the bus contains a valid RX Packet 0 = Current buffer being read from the bus is empty bit 6 IDENTREJ: Reject Identical Packet bit In Packet mode, if this bit is set and a received packet has the same Source address, Source PID and Sequence number as the last packet received RXIDENTIF is set and the packet is discarded. This bit is used if a packet is received, an ACK is transmitted but the ACK is never received. The sender will re-send the TX packet. In this case, RXIF is not triggered for second time for the same packet, hence the second packet is ignored. This is also used to repeat a packet, and the next repeater repeats the same packet back. User should ignore the packet. 1 = Any packet received with the same Source Address, Source PID and Sequence number as the last packet successfully received will be discarded and RXIDENTIF is set. 0 = Duplicated packets are processed further same as non-duplicated packets bit 5 ACKRXFP: ACK RX Frame Pending bit This read-only status bit reflects the value of the FrameCtrl (FramePend) bit in the last received 802.15.4 compatible ACK frame. bit 4 ACKTXFP: ACK TX Frame Pending bit The value of this bit is transmitted in the FrameCtrl (FramePend) bit slot when the MAC sends an ACK packet in 802.15.4 Compatibility mode. bit 3 AUTORPTEN: Auto-Repeat Enable bit If this bit is set, the MAC automatically transmits a packet whenever a packet is received, and its Repeat bit is set. 1 = Auto-Repeat feature is enabled 0 = Auto-Repeat feature is disabled Note 1: ADPTCHEN field is used while receiving and transmitting, and should not be modified while RXEN or TXST is set. 2: ADPTDREN field is used while receiving and transmitting, and should not be modified while RXEN or TXST is set.

DS70005023B-page 116 Advanced  2011-2013 Microchip Technology Inc. bit 2 AUTOACKEN: Auto-Acknowledge Enable bit If this bit is set, then the device will automat ically transmit an ACK packet whenever a packet is received, and its AckReq bit is set. 1 = Automatic Acknowledge processing enabled 0 = Automatic Acknowledge processing disabled bit 1 ADPTCHEN: Adaptive Channel Enable bit(1) Setting this bit will enable the MAC in Proprietary mode to set the transmitt ing channel for the ACK packet based on the AckInfo field (proprietary packet) of the received packet, rather than the CH<3:0> register bits. 1 = Adaptive Channel feature is enabled 0 = Adaptive Channel feature is disabled This feature is also known as Channel Agility. Refer to Section 7.1 “Channel Agility” for more information. bit 0 ADPTDREN: Adaptive Data Rate Enable bit(2) Setting this bit will enable the MAC in Proprietary mode to set the transmission data rate for the ACK packet based on the AckInfo field (proprietary packet) of the received packet, rather than the DR<2:0> register bits. 1 = Adaptive Data Rate feature is enabled 0 = Adaptive Data Rate feature is disabled This feature is also known as Channel Agility. Refer to Section 7.1 “Channel Agility” for more information. REGISTER 4-9: RXCON2 (MAC RECEIVE CONTROL 2 REGISTER) (CONTINUED) Note 1: ADPTCHEN field is used while receiving and transmitting, and should not be modified while RXEN or TXST is set. 2: ADPTDREN field is used while receiving and transmitting, and should not be modified while RXEN or TXST is set.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 117 MRF24XA REGISTER 4-10: PIR3 (PERIPHE RAL INTERRUPT REGISTER 3) R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 RXIF RXDECIF RXTAGIF r RXIDENTIF RXFLTIF RXOVFIF STRMIF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 RXIF: Received Successful Interrupt Flag bit Set by the device when a frame has passed packet filtering and has been accepted (refer to Register 2-23). This interrupt flag is only set once for a packet and is not set when the packet is the duplicate of a repeated transmission, (that is, sequence number matches with the previously received frame). Non-persistent, cleared by SPI read. bit 6 RXDECIF: Receiver Decryption/Authentication Passed Interrupt Flag bit Set by the device when decryption/authentication finished without error. Non-persistent, cleared by SPI read. bit 5 RXTAGIF: Receiver Decryption/Authentication Failure Interrupt Flag bit Set by the device when decryption/authentication finished with error. Non-persistent, cleared by SPI read. bit 4 Reserved: Maintain as ‘0’ bit 3 RXIDENTIF: Received Packet Identical Interrupt Flag bit Set by the device when the packet is the duplicate of a repeated transmission, (that is, sequence num- ber, source address matches with the previously received frame). Non-persistent, cleared by SPI read. bit 2 RXFLTIF: Received Packet Filtered Interrupt Flag bit Set by the device when a packet was received, but rejected by one or more RX Filters (refer to Register 2-23). Non-persistent, cleared by SPI read. bit 1 RXOVFIF: Receiver Overflow Error Interrupt Flag bit Set by the device to indicate that a packet was received, but all RX buffers were full. Consequently the packet was not received, but was discarded instead(1). Non-persistent, cleared by SPI read. bit 0 STRMIF: Receive Stream Time-out Error Interrupt Flag bit Set by the device to indicate that the duration specified in STRMTO has elapsed since the last received packet while in RX-Streaming mode, and the MAC clears the stored sequence number. Non-persistent, cleared by SPI read. Note 1: In Packet-mode a single buffer is used for received frames, whereas in RX-Streaming mode both buffers are used for reception.

DS70005023B-page 118 Advanced  2011-2013 Microchip Technology Inc. REGISTER 4-11: PIR4 (PERIPHERAL INTERRUPT REGISTER 4) R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 TXSFDIF RXSFDIF ERRORIF WARNIF EDCCAIF GPIO2IF GPIO1IF GPIO0IF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 TXSFDIF: Transmit SFD Sent Interrupt Flag bit Set by the device when the last sample of the SFD field has been sent on the air. Non-persistent, cleared by SPI read. bit 6 RXSFDIF: Receive SFD Detected Interrupt Flag bit Set by the device when the SFD field of the received frame is detected. Non-persistent, cleared by SPI read. bit 5 ERRORIF: General Error Interrupt Flag bit Set by the device, when malfunction state is reached. bit 4 WARNIF: Warning Interrupt Flag bit Set by the device when one of the following occurred:

Battery voltage has dropped below the threshold given by BATMON<4:0>
Resistor on pin 28 is missing or not connected well bit 3 EDCCAIF: Energy Detect/CCA Done Interrupt Flag bit Set by the device when Energy-detect or CCA measurement is complete (following that the host MCU has set the EDST/CCAST bit to start the measurement and the device is clearing it in on completion). Non-persistent. Cleared by SPI read. bit 2 GPIO2IF: GPIO2 Interrupt Flag bit Set by the device if the GPIOMO DE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. bit 1 GPIO1IF: GPIO1 Interrupt Flag bit Set by the device if the GPIOMO DE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity. bit 0 GPIO0IF: GPIO0 Interrupt Flag bit Set by the device if the GPIOMO DE register is set to normal operation, the GPIO is enabled and configured to input and the level matches with the polarity.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 119 MRF24XA REGISTER 4-12: PIR2 (PERIPHE RAL INTERRUPT REGISTER 2) R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 R/W/HS/HC-0 TXIF TXENCIF TXMAIF TXACKIF TXCSMAIF TXSZIF TXOVFIF FRMIF bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7-1 Out of scope bit 0 FRMIF: Frame Format Error Interrupt Flag bit Set if the transmitter/receiver fails to parse the frame in the buffer (because it is not as it should be or it is corrupted in demodulation). For example, reserved values found in the MAC header fields. Non-persistent, cleared by SPI read.

DS70005023B-page 120 Advanced  2011-2013 Microchip Technology Inc.

4.11 Carrier Sense Multiple Access-

Collision Avoidance (CSMA-CA) Carrier Sense Multiple Access-Collision Avoidance (CSMA-CA) is performed before transmitting a packet to increase the odds that the packet will be successfully received without interference from other transmitting devices nearby. When enabled (CSMAEN = 1), CSMA-CS is performed automatically by the MAC, using the underlying Clear Channel Assessment (CCA) operation. CSMA-CA is performed only before transmitting a packet (excluding ACK packets automatically transmitted during Auto- Acknowledge) in Packet and Repeater mode.

4.11.1 CSMA-CA CONFIGURATION

CSMA-CA is enabled by setting the CSMAEN register bit. CSMA-CA is automatically executed when the TXST register bit is set, before the packet is transmitted. CSMA-CA is considered part of a transmission operation, and it is therefore aborted by clearing the TXST register bit, and not by clearing the RXEN register bit. The following register bits are used in the configuration of CSMA-CA:

CSMAEN
BOMCNT<2:0>
BOUNIT<7:0>
MINBE<3:0>
MAXBE<3:0>

4.11.2 CSMA-CA BACK-OFF ALGORITHM

Wait a random number of Basetime units between 0 and (2MINBE-1) * BOUNIT<7:0>. 2. Perform a Clear Channel Assessment (CCA) operation. 3. If CCA fails, then wait for a random number of Basetime units between 0 and (2 (MINBE+1)-1) * BOUNIT<7:0>. 4. Repeat above two steps until CCA passes, incrementing the back-off exponent each time, until the maximum back-off time becomes MAXBE-1) * BOUNIT<7:0>, or until the number of attempts is greater than BOMCNT<2:0>. 5. If CCA is failed, but the number of attempts is less than BOMCNT<2:0>, keep trying with a back-off time of (2 MAXBE-1) * BOUNIT<7:0> Basetime units until the number of attempts is greater than BOMCNT<2:0>, or CCA passes. 6. If CCA still fails, the TX CSMA Error event is generated. An external LNA is automatically controlled by MRF24XA if it is enabled. Note: If MINBE = 0, the first iteration of the CSMA algorithm will perform a CCA operation immediately without any backoff time.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 121 MRF24XA REGISTER 4-13: TMRCON (TIMER CONTROL REGISTER) R/W-100 R/W-00010 BOMCNT<2:0> BASETM<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-5 BOMCNT<2:0>: CSMA-CA Back-off Maximum Count Field bits The maximum number of back-off attempts the CS MA-CA algorithm will attempt before declaring a channel access failure. 111 = Reserved 110 = Reserved 101 = 5 attempts 100 = 4 attempts 011 = 3 attempts 010 = 2 attempts 001 = 1 attempts 000 = 0 attempt bit 4-0 BASETM<4:0>: Base time Field bits The number of 1 µs clock cycles that a Base time un it represents in all re gister settings. Refer to Section 4.1 “MAC Architecture” for more information.

DS70005023B-page 122 Advanced  2011-2013 Microchip Technology Inc. REGISTER 4-14: CSMABE (CSMA-CA BA CK-OFF EXPONENT CONTROL REGISTER) R/W-0101 R/W-0011 MAXBE<3:0> MINBE<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-4 MAXBE<3:0>: CSMA-CA Back-off Maximum Count Fields The maximum value of the Back-off exponent (BE) is in the CSMA-CA algorithm. The back-off time is (2BE-1) units. 1111 = Reserved 1001 = Reserved 1000 2 8-1 = 255 maximum units of back-off time 0000 2 0-1 = No back-off time bit 3-0 MINBE<3:0>: CSMA-CA Back-off Minimum Count bit The minimum value of the back-off exponent (BE) is in the CSMA-CA algorithm. The back-off time is (2BE-1) units. 1111 = Reserved 1001 = Reserved 1000 2 8-1 = 255 maximum units of back-off time 0000 2 0-1 = No back-off time

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 123 MRF24XA REGISTER 4-15: BOUNIT (BACK- OFF TIME UNIT REGISTER) FIGURE 4-11: CSMA-CA ALGORITHM R/W-10100000 BOUNIT<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-0 BOUNIT<7:0>: CSMA-CA Back-off Period Unit Field bits The number of Base time units for the basic back-off time unit used by CSMA-CA algorithm. 11111111 = 256 Base time units 00000000 = 1 Base time unit NB = 0 BE = MINBE <3:0> Delay for a Random number of Back-off Periods between 0 and 2^BE -1 Perform CCA Channel Idle? NB = NB +1 BE = min (BE + 1, MAXBE <3:0>) NB > BOMCNT <2:0>? Transmit Pending Packet (Success) (Failure) Yes No No Yes

DS70005023B-page 124 Advanced  2011-2013 Microchip Technology Inc.

4.12 Clear Channel Assessment (CCA)

Clear Channel Assessment (CCA) is a function within CSMA/CA to determine whether the wireless medium is ready and able to receive data, thus the transmitter can start sending it. CCA is implemented outside of the MAC. This allows the radio to transmit in the presence of interference from other wireless protocols that operate on the same frequency. CCA may be performed using either Energy Detection (ED), Carrier Sense (CS) or a combination of both. Refer to Section 9.6 “Clear Channel Assessment (CCA)” for more information on register description.

4.13 Condition for Hardware

Figure 4-11 illustrates the condition for hardware acknowledgement that is examined in Figure 4-8 and Figure 4-10. The AUTOACKEN = 0 case, when Acknowledgement is done by software. Both acknowledgement mechanisms (AUTOACKEN = 0/1) are described for the originator and the recipient. FIGURE 4-12: ACK REQUIREMENT DECISION AUTOACKEN = 1 Evaluates to TRUE “ACK Required?” AckReq = 1 Packet Mode (TRXMODE = 00) and non-streaming frames are considered only, since streaming type of frames always contain AckReq, and RX-Streaming Nodes discard non-streaming type of frames. ACK is handled by software. The sender of the frame does not request an ACK to it. No Yes Yes AUTOACKEN = 1 is forbidden in Repeater Nodes, thus AUTORPTEN = 0 is implied. The required and sufficient condition for Acknowledge sending is TRXMODE = 00 AND AUTORPTEN = 0 AND AUTOACKEN = 1 AND AckReq = 1. Evaluates to FALSE If the transmitter (TXST = 1) of the frame having AckReq = 1 is configured as TRXMODE = 00 AND AUTOACK = 1 then it needs to receive a valid ACK to the sent frame to report successful sending. If the receiver (TXST = 0) of the frame having AckReq = 1 is configured as TRXMODE = 00 AND AUTOACK = 1 then it needs to transmit an ACK to the received frame and all of the subsequent duplicates that arrive before the MHR is overwritten in the frame buffer. No

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 125 MRF24XA REGISTER 4-16: RXCON2 (MAC RECEIVE CONTROL REGISTER 2) R/C/HS-0 R/W-0 R-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 RXBUFFUL IDENTREJ ACKRXFP ACKTXFP AUTORPTEN AUTOACKEN ADPTCHEN ADPTDREN bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HS = Hardware Set C = Clearable bit bit 7-3 Out of scope bit 2 AUTOACKEN: Auto-Acknowledge Enable bit Recipient of a data frame: If this bit is set, the device will automatically transmit an ACK packet whenever a packet is received, and its AckReq bit is set. Originator of a data frame: If this bit is set, then the device will await a ACK packet after the transmission of a packet (and after each retransmissions of it ), and will process the received ACKnowledge packet automatically without writing it to the buffer. Also, setting this bi t is required for enabling automatic retransmissions by the device. The host MCU wo uld clear AUTOACKEN to disable the automatic processing of acknowledge frames, so that they be written to the buffer. 1 = Automatic Acknowledge processing enabled 0 = Automatic Acknowledge processing disabled bit 1-0 Out of scope

DS70005023B-page 126 Advanced  2011-2013 Microchip Technology Inc.

4.14 Acknowledge Sending by

ACK sending shall never use CSMA whether AUTO- ACKEN = 1 or 0. A TXIF is not generated when an ACK packet completes transmission. However, TXSFDIF and TXMAIF are set. FIGURE 4-13: AUTOMATIC ACKN OWLEDGE SENDING (AUTOACKEN = 1 AND ACKREQ = 1) FRMFMT = 1 Exit Enter Proprietary frame carrying AckInfo. No Receiver turned OFF, transmitter remains ON Await RXACKWAIT base time units. (start transition to TX just in time) Start transmitting the preamble in the frame (without doing CSMA) (when SFD is sent: TXSFDIF 1) Generate ACKNOWLEDGE frame MHR without writing to buffer. If FRMFMT = 0 then FrameCtrl.FramePend ACKTXFP. SEQUENCE received frame sequence Append FCS (on-the-fly) CH<3:0> selected as receive channel Return to RX ADPTCHEN Use AckInfo field of the received frame to select the transmitting channel for the ACK frame ADPTDREN Use AckInfo field of the received frame to select the transmitting data rate for the ACK frame Yes By default, RXChannel = TXChannel = CH<3:0>. For the exception, refer to RXEN = 1 FrameCtrl.AckReq = 1 must hold for entry Section 7.1 “Channel Agility” on agility.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 127 MRF24XA TABLE 4-3: IDENTICAL PACKET REJECTION SCENARIO RXBUFFULL IDENTREJ AutoAck AckReg Description 00 0 0 No ACK is sent, RXBUFFULL<100 0 1 00 1 0 0 0 1 1 ACK is sent, RXBUFFULL<- 1 01 0 0 Store Sequence number and Source address (SA + PID) No ACK is sent, RXBUFFULL<- 101 0 1 01 1 0 0 1 1 1 Store Sequence number and Source address (SA + PID) ACK is sent, RXBUFFULL<- 1 1 0 X X No ACK is sent, RXOVFIF<- 1 1 1 0 0 No ACK is sent, if stored sequence number and Source address match with the received one, then RXIDENTIF<- 1 otherwise, RXOVFIF<- 1 11 0 1 11 1 0 1 1 1 1 If stored sequence number and Source address match with the received one, ACK is sent and RXIDENTIF <- 1 Otherwise, RXOVFIF<- 1

DS70005023B-page 128 Advanced  2011-2013 Microchip Technology Inc.

4.15 Acknowledge Reception by

After the reception of a valid ACK packet (sequence field matches with transmitted frame sequence field), RXSFDIF and TXIF interrupts are generated (the RXIF is not generated while receiving an ACK frame). If the maximum number of retransmissions has been reached (TXRETCCNT >= TXRETMCNT), for example, no valid acknowledge received, TXACKIF interrupt is generated. FIGURE 4-14: ACKNOWLEDGE RECEPT ION AND RE-TRANSMISSION CONTROL Enter TRANSMITTER PROCESSING IN PACKET MODE TXST = 1 Entered when ACK Required Receiver turned OFF RXChannel selected Receiver turned OFF TXChannel selected Increment TXRETCCNT Valid ACK frame received with SEQUENCE field matching the transmitted frame? Receiver turned OFF TXChannel selected Radio to RX Start time-out counter Frame received? Timer reached TXACKTO base time units? TXRETCCNT >= TXRETMCNT? No By default, RXChannel = TXChannel = CH<3:0>. For the exception, refer to RXSFDIF 1 Frame parsed without writing to buffer TXACKIF 1 Update ACKRXFP Exit retransmit success No Yes Yes Yes No No failure TXST = 1 Yes Figure 4-8 on agility. Section 7.1 “Channel Agility”

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 129 MRF24XA

4.16 Basetime Units

The desired Basetime is selected by writing the BASETM<4:0> register bits. Each increment of BASETM<4:0> is equal to 1 µs. The RXACKWAIT<7:0>, TXACKTO<7:0>, BOUNIT<7:0>, STRMTO<15:0> and OFFTM<7:0> (3) fields are specified in terms of Basetime Units. The BASETM<4:0> bits should not be changed while RXEN = 1 or TXST = 1. The Basetime is used in all modes for all types of packets. TABLE 4-4: BASETIME UNITS Function/Timer Range of Timer with BASETM<4:0> = 0x01 (1 µs resolution) Range of Timer with BASETM<4:0> = 0x02 (2 µs resolution) Range of Timer with BASETM<4:0> = 0x04 (4 µs resolution) Time to wait before transmitting an ACK packet (RXACKWAIT<7:0>) 0 - 128 µs 0 - 256 µs 0 - 512 µs Maximum time to look for an ACK packet before issuing a TX Ack Error or before retransmitting (TXACKTO<7:0>) 0 - 256 µs 0 - 512 µs 0 - 1024 µs CSMA Backoff Time (0 - (2BE - 1) * BOUNIT<7:0>) (320 µs) BOUNIT<7:0> = 80(2) (320 µs) BE = 0 — 0 BE = 1 — 0 - 320 µs BE = 2 — 0 - 960 µs BE = 3 — 0 - 2.24 ms BE = 4 — 0 - 4.8 ms BE = 5 — 0 - 9.92 ms BE = 6 — 0 - 20.16 ms BE = 7 — 0 - 40.64 ms BE = 8 — 0 - 81.6 ms RX Stream Timeout (STRMTO<15:0>) 0 - 65 ms 0 - 131 ms 0 - 131 ms Minimum OFF Time (OFFTM<7:0> * 32) (3) 0 - 8 ms 0 - 16 ms 0 - 32 ms Note 1: The maximum delay that can be supported by this MAC is 131 ms. Values outside this range may be set, but will result in truncation of the number to one that is less than or equal to 131 ms. 2: The value of 320 µs was chosen because it is the value referenced in the 802.15.4-2006 specification. Other values are possible, but may break 802.15.4 compliance. 3: Note that the OFFTM<7:0> register is the only timer value that is expressed not directly in BASETM units, but rather is expressed in BASETM * 32 units.

DS70005023B-page 130 Advanced  2011-2013 Microchip Technology Inc. NOTES:

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 133 MRF24XA Transmitter Side: Receiver Side:

1 Description TX Configuration:

SECEN = 0 CSMAEN = 0 Example ShortAddress: 0x1A1B PID: 0x2C2D

2 Description Construct, download unprocessed frame

Example 0C | 01 98 | A8 | 2C 2D | FF FF | 2C 2D | 1A 1B | FF | (no CRC) Length = 12d + 2d (CRC) = 14d = 0x0E FrameCtrl = 0x01 0x98 = lsb_0000_0001_1001_1000 (Data, SEC = 0, DA, SA Short Addresses, ver2006) Sequence = 0xA8 SA/DA PID = 0x2D2C DA = 0xFFFF (broadcast) SA = 0x1B1A (unicast) MAC Payload = 0xFF 3 Description Set TXST: Launches transmission. CRC is appended. Length is incremented accordingly. Example 0E | 01 98 | A8 | 2C 2D | FF FF | 2C 2D | 1A 1B | FF | A7 8E CRC: 0xA7 0x8E 4 Description End of Transmission (No ACK Request, No CSMA): TXIF received. TXBUFEMPTY =

1 Description RX Configuration: SECEN = 0 (NWK), Security Suite

Example Address: Don’t care.

2 Description RXSFDIF = 1 unless RXBUFFUL = 1

(If RXBUFFUL= 1 then RXSFDIF = 1; RXOVFIF = 1; no writing to buffer 3 Description RX Parsing and Filtering when frame reception is complete. If duplicated packet then silently discarded Else if packet filtered then RXFLTIF, Otherwise RXIF = 1 (since SECEN = 0) Example RXFILTER(@0x18) = 0x45 4 Description RXIF = 1. CRC is not valid for the decrypted frame. Example 0E | 01 98 | A8 | 2C 2D | FF FF | 2C 2D | 1A 1B | FF | A7 8E||RSVs

DS70005023B-page 134 Advanced  2011-2013 Microchip Technology Inc. FIGURE 5-4: EXAMPLE: PACKET MO DE WITH NKW-LAYER SECURITY

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 135 MRF24XA Transmitter Side:

1 Description Construct, download unprocessed frame

Example 12 | 01 98 | A8 | 2C 2D | FF FF | 2C 2D | 1A 1B | 01 02 03 04 05 06 | FF | (No MIC, no CRC) Length = 18d + 4d (MIC-32) + 2d (CRC) = 24d = 0x18 FrameCtrl = 0x01 0x98 = lsb_0000_0001_1001_1000 (SEC = 0, DA, SA Short Addresses, ver2006) Sequence = 0xA8 SA/DA PID = 0x2D2C DA = 0xFFFF (broadcast) SA = 0x1B1A (unicast) Network Header = 0x01 0x02 0x03 0x04 0x05 0x06 Network Payload = 0xFF

2 Description TX Configuration: NWK-layer Security

Example Security Suite = MIC-32

3 Description TX Configuration: Key, Nonce, Payload Index, Header Index

Example Short Address = 0x1B1A PID = 0x2D2C Header Index (@0x2B) = 12 d Payload Index (@0x2C) = 18d MRF24XA register content 0x20 22 33 44 55 66 77 88 1A 0x28 1B 2C 2D 0C 12 00 00 00 Key<i> = 0x0F0E0D0C0B0A09080706050403020100 Nonce<i> = 0x50 + <i>, i = 0…12 MRF24XA register content 0x40 00 01 02 03 04 05 06 07 0x48 08 09 0A 0B 0C 0D 0E 0F 0x50 60 61 62 63 64 65 66 67 0x58 68 69 6A 6B 6C 00 00 00 4 Description Issue TXENC: Launches CCM authentication and encryption. 5 Description Security Processing Done: TXENCIF = 1, TXENC = 0. Optionally, TX buffer can be read. Processed Frame PRFR can be compared to the result of the receiver security processing or to the calculated expected outcome. Example Expected buffer content: 16 | 01 98 | A8 | 2C 2D | FF FF | 2C 2D | 1A 1B | 01 02 03 04 05 06 | 46 | 78 C3 22 32 | (no CRC) Encrypted payload (0xFF): 0x46 MIC-32: 0x{78 C3 22 32} CRC: 0xA7 0x8E 6 Description Set TXST: Launches transmission. CRC is appended. Example 18 | 01 98 | A8 | 2C 2D | FF FF | 2C 2D | 1A 1B | 01 02 03 04 05 06 | 46 | 78 C3 22 32 | A7 8E CRC: 0xA7 0x8E 7 Description End of Transmission (No ACK Reques t, No CSMA): TXIF received. TXBUFEMPTY= 1

DS70005023B-page 136 Advanced  2011-2013 Microchip Technology Inc. Receiver Side:

5.1 Frame Types in IEEE

802.15.4-Compliant Framing Mode The Type<2:0> bit field in FrameCtrl uses the encoding in Table 5-1. If SecEn bit in FrameCtrl is set then the frame is parsed by hardware to construct the security material (both at sending and after reception). In the case of Beacon frames, it is the responsibility of the host MCU to set the security materials before transmission (TXST) and after reception (RXIF). For beacon frames, the Frame Version subfield shall be set to ‘1’ only if the Security Enabled subfield is set to ‘1’.

1 Description RX Configuration: Security Suite

Example Security Suite = MIC-32

2 Description If RXBUFFUL is 0 then RXSFDIF = 1

If RXBUFFUL is 1 then RXSFDIF = 1 RXOVFIF = 1 (no writing to buffer) 3 Description RX Parsing and Filtering when frame reception is complete. If packet filtered then RXFLTIF, Otherwise = 1 (Network secured frame received since SECEN = 0) Example RXFILTER(@0x18) = 0x45 4 Description Read RX buffer containing PRFR + CRC. CRC is valid for the encrypted frame and, LQI, RSSI (RSVs) appended to the frame. Example 18 | 01 98 | A8 | 2C 2D | FF FF | 2C 2D | 1A 1B | 01 02 03 04 05 06 | 46 | 78 C3 22 32 | A7 8E || RSVs CRC: 0xA7 0x8E 5 Description RXDEC = 1 launches decryption and authenticity checking. 6 Description If authenticity is approved (success): RXDECIF = 1. CRC is not valid for the decrypted frame. Otherwise RXTAGIF = 1. Example 1A | 01 98 | A8 | 2C 2D | FF FF | 2C 2D | 1A 1B | 01 02 03 04 05 06 | FF | 78 C3 22 32 | A7 8E |6C RSSI: 0x6C LQI: 0x42 TABLE 5-1: IEEE 802. 15.4™ FRAME TYPES TYPE Field b2,b1,b0 Frame Type Related Hardware Features 000 Beacon Beacons are a specific type of broadcast frames. This device does not provide support for MHR-parsing on beacon frames. Beacon frames are always accepted as valid frames. 001 Data Can be filtered by setting DATAREJ.

010 Acknowledge Must be generated by the receiver (from SW or HW), if AckReq = 1 in the last

received frame, and must contain the same Sequence value. Can be generated by hardware (AUTOACKEN = 1). In this case it is not loaded to the TX frame buffer. AUTOACKEN = 1 requires CRCSZ = 1 on both the transmitter and the receiver side. 011 Command Can be filtered by CMDREJ. First byte of payload (Command) is never encrypted. Command encoding in Table 82 in Section 7.3 of IEEE 802.15.4™-2006. 1xx Reserved —

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 137 MRF24XA REGISTER 5-1: RXFILTER (RX FILTER REGISTER) R/W-0 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 PANCRDN CRCREJ CMDREJ DATAREJ UNIREJ NOTMEREJ BCREJ NSTDREJ bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-6 Out of Scope bit 5 CMDREJ: Command Frame Reject Enable bit Setting this bit allows the user to reject all packets with FrameCtrl<Type> equal to Command. 1 = Reject all Command packets 0 = Disable Command Frame Rejection bit 4 DATAREJ: Data Frame Reject Enable bit Setting this bit allows the user to reject all packets with FrameCtrl<Type> equal to Data. 1 = Reject all Data packets 0 = Disable Data Frame Rejection bit 3-0 Out of Scope

DS70005023B-page 138 Advanced  2011-2013 Microchip Technology Inc. 5.2 Addressing in IEEE 802.15.4 Compliant Framing Mode Address format used in MHR is defined by the Destina- tion Addressing Mode (DAMode) and Source Addressing Mode (SAMode) bit fields of FrameCrtl (Figure 5-1). DAMode subfield encodes the length of the DestPID and DestAddr fields as listed in Table 5-3. SAMode subfield encodes the length of the SrcPID and SrcAddr fields as listed in Table 5-3. On reception of a frame, each node compares its own SHADDR, ADDR, PANID configuration (see Table 5-4) to the appropriate destination addressing fields in the received frame. A valid frame is identified if a match is found. Additionally, rules apply for broadcast frames and for implied unicast addressing as explained in the sequel. TABLE 5-2: IEEE 802. 15.4™ DESTINATION ADDRESSING MODES DAMode b1, b0 Destination Addressing Mode DestPID | DestAddr format 11 16-bit DestPID and 64-bit Dest. Long Address XXXXh | XXXX_ XXXX_ XXXX_ XXXXh 10 16-bit DestPID and 16-bit Dest. Short Address XXXXh | XXXXh

01 Reserved —

00 DestPID and DestAddr are not present —

TABLE 5-3: IEEE 8 02.15.4™ SOURCE ADDRESSING MODES SAMode b1, b0 Source Addressing Mode SrcPID | SrcAddr Format

11 If DAMode<1> = 1 and PIDCmp = 1, then

64-bit Source Long Address only (SrcPID is implied by DestPID) else, 16-bit SrcPID and 64-bit Source Long Address - |XXXX_XXXX_XXXX_XXXXh XXXXh | XXXX_XXXX_XXXX_XXXXh

10 If DAMode<1> = 1 and PIDCmp = 1, then

16-bit Source Short Address only (SrcPID is implied by DestPID) else, 16-bit SrcPID and 16-bit Source Short Address - |XXXXh XXXXh | XXXXh

00 SrcPID and SrcAddr are not present —

TABLE 5-4: RELEVANT REGISTERS FO R IEEE 802.15.4™-MODE ADDRESSING ADDR. RESGISTER Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0x1F ADDR1 ADDR<7:0> 0x20 ADDR2 ADDR<15:8> 0x21 ADDR3 ADDR<23:16> 0x22 ADDR4 ADDR<31:24> 0x23 ADDR5 ADDR<39:32> 0x24 ADDR6 ADDR<47:40> 0x25 ADDR7 ADDR<55:48> 0x26 ADDR8 ADDR<63:56> 0x27 SHADDRL SHADDR<7:0> 0x28 SHADDRH SHADDR<15:8> 0x29 PANIDL PANID<7:0> 0x2A PANIDH PANID<15:8>

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 139 MRF24XA If DAMode subfield is equal to zero and the Frame Type subfield does not specify that this frame is an acknowledgment or beacon frame, then the SAMode subfield shall be non-zero, implying that the frame is directed to the PAN coordinator with the PAN identifier as specified in the Source PAN Identifier field. This addressing option is referred to as ‘implied’. Broadcast frames of type data or command must always use DAMode = 01 and DestAddr = FFFFh. Acknowledge frames are broadcast frames and always use DAMode = 00 and SAMode = 00. Beacon frames are broadcast frames and always use DAMode = 00, PIDCmp = 0 with SAMode = 01 or 10. Table 5-6 and Table 5-7 show the examples for desti- nation and source addressing, using the TX and RX node configurations in Table 5-5. The valid address formats are summarized in Table 5-8 for all frame types. Broadcast and unicast cases are dis- tinguished in the case of command and data frames. Unicast frames are either addressed to the receiving node or to a different node. UNIREJ and NOTMEREJ are sensitive to the former or the latter case, respec- tively. Broadcast command and data frames are filtered by setting BCREJ. Beacon frames are not filtered by the parser. TABLE 5-5: EXAMPLE CONFIGURATION TX (Source) Configuration ADDR = 0x080706050403020100 SHADDR = 0x1211 PANID = 0xD2D1 RX (Destination) Configuration ADDR = 0xA8A7A6A5A4A3A2A1A0 SHADDR = 0xB2B1 PANID = 0xB2B1 MHR FrameCtrl | Sequence | DestPI D | DestAddr| SrcPID | SrcAddr FrameCtrl FrameCtrl<7:0> = 0 | PIDCmp | X | X | X | Type<2:0> FrameCtrl<15:8> = SAMode<1:0> | 0 | X | DAMode<1:0> | 0 | 0 where, Type is not Acknowledge and X is either of {0,1} TABLE 5-6: DESTINATION ADDRESSING OPTI ONS (IEEE 802.15.4™) USING THE EXAMPLE Options Broadcast Unicast Command (or Data) Beacon Long Short Implied to Coordin. DestPID | DestAddr XX,XX | FF, FF — D1,D2 | A1, A2,…, A8 D1,D2 | B1, B2 — TYPE xxx 000 xxx xxx not 000 DAMode 10 00 11 10 00 Address Filter BCREJ — NOTMEREJ, UNIREJ — Note 1: DAMode = 01 is reserved and is rejected by NSTDREJ = 1. TABLE 5-7: SOURCE ADDRESSING OPTION S (IEEE 802.15.4™) USING THE EXAMPLE Options Long (Explicit SrcPID) Long (Implied SrcPID) Short (Explicit SrcPID) Short (Implied SrcPID) None SrcPID | SrcAddr TYPE xxx xxx xxx xxx xxx SAMode 11 11 10 10 00 DAMode xx 1x xx 1x xx PIDCmp 0 1 0 1 x Note 1: SAMode = 01, is reserved, and is rejected by NSTDREJ = 1.

DS70005023B-page 140 Advanced  2011-2013 Microchip Technology Inc. REGISTER 5-2: RXFILTER (RX FILT ER) – WHEN IEEE 802.15.4™ MODE R/W-0 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 r r r r UNIREJ NOTMEREJ BCREJ NSTDREJ bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-4 Reserved: Maintain as ‘0’ bit 3 UNIREJ: Unicast Reject Enable bit(2) Setting this bit allows the user to reject all unicast packets as in: matches the address in the ADDR<63:0> or SHADDR<15:0> register, as selected by DAMode. Proprietary Mode: Destination Address matches the a ddress in ADDR<ADDRSZ<2:0>*8-1:0> reg- ister, provided that DAddrPrsnt frame control field is set(1). 1 = Reject all Unicast packets addressed to this node 0 = Disable Unicast Rejection bit 2 NOTMEREJ: Not Me Unicast Reject Enable bit(3) Setting this bit allows the user to reject all unicast packets as in: cast) or Destination Address do es not match the address in the ADDR<63:0> register or the SHADDR<15:0> register, as selected by DAMode. Proprietary Mode: Destination Address matches the a ddress in ADDR<ADDRSZ<2:0>*8-1:0> reg- ister, provided that DAddrPrsnt frame control field is set(1). 1 = Reject all Unicast packets NOT addressed to this node 0 = Disable Not Me Unicast Rejection Filtering bit 1 BCREJ: Broadcast Rejection bit mand. A Data or Command packet is broadcast when Short Destination Addressing is used (DAMode = 10) and Short Address is equal 0xFFFF. Proprietary Mode: Setting this bit allows the user to reject all Broadcast packets of type Data or Com- mand (or Streaming). A packet is broadcast when FrameCtrl[Broadcast] is set. 1 = Reject Broadcast Packets 0 = Disable Broadcast Rejection bit 0 NSTDREJ: Non-Standard Frame Reject bit(4) This bit allows the user to reject all 802.15.4 frames having 01 for the DAMode or SAMode fields or having the most significant bit (MSb) (bit 2) in the Type field set (1) or having the MSb (bit 1) in the Frame Version field set to(1). 1 = Reject all Non-Standard 802.15.4 packets 0 = Disable Non-Standard Rejection Note 1: In Proprietary mode (FRMFMT = 1), when CRCREJ = 1 is used to reject unicast frames not addressed to this node. NOTMEREJ = 1 will not reject these frames. 2: Frames using implied destination addressing in 802.15.4 mode and inferred destination addressing in Proprietary mode are not affected by UNIREJ. 3: Frames using implied destination addressing in 802.15.4 mode and inferred destination addressing in Proprietary mode are not affected by NOTMEREJ. 4: Proprietary frames in Proprietary mode are not affected by NSTDREJ.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 141 MRF24XA When a valid frame gets filtered, RXFLTIF is set, other- wise the successful reception is terminated by RXIF. Refer to Register 5-1 for more information. Invalid addressing formats are produced if:

Either DAMode or SAMode are set to the reserved value of ‘01’.
DAMode or SAMode values are used with an incompatible Type field value. For example, - Beacon with DAMode = 1x - DAMode = 00, SAMode = 00 used with Type of Beacon/Command / Data.
PIDCmp is set on an inconsistent way to DAMode and SAMode.
SrcPID or SrcAddr holds ‘FFFF’, or if DestPID holds ‘FFFF’ while DAMode = 11.
LENGTH field is less than the MHR length computed from FrameCtrl. The first condition is checked by the device and FRMIF is generated. The second condition is not checked by the device, therefore one out of RXIF, RXFLTIF, FRMIF is expected. The third condition is checked by the hard- ware and PIDCmp value is handled as 0. The fourth condition is not checked by hardware and RXIF is expected. All other invalid formats also produces one out of RXIF, RXFLTIF, FRMIF. TABLE 5-8: IEEE 802.15 .4™ TEST CASES: VALID ADDRESSING FORMATS DA PID COMP SA DEST (2) TYPES(3) Field Sizes in Octets(4) Description(5) 00 0 (1) 00 BC3 A 0|0|0|0 Acknowledge Frame (no Auto-Ack) 10 0 (1) 00 BC1 C,D 2|2|0|0 Short destin ation (xxxx|FFFF), No Source 10 0 (1) 00 BC2 C,D 2|2|0|0 Short destination (FFFF|xxxx), No Source 10 0 (1) 00 UNI C,D 2|2|0|0 Short destination, No Source 10 0 (1) 00 NOTME C,D 2|2|0|0 Short destination, No Source 11 0 (1) 00 UNI C,D 2|8|0|0 Long destination, No Source 11 0 (1) 00 NOTME C,D 2|8|0|0 Long destination, No Source 00 0 (1) 10 BC3 B 0|0|2|2 Beacon frame sent by the Coordinator 00 0 (1) 10 UNI2, PANCRDN C,D 0|0|2|2 Implied addressing to Coordinator node. UNI2 for Coordinator. 00 0 (1) 10 NOTME2, PANCRDN C,D 0|0|2|2 Implied addressing to Coordinator node. NOTME2 for all nodes other. 00 0 (1) 11 BC3 B 0|0|2|8 Beacon frame sent by the Coordinator 00 0 (1) 11 — C,D 0|0|2|8 Implied addressing to Coordinator node. UNI2 for Coordinator. 00 0 (1) 11 NOTME2, PANCRDN C,D 0|0|2|8 Implied addressing to Coordinator node. NOTME2 for all nodes other. 10 0 (1) 10 BC1 C,D 2|0|2|2 Short destinati on (xxxx | FFFF), Short source 10 0 (1) 10 BC2 C,D 2|0|2|2 Short destination (FFFF | xxxx), Short source 10 0 10 UNI C,D 2|0|2|2 Short destination, Short source 10 0 10 NOTME C,D 2|2|2|2 Short destination, Short source 10 1 10 BC1 C,D 2|2|0|2 Short destination(xxxx | FFFF), Short source (PID compression) 10 1 10 UNI C,D 2|2|0|2 Short destination, Short source (PID compression) 10 1 10 NOTME C,D 2|2|0|2 Short destination, Short source (PID compression) 10 0 11 BC1 C,D 2|2|2|8 Short destin ation (xxxx | FFFF), Long source 10 0 11 BC2 C,D 2|2|2|8 Short destination (FFFF | xxxx), Long source 10 0 11 UNI C,D 2|2|2|8 Short destination, Long source 10 0 11 NOTME C,D 2|2|2|8 Short destination, Long source 10 1 11 BC1 C,D 2|2|0|8 Short destination (xxxx | FFFF), Long source (PID compression) 10 1 11 UNI C,D 2|2|0|8 Short destination, Long source (PID compression)

DS70005023B-page 142 Advanced  2011-2013 Microchip Technology Inc.

5.3 Security Material

The security material required for CBC-MAC, CTR and CCM are the inputs configured to the registers listed in Table 5-10. These are:

SECSUITE<3:0> select s the security suite consisting of encryption and/or authentication (see Table 5-9).
SECHDRINDX<6:0> is the byte index where authentication shall start.
SECPAYINDX<6:0> is the byte index where encryption/decryption shall start.
SECENDINDX<6:0> points at the last byte of the payload (before MIC and FCS).
SECKEY<127:0> holds the symmetric Key.
SECNONCE<103:0> holds a Nonce value that is unique for each frame while a specific Key is in use. This ensures sequence freshness (for pro- tection against repeat-attack) and protects the key from being deciphered based on the encoded messages. The information required to generate the Nonce is generated by the transmitter and sent to the receiver as plain text as part of the frame. Section 5.4 “Security Material Retrieval with IEEE

802.15.4 Compliant Frames” describe how the secu-

rity level is selected and whether the above registers are filled out by the device or by the software before security operation is laun ched. DEVICE/HOST fills in these registers and the Authentication appends a MIC tag to the frame (before FCS is appended), after the position pointed at by SECENDINDX. Encryption/ decryption alters the “payload” stored in the buffer from SECPAYINDX through SECENDINDX. The range defined for “Payload” does not necessarily coincide with the MAC payload as explained in the sequel. Figure 5-2 to Figure 5-9 illustrate the order of all the security operations, which is valid for both 2003/2006 compliant framing modes. 10 1 11 NOTME C,D 2|2|0|8 Short destination, Long source (PID compression) 11 0 10 UNI C,D 2|8|2|2 Long destination, Short source 11 0 10 NOTME C,D 2|8|2|2 Long destination, Short source 11 1 10 UNI C,D 2|8|0|2 Long destination, Short source (PID compression) 11 1 10 NOTME C,D 2|8|0|2 Long destination, Short source (PID compression) 11 0 11 UNI C,D 2|8|2|8 Long destination, Long source 11 0 11 NOTME C,D 2|8|2|8 Long destination, Long source 11 1 11 UNI C,D 2|8|0|8 Long destination, Long source (PID compression) 11 1 11 NOTME C,D 2|8|0|8 Long destination, Long source (PID compression) Note 1: The standard requires 0 in the cases marked by (1); yet, 1 will be handled as 0 in such cases by the device parser (without erroring out). 2: ‘BC1’- Broadcast addr only,’BC2’- Broadcast pid only, ‘BC3’- Broadcast no daddr, ‘UNI’- Unicast to this node, ‘UNI2’- Unicast to this node when no destination address is present, ‘NOTME’- Unicast to different node, ‘NOTME2’- Unicast to different node when no destination address is present. 3: Frame Types Legend: ‘A’-acknowledge, ‘B’-beacon, ‘C’-command, ‘D’-data. 4: DESTPID | DESTADDR | SRCPID | SRCADDR. 5: In the descriptions, ‘xxxx’ represents a 4-digit hexa number different from ‘FFFF’. TABLE 5-8: IEEE 802.15 .4™ TEST CASES: VALID ADDRESSING FORMATS (CONTINUED) DA PID COMP SA DEST (2) TYPES(3) Field Sizes in Octets(4) Description(5) TABLE 5-9: SECURITY LEVEL: MODE OF OPERATION Security Level(1) Payload MIC Tag of Octets Comment

0000 Plain text No Authentication —

0001 Plain text 4 bytes CCM operation. Defined only in 2006 0010 Plain text 8 bytes CCM operation. Defined only in 2006 0011 Plain text 16 bytes CCM operation. Defined only in 2006

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 143 MRF24XA 0100 Encrypted No Authentication CCM operation. Defined only in 2006 0101 Encrypted 4 bytes CCM operation. Defined only in 2003/2006 0110 Encrypted 8 bytes CCM operation. Defined only in 2003/2006 0111 Encrypted 16 bytes CCM operation. Defined only in 2003/2006 1000 Encrypted No Authentication ECB operation. No t defined in 2003/2006 (only encryption) 1001 Encrypted No Authentication CTR operation. Defined in 2003

1010 Reserved — —

1011 Reserved — —

1100 Reserved — —

1101 Plain text 16 bytes CBC-MAC operation. Defined only in 2003 1110 Plain text 8 bytes CBC-MAC operation. Defined only in 2003 1111 Plain text 4 bytes CBC-MAC operation. Defined only in 2003 Note 1: In 2006 compliant framing, the security level is traveling with the frame, while in 2003 it should be set globally. TABLE 5-9: SECURITY LEVEL: MODE OF OPERATION (CONTINUED) Security Level(1) Payload MIC Tag of Octets Comment TABLE 5-10: SECURITY MATERIAL INPUTS TO CBC-MAC, CTR AND CCM ADDR. RESGISTER Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0x10 MACCON1 TRXMODE<1:0> ADDRS Z<2:0> CRCSZ FRMFMT SECFLAGOVR 0x11 MACCON2 CH<3:0> SECSUITE<3:0> 0x2B SECHDRINDX SECHDRINDX<6:0> 0x2C SECPAYINDX SECPAYINDX<6:0> 0x2D SECENDINDX SECENDINDX<6:0> 0x40 through 0x4F SECKEY1 SECKEY<7:0> <2,3,4…,15> … SECKEY16 SECKEY<127:120> 0x50 through 0x5C SECNONCE1 SECNONCE<7:0> <2,3,4…,12> … SECNONCE13 SECNONCE<103:96> 0x5D SECENCFLAG SECENCFLAG<7:0> 0x5E SECAUTHFLAG SEC AUTHFLAG<7:0>

DS70005023B-page 144 Advanced  2011-2013 Microchip Technology Inc. FIGURE 5-5: CCM*/CBC-MAC AUTH ENTICATION OPERATION (TX) Exception Handling: TXSZIF: Transmit Packet Size Error Interrupt Flag TXST is set when the packet size (including MIC tags and CRC) is found to be zero or to be greater than the maximum size that the buffers can support. FRMIF: Frame Format Error Interrupt Flag Set if the transmitter/receiver fails to parse the frame in the buffer (because it is not as it should be or it is corrupted in demodulation). For example, reserved values are found in the MAC header fields. MHR MAC PayloadLength Authentication TX Buffer MHR MAC Payload TagLength CRC Generation MHR MAC Payload CRCTagLengthTransmitted to the air Updating Updating

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 145 MRF24XA FIGURE 5-6: CCM*/CBC-MAC DE-A UTHENTICATION OPERATION (RX)(1, 2) Note 1: The Length field above refers to the total number of octets as reported by the Baseband, and therefore includes the Tag (MIC), but excludes any RSV octets. 2: If present, RSV octets are placed after the Tag, as they are only received once the complete frame has been received. It is the responsibility of software to determine the address of the RSV in the buffer (RSV Address = Length + 1), and to discard/ignore the Tag octets. RX Buffer CRC Check MHR MAC Payload CRCTagLength Received from the air MIC Compare MHR Data/CMD Payload CRCTagLength MHR Data/CMD Payload CRCTagLength

DS70005023B-page 146 Advanced  2011-2013 Microchip Technology Inc. FIGURE 5-7: CCM*/CTR/ECB ENCRYPTION OPERATION (TX) Exception handling: TXSZIF: Transmit Packet Size Error Interrupt Flag TXST is set when the packet size (including MIC tags and CRC) is found to be zero or to be greater than the maximum size that the buffers can support. FRMIF: Frame Format Error Interrupt Flag Set if the transmitter/receiver fails to parse the frame in the buffer (because it is not as it should be or it is corrupted in demodulation). For example, reserved values are found in the MAC header fields. MHR Data/CMD PayloadLength Encryption TX Buffer MHR Encrypted PayloadLength CRC Generation MHR Encrypted Payload CRCLength Transmitted to the air Updating

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 147 MRF24XA FIGURE 5-8: CCM*/CTR/ECB DECRYPTION OPERATION (TX) (1, 2) Exception Handling: RXTAGIF: Receiver Decryption/Authentication Failure Interrupt Flag Set by the device when decryption/authentication finished with error. Note 1: The Length field above refers to the total number of octets as reported by the Baseband, and therefore includes the Tag (MIC), but excludes any RSV octets. 2: If present, RSV octets are placed after the Tag, as they are only received once the complete frame has been received. It is the responsibility of software to determine the address of the RSV in the buffer (RSV Address = Length + 1), and to discard/ignore the Tag octets. RX Buffer CRC Check MHR Encrypted Payload CRCLength Received from the air Decryption MHR Encrypted Payload CRCLength MHR Data/CMD Payload CRCLength

DS70005023B-page 148 Advanced  2011-2013 Microchip Technology Inc. FIGURE 5-9: CCM* ENCRYPTION AND AUTHENTICATION OPERATION (TX) MHR MAC PayloadLength Authentication TX Buffer MHR MAC Payload TagLength Encryption MHR Encrypted Payload Encrypted TagLength Transmitted to the air CRC Generation MHR Encrypted Payload CRC Encrypted TagLength Updating Updating Exception handling: TXSZIF: Transmit Packet Size Error Interrupt Flag TXST is set when the packet size (including MIC tags an d CRC) is found to be zero or to be greater than the maximum size that the buffers can support. FRMIF: Frame Format Error Interrupt Flag Set if the transmitter/receiver fails to parse the frame in the buffer (because it is not as it should be or it is corrupted in demodulation). For example, reserved values are found in the MAC header fields.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 149 MRF24XA FIGURE 5-10: CCM* DECRYPTION AND DE-AUTHENTICATION OPERATION (RX)(1, 2, 3) Exception Handling: RXTAGIF: Receiver Decryption/Authentication Failure Interrupt Flag Set by the device when decryption/authentication finished with error. Note 1: The Length field above refers to the total number of octets as reported by the Baseband, and therefore includes the Tag (MIC), but excludes any RSV octets. 2: If present, RSV octets are placed after the Tag, as they are only received once the complete frame has been received. It is the responsibility of software to determine the address of the RSV in the buffer (RSV Address = Length + 1), and to discard/ignore the Tag octets. 3: The Message and Tag decryption operations do not depend on each other, and may be computed in any order. All other factors being equal, the Tag decryption operation should be performed first, because it uses the starting counter value. RX Buffer CRC Check Received from the air MIC Compare MHR Data/CMD Payload CRCTagLength MHR Data/CMD Payload CRCTagLength Decryption MHR Encrypted Payload CRCEncrypted TagLength MHR Encrypted Payload CRCEncrypted TagLength

DS70005023B-page 150 Advanced  2011-2013 Microchip Technology Inc.

5.4 Security Material Retrieval with

IEEE 802.15.4 Compliant Frames This section explains how the security material (Section 5.3 “Security Material” ) is retrieved when the MAC frame is formatted to the IEEE 802.15.4 spec- ification (either FRMFMT = 0 or “bridging”) and security is applied either at the MAC-layer or at the NWK-layer, or both. The relevant configuration registers (SECSUITE<3:0>) are indicated in bold in Table 5-10. The relevant secu- rity fields (SecEn, SecLvl<2:0>, FrameVer<1:0>, Fra- meCnt, KeyIDMode, KeySrc, KeyIndex) are represented in bold in Figure 5-11. SecEn = 1 selects MAC-layer security as shown in Table 5-13. The NWK-layer security is handled as dif- ferent MAC-payload both se curity layers are selected then NWK-layer frame is secured first, constituting the MAC payload, the MAC-layer security processed for the MAC frame. MAC-layer security material retrieval differs in the 2006 and the 2003 versions of t he standard. Distinction is possible based on the FrameVer<1:0> field. Security Material retrieval is not supported by the device for beacon frames. Beacon frames are distinguished by the Type<2:0> field. KeyIDMode, KeySrc, KeyIndex in the AuxSecHdr are done by software for the retrieval of the MAC-layer Symmetric Key, the details are out of scope. FrameCnt, SecLvl and the 8-byte Source Address are used to construct the N once when 2006-MAC-Layer security is applied (Figure 5-12). In 2003 MAC Layer the Nonce field is constructed from the Source Address, FrameCnt and the KeySeqCnt as shown in Figure 5-13. When the frame contains a short Source Address, the Nonce will not be set correctly by the device. Similarly, if the frame is of Type = Beacon then the SECPAYINDX will not be set correctly. In these cases these registers need to be configured from software. On the RX side, this can be easily done before launching the security processing (RXDEC = 1). On the TX- side, DTSM must be set to prevent the device from over-writing the Nonce and Indexes configured by software. The indexes are specified for the MAC-layer security only, because Network-layer security must always be configured by software: In MAC-layer security, SECHDRINDX is always the first byte of the MHR. In MAC-layer security applied for frames of type Data and Streaming SECPAYINDX is the first byte of the payload. For Command frames, SECPAYINDX is the second byte of the payload. SECPAYINDX can take different values for beacon frames, and should always be specified by software.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 151 MRF24XA REGISTER 5-3: SECHDRINDX (SEC URITY HEADER INDEX REGISTER) REGISTER 5-4: SECPAYINDX (SECUR ITY PAYLOAD INDEX REGISTER) R-0 R/W/HS-0000000 r SECHDRINDX<6:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HS = Hardware Set bit 7 Reserved: Maintain as ‘0’ bit 6-0 SECHDRINDX<6:0>: Security Header Index bits This field defines the portion of the header over which authenticat ion operations are performed. For MAC layer security, SECHDRINDX<6:0> is defined as the address offset of the MAC Header from the beginning of the frame, as stored in the buffer (that is, 0 = Length field, 1 = FrameCtrl field, and so on), and is loaded automatically for both 802.15.4 and proprietary frames. For Network layer security, SECHDRINDX<6:0> is defined as the address offset of the Network Header from the beginning of the MAC Payload, and must be loaded by the Host Cont roller for 802.15.4 frames only (for proprietary frames, the MAC automatically loads it)(1). Note 1: The setting DTSM in TX mode will disable automatic computation of this field. R-0 R/W/HS-0000000 r SECPAYINDX<6:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HS = Hardware Set bit 7 Reserved: Maintain as ‘0’ bit 6-0 SECPAYINDX<6:0>: Security Payload Index bits This field defines the portion of the payload ov er which Encryption/Decryption operations are per- formed. For MAC layer security, SECPAYINDX<6:0> is defined as the address offset of the MAC Pay- load from the beginning of the frame, as stored in the buffer (that is, 0 = Length field, 1 = FrameCtrl field, and so on), and is loaded automatically for both 80 2.15.4 and proprietary frames. For Network layer security, SECPAYINDX<6:0> is defined as the address offset of the Network Header from the beginning of the MAC Payload, and must be loaded by the Host Controller for 802.15.4 frames only (for proprietary frames, the MAC automatically loads it)(1). Note 1: The setting DTSM in TX mode will disable automatic computation of this field.

DS70005023B-page 152 Advanced  2011-2013 Microchip Technology Inc. REGISTER 5-5: SECENDINDX (SEC URITY END INDEX REGISTER) R-0 R/W/HS-0000000 r SECENDINDX<6:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HS = Hardware Set bit 7 Reserved: Maintain as ‘0’ bit 6-0 SECENDINDX<6:0>: Security End Index bits This field defines the end of the payload over which security operations are performed(1). Note 1: The setting DTSM in TX mode will disable automatic computation of this field.

DS70005023B-page 154 Advanced  2011-2013 Microchip Technology Inc. FIGURE 5-12: 802.15.4 CCM NONCE (MAC LAYER SECURITY ONLY)-2006 FIGURE 5-13: 802.15.4 CCM NONCE (MAC LAYER SECURITY ONLY)-2003 Note: The originator device automatically fills in SrcAddr field by the values of registers ADDR8 through ADDR1 irrespective of the SAMode. The recipient host needs to fill in the nonce if SAMode is different from ‘11’. FrameCtr (4 Octets) {5'b00000, SecLvl} (1 Octet) SrcAddr (8 Octets)

13 Octets

7:0 7:07:0 15:8 23:16 31:24 15:8 23:16 31:24 39:3247:4055:4863:56 Note: The originator device automatically fills in SrcAddr field by the values of registers ADDR8 through ADDR1 irrespective of the SAMode. The recipient host needs to fill in the nonce if SAMode is different from ‘11’. FrameCtr (4 Octets) KeySeqCnt SrcAddr (8 Octets) 7:0 7:0 15:8 23:16 31:24 39:32 47:40 55:48 63:56 15:8 23:16 31:24 7:0 (1 Octet)

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 155 MRF24XA

5.5 Transmit Security Processing of

IEEE 802.15.4 Compliant Frames Setting TXST triggers automatic MAC layer security processing and frame sending as an uninterrupted sequence (see Figure 5-14). Separate security pro- cessing (network layer), triggered by TXENC can be applied, where TXENCIF should be awaited before other operation. The security functions triggered by TXST, BUF1TXPP (used for debug), BUF2TXPP (used for debug), and TXENC are shown in Figure 5-12 and Figure 5-14. The respective interrupts are generated on completion and the aforementioned triggering bits are cleared by the device automatically. In Figure 5-12, observe the con- ditions for security material retrieval by the device and the operation of the DTSM bit. FIGURE 5-14: TRANSMIT SECURITY PROCESSING WHEN FRMFMT = 0 (IEEE 802.15.4™ FORMAT) Before launching the transmit processing (Figure 4-8):

SW always configures SECKEY
SW may configure SECSUITE, SECNONCE, SECHDRINDX, SECPAYINDX, SECENDINDX Enter SecEn DTSM CTR, CBC-MAC, CCM Exit MHR Parsed MAC Security Parse AHR Configure SECSUITE, SECNONCE, SECHDRINDX, SECPAYINDX, SECENDINDX. LENTGH is incremented when a MIC tag is attached. TXSZIF is set when LENGTH>0x7F. no security

0 SAMode

DS70005023B-page 156 Advanced  2011-2013 Microchip Technology Inc. FIGURE 5-15: TRANSMITTER TXENC PROCESSI NG WHEN FRMFMT = 0 (IEEE 802.15.4™ FORMAT) Length is affected. MAC MAC/NWK. Exception Handling: TXSZIF: Transmit Packet Size Error Interrupt Flag TXST is set when the packet size (including MIC tags and CRC) is found to be zero or to be greater than the maximum size that the buffers can support. FRMIF: Frame Format Error Interrupt Flag TXENC 1 Interrupt Service LENTGH is incremented when a MIC tag is attached. New LENGTH must not exceed 0x7F. Otherwise TXSZIF is set. CTR, CBC-MAC and CCM TXSZIF? TXENC 0 TXENCIF 1 TXENC 0 TXENC is only required for NWK-layer security processing. SW configured SECKEY, SECSUITE, SECNONCE, SECHDRINDX, SECPAYINDX and SECENDINDX.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 157 MRF24XA

5.6 Security Processing of Received

IEEE 802.15.4 Compliant Frames Receive security is always performed by setting RXDEC and awaiting RXDECIF or RXTAGIF. It is never triggered automatically. When both MAC and NWK- layer security are applied, then both shall be processed (in this order) by setting RXDEC a second time after the security material has been updated correctly. The security functions triggered by RXDEC are shown in Figure 5-17. The respective interrupts generated on completion and RXDEC is cleared by the device automatically. FIGURE 5-16: SECURITY MATERIAL RETRIEVA L SUPPORT IN RECEIVE PROCESSING WHEN FRMFMT = 0 (IEEE 802.15.4™ FORMAT) Length is affected. MAC MAC/NWK. Exception Handling: FRMIF: Frame Format Error Interrupt Flag The bit is set if the transmitter/receiver fails to parse th e frame in the buffer (because it is not as it should be or it is corrupted in demodulation). For example, reserved values found in the MAC header fields. Enter SecEn Exit MHR Parsed MAC Security Parse AHR Configure SECSUITE, SECNONCE, SECHDRINDX, SECPAYINDX, SECENDINDX. For Beacon frames, the configuration should be overridden by SW. After RXIF is asserted:

SW always configures SECKEY.
SW may need to configure SECSUITE, SECNONCE, SECHDRINDX, SECPAYINDX, SECENDINDX.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 159 MRF24XA

5.7 Security Procedure for IEEE

802.15.4 Compliant Frames

For more information about the frame format, refer to Table 5-12 through Table 5-14 and Figure 5-3. TABLE 5-11: RELEVANT REGISTER BITS FO R SECURITY CONTROL WITH IEEE 802.15.4™ FRAMES Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 MACCON1 TRXMODE<1:0> ADDRSZ<2:0> CRCSZ FRMFMT SECFLAGOVR Legend: r = Reserved, read as ‘0’. TABLE 5-12: DEFINITION OF SECURITY SUPPORT CATEGORIES (IEEE 802.15.4™ FRAMES) Security Support Category SecEn FrameVer <1:0> Type<2:0> (and SAMode) Description 0 0 0x Data/Cmd/Beacon/Ack No security A 1 0x Data/Cmd 2003/2006 MAC-layer security only B 1 0x Beacon 2003/2006 MAC-layer secured beacon C 0 0x Data/(Cmd)/Beacon NWK-layer security only D 1 0x Data/Cmd NWK + 2003/2006 MAC-layer security E 1 0x Beacon NWK + 2003/2006 MAC-layer security for beacon frames

DS70005023B-page 160 Advanced  2011-2013 Microchip Technology Inc. TABLE 5-13: SECURED FRAME TRANSMI SSION (IEEE 802.15.4™ MAC FORMAT) # Processing Step Steps per each Security Case AB CD E

1 Host MCU constructs the

frame and loads the buffer SecEn = 1 FrameVer = 0x (either) SecEn = 1 FrameVe = 0x (either) SecEn = 0 FrameVer = 0x (either) SecEn = 1 FrameVer = 0x (either) SecEn = 1 FrameVer = 0x (either)

2 For NWK-security

processing, Host MCU configures: No NWK-layer security. SECKEY SECSUITE SEC*INDX(1) NONCE SECKEY SECSUITE SEC*INDX NONCE SECKEY SECSUITE SEC*INDX NONCE

3 Host MCU triggers security

sending. TXENC ← 1 TXENC ← 1 TXENC ← 1

4 Security processing is per-

NWK layer if TXENC is set. LENGTH and SECEND- INDX are updated if MIC takg is appended. TXSZIF if size run over 127 bytes NWK-layer Security LENGTH, SECENDINDX NWK-layer Secu- rity LENGTH, SECENDINDX NWK-layer Secu- rity LENGTH, SECENDINDX

5 Host MCU awaits TXENCIF

interrupt, indicating comple- tion. (TXENC cleared by the device.) TXENCIF ← 1 TXENC ← 0 TXENCIF ← 1 TXENC ← 0 TXENCIF ← 1 TXENC ← 0

6 For MAC-security process-

ing, Host MCU configures: SECKEY (+NONCE, if SAMode is not 11) (+SECSUITE, if FRAMEVER=2003) SECKEY SECSUITE SEC*INDX NONCE No MAC security SECKEY (+NONCE, if SAMode is not 11) (+SECSUITE, if FRAMEVER=2003) SECKEY SECSUITE SEC*INDX NONCE

7 Host MCU sets DTSM to

overwriting just configured SECSUITE, SEC*INDX and NONCE registers. DTSM = 0 (=1, if SAMode is not 11) DTSM = 1 DTSM = x DTSM = 0 (=1, if SAMode is not 11) DTSM = 1

8 Host MCU triggers Security

TXST ← 1 TXST ← 1 TXST ← 1 TXST ← 1 TXST ← 1

9 If SecEn = 1 and DTSM =

0, then the device config- ures the SECSUITE, SEC*INDX and NONCE registers. SECSUITE SEC*INDX NONCE — — SECSUITE SEC*INDX NONCE —

10 Security processing is per-

MAC layer: LENGTH is adjusted if MIC tag is appended. TXSZIF if size run over 127 bytes MAC-layer Security LENGTH, if MIC added MAC-layer Security LENGTH, if MIC added — MAC-layer Security LENGTH, if MIC added MAC-layer Security LENGTH, if MIC added

11 LENGTH is adjusted as

CRC is appended (if CRCSZ = 1). TXSZIF if size run over 127 bytes LENGTH, CRC

12 Frame is sent TXIF (if no TXSZIF or FRMIF)

TXST ← 0 Note 1: SEC*INDX denotes SECHDRINDX, SECPAYINDX and SECENDINDX.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 161 MRF24XA TABLE 5-14: SECURED FRAME RECEPT ION (IEEE 802.15.4™ MAC FORMAT) # Processing Step Steps per each security case AB C DE -2 Device has parses the SecEn bit in the FrameCtrl SecEn = 1 SecEn = 1 SecEn = 0 SecEn = 1 SecEn = 1 -1 For MAC-security processing, the device configures (correctly or incorrectly) the following: SECSUITE SEC*INDX NONCE incorrect configuration No MAC-layer security SECSUITE SEC*INDX NONCE incorrect configuration

0 Valid frame received on air and

RXIF = 1, RXBUFFUL = 1, (RXSFDIF = 1)

1 Host MCU has the opportunity to check

the SecEn, FrameVer and SAMode bits in the MAC header FrameVer = 0x (either) FrameVer = 0x (either) FrameVer = 0x (either) FrameVer = 0x (either) FrameVer = 0x (either)

2 For MAC-security processing, the Host

MCU must load the following: SECKEY (+NONCE if SAMode is not 11) SECKEY SECSUITE SEC*INDX NONCE No MAC-layer Security SECKEY (+NONCE if SAMode is not 11) SECKEY SECSUITE SEC*INDX NONCE

3 Host MCU starts MAC-security pro-

cessing by setting RXDEC. RXDEC ← 1 RXDEC ← 1 RXDEC ← 1 RXDEC ← 1

4 Device performs MAC-layer security

processing as illustrated in Figure 5-4 through Figure 5-9 MAC-layer MAC-layer MAC-layer MAC-layer

5 If Authentication fails then RXTAGIF is

generated otherwise the security opera- tion is successful and RXDECIF is generated. RXDECIF (or RXTAGIF) RXDECIF (or RXTAGIF) RXDECIF (or RXTAGIF) RXDECIF (or RXTAGIF)

6 SW examines RXTAGIF, if set, SW

aborts further processing and frees the buffer by clearing RXBUFFUL. RXTAGIF ← 1 RXTAGIF ← 1 RXTAGIF ← 1 RXTAGIF ← 1

7 For NWK-security processing, the Host

MCU must load the following: No NWK-layer security SECKEY SECSUITE SEC*INDX NONCE SECKEY SEC- SUITE SEC*INDX NONCE SECKEY SEC- SUITE SEC*INDX NONCE

8 Host MCU starts NWK-security

processing by setting RXDEC. RXDEC ← 1 RXDEC ← 1 RXDEC ← 1

9 Device performs NWK layer security

processing. (No figure) NWK-layer security NWK-layer security NWK-layer security

10 If Authentication fails then RXTAGIF is

generated otherwise the security opera- tion is successful and RXDECIF is generated. RXDEC is cleared by the device. RXDECIF (or RXTAGIF) RXDEC ← 0 RXDECIF (or RXTAGIF) RXDEC ← 0 RXDECIF (or RXTAGIF) RXDEC ← 0

11 SW examines RXTAGIF, if set, SW

aborts further processing and frees the buffer by clearing RXBUFFUL For the length

12 SW reads the entire frame from the

buffer.

13 SW clears the RXBUFFUL to free the

DS70005023B-page 162 Advanced  2011-2013 Microchip Technology Inc.

5.8 Security Examples

The following section provides examples for the usage of MRF24XA security. 5.8.1 802.15.4-2006 COMPLIANT FRAME ANNEX C.2.2 (TYPE A) Configuration:

Network configuration: Extended address, PAN Compression, and ACKReq
Source address: 0xACDE480000000001, where 01 is at address 0x1F
Destination address: 0xACDE480000000002
PANID 0x4321, where 21 is at address 0x29
Payload: 61 62 63 64
Frame counter: 0x00000005
Security level: 0x04
Packet: Data packet

5.8.1.1 Transmission

For 802.15.4-2006 compliant, follow these transmission flow: 1. Host MCU constructs the frame and loads the buffer: 1E || 69 DC 84 21 43 02 00 00 00 00 48 DE AC 01 00 00 00 00 48 DE AC || 04 05 00 00 00 || 61 62 63 64 2. — 3. — 4. — 5. — 6. Host MCU configures SECKEY 0xC0C1C2C3C4C5C6C7C8C9CACBCCCDCECF, where LSB (0xCF) is at address 0x40 7. Host MCU clears DTSM 8. Host MCU issues TXST 9. MRF24XA configures: - SECSUITE to 0x04 - SECNONCE to 0xACDE4800000000010000000504, where MSB (0xAC) is at address 0x5C - SECHDRINDX to 0x01 - SECPAYINDX to 0x1B - SECENDINDX to 0x1E 10. MRF24XA performs CCM* encryption, where 61 62 63 64 is encrypted to D4 3E 02 2B 11. MRF24XA appends CRC: 0x18E0 12. MRF24XA transmits the packet to the medium. MRF24XA is waiting for an ACKnowledge frame. Different IF can be received based on the register settings (for example, TX with CSMA). TX Buffer (0x200) content: 20 || 69 DC 84 21 43 02 00 00 00 00 48 DE AC 01 00 00 00 00 48 DE AC || 04 05 00 00 00 || D4 3E 02 2B || E0 18

5.8.1.2 Reception

MRF24XA receives the following packet through the antenna: 20 || 69 DC 84 21 43 02 00 00 00 00 48 DE AC 01 00 00 00 00 48 DE AC || 04 05 00 00 00 || D4 3E 02 2B || E0 18 2. MRF24XA configures: - SECSUITE to 0x04 - SECNONCE to 0xACDE4800000000010000000504, where MSB (0xAC) is at address 0x5C - SECHDRINDX to 0x01 - SECPAYINDX to 0x1B - SECENDINDX to 0x1E 3. MRF24XA asserts RXIF (RXSFDIF): - Packet accepted by RX filter - ACK frame: 05 || 02 10 84 || 05 E2 sent to medium (asserts TXSFD, TXMAIF) 4. — 5. Host MCU downloads SECKEY 0xC0C1C2C3C4C5C6C7C8C9CACBCCCDCECF , where LSB (0xCF) is at address 0x40 6. Host MCU issues RXDEC 7. MRF24XA performs CCM* decryption, D4 3E 02 2B is decrypted to 61 62 63 64 8. MRF24XA asserts RXDECIF (and IDLEIF) 9. — 10. — 11. — 12. — 13. — 14. — 15. SW read the entire fram e from the Rx Buffer (0x300): 20 || 69 DC 84 21 43 02 00 00 00 00 48 DE AC 01 00 00 00 00 48 DE AC || 04 05 00 00 00 || 61 62 63 64 || E0 18 || RSVs

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 163 MRF24XA 5.8.2 802.15.4-2006 COMPLIANT FRAME ANNEX C.2.3 (TYPE A)

Network configuration: Extended address, ACKReq
Source address: 0xACDE480000000001, where 01 is at address 0x1F
Source PANID: 0X4321, where 21 is at address 0x29
Destination address: 0xACDE480000000002
Destination PANID: 0xFFFF
Payload: 01 CE
Frame counter: 0x00000005
Security level: 0x06
Packet: Command packet

5.8.2.1 Transmission

Host MCU constructs the frame and loads the buffer: 1E || 2B DC 84 21 43 02 00 00 00 00 48 DE AC FF FF 01 00 00 00 00 48 DE AC || 06 05 00 00 00 || 01 CE 2. — 3. — 4. — 5. — 6. Host MCU configures SECKEY 0xC0C1C2C3C4C5C6C7C8C9CACBCCCDCECF, where LSB (0xCF) is at address 0x40 7. Host MCU clears DTSM register 8. Host MCU issues TXST 9. MRF24XA configures: - SECSUITE to 0x06 - SECNONCE to 0xACDE4800000000010000000504, where MSB (0xAC) is at address 0x5C - SECHDRINDX to 0x01 - SECPAYINDX to 0x1E (remember when Type = CMD, first octet of payload is not encrypted) - SECENDINDX to 0x1E 10. MRF24XA performs CCM* authentication with encryption, where 01 CE is encrypted to 01 D8, and the following MIC tag is attached: 4F DE 52 90 61 F9 C6 F1 11. MRF24XA appends CRC: 0x4FE4 12. MRF24XA transmits the packet to the medium. MRF24XA is waiting for an ACK frame. Different IF can be received based on the register settings (for example, TX with CSMA). TX Buffer (0x200) content: 28 || 2B DC 84 21 43 02 00 00 00 00 48 DE AC FF FF 01 00 00 00 00 48 DE AC || 06 05 00 00 00 || 01 D8 || 4F DE 52 90 61 F9 C6 F1 || E4 4F

5.8.2.2 Reception

MRF24XA receives the following packet through the antenna: 28 || 2B DC 84 21 43 02 00 00 00 00 48 DE AC FF FF 01 00 00 00 00 48 DE AC || 06 05 00 00 00 || 01 D8 || 4F DE 52 90 61 F9 C6 F1 || E4 4F 2. MRF24XA configures: - SECSUITE to 0x06 - SECNONCE to 0xACDE4800000000010000000504, where MSB (0xAC) is at address 0x5C - SECHDRINDX to 0x01 - SECPAYINDX to 0x1E - SECENDINDX to 0x26 3. MRF24XA asserts RXIF (RXSFDIF): - Packet accepted by RX filter - ACK frame: 05 || 02 10 84 || 05 E2 sent to medium (asserts TXSFD, TXMAIF) 4. — 5. Host MCU downloads SECKEY 0xC0C1C2C3C4C5C6C7C8C9CACBCCCDCECF, where LSB (0xCF) is at address 0x40 6. Host MCU issues RXDEC 7. MRF24XA performs CCM* de-authentication and decryption, where the MIC tag is compared against the received one, and 01 D8 is decrypted to 01 CE 8. MRF24XA asserts RXDECIF (and IDLEIF) 9. — 10. — 11. — 12. — 13. — 14. — 15. SW can read the entire frame from Rx Buffer (0x300): 28 || 2B DC 84 21 43 02 00 00 00 00 48 DE AC FF FF 01 00 00 00 00 48 DE AC || 06 05 00 00 00 || 01 CE || 4F DE 52 90 61 F9 C6 F1 || E4 4F || RSVs

DS70005023B-page 164 Advanced  2011-2013 Microchip Technology Inc.

5.8.3 NWK-LAYER SECURITY (TYPE C)

Network configurati on: Extended address
Source address: N/A
Source PANID: N/A
Destination address: 0x9897969594939291
Destination PANID: 0xD2D1
Network header: 41 41
Network payload: 14 14
Network security level: 0x06
Packet: Data packet

5.8.3.1 Transmission

Host MCU constructs the frame and loads the buffer: 11 || 01 0C 14 D1 D2 91 92 93 94 95 96 97 98 || 41 41 14 14 2. Host MCU configures security materials: - SECSUITE register to 0x06 - SECNONCE register to 0xFDFCFBFAF9F8F7F6F5F4F3F2F1, where MSB (0xFD) is at address 0x5C - SECKEY register to 0x0F0E0D0C0B0A0908070605040302010, where LSB (0x00) is at address 0x40 - SECHDRINDX register to 0x0E - SECPAYINDX register to 0x10 - SECENDINDX register to 0x11 3. Host MCU issues TXENC 4. MRF24XA performs CCM* authentication with encryption, where 14 14 is encrypted to 14 DA, and the following MIC tag is attached: 53 99 39 A1 55 C5 D3 F6 5. MRF24XA asserts TXENCIF (and IDLEIF) 6. — 7. — 8. Host MCU issues TXST 9. — 10. — 11. MRF24XA appends CRC: 0x9BC9 12. MRF24XA transmits the packet to the medium. Different IF can be received based on the register settings (for example, TX with CSMA). TX Buffer (0x200) content: 1B || 01 0C 14 D1 D2 91 92 93 94 95 96 97 98 || 41 41 14 DA 53 99 39 A1 55 C5 D3 F6 || C9 9B

5.8.3.2 Reception

MRF24XA receives the following packet through the antenna: 1B || 01 0C 14 D1 D2 91 92 93 94 95 96 97 98 || 41 41 14 DA 53 99 39 A1 55 C5 D3 F6 || C9 9B 2. — 3. MRF24XA asserts RXIF (RXSFDIF): Packet accepted by RX filter 4. — 5. — 6. — 7. — 8. — 9. — 10. Host MCU configures security materials: - SECSUITE to 0x06 - SECNONCE to 0xFDFCFBFAF9F8F7F6F5F4F3F2F1, where MSB (0xFD) is at address 0x5C - SECKEY to 0x0F0E0D0C0B0A0908070605040302010, where 00 is at address 0x40 - SECHDRINDX to 0x0E - SECPAYINDX to 0x10 11. Host MCU issues RXDEC 12. MRF24XA performs CCM* de-authentication and decryption, where the MIC tag is compared against the received one and 14 DA is decrypted to 14 14 13. MRF24XA asserts RXDECIF (and IDLEIF) 14. — 15. SW can read the entire frame from Rx Buffer (0x300): 1B || 01 0C 14 D1 D2 91 92 93 94 95 96 97 98 || 41 41 14 14 53 99 39 A1 55 C5 D3 F6 || C9 9B || RSVS

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 165 MRF24XA 5.8.4 802.15.4-2006 COMPLIANT FRAME WITH NWK-LAYER SECURITY (TYPE D)

Network configurati on: Extended address
Source address: 0x0807060504030201, where LSB (0x01) is at address 0x1F
Source PANID: 0xC2C1, where LSB (0xC1) is at address 0x29
Destination address: 0x9897969594939291
Destination PANID: 0xD2D1
Network header: 41 41
Network payload: 14 14
Network security level: 0x06
Frame counter: 0x55555555
Security level: 0x07
Packet: Command packet

5.8.4.1 Transmission

Host MCU constructs the frame and loads the buffer: 20 || 09 DC 14 D1 D2 91 92 93 94 95 96 97 98 C1 C2 01 02 03 04 05 06 07 08 || 07 55 55 55 55 || 41 41 14 14 2. Host MCU configures security materials for NWK: - SECSUITE register to 0x06 - SECNONCE register to 0xFDFCFBFAF9F8F7F6F5F4F3F2F1, where MSB (0xFD) is at address 0x5C - SECKEY register to 0x0F0E0D0C0B0A0908070605040302010, where LSB (0x00) is at address 0x40 - SECHDRINDX register to 0x1D - SECPAYINDX register to 0x1F - SECENDINDX register to 0x20 3. Host MCU issues TXENC 4. MRF24XA performs CCM* authentication with encryption, where 41 41 14 14 is encrypted to 41 41 14 DA, and the following MIC tag is attached: 53 99 39 A1 55 C5 D3 F6 MIC-TAG 5. MRF24XA asserts TXENCIF (and IDLEIF) 6. Host MCU downloads SECKEY 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 7. Host MCU clears DTSM register 8. Host MCU issues TXST 9. MRF24XA configures: - SECSUITE to 0x07 - SECNONCE to 0x08070605040302015555555507, where MSB (0x08) is at address 0x5C - SECHDRINDX to 0x01 - SECPAYINDX to 0x1D - SECENDINDX to 0x38 10. MRF24XA performs CCM* authentication with encryption, where 41 41 14 DA 53 99 39 A1 55 C5 D3 F6 is encrypted to C9 87 C6 D8 7F E4 BD A2 A4 00 89 9F, and the following MIC tag is attached: B4 E6 9C B1 54 7F 9B B3 4089 77 FB 93 34 E2 11. MRF24XA appends CRC: 0x1AA8 12. MRF24XA transmits the packet to the medium. Different IF can be received based on the register settings (for example, TX with CSMA). TX Buffer (0x200) content: 3A || 09 DC 14 D1 D2 91 92 93 94 95 96 97 98 C1 C2 01 02 03 04 05 06 07 08 || 07 55 55 55 55 || C9 87 C6 D8 7F E4 BD A2 A4 00 89 9F B4 E6 9C B1 54 7F 9B B3 40 89 77 FB 93 34 E2 D6 || A8 1A

5.8.4.2 Reception

MRF24XA receives the following packet through the antenna: 3A || 09 DC 14 D1 D2 91 92 93 94 95 96 97 98 C1 C2 01 02 03 04 05 06 07 08 || 07 55 55 55 55 || C9 87 C6 D8 7F E4 BD A2 A4 00 89 9F B4 E6 9C B1 54 7F 9B B3 40 89 77 FB 93 34 E2 D6 || A8 1A 2. MRF24XA configures: - SECSUITE to 0x07 - SECNONCE to 0x08070605040302015555555507, where MSB (0x08) is at address 0x5C - SECHDRINDX to 0x01 - SECPAYINDX to 0x1D - SECENDINDX to 0x38 3. MRF24XA asserts RXIF (RXSFDIF): Packet accepted by RX filter 4. — 5. Host MCU configures SECKEY 0xC0C1C2C3C4C5C6C7C8C9CACBCCCDCECF, where LSB (0xCF) is at address 0x40 6. Host MCU issues RXDEC 7. MRF24XA performs CCM* de-authentication and decryption, where the MIC tag is compared against the received one, and C9 87 C6 D8 7F E4 BD A2 A4 00 89 9F is decrypted to 41 41 14 DA 53 99 39 A1 55 C5 D3 F6

DS70005023B-page 166 Advanced  2011-2013 Microchip Technology Inc. 8. MRF24XA asserts RXDECIF (and IDLEIF) 9. — 10. Host MCU configures security materials: - SECSUITE to 0x06 - SECNONCE to 0xFDFCFBFAF9F8F7F6F5F4F3F2F1, where MSB (0xFD) is at address 0x5C - SECKEY to 0x0F0E0D0C0B0A0908070605040302010, where LSB (0x00) is at address 0x40 - SECHDRINDX to 0x1D - SECPAYINDX to 0x1F 11. Host MCU issues RXDEC 12. MRF24XA performs CCM* de-authentication and decryption, where the MIC tag is compared against the received one, and 14 DA is decrypted to 14 14. 13. MRF24XA asserts RXDECIF (and IDLEIF) 14. — 15. SW can read the entire frame from the RxBuffer (0x300): 3A || 09 DC 14 D1 D2 91 92 93 94 95 96 97 98 C1 C2 01 02 03 04 05 06 07 08 || 07 55 55 55 55 || 41 41 14 14 53 99 39 A1 55 C5 D3 F6 B4 E6 9C B1 54 7F 9B B3 40 89 77 FB 93 34 E2 D6 || A8 1A || RSVs 5.8.5 802.15.4-2003 COMPLIANT FRAME (TYPE A)

Network configuration: Extended address, PAN compression
Source address: 0x0807060504030201, where 01 is at address 0x1F
Destination address: 0xAAAAAAAAAAAAAAAA
PANID: 0x3412 where 12 is at address 0x29
Payload: FF
Frame counter: 0x0403020100
Key sequence counter: 0x12
Security level: CCM-32 (SecLevel: 0x05)
Packet: Data packet

5.8.5.1 Transmission

Host MCU constructs the frame and loads the buffer: 1B || 49 CC 01 12 34 AA AA AA AA AA AA AA AA 01 02 03 04 05 06 07 08 || 01 02 03 04 05 || FF 2. — 3. — 4. — 5. — 6. Host MCU configures SECKEY: 0x000102030405060708090A0B0C0D0E0F, where LSB (0x0F) is at address 0x40 7. Host MCU clears DTSM 8. Host MCU issues TXST 9. MRF24XA configures: - SECNONCE to 0x01020304050607080102030405, where MSB (0x01) is at address 0x5C - SECHDRINDX to 0x01 - SECPAYINDX to 0x1B - SECENDINDX to 0x1B 10. MRF24XA performs CCM* authentication with encryption, where FF is encrypted to AC, and the following MIC tag is attached: FC 30 DB BD 11. MRF24XA appends CRC: 0xEB32 12. MRF24XA transmits the packet to the medium Different IF can be received based on the register settings (for example, TX with CSMA) TX Buffer (0x200) content: 21 || 49 CC 01 12 34 AA AA AA AA AA AA AA AA 01 02 03 04 05 06 07 08 01 02 03 04 05 || AC FC 30 DB BD || 32 EB

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 167 MRF24XA

6.0 PROPRIETARY FRAME

6.1 Proprietary MAC Frame

The proprietary MAC header structure is shown in Figure 6-1. The specific format of Acknowledge frame is shown in Figure 6-2. The frame buffer is written with the LENGTH field byte first, followed by the FrameCtrl field. An optional Acknowledge info field can be sent before the SEQUENCE. FIGURE 6-1: PROPRIETARY MAC HEADER STRUCTURE

6.2 Frame Types

(1 bit) AckReq (1 bit) Repeat (1 bit) SecEn (1 bit) Broadcast (1 bit) SAddrPrsnt (1 bit) 1 byte of FrameCtrl (Proprietary) Type (2 bits) 7 6 54 3 2 1:0 AckInfo (0-1 octets) Sequence DestAddr (0-8 octets) SrcAddr (0-8 octets) AuxSecHdr (0-3 octets) FrameCtrl (1 octets) Destination Source MHR: MAC Header (Proprietary) DAddrPrsnt TABLE 6-1: FRAME TYPES (BOTH PROTOCOLS) Frame Type IEEE Mi-Wi Description Data 001 01 Filtered by DATAREJ Command 011 11 Filtered by CMDREJ First byte of payload (Command) is never encrypted. Ack 010 10 Acknowledge Frame Must be generated by the receiver (from SW or HW) if and only if Ack- Req = 1 in the last received frame, using the same sequence number. Acknowledge Frame can be generated by hardware (AUTOACKEN = 1). If this is the case it is not loaded to the TX frame buffer. AUTOACKEN = 1 requires CRCSZ = 1 on both the transmitter and the receiver side. Beacon 000 (limited HW support) N/A Filtered by BCREJ Otherwise, this device does not provide support for parsing on beacon frames. Security processing requires adjusting the payload index (SECPAYINDX). Beacon frames are used with broadcast addressing only.

DS70005023B-page 168 Advanced  2011-2013 Microchip Technology Inc. FIGURE 6-2: PROPRIETARY MAC HEADER STRUCTURE: ACKNOWLEDGE FRAME

6.3 Addressing in Proprietary

The following fields are handled by the example:

Header
Sequence number
Address
Data/Command
CRC
Inferred Destination Addressing: The Destination Address participates in the CRC computation as part of the frame, but it is omitted from the frame that is sent on air. Streaming N/A 00 TRXMODE= 01 by transmitter TRXMODE= 10 by receiver The two buffers are handled in ping-pong, to service a single direction. Security parsing makes no distinction between Streaming frames and Data frames. Streaming frames are never acknowledged. TABLE 6-1: FRAME TYPES (BOTH PROTOCOLS) (CONTINUED) Frame Type IEEE Mi-Wi Description DAddrPrsnt (1 bit) AckReq (1 bit) Repeat (1 bit) SecEn (1 bit) Broadcast (1 bit) SAddrPrsnt (1 bit) Type (2 bits) 7 6 54 3 2 1:0 FrameCtrl (1 octet) Sequence (1 octet) FCS (2 octets) Length (1 octet) MHR 1 byte of FrameCtrl (Proprietary) = 0x06 0 0 0 0 0 1 10 Acknowledge Frame (Proprietary)

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 169 MRF24XA Legend: r = Reserved, read as ‘0’. TABLE 6-2: RELEVANT REGISTERS FOR PROPRIETARY MODE ADDRESSING ADDR. REGISTER Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0x10 MACCON1 TRXMODE<1:0> ADDRSZ <2:0> CRCSZ FRMFMT SECFLAGOVR 0x1F ADDR1 ADDR<7:0> 0x20 ADDR2 ADDR<15:8> 0x21 ADDR3 ADDR<23:16> 0x22 ADDR4 ADDR<31:24> 0x23 ADDR5 ADDR<39:32> 0x24 ADDR6 ADDR<47:40> 0x25 ADDR7 ADDR<55:48> 0x26 ADDR8 ADDR<63:56> TABLE 6-3: EXAMPLE CONFIGURATION TX and RX Common ADDRSZ<2:0>= 101 => (m eans that ADDR<63:40> will not be used) TX (Source) Configuration ADDR<63:0>= 0xxxxx060504030201 (4 MSBs not used) SHADDR<15:0> = xx xx (not used) PANID <15:0> = xx xx (not used) RX (Destination) Configuration ADDR<63:0>= 0xxxxx969594939291 (4 MSBs not used) SHADDR<15:0> = xx xx (not used) PANID <15:0> = xx xx (not used) FrameCtrl Type<1:0> | Broadcast| 0 | 0 | 0 | DAPrsnt | SAPrsnt Type is not Acknowledge (not = 00) Frame Length | FrameCtrl | Sequence+ + | DEST | SRC | Payload | (CRC) TABLE 6-4: LEGAL DESTINATION ADDRESSING OPTIONS USING THE EXAMPLE Options: Broadcast Unicast ADDRSZ<2:0> Inferred Example DEST. — 0x969594939291 — Type xx xx xx Broadcast 1 0 0 DAPrsn x 1 0 ADDRSZ<2:0> xxx 3'b101 xxx CRCSZ x xx 1 TABLE 6-5: LEGAL SOURCE ADDRESSING OPTIONS USING THE EXAMPLE Options: Unicast ADDRSZ<2:0> Inferred Example SRC. 0x060504030201 — Type xx xx SAPrsnt 0 0 ADDRSZ<2:0> 3'b101 xxx

DS70005023B-page 170 Advanced  2011-2013 Microchip Technology Inc. REGISTER 6-1: RXFILTER (RX FILTER REGISTER) R/W-0 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 R/W-1 PANCRDN CRCREJ CMDREJ DATAREJ UNIREJ NOTMEREJ BCREJ NSTDREJ bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-6 Out of Scope bit 5 CMDREJ: Command Frame Reject Enable bit Setting this bit allows the user to reject all packets with FrameCtrl<Type> equal to Command. 1 = Reject all Command packets 0 = Disable Command Frame Rejection bit 4 DATAREJ: Data Frame Reject Enable bit Setting this bit allows the user to reject all packets with FrameCtrl<Type> equal to Data. 1 = Reject all Data packets 0 = Disable Data Frame Rejection bit 3-0 Out of Scope

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 171 MRF24XA

6.3.1 INFERRED DESTINATION

Inferred destination addressing is indicated in the proprietary frame format by the combination of DAddrPresent = 0 and Broadcast = 0 flags in the frame header (FrameControl Field) and CRCSZ = 1 in the MACCON1 register. The transmitter calculates the CRC over the complete frame (Figure 6-3) but drops the Destination Address (DAddr) from the transmitted one ( Figure 6-4). The receiver checks the CRC with its own address inserted. In the case of a match the frame is accepted, otherwise it is silently discarded. This way CRC filtering takes over the role of Address-Match filtering. Because the framing overhead becomes shorter, the duty-cycle of the radio gets decreased or the through- put gets increased. Therefore the energy consumed by sending a single byte can outweigh the energy budget of hundreds of MCU byte-o perations, the impact on battery life is straightforward. Note, that in case of Inferred DA, the ACKINFO field is mandatory when AckReq = 1. Otherwise, the ACKINFO field is mandatory only if ADPTDREN = 1 or ADPTCHEN = 1. FIGURE 6-3: INFERRED DESTINATION ADDRESS MODE FrameCtrl SeqNo DAddr SAddr Payload CRC Transmitter constructs the frame FrameCtrl SeqNo SAddr Payload CRC Frame sent on air without the DAddr field FrameCtrl SeqNo NAddr SAddr Payload CRC Receiver checks the CRC using its own node address DAddr present = False Note 1: The indicated frame format is somewhat arbitr ary. SeqNo and SAddr refer to sequence number and source address respectively. (1)

DS70005023B-page 172 Advanced  2011-2013 Microchip Technology Inc.

6.4 Security Material Retrieval

Support with Proprietary Frames FIGURE 6-4: PROPRIETARY MAC AUXSECHDR OCTETS (ONLY PRESENT WHEN SECEN = 1) As the MacPayIndex and NetPayIndex fields can point anywhere in the frame (within the range of pointer rep- resentation), it is the arbitrary choice of the application weather the Nonce and the Security Suite is included in the frame or not. SecLayer (2 bits) MacPayIndex (6 bits) 1-byte SecLayer (2 bits) NetHdrIndex (7 bits) 2 bytes NetPayIndex (7 bits) SecLayer (2 bits) MacPayIndex (6 bits) 3 bytes NetHdrIndex (7 bits)0NetPayIndex (7 bits)0 SecLayer = 10 (MAC and NWK-layer security) SecLayer = 01 (NWK-layer security only) SecLayer = 00 (MAC-layer security only) 7:2 1:0 1:0 1:08:215:9 7:214:822:1623 15 Note: Always encode Security Indices with DA present (Inferred DA mode).

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 173 MRF24XA

6.5 Security Processing of

Transmitted Proprietary Frames Setting TXST triggers automatic security processing and frame sending as an uninterrupted sequence (Figure 6-5). Separate security processing, triggered by TXENC, is only required when both NWK-layer and MAC-layer security are applied ( Figure 6-6). In this case, TXENC is set to perform NWK-layer security and TXENCIF shall be awaited, then MAC security is con- figured and TXST is set to launch the MAC-security processing and the sending. The security functions triggered by TXST, BUF1TXPP (used for debug), BUF2TXPP (used for debug), and TXENC are shown in Figure 6-5 and Figure 6-6. The respective interrupts generated on completion and that the aforementioned triggering bits are cleared by the device automatically. Figure 6-5 illustrates the conditions for security material retrieval by the device. FIGURE 6-5: TRANSMIT SECURITY PROCESSING WHEN FRMFMT = 1 (PROPRIETARY– FORMAT) Enter SecEn AHR parsed DTSM SecLayer = 00 OR SecLayer = 10 SECHDRINDX 1 SECPAYINDX MACPayIndex CTR, CBC-MAC, CCM* Exit NWK security to do only SECHDRINDX NetHdrIndex SECPAYINDX NetPayIndex SecLayer = 11 is undefined No Yes YesMAC security left to do MHR parsed already No Before launching the transmit processing - SW always configures SECKEY, SECSUITE, SECNONCE. - SW never needs to configure SECHDRINDX, SECPAYINDX, SECENDINDX, except if DTSM = 1. No security SecLayer = 01 (Figure 4-8)

DS70005023B-page 174 Advanced  2011-2013 Microchip Technology Inc. FIGURE 6-6: TRANSMITTER TXENC PROCESSING WHEN FRMFMT = 1 (PROPRIETARY – FORMAT) TXENC 1 SecLayer = 10 DTSM SECHDRINDX NetHdrIndex SECPAYINDX NetPayIndex CTR, CBC-MAC, CCM* TXENC 0 Interrupt Service Unintended use: SECHDRINDX, SECPAYINDX and SECENDINDX configured for MAC-layer SW configured SECKEY, SECSUITE and SECNONCE. TXENC is only required for NWK-layer security processing in the case when SecLayer = 10 (implying that MAC-layer security will be applied on setting TXST). NWK+MAC layer Do NWK-layer No Yes

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 175 MRF24XA

6.6 Security Processing of Received

Receive security is always performed by setting RXDEC and awaiting RXDECIF or RXTAGIF. It is never triggered automatically. When both MAC- and NWK- layer security are applied, then both shall be processed (in this order) by setting RXDEC a second time after the security material has been updated correctly. The security functions triggered by RXDEC are shown in Figure 6-7. Observe the respective interrupts generated on completion and that RXDEC is cleared by the device automatically. FIGURE 6-7: RECEIVER RXDEC PROCESSING WHEN FRMFMT = 1 (PROPRIETARY) RXDEC 1 SECHDRINDX NetHdrIndex SECPAYINDX NetPayIndex RXDEC 0 RXDECIF 1 Interrupt Service The valid frame is available in BUF2 in mission mode, or in the buffer selected by BUF1RXPP or BUF2RXPP during debug. Device and SW have both parsed the frame. Refer to for security material retrieval support. SW has configured SECKEY SECSUITE, SECNONCE as required for the frame, and could also overwrite the configurations in SECHDRINDX, SECPAYINDX CTR, CBC-MAC, CCM* MIC tag match? SecLayer =10? RXDEC 0 RXTAGIF 1 Authentication failedSuccess Upon successful MAC-layer processing, if Network-layer is also secured, the indexes are retrieved. SW still needs to update SECKEY, SECNONCE, SECSUITE Yes No No Match Yes Figure 6-4 SECENDNDX MIC-tag length

DS70005023B-page 176 Advanced  2011-2013 Microchip Technology Inc.

6.7 Security Procedure for Proprietary

Provided that SecEn is set (1) in the MHR, three levels of security processing are possible, based on the SecLayer<1:0> bits carried in the AuxSecHdr<1:0> field of a given frame: 00-MAC only, 01-NWK only, 10-MAC and NWK. TABLE 6-6: SECURED FRAME TRANSMI SSION (PROPRIETARY MAC FORMAT) # Processing Step Steps per each Security Case MAC-only NWK-only MAC+NWK layer

1 Host MCU constructs the frame and loads the buffer SecEn = 1 SecEn = 1 SecEn = 1

2 For NWK-security processing, Host MCU configures: No NWK-layer

3 Host MCU triggers security processing without sending No TXENC. Host: TXENC ← 1

4 Security processing is performed by the device for NWK

layer if TXENC is set. SECPAYINDX, SECHDRINDX are filled in from NetHdrIn- dex, NetPayIndex, respectively. SECENDINDX initially points at the last payload byte. LENGTH and SECENDINDX are updated if MIC tag is appended. TXSZIF if size have run over 127 bytes. NWK-layer Secu- rity SECPAYINDX SECHDRINDX LENGTH, SECENDINDX

5 Host MCU awaits TXENCIF interrupt, indicating

completion. (TXENC cleared by the device.) TXENCIF ←1 TXENC ← 0

6 For MAC-security processing, Host MCU configures: SECKEY

No MAC security. SECKEY SECSUITE NONCE

7 Host MCU triggers Security processing and Sending Host: TXST ←1 Host: TXST ←1 Host: TXST ←1

8I f S e c E n = 1 and DTSM = 0 then the device config- ures the SEC*INDX registers using MacPayIndex, MacHdrIndex and the LENGTH field. SECHDRINDX SECPAYINDX SECENDINDX — SECHDRINDX SECPAYINDX SECENDINDX

9 Security processing is performed by the device for the indi-

cated layer: LENGTH is adjusted if MAC or NWK-layer MIC tag is appended. TXSZIF if size run over 127 bytes. MAC-layer Security LENGTH if MIC added NWK-layer Security LENGTH if MIC added MAC-layer Security LENGTH if MIC added 10 LENGTH is adjusted as CRC is appended (if CRCSZ = 1). TXSZIF if size run over 127 bytes. LENGTH, CRC 11 Frame is sent. TXIF (if no TXSZIF or FRMIF) TXST ← 0

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 177 MRF24XA TABLE 6-7: SECURED FRAME RECEPT ION (PROPRIETARY MAC FORMAT) # Processing Step Steps per each Security Case MAC-only NWK-only MAC+NWK layer -2 Device parses the SecEn bit in the FrameCtrl SecEn = 1 SecEn = 1 SecEn = 1 -1 For MAC-security processing, the device config- ures the SECHDRINDX, SECPAYINDX based on the Auxiliary Security Header, as well as the SECENDINDX based on the LENGTH field. SEC*INDX from MacHdrIndex, MacPayIndex and the LENGTH SEC*INDX from NetHdrIndex, Net- PayIndex and the LENGTH SEC*INDX from MacHdrIndex, MacPayIndex and the LENGTH

0 Valid frame received and accepted by RXFILTER RXIF = 1, RXBUFFUL = 1, (RXSFDIF = 1)

1 Host MCU reads the frame header to check

SecEn, SecLayer, Source Address, and so on. Read frame header from buffer.

2 For MAC-security processing, the Host MCU must

load the following: SECKEY NONCE SECSUITE No MAC-layer security SECKEY NONCE SECSUITE

3 Host MCU starts MAC-security processing by set-

ting RXDEC. Host: RXDEC ←1 Host: RXDEC ←1 4 Device performs MAC-layer security. MAC-layer security MAC-layer security

5 If SecLayer = 10 then SEC*INDX are filled in

preparation for network-layer security processing following in the sequel. — SEC*INDX from NetHdrIndex, Net- PayIndex and the MAC-layer MIC- position (if present)

6 If Authentication fails then RXTAGIF is generated

otherwise the security operation is successful and RXDECIF is generated. RXDEC is cleared by the device RXDECIF (or RXTAGIF) RXDEC ← 0 RXDECIF (or RXTAGIF) RXDEC ← 0 7 SW examines RXTAGIF. If set, SW aborts further processing and frees the buffer by clearing RXBUFFUL. RXTAGIF ←1 RXTAGIF ←1

8 For NWK-security processing, the Host MCU must

load the following: No NWK-layer security SECKEY SECSUITE NONCE SECKEY SECSUITE NONCE

9 Host MCU starts NWK-security processing by set-

Host: RXDEC ←1 Host: RXDEC ←1 10 Device performs NWK layer security processing. (No figure) NWK-layer security NWK-layer security

11 If Authentication fails then RXTAGIF is generated

otherwise the security operation is successful and RXDECIF is generated. RXDEC is cleared by the device RXDECIF (or RXTAGIF) RXDEC ← 0 RXDECIF (or RXTAGIF) RXDEC ← 0 12 SW examines RXTAGIF. If set, SW aborts further processing and frees the buffer by clearing RXBUFFUL RXTAGIF ←1 RXTAGIF ←1 13 SW reads the payload from the buffer. ——

14 SW clears the RXBUFFUL to free the buffer RXBUFFUL ← 0

DS70005023B-page 178 Advanced  2011-2013 Microchip Technology Inc.

6.8 Security Examples

This section provides examples for Proprietary mode framing.

6.8.1 MAC-LAYER SECURITY EXAMPLE 1

Network configuration: Address size is 8 bytes
Source address: 0x0807060504030201, where LSB (0x01) is at address 0x1F
Destination address: 0x9897969594939291
Payload: BA BA
MAC security level: 0x04
MAC security indices: Encode only from the sec- ond payload
Packet: Data packet

6.8.1.1 Transmission

Host MCU constructs the frame and loads the buffer: 15 || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 54 || BA BA 2. — 3. — 4. — 5. — 6. Host MCU configures: - SECSUITE to 0x04 - SECKEY to 0x0F0E0D0C0B0A0908070605040302010, where LSB (0x00) is at address 0x40 - SECNONCE to 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c 7. Host MCU sets the TXST register 8. MRF24XA configures: - SECHDRINDX to 0x01 - SECPAYINDX to 0x15 - SECENDINDX to 0x15 9. MRF24XA performs CCM* encryption, where BA BA is encrypted to BA F7 10. MRF24XA appends CRC: 0x9D0A 11. MRF24XA transmits the packet to the medium. Different IF can be received based on the register settings (for example, TX with CSMA). TX Buffer (0x200) content: 17 || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 54 || BA F7 || 0A 9D

6.8.1.2 Reception

MRF24XA receives the following packet through the antenna: 17 || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 54 || BA F7 || 0A 9D 2. MRF24XA configures: - SECHDRINDX to 0x01 - SECPAYINDX to 0x15 - SECENDINDX to 0x15 3. MRF24XA asserts RXIF (RXSFDIF): Packet accepted by RX filter 4. — 5. Host MCU configures: - SECSUITE to 0x04 - SECKEY to 0x0F0E0D0C0B0A0908070605040302010, where LSB (0x00) is at address 0x40 - SECNONCE to 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c 6. Host MCU issues RXDEC 7. MRF24XA performs CCM* decryption, where BA F7 is decrypted to BA BA 8. MRF24XA asserts RXDECIF (and IDLEIF) 9. — 10. — 11. — 12. — 13. — 14. — 15. — 16. SW read the entire frame from RX Buffer (0x300): 17 || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 54 || BA BA || 0A 9D || RSVs

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 179 MRF24XA

6.8.2 MAC-LAYER SECURITY EXAMPLE 2

Network configuration: A ddress size is 8 bytes, Inferred destination addressing
Source address: 0x0807060504030201, where LSB (0x01) is at address 0x1F
Destination address: 0x9897969594939291
Payload: BA BA
MAC security level: 0x07
MAC security indices: Encode only from the sec- ond payload
Packet: Data packet

6.8.2.1 Transmission

Host MCU constructs the frame and loads the buffer: 15 || 09 55 91 92 93 94 95 96 97 98 || 34 || BA BA Always encode Security Indices with DA present in AUXSECHDR! 2. — 3. — 4. — 5. — 6. Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c 7. Host MCU issues TXST 8. MRF24XA configures - SECHDRINDX to 0x01 - SECPAYINDX to 0x0D - SECENDINDX to 0x0D 9. MRF24XA performs CCM* authentication with encryption, where BA BA is encrypted to BA F7, and the following MIC tag is attached: 00 11 6C 8C 59 02 66 AC 5B DC 2D 30 21 1E D0 0C 10. MRF24XA appends CRC: 0xA2D2 11. MRF24XA transmits the packet to the medium. Different IF can be received based on the register settings (for example, TX with CSMA). Packet transmitted to the medium: 17 || 09 55 || 34 || BA F7 || 00 11 6C 8C 59 02 66 AC 5B DC 2D 30 21 1E D0 0C || D2 A2 TX Buffer (0x200) content: 1F || 09 55 91 92 93 94 95 96 97 98 || 34 || BA F7 || 00 11 6C 8C 59 02 66 AC 5B DC 2D 30 21 1E D0 0C || D2 A2

6.8.2.2 Reception

MRF24XA receives the following packet through the antenna: 17 || 09 55 || 34 || BA F7 || 00 11 6C 8C 59 02 66 AC 5B DC 2D 30 21 1E D0 0C || D2 A2 2. MRF24XA configures: - SECHDRINDX to 0x01 - SECPAYINDX to 0x0D (inferred DA is considered) - SECENDINDX to 0x15 3. MRF24XA asserts RXIF (RXSFDIF): Packet accepted by RX filter 4. — 5. Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE to 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c 6. Host MCU issues RXDEC 7. MRF24XA performs CCM* de-authentication and decryption, where the MIC tag is compared against the received one, and BA F7 is decrypted to BA BA 8. MRF24XA asserts RXDECIF (and IDLEIF) 9. — 10. — 11. — 12. — 13. — 14. — 15. SW read the entire frame from RX Buffer (0x300): 17 || 09 55 || 34 || BA BA || 00 11 6C 8C 59 02 66 AC 5B DC 2D 30 21 1E D0 0C || D2 A2 || RSVs

DS70005023B-page 180 Advanced  2011-2013 Microchip Technology Inc.

6.8.3 MAC-LAYER SECURITY EXAMPLE 3

Network configuration: Address size is 1 byte, Inferred destination addressing
Source address: 0x01 (is at address 0x1F)
Destination address: 0x91
Payload: BA BA
MAC security level: 0x07
MAC security indices: Encode only from the sec- ond payload
Packet: Data packet

6.8.3.1 Transmission

Host MCU constructs the frame and loads the buffer: 06 || 09 55 91 || 18 || BA BA. Always encode security indices with DA present in AUXSECHDR! 2. — 3. — 4. — 5. — 6. Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c 7. Host MCU issues TXST 8. MRF24XA configures: - SECHDRINDX to 0x01 - SECPAYINDX to 0x06 - SECENDINDX to 0x06 9. MRF24XA performs CCM* authentication with encryption, where BA BA is encrypted to BA F7, and the following MIC tag is attached: 35 84 FC 4F 1B 92 36 D2 8F D5 D8 B6 68 79 6A 10. MRF24XA appends CRC: 0x23A9 11. MRF24XA transmits the packet to the medium. Different IF can be received based on the regis- ter settings (for example, TX with CSMA). Packet transmitted to the medium: 17 || 09 55 || 18 || BA F7 || 35 84 FC 4F 1B 92 36 D2 8F D5 D8 B6 68 79 6A 13 || A9 23 TX Buffer (0x200) content: 18 || 09 55 91 || 18 || BA F7 || 35 84 FC 4F 1B 92

36 D2 8F D5 D8 B6 68 79 6A 13 || A9 23

6.8.3.2 Reception

MRF24XA receives the following packet through the antenna: 17 || 09 55 || 18 || BA F7 || 35 84 FC 4F 1B 92 36 D2 8F D5 D8 B6 68 79 6A 13 || A9 23 2. MRF24XA configures: - SECHDRINDX to 0x01 - SECPAYINDX to 0x06 (inferred DA is considered) - SECENDINDX to 0x15 3. MRF24XA asserts RXIF (RXSFDIF): Packet accepted by RX filter 4. — 5. Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE to 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c 6. Host MCU issues RXDEC 7. MRF24XA performs CCM* de-authentication and decryption, where the MIC tag is compared against the received one, and BA F7 is decrypted to BA BA 8. MRF24XA asserts RXDECIF (and IDLEIF) 9. — 10. — 11. — 12. — 13. — 14. — 15. SW read the entire frame from RX Buffer (0x300): 17 || 09 55 || 18 || BA BA || 35 84 FC 4F 1B 92

36 D2 8F D5 D8 B6 68 79 6A 13 || A9 23 || RSVs

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 181 MRF24XA

6.8.4 NWK-LAYER SECURITY

Network configuration: Address size is 8 bytes
Source address: 0x0807060504030201, where LSB (0x01) is at address 0x1F
Destination address: 0x9897969594939291
Network header: BA BA
Network payload: AB AB
NET security level: 0x01
Packet: Data packet

6.8.4.1 Transmission

Host MCU constructs the frame and loads the buffer: 15 || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 55 2E || BA BA AB AB 2. Host MCU configures: - SECSUITE to 0x01 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c 3. — 4. — 5. — 6. — 7. Host MCU issues TXST 8. MRF24XA configures: - SECHDRINDX to 0x15 - SECPAYINDX to 0x17 - SECENDINDX to 0x18 9. MRF24XA performs CCM* authentication, where the following MIC tag is attached: FB 17 32 26 10. MRF24XA appends CRC: 0xAA70 11. MRF24XA transmits the packet to the medium. Different IF can be received based on the register settings (for example, TX with CSMA). TX Buffer (0x200) content: 1E || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 55 2E || BA BA FB 17 32 26 || 70 AA

6.8.4.2 Reception

MRF24XA receives the following packet through the antenna: 1E || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 55 2E || BA BA FB 17 32 26 || 70 AA 2. MRF24XA configures: - SECHDRINDX to 0x15 - SECPAYINDX to 0x17 - SECENDINDX to 0x18 3. MRF24XA asserts RXIF (RXSFDIF): Packet accepted by RX filter 4. — 5. — 6. — 7. — 8. — 9. — 10. — 11. Host MCU configures: - SECSUITE to 0x04 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE to 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c 12. Host MCU issues RXDEC 13. MRF24XA performs CCM* de-authentication, where the MIC tag is compared against the received one 14. MRF24XA asserts RXDECIF (and IDLEIF) 15. — 16. SW read the entire frame from RX Buffer (0x300): 1E || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 55 2E || BA BA FB 17 32 26 || 70 AA || RSVs

DS70005023B-page 182 Advanced  2011-2013 Microchip Technology Inc.

6.8.5 NWK-LAYER SECURITY

Network configuration: A ddress size is 8 bytes, Inferred destination addressing
Source address: 0x0807060504030201 where LSB (0x01) is at address 0x1F
Destination address: 0x9897969594939291
Network header: BA BA
Network payload: AB AB
Security level: 0x07
Packet: Data packet

6.8.5.1 Transmission

Host MCU constructs the frame and loads the buffer: 15 || 89 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 55 2E || BA BA AB AB 2. Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c 3. — 4. — 5. — 6. — 7. Host MCU issues TXST 8. MRF24XA configures: - SECHDRINDX to 0x15 - SECPAYINDX to 0x17 - SECENDINDX to 0x18 9. MRF24XA performs CCM* authentication and encryption, where BA BA AB AB is encrypted to BA BA E6 E5, and the following MIC tag is attached:

77 FE 46 E2 D4 0E 1D C6 34 D9 34 36 4F 28 2F

MRF24XA appends CRC: 0x55C1 11. MRF24XA transmits the packet to the medium. Different IF can be received based on the register settings (for example, TX with CSMA). Packet transmitted to the medium: 22 || 89 55 01 02 03 04 05 06 07 08 || 55 2E || BA BA E6 E5 77 FE 46 E2 D4 0E 1D C6 34 D9 34 36 4F 28 2F D8 || C1 55 TX Buffer (0x200) content: 2A || 89 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 55 2E || BA BA E6 E5 77 FE 46 E2 D4 0E 1D C6 34 D9 34 36 4F 28 2F D8 || C1 55

6.8.5.2 Reception

MRF24XA receives the following packet through the antenna: 22 || 89 55 01 02 03 04 05 06 07 08 || 55 2E || BA BA E6 E5 77 FE 46 E2 D4 0E 1D C6 34 D9 34 36 4F 28 2F D8 || C1 55 2. MRF24XA configures: - SECHDRINDX to 0x15 (inferred DA is considered) - SECPAYINDX to 0x17 (inferred DA is considered) - SECENDINDX to 0x20 3. MRF24XA asserts RXIF (RXSFDIF): Packet accepted by RX filter 4. — 5. — 6. — 7. — 8. — 9. — 10. — 11. Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE to 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c 12. Host MCU issues RXDEC 13. MRF24XA performs CCM* de-authentication and decryption, where the MIC tag is compared against the received one, and BA BA E6 E5 is decrypted to BA BA AB AB 14. MRF24XA asserts RXDECIF (and IDLEIF) 15. — 16. SW read the entire frame from RX Buffer (0x300): 22 || 89 55 01 02 03 04 05 06 07 08 || 55 2E || BA BA AB AB 77 FE 46 E2 D4 0E 1D C6 34 D9 34 36 4F 28 2F D8 || C1 55 || RSVs

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 183 MRF24XA

6.8.6 NWK-LAYER EXAMPLE 3

Network configuration: Address size is 1 byte, Inferred destination addressing
Source address: 0x01 (is at address 0x1F)
Destination address: 0x91
Network header: BA BA
Network payload: AB AB
Security level: 0x07
Packet: Data packet

6.8.6.1 Transmission

Host MCU constructs the frame and loads the buffer: 0A || 89 55 91 01 || 1D 12 || BA BA AB AB 2. Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c 3. — 4. — 5. — 6. — 7. Host MCU issues TXST 8. MRF24XA configures: - SECHDRINDX to 0x07 - SECPAYINDX to 0x09 - SECENDINDX to 0x0A 9. MRF24XA performs CCM* authentication and encryption, where BA BA AB AB is encrypted to BA BA E6 E5, and the following MIC tag is attached:
MRF24XA appends CRC: 0xCD05 11. MRF24XA transmits the packet to the medium. Different IF can be received based on the regis- ter settings (for example, TX with CSMA). Packet transmitted to the medium: 1B || 89 55 01 || 1D 12 || BA BA E6 E5 77 FE 46 E2 D4 0E 1D C6 34 D9 34 36 4F 28 2F D8 || 05 CD TX Buffer (0x200) content: 1C || 89 55 91 01 || 1D 12 || BA BA E6 E5 77 FE

46 E2 D4 0E 1D C6 34 D9 34 36 4F 28 2F D8 ||

6.8.6.2 Reception

MRF24XA receives the following packet through the antenna: 1B || 89 55 01 || 1D 12 || BA BA E6 E5 77 FE 46 E2 D4 0E 1D C6 34 D9 34 36 4F 28 2F D8 || 05 CD 2. MRF24XA configures: - SECHDRINDX to 0x07 (inferred DA is considered) - SECPAYINDX to 0x09 (inferred DA is considered) - SECENDINDX to 0x19 3. MRF24XA asserts RXIF (RXSFDIF): Packet accepted by RX filter 4. — 5. — 6. — 7. — 8. — 9. — 10. — 11. Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE to 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c 12. Host MCU issues RXDEC 13. MRF24XA performs CCM* de-authentication and decryption, where the MIC tag is compared against the received one, and BA BA E6 E5 is decrypted to BA BA AB AB 14. MRF24XA asserts RXDECIF (and IDLEIF) 15. — 16. SW read the entire frame from the RX Buffer (0x300): 1B || 89 55 01 || 1D 12 || BA BA BA BA 77 FE 46 E2 D4 0E 1D C6 34 D9 34 36 4F 28 2F D8 || 05 CD || RSVs

DS70005023B-page 184 Advanced  2011-2013 Microchip Technology Inc.

6.8.7 MAC AND NWK-LAYER SECURITY

Network configuration: Address size is 8 bytes
Source address: 0x0807060504030201, where LSB (0x01) is at address 0x1F
Destination address: 0x9897969594939291
Payload: BA BA
Network header: AB
Network payload: AB
Network security level: 0x07
MAC security level: 0x03
MAC security indices: Encode only from the sec- ond payload
Packet: Data packet

6.8.7.1 Transmission

Host MCU constructs the frame and loads the buffer: 19 || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 5E 18 19 || BA BA AB AB 2. Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c 3. Host MCU issues TXENC 4. MRF24XA configures - SECHDRINDX to 0x18 - SECPAYINDX to 0x19 - SECENDINDX to 0x19 5. MRF24XA performs CCM* authentication with encryption, where AB AB is encrypted to AB E6, and the following MIC tag is attached: AB 4B 03 7B B7 30 98 B1 E5 93 CA D7 86 81 8A 2D 6. MRF24XA asserts TXENCIF (and IDLEIF) 7. Host MCU configures: - SECSUITE to 0x03 - SECKEY to 0xFFFEFDFCFBFAF9F8F7F6F5F4F3F2F1F0, where LSB (0xF0) is at address 0x40 - SECNONCE 0xF8F7F6F5F4F3F2F15555555506, where (0xF8) is at address 0x5c 8. Host MCU issues TXST 9. MRF24XA configures: - SECHDRINDX to 0x01 - SECPAYINDX to 0x17 - SECENDINDX to 0x29 10. MRF24XA performs CCM* authentication, where the following MIC tag is attached: 05 15 AB 5F 6C 7D 5C 70 6C 96 91 C0 34 E5 18 0D 11. MRF24XA appends CRC: 0x717B 12. MRF24XA transmits the packet to the medium. Different IF can be received based on the regis- ter settings (for example, TX with CSMA). TX Buffer (0x200) content: 3B || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 5E 18 19 || BA BA AB E6 AB 4B 03 7B B7 30 98 B1 E5 93 CA D7 86 81 8A 2D 05 15 AB 5F 6C 7D 5C 70 6C 96 91 C0 34 E5 18 0D || 7B 71

6.8.7.2 Reception

MRF24XA receives the following packet through the antenna: 3B || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 5E 18 19 || BA BA AB E6 AB 4B 03 7B B7 30 98 B1 E5 93 CA D7 86 81 8A 2D 05 15 AB 5F 6C 7D 5C 70 6C 96 91 C0 34 E5 18 0D || 7B 71 2. MRF24XA configures: - SECHDRINDX to 0x01 - SECPAYINDX to 0x17 - SECENDINDX to 0x39 3. MRF24XA asserts RXIF (RXSFDIF): Packet accepted by RX filter 4. — 5. Host MCU configures - SECSUITE to 0x03 - SECKEY to 0xFFFEFDFCFBFAF9F8F7F6F5F4F3F2F1F0, where LSB (0xF0) is at address 0x40 - SECNONCE 0xF8F7F6F5F4F3F2F15555555506, where MSB (0xF8) is at address 0x5c 6. Host MCU issues RXDEC 7. MRF24XA performs CCM* de-authentication, where the MIC tag is compared against the received one 8. MRF24XA configures: - SECHDRINDX to 0x18 - SECPAYINDX to 0x19 - SECENDINDX to 0x29 9. MRF24XA asserts RXDECIF (and IDLEIF) 10. —

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 185 MRF24XA 11. Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE to 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c 12. Host MCU issues RXDEC 13. MRF24XA performs CCM* de-authentication and decryption, where the MIC tag is compared against the received one, and AB E6 is decrypted to AB AB 14. MRF24XA asserts RXDECIF (and IDLEIF) 15. — 16. SW read the entire frame from the RX Buffer (0x300): 3B || C9 55 91 92 93 94 95 96 97 98 01 02 03 04 05 06 07 08 || 5E 18 19 || BA BA AB AB AB 4B 03 7B B7 30 98 B1 E5 93 CA D7 86 81 8A 2D 05 15 AB 5F 6C 7D 5C 70 6C 96 91 C0 34 E5 18 0D || 7B 71 || RSVs

6.8.8 MAC AND NWK-LAYER SECURITY

Network configuration: Address size is 4 bytes, Inferred destination addressing
Source address: 0x04030201 where LSB (0x01) is at address 0x1F
Destination address: 0x94939291
Payload: BA BA
Network header: AB
Network payload: AB
Network security level: 0x07
MAC security level: 0x07
MAC security indices: En code only from the sec- ond payload
Packet: Data packet

6.8.8.1 Transmission

Host MCU constructs the frame and loads the buffer: 11 || 89 55 91 92 93 94 01 02 03 04 || 3E 10 11 || BA BA AB AB 2. Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0x0F0E0D0C0B0A09080706050403020100, where LSB (0x00) is at address 0x40 - SECNONCE 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c 3. Host MCU issues TXENC 4. MRF24XA configures: - SECHDRINDX to 0x10 - SECPAYINDX to 0x11 - SECENDINDX to 0x11 5. MRF24XA performs CCM* authentication with encryption, where AB AB is encrypted to AB E6, and the following MIC tag is attached: AB 4B 03 7B B7 30 98 B1 E5 93 CA D7 86 81 8A 2D 6. MRF24XA asserts TXENCIF (and IDLEIF) 7. Host MCU configures: - SECSUITE to 0x03 - SECKEY to 0xFFFEFDFCFBFAF9F8F7F6F5F4F3F2F1F0, where LSB (0xF0) is at address 0x40 - SECNONCE 0xF8F7F6F5F4F3F2F15555555506, where (0xF8) is at address 0x5c 8. Host MCU issues TXST

DS70005023B-page 186 Advanced  2011-2013 Microchip Technology Inc. 9. MRF24XA configures: - SECHDRINDX to 0x01 - SECPAYINDX to 0x0F - SECENDINDX to 0x21 10. MRF24XA performs CCM* authentication with encryption, where BA BA AB E6 AB 4B 03 7B B7 30 98 B1 E5 93 CA D7 86 81 8A 2D is encrypted to BA A2 6D 3C 78 90 8F 99 BB E6 6B 29 CC AF A1 6F 14 9B 0D 7A, and the following MIC tag is attached:

23 EB C5 73 E8 44 DA 0E 8D D7 9C E7 06 E1

MRF24XA appends CRC: 0xF9B3 12. MRF24XA transmits the packet to the medium. Different IF can be received based on the regis- ter settings (for example, TX with CSMA). Packet transmitted to the medium: 2F || 89 55 01 02 03 04 || 3E 10 11 || BA A2 6D 3C 78 90 8F 99 BB E6 6B 29 CC AF A1 6F 14 9B 0D 7A 23 EB C5 73 E8 44 DA 0E 8D D7 9C E7 06 E1 BD C2 || B3 F9 TX Buffer (0x200) content: 33 || 89 55 91 92 93 94 01 02 03 04 || 3E 10 11 || BA A2 6D 3C 78 90 8F 99 BB E6 6B 29 CC AF A1 6F 14 9B 0D 7A 23 EB C5 73 E8 44 DA 0E 8D D7 9C E7 06 E1 BD C2 || B3 F9

6.8.8.2 Reception

MRF24XA receives the following packet through the antenna: 2F || 89 55 01 02 03 04 || 3E 10 11 || BA A2 6D 3C 78 90 8F 99 BB E6 6B 29 CC AF A1 6F 14 9B 0D 7A 23 EB C5 73 E8 44 DA 0E 8D D7 9C E7 06 E1 BD C2 || B3 F9 2. MRF24XA configures: - SECHDRINDX to 0x01 - SECPAYINDX to 0x0F (inferred DA is considered) - SECENDINDX to 0x2D 3. MRF24XA asserts RXIF (RXSFDIF): Packet accepted by RX filter 4. — 5. Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0xFFFEFDFCFBFAF9F8F7F6F5F4F3F2F1F0, where LSB (0xF0) is at address 0x40 - SECNONCE 0xF8F7F6F5F4F3F2F15555555506, where (0xF8) is at address 0x5c 6. Host MCU issues RXDEC 7. MRF24XA performs CCM* de-authentication, where the MIC tag is compared against the received one, and BA A2 6D 3C 78 90 8F 99 BB E6 6B 29 CC AF A1 6F 14 9B 0D 7A is decrypted to BA BA AB E6 AB 4B 03 7B B7 30 98 B1 E5 93 CA D7 86 81 8A 2D 8. MRF24XA configures: - SECHDRINDX to 0x10 - SECPAYINDX to 0x11 - SECENDINDX to 0x1D 9. MRF24XA asserts RXDECIF (and IDLEIF) 10. — 11. Host MCU configures: - SECSUITE to 0x07 - SECKEY to 0x0F0E0D0C0B0A0908070605040302010, where LSB (0x00) is at address 0x40 - SECNONCE to 0x08070605040302015555555506, where MSB (0x08) is at address 0x5c 12. Host MCU issues RXDEC 13. MRF24XA performs CCM* de-authentication and decryption, where the MIC tag is compared against the received one, and AB E6 is decrypted to AB AB 14. MRF24XA asserts RXDECIF (and IDLEIF) 15. — 16. SW read the entire frame from RX Buffer (0x300): 2F || 89 55 01 02 03 04 || 3E 10 11 || BA BA AB AB AB 4B 03 7B B7 30 98 B1 E5 93 CA D7 86 81 8A 2D 23 EB C5 73 E8 44 DA 0E 8D D7 9C E7 06 E1 BD C2 || B3 F9 || RSVs

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 187 MRF24XA

7.0 ADVANCED LINK BEHAVIOR

7.1 Channel Agility

In some communication environments, where several nodes use the same medium, it might be necessary to choose different channels for the communicating nodes. It introduces difficulties in ACK receiving. Figure 7-1 illustrates the example of channel agility. To prevent higher MCU load on channel changing, MRF24XA handles the channel change for ACK send- ing automatically. This feature is enabled by ADPTCHEN bit, that must be enabled for all the nodes within the same network. Figure 4-12 describes the ACK sending mechanism. Note, that in case of Inferred DA, the ACKINFO field is mandatory when AckReq=1. Otherwise the ACKINFO field is mandatory if and only if ADPTDREN = 1 or ADPTCHEN = 1. FIGURE 7-1: CHANNEL AGILITY EXAMPLE EXAMPLE 7-1: AUTO ACK EXAMPLE WITH CHANNEL AGILITY Channel Agility is based on AckInfo field of the Propri- etary MAC Header. Proprietary MAC Header is described by Figure 6-1. FIGURE 7-2: PROPRIETARY MAC ACKINFO<7:0> OCTET (ONLY PRESENT WHEN ACKREQ = 1) Node A Node B RX Channel: 7 RX Channel: 10 Interfering Node Interfering Node Channel: 10 Channel: 7 A B: A: CHANNEL = 10(1) TXST CHANNEL = 7 B: CHANNEL = 10(2) RXIF CHANNEL = 7 Sending ACK back to A CHANNEL = 10 Note 1: Node A knows the frequency channel, that Node B uses for receiving. 2: However, Node B might know the RX channel of Node A, as AUTOACK = 1 the ACK must immediately sent back, there is no time for MCU interactions. AckDataRate: When ADPTDREN = 1 and AckReq = 1, this field determines the TX Data Rate for the ACK packet, regardless of the setting of the DR<3:0> register field. AckChannel: When ADPTCHEN = 1 and AckReq = 1, this field determines the TX Channel for the ACK packet, regardless of the setting of the CH<3:0> register field. ACKDataRate ACKChannel

1 Octet

3:0 7:4 (4 bits) (4 bits)

DS70005023B-page 188 Advanced  2011-2013 Microchip Technology Inc. REGISTER 7-1: RXCON2 (MAC RECEIVE CONTROL 2 REGISTER) R/C/HS-0 R/W-0 R-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 RXBUFFUL IDENTREJ ACKRXFP ACKTXFP AUTORPTEN AUTOACKEN ADPTCHEN ADPTDREN bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HS = Hardware Set C = Clearable bit bit 7-2 Out of scope bit 1 ADPTCHEN: Adaptive Channel Enable bit(1) Setting this bit will enable the MAC to set the transmitting channel for the ACK packet based on the AckInfo field (proprietary packet) of the received packet, rather than the CH<3:0> register bits. 1 = Adaptive Channel feature is enabled 0 = Adaptive Channel feature is disabled bit 0 Out of scope Note 1: ADPTCHEN field is used while receiving and transmitting, and should not be modified while RXEN or TXST is set.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 189 MRF24XA

7.2 Data Rate Agility

Similar to Channel Agility, described in Figure 7.1, ACK can be sent at different data rates within different nodes. It might provide more robust ACK sending mechanism in busier networking environments. Data Rate Agility is enabled by the ADPTDREN bit, and that must be set for all the nodes within the same network. Data Rate Agility is based on AckInfo field of the Pro- prietary MAC Header. Proprietary MAC Header is described in Figure 6-1. AckInfo field is described in Figure 7-1. Figure 4-12 describes the ACK sending mechanism. REGISTER 7-2: RXCON2 (MAC RECEIVE CONTROL 2 REGISTER) R/C/HS-0 R/W-0 R-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 RXBUFFUL IDENTREJ ACKRXFP ACKTXFP AUTORPTEN AUTOACKEN ADPTCHEN ADPTDREN bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HS = Hardware Set C = Clearable bit bit 7-1 Out of scope bit 0 ADPTDREN: Adaptive Data Rate Enable bit(1) Setting this bit will enable the MAC to set the transmission data rate for the ACK packet based on the AckInfo field (proprietary packet) of the received packet, rather than the DR<2:0> register bits. 1 = Adaptive Data Rate feature is enabled 0 = Adaptive Data Rate feature is disabled Note 1: ADPTDREN field is used while receiving and transmitting, and should not be modified while RXEN or TXST is set.

DS70005023B-page 190 Advanced  2011-2013 Microchip Technology Inc.

7.3 Auto-Repeater

The Auto-Repeat feature allows to automatically (with- out Host Controller intervention) repeat any packets that request it (FrameCtrl[Repeat] = 1). Auto-Repeat is not available in RX- or TX- Streaming modes, as these modes are designed to provide maximum throughput, rather than reliable transport. Only Data and Command frames are repeated with Auto-Repeat. When MRF24XA receives a Data or Command frame with its FrameCtrl[Repeat] bit set, that frame may be repeated without MCU intervention by setting the AUTORPTEN register bit. If the packet is a Unicast packet, and its Destination Address (explicit or inferred) matches the ADDR<63:0> register, then the packet will not be repeated, but will instead be received as a normal packet. If the packet is a Broadcast packet, or is a Unicast packet with a non-matching address, the packet will be received into the buffer, and then retransmitted (repeated) without modification (no CRC generation or encryption steps are performed). It is recommended to use this function together with the CSMA/CA algorithm, to avoid the collision and with the IDENTREJ = 1 function. Therefore, packet received more than twice will not be repeated.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 191 MRF24XA

7.4 Streaming

The Streaming feature provides the maximum throughput between two nodes. In this mode, the two packet buffers are used to transmit/receive packets in ping-pong fashion. Auto-ACK and Auto- Retransmission are not available in this mode. In addition, CSMA-CA operation is skipped in order to provide the maximum throughput. 7.4.1 TX After the initial negotiation (channel, power, security key, and so on), the TX node sets the TRXMODE<1:0> register to 2’b10. The MCU shall write the packets to address 0x200. The switching is handled internally. Note that MCU shall write MRF24XA if and only if the TXBUFFEMPTY flag is set. To maximize throughput, “WRITE and set TXST” SPI framing format is recommended. Note that for debugging purpose, the TXRDBUF, BUSWRBUF and TXBUFEMPTY signals can be output on the GPIO pins with GPIOMODE = 1010 settings. FIGURE 7-3: STREAMING MODE TX TIMELINE

DS70005023B-page 192 Advanced  2011-2013 Microchip Technology Inc. 7.4.2 RX After the initial negotiation (channel, power, security key, and so on), the RX node sets the TRXMODE<1:0> register to 2’b01. The MCU shall read the packets from address 0x300. The switching is handled internally. Note that MCU shall read MRF24XA when the RXBUFFULL flag is set. To maximize throughput, “READ and clear RXBUFFULL” SPI framing format is recommended. Note that for debugging purpose, the RXWRBUF, BUSRDBUF and RXBUFFUL signals can be output on the GPIO pins with GPIOMODE = 1011 settings. FIGURE 7-4: STREAMING RX TIMELINE

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 193 MRF24XA

8.0 BRIDGING

Any member of a proprietary node may run two stacks and be part of a 15.4 network. This allows the node to act as a gateway between the two networks. By default it is configured to be NWFRMFMT = 1. When it receives a 15.4 frame, this setting is overridden. When it needs to send it switches back temporarily. The network can be configured to use proprietary or standard (IEEE 802.15.4) MAC. However, a proprietary network should also be able to send and receive frames to/from standard-compliant networks. This capability is referred to as bridging. The bridging node must implement both the proprietary and the standard compliant MAC framing protocols. Each time a 250 kbps frame is received by the bridging node, it needs to decide which MAC protocol to use for parsing the incoming frame. The problem of bridging is that the 802.15.4 MAC Frame Control field will not allow for distinction in the case of 250 kbps frames. Therefore, the selected SFD is used for distinction. Standard compliant SFD pattern is selected when Standard MAC is used with 250 kbps frame, or else different SFD value is used. When the Host MCU (or MAC) selects the 250 kbps air data rate for transmission, it also indicates which MAC is used by a sideband signal. The transmitter baseband will select the SFD accordingly. If proprietary MAC is selected, the SFD is read from a host configurable register, otherwise the standard defined pattern is used (0xA7). As an additional difference, the length and payload fields are scrambled if proprietary is used, otherwise they are not. On the receiver side, the 250 kbps preamble and the SFD are detected first. This will determine which MAC protocol is used to parse the PHY payload. FIGURE 8-1: BRIDGING

DS70005023B-page 194 Advanced  2011-2013 Microchip Technology Inc. NOTES:

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 195 MRF24XA

9.0 PHYSICAL LAYER FUNCTIONS

9.1 Synthesizer Power-Up, Power-Off

Table 2-1 illustrates MRF24XA power modes, while Figure 4-2 illustrates the operation states. RFOFF state is the state when most of the RF circuits are powered off. As Table 2-1 illustrates, RFOFF state can be divided into two sub-states. In Crystal ON state, only 16 MHz on-chip crystal oscillator is powered on and the synthesizer is switched off. In Synthesizer ON state, both the on-chip crystal oscillator and the synthesizer are powered on. MRF24XA provides an OFF-Timer to optimize the power consumption by managing the ON-time of the on-chip synthesizer. Before the synthesizer is switched off, RXEN or TXST goes to ‘0’ from ‘1’, the user must set OFFTM<7:0>. The value of the register is interpreted as an OFF time counter. As the counter runs out, synthesizer is started regardless of the state of RXEN and TXST bits. REGISTER 9-1: OFFTM (OFF-TIMER REGISTER) R/W-00000000 OFFTM<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-0 OFFTM<7:0>: OFF-Timer Field bits This value sets the minimum PLL OFF time. Minimum OFF Time = OFFTM<7:0> * 32 s If this register is set to 0xFF, PLL will remain off.

DS70005023B-page 196 Advanced  2011-2013 Microchip Technology Inc. REGISTER 9-2: RXCON1 (MAC RECEIVE CONTROL 1 REGISTER) R/W/HC/HS-0 R/W-0 R/W/HC-0 R/W-0 R/W-0 R/W-0 R/W-0 R-0 RXEN NOPA RXDEC RSVLQIEN RSVRSSIEN RSVCHDREN RSVCFOEN r bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 RXEN: Receive Enable Field bit This bit enables/disables the packet reception. If an RX packet is being received, clearing this bit will cause that packet to be discarded. 1 = RX enabled 0 = RX disabled Hardware clear/set when:

Cleared when TRXMODE is set to TX-Streaming mode
Set when TRXMODE is set to RX-Streaming mode Clearing this bit will abort the current operation in the following cases:
Receiving a packet in Packet mode or in RX-Streaming mode The most RX related settings should only be changed while this bit is cleared. The clear channel assessment (CSMAEN) and ACK-frame reception does not require RXEN = 1, because the device will turn the radio into RX when required, irrespective of the status of the RXEN bit. bit 6 NOPA: No Parsing bit This bit will disable packet parsing. Only CRC will be checked, if it is enabled. This feature is useful in Sniffer mode. 1 = Disable packet parsing 0 = Enable packet parsing bit 5 RXDEC: RX Decryption bit Setting this bit will start RX security processing (authentication and/or decryption) on the last received packet. 1 = RX security processing started/in process. RXDECIF or RXTAGIF is set. 0 = RX security processing inactive or complete This bit will clear itself after RX decryption has completed. bit 4 RSVLQIEN: Receive Status Vector LQI Enable bit If this bit is set, the measured Link Quality is appended after the received frame in the packet buffer. 1 = Append LQI field 0 = Do not append LQI field bit 3 RSVRSSIEN: Receive Status Vector RSSI Enable bit If this bit is set, the measured RSSI is appended after the received frame in the packet buffer. 1 = Append RSSI field 0 = Do not append RSSI field bit 2 RSVCHDREN: Receive Status Vector Channel/MAC Type/Data Rate Enable bit If this bit is set, Channel, MAC type and Data Rate configurations used with the received frame are appended after the received frame in the packet buffer, using the encoding specified for CH<3:0>, FRMFMT and DR<2:0> (concatenated in this order when most significant bit (MSb) is first). 1 = Append Channel, MAC type and Data Rate fields 0 = Do not append Channel, MAC type and Data Rate fields

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 197 MRF24XA REGISTER 9-3: TXCON (TRANSMIT CONTROL REGISTER) bit 1 RSVCFOEN: Receive Status Vector CFO Enable bit If bit is set, the estimated Carrier Frequency Offs et of the received frame is appended after the received frame in the packet buffer, using the same encoding as CFOMEAS register. 1 = Append CFO estimation 0 = Do not append estimated CFO bit 0 Reserved: Maintain as ‘ 0’ R/W/HC -0 R/W-0 R/W/HC-0 R/HS/HC-1 R/W-1 R/W-011 TXST DTSM TXENC TXBUFEMPTY CSMAEN DR<2:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 TXST: Transmit Start bit. When set or cleared by the host MCU bit(1, 2) 1 = Starts the transmission of the next TX packet 0 = Termination of current TX operation, which may result in the transmission of an incomplete packet. Hardware Clear:

After the packet has been successfully transmitted (including all attempted re-transmissions, if any) this bit will be cleared by hardware and TXIF and IDLEIF are set.
If the packet transmission fails due to a CSMA failure, then this bit will be cleared, and TXCSMAIF is set.
If Acknowledge was requested (AckReq bit field in the transmitted frame and AUTOACKEN regis- ter bit are both set) and not received after the configured number of re-transmissions (TXRET- MCNT), then TXST bit will be cleared, and a TXACKIF is set.
In TX-Streaming mode (TRXMODE), TXST can be set even when it is already set, resulting in a “posted start”. When the current TX operation completes, the “posted start “will start immediately afterwards. Clearing of the TXST bit clears both the current and the posted (pending) TX starts. TXOVFIF is not changed when TXST = 1, a posted start is present and a Host Controller write to the packet buffer occurs. Outside of TX-Streaming mode, writes to TXST when TXST is already set will be ignored. Clearing this bit will abort the current operation in the following cases:
When transmitting a packet in Packet mode or in TX-Streaming mode
When waiting for an ACK packet after a transmission
During the CSMA CA algorithm
When transmitting a repeated frame This field can be read at any time to determine if the TX operation is in progress. bit 6-0 Out of scope Note 1: Transmission may include automatic security processing, CRC appending, CSMA-CA channel access, Acknowledge reception and re-transmissions depending on the register configuration and the frame control field of the frame to be transmitted. 2: By setting the TXST bit in either Sleep/RFOFF state, the device will transit to TX state for packet transmission. REGISTER 9-2: RXCON1 (MAC RECEIVE CONTROL 1 REGISTER) (CONTINUED)

DS70005023B-page 198 Advanced  2011-2013 Microchip Technology Inc.

9.2 Operating Channel

MRF24XA is capable of selecting one of sixteen channel frequencies in the 2.4 GHz band. The desired channel is selected by configuring the CHANNEL<3:0> bits in the MACCON2 register. Refer to Table 9-2 for the MACCON2 register setting for channel number and frequency. If Channel Agility is not used, all nodes share the same channel both in RX and TX modes. The channel is defined by CHANNEL<3:0> as it is indicated below. Refer to Section 7.1 “Channel Agility” for more information on channel agility. REGISTER 9-4: MACCON2 (MAC CONTROL 2 REGISTER) TABLE 9-2: CHANNEL SELECTION MACCON2 (0x11) REGISTER SETTING TABLE 9-1: REGISTERS ASSOCIATED WITH OFF PLL POWER-UP, POWER-OFF Names Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 OFFTM OFFTM<7:0> RXCON1 RXEN NOPA RXDEC RSVLQIEN RSVRSSIEN RSVCHDREN RSVCFOEN r TXCON TXST DTSM TXENC TXBUFEMPTY CSMAEN DR<2:0> Legend: r = Reserved, read as ‘0’. R/W-0000 R/W/HS-0000 CHANNEL<3:0> SECSUITE<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-4 CHANNEL<3:0>: TX/RX operating channel Fields bits(1) These register bits are used as the current operating channel for TX/RX operation. 0x0 = Channel 11 0x1 = Channel 12 0xF = Channel 26 bit 3-0 Out of scope Note 1: This field is used while receiving and transmitting, and should not be modified while RXEN or TXST is set. CHANNEL<3:0> Bits in MACCON2 Channel Number Channel Frequency 0x0 11 2.405 GHz 0x1 12 2.410 GHz 0x2 13 2.415 GHz 0x3 14 2.420 GHz 0x4 15 2.425 GHz 0x5 16 2.430 GHz 0x6 17 2.435 GHz 0x7 18 2.440 GHz 0x8 19 2.445 GHz 0x9 20 2.450 GHz 0xA 21 2.455 GHz 0xB 22 2.460 GHz 0xC 23 2.465 GHz 0xD 24 2.470 GHz 0xE 25 2.475 GHz 0xF 26 2.480 GHz CHANNEL<3:0> Bits in MACCON2 Channel Number Channel Frequency

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 199 MRF24XA REGISTER 9-5: RXCON1 (MAC RECEIVE CONTROL 1 REGISTER) R/W/HC/HS-0 R/W-0 R/W/HC-0 R/W-0 R/W-0 R/W-0 R/W-0 R-0 RXEN NOPA RXDEC RSVLQIEN RSVRSSIEN RSVCHDREN RSVCFOEN r bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 RXEN: Receive Enable bit(1, 2) This bit Enables/Disables the packet reception. If an RX packet is being received, clearing this bit will cause that packet to be discarded. 1 = RX enabled 0 = RX disabled Hardware clear/set when:

Cleared when TRXMODE is set to TX-Streaming mode
Set when TRXMODE is set to RX-Streaming mode Clearing this bit will abort the current operation in the following cases:
Receiving a packet in Packet mode or in RX-Streaming mode
Transmitting an ACK packet for a received frame during an Auto-Acknowledge operation bit 6-0 Out of scope Note 1: Most RX related settings should only be changed while this bit is cleared. 2: Clear channel assessment (CSMAEN) and ACK-frame reception does not require RXEN = 1, because the device will turn the radio into RX when needed, irrespective of the status of the RXEN bit.

DS70005023B-page 200 Advanced  2011-2013 Microchip Technology Inc. REGISTER 9-6: RXCON2 (MAC RECEIVE CONTROL 2 REGISTER) SECSUITE<3:0>

9.3 RXLISTEN Operations

The air data rate can be detected in two stages: 1. By simultaneously monitoring the presence of

2 Mbps, 500 kbps, 250 kbps modulated pream-

bles until one of them can be detected with suf- ficient reliability. 2. By searching for a Start Frame Delimiter that may further distinguish between air data rates. The order of processing steps and decisions is shown in Figure 9-1 and Figure 9-2 for the Optimal and Legacy frame formats. R/C/HS-0 R/W-0 R-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 RXBUFFUL IDENTREJ ACKRXFP ACKTXFP AUTORPTEN AUTOACKEN ADPTCHEN ADPTDREN bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HS = Hardware Set C = Clearable bit bit 7-2 Out of scope bit 1 ADPTCHEN: Adaptive Channel Enable bit(1) Setting this bit will enable the MAC to set the transmitting channel for the ACK packet based on the AckInfo field (proprietary packet) of the received packet, rather than the CH<3:0> register bits. 1 = Adaptive Channel feature is enabled 0 = Adaptive Channel feature is disabled bit 0 ADPTDREN: Adaptive Data Rate Enable bit(1) Setting this bit will enable the MAC to set the transmission data rate for the ACK packet based on the AckInfo field (proprietary packet) of the received packet, rather than the DR<2:0> register bits. 1 = Adaptive Data Rate feature is enabled 0 = Adaptive Data Rate feature is disabled Note 1: This field is used while receiving and transmitting, and should not be modified while RXEN or TXST is set. TABLE 9-3: REGISTERS ASSOCIAT ED WITH CHANNEL SELECTION Names Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 MACCON2 CHANNEL<3:0> SECSUITE<3:0> RXCON1 RXEN NOPA RXDEC RSVLQIEN RSVRSSIEN RSVCHDREN RSVCFOEN r RXCON2 RXBUFFUL IDENTREJ ACKRXFP ACKTXFP AUTORPTEN AUTOACKEN ADPTCHEN ADPTDREN Legend: r = Reserved, read as ‘0’.

DS70005023B-page 201 Advanced  2011-2013 Microchip Technology Inc. FIGURE 9-1: DATA RATE SELECTION IN THE RECEIVER WHEN OPTIMAL FRAMING MODE IS CONFIGURED Start RX Signal Processing 500 kbps preamble? 16-bit exact match to pattern_2000 Signal path to 2 Mbps bit- and byte-aligned demodulation/decoding

2 Mbps

preamble? 250 kbps preamble? Signal path to 500 kbps bit- and byte-aligned demodulation/decoding Signal path to 250 kbps bit- and byte-aligned demodulation/decoding Search for two different 16-chip SFD patterns (at 2 Mbps) Search for 8-bit SFD pattern Search for two different 16-chip SFD patterns (at 250 kbps) Continue 2 Mbps reception Switch to 1 Mbps reception 8-bit exact match to pattern_500 8-bit exact match to 0xA7 8-bit exact match to pattern_250 8-bit exact match to pattern_125 Continue 500 kbps reception Switch to 250 kbps reception Continue 250 kbps reception as in the standard Switch to 125 kbps reception Receive Length Field Receive Payload bytes 16-bit tolerant match to pattern_1000 No No No No Yes Yes No No Yes YesYesYes Yes No Yes Yes IEEE 802.155.4 Frame No No

DS70005023B-page 202 Advanced  2011-2013 Microchip Technology Inc. FIGURE 9-2: DATA RATE SELECTION IN THE RE CEIVER WHEN LEGACY FRAMING MODE IS CONFIGURED Start RXSignal Processing 250 kbps preamble? Switch signal path to 250 kbps bit- and byte-aligned demodulation and decoding 8-bit exact match to pattern_L2000 After LENGTH field switch to 2 Mbps reception 8-bit exact match to pattern_L1000 8-bit exact match to pattern_L500 No No Search for two different 16-bit SFD patterns (at 2 Mbps) Yes No 8-bit exact match to 0xA7 8-bit exact match to pattern_250 16-bit tolerant match to pattern_125Start descrambler Start descrambler Start descrambler After LENGTH field switch to 1 Mbps reception After LENGTH field switch to 500 kbps reception Continue 250 kbps reception Switch to 125 kbps reception: LLR mapping, DE-interleaving, FEC decoding Continue 250 kbps reception Start descrambler Receive LENGTH field Receive Payload bytes No No Yes Yes No Yes Yes Yes No Yes IEEE 802.155.4 Frame

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 203 MRF24XA FIGURE 9-3: PHYSICAL RECEIV ER OPERATION: OVERVIEW Abort/Reset from upper layer Preamble Loss? Switch Signal Flow to bit- and byte-aligned demodulation at the detected Preamble Air Data Rate; Start SFD detectors; AGC must hold the gain SFD detected? Start AGC Start Digital Demodulator Preamble Acquired? AGC Level Triggered? Gain Change SFD time-out? Switch the signal path to the detected payload data rate Transfer bytes to MAC Last byte done? Init SFD time-out Yes No Yes Yes No Yes No Yes No No No Yes

DS70005023B-page 204 Advanced  2011-2013 Microchip Technology Inc.

9.4 Automatic Gain Control (AGC)

AGC circuit can provide aut omatic gain adjustment according to the received field strength. AGC gain can be set in four steps. REGISTER 9-7: BBCON (BASEBAND CONFIGURATION REGISTER) R/W-0 R/W-0 R/W-11 R/W-0 R/W-001 RNDMOD AFCOVR RXGAIN<1:0> PRMBHOLD PRMBSZ<2:0> bit 7 bit 0 Legend: W = Writable bit R = Readable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 Out of scope bit 6 Out of scope bit 5-4 RXGAIN<1:0>: Receiver Gain Register Field bits By setting this bit, the AGC operation can be inhibi ted in the receiver and the receiver radio gain configuration can be selected between three different gain levels. Encoding: 11 = AGC operation is enabled (default value) 10 = High gain 01 = Middle gain 00 = Low gain This feature can be used for test and streaming pur poses. To reduce the required interframe-gap, the RXGAIN should be set to one of the fixed gain options when the MAC is in Streaming mode. bit 3-0 Out of scope

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 205 MRF24XA

9.5 Energy Detection

The Received Signal Strength Indicator (RSSI) is an estimate of the received signal power within the band- width of a particular channel, and can be obtained by the user using Energy Detection (ED). MRF24XA has the capability to measure the received signal power for a user-defined number of symbols, and to report back the measured RSSI value. The mapping between the RSSI value returned and the input power level is shown in Figure 9-4. This aggregates all the AGC curves, hence user does not require to calculate with any other settings. The curve can be directly used. The RSSI value associated with a received packet may also be stored automatically as part of the packet’s Receive Status Vector (RSV). FIGURE 9-4: RSSI VALUE VS. RECEIVED POWER EQUATION 9-1: RSSI VALUE VS. RECEIVED POWER EQUATION Pin = 0.5 * Energy Detect Code(1) - 112 <dBm>(2) Note 1: Energy Detect Code can be read from EDMEAN<7:0> field. 2: Equation 9-1 is valid for EDMEAN<7:0> from 40 to 184 decimal values.

DS70005023B-page 206 Advanced  2011-2013 Microchip Technology Inc. REGISTER 9-8: RXCON1 (MAC RECEIVE CONTROL 1 REGISTER) R/W/HC/HS-0 R/W-0 R/W/HC-0 R/W-0 R/W-0 R/W-0 R/W-0 R-0 RXEN NOPA RXDEC RSVLQIEN RSVRSSIEN RSVCHDREN RSVCFOEN r bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 RXEN: Receive Enable Field bit This bit Enables/Disables the packet reception. If an RX packet is currently being received, clearing this bit will cause that packet to be discarded. 1 = RX enabled 0 = RX disabled Hardware clear/set when:

Cleared when TRXMODE is set to TX-Streaming mode
Set when TRXMODE is set to RX-Streaming mode Clearing this bit will abort the current operation in the following cases:
Receiving a packet in Packet mode or in RX-Streaming mode The most RX related settings should only be changed while this bit is cleared. The clear channel assessment (CSMAEN) and ACK-frame reception does not require RXEN = 1, because the device will turn the radio into RX when needed, irrespective of the status of the RXEN bit. bit 6 NOPA: No Parsing bit This bit will disable packet parsing. Only CRC will be checked, if it is enabled. This feature is useful in sniffer mode. 1 = Disable packet parsing 0 = Enable packet parsing bit 5 RXDEC: RX Decryption bit Setting this bit will start RX security processing (authentication and/or decryption) on the last received packet. 1 = RX security processing started/in process. RXDECIF or RXTAGIF is set. 0 = RX security processing inactive or complete This bit will clear itself after RX decryption has completed. bit 4 RSVLQIEN: Receive Status Vector LQI Enable bit If this bit is set, the measured Link Quality is appended after the received frame in the packet buffer. 1 = Append LQI field 0 = Do not append LQI field bit 3 RSVRSSIEN: Receive Status Vector RSSI Enable bit If this bit is set, the measured RSSI is appended after the received frame in the packet buffer. 1 = Append RSSI field 0 = Do not append RSSI field bit 2 RSVCHDREN: Receive Status Vector Channel/MAC Type/Data Rate Enable bit If this bit is set, Channel, MAC type and Data Rate configurations used with the received frame are appended after the received frame in the packet buffer, using the encoding specified for CH<3:0>, FRMFMT and DR<2:0> (concatenated in this order when MSb is first). 1 = Append Channel, MAC type and Data Rate fields 0 = Do not append Channel, MAC type and Data Rate fields

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 207 MRF24XA REGISTER 9-9: CCACON1 (CCA CONTROL 1 REGISTER) bit 1 RSVCFOEN: Receive Status Vector CFO Enable bit If bit is set, the estimated Carrier Frequency Offs et of the received frame is appended after the received frame in the packet buffer, using the same encoding as CFOMEAS register. 1 = Append CFO estimation 0 = Do not append estimated CFO bit 0 Reserved: Maintain as ‘0’ REGISTER 9-8: RXCON1 (MAC RECEIVE CONTROL 1 REGISTER) (CONTINUED) R/HS/HC-0 R/W/HC-0 R/W-001100 CCABUSY CCAST RSSITHR<5:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 CCABUSY: Clear Channel Assessment Busy Flag bit This bit represents the result of the latest CCA measurement. 1 = Medium is busy 0 = Medium is silent bit 6 CCAST: Clear Channel Assessment Start bit(1) By setting this register bit, the MCU triggers st arting a new CCA measurement. This register bit is cleared by the hardware when the CCA measurement is done (EDCCAIF is set) and CCABUSY is valid. bit 5-0 RSSITHR<5:0>: RSSI Threshold bits This threshold is used in CCA operation when Ener gy detect or Energy and Carrier Sense mode is selected. Representation: resolution of 2 dB/LSB Note 1: RX chain should be turned on (RXEN = 1) to perform this measurement. Packet reception is not disabled during the measurement, its main purpose is testing.

DS70005023B-page 208 Advanced  2011-2013 Microchip Technology Inc. REGISTER 9-10: EDCON (ENERGY DETECT CONTROL REGISTER) (1, 2) REGISTER 9-11: EDMEAN (ENERGY DE TECT MEAN INDICATION REGISTER) R-00 R/W-01 R/W/HC-0 R/W-1110 r EDMODE EDST EDLEN<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear bit 7-6 Reserved: Maintain as ‘0’ bit 5 EDMODE: Energy Detect Mode Select bit 1 = Energy Detect Sampling Mode. ED duration is 128 µs. A single atomic RSSI-peak measurement is accomplished. The result is stored in EDPEAK<7:0> register. 0 = Energy Detect Scan Mode. ED duration is set by EDLEN<3:0>. The result is stored in EDMEAN<7:0> register. bit 4 EDST: Energy Detect Measurement Start bit By setting this register bit, the MCU triggers starting a new ED measurement. This register bit is cleared by the hardware when the ED measurement is done (EDCCAIF is not changed) and values in EDMEAN<7:0> and EDPEAK<7:0> are valid. If the ED measurement is aborted (RX state is change d, or the EDST bit is cleared by the MCU) then EDCCAIF is not changed. bit 3-0 EDLEN<3:0>: Energy Detect Measurement Length Field bits Value M indicates a sequence of (M + 1) * 8 atomic RSSI-peak measurements, each having the duration of 128 µs. At the end of the aggregate measurement, the mean and the peak value of the sequence are available in EDMEAN<7:0> and EDPEAK<7:0>. Note 1: The RX chain should be turned on (RXEN = 1) to perform this measurement. Packet reception is disabled during the measurement. 2: When EDLEN<3:0> = M = 0xE, then the 128 μs atomic measurements are preformed 120 times, which is equal to the a BaseSuperFrameDuration parameter in the IEEE 802.15.4 standard. R/HS/HC-00000000 EDMEAN<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7-0 EDMEAN<7:0>: Energy Detect Mean Indication Field bits Measured mean signal strength during ED/CCA measurement.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 209 MRF24XA REGISTER 9-12: EDPEAK (ENERGY DETECT PEAK INDICATION REGISTER) R/HS/HC-00000000 EDPEAK<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7-0 EDPEAK<7:0>: Energy Detect Peak Indication Field bits Measured peak signal strength during ED measurement. Computation: The gain-compensated RSSI value is averaged over intervals of 128 μs. The peak value obtained from a sequence of such measurements is stored in EDPEAK, when EDMODE = 1. TABLE 9-4: REGISTERS ASSOCIATED WITH RSSI AND ED Names Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 RXCON1 RXEN NOPA RXDEC RXVLQIEN RSVRSSIEN RSVCHDREN RSVCFOEN r CCACON1 CCABUSY CCAST RSSITHR<5:0> EDCON r EDMODE EDST EDLEN<3:0> EDMEAN EDMEAN<7:0> EDPEAK EDPEAK<7:0> Legend: r = Reserved, read as ‘0’.

DS70005023B-page 210 Advanced  2011-2013 Microchip Technology Inc.

9.6 Clear Channel Assessment (CCA)

Clear Channel Assessment is a function within CSMA/ CA to determine whether the wireless medium is ready and able to receive data, therefore the transmitter can start sending the data. CCA is implemented outside of the MAC. This allows the radio to transmit in the presence of interference from other wireless protocols that operate on the same frequency. CCA may be performed using either Energy Detection (ED), Carrier Sense (CS) or a combination of both.

9.6.1 CCA CONFIGURATION

CCA is automatically exec uted (potentially multiple times) as part of the CSMA-CA procedure when the TXST register bit is set and CSMA-CA is enabled. The following register bits are used in the configuration of CCA:

CCAMODE<1:0>
CCALEN<1:0>
CCACSTHR<3:0>
CCAEDTHR<5:0>

9.6.1.1 Energy Detection (ED) Only

When CCAMODE<1:0> = 10, the CCA will report a busy medium upon detecting energy above the energy detection threshold defined in the CCAEDTHR<7:0> register bits. To use this method of CCA, the following configuration should be used:

CCALEN<1:0> = Measurement duration
CCAMODE<1:0> = 10
CCAEDTHR<5:0> = RSSI threshold value The mapping between the CCAEDTHR threshold and the power level is shown in Figure 9-4 and Equation 9-1.

9.6.1.2 Carrier Sense (CS) Only

When CCAMODE<1:0> = 01, the CCA will report a busy medium upon detecting of a signal with particular modulation and spreading characteristics. To use this method of CCA, the following configuration should be used:

CCALEN<1:0> = Measurement duration
CCAMODE<1:0> = 01
CCACSTHR<3:0> = Carri er sense threshold

9.6.1.3 Carrier Sense with Energy Detection

When CCAMODE<1:0> = 11, the CCA will report a busy medium upon detecting of a signal with particular modulation and spreading characteristics and energy above the energy detection threshold defined in the CCAEDTHR<5:0> register bits. To use this method of CCA, the following configuration should be used:

CCALEN<1:0> = Measurement duration
CCAMODE<1:0> = 11
CCAEDTHR<5:0> = RSSI threshold value
CCACSTHR<3:0> = Carri er sense threshold

9.6.2 CCA OPERATION

CCA is automatically initiated by MRF24XA, as part of the CSMA-CA algorithm. CCA operation can be requested independently for software CSMA-CA, or for test purpose through the CCAST bit.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 211 MRF24XA REGISTER 9-13: OPSTATUS (OPERATION STATUS) (3) R-0 R/HS/HC-0 R/HS/HC-0 R/HS/HC-0 R/ HS/HC-0 R/HS/HC-0 R/HS/HC-0 R/HS/HC-0 r MACOP<3:0> RFOP<2:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 Reserved: Maintain as ‘0’ bit 6-3 MACOP <3:0>: MAC Operation Register Field bits (1, 2) Provides status information on the current state of the MAC state machine. Encoding on MACOP<3:1>: 111 = Transmitting Acknowledge (TXACK) 110 = Receiving a packet (RXBUSY) 101 = Receiver listening to the channel waiting for packet (RX) 100 = Receiving (or waiting for) Acknowledge (RXACK) 011 = Transmitting a packet (TX) 010 = Performing Clear Channel Assessment (CCA) 001 = Back-off before repeated CCA (BO) 000 = MAC does not perform any operation (IDLE) bit 2-0 RFOP <2:0>: Radio Operation Register Field bits Provides status information on the current Radio state. Encoding on RFOP<2:0>: 111 = TX with external PA is turned on (TX+PA) 110 = RX with external LNA is turned on (RX+LNA) 101 = Synthesizer and external PA or LNA is turned on (SYNTH+PA/LNA) 100 = Radio is calibrating if CALST has been set by the host MCU, otherwise device malfunction (CAL/MAL) 011 = Analog transmit chain is activated (TX) 010 = Analog receiver chain is active (RX). (Digital may be partially shut off) 001 = Synthesizer is steady or ramping up or channel change is issued (SYNTH) 000 = Only the crystal oscillator is ON(OFF), (except when XTALSF = 1) Note 1: GPIO<2:0> can be dedicated to output MACOP<3:1> or RFOP<2:0>. Refer to PINCON register, which specifies the pin configuration. 2: MACOP<0> is connected to RXBUFFUL register bit. It cannot be output over GPIO’s. 3: OPSTATUS register is sent on the SDO pin during all SPI operation.

DS70005023B-page 212 Advanced  2011-2013 Microchip Technology Inc. REGISTER 9-14: CCACON1 (CCA CONTROL 1 REGISTER) REGISTER 9-15: CCACON2 (CCA CONTROL 2 REGISTER) R/HS/HC-0 R/W/HC-0 R/W-001100 CCABUSY CCAST RSSITHR<5:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 CCABUSY: Clear Channel Assessment Busy Flag bit This bit represents the result of the latest CCA measurement. 1 = Medium is busy 0 = Medium is silent bit 6 CCAST: Clear Channel Assessment Start bit (1) By setting this register bit, the MCU triggers st arting a new CCA measurement. This register bit is cleared by the hardware when the CCA measurement is done (EDCCAIF is set) and CCABUSY is valid. bit 5-0 RSSITHR<5:0>: RSSI Threshold bits This threshold is used in CCA operation when Ener gy detect or Energy and Carrier Sense mode is selected. Representation: resolution of 2 dB/LSB Note 1: RX chain should be turned on (RXEN = 1) to perform this measurement. Packet reception is not disabled during the measurement, and main purpose is testing. R-0 R/W-01 R/W-01 CSTHR<3:0> CCALEN<1:0> CCAMODE<1:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-4 CSTHR<3:0>: Carrier Sense Threshold Field bits bit 3-2 CCALEN<1:0>: Clear Channel Assessment Length bits(2) Value N indicates duration of 2^N * 32 µs. bit 1-0 CCAMODE<1:0>: Clear Channel Assessment Mode Field bits(2) 11 = CCA Mode 3/a in the std. <1>: Energy AND Carrier Sense Threshold 10 = CCA Mode 2 in the std. <1>: Carrier Sense Threshold 01 = CCA Mode 1 in the std. <1>: Energy Detect Threshold (default) 00 = CCA Mode 3/b in the std.<1>: Energy OR Carrier Sense Threshold Note 1: The IEEE 802.15.4 standard requires 128 µs. But shorter length is recommended when using higher rates with optimized preamble mode (RATECON.OPTIMAL = 1). 2: The measured RSSI result is stored in EDMEAN<7:0> register in all modes except in Mode 2.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 213 MRF24XA REGISTER 9-16: EDMEAN (ENERGY DE TECT MEAN INDICATION REGISTER) R/HS/HC-00000000 EDMEAN<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7-0 EDMEAN<7:0>: Energy Detect Mean Indication Field bits Measured mean signal strength during ED/CCA measurement. TABLE 9-5: REGISTERS ASSOCIATED WITH CCA Names Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 OPSTATUS r MACOP<3:0> RFOP<2:0> CCACON1 CCABUSY CCAST RSSITHR<5:0> CCACON2 CSTHR<3:0> CCALEN<1:0> CCAMODE<1:0> EDMEAN EDMEAN<7:0> Legend: r = Reserved, read as ‘0’.

DS70005023B-page 214 Advanced  2011-2013 Microchip Technology Inc.

9.7 Physical Framing

Physical frame durations for the different data rates are shown in Table 9-6. Duration is expressed in payload byte time. Different frame data rates are recognized and pro- cessed based on the recognized SFD field of the PHY frame. Figure 4-6 describes the basic PHY frame struc- ture. The reception of the unwanted data rate frames can be disabled by RATECON<7:2> bits. TABLE 9-6: FRAME DURATION Frame Formats T [µs/byte] Duration expressed in payload byte time (T) Preamble SFD Length PHY payload Proprietary 125 kbps 64 4 1 1 N Standard 250 kbps 32 4 1 1 N Proprietary 500 kbps 16 4 1 1 N Proprietary 1 Mbps 8 4 1 1 N Proprietary 2 Mbps 4 8 2 1 N TABLE 9-7: USED SFD FIELDS FOR VARIOUS DATA RATES Preamble Type Data Rate Pattern Used SFD Field Fault Tolerance Optimal Pattern_2000 <SFD1, SFD6> Exact match required Pattern_1000 <SFD2, SFD7> Maximally two non-contiguous two-element burst error Pattern_500 SFD3 Exact match required Pattern_250 proprietary SFD4 Exact match required Pattern_250 standard 0xA7 Exact match required Pattern_125 <SFD5, SFD6> Maximally two faulty nibbles from four Legacy Pattern_2000 SFD1 Exact match required Pattern_1000 SFD2 Exact match required Pattern_500 SFD3 Exact match required Pattern_250 proprietary SFD4 Exact match required Pattern_250 standard 0xA7 Exact match required Pattern_125 <SFD5, SFD6> —

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 215 MRF24XA REGISTER 9-17: RATECON ( RATE CONFIGURATION REGISTER) R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-1 R/W-1 DIS2000 DIS1000 DIS500 DIS2 50 DISSTD DIS125 OPTIMAL PSAV bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 DIS2000: Disable 2 Mbps Frame Reception bit If this bit is set, then reception of 2 Mbps frames is disabled. bit 6 DIS1000: Disable 1 Mbps Frame Reception bit If this bit is set, then reception of 1 Mbps frames is disabled. bit 5 DIS500: Disable 500 kbps Frame Reception bit If this bit is set, then reception of 500 kbps frames is disabled. bit 4 DIS250: Disable 250 kbps Frame Reception bit If this bit is set, the reception of 250 kbps frames with non-standard-co mpliant SFD patterns is disabled. bit 3 DISSTD: Disable IEEE 802.15.4 compliant Frame Reception bit If this bit is set, then reception of 250 kbps frames with IEEE 802.15.4 compliant SFD patterns is disabled. bit 2 DIS125: Disable 125 kbps Frame Reception bit If this bit is set, then reception of 125 kbps frames is disabled. bit 1 OPTIMAL: Optimized Preamble Selection bit When this bit is set, then optimized preamble is used instead of legacy. 1 = Optimized preamble 0 = Legacy preamble bit 0 Out of scope

DS70005023B-page 216 Advanced  2011-2013 Microchip Technology Inc. REGISTER 9-18: SFD1 (START FRAME DELI MITER PATTERN 1 CONFIGURATION REGISTER) REGISTER 9-19: SFD2 (START FRAME DELIMITER PATTERN 2 CONFIGURATION REGISTER) R/W-00100001 SFD1<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-0 SFD1<7:0>: Start Frame Delimiter Pattern 1 Register Field bits This octet is used as SFD pattern with 2 Mbps rate when OPTIMAL = 0, and as the MSB of the SFD pattern with 2 Mbps rate when OPTIMAL = 1. When OPTIMAL = 0: The hexadecimal digits must be different from 0x 0 and different from the corresponding digits in SFD<k>, k = 2, 3, 4, 6, and the value 0xA7 is forbidden. When OPTIMAL = 1: The hexadecimal digits must be different from 0x0 and different from the corresponding digits of SFD2. R/W-11110001 SFD2<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-0 SFD2<7:0>: Start Frame Delimiter Pattern 2 Register Field bits This octet is used as SFD pattern with 1 Mbps rate when OPTIMAL = 0, and as the MSB of the SFD pattern with 1 Mbps rate when OPTIMAL = 1. When OPTIMAL = 0: The hexadecimal digits must be different from 0x 0 and different from the corresponding digits in SFD<k>, k = 1, 3, 4, 6, and the value 0xA7 is forbidden. When OPTIMAL = 1: The hexadecimal digits must be different from 0x0 and different from the corresponding digits of SFD1.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 217 MRF24XA REGISTER 9-20: SFD3 (START FRAME DELI MITER PATTERN 3 CONFIGURATION REGISTER) REGISTER 9-21: SFD4 (START FRAME DELI MITER PATTERN 4 CONFIGURATION REGISTER) R/W-00111011 SFD3<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-0 SFD3<7:0>: Start Frame Delimiter Pattern 3 Register Field bits This octet is used as SFD pattern with 500 kbps rate. When OPTIMAL = The hexadecimal digits must be different from 0x 0 and different from the corresponding digits in SFD<k>, k = 1, 2, 4, 6, and the value 0xA7 is forbidden. When OPTIMAL = 1: The hexadecimal digits must be different from 0x0. R/W-11100101 SFD4<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-0 SFD4<7:0>: Start Frame Delimiter Pattern 4 Register Field bits This octet is used as SFD pattern with 250 kbps ra te when proprietary MAC is in use, otherwise the pattern defined in the standard <1> is used instead, that is, 0xA7. The hexadecimal digits must be different from 0x0 and from the corresponding digits in SFD<k>, where, k = 1, 2, 3, 6 when OPTIMAL = 0. The value 0xA7 is forbidden.

DS70005023B-page 218 Advanced  2011-2013 Microchip Technology Inc. REGISTER 9-22: SFD5 (START FRAME DELI MITER PATTERN 5 CONFIGURATION REGISTER) REGISTER 9-23: SFD6 (START FRAME DELI MITER PATTERN 6 CONFIGURATION REGISTER) REGISTER 9-24: SFD7 (START FRAME DELI MITER PATTERN 7 CONFIGURATION REGISTER) R/W-01001101 SFD5<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-0 SFD5<7:0>: Start Frame Delimiter Pattern 5 Register Field bits This octet is used as the MSB of the SFD pattern with 125 kbps rate. R/W-10101000 SFD6<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-0 SFD6<7:0>: Start Frame Delimiter Pattern 6 Register Field bits This octet is used as the LSB of the SFD pattern with 125 kbps rate. When OPTIMAL = 1, this octet is used as the LSB of the SFD pattern with 2 Mbps rate. The hexadecimal digits must be different from 0x 0 and different from the corresponding digits in SFD<k>, k = 1, 2, 3, 4 when OPTIMAL = 0. The value 0xA7 is forbidden. R/W-11001000 SFD7<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-0 SFD7<7:0>: Start Frame Delimiter Pattern 7 Register Field bits When OPTIMAL = 1, this octet is used as the LSB of the SFD pattern with 1 Mbps rate.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 219 MRF24XA

9.8 Start-of-Frame Delimiter (SFD)

The following sections describe the SFD detection mechanism for the different data rates. Header processing is required to work at least as reli- ably as the demodulation. To meet this requirement, longer preamble and 16-bit SFD is defined for frames where the payload data rate is lower than the air data rate of the preamble.

9.8.1 SFD DETECTION AT 125 kbps

The input contains a nibble of bits decoded from the received DSSS symbol. This input is updated on every new DSSS symbol received. After each update the latest four received nibbles are compared against the nibbles contained in the 16-bit SFD pattern that has been configured by the host MCU. At least three out of four nibbles must match to trigger an SFD_FOUND event. SFD_TIMEOUT occurs if the latest five nibbles are different from “0000” (preamble lost) while SFD_FOUND is not triggered. Reception is reset on SFD_TIMEOUT. For the 125 kbps data rate the last decoded four nibbles and the nibbles of pattern_125 must match in at least three nibble positions.

9.8.2 SFD DETECTION AT 1 Mbps

The input contains a byte, which is updated on every new byte received after the first preamble byte has been detected (this identifies the byte boundary). The two latest received bytes form a word of 16 bits, denoted by W. SFD_FOUND event is reported if W exactly matches the host configured 16-bit preamble pattern (SFD), or if an approximate match is found with the following error patterns:

SFD XOR W = 110...0110…0 (two error bursts of length 2)
SFD XOR W = 10...0110…01 (single error burst of length 2, and single error on either or both ends) SFD XOR W = 0...0110…0 (single error burst of length 2)
SFD XOR W = 0...010…0 (single error) The rationale behind selecting these patterns is that the maximum-likelihood demodulator tends to produce error bursts of length 2 due to the trellis of the MSK modulation (this particular tolerance scheme seems to be novel). SFD_TIMEOUT event is reported if the latest three octets are different from 0x0F0F0F, while SFD_FOUND is not triggered. Reception is reset on SFD_TIMEOUT. At 1 Mbps the match tolerates single bit or maximum 2 non-contiguous 2-bit burst differences in the comparison of the last received 16 bits and pattern_1000 (simultaneously isolated single bit mismatches at both ends of the pattern constitute a single 2-bit mismatch burst).

DS70005023B-page 220 Advanced  2011-2013 Microchip Technology Inc.

9.9 Physical Transmissions

As TXST is set by the MCU, TXST = 1, transmitting starts by setting TXST to ‘ 1’. TXMAIF, TXSFDIF and RXSFDIF flags are handled. RXSFDIF is handled even with ACK. External PA/LNA is automatically handled. Refer to Section 9.13 “External Power Amplifier (PA)/ Low-Noise Amplifier (LNA)” for more information on this mode. Channel, data rate and link adaptation is based on retransmission, and the information is from the receiver. REGISTER 9-25: TXPOW (TRANSMIT POWER CONFIGURATION REGISTER)

9.10 Signal Detection (Power-Save

Listen Mode) In Power-Save Listen Mode only the RX front end cir- cuit is powered, the baseb and is switched off. In this mode, approximately 3 mA receive current can be saved. This mode can be used by setting the PSAV bit to ‘1’. R/W-000 R/W-11111 CHIPBOOST<2:0> TXPOW<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-5 CHIPBOOST<2:0>: TX Chip Boosting Field bits This field modifies the spectrum of the OQPSK transmission. bit 4-0 TXPOW<4:0>: TX Power Register Field bits This field allows configuring the TX power ranging from -17.5 to 0 dBm. Encoding: 10101 = 0 dBm 00001 = -17.5 dBm 00000 = PA OFF Note: In this mode, MRF24XA consumes less current that causes sensitivity degradation. TABLE 9-8: RECOMMENDED SETTINGS FOR POWER-SAVE LISTEN MODE Thresholds 125/250/ Legacy 500 kbps 1 Mbps 2 Mbps DesensThr 0x3 0x4 0x5 0x5 PsavThr 0x9 0xC 0xF 0xF

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 221 MRF24XA REGISTER 9-26: RATECON ( RATE CONFIGURATION REGISTER) R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-1 R/W-1 DIS2000 DIS1000 DIS500 DIS250 DISSTD DIS125 OPTIMAL PSAV bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 DIS2000: Disable 2 Mbps Frame Reception bit If this bit is set, then reception of 2 Mbps frames is disabled. bit 6 DIS1000: Disable 1 Mbps Frame Reception bit If this bit is set, then reception of 1 Mbps frames is disabled. bit 5 DIS500: Disable 500 kbps Frame Reception bit If this bit is set, then reception of 500 kbps frames is disabled. bit 4 DIS250: Disable 250 kbps Frame Reception bit If this bit is set, then reception of 250 kbps frames with non-standard-compliant SFD patterns is disabled. bit 3 DISSTD: Disable IEEE 802.15.4 compliant Frame Reception bit If this bit is set, th en reception of 250 kbps frames with IEEE 802.15.4 compliant SFD patterns is disabled. bit 2 DIS125: Disable 125 kbps Frame Reception bit If this bit is set, then reception of 125 kbps frames is disabled. bit 1 OPTIMAL: Optimized Preamble Selection bit When this bit is set, then optimized preamble is used instead of legacy. 1 = Optimized preamble 0 = Legacy preamble bit 0 PSAV: Power-Save Mode Selection bit When this bit is set, frame detection is dependent on the RSSI signal, and the receive signal processor is turned on when a sudden and significant increase (PSAVTHR<3:0>) is detected in the signal strength or the signal strength is above an absolute level (DESENSTHR<3:0>). 1 = Power-Save mode 0 = Hi-Sensitivity mode

DS70005023B-page 222 Advanced  2011-2013 Microchip Technology Inc. REGISTER 9-27: POWSAVE (POWER-SAVE CONFIGURATION REGISTER) R/W-1010 R/W-1010 DESENSTHR<3:0> PSAVTHR<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-4 DESENSTHR<3:0>: Desensitization Threshold Field bits This field defines an absolute level on the RSSI signal to activate receive signal processor if PSAV = 1. Unit is: 4 dB/LSB. Unsigned encoding is used. bit 3-0 PSAVTHR<3:0>: Frame Detection Threshold Register Field bits This field defines a relative (relative to the last 4 s RSSI value) threshold level on the RSSI signal to activate receive signal processor if and only if PSAV = 1. Unit is 0.5 dB/LSB. Unsigned encoding is used. TABLE 9-9: REGISTERS ASSOCIATED WITH POWER-SAVE LISTEN MODE Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 RATECON DIS2000 DIS1000 DIS500 DIS250 DISSTD DIS125 OPTIMAL PSAV POWSAVE DESENSTHR<3:0> PSAVTHR<3:0> Legend: r = Reserved, read as ‘0’.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 223 MRF24XA

9.11 AFC

AFC circuit of MRF24XA measures Carrier Frequency Offset (CFO), for all the received packets. The measured value is interpreted as the frequency offset between the two communicating nodes. REGISTER 9-28: CFOCON (CFO PRE COMPENSATION REGISTER) Note: AFC circuit stores CFO value in CFO- MEAS field after the SFD is detected and clears the field as the frame processing is finished and RXIF interrupt is generated. CFOTX is used as digital CFO compensa- tion for transmitting. CFORX is used as digital CFO compensation for receiving. R/W-0000 R/W-0000 CFOTX<3:0> CFORX<3:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-4 CFOTX<3:0>: TX Carrier Frequency Offset Field bits This value can be written by the host to compensate for the carrier frequency offset of the node during transmission. Pre-compensation allows using crystals with wider tolerances. Frequency Offset Unit is: 13 ppm/LSB. Two’s complement encoding. bit 3-0 CFORX<3:0>: RX Carrier Frequency Offset Field bits This value can be written by the host to pre-compensate the Carrier Frequency Offset estimation window (±55 ppm). Frequency Offset Unit is: 13 ppm/LSB. Two’s complement encoding.

DS70005023B-page 224 Advanced  2011-2013 Microchip Technology Inc. REGISTER 9-29: CFOMEAS (CFO MEASUREMENT INDICATION REGISTER)

9.12 Receive Status Vector (RSV) (1, 2)

The received packet can be extended by RSV, that gives extra information about the link. RSV bits can be individually enabled. R/W-00000000 CFOMEAS<7:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-0 CFOMEAS<7:0>: CFO Measurement Field bits If AFCOVR bit is cleared, then this register is written and valid when RXSFDIF is set with the value of the carrier frequency offset that was estimated during the acquisition of the packet. The host may use this value together with the LQI as a preamble quality indication (t he LQI is measured over the CFO compensated payload). If AFCOVR bit is set, this receiver will compensate the carrier frequency offset. Note that in this case, the CFO estimation algorithm is disabled, thus ±13 ppm CFO can be tolerated. CFORX has no effect when AFCOVR is set. Frequency Offset Unit is: ~1.62 ppm/LSB of the 2.4 GHz carrier. Two’s complement encoding is used.Note 1: LENGTH field of the packet is not affected by RSV. 2: LQI, RSSI, CHDR and CFO are the order of appending the CRC.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 225 MRF24XA REGISTER 9-30: RXCON1 (MAC RECEIVE CONTROL 1 REGISTER) R/W/HC/HS-0 R/W-0 R/W/HC-0 R/W-0 R/W-0 R/W-0 R/W-0 R-0 RXEN NOPA RXDEC RSVLQIEN RSVRSSIEN RSVCHDREN RSVCFOEN r bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 RXEN: Receive Enable Field bit This bit enables/disables the packet reception. If an RX packet is currently being received, clearing this bit will cause that packet to be discarded. 1 = RX enabled 0 = RX disabled Hardware clear/set when:

Cleared when TRXMODE is set to TX-Streaming mode
Set when TRXMODE is set to RX-Streaming mode Clearing this bit will abort the current operation in the following cases:
Receiving a packet in Packet mode or in RX-Streaming mode The most RX related settings should only be changed while this bit is cleared. The clear channel assessment (CSMAEN) and ACK-frame reception does not require RXEN = 1, because the device will turn the radio into RX when needed, irrespective of the status of the RXEN bit. bit 6 NOPA: No Parsing bit This bit will disable packet parsing. Only CRC will be checked, if it is enabled. This feature is useful in Sniffer mode. 1 = Disable packet parsing 0 = Enable packet parsing bit 5 RXDEC: RX Decryption bit Setting this bit will start RX security processing (authentication and/or decryption) on the last received packet. 1 = RX security processing started/in process. RXDECIF or RXTAGIF is set. 0 = RX security processing inactive or complete This bit will clear itself after RX decryption has completed. bit 4 RSVLQIEN: Receive Status Vector LQI Enable bit If bit is set, the measured Link Quality is appended after the received frame in the packet buffer. 1 = Append LQI field 0 = Do not append LQI field bit 3 RSVRSSIEN: Receive Status Vector RSSI Enable bit If bit is set, the measured RSSI is appended after the received frame in the packet buffer. 1 = Append RSSI field 0 = Do not append RSSI field bit 2 RSVCHDREN: Receive Status Vector Channel/MAC Type/Data Rate Enable bit If bit is set, Channel, MAC type and Data Rate configurations used with the received frame are appended after the received frame in the packet buffer, using the encoding specified for CH<3:0>, FRMFMT and DR<2:0> (concatenated in this order when MSb is first). 1 = Append Channel, MAC type and Data Rate fields 0 = Do not append Channel, MAC type and Data Rate fields

DS70005023B-page 226 Advanced  2011-2013 Microchip Technology Inc.

9.13 External Power Amplifier (PA)/

Low-Noise Amplifier (LNA) MRF24XA has a PA control pin (pin 20) and an LNA control pin (pin 21) to handle external PAs and LNAs or external antenna switch circuits. MRF24XA can also tolerate different start up times of different external cir- cuits by sending or accepting data just if the external circuits have completed their ramp up. MRF24XA can handle both active-high or active-low control signal sensitive circuits.

9.13.1 EXTERNAL PA HANDLING

MRF24XA can switch ON and OFF external PA circuits automatically as the internal functionalities require to transmit any signal. PA pin is automatically set to its preset active state as external PA is needed and set back to its inactive state if PA is not needed. To enable external PA handling, PAEN bit of EXTPA register must be set to ‘1’. The active state of PA control line can be set by EXTPAP bit. The current value of EXTPAP bit is the active state of the PA line. RFOP<2:0>, field of the Radio Operation Register shows the status of the radio and external PA.

9.13.1.1 PA Switch Time Management

MRF24XA can be used with various external PA cir- cuits. Different PA circuits might have different start-up time constraints to reach the steady state. MRF24XA can manage to start transmitting if both the internal and external PA circuits are ready to operate. TX2TXMA<4:0>, Transmit Power-up to Medium Access Configuration, defines the time delay that MRF24XA waits after powering on the internal PA before sending any data to transmit. Its POR default value is calculated to cover most of the cases, but user can redefine its value if needed. PA2TXMA<4:0>, External Power Amplifier Power-up to Medium Access Configuration, defines the time delay that MRF24XA waits after powering on the external PA before sending any data to transmit. Figure 9-5 illustrates the method of PA time management of MRF24XA. FIGURE 9-5: PA ACC ESS TIME MANAGEMENT bit 1 RSVCFOEN: Receive Status Vector CFO Enable bit If bit is set, the estimated Carrier Frequency Offs et of the received frame is appended after the received frame in the packet buffer, using the same encoding as CFOMEAS register. 1 = Append CFO estimation 0 = Do not append estimated CFO bit 0 Reserved: Maintain as ‘0’ REGISTER 9-30: RXCON1 (MAC RECEIVE CONTROL 1 REGISTER) (CONTINUED) Switching ON External PA Switching ON Internal PA Start Transmitting T0T0 - PA2TXMAT0 - TX2TXMA

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 227 MRF24XA

9.13.2 EXTERNAL LNA HANDLING

MRF24XA can switch ON and OFF external LNA circuit automatically as the inter nal functionalities require receiving. LNA pin is automatically set to its predefined active state as external LNA circuit is needed, and set back to its inactive state if LNA is not needed. To enable external LNA handling, LNAEN bit of the EXTLNA register must be set to ‘1’. The active state of LNA line can be set by EXTLNAP bit. The actual value of EXTLNAP bit is the active state of the LNA line. MRF24XA can be programmed to delay signal receiv- ing after powering on the external LNA circuit. It allows to optimize the power consumption to the startup time of the external LNA circuit. LNADLY<4:0> defines the time delay between LNA power up and the start of sig- nal reception. The time base is 1 µs. Higher LNADLY value means longer wait before starting reception. RFOP<2:0> field of the Radio Operation register shows the status of the radio and external LNA. REGISTER 9-31: OPSTATUS (OPERATION STATUS) R-0 R/HS/HC-0 R/HS/HC-0 R/HS/HC-0 R/ HS/HC-0 R/HS/HC-0 R/HS/HC-0 R/HS/HC-0 r MACOP<3:0> RFOP<2:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved HC = Hardware Clear HS = Hardware Set bit 7 Reserved: Maintain as ‘0’ bit 6-3 Out of scope bit 3 RFOP <2:0>: Radio Operation Register Field bits Provides status information on the current Radio state. Encoding on RFOP<2:0>: 111 = TX with external PA is turned on (TX+PA) 110 = RX with external LNA is turned on (RX+LNA) 101 = Synthesizer and external PA or LNA is turned on (SYNTH+PA/LNA)

DS70005023B-page 228 Advanced  2011-2013 Microchip Technology Inc. REGISTER 9-32: TX2TXMA (TRANSMIT POWE R-UP TO MEDIUM ACCESS CONFIGURATION REGISTER) R-0 R/W-00011 r TX2TXMA<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7-5 Reserved: Maintain as ‘ 0’ bit 4-0 TX2TXMA<4:0>: Transmit Power-Up to Medium Access Configuration Field bits Defines the time interval between turning on the transmitter of the device and the start time of medium access (start of the PHY-layer frame). TX_TO_TXMA = The transient time of the transmitter, in the following scenarios: PAEN = 0 PAEN = 1, but the PA is turned on first. PA_TO_TXMA = TX_TO_TXMA + PA transient time. PAEN = 1, but the TX and PA transients are NOT sequenced. TX_TO_TXMA = The transient time of the transmitter + PA_TO_TXMA: PAEN = 1, and the transmitter is turned on first (transients are sequenced). Representation: 1 s/1 LSB. No offset.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 229 MRF24XA REGISTER 9-33: EXTPA (EXTERNAL POWE R AMPLIFIER CONFIGURATION REGISTER) R-0 R/W-0 R/W-0 R/W-00100 r EXTPAP PAEN PA2TXMA<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 Reserved: Maintain as ‘0’ bit 6 EXTPAP: External Power Amplifier Polarity bit 1 = 3.3V turns Power Amplifier ON 0 = GND turns Power Amplifier ON bit 5 PAEN: External Power Amplifier Enable bit This bit enables the PA pin to output the control signal for external Power Amplifier. bit 4-0 PA2TXMA<4:0>: External Power Amplifier Power-up to Medium Access Configuration Field bits Defines the time interval between turning on the external PA of the device and the start time of medium access (start of the PHY-layer frame). PA_TO_TXMA = The transient time of the external PA, in the following scenarios: PAEN = 1, and the transmitter is turned on first. TX_TO_TXMA = PA_TO_TXMA + TX transient time. PAEN = 1, but the TX and PA transients are NOT sequenced. PA_TO_TXMA = The transient time of the PA + TX_TO_TXMA: PAEN = 1, and the external power amplifier is turned on first (Transients are sequenced). Representation: 1 s/1 LSB. No offset

DS70005023B-page 230 Advanced  2011-2013 Microchip Technology Inc. REGISTER 9-34: EXTLNA (EXTERNAL LOW-NO ISE AMPLIFIER CONFIGURATION REGISTER) Legend: r = Reserved, read as ‘0’. R-0 R/W-0 R/W-0 R/W-00100 r EXTLNAP LNAEN LNADLY<4:0> bit 7 bit 0 Legend: R = Readable bit W = Writable bit U = Unimplemented bit, read as ‘0’ -n = Value at POR ‘1’ = Bit is set ‘0’ = Bit is cleared x = Bit is unknown r = Reserved bit 7 Reserved: Maintain as ‘0’ bit 6 EXTLNAP: External Low Noise Amplifier Polarity bit 1 = 3.3V turns Low-Noise Amplifier ON 0 = GND turns Low-Noise Amplifier ON bit 5 LNAEN: External Low-Noise Power Amplifier Enable bit This bit enables the LNA pin to output the control signal for external Low-Noise Amplifier. bit 4-0 LNADLY<4:0>: External Low-Noise Amplifier Power-Up Transient Delay Field bits Defines the duration between turning on the LNA and the time when the reception is valid. LNA and receiver are turned on together. The longer transient is awaited before input signal is accepted as valid. Representation: 1 s/1 LSB. No offset. TABLE 9-10: REGISTERS ASSOCIAT ED WITH EXTERNAL PA AND LNA 76 5 4 3 2 10 OPSTATUS r MACOP<3:0> RFOP<2:0> TX2TXMA rT X 2 T X M A < 4 : 0 > EXTPA r EXTPAP PAEN PA2TXMA<4:0> EXTLNA r EXTLNAP LNAEN LNADLY<4:0>

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 231 MRF24XA

10.0 BATTERY LIFE OPTIMIZATION

In a battery operated application, the device wakes up only when it needs to transmit or requires to poll for data. Polling is used for data reception as a means to synchronize the re motely transmitting node to the wake-up event in the receiver. Between transmission and reception the device should be held in Deep Sleep mode drawing less current than the battery self-discharge, which is about 1 µA. Register contents and internal calibration state are maintained in Deep Sleep mode for efficient power mode changes. Long battery life is achieved through low currents in each state of the device and a series of system features that contribute to minimize the duration required for transmit or receive. The following enhanced features are used to minimize radio ON-time:

High air-data-rates to minimize the packet duration
Automatic, on-the-fly, per-frame, air-data-rate adaptation in the receiver, allowing the transmitter to select the highest data rate that fits the quality of the link
Minimized framing overheads in both the PHY and the MAC layers
Minimized ramp-up and turnaround times
Short, still reliable channel assessment
Automatically handled TX and RX signal paths
Inferred destination addressing On-the-fly, per-frame air-data-rate detection is the capability of the receiver to synchronize to the transmit- ter data rate without knowing the sender of the frame and the expected data rate in advance. On-the-fly, per-frame, air-data-rate dete ction gives the following advantages:
Each low-power node can use the highest data rate allowed by its link quality to save its battery charge. The evaluation of the link quality requires MCU interaction.
Multiple data rates can be used within the same network. As opposed to conventional protocols supporting the simultaneous use of multiple air-data-rates in the net- work traffic, the frame header, which encodes the pay- load data rate, does not have to use the lowest data rate. Without this feature either the worst link would define the air data-rate that all nodes have to use, or each node would have to use the lowest data rate for the frame header, which would severely compromise the throughput and battery efficiency of the highest rates. Passive listening, channel assessment and the dura- tion of the turnaround between transmit and receive contribute to the power consumption. In this regard, MRF24XA excels by minimized TX-to- RX turnaround durations, fast but reliable channel assessment and short PLL and AGC ramp-up dura- tions. Power modes are sequenced automatically dur- ing CSMA sending by the internal state machines of the device without interaction from the MCU. These mechanisms can optionally control external PA and LNA. The Message Chart in Figure 10-1 illustrates a typical wake-up cycle: 1. While the low-power device is in Deep Sleep mode, the coordinator listens to the channel and buffers any messages addressed to the low-power node. 2. The low-power node wakes up when it needs to transmit, or periodically to poll the coordinator for any pending data. 3. First, the low-power node sends a poll command to the coordinator and any data it needs to send. 4. Low-power node can go back to Deep Sleep mode as soon as it gets an ACK unless the coor- dinator has buffered pending data. This condi- tion is indicated in a specific bit field of the acknowledge frame that the coordinator is sending. 5. In the case of pending data, the low-power node may want to turn off the radio for a pre- determined duration allowing the coordinator to retrieve the pending data for sending. 6. Finally, the coordinator goes to Receive mode to get the pending data. On successful reception, it turns to transmit to send an ACK and returns to Deep Sleep mode. 7. Time-outs ensure that the low-power node does not stay powered-up forever in the case when the coordinator fails to respond in any of the transactions above. As indicated on the right side of Figure 10-1all the radio activities are kept as short as possible by the device to be able to return to Deep Sleep mode as fast as possible. As a result, the average current consumption can be reduced by multiple factors in comparison to the stan- dard IEEE 802.15.4 operation. The comparison is done for three corner cases, as given below:
Table 10-1 for polling without pending data Table 10-2 for polling with 80 octets pending data
Table 10-3 for the transmission of 80 octets A combination of the three cases allow evaluating the energy budget of complex scenarios. A yearly 10 mAh is to be added for battery self-discharge and Deep Sleep mode. Equation 10-1 shows the self discharge current calculation. The c onsumption of the MCU and any sensors, displays needs to be added.

DS70005023B-page 232 Advanced  2011-2013 Microchip Technology Inc. The enhanced MAC and PHY feature set also compresses the frame header time to achieve the shortest possible radio ON-time. EQUATION 10-1: BATTERY SELF-DISCHARGE The discharge caused by 1 µA average current over one year: 1µA x 1 year = 8.76 mAh TABLE 10-1: POLLING FOR PENDING DATA – NO PENDING DATA IS AVAILABLE (1) Wake-up Consumed Battery Charge Unit Mode Period 2 Mbps Extended Data Rate

802.15.4 Compliant

Single wake-up per wake-up 4480 17450 mA*µs = nC Yearly average while waking up regularly in every 1s 39.3 152.9 mAh/year = µA 20s 2 7.6 mAh/year = µA 1 min 0.7 2.5 mAh/year = µA 5 min 0.1 0.5 mAh/year = µA Note 1: The calculations are strongly depended on the used protocol. It may happen that a given protocol cannot produce the listed battery life values. TABLE 10-2: POLLING FOR PENDING DATA – 80 OCTETS OF PENDING DATA RECEIVED(1) Wake-up Consumed Battery Charge UnitMode Period 2 Mbps Extended Data Rate Single wake-up per wake-up 12030 62620 mA*us = nC Yearly average while waking up regularly in every 1s 163.7 936.7 mAh/year = µA 20s 8.2 46.8 mAh/year = µA 1 min 2.7 15.6 mAh/year = µA 5 min 0.5 3.1 mAh/year = µA Note 1: The calculations are strongly depended on the used protocol. It may happen that a given protocol cannot produce the listed battery life values. TABLE 10-3: POLLING FOR PENDING DATA – T RANSMITTING 80 OCTETS TO COORDINATOR (AS PIGGYBACK DATA – NO PENDING RECEIVED DATA)(1) Wake-up Consumed Battery Charge UnitMode Period 2 Mbps Extended Data Rate Single wake-up per wake-up 10560 66090 mA*us = nC Yearly average while waking up regularly in every 1s 92.5 579 mAh/year = µA 20s 4.6 28.9 mAh/year = µA 1 min 1.5 9.6 mAh/year = µA 5 min 0.3 1.9 mAh/year = µA Note 1: The calculations are strongly depended on the used protocol. It may happen that a given protocol cannot produce the listed battery life values.

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 233 MRF24XA FIGURE 10-1: MRF24XA POWER MODES D URING DATA POLLING (MESSAGE SEQUENCE CHART) Coordinator (mains powered) Low-power (battery powered) Listen/ Receive POLL for pending data (+ optional piggyback data) Acknowledge + indicate if data is pending Pending DATA MCU retrieves the data to send and loads it for transmission Waits for data retrieval (fixed duration) TX/RX OFF Listen/Receive Duration is... Deep Sleep maximized Wake-up minimized Clear channel assessment RX-to-TX Transmit TX-to-RX Listen/ Receive If data is NOT pending then Deep Sleep else TRXOFF-to-RX (start PLL) minimized by high data rate and low framing overhead TX/RX OFF minimized by zero-IF architecture minimized by high data rate and low framing overhead minimized by zero- IF architecture minimized by sensitive detector minimized by high data rate and low framing overhead Listen/ Receive RX-to-TX Transmit minimized by zero- IF architecture minimized by high data rate and low framing overhead Acknowledge

DS70005023B-page 234 Advanced  2011-2013 Microchip Technology Inc. NOTES:

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 235 MRF24XA

11.0 ELECTRICAL CHARACTERISTICS

Note: Stresses above those listed under “Absolute Ma ximum Ratings” may cause permanent damage to the device. This is a stress rating only and functional operation of the device at those or any other conditions above those indicated in the operation listings of this specification is not implied. Exposure to maximum rating conditions for extended periods may affect device reliability. TABLE 11-1: RECOMMENDED OPERATING CONDITIONS Parameter Min. Typ Max. Units Ambient Operating Temperature -40 +25 +85 °C Supply Voltage for RF, analog (AVDD) and digital circuits (DVDD) 1.08 1.2 1.32 V Supply Voltage for LDO Input (pin 30) and digital I/O (pin 23) 1.5 3.3 3.6 V Input High Voltage (VIH) 0.65 x V DD —V DD +0.3 V Input Low Voltage (VIL) -0.3 — 0.35 x V DD V TABLE 11-2: CURRENT CONSUMPTION Typical Values: TA = 25°C, VDD = 3.3V Operating mode Condition Min. Typ Max. Units Deep Sleep All GPIO pins are grounded — 40 — nA Sleep — — 0.3 — mA Crystal ON — — 1 — mA Synthesizer ON — — 7 — mA RX Listen Power-Save All data rates — 13.5 — mA RX Listen All data rates — 16.5 — mA RX Packet Demodulation 1 Mbps or 2 Mbps — 15.5 — mA RX Packet Demodulation 500 kbps, 250 kbps or 125 kbps — 16.5 — mA TX at maximum power — 25 — mA

DS70005023B-page 236 Advanced  2011-2013 Microchip Technology Inc. TABLE 11-3: RECEIVER CHARACTERISTICS Typical Values: TA = 25°C, VDD = 3.3V Parameters Condition Min. Typ Max. Units RF Input Frequency — 2.405 — 2.480 GHz RF Sensitivity Data Rate: 250 kbps, PER 1% — -95 — dBm 125 kbps at 0 ppm CFO — -103 — at +/- 110 ppm CFO — -100 — 250 kbps at 0 ppm CFO — -100 — at +/- 110 ppm CFO — -99 — 500 kbps: Legacy and Optimal framing — — — at 0 ppm CFO — -97 — at +/- 110 ppm CFO — -96 —

1 Mbps: Legacy framing — — —

at 0 ppm CFO — -92 — at +/- 110 ppm CFO — -92 — Optimal framing — — — at 0 ppm CFO — -91 — at +/- 85 ppm CFO — -89 —

2 Mbps: Legacy framing — — —

at 0 ppm CFO — -88 — at +/- 110 ppm CFO — -88 — Optimal framing — — — at 0 ppm CFO — -87 — at +/- 85 ppm CFO — -86 — Maximum RF Input — — -10 — dBm LO Leakage Measured at balun matching network input at frequency 2.405 GHz-2.48 GHz — T B D — d B m Adjacent Channel Rejection at ±5 MHz — 32 — dB Alternate Channel Rejection at ±10 MHz — 45 — dB RSSI Range — — 75 — dB RSSI Error — — — ± 5 dB TABLE 11-4: TRANSMITTER CHARACTERISTICS Typical Values: TA = 25°C, VDD = 3.3V Parameters Condition Min. Typ Max. Units RF Carrier Frequency — 2.405 — 2.480 GHz Maximum RF Output Power — — 0 — dBm RF Output Power Control Range — — 17.5 — dB Carrier Suppression — — TBD — dBc TX Spectrum Mask for O-QPSK Signal Offset frequency >3.5 MHz, at 0 dBm output power — - 3 5— d B m TX EVM — — TBD — %

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 237 MRF24XA FIGURE 11-1: EXAMPLE SPI SLAVE MODE TIMING TABLE 11-5: EXAMPLE SLAVE MODE REQUIREMENTS Parameter Number Symbol Characteristic Min. Max. Units

70 T SSL2SCHC S ↓ to SCK ↑ Input 50 — ns

71 T SCH SCK Input High Time 50 — ns

72 T SCL SCK Input Low Time 50 — ns

74 T SCH2DIL Hold Time of SDI Data Input to SCK Edge 25 — ns

75 T DOR SDO Data Output Rise Time — 25 ns

76 T DOF SDO Data Output Fall Time — 25 ns

78 T SCR SCK Output RiseTime — 25 ns

80 T SCH2DOV, TSCL2DOV SDO Data Output Valid after SCK Edge 50 — ns

82 T SSL2DOV SDO Data Output Valid after NCS ↓ Edge 50 — ns

83 T SSL2SSH NCS ↑ after SCK Edge 50 — ns

DS70005023B-page 238 Advanced  2011-2013 Microchip Technology Inc. NOTES:

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 239 MRF24XA

12.0 PACKAGING INFORMATION

Note: This section will be updated in a future revision of this document.

DS70005023B-page 240 Advanced  2011-2013 Microchip Technology Inc. NOTES:

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 241 MRF24XA APPENDIX A: REVISION HISTORY Revision A (August 2011) This is the initial released version of the document. Revision B (March 2013) Major formatting and text updates have been incorporated throughout the document

DS70005023B-page 242 Advanced  2011-2013 Microchip Technology Inc. NOTES:

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 243 MRF24XA THE MICROCHIP WEB SITE Microchip provides online support through our WWW site at www.microchip.com. This web site is used as a means to make files and information easily available to customers. Accessible by using your favorite Internet browser, the web site contains the following information:

Product Support – Data sheets and errata, application notes and sample programs, design resources, user’s guides and hardware support documents, latest software releases and archived software
General Technical Support – Frequently Asked Questions (FAQs), technical support requests, online discussion groups, Microchip consultant program member listing
Business of Microchip – Product selector and ordering guides, latest Microchip press releases, listing of seminars and events, listings of Microchip sales offices, distributors and factory representatives CUSTOMER CHANGE NOTIFICATION SERVICE Microchip’s customer notification service helps keep customers current on Microchip products. Subscribers will receive e-mail notification whenever there are changes, updates, revisions or errata related to a spec- ified product family or development tool of interest. To register, access the Microchip web site at www.microchip.com. Under “Support”, click on “Customer Change Notification” and follow the registration instructions. CUSTOMER SUPPORT Users of Microchip products can receive assistance through several channels:
Distributor or Representative
Local Sales Office
Field Application Engineer (FAE)
Technical Support
Development Systems Information Line Customers should contact their distributor, representative or field application engineer (FAE) for support. Local sales offices are also available to help customers. A listing of sa les offices and locations is included in the back of this document. Technical support is available through the web site at: http://microchip.com/support

DS70005023B-page 244 Advanced  2011-2013 Microchip Technology Inc. READER RESPONSE It is our intention to provide you with the best document ation possible to ensure succe ssful use of your Microchip product. If you wish to provide your comments on organiz ation, clarity, subject matter, and ways in which our documentation can better serve you, please FAX your comments to the Technical Publications Manager at (480) 792-4150. Please list the following information, and use this outline to provide us with your comments about this document. TO: Technical Publications Manager RE: Reader Response From: Name Company Address City / State / ZIP / Country Application (optional): Would you like a reply? Y N Device: Literature Number: Questions: DS700050MRF24XA 1. What are the best features of this document? 2. How does this document meet your hardware and software development needs? 3. Do you find the organization of this document easy to follow? If not, why? 4. What additions to the document do you th ink would enhance the structure and subject? 5. What deletions from the document could be made without affecting the overall usefulness? 6. Is there any incorrect or misleading information (what and where)? 7. How would you improve this document?

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 245 MRF24XA PRODUCT IDENTIFICATION SYSTEM To order or obtain information, for example, on pricing or delivery, refer to the factory or the listed sales office. PART NO. X T -X TemperatureTape and ModuleDevice Device MRF24XA; VDD range 1.5V to 3.6V Temperature Range I = -40º C to +85º C (Industrial) Example: a) MRF24XA -I/ = Industrial temp. tray. module RangeReel Type

DS70005023B-page 246 Advanced  2011-2013 Microchip Technology Inc. NOTES:

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 247 MRF24XA INDEX A C D E I L M P R S W

 2011-2013 Microchip Technology Inc. Advanced DS70005023B-page 248 NOTES:

 2011-2013 Microchip Technology Inc. DS70005023B-page 249 Information contained in this publication regarding device applications and the like is provided only for your convenience and may be superseded by updates. It is your responsibility to ensure that your application me ets with your specifications. MICROCHIP MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND WHETHER EXPRESS OR IMPLIED, WRITTEN OR ORAL, STATUTORY OR OTHERWISE, RELATED TO THE INFORMATION, INCLUDING BUT NOT LIMITED TO ITS CONDITION, QUALITY , PERFORMANCE, MERCHANTABILITY OR FITNESS FOR PURPOSE . Microchip disclaims all liability arising from this information and its use. Use of Microchip devices in life support and/or safety applications is entirely at the buyer’s risk, and the buyer agrees to defend, indemnify and hold harmless Microchip from any and all damages, claims, suits, or expenses resulting fr om such use. No licenses are conveyed, implicitly or ot herwise, under any Microchip intellectual property rights. Trademarks The Microchip name and logo, the Microchip logo, dsPIC, FlashFlex, KEELOQ, KEELOQ logo, MPLAB, PIC, PICmicro, PICSTART, PIC32 logo, rfPIC, SST, SST Logo, SuperFlash and UNI/O are registered trademarks of Microchip Technology Incorporated in the U.S.A. and other countries. FilterLab, Hampshire, HI-TECH C, Linear Active Thermistor, MTP, SEEVAL and The Embedded Control Solutions Company are registered trademarks of Microchip Technology Incorporated in the U.S.A. Silicon Storage Technology is a registered trademark of Microchip Technology Inc. in other countries. Analog-for-the-Digital Age, Application Maestro, BodyCom, chipKIT, chipKIT logo, CodeGuard, dsPICDEM, dsPICDEM.net, dsPICworks, dsSPEAK, ECAN, ECONOMONITOR, FanSense, HI-TIDE, In-Circuit Serial Programming, ICSP, Mindi, MiWi, MPASM, MPF, MPLAB Certified logo, MPLIB, MPLINK, mTouch, Omniscient Code Generation, PICC, PICC-18, PICDEM, PICDEM.net, PICkit, PICtail, REAL ICE, rfLAB, Select Mode, SQI, Serial Quad I/O, Total Endurance, TSHARC, UniWinDriver, WiperLock, ZENA and Z-Scale are trademarks of Microchip Technology Incorporated in the U.S.A. and other countries. SQTP is a service mark of Microchip Technology Incorporated in the U.S.A. GestIC and ULPP are registered trademarks of Microchip Technology Germany II GmbH & Co. & KG, a subsidiary of Microchip Technology Inc., in other countries. All other trademarks mentioned herein are property of their respective companies. © 2011-2013, Microchip Technology Incorporated, Printed in the U.S.A., All Rights Reserved. Printed on recycled paper. ISBN: 978-1-62077-120-4 Note the following details of the code protection feature on Microchip devices:

Microchip products meet the specification cont ained in their particular Microchip Data Sheet.
Microchip believes that its family of products is one of the mo st secure families of its kind on the market today, when used in the intended manner and under normal conditions.
There are dishonest and possibly illegal meth ods used to breach the code protection feature. All of these methods, to our knowledge, require using the Microchip products in a manner outside the operating specifications contained in Microchip’s Data Sheets. Most likely, the person doing so is engaged in theft of intellectual property.
Microchip is willing to work with the customer who is concerned about the integrity of their code.
Neither Microchip nor any other semiconduc tor manufacturer can guarantee the security of their code. Code protection does not mean that we are guaranteeing the product as “unbreakable.” Code protection is constantly evolving. We at Microchip are committed to continuously improving the code protection features of our products. Attempts to break Microchip’s code protection feature may be a violation of the Digital Millennium Copyright Act. If such acts allow unauthorized access to your software or other copyrighted work, you may have a right to sue for relief under that Act. Microchip received ISO/TS-16949:2009 certification for its worldwide headquarters, design and wafer fabrication facilities in Chandler and Tempe, Arizona; Gresham, Oregon and design centers in California and India. The Company’s quality system processes and procedures are for its PIC ® MCUs and dsPIC® DSCs, KEELOQ® code hopping devices, Serial EEPROMs, microperipherals, nonvolatile memory and analog products. In addition, Microchip’s quality system for the design and manufacture of development systems is ISO 9001:2000 certified. QUALITY MANAGEMENT SYSTEM CERTIFIED BY DNV == ISO/TS 16949 ==

DS70005023B-page 250  2011-2013 Microchip Technology Inc. AMERICAS Corporate Office 2355 West Chandler Blvd. Chandler, AZ 85224-6199 Tel: 480-792-7200 Fax: 480-792-7277 Technical Support: http://www.microchip.com/ support Web Address: www.microchip.com Atlanta Duluth, GA Tel: 678-957-9614 Fax: 678-957-1455 Boston Westborough, MA Tel: 774-760-0087 Fax: 774-760-0088 Chicago Itasca, IL Tel: 630-285-0071 Fax: 630-285-0075 Cleveland Independence, OH Tel: 216-447-0464 Fax: 216-447-0643 Dallas Addison, TX Tel: 972-818-7423 Fax: 972-818-2924 Detroit Farmington Hills, MI Tel: 248-538-2250 Fax: 248-538-2260 Indianapolis Noblesville, IN Tel: 317-773-8323 Fax: 317-773-5453 Los Angeles Mission Viejo, CA Tel: 949-462-9523 Fax: 949-462-9608 Santa Clara Santa Clara, CA Tel: 408-961-6444 Fax: 408-961-6445 Toronto Mississauga, Ontario, Canada Tel: 905-673-0699 Fax: 905-673-6509 ASIA/PACIFIC Asia Pacific Office Suites 3707-14, 37th Floor Tower 6, The Gateway Harbour City, Kowloon Hong Kong Tel: 852-2401-1200 Fax: 852-2401-3431 Australia - Sydney Tel: 61-2-9868-6733 Fax: 61-2-9868-6755 China - Beijing Tel: 86-10-8569-7000 Fax: 86-10-8528-2104 China - Chengdu Tel: 86-28-8665-5511 Fax: 86-28-8665-7889 China - Chongqing Tel: 86-23-8980-9588 Fax: 86-23-8980-9500 China - Hangzhou Tel: 86-571-2819-3187 Fax: 86-571-2819-3189 China - Hong Kong SAR Tel: 852-2401-1200 Fax: 852-2401-3431 China - Nanjing Tel: 86-25-8473-2460 Fax: 86-25-8473-2470 China - Qingdao Tel: 86-532-8502-7355 Fax: 86-532-8502-7205 China - Shanghai Tel: 86-21-5407-5533 Fax: 86-21-5407-5066 China - Shenyang Tel: 86-24-2334-2829 Fax: 86-24-2334-2393 China - Shenzhen Tel: 86-755-8203-2660 Fax: 86-755-8203-1760 China - Wuhan Tel: 86-27-5980-5300 Fax: 86-27-5980-5118 China - Xian Tel: 86-29-8833-7252 Fax: 86-29-8833-7256 China - Xiamen Tel: 86-592-2388138 Fax: 86-592-2388130 China - Zhuhai Tel: 86-756-3210040 Fax: 86-756-3210049 ASIA/PACIFIC India - Bangalore Tel: 91-80-3090-4444 Fax: 91-80-3090-4123 India - New Delhi Tel: 91-11-4160-8631 Fax: 91-11-4160-8632 India - Pune Tel: 91-20-2566-1512 Fax: 91-20-2566-1513 Japan - Osaka Tel: 81-66-152-7160 Fax: 81-66-152-9310 Japan - Yokohama Tel: 81-45-471- 6166 Fax: 81-45-471-6122 Korea - Daegu Tel: 82-53-744-4301 Fax: 82-53-744-4302 Korea - Seoul Tel: 82-2-554-7200 Fax: 82-2-558-5932 or 82-2-558-5934 Malaysia - Kuala Lumpur Tel: 60-3-6201-9857 Fax: 60-3-6201-9859 Malaysia - Penang Tel: 60-4-227-8870 Fax: 60-4-227-4068 Philippines - Manila Tel: 63-2-634-9065 Fax: 63-2-634-9069 Singapore Tel: 65-6334-8870 Fax: 65-6334-8850 Taiwan - Hsin Chu Tel: 886-3-5778-366 Fax: 886-3-5770-955 Taiwan - Kaohsiung Tel: 886-7-213-7828 Fax: 886-7-330-9305 Taiwan - Taipei Tel: 886-2-2508-8600 Fax: 886-2-2508-0102 Thailand - Bangkok Tel: 66-2-694-1351 Fax: 66-2-694-1350 EUROPE Austria - Wels Tel: 43-7242-2244-39 Fax: 43-7242-2244-393 Denmark - Copenhagen Tel: 45-4450-2828 Fax: 45-4485-2829 France - Paris Germany - Munich Tel: 49-89-627-144-0 Fax: 49-89-627-144-44 Italy - Milan Tel: 39-0331-742611 Fax: 39-0331-466781 Netherlands - Drunen Tel: 31-416-690399 Fax: 31-416-690340 Spain - Madrid Tel: 34-91-708-08-90 Fax: 34-91-708-08-91 UK - Wokingham Tel: 44-118-921-5869 Fax: 44-118-921-5820 Worldwide Sales and Service 10/26/12

Product Information

MRF24XA specifications and overview.

Summary

Low-Power, 2.4 GHz ISM-Band IEEE 802.15.4??RF Transceiver with Extended Proprietary Features

Description

Low-Power, 2.4 GHz ISM-Band IEEE 802.15.4??RF Transceiver with Extended Proprietary Features

Source title MRF24XA Datasheet(PDF) - Texas Instruments

Related Parts

More parts from the same family.

Browse manufacturer