CC1010 CC1010 Single Chip Very Low Power RF Transceiver with 8051-Compatible Microcontroller Applications • Very low power UHF wireless data • RKE – Remote Keyless Entry with transmitters and receivers acknowledgement • 315 / 433 / 868 and 915 MHz ISM/SRD • Low power telemetry band systems • Toys • Home automation and security • AMR – Automatic Meter Reading Product Description The CC1010 is a true single-chip UHF transceiver with an integrated high performance 8051 microcontroller with 32 kB of Flash program memory. The RF transceiver can be programmed for operation in the 300 – 1000 MHz range, and is designed for very low power wireless applications. The CC1010 together with a few external passive components constitutes a powerful embedded system with wireless communication capabilities. CC1010 is based on Chipcon’s SmartRF®02 technology in 0.35 µm CMOS. Key Features • 300-1000 MHz RF Transceiver • 8051-Compatible Microcontroller • Very low current consumption (9.1 • Typically 2.5 times the performance mA in RX) of a standard 8051 • High sensitivity (typically -107 dBm) • 32 kB Flash, 2048 + 128 Byte SRAM • Programmable output power up to • 3 channel 10 bit ADC, 4 timers / 2 +10 dBm PWMs, 2 UARTs, RTC, Watchdog, • Data rate up to 76.8 kbps SPI, DES encryption, 26 general I/O • Very few external components pins • Fast PLL settling allowing frequency • In-circuit interactive debugging is hopping protocols supported for the Keil µVision2 IDE • RSSI through a simple serial interface. • EN 300 220 and FCC CFR47 part • 2.7 - 3.6 V supply voltage 15 compliant • 64-lead TQFP SWRS047A Page 1 of 146

CC1010 Table Of Contents 1. FEATURES.....................................................................................................................4 2. ABSOLUTE MAXIMUM RATINGS................................................................................5 3. RECOMMENDED OPERATING CONDITIONS.............................................................5 4. DC CHARACTERISTICS...............................................................................................6 5. ELECTRICAL SPECIFICATIONS..................................................................................7 6. ADC................................................................................................................................8 7. RF SECTION, GENERAL..............................................................................................8 8. RF TRANSMIT SECTION..............................................................................................9 9. RF RECEIVE SECTION...............................................................................................10 10. IF SECTION..................................................................................................................11 11. FREQUENCY SYNTHESIZER SECTION....................................................................12 12. PIN CONFIGURATION................................................................................................13 13. PIN DESCRIPTION......................................................................................................15 14. BLOCK DIAGRAM.......................................................................................................18 15. 8051 CORE..................................................................................................................19 15.1 GENERAL DESCRIPTION............................................................................................19 15.2 RESET.....................................................................................................................19 15.3 MEMORY MAP.........................................................................................................20 15.4 CPU REGISTERS.....................................................................................................23 15.5 INSTRUCTION SET SUMMARY....................................................................................24 15.6 INTERRUPTS............................................................................................................28 15.7 EXTERNAL INTERRUPTS............................................................................................32 15.8 MAIN CRYSTAL OSCILLATOR.....................................................................................32 15.9 POWER AND CLOCK MODES.....................................................................................34 15.10 FLASH PROGRAM MEMORY......................................................................................37 15.11 SPI FLASH PROGRAMMING.......................................................................................37 15.12 SERIAL PROGRAMMING ALGORITHM..........................................................................37 15.13 8051 FLASH PROGRAMMING....................................................................................42 15.14 FLASH POWER CONTROL.........................................................................................43 15.15 IN CIRCUIT DEBUGGING............................................................................................44 15.16 CHIP VERSION / REVISION........................................................................................45 16. 8051 PERIPHERALS...................................................................................................47 16.1 GENERAL PURPOSE I/O...........................................................................................47 16.2 TIMER 0 / TIMER 1....................................................................................................52 16.3 TIMER 2 / 3 WITH PWM............................................................................................59 16.4 POWER ON RESET (BROWN-OUT DETECTION)..........................................................62 16.5 WATCHDOG TIMER...................................................................................................63 16.6 REAL-TIME CLOCK...................................................................................................65 16.7 SERIAL PORT 0 AND 1..............................................................................................66 16.8 SPI MASTER...........................................................................................................71 16.9 DES ENCRYPTION / DECRYPTION.............................................................................75 16.10 RANDOM BIT GENERATION.......................................................................................78 16.11 ADC.......................................................................................................................79 17. RF TRANSCEIVER......................................................................................................83 17.1 GENERAL DESCRIPTION............................................................................................83 17.2 RF TRANSCEIVER BLOCK DIAGRAM..........................................................................83 17.3 RF APPLICATION CIRCUIT........................................................................................85 17.4 TRANSCEIVER CONFIGURATION OVERVIEW...............................................................88 17.5 RF TRANSCEIVER RX/TX CONTROL AND POWER MANAGEMENT.................................89 17.6 DATA MODEM AND DATA MODES..............................................................................91 17.7 BAUD RATES............................................................................................................94 17.8 TRANSMITTING AND RECEIVING DATA........................................................................95 SWRS047A Page 2 of 146

CC1010 17.9 DEMODULATION AND DATA DECISION.........................................................................97 17.10 SYNCHRONIZATION AND PREAMBLE DETECTION.......................................................102 17.11 RECEIVER SENSITIVITY VERSUS DATA RATE AND FREQUENCY SEPARATION................105 17.12 FREQUENCY PROGRAMMING...................................................................................107 17.13 LOCK INDICATION...................................................................................................110 17.14 RECOMMENDED SETTINGS FOR ISM FREQUENCIES.................................................111 17.15 VCO.....................................................................................................................113 17.16 VCO AND PLL SELF-CALIBRATION..........................................................................113 17.17 VCO, LNA AND BUFFER CURRENT CONTROL...........................................................118 17.18 INPUT / OUTPUT MATCHING....................................................................................120 17.19 OUTPUT POWER PROGRAMMING............................................................................123 17.20 RSSI OUTPUT.......................................................................................................126 17.21 IF OUTPUT.............................................................................................................127 17.22 OPTIONAL LC FILTER.............................................................................................128 18. RESERVED REGISTERS AND TEST REGISTERS.................................................129 19. SYSTEM CONSIDERATIONS AND GUIDELINES...................................................131 19.1 SRD REGULATIONS................................................................................................131 19.2 LOW COST SYSTEMS..............................................................................................131 19.3 BATTERY OPERATED SYSTEMS................................................................................131 19.4 NARROW-BAND SYSTEMS.......................................................................................131 19.5 HIGH RELIABILITY SYSTEMS....................................................................................131 19.6 FREQUENCY HOPPING SPREAD SPECTRUM SYSTEMS................................................132 19.7 SOFTWARE............................................................................................................132 19.8 DEVELOPMENT TOOLS............................................................................................132 19.9 PA “SPLATTERING”.................................................................................................132 19.10 PCB LAYOUT RECOMMENDATIONS.........................................................................133 19.11 ANTENNA CONSIDERATIONS...................................................................................133 20. PACKAGE DESCRIPTION (TQFP-64)......................................................................134 21. SOLDERING INFORMATION....................................................................................134 22. TRAY SPECIFICATION.............................................................................................134 23. LIST OF ABBREVIATIONS.......................................................................................137 24. SFR SUMMARY.........................................................................................................138 25. ALPHABETIC REGISTER INDEX.............................................................................142 26. ORDERING INFORMATION......................................................................................145 27. GENERAL INFORMATION........................................................................................146 27.1 DOCUMENT HISTORY.............................................................................................146 SWRS047A Page 3 of 146

CC1010 1. Features Fully Integrated UHF RF Transceiver • Programmable read and write lock of • Programmable frequency in the portions of Flash memory for software range 300 – 1000 MHz security • High sensitivity (typically -107 dBm • 2048 + 128 Byte of internal SRAM at 2.4 kBaud) Hardware DES Encryption / Decryption • Programmable output power –20 to • DES supported in hardware +10 dBm • Output Feedback Mode or Cipher • Very low current consumption (RX: Feedback Mode DES to avoid the 9.1 mA) requirement that data length must • Very few external components be a multiple of eight bytes required and no external RF switch Peripheral Features or IF filter required • Power On Reset / Brown-Out • Single port antenna connection Detection • Fast PLL settling allows frequency • Three channel, max 23 kSample/s, hopping protocols 10 bit ADC • FSK modulation with a data rate of • Programmable watchdog timer. up to 76.8 kBaud • Real time clock with 32 kHz crystal • Manchester or NRZ coding and oscillator decoding of data performed in • Two timers / pulse counters and two hardware. Byte delineation of data timers / pulse width modulators can be performed in hardware to • Two programmable serial UARTs. lessen the processor burden • Master SPI interface • RSSI output which can be sampled • 26 configurable general-purpose by on-chip ADC I/O-pins • Complies with EN 300 220 and FCC • Random bit generator in hardware CFR47 part 15 Low Power High-Performance and Low-Power • 8051 core and peripherals can use 8051-Compatible Microcontroller the RTC's 32 kHz clock • Optimised 8051-core which typically • Idle and sleep modes for reduced gives 2.5x the performance of a power consumption. System can standard 8051 wake up on interrupt or when ADC • Dual data pointers input exceeds a set threshold • Idle and sleep modes • Low-power fully static CMOS design • In-circuit interactive debugging is Operating Conditions supported for the Keil µVision IDE • 2.7 - 3.6 V supply voltage through a simple serial interface • -40 - 85 °C operational temperature Data and Non-volatile Program Memory • 3 - 24 MHz crystal (up to 50 ppm) • 32 kB of non-volatile Flash memory for the main crystal oscillator in-system programmable through a Packaging simple SPI interface or by the 8051 • 64-lead TQFP core. • Typical Flash memory endurance: 20 000 write/erase cycles SWRS047A Page 4 of 146

CC1010 2. Absolute Maximum Ratings Under no circumstances must the absolute maximum ratings given in Table 1 be violated. Stress exceeding one or more of the limiting values may cause permanent damage to the device. Parameter Min. Max. Units Condition Supply voltage, VDD -0.3 5.0 V Voltage on any pin -0.3 VDD+0.3, V max 5.0 Input RF level 10 dBm Storage temperature range -50 150 °C Un-programmed device Storage temperature range -40 125 °C Programmed device, data retention > 0.49 years at 125°C Lead temperature 260 °C T = 10 s Table 1. Absolute Maximum Ratings Caution! ESD sensitive device. Precaution should be used when handling the device in order to prevent permanent damage. 3. Recommended Operating Conditions Tc = -40 to 85°C, VDD = 2.7 to 3.6 V if nothing else stated Parameter Min Typ Max Unit Condition Supply voltage, DVDD, AVDD 2.7 3.3 3.6 V Supply voltage during normal operation Supply voltage, DVDD, AVDD 2.7 3.6 V Supply voltage during program/erase Flash memory Operating temperature, free-air -40 85 °C Main oscillator frequency 3 24 MHz RTC oscillator frequency 32768 Hz Table 2. Recommended Operating Conditions SWRS047A Page 5 of 146

CC1010 4. DC Characteristics The DC Characteristics of CC1010 are listed in Table 3 below. Tc = 25°C, VDD = 3.3 V if nothing else stated Digital Inputs/Outputs Min Max Unit Condition Logic "0" input voltage 0 0.3*VDD V Logic "1" input voltage 0.7*VDD VDD V Logic "0" output voltage 0 0.4 V Output current -2.0 mA, ports P0.3-P0.0, P1.7- P1.0, P2.7-P2.4, P2.2- P2.0 Logic "1" output voltage 2.5 VDD V Output current 2.0mA, ports P0.3-P0.0, P1.7- P1.0, P2.7-P2.4, P2.2- P2.0 Logic "0" output voltage 0 0.4 V Output current -8.0 mA, port P2.3 Logic "1" output voltage 2.5 VDD V Output current 8.0mA, port P2.3 Logic "0" input current NA -1 µA Input signal equals GND Logic "1" input current NA 1 µA Input signal equals VDD Table 3. DC Characteristics 25 20 A] m [ nt 15 e r r u c 10 y pl p u 5 S 0 0 4 8 12 16 20 24 Frequency [MHz] Figure 1. Typical CPU core supply current vs. clock frequency SWRS047A Page 6 of 146

CC1010 5. Electrical Specifications Tc = 25°C, VDD = 3.3 V if nothing else stated All electrical specifications are measured on Chipcon’s CC1010EM reference design. Parameter Min. Typ. Max. Unit Condition Power on reset (POR) voltage 2.7 2.9 3.1 V Tc = -40 to 85°C Brown out voltage 2.7 2.9 3.1 V Tc = -40 to 85°C RTC start-up time 160 ms Current consumption MCU, 14.8 mA 14.7456 MHz, main oscillator Active mode 1.3 mA 32 kHz, RTC oscillator See page 33 for explanation of modes. See Figure 1 page 6 for supply current vs. clock frequency Current consumption MCU, Idle 12.8 mA 14.7456 MHz, main oscillator mode 29.4 µA 32 kHz, RTC oscillator Current consumption, Power 0.2 1 µA Down mode Current consumption, Power- 34 uA on reset circuit (when enabled) Current consumption Main 67 µA 14.7456 MHz crystal crystal oscillator Current consumption RF 9.1/ mA Current for RF transceiver Transceiver, Receive mode, 11.9 alone 433/868 MHz Current consumption RF The output power is delivered Transceiver, Transmit mode, to a single-ended 50Ω load, 433/868 MHz see also page 123. Current is for RF transceiver alone P=0.01 mW (-20 dBm) 5.3/8.6 mA P=0.3 mW (-5 dBm) 8.9/13.8 mA P=1 mW (0 dBm) 10.4/17 mA P=2.5 mW (4 dBm) 24.8/ mA 23.5 P=10 mW (10 dBm) 26.6/NA mA 32 kHz oscillator crystal load 12 pF capacitance Table 4. Electrical specifications SWRS047A Page 7 of 146

CC1010 6. ADC Parameter Min. Typ. Max. Unit Condition Number of bits 10 bits Differential Nonlinearity (DNL) +/-0.2 LSB VDD is reference voltage Integral Nonlinearity (INL) +/-1.3 LSB VDD is reference voltage Offset 3 LSB 7 Hz test tone Total Harmonic Distortion 59 dB 7 Hz test tone (THD) SINAD 54 dB 7 Hz test tone 9 bits Internal reference tolerance ± 10 % Conversion time 44 µs When ADC is operated at 250 kHz Clock frequency 32 250 250 kHz 250 kHz recommended for full 10-bit performance External reference voltage 1.3 2.7 V External reference voltage should never exceed 2.7 V. It is recommended to use a reference voltage close to 1.3 V to have the best possible linearity. Input voltage 0 Vref V Table 5. ADC characteristics 7. RF section, general Parameter Min. Typ. Max. Unit Condition RF Frequency Range 300 1000 MHz Programmable in steps of < 250 Hz Data rate 0.6 76.8 kBaud NRZ or Manchester encoding. 76.8 kBaud equals 76.8 kbps using NRZ coding. See page 94 Table 6 General RF characteristics SWRS047A Page 8 of 146

CC1010 8. RF transmit section Parameter Min. Typ. Max. Unit Condition Binary FSK frequency 0 64 65 kHz The frequency corresponding separation to the digital "0" is denoted f , 0 while f corresponds to a 1 digital "1". The frequency separation is f -f . The RF carrier 1 0 frequency, f , is then given by c f =(f +f )/2. c 0 1 (The frequency deviation is given by f =+/-(f -f )/2 ) d 1 0 The frequency separation is programmable in 250 Hz steps. Separations up to 65 kHz are guaranteed at 1 MHz reference frequency. Larger separations can be achieved at higher reference frequencies Output power -20 0 10/4 dBm Delivered to single-ended 50 433 / 868 MHz Ω load. The output power is programmable, see page 123 RF output impedance 140/80 Ω Transmit mode, optimum load 433 / 868 MHz impedance. For matching details see “Input/ output matching” p.120 Harmonics Conducted measur at maximum output power. An 2nd harmonic, 433 / 868 MHz -7/-15 dBm external LC filter should be 3rd harmonic, 433 / 868 MHz -27/-29 used to reduce harmonics emission to comply with SRD requirements. See p.128 Table 7. RF transmit characteristics SWRS047A Page 9 of 146

CC1010 9. RF receive section Parameter Min. Typ. Max. Unit Condition Receiver Sensitivity, -107/ dBm 2.4 kBaud, Manchester coded 433 / 868 MHz -106 data, 64 kHz frequency separation, BER = 10-3 See Table 33 and Table 34page 105 for typical sensitivity figures at other data rates. System noise bandwidth 30 kHz 2.4 kBaud, Manchester coded data Cascaded noise figure 12/13 dB 433/868 MHz Saturation (maximum input 10 dBm 2.4 kBaud, Manchester coded level) data, BER = 10-3 -1 dBm 76.8 kBaud NRZ, BER = 10-3 Input IP3 -26 dBm From LNA to IF output Blocking 40 dBc At +/- 1 MHz LO leakage -57 dBm Input impedance Receive mode, series equivalent 90-j13 Ω at 315 MHz 68-j24 Ω at 433 MHz 36-j11 Ω at 868 MHz 36-j13 Ω at 915 MHz For matching details see “Input/ output matching” p. 120. Turn on time 11 128 Baud The demodulator settling time, which is programmable, determines the turn-on time. See page 97 for details. Table 8. RF receive characteristics SWRS047A Page 10 of 146

CC1010 10. IF section Parameter Min. Typ. Max. Unit Condition Intermediate frequency (IF) 150/ kHz Internal IF filter 433/868 MHz 130 10.7 MHz External IF filter IF bandwidth (noise bandwidth) 175 kHz RSSI dynamic range -105 -60 dBm RSSI 3-dB bandwidth 260 kHz 868 MHz CW, -70 dBm RSSI accuracy ± 6 dB See p. 126 for details RSSI linearity ± 2 dB Table 9 IF characteristics SWRS047A Page 11 of 146

CC1010 11. Frequency synthesizer section Parameter Min. Typ. Max. Unit Condition Crystal Oscillator Frequency 3 24 MHz Crystal frequency can be 3-4, 6-8 or 9-24 MHz. Recommended frequencies are 3.6864, 7.3728, 11.0592, 14.7456, 18.4320 and 22.1184 MHz. See page 32 for details Crystal frequency accuracy ± 50 ppm 433 MHz requirement ± 25 868 MHz The crystal frequency accuracy and drift (ageing and temperature dependency) will determine the frequency accuracy of the transmitted signal. Crystal operation Parallel C171 and C181 are loading capacitors Crystal load capacitance 12 20 30 pF 3-4 MHz, 20 pF recommended 12 16 30 pF 6-8 MHz, 16 pF recommended 12 16 16 pF 9-16 MHz, 16 pF recommended 16-24 MHz, 12 pF recommended 12 12 16 pF Crystal oscillator start-up time 5 ms 3.6864 MHz, 16 pF load 1.5 ms 7.3728 MHz, 16 pF load 2 ms 16 MHz, 16 pF load Output signal phase noise -85 dBc/Hz At 100 kHz offset from carrier PLL lock time (RX / TX turn 200 µs time) PLL turn-on time 250 µs Table 10. Frequency synthesizer characteristics SWRS047A Page 12 of 146

CC1010 12. Pin Configuration (Top view) F) SI/I SO) ND 2 (RS 1 0 DD SET OG 7 6 7 6 5 3 2 (MI DD ND G D D D V E R 2. 2. 1. 1. 1. 0. 0. V G A A A A D R P P P P P P P P D D 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 AVDD 1 48 P3.0 (RXD0) AVDD 2 47 P3.1 (TXD0) AGND 3 46 P3.2 (INT0) RF_IN 4 45 P2.5 RF_OUT 5 44 P2.4 C AVDD 6 43 DVDD C AGND 7 42 P2.3 AGND 8 1 41 DGND AGND 9 0 40 DVDD L1 10 39 P2.2 1 L2 11 38 P1.4 0 AVDD 12 37 P1.3 CHP_OUT 13 36 P1.2 R_BIAS 14 35 P1.1 AVDD 15 34 P0.1 (MOSI) AGND 16 33 P0.0 (SCK) 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 D 1 2 2 1 D D D E 0 0 1 5 4 3 D N Q Q Q Q N N N _ 1. 2. 2. 3. 3. 3. N G _ _ _ _ G G G R P P P P P P G A OSC OSC C32 C32 A D D PO D1) D1) M3) M2) T1) D X X XOS XOS (RX (TX (PW (PW (IN Pin Pin name Alternate Pin type Description # function 1 AVDD - Power (A) Power supply ADC 2 AVDD - Power (A) Power supply Mixer and IF 3 AGND - Power (A) Ground connection Mixer and IF 4 RF_IN - RF input RF signal input from antenna (external AC- coupling) 5 RF_OUT - RF output RF signal output to antenna 6 AVDD - Power (A) Power supply LNA and PA 7 AGND - Power (A) Ground connection LNA and PA 8 AGND - Power (A) Ground connection PA 9 AGND - Power (A) Ground connection VCO and prescaler 10 L1 - Analog Connection #1 for external VCO tank inductor 11 L2 - Analog Connection #2 for external VCO tank inductor 12 AVDD - Power (A) Power supply VCO and prescaler SWRS047A Page 13 of 146

CC1010 Pin Pin name Alternate Pin type Description # function 13 CHP_OUT - Analog output Charge pump current output when external loop filter is used 14 R_BIAS - Analog Connection for external precision bias resistor (82 kΩ, ± 1%) 15 AVDD - Power (A) Power supply misc. analog modules 16 AGND - Power (A) Ground connection misc. analog modules 17 AGND - Power (A) Analog ground connection 18 XOSC_Q1 - Analog input 3-24 MHz crystal, pin 1 or external clock input 19 XOSC_Q2 - Analog output 3-24 MHz crystal, pin 2 20 XOSC32_Q - Analog output 32 kHz crystal pin2 2 21 XOSC32_Q - Analog input 32 kHz crystal pin1 or external clock input 1 22 AGND - Power (A) Analog ground connection 23 DGND - Power (D) Digital ground connection 24 DGND - Power (D) Digital ground connection 25 POR_E - Digital input Power-on reset enable. 0: Disable internal power-on reset module 1: Enable internal power-on reset module 26 P1.0 - Digital high-Z I/O 8051 port 1, bit 0 27 P2.0 RXD1 (I) Digital high-Z I/O 8051 port 2, bit 0 or RX of serial port 1 28 P2.1 TXD1 (O) Digital high-Z I/O 8051 port 2, bit 1 or TX of serial port 1 29 P3.5 PWM3 (O) Digital high-Z I/O 8051 port 3, bit 5 or pulse width modulator T1 (I) 3's output or Timer / Counter 1 external input 30 P3.4 PWM2 (O) Digital high-Z I/O 8051 port 3, bit 4 or pulse width modulator T0 (I) 2's output or Timer / Counter 0 external input 31 P3.3 INT1 (I) Digital high-Z I/O 8051 port 3, bit 3 or interrupt 1 input configurable as level or edge sensitive 32 DGND - Power (D) Ground connection digital part 33 P0.0 SCK (O) Digital high-Z I/O 8051 port 0, bit 0 or SPI master interface SCK (I) serial clock output or Flash programming SPI slave clock input. 34 P0.1 MO (O) Digital high-Z I/O 8051 port 0, bit 1 or SPI interface master SI (I) output or Flash programming SPI slave serial data input 35 P1.1 - Digital high-Z I/O 8051 port 1, bit 1 36 P1.2 - Digital high-Z I/O 8051 port 1, bit 2 37 P1.3 - Digital high-Z I/O 8051 port 1, bit 3 38 P1.4 - Digital high-Z I/O 8051 port 1, bit 4 39 P2.2 - Digital high-Z I/O 8051 port 2, bit 2 (Schmitt trigger input) 40 DVDD - Power (D) Digital power supply 41 DGND - Power (D) Ground connection digital part 42 P2.3 - Digital high-Z I/O (8 8051 port 2, bit 3 mA) 43 DVDD - Power (D) Digital power supply 44 P2.4 - Digital high-Z I/O 8051 port 2, bit 4 45 P2.5 - Digital high-Z I/O 8051 port 2, bit 5 46 P3.2 INT0 (I) Digital high-Z I/O 8051 port 3, bit 2 or interrupt 0 input configurable as level or edge sensitive 47 P3.1 TXD0 (O) Digital high-Z I/O 8051 port 3, bit 1 or TX of serial port 0 48 P3.0 RXD0 (I) Digital high-Z I/O 8051 port 3, bit 0 or RX of serial port 1 49 DGND - Power (D) Digital ground connection 50 DVDD - Power (D) Digital power supply SWRS047A Page 14 of 146

CC1010 Pin Pin name Alternate Pin type Description # function 51 P0.2 MI (I) Digital high-Z I/O 8051 port 0, bit 2 or SPI interface master SO (O) input or Flash programming SPI slave serial data output 52 P0.3 - Digital high-Z I/O 8051 port 0, bit 3 53 P1.5 - Digital high-Z I/O 8051 port 1, bit 5 54 P1.6 - Digital high-Z I/O 8051 port 1, bit 6 55 P1.7 - Digital high-Z I/O 8051 port 1, bit 7 56 P2.6 - Digital high-Z I/O 8051 port 2, bit 6 57 P2.7 - Digital high-Z I/O 8051 port 2, bit 7 58 - Digital input Flash program enable pad, active low PROG 59 - Digital input (pull-up) System reset pin, active low RESET 60 DVDD - Power (D) Digital power supply 61 AD0 - Analog input ADC input channel 0 62 AD1 - Analog input ADC input channel 1 63 AD2 RSSI (O), Analog input/output ADC input channel 2, RSSI (Receiver signal IF (O) strength indicator) output, or IF output when using external demodulator 64 AGND - Power (A) Analog ground connection ADC A = Analog, D = Digital, I = input, O= Output 13. Pin description AVDD, DVDD matched to the input impedance. A DC Supply voltages for analog and digital ground is needed for LNA biasing. modules respectively. All supply pins RFOUT should be decoupled by capacitors. In This is the RF output, internally connected particular, the digital and analog supply to the power amplifier (PA). The external domains should be properly decoupled load (antenna) should be matched to the from each other (a ferrite bead can be output impedance (optimum load used to prevent high-frequency noise from impedance). This pin must be DC coupled coupling from one supply domain to to AVDD for PA biasing (open drain another). The placement and size of output). decoupling capacitors and supply filtering are critical with respect to LO leakage and L1, L2 sensitivity. Chipcon’s reference layout Connection to internal voltage controlled designs should be used (available from oscillator (VCO). An inductor should be Chipcon’s website). See also page 133 for connected between these pins. The layout recommendations. inductor value will determine the VCO tuning range. The inductor should be place AGND, DGND very close to the pins in order to minimize Ground for analog and digital modules paracitic inductance. respectively. Normally one common ground plane is recommended. If two CHP_OUT separate analog and digital grounds are Charge Pump output. If the RF transceiver used they should be interconnected in one is configured for external loop filter this is place, and one place only. the current output from the charge pump. Normally the internal loop filter should be RFIN used and this pin should be left open (not This is the RF input, internally connected connected). to the low noise amplifier (LNA). The signal source (antenna) should be SWRS047A Page 15 of 146

CC1010 RBIAS output or IF output. The pin is configured Current output from internal band gap cell by the FREND register. When not used this bias generator. A precision resistor (82 pin can be left open (not connected). kΩ, ±1%) should be connected between PORT 0 this pin and ground to set the correct bias Port 0 is a 4-bit (P0.3-P0.0) bi-directional current level. CMOS I/O port with 2 mA drivers. A XOSC_Q1, XOSC_Q2 direction register (P0DIR) controls whether These are the main oscillator connection each pin is an output or input and the pins. An external crystal should be register P0 is used to read the input or connected between these pins, and load control the logical value of the output. capacitors should be connected between each pin and ground. If an external Pins P0.0 - P0.2 can be configured to oscillator is used, the clock signal should become a master SPI interface in register be connected to the XOSC_Q1 pin, and SPCR and will then override P0(2:0), XOSC_Q2 should be left open (not P0DIR(2) and P0DIR(1). connected). Used as SPI interface, P0.0 is SCK, XOSC32_Q1, XOSC32_Q2 P0.1 is MOSI, and P0.2 is MISO. These are the real time clock (RTC) PORT 1 oscillator connection pins. An external crystal should be connected between Port 1 is an 8-bit (P1.7-P1.0) bi- these pins, and load capacitors should be directional CMOS I/O port with 2 mA connected between each pin and ground. drivers. A direction register (P1DIR) If an external oscillator is used, the clock controls whether each pin is an output or signal should be connected to the input and the register P1 is used to read XOSC32_Q1 pin, and XOSC32_Q2 the input or control the logical value of the should be left open (not connected). output. POR_E PORT 2 Enable signal for the on-chip power-on Port 2 is an 8-bit (P2.7-P2.0) bi- reset module. The power-on reset is directional CMOS I/O port with 2 mA enabled when POR_E is connected to drivers, except for P2.3 that has an 8 mA DVDD and disabled when connected to output buffer. A direction register (P2DIR) DGND. controls whether each pin is an output or input and the register P2 is used to read PROG the input or control the logical value of the Active low Flash programming enable pin. output. When this signal is active (driven to DGND) Pins P2.0 and P2.1 can be configured to a Flash programmer can be connected to become the RXD1 and TXD1 pin, the SPI interface. Under normal operation respectively, of UART 1. it must be driven to DVDD. Pin P2.2 has a Schmitt-trigger input RESET stage. Note that while this pin does have hysteresis, it will draw a large input current Active low asynchronous system reset. It (~0.5 mA) if the input voltage is close to has an internal pull-up resistor and can be VDD/2. left unconnected during normal operation. PORT 3 AD0, AD1 Port 3 is a 6-bit (P3.5-P3.0) bi-directional Analog inputs to A/D converter channels 0 CMOS I/O port with 2 mA drivers. A and 1 respectively. When not used these pins can be left open (not connected). direction register (P3DIR) controls whether each pin is an output or input. The register AD2 (RSSI/IF) P3 is used to read the input or control the Analog input to A/D converter channel 2. logical value of the output. This pin can also be configured to be RSSI SWRS047A Page 16 of 146

CC1010 Pins P3.0 and P3.1 can be configured to can be configured to be either level- become the RXD0 and TXD0 pin, sensitive or edge-sensitive. respectively, of UART 0. Pins P3.4 and P3.5 can be configured to Pins P3.2 and P3.3 are connected to the become the pulse width modulator (PWM) outputs of Timer/PWM 2 and Timer/PWM external interrupt inputs INT0 and INT1, 3, respectively. When pulse width respectively, and can cause interrupts if modulation is enabled the corresponding the corresponding interrupt enable flags bits in P3DIR and P3 are overridden. are set in register IE. The interrupts inputs SWRS047A Page 17 of 146

CC1010 14. Block Diagram The CC1010 Block Diagram is shown in Figure 2 below. Programmable I/O (General purpose or alternate function) Port 0 Port 2 POR_E Power-on DES Module reset er Port 1 FLASH Arbit 2048 byte Port 3 32 kB Programming DMA M SRAM A FLASH R Timers/ 128 byte PWMs SRAM 8051 core Timers/ RESET WRTatiemcsheedrtog InterruptController puCGrpoeounsenert aeI/lOrs Generation PROG UUAARRTTss SPI Special Function Realtime Registers Clock (SFRs) 32 kHz crystal AD0 Clock AD1 ADC System Multiplexer AD2 MUX clock (RSSI/IF) RF Transceiver MIXER IF RSSI RF_IN CODEC, Bit synchronizer, LNA IF stage MODEM Serializer/Deserializer :N.n Bias Bias resistor RF_OUT Main Crystal PA VCO LPF CHP PD :R Oscillator 3-24 MHz crystal L1 L2 CHP_OUT VCO inductor Figure 2. CC1010 Block Diagram SWRS047A Page 18 of 146

CC1010 15. 8051 Core 15.1 General description The CC1010 microcontroller core is based The various peripherals are controlled on the industry-standard 8051 through Special Function Registers architecture. The MCU core is 8-bit, with (SFRs) located in the internal RAM space. program and data memory located in The 8051 core is instruction set separate memory spaces (Harvard compatible with the industry standard architecture). The internal registers are 8051. It also has one additional instruction, organised as four banks of 8 registers TRAP, to enable advanced in-circuit- each. The instruction set supports direct, debugging features. This is described on indirect and register addressing modes. page 44. Program memory can be addressed using indexed addressing. The core registers The instruction cycle time is 4 clock are comprised of an accumulator, a stack cycles, which typically gives a 2.5X pointer and dual data pointer registers in average reduction in instruction execution addition to the general registers. time over the original Intel 8051. Data memory is split into internal and Peripheral units, including general purpose external RAM. The name "external RAM" I/O, 2 standard 8051 timers, 2 extra timers is in fact misleading since in the case of with PWM functionality, a watchdog timer, the CC1010 all the RAM is internal to the a real-time clock, an SPI master interface, chip. The difference between external and hardware DES encryption, a true random internal is that external RAM can only be bit generator and ADC are all described accessed by a few instructions. Therefore, from page 47 and out. Dual data pointers frequently-accessed variables as well as are available for faster data transfer. the stack should be kept in internal RAM. 15.2 Reset CC1010 must be reset at start-up. There voltage may require an external POR are several sources for reset in CC1010 : module, as described in the Power On Reset (Brown-Out Detection) section • External reset pin, RESET . Applying at page 62. a low signal to this pin at any time will • Brown-out detection reset. The POR reset almost all registers in CC1010. will also detect low supply voltage and Exceptions can be found in Table 40 generate a reset. on page 141. The input is asynchronous and is synchronised • Watchdog timer reset. The watchdog internally, so that the reset can be timer can generate a reset, as released independent of the timing of described in the section on page 63. the active clock signal. If the main • ADC reset. The ADC module can be crystal oscillator is inactive, the reset programmed to generate a reset input should be held long enough for signal if its inputs exceed a the oscillator to start up and stabilize. programmed threshold. See the ADC See Electrical Specifications page 7 section on page 79 for details. for oscillator start-up timing. The POR and ADC reset signals will be • Power On Reset (POR). The internal held for 1024 clock periods after the signal POR module can generate reset upon is released. This will ensure a safe clock power-up. Special requirements for start-up if the crystal oscillator is currently power consumption or power supply not running. SWRS047A Page 19 of 146

CC1010 15.3 Memory Map The CC1010 memory map is shown in from (to) the address pointed to by the Figure 3. currently selected data pointer. CC1010 has 2 blocks of RAM on chip. This The instructions MOVX A, @Ri and MOVX includes the 128 bytes Internal RAM and @Ri, A moves data to (from) the the 2048 bytes External RAM. (The 2048- accumulator, from (to) the address given byte RAM will be referred to as External by the memory page address register RAM, although it is on-chip. Direct access MPAGE and the register Ri (R0 or R1). to off-chip RAM is not implemented.) MPAGE gives the 8 most significant Access to the internal RAM is performed address bits, while the register Ri gives the 8 least significant bits. In many 8051 using the MOV instruction. MOV A, @Ri, implementations, this type of external MOV @Ri, A and MOV @Ri, #data use RAM access is performed using P2 to give indirect addressing. MOV A, direct, the most significant address bits. Existing MOV Rn, direct, MOV direct, A, software may therefore have to be MOV direct, Rn, MOV direct, adapted to make use of MPAGE instead of direct and MOV direct, #data use P2. direct addressing. MOV @Ri, direct uses indirect and direct addressing. The program memory can be read using the MOVC A, @A+DPTR and MOVC A, All direct addressing instructions can also @A+PC instructions, which moves a byte be used to access the SFRs. CC1010 also from the program memory address given implements the option to access SFRs by A+DPTR or A+PC respectively. The indirectly, as described in the In Circuit program memory can not be written using Debugging section on page 44. CC1010 has MOV commands, but uses the method dual data pointers to external RAM, described in the 8051 Flash Programming provided in the 16 bit registers DPTR0 and section on page 42. DPTR1 (SFRs DPH0, DPL0, DPH1 and DPL1). If a high-level language compilator CC1010 also provides a possibility to stretch is used, it should be set up to make use of the access cycle to external RAM, through both pointers for better performance. The CKCON.MD(2:0) (see page 55). The data pointer is selected through DPS.SEL. default value for CKCON.MD is "001". It is recommended to set CKCON.MD to "000" Access to the external RAM is performed for faster RAM access. using the MOVX instruction and indirect addressing using either the 16 bit data pointers or the 8 bit registers R0 or R1 together with MPAGE. MOVX A, @DPTR and MOVX @DPTR, A moves data to (from) the accumulator, SWRS047A Page 20 of 146

CC1010 Flash Program Memory 0x7FFF External RAM 0x7FF Internal RAM / SFR 0xFF Special Function Accesible Accesible Registers (SFR), through indirect through indirect accessible addressing addressing through Direct Addressing 0x7F Internal RAM Accessible through Direct and Indirect Addressing 0x00 0x00 0x00 Figure 3. Memory Map DPL0 (0x82) - Data Pointer 0, low byte Bit Name R/W Reset value Description 7:0 DPL0(7:0) R/W 0x00 Data Pointer 0, low byte DPH0 (0x83) - Data Pointer 0, high byte Bit Name R/W Reset value Description 0 DPH0(7:0) R/W 0x00 Data Pointer 0, high byte DPL1 (0x84) - Data Pointer 1, low byte Bit Name R/W Reset value Description 7:0 DPL1(7:0) R/W 0x00 Data Pointer 1, low byte DPH1 (0x85) - Data Pointer 1, high byte Bit Name R/W Reset value Description 7:0 DPH1(7:0) R/W 0x00 Data Pointer 1, high byte SWRS047A Page 21 of 146

CC1010 DPS (0x86) - Data Pointer Select Bit Name R/W Reset value Description 7:1 - R0 0x00 Reserved, read as 0 0 SEL R/W 0x00 Data Pointer Select for external RAM access 0 : DPH0 and DPL0 are used 1 : DPH1 and DPL1 are used MPAGE (0x92) - Memory Page Select Register Bit Name R/W Reset value Description 7:0 MPAGE(7:0) R/W 0x00 Memory Page A total of 119 Special Function Registers All SFRs will be described in the following (SFRs) are accessible from the sections. A more detailed overview is microcontroller core. The names and provided in Table 40 on page 141, which addresses of all SFRs are listed in Table also includes all reset values. SFRs with 11. All standard 8051 registers are addresses ending with 0 or 8 (leftmost available, in addition to SFRs which are column of Table 11) are bit adressable. CC1010 specific, controlling modules such as the RF Transceiver, DES encryption, ADC and Real-Time Clock. 0/8 1/9 2/A 3/B 4/C 5/D 6/E 7/F 0xF8 EIP TEST0 TEST1 TEST2 TEST3 TEST4 TEST5 TEST6 0xF0 B FSHAPE7 FSHAPE6 FSHAPE5 FSHAPE4 FSHAPE3 FSHAPE2 FSHAPE1 0xE8 EIE FSDELAY FSEP0 FSEP1 FSCTRL RTCON FREND TESTMUX 0xE0 ACC CURRENT PA_POW PLL LOCK CAL PRESCALER RESERVED 0xD8 EICON MODEM2 MODEM1 MODEM0 MATCH FLTIM - - 0xD0 PSW X32CON WDT PDET BSYNC - - - 0xC8 RFMAIN RFBUF FREQ_0A FREQ_1A FREQ_2A FREQ_0B FREQ_1B FREQ_2B 0xC0 SCON1 SBUF1 RFCON CRPCON CRPKEY CRPDAT CRPCNT RANCON 0xB8 IP RDATA RADRL RADRH CRPINI4 CRPINI5 CRPINI6 CRPINI7 0xB0 P3 - - - CRPINI0 CRPINI1 CRPINI2 CRPINI3 0xA8 IE TCON2 T2PRE T3PRE T2 T3 FLADR FLCON 0xA0 P2 SPCR SPDR SPSR P0DIR P1DIR P2DIR P3DIR 0x98 SCON0 SBUF0 - - - - - CHVER 0x90 P1 EXIF MPAGE ADCON ADDATL ADDATH ADCON2 ADTRH 0x88 TCON TMOD TL0 TL1 TH0 TH1 CKCON - 0x80 P0 SP DPL0 DPH0 DPL1 DPH1 DPS PCON Table 11 CC1010 SFR Overview SWRS047A Page 22 of 146

CC1010 15.4 CPU Registers CC1010 provides 4 register banks of 8 parity flags that reflect the current CPU registers each. These register banks are state. mapped in the the internal data memory In addition, the CPU uses the accumulator (see the Memory section on page 33) at register A (accessed via the SFR space as addresses 0x00 - 0x07, 0x08 - 0x0F, 0x10 ACC), B (for multiplication and division) and - 0x17 and 0x18 - 0x1F. Each register the stack pointer SP. These registers are bank contains the 8 8-bit registers R0 shown below. Note that the hardware through R7. The different register banks stack pointer SP is increased when are selected through the Program Status pushing and decreased when popping Word PSW.RS(1:0) as shown below. data, unlike many other microcontroller PSW also contains carry, overflow and architectures. PSW (0xD0) - Program Status Word Bit Name R/W Reset value Description 7 CY R/W 0 Carry Flag, set to 1 when the last arithmetic operation resulted in a carry (during addition) or borrow (during subtraction), otherwise cleared to 0 by all arithmetic operations. CY is also used for rotation instructions. 6 AC R/W 0 Auxiliary carry flag. Set to 1 when the last arithmetic operation resulted in a carry into (during addition) or borrow from (during subtraction) the high order nibble, otherwise cleared to 0 by all arithmetic operations. 5 F0 R/W 0 Flag 0 (Available to the user for general purpose) 4 RS1 R/W 0 Register bank select. 3 RS0 R/W 0 RS1 RS0 Working register bank and address 0 0 Bank0 0x00-0x07 0 1 Bank1 0x08-0x0F 1 0 Bank2 0x10-0x17 1 1 Bank3 0x18-0x1F 2 OV R/W 0 Overflow flag. Set to 1 when the last arithmetic operation resulted in a carry (addition), borrow (subtraction), or overflow (multiply or divide). Otherwise, the bit cleared to 0 by all arithmetic operations. 1 F1 R/W 0 Flag 1 (Available to the user for general purpose) 0 P R/W 0 Parity flag. Set to 1 when the modulo-2 sum of the 8 bits in the accumulator is 1 (odd parity), cleared to 0 on even parity. ACC (0xE0) - Accumulator Register Bit Name R/W Reset value Description 7:0 ACC(7:0) R/W 0x00 Accumulator B (0xF0) - B Register Bit Name R/W Reset value Description 7:0 B(7:0) R/W 0x00 B is used for multiplication and division SWRS047A Page 23 of 146

CC1010 SP (0x81) - Stack Pointer Bit Name R/W Reset value Description 7:0 SP(7:0) R/W 0x07 Stack Pointer, used for pushing and poping data to and from the stack. Note that the reset value for SP is 0x07 15.5 Instruction Set Summary The 8051 instruction set is summarised in • rel - Two's complement offset byte Table 12 below. All mnemonics are used by SJMP and conditional jumps Copyright © Intel Corporation 1980. • bit - Direct bit address One non-standard 8051 instruction, TRAP, with opcode 0xA5 is included to enable • #data - 8-bit constant setting of breakpoints. This instruction is • #data 16 - 16-bit constant described in the In Circuit Debugging section at page 44. Symbols used in the • addr 16 - 16-bit destination address table are: • addr 11 - 11-bit destination address, • A - Accumulator used by ACALL and AJMP. The branch will be within the same 2 kB block of • AB - Register pair A and B program memory of the first byte of • B - Multiplication register the following instruction. • C - Carry flag The ‘Bytes’ column shows the number of bytes of Flash memory used. Further, the • DPTR - Data pointer number of instruction cycles is shown. Each instruction cycle requires four clock • Rn - Register R0 - R7 cycles. The 4 rightmost columns shows • PC - Program counter which flags in the program status word PSW (see page 23) are affected by the • direct - 8-bit data address (Internal instructions. RAM 0x00 - 0x7F, SFRs 0x80-0xFF) • @Ri - Internal register pointed to by R0 or R1 (except MOVX) Mnemonic Description s e e d cl o y c C p Bytes nstr. Hex O CY AC OV P I Arithmetic ADD A, Rn Add register to A 1 1 28-2F x x x x ADD A, direct Add direct byte to A 2 2 25 x x x x ADD A, @Ri Add data memory to A 1 1 26-27 x x x x ADD A, #data Add immediate to A 2 2 24 x x x x ADDC A, Rn Add register to A with carry 1 1 38-3F x x x x ADDC A, direct Add direct byte to A with carry 2 2 35 x x x x ADDC A, @Ri Add data memory to A with carry 1 1 36-37 x x x x ADDC A, #data Add immediate to A with carry 2 2 34 x x x x SUBB A, Rn Subtract register from A with 1 1 98-9F x x x x borrow SUBB A, direct Subtract direct byte from A with 2 2 95 x x x x borrow SWRS047A Page 24 of 146

CC1010 Mnemonic Description s e e d cl o y c C p Bytes nstr. Hex O CY AC OV P I SUBB A, @Ri Subtract data memory from A with 1 1 96-97 x x x x borrow SUBB A, #data Subtract immediate from A with 2 2 94 x x x x borrow INC A Increment A 1 1 04 x INC Rn Increment register 1 1 08-0F INC direct Increment direct byte 2 2 05 INC @Ri Increment data memory 1 1 06-07 DEC A Decrement A 1 1 14 x DEC Rn Decrement register 1 1 18-1F DEC direct Decrement direct byte 2 2 15 DEC @Ri Decrement data memory 1 1 16-17 INC DPTR Increment data pointer 1 3 A3 MUL AB Multiply A by B 1 5 A4 x x x DIV AB Divide A by B 1 5 84 x x x DA A Decimal adjust A 1 1 D4 x x Logical ANL A, Rn AND register to A 1 1 58-5F x ANL A, direct AND direct byte to A 2 2 55 x ANL A, @Ri AND data memory to A 1 1 56-57 x ANL A, #data AND immediate to A 2 2 54 x ANL direct, A AND A to direct byte 2 2 52 ANL direct, #data AND immediate data to direct byte 3 3 53 ORL A, Rn OR register to A 1 1 48-4F x ORL A, direct OR direct byte to A 2 2 45 x ORL A, @Ri OR data memory to A 1 1 46-47 x ORL A, #data OR immediate to A 2 2 44 x ORL direct, A OR A to direct byte 2 2 42 ORL direct, #data OR immediate data to direct byte 3 3 43 XRL A, Rn Exclusive-OR register to A 1 1 68-6F x XRL A, direct Exclusive-OR direct byte to A 2 2 65 x XRL A, @Ri Exclusive-OR data memory to A 1 1 66-67 x XRL A, #data Exclusive-OR immediate to A 2 2 64 x XRL direct, A Exclusive-OR A to direct byte 2 2 62 XRL direct, #data Exclusive-OR immediate to direct 3 3 63 byte CLR A Clear A 1 1 E4 x CPL A Complement A 1 1 F4 x SWAP A Swap nibbles of A 1 1 C4 RL A Rotate A left 1 1 23 RLC A Rotate A left through carry 1 1 33 x x RR A Rotate A right 1 1 03 RRC A Rotate A right through carry 1 1 13 x x Data Transfer MOV A, Rn Move register to A 1 1 E8- x EF MOV A, direct Move direct byte to A 2 2 E5 x SWRS047A Page 25 of 146

CC1010 Mnemonic Description s e e d cl o y c C p Bytes nstr. Hex O CY AC OV P I MOV A, @Ri Move data memory to A 1 1 E6- x E7 MOV A, #data Move immediate to A 2 2 74 x MOV Rn, A Move A to register 1 1 F8-FF MOV Rn, direct Move direct byte to register 2 2 A8- AF MOV Rn, #data Move immediate to register 2 2 78-7F MOV direct, A Move A to direct byte 2 2 F5 MOV direct, Rn Move register to direct byte 2 2 88-8F MOV direct, Move direct byte to direct byte 3 3 85 direct MOV direct, @Ri Move data memory to direct byte 2 2 86-87 MOV direct, #data Move immediate to direct byte 3 3 75 MOV @Ri, A MOV A to data memory 1 1 F6-F7 MOV @Ri, direct Move direct byte to data memory 2 2 A6- A7 MOV @Ri, #data Move immediate to data memory 2 2 76-77 MOV DPTR, #data Move immediate to data pointer 3 3 90 MOVC A, @A+DPTR Move code byte relative DPTR to 1 3 93 x A MOVC A, @A+PC Move code byte relative PC to A 1 3 83 x MOVX A, @Ri Move external data (A8) to A 1 2-9 E2- x E3 MOVX A, @DPTR Move external data (A16) to A 1 2-9 E0 x MOVX @Ri, A Move A to external data (A8) 1 2-9 F2-F3 MOVX @DPTR, A Move A to external data (A16) 1 2-9 F0 PUSH direct Push direct byte onto stack 2 2 C0 POP direct Pop direct byte from stack 2 2 D0 XCH A, Rn Exchange A and register 1 1 C8- x CF XCH A, direct Exchange A and direct byte 2 2 C5 x XCH A, @Ri Exchange A and data memory 1 1 C6- x C7 XCHD A, @Ri Exchange A and data memory 1 1 D6- x nibble D7 Boolean CLR C Clear carry 1 1 C3 x CLR bit Clear direct bit 2 2 C2 SETB C Set carry 1 1 D3 x SETB bit Set direct bit 2 2 D2 CPL C Complement carry 1 1 B3 x CPL bit Complement direct bit 2 2 B2 ANL C, bit AND direct bit to carry 2 2 82 x ANL C, /bit AND direct bit inverse to carry 2 2 B0 x ORL C, bit OR direct bit to carry 2 2 72 x ORL C, /bit OR direct bit inverse to carry 2 2 A0 x MOV C, bit Move direct bit to carry 2 2 A2 x MOV bit, C Move carry to direct bit 2 2 92 SWRS047A Page 26 of 146

CC1010 Mnemonic Description s e e d cl o y c C p Bytes nstr. Hex O CY AC OV P I Branching ACALL addr 11 Absolute call to subroutine 2 3 11-F1 LCALL addr 16 Long call to subroutine 3 4 12 RET Return from subroutine 1 4 22 RETI Return from interrupt 1 4 32 AJMP addr 11 Absolute jump unconditional 2 3 01-E1 LJMP addr 16 Long jump unconditional 3 4 02 SJMP rel Short jump (relative address) 2 3 80 JC rel Jump on carry = 1 2 3 40 JNC rel Jump on carry = 0 2 3 50 JB bit, rel Jump on direct bit = 1 3 4 20 JNB bit, rel Jump on direct bit = 0 3 4 30 JBC bit, rel Jump on direct bit = 1 and clear 3 4 10 JMP @A+DPTR Jump indirect relative DPTR 1 3 73 JZ rel Jump on accumulator = 0 2 3 60 JNZ rel Jump on accumulator /= 0 2 3 70 CJNE A, direct, Compare A and direct, jump 3 4 B5 x rel relative if not equal CJNE A, #d, rel Compare A and immediate, jump 3 4 B4 x relative if not equal CJNE Rn, #d, rel Compare reg and immediate, 3 4 B8- x jump relative if not equal BF CJNE @Ri, #d, rel Compare ind and immediate, jump 3 4 B6- x relative if not equal B7 DJNZ Rn, rel Decrement register, jump relative 2 3 D8- if not zero DF DJNZ direct, rel Decrement direct byte, jump 3 4 D5 relative if not zero Misc. NOP No operation 1 1 00 TRAP Set EICON.FDIF = 1, used for 1 3 A5 breakpoints Table 12. Instruction Set Summary SWRS047A Page 27 of 146

CC1010 15.6 Interrupts In CC1010 there are a total of 15 interrupt interrupt enable and interrupt flag, is also sources, which share 12 interrupt lines. shown in the table, and will be described These are all shown in Table 13. Each below. interrupt’s natural priority, interrupt vector, Interrupt Natural Priority Interrupt Interrupt Interrupt Flag Priority Control Vector Enable Flash / Debug interrupt 0 - 0x33 EICON. EICON. FDIE FDIF External Interrupt 0 1 IP.PX0 0x03 IE.EX0 TCON.IE0 (*) Timer 0 Interrupt 2 IP.PT0 0x0B IE.ET0 TCON.TF0 (*) External Interrupt 1 3 IP.PX1 0x13 IE.EX1 TCON.IE1 (*) Timer 1 Interrupt 4 IP.PT1 0x1B IE.ET1 TCON.TF1 (*) Serial Port 0 Transmit Interrupt 5 IP.PS0 0x23 IE.ES0 SCON0.TI_0 Serial Port 0 Receive Interrupt SCON0.RI_0 Serial Port 1 Transmit Interrupt 6 IP.PS1 0x3B IE.ES1 SCON1.TI_1 Serial Port 1 Receive Interrupt SCON1.TI_1 RF Transmit / Receive Interrupt 7 EIP.PRF 0x43 EIE.RFIE EXIF.RFIF Timer 2 Interrupt 8 EIP.PT2 0x4B EIE.ET2 EXIF.TF2 ADC Interrupt 9 EIP.PAD 0x53 EIE.ADIE EXIF.ADIF and ADCON2. and ADCIE ADCON2. ADCIF DES Encryption / Decryption EIE.ADIE EXIF.ADIF Interrupt and and CRPCON. CRPCON. CRPIE CRPIF Timer 3 Interrupt 10 EIP.PT3 0x5B EIE.ET3 EXIF.TF3 Realtime Clock Interrupt 11 EIP.PRTC 0x63 EIE.RTCIE EICON.RTCIF (*) - Interrupt flag is cleared by hardware. Table 13. CC1010 Interrupt overview CC1010 executes the ISR to completion 15.6.1 Interrupt Masking unless another interrupt set at a higher IE.EA is the global interrupt enable for all interrupt level occurs. Each ISR ends with interrupts, except the Flash / Debug a RETI (return from interrupt) instruction. interrupt. When IE.EA is set, each After executing the RETI, CC1010 returns interrupt is masked by the interrupt enable to the next instruction that would have bits listed in Table 13. When IE.EA is been executed if the interrupt had not cleared, all interrupts are masked, except occurred. the Flash / Debug interrupt, which has its CC1010 always completes the instruction in own interrupt mask bit, EICON.FDIE. progress before servicing an interrupt. If the instruction in progress is RETI, or a 15.6.2 Interrupt Processing write access to any of the IP, IE, EIP, or When an enabled interrupt occurs, the EIE SFRs, CC1010 completes one CPU jumps to the address of the interrupt additional instruction before servicing the service routine (ISR) associated with that interrupt. interrupt, as shown in Table 13. Most interrupts can also be initiated by setting the associated interrupt flag from software. SWRS047A Page 28 of 146

CC1010 IE (0xA8) - Interrupt Enable Register Bit Name R/W Reset value Description 7 EA R/W 0 Global Interrupt enable / disable 0 : All interrupts except the Flash / debug interrupt are disabled 1 : Each interrupt is enabled by its individual masking bit 6 ES1 R/W 0 Serial Port 1 interrupt enable / disable 0 : Interrupt is disabled 1 : Interrupt is enabled, when also EA is set 5 - R/W 0 Reserved for future use 4 ES0 R/W 0 Serial Port 0 interrupt enable / disable 0 : Interrupt is disabled 1 : Interrupt is enabled, when also EA is set 3 ET1 R/W 0 Timer 1 interrupt enable / disable 0 : Interrupt is disabled 1 : Interrupt is enabled, when also EA is set 2 EX1 R/W 0 External interrupt 1 (from P3.3) enable / disable 0 : Interrupt is disabled 1 : Interrupt is enabled, when also EA is set 1 ET0 R/W 0 Timer 0 interrupt enable / disable 0 : Interrupt is disabled 1 : Interrupt is enabled, when also EA is set 0 EX0 R/W 0 External interrupt 0 (from P3.2) enable / disable 0 : Interrupt is disabled 1 : Interrupt is enabled, when also EA is set EIE (0xE8) - Extended Interrupt Enable Register Bit Name R/W Reset value Description 7 - R1 1 Reserved, read as 1 6 - R1 1 Reserved, read as 1 5 - R1 1 Reserved, read as 1 4 RTCIE R/W 0 Realtime Clock interrupt enable / disable 0 : Interrupt is disabled 1 : Interrupt is enabled, when also EA is set 3 ET3 R/W 0 Timer 3 interrupt enable / disable 0 : Interrupt is disabled 1 : Interrupt is enabled, when also EA is set 2 ADIE R/W 0 ADC / DES interrupt enable / disable 0 : Interrupt is disabled 1 : Interrupt is enabled, when also EA is set 1 ET2 R/W 0 Timer 2 interrupt enable / disable 0 : Interrupt is disabled 1 : Interrupt is enabled, when also EA is set 0 RFIE R/W 0 RF Interrupt enable / disable 0 : Interrupt is disabled 1 : Interrupt is enabled, when also EA is set SWRS047A Page 29 of 146

CC1010 EICON (0xD8) - Extended Interrupt Control Bit Name R/W Reset value Description 7 SMOD1 R/W 0 Serial Port 1 baud rate doubler enable / disable 0 : Serial Port 1 baud rate is normal 1 : Serial Port 1 baud rate is doubled 6 - R1 1 Reserved, read as 1 5 FDIE R/W 0 Flash / Debug interrupt enable 0 : Interrupt is disabled 1 : Interrupt is enabled (independent of IE.EA) 4 FDIF R/W 0 Flash / Debug interrupt flag FDIF is set by hardware when an 8051-initiated write to Flash program memory is completed or a TRAP instruction is executed. FDIF may also be set by software. FDIF must be cleared by software before exiting the ISR. 3 RTCIF R/W 0 Real-time clock interrupt flag RTCIF is set by hardware when an interrupt request is generated from the real-time clock. RTCIF may also be set by software. RTCIF must be cleared by software before exiting the ISR. 2 - R0 0 Reserved, read as 0 1 - R0 0 Reserved, read as 0 0 - R0 0 Reserved, read as 0 EXIF (0x91) - Extended Interrupt Flag Bit Name R/W Reset value Description 7 TF3 R/W 0 Timer 3 interrupt flag. TF3 is set by hardware when an interrupt request is generated from Timer 3. TF3 may also be set by software. TF3 must be cleared by software before exiting the ISR. 6 ADIF R/W 0 ADC / DES Interrupt flag. ADIF is set by hardware when an interrupt request is generated from the ADC block (ADCON2.ADCIF) or by the DES Encryption / Decryption block (CRPCON.CRPIF). These interrupts must also be enabled by setting ADCON2.ADCIE and CRPCON.CRPIE. ADIF may also be set by software. ADIF must be cleared by software before exiting the ISR 5 TF2 R/W 0 Timer 2 interrupt flag. TF2 is set by hardware when an interrupt request is generated from Timer 2. TF2 may also be set by software. TF2 must be cleared by software before exiting the ISR 4 RFIF R/W 0 RF Transmit / receive interrupt flag. RFIF is set by hardware when an interrupt request is generated from the RF transceiver block. RFIF may also be set by software. RFIF must be cleared by software before exiting the ISR. 3 - R1 1 Reserved, read as 1 2 - R0 0 Reserved, read as 0 1 - R0 0 Reserved, read as 0 0 - R0 0 Reserved, read as 0 SWRS047A Page 30 of 146

CC1010 15.6.3 Interrupt Priority Two interrupts with the same interrupt Interrupts are prioritised in two stages: priority that occur simultaneously are Interrupt level and natural priority. The resolved through their natural priority. The interrupt level (low, high or highest) takes natural priority is shown in Table 13. The precedence over the natural priority. interrupt having the lowest natural priority The Flash / Debug Interrupt, if enabled, will be serviced first. always has the highest priority and is the Once an interrupt is being serviced, only only interrupt that can have the highest an interrupt of higher priority level can priority. All other interrupts can be interrupt the service routine of the interrupt assigned either low or high priority, set by currently being serviced. the registers IP and EIP listed below. IP (0xB8) - Interrupt Priority Register Bit Name R/W Reset value Description 7 - R1 1 Reserved, read as 1 6 PS1 R/W 0 Serial Port 1 interrupt priority control 0 : Interrupt has low priority 1 : Interrupt has high priority 5 - R/W 0 Reserved for future use 4 PS0 R/W 0 Serial Port 0 interrupt priority control 0 : Interrupt has low priority 1 : Interrupt has high priority 3 PT1 R/W 0 Timer 1 interrupt priority control 0 : Interrupt has low priority 1 : Interrupt has high priority 2 PX1 R/W 0 External Interrupt 1 (from P3.3) interrupt priority control 0 : Interrupt has low priority 1 : Interrupt has high priority 1 PT0 R/W 0 Timer 0 interrupt priority control 0 : Interrupt has low priority 1 : Interrupt has high priority 0 PX0 R/W 0 External Interrupt 0 (from P3.2) interrupt priority control 0 : Interrupt has low priority 1 : Interrupt has high priority EIP (0xF8) - Extended Interrupt Priority Register Bit Name R/W Reset value Description 7 - R1 1 Reserved, read as 1 6 - R1 1 Reserved, read as 1 5 - R1 1 Reserved, read as 1 4 PRTC R/W 0 Realtime Clock interrupt priority control 0 : Interrupt has low priority 1 : Interrupt has high priority 3 PT3 R/W 0 Timer 3 interrupt priority control 0 : Interrupt has low priority 1 : Interrupt has high priority 2 PAD R/W 0 ADC / DES interrupt priority control 0 : Interrupt has low priority 1 : Interrupt has high priority 1 PT2 R/W 0 Timer 2 interrupt priority control 0 : Interrupt has low priority 1 : Interrupt has high priority 0 PRF R/W 0 0 : Interrupt has low priority 1 : Interrupt has high priority SWRS047A Page 31 of 146

CC1010 15.7 External interrupts Two external interrupt pins are available in register, any pulse longer than 8 clock the CC1010. They are located on pins P3.2 cycles will always generate an interrupt. and P3.3, and can be set up to be either The CC1010 will wake up from Idle mode level- or edge sensitive by setting the IT1 when an external interrupt pin is activated, and IT2 bits in the TCON register (see but the external interrupt pins cannot wake page 54 for more information). When the the CC1010 from Power-Down mode. external interrupts are activated in the IE 15.8 Main Crystal Oscillator An external clock signal or the main crystal The parasitic capacitance is constituted by oscillator can be used as main frequency pin input capacitance and PCB stray reference and microcontroller clock signal. capacitance. Typically the total parasitic An external clock signal should be capacitance is 3-5pF. A trimming capacitor connected to XOSC_Q1, while XOSC_Q2 may be placed across C171 for initial should be left open. tuning if necessary. The microcontroller core and main The crystal oscillator is of an advanced oscillator will operate at any frequency in amplitude-regulated type. A high current is the range 3 - 24 MHz. However, the used to start up the oscillations. When the crystal frequency should be in the range 3- amplitude builds up, the current is reduced 4, 6-8 or 9-24 MHz because the crystal to what is necessary to maintain a 600 frequency is used as reference for the mVpp amplitude. This ensures a fast start- data rate in the RF transceiver part (as up, keeps the current consumption and the well as other internal functions). The drive level to a minimum and makes the following frequencies are recommended oscillator insensitive to ESR variations. As as they will provide “standard” data rates: long as you follow the crystal loading 3.6864, 7.3728, 11.0592, 14.7456, capacitance requirements, do not worry 18.4320 and 22.1184 MHz. The selected about ESR or drive levels (a typical drive crystal frequency range must be set in level is 4 µW for 3 MHz). MODEM0.XOSC_FREQ(2:0) in order to The main crystal oscillator circuit is shown get the correct data rate (see page 93). in Figure 4. Typical component values for Using the main crystal oscillator, the different values of CL are given in Table crystal must be connected between the 14. Recommended load capacitance pins XOSC_Q1 and XOSC_Q2. The versus frequency is given in Table 10 on oscillator is designed for parallel mode page 12. operation of the crystal. In addition loading The initial tolerance, temperature drift, capacitors (C171 and C181) for the crystal ageing and load pulling should be carefully are required. The loading capacitor values specified in order to meet the required depend on the total load capacitance, C , L frequency accuracy in a certain specified for the crystal. The total load application. By specifying the total capacitance seen between the crystal expected frequency accuracy in SmartRF® terminals should equal C for the crystal to L Studio together with data rate and oscillate at the specified frequency. frequency separation, the software will calculate the total bandwidth and compare 1 C = +C to the available IF bandwidth. Any L 1 1 parasitic contradictions will be reported by the + C C software and a more accurate crystal will 171 181 be recommended if required. SWRS047A Page 32 of 146

CC1010 XOSC_Q1 XOSC_Q2 XXTTAALL C181 C171 Figure 4. Crystal oscillator circuit Item C = 12 pF C = 20 pF L L C171 15 pF 30 pF C181 15 pF 30 pF Table 14. Crystal oscillator component values SWRS047A Page 33 of 146

CC1010 15.9 Power and Clock Modes Several power modes are defined to save 15.9.3 Power-Down Mode power when running CC1010. The modes are described below. See also Table 15. After completing the instruction that sets the PCON.STOP bit, the controller core and 15.9.1 Active Mode the peripherals are stopped. In Power- Down Mode, the clock trees of the 8051 In active mode the 8051 is running and peripherals are disabled. Only the normally, executing instructions from the ADC clock tree is running. This enables Flash program memory. The clock used in the ADC to generate reset as will be this mode could either be the main crystal described in the ADC section. oscillator, or it could be the 32 kHz oscillator. The current consumption Note that the PCON.STOP bit does not depends on the actual frequency used. affect the clock oscillators; these will still be running if they are switched on when 15.9.2 Idle Mode entering Power-Down Mode. After completing the instruction that sets To ensure minimum power-consumption, the PCON.IDLE bit, Idle Mode is entered. the ADC should be switched off and In Idle Mode, the 8051 processing is Power-down mode should be entered by stopped and internal registers maintain switching off the oscillators instead of their current data, but all peripherals are using the PCON.STOP bit. still running. There are 2 ways to exit Power Down There are 3 ways to exit Idle Mode: Mode: • Activate any enabled interrupt. This • Activate any reset condition. All clears the IDLE bit, terminating Idle registers are then reset, and program Mode, and executes the ISR execution will resume when the reset associated with the received interrupt. condition is cleared. Program The RETI instruction at the end of the execution will then resume from ISR causes the 8051 to return to the address 0x0000. instruction following the one that • Turn the power off and on. The Power enabled Idle Mode. On Reset module should then be • Activate any reset condition. All enabled, or an external reset signal registers are then reset, and program should be applied during power up. execution will resume from address More information about minimising the 0x0000 when the reset condition is power consumption of the CC1010 can be cleared. found in Application Note AN017 Low • Turn the power off and on. The Power Power Systems Using The CC1010. On Reset module should then be enabled, or an external reset signal should be applied during power up. SWRS047A Page 34 of 146

CC1010 Mode Core Peripherals Typical current Exit condition consumption1 Main osc. Main osc. 14.8 mA at Writing SFR 14.7456 MHz Active RTC osc. RTC osc. 1.3 mA Writing SFR (32 kHz) (32 kHz) Stopped Main osc. 12.8 mA at Interrupt 14.7456 MHz Reset Idle Stopped RTC osc. 29.4 uA Power off/on (32 kHz) ADC Off Stopped ADC On 200 uA ADC value exceeds threshold (32 kHz) Reset Power-Down Power off/on Stopped Stopped 0.2 uA Reset Power off/on Note 1: Flash duty-cycle reduction is used for all modes Table 15. Operating modes summary Clock Mode 1 to Clock Mode 0 will require 15.9.4 Clock Modes the main crystal oscillator to be powered The 8051 and its peripherals can be run up again. on both the main crystal oscillator (Clock Since the Flash program memory draws a Mode 0) and the 32.768 kHz oscillator static current, Idle Mode together with (Clock Mode 1). The clock mode is set in Flash Power Control (see page 43) should X32CON.CMODE. be applied for maximum power saving in Clock Mode 1. 15.9.5 Entering Clock Mode 1 from Clock Mode 0 The RF receiver cannot be activated in Clock Mode 1. After reset, the 8051 and its peripherals are running on the main crystal oscillator, 15.9.6 Entering Clock Mode 0 from and the 32.768 kHz oscillator is in power Clock Mode 1 down. To enter Clock Mode 1, the 32.768 kHz oscillator must first be powered up. To enter Clock Mode 0 from Clock Mode This requires clearing X32CON.X32_PD 1, the main crystal oscillator must first be and then waiting at least 160 ms, after set in power up (if powered down). This which X32CON.CMODE can be set to enter requires clearing RFMAIN.CORE_PD and Clock Mode 1. RFMAIN.BIAS_PD and then waiting at least 5 ms (depend on main oscillator If an external 32.768 kHz clock source is frequency, see Electrical Specifications already available in the system, this clock page 7). If the oscillator is already can be applied to the XOSC32_Q1 pin after powered up, no waiting is required. setting the X32CON.X32_BYPASS bit. Clearing X32CON.CMODE will then cause a After 2 to 3 clock periods on the 32.768 glitch free transition from Clock Mode 1 to kHz oscillator, a glitch free transition has Clock Mode 0 after 2 to 3 clock periods on been made from the main crystal oscillator the main crystal oscillator. to the 32.768 kHz oscillator. If desired, the main crystal oscillator can then be set in 15.9.7 Flash Power Control power down to save more power by The Flash program memory current setting RFMAIN.CORE_PD and consumption can be controlled as RFMAIN.BIAS_PD. This has the described in the Flash Power Control disadvantage that a later transition from section on page 43. SWRS047A Page 35 of 146

CC1010 PCON (0x87) - Power Control Register Bit Name R/W Reset value Description 7 SMOD0 R/W 0 Serial Port 0 baud rate doubler enable. 0 : Serial Port 0 baud rate is not doubled 1 : Serial Port 0 baud rate is doubled 6 - R/W 0 Reserved 5 - R1 1 Reserved, read as 1 4 - R1 1 Reserved, read as 1 3 GF1 R/W 0 General purpose flag 1. Bit-addressable, general purpose flag for software control. 2 GF0 R/W 0 General purpose flag 0. Bit-addressable, general purpose flag for software control. 1 STOP R/W 0 Power Down (Stop) mode select. Setting the STOP bit places CC1010 core and peripherals in Stop Mode. 0 IDLE R/W 0 Idle mode select. Setting the IDLE bit places CC1010 in Idle Mode (core is stopped but peripherals are running). X32CON (0xD1) - 32.768 kHz Crystal Oscillator Control Register Bit Name R/W Reset value Description 7 - R0 0 Reserved, read as 0 6 - R0 0 Reserved, read as 0 5 - R0 0 Reserved, read as 0 4 - R0 0 Reserved, read as 0 3 - R0 0 Reserved, read as 0 2 X32_BYPASS R/W 0 32.768 kHz oscillator bypass control signal 0 : The internal 32.768 kHz oscillator is used to generate the 32.768kHz clock 1 : The internal 32.768 kHz oscillator is bypassed, and an external clock signal can be applied to the XOSC32_Q1 pin. 1 X32_PD R/W 1 32.768 kHz oscillator power down signal 0 : The oscillator is powered up 1 : The oscillator is powered down (default after reset) 0 CMODE R/W 0 Select different Clock Modes for the 8051 and its peripherals. 0 : Clock Mode 0 is selected (default after reset) 1 : Clock Mode 1 is selected SWRS047A Page 36 of 146

CC1010 15.10 Flash Program Memory CC1010 has 32 kBytes of on-chip Flash others. It can also prevent parts of the program memory. It is divided into 256 Flash memory from being modified by pages of 128 bytes each. It can be software, such as a boot loader that programmed / erased through a serial SPI should remain unchanged. Other parts of interface or page-by-page from the 8051 the Flash may still be updated by the boot as described in the following sections. loader. The endurance for the Flash program For the security of the Flash protection, memory is typically 20.000 erase / write please refer to the disclaimer at the end of cycles. this document. The Flash program memory can be locked Erasing a Flash page takes 10-20 ms for further reading / writing by setting depending on the FLTIM register. Writing appropriate lock bits through the serial to a Flash page takes 5-10 ms. interface. Chip erase must be performed to unlock the memory. This provides a way to prevent software from being copied by 15.11 SPI Flash Programming The on-chip Flash program memory can 3. Set PROG low. be programmed using the SPI Flash programming protocol described in this 4. Send the Programming Enable section. command. Check that the slave is synchronised by verifying that the SPI Flash programming is enabled when second byte of the instruction is the pin PROG is held low. This enables the echoed back when issuing the third SPI slave, using the pins SCK (P0.0) as byte. If the second byte did not echo, the clock input, SI (P0.1) as the serial issue a positive pulse on SCK and try data input and SO (P0.2) as the serial again. In the worst case it will take 32 data output. attempts to synchronise. A Windows based Flash programmer is 5. Send the Set Write Cycle Time also available free of charge at the command according to the device Chipcon web site. clock oscillator frequency. c*16*clock period must be between 20-40us for safe flash programming. 15.12 Serial Programming Algorithm 6. If a chip erase is performed wait When writing serial data to the SPI 450ms after the instruction before interface, data is clocked at the rising edge issuing Write. of SCK. When reading data from the SPI interface, data is clocked at the falling 7. Flash memory is programmed one edge of SCK, see Figure 5. page at a time. Each page consists of 128 bytes. Load all bytes of the page 1. Apply power between V and DGND DD that is to be programmed with the while SCK is set to ‘0’. If a crystal is not Load Program Memory Page connected between XOSC_Q1 and instruction. XOSC_Q2 apply a clock signal to the 8. When all bytes of a page has been XOSC_Q1 pin. loaded issue Write Program Memory Page with the page address. The write 2. Give RESET a negative pulse of at operation finishes within 5.4ms. least one XOSC period. Reading an address while writing will return 0xFF. This can be used for polling SWRS047A Page 37 of 146

CC1010 to determine when a page write is finished. 15.12.1 SPI Flash Programming When a read instruction returns anything Instructions other than $FF all flash write operations 9 instructions are defined to perform the have finished. serial Flash programming. These are shown in Table 16. Instruction Byte 1 Byte 2 Byte 3 Byte 4 Operation Enable serial Programming 1010 1100 0101 0011 xxxx xxxx xxxx xxxx programming after Enable PROG is set low Set the Flash timing Set Flash 1010 1100 0101 1101 xxxx xxxx xxii iiii Timing register Chip erase. Clears all 1010 1100 100x xxxx xxxx xxxx xxxx xxxx pages, including the Chip Erase lock bits. Load data i to Load Program 0100 H000 xxxx xxxx bbbb bbxx iiii iiii Programming Buffer at Memory Page address b:H Write the loaded page Write Program 0100 1100 aaaa aaaa xxxx xxxx xxxx xxxx Memory Page at address a. Read data o at address Read Program 0010 H000 aaaa aaaa bbbb bbxx oooo oooo Memory a:b:H Write Lock Bits. Bits written will be ANDed 1010 1100 111x xxxx xxxx xxxx iiii iiii Write Lock Bits together with the existing lock bits. Read Lock 0101 1000 xxxx xxxx xxxx xxxx oooo oooo Read lock bits. Bits Read signature byte o Read 0011 0000 xxxx xxxx xxxx xsss oooo oooo Signature Byte at address s a: Page address s: Signature byte address b: Even byte address i: Input data H: Odd or even (high or low) byte o: Output data c: Clock timing bits x: Don’t care Table 16. SPI Flash Programming Instructions Each instruction is sent in the order bytes The timing for the SPI interface is shown 1 to 4, most significant bits first. All 4 bytes in Figure 5. All timing parameters are must be sent, even if the last bits are 'x'. listed in Table 17. SWRS047A Page 38 of 146

CC1010 Tsck, high Tsck, low Tsck, rise Tsck, fall SCK (P0.0) SI (P0.1) 7 6 5 4 3 2 1 0 SO (P0.2) 7 6 5 4 3 2 1 0 Tsi, setup Tsi, hold Tso, delay Figure 5. SPI Flash Programming Timing Symbol Min Max Units Conditions Fsck - f / 8 XOSC Tsck, high 4 ⋅ T - The minimum time SCK must be held high XOSC Tsck, low 4 ⋅ T - The minimum time SCK must be held low XOSC Tsck, rise - T /2 ns The maximum rise time on SCK XOSC Tsck, fall - T /2 ns The maximum fall time on SCK XOSC Tsi, setup T - The minimum setup time for SI before the positive edge XOSC on SCK Tsi, hold T - The minimum hold time for SI after the positive edge on XOSC SCK Tso, delay - T The delay from the negative edge on SCK to valid data XOSC on SO Table 17. SPI Flash Programming Timing Parameters f f 15.12.2 Programming Enable XOSC ≤FLTIM≤ XOSC 0.8MHz 0.4MHz Programming Enable is always the first instruction to be sent. It must be sent to It is recommended to set FLTIM to the synchronise the data flow and enable smallest number satisfying the equation CC1010 to receive further instructions. above, to reduce the time needed for Synchronisation is achieved when byte 2 Flash programming. For a 3.6864 MHz of the instruction (0x53) is echoed back crystal, FLTIM should be set to 5. from the SPI interface as byte 3. If synchronisation is not achieved, byte 3 will 15.12.4 Chip Erase return all zeros. In this case, an extra clock The Chip Erase instruction erases all data pulse should be inserted on SCK, and the in the Flash memory, including the lock Programming Enable instruction should be bits. All bits will be set high. resent. If synchronisation is not successful within 32 attempts, Programming Enable Wait 450 ms (depending on Set Flash is unsuccessful and further debugging is Timing) after sending the Chip Erase needed. instruction before issuing a new instruction. 15.12.3 Set Flash Timing 15.12.5 Load Program Memory Page The Set Flash Timing instruction is needed to generate internal timing for the Flash The Load Program Memory Page module. FLTIM must be set in instruction instruction is used to load the 128 bytes of byte 4 so that: data in a page to a buffer in RAM. Each instruction writes one byte to the 7 bit address specified in the instruction. SWRS047A Page 39 of 146

CC1010 15.12.6 Write Program Memory Page Bit Name Function 7:3 - Reserved, write as '0' The Write Program Memory Page 4 BBLOCK Boot Block Lock instruction writes the 128 bytes buffered 0 : Page 0 is write through the Load Program Memory Page protected instructions to Flash memory. 1 : Page 0 is writeable, unless LSIZE is 000 After issuing this command, wait 5.4 ms 3:1 LSIZE[2:0] Lock Size, sets the size of for it to complete. It is also possible to use the upper Flash area which the Read Program Memory instruction to is write protected. Byte poll when the program memory has been sizes and page numbers written. When writing is in progress, all are listed below: read instructions will return 0xFF. Reading 000 : 32768 (All pages) an address containing data different from 001 : 16384 (page 128- 255) 0xFF can then be used to check when the 010 : 8192 (page 192-255) write is completed. 011 : 4096 (page 224-255) 100 : 2048 (page 240-255) 15.12.7 Read Program Memory 101 : 1024 (page 248-255) 110 : 512 (page 252-255) The Flash program memory can be read 111 : 0 (no pages) back byte by byte using the Read Program 0 SPIRE SPI Read Flash Enable / Memory instruction. The data is returned Disable in byte 4 of the instruction. 0 : SPI Interface returns all zeros on the Read Wait at least 9 ⋅ T between the last XOSC Program Memory negative transition on SCK for byte 3 instruction before issuing the first positive edge on 1 : SPI Interface returns SCK for byte 4 to receive valid data. valid Flash data on the Read Program Memory 15.12.8 Write Lock Bits instruction The reading (through SPI) and writing to Table 18. Flash Lock Bits the Flash program memory can be Lock bits can only be erased (set high) by disabled by setting the lock bits as issuing the Chip Erase instruction. If described in this section. This should be multiple Write Lock Bits instructions are used for software protection. issued without chip erase in between, The lock bits are set using the Write Lock each lock bit will be AND-ed together with Bits instruction. A block of programmable the previously written lock bits. size at the top of the Flash program In effect, this means that it is not possible memory can be locked for writing using to unlock the Flash program memory the LSIZE bits. Page 0 can be without also erasing it. independently locked for writing by using The effect of the different lock size bits are the BBLOCK bit. Reading data through the illustrated in Figure 6. SPI interface can be disabled using the SPIRE bit. The detailed description of all lock bits is given in Table 18. SWRS047A Page 40 of 146

CC1010 signature byte address is issued, and the mber 000 001 010 011 100 101 110 111 value is then returned as byte 4. ddress age nu SIZE = SIZE = SIZE = SIZE = SIZE = SIZE = SIZE = SIZE = Signature A P L L L L L L L L byte address Value Meaing 0x7FFF 225545 KED 000 0x7F JEDEC manufacturer 0x7E00 222555123 CKED LOC 000110 00xx77FF IADS, iadse nthtiefi es Chipcon 250 D LO 011 0x9E manufacturer. 249 E 0x7C00 222444678 ED LOCK 100 0x95 oIdf eFnlatifsiehs m 3e2m koBryyt es K 101 0x00 Identifies CC1010 C O 242 D L 241 E Table 19. Signature Bytes 0x7800 223490 OCK 238 ED L Wait at least 9 ⋅ TXOSC between the last K C negative transition on SCK for byte 3 222256 ED LO KED before issuing the first positive edge on 00xx76000000 111122299992221234234 LOCK OCKED UNLOCKED UNLOCKED UNLOC Swi1n5Cist.Kht1r u2fc.o1trit1o h bneSy. PteI RF4lea atsodh rPercoPegrirvoaegm ravmmailn idg dMaetam, oarys 190 KED UNL Initialisation C 0x4000 111122237890 D OCKED UNLO CpCro10g1r0am mmiunsgt mboed e setot ainllotow tShPe I FFllaasshh 126 CKE UNL operations. This is done as follows: O 12 UNL • Apply power between all DVDD and 0 DGND pins. 0x0000 Page 0 is locked when BBLOCK is cleared • Hold PROG low. Figure 6. Flash Lock Bits illustration • If a crystal is connected between XOSC_Q1 and XOSC_Q2, hold RESET 15.12.9 Read Lock Bits low and wait for the oscillator to start The lock bits described in the previous up. Crystal oscillator start-up times are section can be read through the SPI given in Table 10. Release RESET interface by using the Read Lock Bits and wait at least 4 crystal oscillator instruction. The instruction will return the 8 periods. lock bits in byte 4 of the instruction. • If a crystal is not connected between Wait at least 9 ⋅ T between the last XOSC negative transition on SCK for byte 3 XOSC_Q1 and XOSC_Q2, hold RESET before issuing the first positive edge on low and apply a clock signal to SCK for byte 4 to receive valid data, as XOSC_Q1. Release RESET after at with the Read Program Memory instruction. least 3 clock periods, and then wait at least 4 clock periods. The lock bits can only be read through the SPI interface, and not from the 8051 core. • Execute the Programming Enable instruction to complete the SPI Flash 15.12.10 Read Signature Byte programming Initialisation. A 6 byte chip signature can be read CC1010 is now ready to be programmed, as through the SPI interface using the Read described in the next section. Signature Byte instruction. The 3 bit SWRS047A Page 41 of 146

CC1010 15.12.12 Programming the Flash Memory • Repeat the loading and writing of each new page. After the initialisation is completed, SPI programming can be performed as follows: • Programming can be verified using the Read Program Memory instruction. • Device identity can be verified using the Read Signature Byte instruction. • Set the lock bits using the Write Lock Bits instruction. • Perform Chip Erase. • Lock bits can be verified by using the • Load one page into the buffer using Read Lock Bits instruction. the Load Program Memory Page instruction. • Write the buffer to Flash by using the Write Program Memory Page instruction. 15.13 8051 Flash Programming Each of the 256 pages (128 bytes each) in • Disable all interrupts except the Flash Flash program memory can be / Debug interrupt, which must be programmed individually from the 8051. enabled (through EICON.FDIE). The 8051 must be set in Idle Mode while • Store the 128 bytes of data to be programming the Flash, since it has no written in the external data memory. access to the program memory while the The address of the first byte in the writing is in progress. buffer must be a multiple of 128. The step for writing a page to Flash is described as follows: • Write the 4 most significant bits of the RAM buffer address to • Set the correct write cycle time, FLCON.RMADR(3:0). Also set the bit according to the current crystal FLCON.WRFLASH. oscillator frequency, in the FLTIM SFR. This number is used to generate • Set the 8051 in Idle Mode by setting the timing to the on-chip Flash PCON.IDLE. The Flash page is then interface, as was also done with SPI automatically erased and Flash programming. It must be set so programmed. that: The sequence of the above steps is not important. Flash programming is started f f XOSC ≤FLTIM≤ XOSC whenever entering Idle Mode while 0.8MHz 0.4MHz FLCON.WRFLASH is set. • The time used for programming a A Flash / Debug interrupt will be generated Flash page is strongly dependent on when the page write operation is the setting in FLTIM. It is therefore completed, which will get the 8051 out of recommended to set FLTIM as low as Idle Mode. An ISR must be present to possible, as with the SPI Flash service the Flash / Debug interrupt. programming. • Write the desired Flash page number to the FLADR register. SWRS047A Page 42 of 146

CC1010 FLADR (0xAE) - Flash Write Address Register Bit Name R/W Reset value Description 7:0 FLADR(7:0) R/W 0x00 The number of of the Flash page to be written (8 MSB of the byte address) FLCON (0xAF) - Flash Write Control Register Bit Name R/W Reset value Description 7 - R0 0 Reserved, read as 0 6:5 FLASH_LP R/W 00 Flash Low Power control bits (1:0) 00 : The Flash module is always active. 01 : The Flash module enters standby mode when the 8051 is put in Idle mode or Stop mode 10 : The Flash module enters standby mode between instruction fetches and when the 8051 is put in Idle Mode or Stop Mode. 11 : Reserved for future use. 4 WRFLASH R/W 0 Write Flash Start bit Starting a Flash page programming is done by first setting this bit and then setting the 8051 in Idle Mode. If the WRFLASH bit is cleared before Idle Mode is entered, no programming is performed. 3:0 RMADR(3:0) R/W 0x0 RAM Buffer address RMADR(3:0) contains the 4 most significant bits of the RAM address where the data is buffered before writing to Flash FLTIM (0xDD) - Flash Write Timing Register Bit Name R/W Reset value Description 7:0 FLTIM(7:0) R/W 0x0A Flash Write Timing control FLTIM must be set as described in this section prior to using the 8051 Flash programming. If an attempt is made to write data to a 15.13.1 Example Code Flash page which is locked (see the previous section), a Flash / Debug Example C code writing data buffered at interrupt will be generated immediately address 0x100-0x17F in external RAM to after Idle Mode is entered. No data will be the second page in Flash (address 0x080- written. 0x0FF) is shown below. The system clock frequency is assumed to be 3.6864 MHz. It is not possible to read or write the Flash lock bits from the 8051. An interrupt service routine must be present at address 0x33, which clears the interrupt flag EICON.FDIF and returns from the interrupt (RETI). FLTIM=0x05; /* Set Flash timing for 3.6864 MHz clock frequency */ FLADR=0x01; /* Write data to the second page in Flash */ EICON|=0x20; /* Enable Flash interrupt */ IE&= ~0x80; /* Disable other interrupts */ FLCON=0x10 | (0x100 >> 7); /* Enable Flash writing, RAM buffer from addr. 0x100 */ PCON|=0x01; /* Enter Idle Mode to start Flash writing. 15.14 Flash Power Control SWRS047A Page 43 of 146

CC1010 The Flash module can be set into different operating conditions). However, to save power modes using the control bits power the Flash module can be set in a FLCON.FLASH_LP(1:0) introduced in power-down mode between instructions in the previous section. Active mode, and always in Idle or Power- Down mode. This will save approximately After reset, the Flash module is always 1.5 mA of the Flash current consumption active, drawing a static current of during operation in Active mode, and 2.5 approximately 2.5 mA (at nominal mA during Idle or Power-Down mode. 15.15 In Circuit Debugging In order to facilitate a software monitor for Since the Flash memory can only in-circuit debugging/emulation capabilities withstand 20000 (typical) erase/write- a number of hardware support features cycles a simple instruction replacement have been implemented: mechanism has been implemented. This feature allows the surveillance of an A breakpoint instruction has been added address in the instruction memory space to the 8051's instruction set. The as defined in registers RADRL and RADRH. instruction, given the mnemonic TRAP, is a When this address is encountered on the single byte instruction with the opcode Flash program memory address bus, the 0xA5. In the original 8051 the 0xA5 data returned on the data bus is replaced opcode is executed as a NOP instruction by the contents of register RDATA. Setting (opcode 0x00.) In the modified core this RADRH=RADRL=0 disables the instruction raises a highest-level interrupt replacement mechanism. (Flash / Debug) by setting the corresponding interrupt flag EICON.FDIF This instruction replacement mechanism and waiting a sufficient number of can be used in different ways: instruction cycles to allow the interrupt to • A simple way of setting a single soft take effect before the next instruction. (not stored in FLASH) breakpoint, by The TRAP instruction can thus be written setting RDATA to 0xA5 (the TRAP over the first byte (opcode) of any other instruction) and RADR to the instruction, the execution of which then will breakpoint address. result in a branch to a software debugging • A simple way of restoring the original monitor in the highest priority interrupt opcode byte of an instruction which service routine. has been subjected to a hard (stored Single-stepping through instructions is in Flash) breakpoint, so that it can be supported since exactly one instruction is executed (in single-step mode). executed if an interrupt condition exists when returning from an interrupt service • SFRs (hardware registers) can routine. Thus, single-stepping can be normally only be addressed directly accomplished simply by not clearing the (i.e. by hardwiring the specific address corresponding interrupt flag in the interrupt into the corresponding MOV service routine associated with the instruction.) This would make code in software monitor. a debug monitor, which returns the value of SFRs to a PC rather bloated. A second serial port has been added to Using the instruction replacement enable debugging communication with a mechanism on the operand byte of the host PC without disrupting applications move instruction instead of the opcode that use the main serial port for other byte, allows indirect addressing of purposes. SFRs. Setting breakpoints and executing the Chipcon provides software for in-circuit instructions which have a breakpoint debugging, which may be downloaded attached involves writing new data to the from the Chipcon homepage. This Flash instruction memory several times. software uses the RESERVED register, SWRS047A Page 44 of 146

CC1010 which can then not be used for other there will be a short interval where the purposes. If in-circuit debugging is not address is not valid as only one of the required, the RESERVED register shown bytes are written at a time. If this below may be used for any purpose. intermediate address point to the very Writing to it will have no effect on the same location as of the code modifying the operation of CC1010. RADR, a malfunction will occur. One possible work-around is to first write Great caution should be used when the RADRH to a value pointing to a memory RADR is written. Since the address location not used by the code. consists of two bytes (RADRL and RADRH), RESERVED (0xE7) - Reserved register, used by Chipcon debugger software Bit Name R/W Reset value Description 7:0 RESERVED(7:0) R/W 0x00 Reserved register, which is used by Chipcon debugger software. RESERVED may be used for other purposes if Chipcon’s debugger software is not needed. RDATA (0xB9) - Replacement Data Bit Name R/W Reset value Description 7:0 RDATA(7:0) R/W 0x00 Replacement data. Used to replace the byte at program memory address RADR with the data from RDATA, if RADR > 0. RADRH (0xBB) - Replacement address, high byte Bit Name R/W Reset value Description 7:0 RADR(15:8) R/W 0x00 Replacement address, high byte. Used to replace the byte at program memory address RADR with the data from RDATA, if RADR > 0. RADRL (0xBA) - Replacement address, low byte Bit Name R/W Reset value Description 7:0 RADR(7:0) R/W 0x00 Replacement address, low byte. Used to replace the byte at program memory address RADR with the data from RDATA, if RADR > 0 15.16 Chip Version / Revision CC1010 has a SFR register CHVER that can current revision. The register description is be read to decide the chip type and shown below. CHVER (0x9F) - Chip Version / Revision Register Bit Name R/W Reset value Description 7:2 CHIP_TYPE R 0x00 CHIP_TYPE is a read-only status word, which gives the type number of the chip. 000000 : CC1010 000001 - 111111 : Reserved for future use 1:0 CHIP_REV R 0x01 CHIP_REV is a read only status word, which gives the chip revision number of the chip. Current chip revision is 01 SWRS047A Page 45 of 146

CC1010 SWRS047A Page 46 of 146

CC1010 16. 8051 Peripherals CC1010 offers the following peripherals • Real-time clock units controlled by the 8051-compatible • SPI master core: • Hardware DES encryption / decryption • Four general-purpose I/O ports, with 26 I/O pins in total. • Random bit generator • Two standard 8051 timers • 10-bit ADC • Two timers with PWM functionality These modules are described in the following sections. • Watchdog timer 16.1 General Purpose I/O Four general purpose I/O-ports are Writing to the Px registers writes to the available: P0, P1, P2 and P3. Table 20 output register, and sets the I/O pin state. shows each port and the pins on each Using a read-modify-write operation reads port. from the output register, modifies the value according to the instruction executed and Each port is associated with two registers: writes the result back into the output The port register (P0, P1, P2, or P3) and register, modifying the I/O pin state the direction register (P0DIR, P1DIR, accordingly. P2DIR, or P3DIR). In practice, this means that the mov Each bit in the Px registers has its instruction should only be used when associated bit in the direction registers writing to all the pins in the port. To modify PxDIR. Setting PxDIR.y will make Px.y only a few pins, use a read-modify-write an input which can be read in Px(y). All instruction. Also, be careful of using pins are inputs after reset. Clearing constructs in C or another high-level PxDIR.y will make the pin Px.y output language that result in a mov from the Px the data from the register Px(y). All Px registers, modify the result and write it and PxDIR register descriptions are back (without using read-modify-write shown from page 49. instructions), as this will cause problems if not all I/O pins in the port are configured The structure for a single I/O-bit y on port as outputs. In C, the |=, &= and ^= x is shown in Figure 7. Some ports have operators should be used to set, clear and alternate functions (such as the SPI toggle pins respectively. interface), which are enabled through other registers (such as SPCR.SPE). The CC1010 ports deviate from the These alternate functions may or may not standard 8051-port in the following ways: override the direction setting from PxDIR • No pull-ups / pull-downs on pins as shown. • Dedicated direction bits in PxDIR When reading the Px registers, data is registers read from the directly from the pin. When using a read-modify-write instruction such • CMOS output levels on all ports as All general-purpose I/O pins are rated to ANL Px, #0x01, the output register sink or source 2 mA, except pin P2.3, value is read and modified regardless of which is rated to sink or source 8 mA. the setting in PxDIR. SWRS047A Page 47 of 146

CC1010 Port Available Alternate Function pins Normal operation Flash Programming P0.0 SCK, SPI Serial Clock output SCK, SPI Serial Clock Input P0.1 MO, SPI Master Output SI, SPI Slave Input P0 P0.2 MI, SPI Master Input SO, SPI Slave Output P0.3 - - P1.0 - - P1.1 - - P1.2 - - P1.3 - - P1 P1.4 - - P1.5 - - P1.6 - - P1.7 - - P2.0 RXD1, Serial port 1 input - P2.1 TXD1, Serial port 1 output - P2.2 - - P2.3 - - P2 P2.4 - - P2.5 - - P2.6 - - P2.7 - - P3.0 RXD0, Serial port 0 input - P3.1 TXD0, Serial port 0 output - P3.2 - INT0 , External interrupt 0 P3.3 - P3 INT1 , External interrupt 1 P3.4 T0, Counter input 0 to Timer 0, or - PWM2, PWM output from Timer 2 P3.5 T1, Counter input 1 to Timer 1, or - PWM3, PWM output from Timer 3 Table 20. Available I/O-Ports SWRS047A Page 48 of 146

CC1010 Alternate function enable Alternate function static direction or PxDIR.y PxDIR.y S 1 Alternate data 0 Read output register enable S 1 Px.y PAD Internal Data Bus D Q 0 Output register Read Pin Enable Figure 7. Port x bit y structure P0 (0x80) - Port 0 Data Register Bit Name R/W Reset value Description 7 - R0 0 Reserved, read as 0 6 - R0 0 Reserved, read as 0 5 - R0 0 Reserved, read as 0 4 - R0 0 Reserved, read as 0 3 P0_3 R/W 1 Data of port 0, bits 0 to 3. 2 P0_2 R/W 1 1 P0_1 R/W 1 0 P0_0 R/W 1 P1 (0x90) - Port 1 Data Register Bit Name R/W Reset value Description 7 P1_7 R/W 1 Data of port 1, bits 0 to 7. 6 P1_6 R/W 1 5 P1_5 R/W 1 4 P1_4 R/W 1 3 P1_3 R/W 1 2 P1_2 R/W 1 1 P1_1 R/W 1 0 P1_0 R/W 1 SWRS047A Page 49 of 146

CC1010 P2 (0xA0) - Port 2 Data Register Bit Name R/W Reset value Description 7 P2_7 R/W 1 Data of port 2, bits 0 to 7 6 P2_6 R/W 1 5 P2_5 R/W 1 4 P2_4 R/W 1 3 P2_3 R/W 1 2 P2_2 R/W 1 1 P2_1 R/W 1 0 P2_0 R/W 1 P3 (0xB0) - Port 3 Data Register Bit Name R/W Reset value Description 7 - R0 0 Reserved, read as 0 6 - R0 0 Reserved, read as 0 5 P3_5 R/W 1 Data of port 3, bits 0 to 5 4 P3_4 R/W 1 3 P3_3 R/W 1 2 P3_2 R/W 1 1 P3_1 R/W 1 0 P3_0 R/W 1 P0DIR (0xA4) - Port 0 Direction Register Bit Name R/W Reset value Description 7 - R0 0 Reserved, read as 0 6 - R0 0 Reserved, read as 0 5 - R0 0 Reserved, read as 0 4 - R0 0 Reserved, read as 0 3 P0DIR_3 R/W 1 Port 0 direction register, bit 0 to 3. Each bit sets the 2 P0DIR_2 R/W 1 direction of the associated pin on Port 0. 0 : Associated pin is an output 1 P0DIR_1 R/W 1 1 : Associated pin is an input 0 P0DIR_0 R/W 1 P1DIR (0xA5) - Port 1 Direction Register Bit Name R/W Reset value Description 7 P1DIR_7 R/W 1 Port 1 direction register, bit 0 to 7. Each bit sets the 6 P1DIR_6 R/W 1 direction of the associated pin on Port 1. 5 P1DIR_5 R/W 1 0 : Associated pin is an output 1 : Associated pin is an input 4 P1DIR_4 R/W 1 3 P1DIR_3 R/W 1 2 P1DIR_2 R/W 1 1 P1DIR_1 R/W 1 0 P1DIR_0 R/W 1 SWRS047A Page 50 of 146

CC1010 P2DIR (0xA6) - Port 2 Direction Register Bit Name R/W Reset value Description 7 P2DIR_7 R/W 1 Port 2 direction register, bit 0 to 7. Each bit sets the 6 P2DIR_6 R/W 1 direction of the associated pin on Port 2. 5 P2DIR_5 R/W 1 0 : Associated pin is an output 1 : Associated pin is an input 4 P2DIR_4 R/W 1 3 P2DIR_3 R/W 1 2 P2DIR_2 R/W 1 1 P2DIR_1 R/W 1 0 P2DIR_0 R/W 1 P3DIR (0xA7) - Port 3 Direction Register Bit Name R/W Reset value Description 7 - R0 0 Reserved, read as 0 6 - R0 0 Reserved, read as 0 5 P3DIR_5 R/W 1 Port 3 direction register, bit 0 to 7. Each bit sets the 4 P3DIR_4 R/W 1 direction of the associated pin on Port 3. 3 P3DIR_3 R/W 1 0 : Associated pin is an output 1 : Associated pin is an input 2 P3DIR_2 R/W 1 1 P3DIR_1 R/W 1 0 P3DIR_0 R/W 1 SWRS047A Page 51 of 146

CC1010 16.2 Timer 0 / Timer 1 CC1010 contains two standard 8051 Each Timer / Counter has a 16-bit register timers/counters (Timer 0 and Timer 1) which is readable and writeable through which can operate as either a timer with a TL0 and TH0 for Timer / Counter 0 and clock rate based on the system clock (as TL1 and TH1 for Timer / Counter 1. These defined by the current clock mode), or as registers are described below. an event counter clocked by the T0 (P3.4 for Timer 0) or T1 (P3.5 for Timer 1) inputs. TL0 (0x8A) - Timer / Counter 0 Low byte counter value Bit Name R/W Reset value Description 7:0 TL0(7:0) R/W 0x00 Timer / Counter 0, low byte counter value TL1 (0x8B) - Timer / Counter 1 Low byte counter value Bit Name R/W Reset value Description 7:0 TL1(7:0) R/W 0x00 Timer / Counter 1, low byte counter value TH0 (0x8C) - Timer / Counter 0 High byte counter value Bit Name R/W Reset value Description 7:0 TH0(7:0) R/W 0x00 Timer / Counter 0, high byte counter value TH1 (0x8D) - Timer / Counter 1 High byte counter value Bit Name R/W Reset value Description 7:0 TH1(7:0) R/W 0x00 Timer / Counter 1, high byte counter value • 16-bit timer / counter (Mode 1) 16.2.1 Timer / Counter 0 and 1 Modes • 8-bit timer / counter with auto-reload Timer / Counter 0 and 1 can individually (Mode 2) be programmed to operate in one out of four different modes, controllable through • Two 8-bit timers / counters (Mode 3, the registers TMOD and TCON. They are as Timer 0 only) follows: See the register descriptions for TMOD and • 13-bit timer / counter (Mode 0) TCON on the following pages. SWRS047A Page 52 of 146

CC1010 TMOD (0x89) - Timer / Counter 0 and 1 Mode register Bit Name R/W Reset value Description 7 GATE1 R/W 0 Timer / Counter 1 gate control 0 : Timer / Counter 1 will clock only when TCON.TR1 is set. 1 : Timer / Counter 1 will clock only when TCON.TR1 is set and the INT0 input is high. 6 R/W 0 Counter / Timer select for Counter / Timer 1 C/ T 1 0 : Timer 1 is clocked by the system clock divided by 4 or 12, depending on the state of CKCON.T1M (see page 55) 1 : Timer 1 is clocked by the T1 pin. 5 M1.1 R/W 0 Timer / Counter 1 mode select bits 4 M1.0 R/W 0 00 : 13-bit counter 01 : 16-bit counter 10 : 8-bit counter with auto-reload 11 : Timer 1 off 3 GATE0 R/W 0 Timer / Counter 0 gate control 0 : Timer / Counter 0 will clock only when TCON.TR0 is set. 1 : Timer / Counter 0 will clock only when TCON.TR0 is set and the INT0 input is high. 2 R/W 0 Counter / Timer select for Counter / Timer 0 C/ T 0 0 : Timer 0 is clocked by the system clock divided by 4 or 12, depending on the state of CKCON.T0M (see page 55) 1 : Timer 0 is clocked by the T0 pin. 1 M0.1 R/W 0 Timer / Counter 0 mode select bits 0 M0.0 R/W 0 00 : 13-bit counter 01 : 16-bit counter 10 : 8-bit counter with auto-reload 11 : Two 8-bit counters SWRS047A Page 53 of 146

CC1010 TCON (0x88) - Timer / Counter 0 and 1 control register Bit Name R/W Reset value Description 7 TF1 R/W 0 Timer 1 overflow flag. TF1 is set to 1 by hardware when the Timer 1 count overflows and is cleared by hardware when the 8051 vectors to the interrupt service routine. 6 TR1 R/W 0 Timer 1 run control bit 0 : Timer / Counter 1 is disabled 1 : Timer / Counter 1 is enabled 5 TF0 R/W 0 Timer 0 overflow flag. TF0 is set to 1 by hardware when the Timer 0 count overflows and is cleared by hardware when the 8051 vectors to the interrupt service routine. 4 TR0 R/W 0 Timer 0 run control bit 0 : Timer / Counter 0 is disabled 1 : Timer / Counter 0 is enabled 3 IE1 R/W0 0 External interrupt 1 edge detect (interrupt flag) If external interrupt 1 is configured to be edge sensitive (TCON.IT1 = 1), IE1 is set by hardware when a negative edge is detected on the INT1 pin and is cleared by hardware when the 8051 vectors to the corresponding interrupt service routine. In edge-sensitive mode, IE1 can also be set by software. If external interrupt 1 is configured to be level-sensitive (TCON.IT1 = 0), IE1 is set when the INT1 pin is low and cleared when the INT1 pin is high. In level-sensitive mode, software cannot write to IE1. 2 IT1 R/W 0 External interrupt 1 type select. 0 : The INT1 interrupt is triggered when INT1 is low (level sensitive). 1 : The INT1 interrupt is triggered on the falling edge (edge sensitive) 1 IE0 R/W0 0 External interrupt 0 edge detect (interrupt flag) If external interrupt 0 is configured to be edge sensitive (TCON.IT0 = 1), IE0 is set by hardware when a negative edge is detected on the INT0 pin and is cleared by hardware when the 8051 vectors to the corresponding interrupt service routine. In edge-sensitive mode, IE0 can also be set by software. If external interrupt 0 is configured to be level-sensitive (TCON.IT0 = 0), IE0 is set when the INT0 pin is low and cleared when the INT0 pin is high. In level-sensitive mode, software cannot write to IE0. 0 IT0 R/W 0 External interrupt 0 type select. 0 : The INT0 interrupt is triggered when INT0 is low (level sensitive). 1 : The INT0 interrupt is triggered on the falling edge (edge sensitive) SWRS047A Page 54 of 146

CC1010 CKCON (0x8E) - Timer Clock rate Control Register Bit Name R/W Reset value Description 7 - R0 0 Reserved, read as 0 6 - R0 0 Reserved, read as 0 5 - R0 0 Reserved, read as 0 4 T1M R/W 0 Timer 1 clock select. T1M has no effect in counter mode. 0 : Timer 1 uses the µC clock divided by 12 (for compatibility with the 80C32) 1 : Timer 1 uses the µC clock divided by 4 3 T0M R/W 0 Timer 0 clock select. T0M has no effect in counter mode. 0 : Timer 0 uses the µC clock divided by 12 (for compatibility with the 80C32) 1 : Timer 0 uses the µC clock divided by 4 2:0 MD(2:0) R/W 001 MD(2:0) controls the memory stretch cycles when accessing the external RAM. The reset value is 001, but for faster access to external RAM, MD(2:0) should always be written 000. When the 13-bit count increments from 16.2.2 Mode 0 0x1FFF (all ones), the counter rolls over to Mode 0 operation is illustrated for timer or all zeros. The overflow flag TCON.TF0 / counter 0 and 1 in Figure 8. The timer / TCON.TF1 is then set. counter uses bit 0 to 4 of TL0 / TL1 and all The 3 most significant bits in TL0 / TL1 8 bits of TH0 / TH1 as a 13 bit counter. are undetermined in Mode 0, and should TCON.TR0 / TCON.TR1 must be set to be masked by software for evaluation. enable the Timer / Counter. In Mode 0, the timer timeout period is The C/T bit in TMOD selects the Timer or determined by: Counter clock source as described. (12−8⋅CKCON.TxM)(8192−THx:TLx) Transitions are counted from the selected T = source, as long as TMOD.GATE0 / fxosc TMOD.GATE1 is 0, or TMOD.GATE0 / where THx:TLx is the contents of the TMOD.GATE1 is 1 and the corresponding THx:TLx registers if this is reloaded in the interrupt pin ( INT0 / INT1 ) is interrupt handler, or 0 if no reload is done. deasserted. SWRS047A Page 55 of 146

CC1010 Divide by 12 0 T0M / T1M System Clk 0 Divide by 4 1 C/T0 / C/T1 1 T0 / T1 TL0 / TL1 Clock TR0 / TR1 0 1 2 3 4 5 6 7 Mode 0 GATE0 / GATE1 Mode 1 INT0 / INT1 TH0 / TH1 0 1 2 3 4 5 6 7 Timer 0 / Timer 1 TF0 / TF1 interrupt request Figure 8. Mode 0 and Mode 1 operation for Timer / Counter 0 or 1 16.2.3 Mode 1 16.2.4 Mode 2 Mode 1 operation is illustrated for Timer / Mode 2 operation is illustrated for Timer / Counter 0 and 1 in Figure 8. The counter Counter 0 and 1 in Figure 9. Mode 2 is configured as a 16-bit counter, as operates as an 8-bit counter with compared to the 13 bits in Mode 0, and all automatic reload of the start value. bits in TL0 or TL1 are thus used. The The Timer / Counter is controlled as for counter overflows when the count Mode 0 and Mode 1, but when TL0 / TL1 increments from 0xFFFF. overflows, TH0 / TH1 is loaded into TL0 / Otherwise, Mode 1 operation is the same TL1. as Mode 0. In Mode 2, the timer timeout period is In Mode 1, the timer timeout period is determined by: determined (12−8⋅CKCON.TxM)(256−THx) by: T = (12−8⋅CKCON.TxM)(65536−THx:TLx) fxosc T = f xosc where THx:TLx is the contents of the THx:TLx registers if this is reloaded in the interrupt handler, or 0 if no reload is done. SWRS047A Page 56 of 146

CC1010 Divide by 12 0 T0M / T1M System Clk 1 0 C/T0 / C/T1 Divide by 4 1 T0 / T1 TL0 / TL1 TR0 / TR1 Clock Reload Mux GATE0 / GATE1 TH0 / TH1 INT0 / INT1 Timer 0 / Timer 1 TF0 / TF1 interrupt request Figure 9. Mode 2 operation for Timer / Counter 0 or 1 still be used for baud rate generation and 16.2.5 Mode 3 the Timer 1 count values are still available In Mode 3, which is illustrated in Figure 10, in the TL1 and TH1 registers. Timer 0 is operated as two separate 8-bit Control of Timer 1 when Timer 0 is in counters and Timer 1 stops counting and mode 3 is done through the Timer 1 mode holds its value. bits. To turn Timer 1 on, set Timer 1 to TL0 is configured as an 8-bit counter mode 0, 1 or 2. To turn Timer 1 off, set it controlled by the normal Timer 0 control to mode 3. Timer 1 can count clock cycles bits. It counts either clock cycles divided divided by 4 or 12 or high to low transitions by 4 or by 12 (as given by CKCON.T0M), or on the T1 pin. The GATE function is also high to low transitions on T0 (as given by available. TMOD.C/ T 0). It is also possible to use In Mode 3, the timer timeout periods are determined by: the GATE function for TL0 to set INT0 as (12−8⋅CKCON.TxM)(256−TYx) count enable. T = f TH0 is locked into a timer function, and xosc where TYx is the contents of the THx or takes over the use of TR1 and TF1 from TLx register if this is reloaded in the Timer 1. It counts clock cycles divided by 4 interrupt handler, or 0 if no reload is done. or 12 (as given by CKCON.T1M). TH0 may then generate Timer 1 interrupts. Timer 1 has limited usage when Timer 0 is in mode 3. This is because Timer 0 uses the Timer 1 control bit TR1 and the interrupt flag TF1. However, Timer 1 can SWRS047A Page 57 of 146

CC1010 TR1 Clock TH0 Divide by 12 0 T0M µC Clk 0 Divide by 4 1 C/T0 1 TF1 Timer 1 interrupt T0 request TL0 Clock TR0 GATE0 Timer 0 interrupt TF0 request INT0 Figure 10. Mode 3 operation for Timer / Counter 0 SWRS047A Page 58 of 146

CC1010 16.3 Timer 2 / 3 with PWM CC1010 also features two timers with pulse M3 in the TCON2 control register shown width modulation (PWM) outputs. Each below. timer can generate interrupts, as Timer 2 and Timer 3 are enabled described in the Interrupts section on page individually through the bits TCON2.TR2 28. The timers are individually set in one and TCON2.TR3. of two modes, timer mode or PWM mode. This is controlled through the bits M2 and TCON2 (0xA9) - Timer Control register 2 Bit Name R/W Reset value Description 7 - R0 0 Reserved, read as 0 6 - R0 0 Reserved, read as 0 5 - R0 0 Reserved, read as 0 4 - R0 0 Reserved, read as 0 3 TR3 R/W 0 Timer 3 run control 0 : Timer 3 is disabled. The Timer 3 counter is cleared. 1 : Timer 3 is enabled. 2 M3 R/W 0 Timer 3 mode control. 0 : Timer 3 is in timer mode. 1 : Timer 3 is in PWM mode. P3.5 is set to be an output, overriding P3DIR(5) 1 TR2 R/W 0 Timer 2 run control 0 : Timer 2 is disabled. The Timer 2 counter is cleared. 1 : Timer 2 is enabled. 0 M2 R/W 0 Timer 2 mode control. 0 : Timer 2 is in timer mode. 1 : Timer 2 is in PWM mode. P3.4 is set to be an output, overriding P3DIR(4) interrupt request must be cleared by 16.3.1 Timer Mode software. Timer 2 / Timer 3 can be set in Timer In Timer mode, interrupts are generated Mode by clearing the bit TCON2.M2 / with an interval as given by T , where TCON2.M3. Timer Mode operation is nINT n⊆{2,3} : illustrated in Figure 11. The 16 bit counter is preloaded with T2 and T2PRE (or T3 255⋅(TnPRE⋅256+Tn+1) T = and T3PRE) as shown. When disabling the nInt f system timer through clearing TCON2.TR2 (or TCON2.TR3) the counter is also As long as TnPRE and Tn are set before preloaded. The counter value cannot be TCON.TRn, the first interrupt is generated read by software. T after enabling the timer and then with nINT T intervals. When the counter underflows (decrements nINT from a zero value), it is loaded with the contents of T2 / T3 and T2PRE / T3PRE, and the interrupt request bit EXIF.TF2 / EXIF.TF3 is set by hardware. The SWRS047A Page 59 of 146

CC1010 Timer 2 (or Timer 3) 16 bit counter System Divide Clk Underflow 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Clock by 255 Timer 2 EXIF.TF2 Mux Mux (or EXIF.TF3) (or Timer 3) interrupt request 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 T2 (or T3) T2PRE (or T3PRE) TR2 (or TR3) Figure 11. Timer Mode operation for Timer 2 / Timer 3 T2PRE (0xAA) - Timer 2 Prescaler Control Bit Name R/W Reset value Description 7:0 T2PRE(7:0) R/W 0x00 Timer 2 Prescaler Control. In Timer Mode, T2PRE sets the 8 most significant bits of the 16-bit counter reload value. In PWM Mode, T2PRE sets the prescaler value that sets the PWM period. T3PRE (0xAB) - Timer 3 Prescaler Control Bit Name R/W Reset value Description 7:0 T3PRE(7:0) R/W 0x00 Timer 3 Prescaler Control. In Timer Mode, T3PRE sets the 8 most significant bits of the 16-bit counter reload value. In PWM Mode, T3PRE sets the prescaler value that sets the PWM period. T2 (0xAC) - Timer 2 Low byte counter value Bit Name R/W Reset value Description 7:0 T2(7:0) R/W 0x00 In Timer Mode, T2 sets the 8 least significant bits of the 16-bit counter reload value. In PWM Mode T2 sets the PWM duty cycle. T3 (0xAD) - Timer 3 Low byte counter value Bit Name R/W Reset value Description 7:0 T3(7:0) R/W 0x00 In Timer Mode, T3 sets the 8 least significant bits of the 16-bit counter reload value. In PWM Mode T3 sets the PWM duty cycle. P3.4 is the PWM output for timer 2, P3.5 16.3.2 PWM Mode is the PWM output for Timer 3. Timer 2 /Timer 3 can be set in PWM Mode The PWM operation is illustrated in Figure by setting the bit TCON2.M2 / TCON2.M3. 13. The PWM period T for timer n is The pins P3.4 / P3.5 are then enabled as nPWM set by TnPRE: outputs, overriding the port direction bit P3DIR.4 / P3DIR.5. The port direction is 255⋅(TnPRE+1) T = overridden independent of the timer run nPWM f control bit TCON2.TR2 / TCON2.TR3. system Interrupts are not generated in PWM mode. SWRS047A Page 60 of 146

CC1010 The PWM “high” state duration T for This means that in PWM mode, setting Tn nhPWM timer n is set by Tn: to 0 produces a constant low output and setting Tn to 255 produces a constant high Tn⋅(TnPRE+1) T = output. The timing of the PWM outputs is nhPWM f illustrated in Figure 12. system T T nPWM nPWM PWMn Output T T nhPWM nhPWM Figure 12. PWM Timing illustration Timer 2 or Timer 3 Divide by 8 bit counter System Clk TnPRE + 1 (counts 0-254) A PWM output A>B? TnPWM B Figure 13. PWM operation for Timer 2 / Timer 3 SWRS047A Page 61 of 146

CC1010 16.4 Power On Reset (Brown-Out Detection) The Power On Reset functionality detects reset module should then be connected to power-on and brown-out situations, and the external RESET pin. includes glitch immunity and hysteresis for noise and transient stability. The Power On Reset and Brown-Out Detection voltage levels are specified in The power on reset functionality is the Electrical Specifications section at disabled using the dedicated POR_E pin. page 7. Grounding POR_E will disable the internal power on reset. An external power-on- SWRS047A Page 62 of 146

CC1010 16.5 Watchdog Timer CC1010 includes an 8-bit watchdog timer Chipcon recommends that the watchdog that is clocked by the system clock. The timer should be disabled when the CC1010 clock is divided by a number in the range is clocked from the 32 kHz oscillator from 2048 to 16384, controllable through (Clock mode 1). WDT.WDTPRE(1:0). The divided clock Note that the watchdog timer is not active controls an 8-bit timer, which generates in Power-down mode, and therefore system reset upon overflow. A block cannot wake up the CC1010 from Power- diagram for the Watchdog Timer is shown Down mode. in Figure 14. WDT (0xD2) - Watchdog Timer Control Register Bit Name R/W Reset value Description 7 - R0 0 Reserved, read as 0 6 - R0 0 Reserved, read as 0 5 - R0 0 Reserved, read as 0 4 WDTSE R/W 0 Watchdog Timer Stop Enable, used to disable the watchdog timer 3 WDTEN R/W 1 Watchdog Timer Enable / Disable 0 : The watchdog timer is disabled 1 : The watchdog timer is enabled The watchdog timer is enabled after reset. To disable the watchdog timer, WDTSE must be used as described in this section. 2 WDTCLR R0/ 0 Watchdog timer clear signal. WDTCLR must periodically W be set to prevent the watchdog timer from resetting the system. WDTCLR is cleared by hardware, and is thus always read 0. 0 : Normal watchdog operation 1 : Watchdog timer is cleared. 1:0 WDTPRE.1 R/W 11 Watchdog timer prescaler control. WDTPRE(1:0) controls the division of the main crystal oscillator clock to generate the watchdog timer clock. 00 : f = f / 2048 WDT XOSC 01 : f = f / 4096 WDT XOSC 10 : f = f / 8192 WDT XOSC 11 : f = f / 16384 WDT XOSC SWRS047A Page 63 of 146

CC1010 Clear Enable System clock Watchdog Prescaler /2048 /4096 /8192 /16384 WDTPRE(1:0) WDTCLR Clear Enable 8 Bit Watchdog Counter w o erfl v O WDTEN System Reset Figure 14. Watchdog Timer Setting different prescaler settings, 256⋅2(11+WDTPRE) combined with different Main Crystal f Oscillator frequencies, generates reset at system an interval of: The intervals for the maximum and minimum clock frequencies are shown in Table 21 below. WDTPRE.1 WDTPRE.0 Division Rate Reset timing, given Reset timing, given f = 3MHz f = 24MHz XOSC XOSC 0 0 2048 175 ms 21.8 ms 0 1 4096 350 ms 43.7 ms 1 0 8192 699 ms 87.4 ms 1 1 16384 1400 ms 175 ms Table 21. Watchdog Timer timing If interrupts are enabled while disabling 16.5.1 Disabling the Watchdog Timer the Watchdog Timer, the user must make The Watchdog Timer is enabled after sure that WDT.WDTEN is actually cleared. system reset, through the Watchdog Timer This could for instance be done as follows: enable flag WDT.WDTEN. To disable the Watchdog Timer, this flag must be cleared. However, clearing this flag requires the user to first set the flag WDT.WDTSE, and then clearing WDT.WDTEN within 16 system clock periods (preferably in the next instruction). SWRS047A Page 64 of 146

CC1010 while (WDT & 0x08) { 16.5.2 Enabling the Watchdog Timer WDT |= 0x10; // Set WDTSE WDT &= ~0x08; // Clear WDTEN Enabling the Watchdog Timer is simply } done by setting WDT.WDTEN. Using the WDT.WDTSE control bit is not required. 16.6 Real-time Clock The real-time clock can generate enabled by setting RTCON.RTEN. The first interrupts with intervals ranging from 1 to interrupt will be generated RT seconds 127 seconds. It is connected to the 32.768 after RTEN is set. kHz crystal oscillator, which is disabled after reset. It must be enabled as The real-time clock interrupt must be described in the section on page 33. An enabled as described in the Interrupts external 32.768 kHz clock signal can also section on page 28. be applied, as described. The RTC oscillator circuit is shown in The interrupt interval is programmed in the Figure 15. The loading capacitors values range from 1 through 127 seconds by can be calculated as described for the setting RTCON.RT(6:0). The timer is main crystal oscillator at page 32. RTCON (0xED) – Real-time Clock Control Register Bit Name R/W Reset value Description 7 RTEN R/W 0 Real-time Clock Enable / Disable 0 : Real-time Clock is disabled 1 : Real-time Clock is enabled 6:0 RT(6:0) R/W 0x00 Real-time Clock interrupt interval control. RT(6:0) gives the desired interrupt interval in seconds. RT(6:0) must be between 1 and 127. XOSC32_Q1 XOSC32_Q2 XXTTAALL 3322..776688 kkHHzz C12 C13 Figure 15. RTC oscillator circuit SWRS047A Page 65 of 146

CC1010 16.7 Serial Port 0 and 1 Two serial ports, serial port 0 and 1, are must be configured in a certain way in implemented. They are controlled through order to allow serial communication. This the SCON0 and SCON1 control register. is summarized in Table 22. The data is buffered in SBUF0 and SBUF1. The mode is set in SCON0.SMx_0 / Serial port 0 may be used for general SCON1.SMx_0. To receive data, purpose serial communication. Timer 1 SCON0.REN_0 / SCON1.REN_1 must be may be used to generate different baud enabled for the ports. Separate transmit rates. Serial port 1 is primarily for use with and receive interrupt flags are available in an in-circuit-debugger, but can also be SCON0.TI_0 / RI_0 and SCON1.TI_1 / used for general purpose serial RI_1. Note that the baud rate also communication. A block diagram is shown depends on the Clock Mode selected (see in Figure 16. page 35). The general-I/O ports that map to the same physical pins as the serial ports Data Bus Write SBUF Read SBUF TXD0/TXD1 SBUF0/SBUF1 SBUF0/SBUF1 (Transmit) (Receive) Mode 0 Load SBUF Transmit Receive RXD0/RXD1 Shift Register Interrupt Request RI_0/RI_1 TI_0/TI_1 SCON0/SCON1 Figure 16. Serial ports block diagram UART0 UART1 P3.0 P3.1 P3DIR.0 P3DIR.1 P2.0 P2.1 P2DIR.0 P2DIR.1 X Mode 0 x 1 1 0 x 1 1 0 R Mode 1-3 x x 1 x x x 1 x Mode 0 1 1 0 0 1 1 0 0 X T Mode 1-3 x 1 x 0 x 1 x 0 Table 22. Configuration of general purpose I/O for UART0 and UART1 SWRS047A Page 66 of 146

CC1010 SBUF0 (0x99) - Serial Port 0, data buffer Bit Name R/W Reset value Description 7:0 SBUF0(7:0) R/W 0x00 Serial Port 0, data buffer. SBUF1 (0xC1) – Serial Port 1, data buffer Bit Name R/W Reset value Description 7:0 SBUF1(7:0) R/W 0x00 Serial Port 1, data buffer SCON0 (0x98) - Serial Port 0 Control Register Bit Name R/W Reset value Description 7 SM0_0 R/W 0 Serial Port 0 mode bits, decoded as: SM0_0 SM1_0 Mode 6 SM1_0 R/W 0 0 0 0 (Synchronous half duplex) 0 1 1 (Asynchronous full duplex, start + stop bit) 1 0 2 (Asynchronous full duplex, start + stop bit, 9th data bit) 1 1 3 (Asynchronous full duplex, start + stop bit, 9th data bit) 5 SM2_0 R/W 0 Multiprocessor communication enable. In modes 2 and 3 SM2_0 = 1 enables the multiprocessor communication feature: In mode 2 or 3 RI_0 will not be activated if the received 9th bit is 0. If SM2_0 = 1 in mode 1, RI_0 will only be activated if a valid stop bit is received. In mode 0 SM2_0 establishes the baud rate: when SM2_0 = 0 the baud rate is clk / 12; when SM2_0 = 1 the baud rate is clk / 4. 4 REN_0 R/W 0 Receive enable. When REN_0 = 1 reception is enabled. 3 TB8_0 R/W 0 Defines the state of the 9th data bit transmitted in modes 2 and 3. 2 RB8_0 R/W 0 In modes 2 and 3 RB8_0 indicates the state of the 9th bit received. In mode 1 RB8_0 indicates the state of the received stop bit. In mode 0 RB8_0 is not used. 1 TI_0 R/W 0 Transmit interrupt flag. Indicates that the transmit data word has been shifted out. In mode 0 TI_0 is set at the end of the 8th data bit. In all other modes TI_0 is set when the stop bit is placed on the TXD0 pin. TI_0 must be cleared by the software. 0 RI_0 R/W 0 Receive interrupt flag. Indicates that a serial data word has been received. In mode 0 RI_0 is set at the end of the 8th data bit. In mode 1 RI_0 is set after the last sample of the incoming stop bit, subject to the state of SM2_0. In modes 2 and 3 RI_0 is set at the end of the last sample of RB8_0. RI_0 must be cleared by the software. SWRS047A Page 67 of 146

CC1010 SCON1 (0xC0) - Serial Port 1 Control Register Bit Name R/W Reset value Description 7 SM0_1 R/W 0 Serial Port 1 mode bits, decoded as: SM0_1 SM1_1 Mode 6 SM1_1 R/W 0 0 0 0 (Synchronous half duplex) 0 1 1 (Asynchronous full duplex, start + stop bit) 1 0 2 (Asynchronous full duplex, start + stop bit, 9th data bit) 1 1 3 (Asynchronous full duplex, start + stop bit, 9th data bit) 5 SM2_1 R/W 0 Multiprocessor communication enable. In modes 2 and 3 SM2_1 = 1 enables the multiprocessor communication feature: In mode 2 or 3 RI_1 will not be activated if the received 9th bit is 0. If SM2_1 = 1 in mode 1 RI_1 will only be activated if a valid stop bit is received. In mode 0 SM2_1 establishes the baud rate: when SM2_1 = 0 the baud rate is clk / 12; when SM2_1= 1 the baud rate is clk / 4. 4 REN_1 R/W 0 Receive enable. When REN_1 = 1 reception is enabled. 3 TB8_1 R/W 0 Defines the state of the 9th data bit transmitted in modes 2 and 3. 2 RB8_1 R/W 0 In modes 2 and 3 RB8_1 indicates the state of the 9th bit received. In mode 1 RB8_1 indicates the state of the received stop bit. In mode 0 RB8_1 is not used. 1 TI_1 R/W 0 Transmit interrupt flag. Indicates that the transmit data word has been shifted out. In mode 0 TI_1 is set at the end of the 8th data bit. In all other modes TI_1 is set when the stop bit is placed on the TXD1 pin. TI_1 must be cleared by the software. 0 RI_1 R/W 0 Receive interrupt flag. Indicates that a serial data word has been received. In mode 0 RI_1 is set at the end of the 8th data bit. In mode 1 RI_1 is set after the last sample of the incoming stop bit, subject to the state of SM2_1. In modes 2 and 3 RI_1 is set at the end of the last sample of RB8_1. RI_1 must be cleared by the software. Data transmission begins when an 16.7.1 MODE 0 instruction writes to the SBUF0 (or SBUF1) Serial mode 0 provides synchronous, half- register. The serial port shifts the data byte duplex serial communication. For serial out, LSB first, at the selected baud rate. port 0, pin RXD0 (P3.0) is used for data Data reception starts when SCON0.REN_0 input and output while TXD0 (P3.1) / SCON1.REN_1 is set and the receive provides the bit clock for both transmit and interrupt flag SCON0.RI_0 / SCON1.RI_1 receive. For serial port 1 the is cleared. The bit clock is activated and corresponding pins are RXD1 (P2.0) and the UART shifts data in on each rising TXD1 (P2.1). edge of the bit clock, until 8 bits have been The serial mode 0 baud rate is set by received. Immediately after the 8th bit is SCON0.SM2_0 / SCON1.SM2_1. If this bit shifted in, the receive interrupt flag is set is cleared, the baud rate is the system and reception stops until the software clock divided by 4. If the bit is set, the clears the flag. system clock is divided by 12. SWRS047A Page 68 of 146

CC1010 The clock output is high when the serial transmission, each new bit is set on the port is idle. In reception, data is shifted in falling edge of the clock. on the rising edge of the clock. In Baudrate T1M/TH1 (kBaud) F = F = F = F = F = F = xosc xosc xosc xosc xosc xosc 3.6864 7.3728 11.0592 14.7456 18.4320 22.1184 MHz MHz MHz MHz MHz MHz 57.6 1/255 1/254 0/255 1/252 1/251 1/250 19.2 1/253 1/250 0/253 0/252 1/241 1/238 9.6 1/250 1/244 0/250 0/248 1/226 1/220 4.8 1/244 1/232 0/244 0/240 1/196 1/184 2.4 1/232 1/208 0/232 0/224 1/136 1/112 1.2 1/208 1/160 0/208 0/192 1/16 0/160 Table 23. Baud rate examples (SMODx=1) T1M in the above equation is in register 16.7.2 MODE1 CKCON (see page 55), and controls the Mode 1 provides standard asynchronous initial division in Timer 1 between 4 and full duplex communication, using a total of 12. 10 bits: 1 start bit, 8 data bits and 1 stop Some example baud rates and reload bit. For receive operations, the stop bit is values are shown in Table 23. The setting stored in SCON0.RB8_0 (or for other baud rates and oscillator SCON1.RB8_1). Data bits are received frequencies can be determined by using and transmitted with their LSB first. the above equation. The baud rate for mode 1 is a function of To transmit data in mode 1, write data to timer 1 overflow. Each time the timer SBUF0 / SBUF1. Transmission is then increments from its maximum count performed on TXD0 / TXD1 in the following (0xFF), a clock pulse is sent to the baud order: start bit, 8 data bits (LSB first) and rate circuit, to be further divided by 16 or then the stop bit. 32 as set by PCON.SMOD0 / EICON.SMOD1 to give the baud rate: Reception begins on the falling edge of a start bit received on RXD0 / RXD1, if 2SMODx Baud Rate = ⋅Timer 1overflow reception is enabled in SCON0.REN_0 / 32 SCON1.REN_1. The data input is sampled 16 times per baud for any baud rate. Each As can be seen from the equation above, bit decision is performed as a majority if both serial ports are in use decision between 3 successive samples in simultaneously, the baud rate is equal or the middle of each baud. If the majority different by a factor 2. decision is not equal to zero for the start It is common to use Timer 1 in Mode 2 (8- bit, the serial port will stop reception and bit counter with auto-reload) for baud rate wait for a new start bit. generation, although any timer mode can When the majority decision is made for the be used. The Timer 1 reload value is stop-bit, the following conditions must be stored in the TH1 register, which makes met: the complete baudrate using mode 2: • RI_0 / RI_1 is 0 2SMODx f Baud Rate= ⋅ system 32 (12−8⋅T1M)⋅(256−TH1) • If SM2_0 / SM2_1 is set, the state of the stop bit must be one If these conditions are met, the received data is buffered in SBUF0 / SBUF1, the SWRS047A Page 69 of 146

CC1010 received stop bit is stored in RB8_0 / If these conditions are met, the received RB8_1) and the receive interrupt flag is data is buffered in SBUF0 / SBUF1, the set. If not, the received data is lost and received stop bit is stored in RB8_0 / RB8_0 / RB8_1 and the receive interrupt RB8_1 and the receive interrupt flag RI_0 flag remains unchanged. / RI_1 is set. If not, the received data is lost and RB8 and the receive interrupt flag 16.7.3 MODE2 remains unchanged. Mode 2 provides asynchronous full-duplex 16.7.4 MODE 3 communication using a total of 11 bits: 1 start bit, 8 data bits, a programmable 9th Mode 3 provides asynchronous, full- bit and 1 stop bit. The data bits are duplex communication, using a total of 11 transmitted and received LSB first. bits (as with mode 2): 1 start bit, 8 data bits, a programmable 9th bit and 1 stop bit. The mode 2 baud rate is either f /32 or system The data bits are transmitted and received f /64, set by PCON.SMOD0 (or system LSB first. EICON.SMOD1). The baud rate is then: Transmission and reception in mode 3 is 2SMODx Baud Rate= ⋅ f identical to mode 2, except for the baud 64 system rate generation, which is identical to mode 1. To transmit data in mode 1, write data to SBUF0 / SBUF1. Transmission is then 16.7.5 Multiprocessor Communications performed on pin TXD0 / TXD1 in the following order: start bit, 8 data bits (LSB The multiprocessor communication feature first), 9th bit (from TB8_0 / TB8_1) and is enabled in mode2 and mode 3, when then the stop bit. The transmit interrupt the SM2_0 / SM2_1 bit is set. The 9th bit flag TI_0 / TI_1 is set when the stop bit received is then stored in RB8_0 / RB8_1 is placed on the transmit pin. and the interrupt bit is only set if this bit is 1. Reception must be enabled by setting REN_0 / REN_1. It is then initiated by the An address byte can then be transmitted, with the 9th bit set, to generate an falling edge of a start bit received on RXD0 interrupt on all slaves. The slave(s) with / RXD1. The input pin is sampled 16 times the correct address (decoded in software) per baud. Majority decision is made, as may then clear SM2_0 / SM2_1 to receive with mode 1. When the majority decision is the rest of the data, which is transmitted made for the stop-bit, the following with the 9th bit low. All other slaves will conditions must be met: then ignore the data received. • RI_0 / RI_1 is 0 • If SM2_0 / SM2_1 is set, the 9th bit and the stop bit must be one. SWRS047A Page 70 of 146

CC1010 16.8 SPI Master The SPI master interface allows CC1010 to as an output and MI as an input. The communicate with peripheral devices such direction bit P0DIR(1) still determines the as an external serial EEPROM interface. It direction of the master data output pin MO. has a programmable data rate up to 3 This allows the SPI master to MHz, depending on the frequency of the communicate with a bi-directional data main crystal. line. P0DIR(1) should then be cleared when transmitting and set when receiving The SPI master interface is controlled using the SPCR register shown below. data, with MO and MI connected together externally. For normal full-duplex Setting SPCR.SPE enables the SPI operation of the SPI master, P0DIR(1) interface. Pins P0.0, P0.1 and P0.2 are must be cleared to set MO as an output. then reconfigured as the serial clock Any other general purpose I/O-pin may be output SCK, the serial data output pin MO used for slave select signals to the and the serial data input pin MI. The peripheral modules. direction bits set in P0DIR(0) and P0DIR(2) are then ignored, setting SCK SWRS047A Page 71 of 146

CC1010 SPCR (0xA1) - SPI Control Register Bit Name R/W Reset value Description 7 - R0 0 Reserved, read as 0 6 - R/W 0 Reserved, write 0 5 SPE R/W 0 SPI Enable. 0 0 : SPI interface is disabled 1 : SPI interface is enabled 4 DORD R/W 0 Data Order 0 : Least significant bit (LSB) is transmitted / received first 1 : Most significant bit (MSB) is transmitted / received first 3 CPOL R/W 0 Clock Polarity 0 : SCK has negative clock polarity 1 : SCK has positive clock polarity 2 CPHA R/W 0 Clock Phase 0 : Data is output on DO when SCK goes from CPOL to CPOL and is sampled from DI when SCK goes from CPOL to CPOL 1 : Data is output on DO when SCK goes from CPOL to CPOL and is sampled from DI when SCK goes from CPOL to CPOL 1:0 SPR(1:0) R/W 0 SPI Data Rate. SPR(1:0) 00 : SCK clock frequency = f / 8 XOSC 01 : SCK clock frequency = f / 16 XOSC 10 : SCK clock frequency = f / 32 XOSC 11 : SCK clock frequency = f / 64 XOSC SPDR (0xA2) - SPI Data Register Bit Name R/W Reset value Description 7:0 SPDR(7:0) R/W 0x00 SPI Data Register Writing to SPDR when SPCR.SPE is set will initiate a data transmission. Reading SPDR will read the data input buffer, which is only updated after each completed transmission. SPSR (0xA3) - SPI Status Register Bit Name R/W Reset value Description 7:2 - R0 0x00 Reserved, read as 0 1 SPA R 0 SPI Active status bit 0 : The SPI interface is currently not transmitting data 1 : The SPI interface is currently transmitting data 0 WCOL R 0 Write collision flag. This flag is updated by hardware when SPDR is written. 0 : The previous write to SPDR did not generate a data collision. 1 : The previous write to SPDR generated a data collision Writing data to SPDR when SPCR.SPE is are transmitted and received with the data set will initiate a data transmission. 8 bits order, clock polarity, clock phase and data SWRS047A Page 72 of 146

CC1010 rate as set by SPCR.DORD, SPCR.CPOL, It is also possible to check the SPI status SPCR.CPHA and SPCR.SPR. bit, SPSR.SPA, before writing to SPDR to avoid collisions. This bit is set only when Reading data from SPDR will read the data is being transmitted. input buffer, which is only updated after each complete transmission. This means SPI timing, data order, clock polarity and that a new byte can be written to SPDR clock phase are shown in Figure 18. before reading the newly received byte in It is also possible to use the master SPI order to maximise the data rate. interface to interface with a two-pin serial If data is written to SPDR while a interface that uses a bi-directional data line (such as the interface used by the transmission is in progress, this is Chipcon CC1000 RF transceiver). In this regarded as a collision. After each new case, you would connect the MO and MI byte written to SPDR, the write collision flag pins together on your PCB, as shown in SPSR.WCOL is updated. If a collision Figure 17. In the software, the P0DIR.1 bit occurs, the data written to SPDR is ignored must be set correctly according to whether and the data must be written to SPDR data is being written or read. again for it to be sent. MO DIO MI DCLK SCK Two-wire CC1010 peripheral Figure 17. Two-wire serial interface SWRS047A Page 73 of 146

CC1010 SPDR is written by 8051 here, while SPCR.SPE is active SCK (CPOL=0, CPHA=0) SCK (CPOL=0, CPHA=1) SCK (CPOL=1, CPHA=0) SCK (CPOL=1, CPHA=1) MO / MI 0 1 2 3 4 5 6 7 DORD=0 MO / MI 7 6 5 4 3 2 1 0 DORD=1 SPSR.SPA SPDR read by 8051 Data received during last byte transmission New data SPSR.WCOL is set if SPDR is written here Figure 18. SPI Data Flow SWRS047A Page 74 of 146

CC1010 16.9 DES Encryption / Decryption DES encryption / decryption is supported containing the 8 most significant address by hardware in CC1010. Blocks of data bits. New keys are loaded only at the ranging from 1 to 256 bytes can be beginning of an encryption / decryption if encrypted / decrypted in one operation by CRPCON.LOADKEYS is set. If not, the the DES module. Multiple encryption / same keys as used in the previous run will decryption operations can also be used on be used again. larger data blocks. The DES keys do not contain parity bits. If Encryption is the process of encoding an DES keys with parity bits are given, the information bit stream to secure the data parity bits must be removed before content. The DES algorithm is a common, performing encryption / decryption. The simple and well-established encryption keys are therefore stored as 7 successive routine. An encryption key of 56 bits is bytes in RAM. used to encrypt the message. The receiver After running the DES, a output block O of must use the exact same key to decrypt length CRPCNT bytes is generated by the message, otherwise the message will be scrambled. The encryption and encrypting / decrypting the input block I of decryption operations in the DES same length as O using key K1 as follows: algorithm are symmetrical operations with O=E (I) (encryption) the same computational requirements. K1 The operations produce the same number O=D (I) (decryption) K1 of output bytes as input bytes. The The following is an example on how to use strength of an encryption algorithm is the single DES algorithm hardware in determined by the number of bits in the CC1010. First the 56-bit encryption key key, the more the better. The DES must be stored in the external RAM. Then algorithm offers a low to medium level of the CRPKEY register must be written to security. If higher levels of security are point to the start of the encryption key. required, a triple DES algorithm can be Note that the encryption key must start on used. Triple DES can be achieved by a RAM address location divisible by 8. running the DES algorithm three times Then the data bit stream to encrypt must sequentially using three different 56-bit be stored in the external RAM. The data encryption keys. The keys must be used in bit stream must consist of at least 1 byte reverse order when decrypting. up to a maximum of 256 bytes, and it must The DES algorithm works internally on also start on a RAM address location entities of 8 bytes. The Output Feedback divisible by 8. The CRPDAT register must Mode (OFB) and Cipher Feedback Mode be written to point to the start of the data (CFB) are DES modes of operation that bit stream, and CRPCNT must be written to permit data lengths that are not a multiple give the number of bytes to be encrypted. of eight bytes. The operation mode is Then the CRPINI0, CRPINI1, selected through the CRPCON.CRPMD CRPINI2, CRPINI3, CRPINI4, control bit. The same DES mode of CRPINI5, CRPINI6, CRPINI7 operation must be used both for registers must be written to contain the encryption and decryption to yield correct DES initialisation vector used in the OFB results. CFB is recommended, as it is and CFB modes of operation. For more secure than OFB. simplicity it can be set to all zeros. Note CRPCON.ENCDEC should be cleared when that the initialisation vector must be the same for both encryption and decryption to encrypting data and set when decrypting yield correct results. To initiate the data. encryption the CRPCON register must be 56 bit DES keys are stored in external written. The bits in this register select RAM, as shown in Table 24. The location encryption/decryption, feedback mode, is given by the register CRPKEY, and DES interrupt enable. When the SWRS047A Page 75 of 146

CC1010 encryption has been completed, in the same location as the input data CRPCON.CRPEN goes low and the DES bytes were originally put. To perform the interrupt flag is set. The external RAM will reverse operation, write CRPCON again now contain the encrypted data bit stream with the CRPCON.ENCDEC bit set. Key First RAM Location Last RAM Location K1 8 ⋅ CRPKEY 8 ⋅ CRPKEY+6 Table 24. DES key location in RAM Encryption / decryption is done in-place, Encryption / decryption is started when i.e. each byte of data read from external CRPCON.CRPEN is set. When the RAM for encryption / decryption will be encryption / decryption is completed, written back to the same location after CRPCON.CRPEN is cleared by hardware encryption / decryption as described and the interrupt flag CRPCON.CRPIF is above. The input and output blocks must set. If CRPCON.CRPIE is set, the interrupt start on an address which is a multiple of flag EXIF.ADIF is also set, which will eight. CRPDAT then gives the 8 most generate an interrupt if EIE.ADIE is set. significant address bits to the first data (See the Interrupts section on page 28 for byte. details on interrupts.) The encryption / decryption initialization The duration of a DES encryption / vector should be written to registers decryption operation is shown in Table 25. CRPINI0 to CRPINI7. These registers Accessing external RAM from the 8051 must be written prior to encrypting / while encrypting / decrypting may delay decrypting a new block of data, as they the operation slightly since the access is are modified by hardware. They should be multiplexed. left unchanged between multiple encryption / decryption operations for DES DES keys stored in Flash memory will be blocks larger than 256 bytes. A zero value protected by the Flash memory read initialisation vector can be used, or protection. For the security of the Flash additional security can be effected by protection, please refer to the disclaimer at using the initialisation vector as an the end of this document. additional key. Mode Duration (clock cycles) Single DES 2+25⋅#Data Bytes +21⋅LOADKEYS Table 25. DES Encryption / Decryption duration SWRS047A Page 76 of 146

CC1010 CRPCON (0xC3) - Encryption / Decryption Control Register Bit Name R/W Reset value Description 7 - R0 0 Reserved, read as 0 6 CRPIE R/W 0 Encryption / Decryption interrupt enable flag. In order for CRPIF to raise an interrupt, EIE.ADIE must also be set. 5 CRPIF R/W 0 Encryption / Decryption interrupt flag. CRPIF is set by hardware when an encryption / decryption is completed. CRPIF must be cleared by software. Because the encryption /decryption shares an interrupt line with the ADC, EXIF.ADIF must also be cleared by software before exiting the interrupt service routine. EXIF.ADIF should be cleared before CRPIF, so that the 8051 is ready to receive a new interrupt immediately after CRPIF is cleared. 4 LOADKEYS R/W 0 Enable / disable loading of keys at start up. 0 : New keys are not loaded at encryption / decryption start up. The same keys as used during the previous encryption / decryption will be used again. 1 : New keys are loaded from RAM at encryption / decryption start up. The key RAM location is given by CRPKEY. 3 CRPMD R/W 0 OFB / CFB Mode 0 : OFB (Output Feedback Mode) is selected 1 : CFB (Cipher Feedback Mode) is selected 2 ENCDEC R/W 0 Encryption / Decryption select 0 : Encryption is selected 1 : Decryption is selected 1 TRIDES R/W0 0 Reserved, write 0 0 CRPEN R/W1 0 Encryption / Decryption start and status bit. When set by software, encryption / decryption is initiated. It cannot be cleared by software, but will be cleared by hardware when the encryption / decryption is completed. CRPKEY (0xC4) - Encryption / Decryption Key Location Register Bit Name R/W Reset value Description 7:0 CRPKEY(7:0) R/W 0x00 CRPKEY(7:0) gives the 8 most significant bits of the external RAM location of the DES keys. The keys are located in RAM as given in Table 24. CRPDAT (0xC5) - Encryption / Decryption Data Location Register Bit Name R/W Reset value Description 7:0 CRPDAT(7:0) R/W 0x00 CRPDAT(7:0) gives the 8 most significant bits of the external RAM address of the first byte to be encrypted / decrypted. The 3 least significant address bits are all zeros. CRPCNT (0xC6) – Encryption / Decryption Counter Bit Name R/W Reset value Description 7:0 CRPCNT(7:0) R/W 0x00 CRPCNT(7:0) gives the number of bytes to be encrypted / decrypted. If CRPCNT=0, 256 bytes are encrypted / decrypted. SWRS047A Page 77 of 146

CC1010 CRPINIn, n∈{0..7} (0xB4-0xB7, 0xBC-0xBF) - DES Initialisation Vector Bit Name R/W Reset value Description 7:0 CRPINIn R/W 0x00 The 8 registers CRPINIn, n ∈{0..7}, contains the 64 (7:0) bit DES initialisation vector. Bits 8⋅n-1 down to 8⋅n are located in register CRPINIn 16.10 Random Bit Generation CC1010 can generate real random bit For applications requiring guaranteed DC sequences to be used as encryption keys, free data, software should process the seed for a software pseudo random generated data, for example by xor'ing two generator or other purposes. The data is successive bits. generated from amplifying noise in the RF The random data generated has a receiver path. relatively white spectrum, but tones have To enable random bit generation, set been observed when the random bit RANCON.RANEN and clear generator has been enabled for more than RFMAIN.RX_PD. Wait at least 1 ms before one second. If this is not sufficient for the reading data from RANCON.RANBIT. The application to generate the random bits required, the random bit generator should period between reads should be at least be disabled and enabled following the 10 µs for the data to be as random as procedure described above before possible. generating more data. RANCON (0xC7) - Random Bit Generator Control Register Bit Name R/W Reset value Description 7:2 - R0 0x00 Reserved, read as 0 1 RANEN R/W 0 Random Bit Generator Enable 0 : Random Bit Generator is disabled. 1 : Random Bit Generator is enabled. RFMAIN.RX_PD must also be cleared to generate random bits. 0 RANBIT R 0 RANBIT returns one random bit, generated from the RF receiver path. SWRS047A Page 78 of 146

CC1010 16.11 ADC The on-chip 10-bit ADC is controlled by In each conversion cycle, the input signal the registers ADCON and ADCON2. is sampled on the sample capacitor during one half-clock period. During this time, the Three analog pins can be sampled, accuracy of the voltage on the capacitor selected by ADCON.ADADR. This register must reach at least ½ LSB accuracy in is also used to select the AD1 pin as order to get the full accuracy of the external reference (when using AD0). conversion. Charging of the capacitor When the AD1 pin is used as external follows the Caharing formula: reference, only two ADC inputs are available. ⎛ −t ⎞ V =V *(1−e−t/τ) =V *⎜1−eRC ⎟⇒ The ADC output is unipolar, with an output in in ⎜ ⎟ ⎝ ⎠ value of 0 corresponding to 0V and 1023 corresponding to the reference voltage (1.25 V or VDD depending on the setting −t −1 of the ADCREF bit). R = = ( ) ⎛ V ⎞ 2f *C*ln err The analog reference voltage is controlled C*ln⎜1− ⎟ clk ⎜ ⎟ by ADCON.ADCREF. ADCON.AD_PD should ⎝ V ⎠ in be set when the ADC is not used in order to save power. A conversion can be started 5 µs after clearing the bit when The result of this formula is the maximum using VDD or an external reference, or output resistance of the source, for a given 100 µs afterwards when using the internal ADC clock frequency and accuracy. 30% 1.25V reference. safety margin should be used, due to non- perfect duty cycle etc., i.e. a maximum The input impedance of the ADC is a output resistance 30% less than calculated 3.2pF switched capacitor that samples the should be used. input signal once for each conversion. For ½ LSB accuracy in the charging, Table The average input impedance is thus: 27 shows the maximum output resistance that should be used for the source at 1 R = maximum and minimum ADC clock in C* f frequencies. s Average input impedances for minimum fclk Rmax and maximum sampling frequencies are 250 kHz 57 kΩ shown in Table 26. 32 kHz 450 kΩ Table 27. Maximum source impedance for ADC f f R clk s in 250 kHz 22.7 kHz ~14 MΩ The ADC can be operated in 4 modes 32 kHz 2.9 kHz ~107 MΩ controlled by ADCON.ADCM. Each ADC sample conversion takes 11 ADC clock Table 26. ADC input impedance vs. cycles. In Clock Mode 1, when sampling frequency X32CON.CMODE is set, the 32 kHz clock is The average input impedance accounts for applied directly to the ADC. The the average input current to the ADC, but conversion time is then 344 µs. In Clock cannot be used for estimation of Mode 0 the ADC clock input is derived conversion errors due to voltage division from the main oscillator clock using the between the source impedance and the divider selected by ADCON2.ADCDIV. The ADC input impedance. For that purpose register must be set so that the resulting the charging time of the sample capacitor ADC clock frequency is less than or equal must be considered. to 250 kHz. If the clock frequency is equal SWRS047A Page 79 of 146

CC1010 to 250 kHz, then the conversion time is 44 ADTRH⋅ 4) an interrupt is generated and µs. the corresponding interrupt service routine is then executed if the interrupt enable In single-conversion mode each flags EIE.ADIE and ADCON2.ADCIE are conversion is initiated by setting the set. The ADC will continue its conversions ADCON.ADCRUN control bit. The ADC regardless of the result of the threshold interrupt flags EXIF.ADIF and comparison. To always get an interrupt ADCON2.ADCIF are set by hardware if the upon completion of a conversion, ADTRH 8 MSB of the latest sampled value is should be set to 0. greater than or equal to the threshold value stored in the ADTRH register. An Multi-conversion, stopping. When the interrupt service routine is then executed if threshold comparison holds true (value ≥ the interrupt enable flags EIE.ADIE and ADTRH⋅ 4) an interrupt is generated and ADCON2.ADCIE are set. To always get an the corresponding interrupt service routine interrupt upon completion of a conversion, is then executed if the interrupt enable ADTRH should be set to 0. The flags EIE.ADIE and ADCON2.ADCIE are ADCON.ADCRUN control bit is cleared by set. The ADC will stop when the threshold hardware when the conversion is finished. comparison holds true, clearing ADCON.ADCRUN. In the multi-conversion modes the ADC starts a new conversion every 11th ADC Multi-conversion, reset-generating. clock cycle. All multi-conversion modes When the threshold comparison holds true can be stopped by clearing (value ≥ ADTRH⋅ 4) a system reset is ADCON.ADCRUN, after which the ADC will generated. This mode can be used in abort its current conversion and then stop. conjunction with the 8051's stop mode and In all modes an action is taken when the 8 the 32 kHz oscillator to achieve very low MSB of the latest sample value is greater power consumption while monitoring a than or equal to the value written in signal. The value stored in ADDATH and ADTRH; these are: ADDATL is not affected by a reset, so that the sampled value can be read back after Multi-conversion, continuous. When the the reset has taken effect. threshold comparison holds true (value ≥ SWRS047A Page 80 of 146

CC1010 ADCON (0x93) - ADC Control Register Bit Name R/W Reset value Description 7 AD_PD R/W 1 ADC Power down bit. 0 : ADC is active 1 : ADC is in power down 6 - R0 0 Reserved, read as 0 5:4 ADCM(1:0) R/W 00 ADC Mode: 00 : Single-conversion mode. (Interrupt when threshold condition holds true, stop after one conversion.) 01 : Multi-conversion mode, continuous. (Interrupt when threshold condition holds true, continue sampling.) 10 : Multi-conversion mode, stopping. (Interrupt when threshold condition holds true, stop sampling.) 11: Multi-conversion mode, reset-generating. (Generate reset when threshold condition holds true.) 3 ADCREF R/W 0 Select the internal ADC Voltage Reference 0 : Voltage reference is VDD 1 : Voltage reference is 1.25 V, generated on chip. 2 ADCRUN R/W 0 ADC run control. Setting this bit in software will start ADC operation in single- or multi-conversion mode. In single conversion mode this bit is cleared by hardware when the single conversion is done. Multi-conversion operation can be halted at the end of the current conversion by clearing this bit. (When ADCM=10 the hardware clears this bit when stopping.) 1:0 ADADR(1:0) R/W 00 Select the analog input to the ADC 00 : Mux data from the AD0 pin 01 : Mux data from the AD1 pin 10 : Mux data from the AD2 (RSSI/IF) pin 11 : Mux data from the AD0 pin with AD1 as an external reference. ADCREF is ignored in this setting ADDATL (0x94) - ADC Data Register, Low Byte Bit Name R/W Reset value Description 7:0 ADDAT(7:0) R 0x00 8 LSB of ADC data output ADDATH (0x95) - ADC Data Register, High Bits Bit Name R/W Reset value Description 7:2 - R0 0x00 Reserved, read as 0 1:0 ADDAT(9:8) R 0x00 2 MSB of ADC data output, latched when ADDATL is read SWRS047A Page 81 of 146

CC1010 ADCON 2(0x96) - ADC Control Register 2 Bit Name R/W Reset value Description 7 ADCIE R/W 0 ADC interrupt enable flag. In order for ADCIF to raise an interrupt, EIE.ADIE must also be set. 6 ADCIF R/W 0 ADC interrupt flag. ADCIF must be cleared by software. Because the ADC shares an interrupt line with the DES module, EXIF.ADIF must also be cleared by software before exiting the interrupt service routine. EXIF.ADIF should be cleared first so that the 8051 is ready to receive a new interrupt immediately after ADCIF is cleared. 5:0 ADCDIV R/W 0x00 ADC clock divider. Selects ADC clock divider in steps of 16. 000000: Divider is 16 000001: Divider is 32 … 111111: Divider is 1024 ADTRH (0x97) - ADC Threshold Register Bit Name R/W Reset value Description 7:0 ADTRH(7:0) R/W 0x00 ADC comparator threshold value, used to generate ADC interrupt or chip reset when the threshold is exceeded. SWRS047A Page 82 of 146

CC1010 17. RF Transceiver 17.1 General description The CC1010 UHF RF Transceiver is Very few external passive components are designed for very low power and low required for operation of the RF voltage applications. The transceiver Transceiver. circuit is mainly intended for the ISM The key parameters for the RF transceiver (Industrial, Scientific and Medical) and are listed in Table 6, Table 7, Table 8, SRD (Short Range Device) frequency Table 9, and Table 10, starting page 8. bands at 315, 433, 868 and 915 MHz, but can easily be programmed for operation at other frequencies in the 300-1000 MHz range. The main operating parameters of CC1010 can be programmed via Special Function Registers (SFRs), thus making CC1010 a very flexible and easy to use transceiver. AD2(RSSI/IF) MIXER RF_IN LNA IF STAGE DEMOD RFBUF Internal 8051 SFR Bus SFR ENCODER CONTROL REGISTERS /N RF_OUT PA BIAS R_BIAS ~ XOSC_Q2 CHARGE VCO LPF PD /R OSC PUMP XOSC_Q1 L1 L2 CHP_OUT 17.2 RF Transceiver Block Diagram Figure 19. Simplified block diagram of the RF Transceiver A simplified block diagram of the RF the internal SFR data bus that is used to transceiver is shown in Figure 19. Only configure the RF interface and to transmit analog signal pins are shown together with and receive data. SWRS047A Page 83 of 146

CC1010 In receive mode the CC1010 is configured each bit or byte to be transmitted as a traditional super-heterodyne receiver. (EXIF.RFIF). The internal T/R switch The RF input signal is amplified by the circuitry makes the antenna interface and low-noise amplifier (LNA) and converted matching very easy using a few passive down to the intermediate frequency (IF) by components. the mixer (MIXER). In the intermediate The frequency synthesiser generates the frequency stage (IF STAGE) this down- local oscillator signal which is fed to the converted signal is amplified and filtered MIXER in receive mode and to the PA in before being fed to the demodulator transmit mode. The frequency synthesiser (DEMOD). As an option a RSSI signal or consists of a crystal oscillator (XOSC), the IF signal after the mixer is available at phase detector (PD), charge pump the AD2(RSSI/IF) pin. After demodu- (CHARGE PUMP), internal loop filter lation the digital data is sent to the RFBUF (LPF), VCO, and frequency dividers (/R register. Interrupts can be generated for and /N). An external crystal must be each bit or byte received (EXIF.RFIF). connected to the XOSC. Only one external In transmit mode the voltage controlled inductor is required for the VCO. oscillator (VCO) output signal is fed A detailed pin description is given at page directly to the power amplifier (PA). The 15. RF output is frequency shift keyed (FSK) by the digital bit stream fed to the RFBUF register. Interrupts can be generated for SWRS047A Page 84 of 146

CC1010 17.3 RF Application Circuit Very few external components are 17.3.3 Additional filtering required for operation of the RF transceiver. A typical application circuit is Additional external components (e.g. RF shown in Figure 20. Component values are LC or SAW-filter) may be used in order to shown in Table 28. improve the performance in specific applications. See also the Optional LC 17.3.1 Input / output matching Filter section on page 128 for further information. If a SAW filter is used, it C31/L32 is the input match for the should be included in the RX path only (an receiver, and L32 is also used as a DC external RX/TX switch should then be choke for biasing. C41, L41 and C42 are used). used to match the transmitter to a 50-Ohm load. An internal T/R switch circuit makes 17.3.4 Voltage supply decoupling it possible to connect the input and output together and match the transceiver to 50 Voltage supply filtering and de-coupling Ω in both RX and TX mode. See the Input capacitors must be used (not shown in the / Output Matching section on page 126 for application circuit). These capacitors details. should be placed as close as possible to the voltage supply pins of CC1010. 17.3.2 VCO inductor The placement and size of the decoupling The VCO is completely integrated except capacitors and power supply filtering are for the inductor L101. very important to achieve the best sensitivity and lowest possible LO leakage Component values for the matching and the reference layouts should be network and VCO inductor are easily followed. calculated using the SmartRF® Studio software for any operation frequency. SWRS047A Page 85 of 146

CC1010 DVDD DVDD 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 AVDD 1 AVDD AGND D2 (RSSI/IF) AD1 AD0 (DVDDTopRESET viePROGw) P2_7 P2_6 P1_7 P1_6 P1_5 P0_3 P0_2 (MISO) DVDD DGNDP3_0 (RXD0) 48 A 2 AVDD P3_1 (TXD0) 47 C31 3 AGND P3_2 (INT0) 46 Antenna 4 RF_IN P2_5 45 DVDD 5 RF_OUT C P2_4 44 C42 6 AVDD DVDD 43 C C41 L41 L32 7 AGND P2_3 42 8 AGND 1 DGND 41 AVDD 9 AGND 0 DVDD 40 10 L1 P2_2 39 1 L101 11 L2 P1_4 38 0 12 AVDD P1_3 37 13 CHP_OUT P1_2 36 14 R_BIAS P1_1 35 15 AVDD P0_1 (MOSI) 34 R131 16 AGND AGND XOSC_Q1 XOSC_Q2 XOSC32_Q2 XOSC32_Q1 AGND DGND DGND POR_E P1_0 (RXD1) P2_0(TXD1) P2_1 (PWM3) P3_5 (PWM2) P3_4 (INT1) P3_3DGNDP0_0 (SCK) 33 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 XTAL C181 C171 Figure 20. Typical CC1010 application circuit Note: Decoupling capacitors not shown. Please see CC1010EM reference design. SWRS047A Page 86 of 146

CC1010 Item 433 MHz 868 MHz 915 MHz C31 10 pF, 5%, C0G, 0603 8.2 pF, 5%, C0G, 0603 8.2 pF, 5%, C0G, 0603 C41 6.8 pF, 5%, C0G, 0603 Not used Not used C42 8.2 pF, 5%, C0G, 0603 10 pF, 5%, C0G, 0603 10 pF, 5%, C0G, 0603 C171 18 pF, 5%, C0G, 0603 18 pF, 5%, C0G, 0603 18 pF, 5%, C0G, 0603 C181 18 pF, 5%, C0G, 0603 18 pF, 5%, C0G, 0603 18 pF, 5%, C0G, 0603 L32 68 nH, 10%, 0805 12 nH, 10%, 0805 12 nH, 10%, 0805 (Coilcraft 0805CS-680XKBC) (Coilcraft 0805CS-120XKBC) (Coilcraft 0805CS-120XKBC) L41 6.2 nH, 10%, 0805 2.5 nH, 10%, 0805 2.5 nH, 10%, 0805 (Coilcraft 0805HQ-6N2XKBC) (Coilcraft 0805HQ-2N5XKBC) (Coilcraft 0805HQ- 2N5XKBC) L101 27 nH, 5%, 0805 3.3 nH, 5%, 0805 3.3 nH, 5%, 0805 (Koa KL732ATE27NJ) (Koa KL732ATE3N3C) (Koa KL732ATE3N3C) R131 82 kΩ, 1%, 0603 82 kΩ, 1%, 0603 82 kΩ, 1%, 0603 XTAL 14.7456 MHz crystal, 14.7456 MHz crystal, 14.7456 MHz crystal, 16 pF load 16 pF load 16 pF load Table 28. Bill of materials for the application circuit Note: Shaded items are different for different frequencies Note that the component values for 868 be placed very close and symmetrical with and 915 MHz can be the same. However, respect to the pins (L1 and L2). it is important that the layout is optimised Chipcon provides reference layouts that for the selected VCO inductor in order to should be followed very closely in order to centre the tuning range around the achieve the best performance. The operating frequency to account for reference design can be downloaded from inductor tolerance. The VCO inductor must the Chipcon website. SWRS047A Page 87 of 146

CC1010 17.4 Transceiver Configuration Overview The RF transceiver configuration can be which generates all necessary CC1010 RF optimised to achieve the best performance configuration settings based on the user's for different applications. Through the SFR selections of various parameters. These registers the following key parameters can SFR register settings can be used in a be programmed: CC1010 program to configure the RF. In addition SmartRF® Studio will provide the • Receive / transmit mode user with the component values needed • RF output power for the input/output matching circuit and the VCO inductor. • Frequency synthesiser key parameters: RF output frequency, FSK frequency Chipcon recommends using the register separation (deviation), crystal oscillator settings found using the SmartRF® Studio reference frequency software. These are the register settings that Chipcon can guarantee across • Power-down / power-up mode temperature, voltage and process. Please • Data rate and data format (NRZ, visit the Chipcon web site regularly for Manchester coded, Transparent or updates to the SmartRF® Studio software, UART interface) or subscribe to the Chipcon Developer’s Newsletter to be notified of updates. • Synthesiser lock indicator mode Figure 21 shows the user interface of • Optional RSSI or external IF output SmartRF® Studio. 17.4.1 SmartRF® Studio Chipcon provides users of CC1010 with a Windows application, SmartRF® Studio, Figure 21. SmartRF® Studio SWRS047A Page 88 of 146

CC1010 17.5 RF Transceiver RX/TX control and power management The RFMAIN register controls the part, the TX part, the frequency operation mode (RX or TX), use of the synthesiser and the crystal oscillator. This dual frequency registers and several individual control can be used to optimise power down modes. In this way the CC1010 for lowest possible current consumption in offers great flexibility for RF power a certain application. management in order to meet strict power A typical power-on sequence for minimum consumption requirements in battery- power consumption is shown in Figure 22. operated applications. Different power- The figure assumes that frequency A is down modes are controlled through used for RX and frequency B is used for individual bits in the RFMAIN register. TX. If this is not the case, simply invert the There are separate bits to control the RX F_REG setting. RFMAIN (0xC8) - RF Main Control Register Bit Name R/W Reset value Description 7 RXTX R/W 0 RX/TX Switch. 0 : RX 1 : TX 6 F_REG R/W 0 Select the frequency registers A or B 0 : Select frequency registers A 1 : Select frequency registers B 5 RX_PD R/W 1 Select power down for the LNA, mixer, IF filter and digital demodulator. 0 : Power up 1 : Power down 4 TX_PD R/W 1 Select power down of the digital modem and PA. 0 : Power up 1 : Power down 3 FS_PD R/W 1 Select power down of the frequency synthesizer 0 : Power up 1 : Power down 2 CORE_PD R/W 0 Power down of main crystal oscillator core. 0 : Power up 1 : Power down 1 BIAS_PD R/W 0 Power down of bias current generator and crystal oscillator buffer. 0 : Power up 1 : Power down 0 - R0 0 Reserved, read as 0 SWRS047A Page 89 of 146

CC1010 RF Power Down RX TX RX or TX? Turn on RX: Turn on TX: RFMAIN: RXTX = 0, F_REG = 0 PA_POW = 00h RX_PD = 0, FS_PD = 0 RFMAIN: RXTX = 1, F_REG = 1 CURRENT = ‘RX current’ TX_PD = 0, FS_PD = 0 Wait 250 µs CURRENT = ‘TX current’ Wait 250 µs RX mode PA_POW = ‘Output power’ Wait 20 µs Turn off RX: RFMAIN: RX_PD = 1, FS_PD = 1 TX mode RF Power Down Turn off TX: RFMAIN: TX_PD = 1, FS_PD = 1 PA_POW = 00h RF Power Down Figure 22. RF Transceiver power-on sequence SWRS047A Page 90 of 146

CC1010 17.6 Data Modem and Data Modes Four different data modes are defined for Synchronization and preamble detection transmission and reception, programmable section on page 102. through MODEM0.DATA_FORMAT. These Two other modes, Transparent mode and modes differ in data encoding, how UART mode, simply passes data between incoming and outgoing data is delivered the FSK modem and the RFBUF register and accepted, and whether and UART0, respectively, allowing custom resynchronisation of the bitstream is baud rates and data encoding. When performed (clock regeneration) or not. The using the UART0 in the UART mode the data format should be selected before pin P3.1 is not used for UART output and enabling the RF Transceiver can instead be used for general I/O. Two of the modes, Synchronous NRZ Chipcon strongly recommends that the mode and Synchronous Manchester synchronous modes be used. The other encoded mode, transmit or receive data data modes bypass the data decision using a baudrate as specified in circuitry of the RF transceiver and do not MODEM0.BAUDRATE. The modem does support bytemode. The Transparent mode resynchronisation of the bit stream during is only intended for testing. reception. In the Manchester mode the modem also does the Manchester 17.6.1 Manchester encoding encoding and decoding. The NRZ and Manchester modes accept and deliver In Manchester mode the data clock is data either one bit or one byte at a time, transmitted along with the data. A '1' is programmable through encoded as a high frequency f followed 1 RFCON.BYTEMODE. In most applications by a lower frequency f . A '0' is encoded 0 these two modes are recommended. as a low frequency f followed by a higher 0 frequency f . This is illustrated in Figure Data to be transmitted or data received 1 23. See the Frequency programming are stored in the RFBUF register. During section on page 106 for definitions of f transmission or reception the need for 0 and f . more data or the arrival of new data, bit by 1 bit or byte by byte depending on The Manchester code ensures that the RFCON.BYTEMODE, is signaled by signal has a constant DC component, generating an interrupt (EXIF.RFIF.) which is necessary in some FSK Depending on whether the RF interrupt is demodulators. Using this mode also enabled or not (EIE.RFIE), transmission ensures compatibility with CC400 / CC900 or reception can be handled by an designs. interrupt service routine or be performed The properties of the different data modes by polling. are summarized in Table 29. During reception when using NRZ or Manchester mode, hardware preamble and start of frame detection can optionally be activated using the registers PDET and BSYNC. This is described in the SWRS047A Page 91 of 146

CC1010 1 0 1 1 0 0 0 1 1 0 1 f 1 TX data f 0 Time Figure 23. Manchester encoding Transparent UART mode Synchronous Synchronous NRZ mode Manchester mode encoded mode Baudrate User defined Defined by UART Generated by hardware, as defined by configuration through Timer 1 MODEM0.BAUDRATE Data encoding User defined Defined by UART Manchester None (NRZ) settings encoding. Bitrate is half of baudrate. Data Input & RFBUF(0) N/A RFBUF in bytemode, RFBUF(0) in bitmode. Output Clock N/A Performed by Performed Performed by Regeneration UART internally. A hardware violation to the Manchester coding format is reported in RFCON.MVIOL. Bitmode/ N/A N/A Both possible. Bytemode is forced when Bytemode using preamble detection Preamble N/A N/A If PDET.PEN=1 a configurable number of detection alternating '0's and '1's (PDET.PLEN) followed by a one-byte start of frame delimiter as defined in BSYNC is needed to trigger reception. Bytemode is forced when PDET.PEN=1. Table 29. Properties of different data modes (MODEM0.DATA_FORMAT) SWRS047A Page 92 of 146

CC1010 MODEM0 (0xDB) - Modem Control Register 0 Bit Name R/W Reset value Description 7:5 BAUDRATE(2:0) R/W 011 000 : 0.6 kBaud 001 : 1.2 kBaud 010 : 2.4 kBaud 011 : 4.8 kBaud 100 : 9.6 kBaud 101 : 19.2, 38.4 and 76.8 kBaud 110 : Not used 111 : Not used 4:3 DATA_FORMAT (1:0) R/W 10 00 : NRZ mode 01 : Manchester mode 10 : Transparent mode 11 : UART mode 2:0 XOSC_FREQ (2:0) R/W 001 Select the current crystal oscillator frequency. 000 : 3-4 MHz, 3.6864 MHz recommended Also used for 76.8 kBaud for 14.7456 MHz and 38.4 kBaud for 7.3728 MHz 001 : 6-8 MHz, 7.3728 MHz recommended Also used for 38.4 kBaud for 14.7456 MHz 010 : 9-12 MHz, 11.0592 MHz recommended Also used for 38.4 kBaud for 22.1184 MHz 011 : 12-16 MHz, 14.7456 MHz recommended 100 : 16-20 MHz, 18.4320 MHz recommended 101 : 20-24 MHz, 22.1184 MHz recommended 110 : Reserved for future use 111 : Reserved for future use SWRS047A Page 93 of 146

CC1010 17.7 Baud rates Baud rates from 0.6 kBaud to 76.8 kBaud according to the crystal in use. Baud rates are programmable in the are generated as follows: MODEM0.BAUDRATE control bits. MODEM0.XOSC_FREQ must also be set 2BAUDRATE f RF _BAUDRATE = ⋅ xosc ⋅0.6 kBaud ( ) XOSC_FREQ+1 3.6864MHz RF_BAUDRATE is the output baud rate in Other crystal frequencies will scale the kBaud, BAUDRATE and XOSC_FREQ are baud rate as described above. control bits in MODEM0. Using one of the Baud rates up to and including 19.2 kBaud standard crystals mentioned in the can be generated for any crystal MODEM0.XOSC_FREQ description will frequency. Above 19.2 kBaud a few produce the standard baud rates 0.6, 1.2, combinations are possible, as shown in 2.4, 4.8, 9.6, 19.2, 38.4 or 76.8 kBaud. Table 30. MODEM0. f xosc BAUDRATE [MHz] /XOSC.FREQ RF_BAUDRATE 3.6864 7.3728 11.0592 14.7456 18.4320 22.1184 [kBaud] 0.6 0/0 0/1 0/2 0/3 0/4 0/5 1.2 1/0 1/1 1/2 1/3 1/4 1/5 2.4 2/0 2/1 2/2 2/3 2/4 2/5 4.8 3/0 3/1 3/2 3/3 3/4 3/5 9.6 4/0 4/1 4/2 4/3 4/4 4/5 19.2 5/0 5/1 5/2 5/3 5/4 5/5 38.4 NA 5/0 NA 5/1 NA 5/2 76.8 NA NA NA 5/0 NA NA Table 30. Baud rates versus crystal frequency SWRS047A Page 94 of 146

CC1010 17.8 Transmitting and receiving data In the Transparent or UART modes modes, however, data buffering occurs in outgoing and incoming data is routed RFBUF as illustrated in Figure 24. This directly to the modulator in transmit mode buffering has some repercussions that and directly from the demodulator in must be considered when receiving or receive mode. In the NRZ and Manchester transmitting data, particularly in bytemode. RF RF Transmitter 8-bit shift reg. Receiver Modulator Demodulator RFBUF LSB 8051 core Figure 24. RF Data Buffering. Dotted lines show bitmode RFBUF (0xC9) - RF Data Buffer Bit Name R/W Reset value Description 7:0 RFBUF R/W 0x00 RF Data Buffer, 8 bits. RFBUF is used as described below. mode), the next time the shift register is 17.8.1 Transmission empty it will load the same byte from When transmitting data in bytemode RFBUF again. E.g. when transmitting a (RFCON.BYTEMODE=1), the buffering preamble consisting of alternating '0' and scheme shifts out bits of an 8-bit shift '1', it is only necessary to write the byte to register to the modulator one at a time, RFBUF once and then wait the desired MSB first, at periods specified by the number of byte cycles for the preamble to selected baud rate. When this shift register be transmitted. is empty it will load a new byte from In bitmode (RFCON.BYTEMODE=0), the RFBUF and continue shifting out bits. The same buffering occurs, but only for one bit contents of the RFBUF register remain at a time. Thus, the shift register will load a unchanged after a shift register load. An new bit from RFBUF.0 after each interrupt request is generated (EXIF.RFI) transmitted bit, which in turn generates a so that RFBUF can be loaded with a new RF-interrupt request so that a new bit can data byte. be loaded. In order to be able to write the If a new byte is not written within eight bit next bit to RFBUF.0 within one bit period periods (eight baud periods in NRZ mode at high baud rates, it is advisable to use a and 16 baud periods in Manchester SWRS047A Page 95 of 146

CC1010 tight polling loop instead of an interrupt 17.8.2 Reception based transmit procedure. When receiving data the buffering scheme In order to start transmission of data as works in reverse of what it does during quickly as possible, the first bit/byte to be transmitting. Bit by bit from the transmitted should be written to RFBUF demodulator is shifted into the eight-bit before the modulator is turned on shift register, MSB-first: When the shift (RFMAIN.TX_PD=0). It will then be register is full it is loaded into RFBUF and immediately loaded into the shift register an interrupt request is generated and an interrupt request will be generated (EXIF.RFIF). The byte must be read for the second bit/byte. within one byte period (eight baud periods in NRZ mode and 16 baud periods in It is especially important to take the Manchester mode). If not, it will be buffering scheme into account at the end overwritten by the next byte received and of a transmission. When the last byte of a the data is lost. data frame or packet is loaded into the shift register it is still not transmitted. Thus In bitmode the same buffering occurs, but the interrupt request generated at the only for one bit at a time. Thus, when a same time must not turn off either analog new bit arrives from the demodulator the or digital parts of the transmit chain. The shift register will store it and store the last transmission can not be ended safely until bit into RFBUF.0, which in turn generates nine bit periods later in bytemode and two a RF-interrupt request so that the new bit bit periods later in bitmode, when the last can be read. In order to be able to read bit has been shifted out and has the next bit from RFBUF.0 within one bit propagated through the transmit chain to period at high baud rates it is advisable to the antenna. A simple solution is to always use a tight polling loop instead of an transmit two extra bytes in bytemode or interrupt based receive procedure. two extra bits in bitmode at the end of the No special considerations have to be real data content. (In bytemode this will taken at the start of, or end of, receptions. result in that approximately seven of these bits will be transmitted along with the real data.) This should cause no problems in practice. SWRS047A Page 96 of 146

CC1010 17.9 Demodulation and data decision A block diagram of the digital demodulator transceiver will be switched away from is shown in Figure 25. The IF signal is receive mode as soon as it is sampled and its instantaneous frequency determined that no data is present. is detected. The result is decimated and If the averaging filter is locked filtered. In the data slicer the data filter (MODEM1.LOCK_AVG_MODE='1'), the output is compared to the average filter acquired value will be kept also after output to generate the data output. Power Down or Transmit mode. The averaging filter is used to find the After a modem reset average value of the incoming data. While (MODEM1.MODEM_RESET_N), or a main the averaging filter is running and reset (using any of the standard reset acquiring samples, it is important that the sources), the averaging filter is reset. number of high and low bits received is equal (e.g. Manchester code or a In a polled receiver system the automatic balanced preamble). locking can be used. This is illustrated in Figure 26. If the receiver is operated Therefore all modes, also synchronous continuously and searching for a NRZ mode, need a DC balanced preamble preamble, the averaging filter should be for the internal data slicer to acquire locked manually as soon as the preamble correct comparison level from the is detected. This is shown in Figure 27. If averaging filter. The suggested preamble the data is Manchester coded there is no is a ‘010101…’ bit pattern. The same bit need to lock the averaging filter pattern should also be used in Manchester mode, giving a ‘011001100110…chip (MODEM1.LOCK_AVG_IN='0'), as shown in pattern. This is necessary for the bit Figure 28. synchronizer to synchronize correctly. The minimum length of the preamble The averaging filter must be locked before depends on the acquisition mode selected any NRZ data can be received. This can and the settling time. Table 31 gives the be done in one of two ways: minimum recommended number of chips for the preamble in NRZ and UART • After receiving the preamble and byte modes. In this context ‘chips’ refer to the synchronisation (see the data coding. Using Manchester coding Synchronization and preamble every bit consists of two ‘chips’. For detection section on page 102), set Manchester mode the minimum MODEM1.LOCK_AVG_IN='1' to stop recommended number of chips is shown updating the averaging filter. in Table 32. • Set MODEM1.LOCK_AVG_MODE='1', A special feature in the data filter is a peak and then enter Receive mode remover acting like a low pass filter. The (RFMAIN.RX_PD=’0’). The averaging peak threshold must be programmed filter will then be automatically locked according to the deviation and expected after a preset number of baud periods, frequency drift. When programmable in MODEM1.SETTLING. MODEM1.PEAKDETECT is enabled, The settling time is programmable MODEM2.PLO should be set such that: from 11 to 86 bauds. The average f f 5 filter lock status can be read through PLO= S − s ⋅ MODEM1.AVG_FILTER_STAT. IF ∆f 8 low IF + Please note that the locking is only low 2 automatic in that the lock is enabled the programmed number of bit periods after receive mode is entered. The automatic locking should therefore only be used in situations where the SWRS047A Page 97 of 146

CC1010 where It is important that the peak detector is programmed with a correct value; an error f f = XOSC may result in incorrect data reception. s MODEM0.XOSC_FREQ+1 IF =150kHz−2⋅ f ⋅XTAL_accuracy low RF and ∆f is the deviation. SmartRF® Studio may be used to configure this correctly. Average filter Frequency Data Data slicer Sampler Decimator detector filter comparator Figure 25. Demodulator block diagram DDaattaa ppaacckkaaggee ttoo bbee rreecceeiivveedd NNooiissee PPrreeaammbbllee NNRRZZ ddaattaa NNooiissee RRXX PPDD RRXX AAvveerraaggiinngg ffiilltteerr lloocckkeedd AAvveerraaggiinngg ffiilltteerr ffrreeee--rruunnnniinngg // nnoott uusseedd AAuuttoommaattiiccaallllyy lloocckkeedd aafftteerr aa sshhoorrtt ppeerriioodd ddeeppeennddiinngg oonn ““SSEETTTTLLIINNGG”” Figure 26. Automatic locking of the averaging filter DDaattaa ppaacckkaaggee ttoo bbee rreecceeiivveedd NNooiissee PPrreeaammbbllee NNRRZZ ddaattaa NNooiissee PPDD RRXX AAvveerraaggiinngg ffiilltteerr ffrreeee--rruunnnniinngg AAvveerraaggiinngg ffiilltteerr lloocckkeedd MMaannuuaallllyy lloocckkeedd aafftteerr pprreeaammbbllee iiss ddeetteecctteedd Figure 27. Manual locking of the averaging filter SWRS047A Page 98 of 146

CC1010 DDaattaa ppaacckkaaggee ttoo bbee rreecceeiivveedd NNooiissee PPrreeaammbbllee MMaanncchheesstteerr eennccooddeedd ddaattaa NNooiissee PPDD RRXX AAvveerraaggiinngg ffiilltteerr aallwwaayyss ffrreeee--rruunnnniinngg Figure 28. Free-running averaging filter Settling Manual Lock Automatic Lock NRZ mode UART mode NRZ mode UART mode MODEM1. MODEM1.LOCK_ MODEM1.LOCK_ MODEM1.LOCK_ MODEM1.LOCK_ SETTLING AVG_MODE='1' AVG_MODE='1' AVG_MODE='0' AVG_MODE='0' (1:0) MODEM1.LOCK_ MODEM1.LOCK_ MODEM1.LOCK_ MODEM1.LOCK_ AVG_IN='0'=→’1’** AVG_IN='0'=→’1’** AVG_IN='X'*** AVG_IN='X'*** 00 14 11 16 16 01 25 22 32 32 10 46 43 64 64 11 89 86 128 128 Table 31. Minimum preamble bits for locking the averaging filter, NRZ and UART mode Notes: ** The averaging filter is locked when MODEM1.LOCK_AVG_IN is set to 1 *** X = Do not care. The timer for the automatic lock is started when RX mode is set in the RFMAIN register Also please note that in addition to the number of bits required to lock the filter, you need to add the number of bits needed for the preamble detector. See the next section for more information. Settling Free-running Manchester mode MODEM1. MODEM1.LOCK_ SETTLING AVG_MODE='1' (1:0) MODEM1.LOCK_ AVG_IN='0' 00 23 01 34 10 55 11 98 Table 32. Minimum number preamble chips for averaging filter, Manchester mode SWRS047A Page 99 of 146

CC1010 MODEM1 (0xDA) - Modem Control Register 1 Bit Name R/W Reset value Description 7 - R0 0 Reserved, read as 0 6 LOCK_AVG_IN R/W 0 Lock control bit of average filter 0 : Average Filter is free-running, used for receiving zero average data (e.g. Preamble or Manchester encoded data) 1 : Lock average filter, used for NRZ data 5 LOCK_AVG_MODE R/W 1 Automatic lock of average filter 0 : Lock of Average Filter is controlled automatically, use when zero average data is present when the receiver is turned on 1 : Lock of Average Filter is controlled by LOCK_AVG_IN 4 LOCK_AVG_STAT R 0 Average filter status bit 0 : Average filter is free running 1 : Average filter is locked 3:2 SETTLING(1:0) R/W 11 Settling time of average filter 00 : 11 baud settling time, worst case 1.2dB loss in sensitivity 01 : 22 baud settling time, worst case 0.6dB loss in sensitivity 10 : 43 baud settling time, worst case 0.3dB loss in sensitivity 11 : 86 baud settling time, worst case 0.15dB loss in sensitivity 1 PEAKDETECT R/W Peak detector and remover enable / disable 0 : Peak detector and remover is disabled. 1 : Peak detector and remover is enabled 0 MODEM_RESET_N R/W Separate reset of the MODEM. 0 : The Modem is reset 1 : The Modem reset is released MODEM2 (0xD9) - Modem Control Register 2 Bit Name R/W Reset value Description 7 - R0 0 Reserved, read as 0 6:0 PLO(6:0) R/W 0x16 Peak Level Offset, threshold level for peak the peak detector and remover in the demodulator, which is activated when MODEM1.PEAKDETECT is set. PLO should be set as described on page 97. SWRS047A Page 100 of 146

CC1010 RFCON (0xC2) - RF Control Register Bit Name R/W Reset value Description 7:5 - R0 0 Reserved, read as 0 4 MVIOL R 0 Manchester code violation status of current bit in bitmode or the aggregate-OR of the Manchester code status of all bits in the current byte in bytemode. Only valid when MODEM0.DATA_FORMAT=01 (Manchester encoding) 3:1 MLIMIT(2:0) R/W 011 Limit value used by the clock regeneration logic in Manchester mode to determine whether the current symbol constitutes a Manchester code violation. The violation detection is determined by how balanced the bit is by looking at the 14 samples. A perfect bit is 14 (all samples are correct). The limit can be set from 1 to 7 (001 – 111). 0 disable the violation detection function. 0 BYTEMODE R/W 0 Select bit or bytemode 0 : Bitmode is enabled. Data is transmitted and received bit by bit through RFBUF.0 1 : Bytemode is enabled. Data is transmitted and received byte by byte through RFBUF, with MSB first. BYTEMODE is ignored if PDET.PEN = 1 SWRS047A Page 101 of 146

CC1010 17.10 Synchronization and preamble detection Most RF communication protocols will examples are shown in Figure 29. Note have a preamble designated to let the that the Manchester baud rate is twice the receiver synchronise reception on a bit NRZ baud rate in the figure. and byte level. CC1010 contains hardware The preamble must consist of an that will perform these tasks easily in alternating 0-1-pattern followed by a synchronous NRZ and Manchester synchronization byte of eight bits. Unless encoded modes. the average filter is already locked at the The byte synchronization mechanism arrival of the synchronization byte in NRZ ensures that the framing of bytes in the mode, it is vital that the synchronization received data bit stream is correct, thus byte is DC-balanced (equal number of freeing the software from needing to zeros and ones) and contains no more perform shifting and recombination of data than two consecutive ones or zeros. It is bytes. In addition, the synchronization byte also required that the synchronization byte functions as a start of frame delimiter. The contains two consecutive ones or zeros. preamble detection mechanism reduces This means that e.g. 0xCC is not a legal the workload for the processor when the synchronization byte, but 0xCA is. exact time of the start of a transmission is uncertain. Both mechanisms are active when PDET.PEN is set. (See PDET register definition below.) Two preamble NRZ Bit value 1 0 1 0 1 0 1 0 1 0 1 0 0 1 0 1 1 0 0 1 0 Manchester Bit value 1 0 1 0 1 0 1 0 1 0 1 0 0 1 0 1 1 0 0 1 0 Preamble Byte sync Data Figure 29. Preamble detection examples PDET (0xD3) - Preamble Detection Control Register Bit Name R/W Reset value Description 7 PEN R/W 0 Preamble and byte synchronisation enable. 0 : Receiver mode is defined by RFCON.BYTEMODE. 1 : Preamble and byte synchronisation is enabled. RFCON.BYTEMODE is don't care. 6:0 PLEN R/W 0x00 Preamble length. Define the number of alternating bits required before byte synchronisation. PLEN must be greater than zero. BSYNC (0xD4) - Byte Synchronisation Register Bit Name R/W Reset value Description 7:0 BSYNC(7:0) R/W 0x00 BSYNC defines the byte that triggers byte synchronisation during RF preamble detection. The hardware support for preamble which keeps track of the number of detection consists of a seven-bit counter, successive alternating bits. It is reset SWRS047A Page 102 of 146

CC1010 whenever two bits are equal and 17.10.1 Estimating the required incremented whenever two successive bits preamble length are different. The counter is limited and The preamble length is determined by will not overflow. A seven-bit threshold is several factors. First, the receiver circuitry programmable through PDET.PLEN. Not needs some time to settle. Second, the until this counter equals or exceeds averaging filter must acquire a correct PDET.PLEN will a synchronization byte be value. Third, the preamble detection circuit accepted. CC1010 is able to detect must receive the required number of bits. preambles (including the synchronization byte) with minimum lengths from 10 to 135 The first factor depends on the data rate bits. and will be limited to only a few bits. The number of bits required by the averaging When the requisite number of alternating filter is a bit tricky to calculate, but zeros and ones has been received, a estimates of the maximum bound are special state is entered where a deviation given in Table 31 and Table 32. The from the 0-1-pattern is searched for. Once number of bits required will vary because a bit does not correspond to the the updating of the averaging filter is not alternating bits pattern, a synchronization synchronised to the start of the byte matching that defined in BSYNC must transmission. RF noise can complicate the occur within a maximum of seven bits, issue further. otherwise the receiver will reset its preamble counter and go back to the To determine an approximate preamble preamble detection mode. length, add the estimated number of bits required by the averaging filter with the If, however, a match is found before the preamble detector setting. Round the timeout, the synchronization byte is number of bits up to the closest multiple of transferred to RFBUF and an EXIF.RFIF 8 and use this as a starting point. For time- interrupt request generated, after which critical applications where it is important to the receiver enters normal reception use as short preamble as possible, the mode. For both the examples shown in preamble length should be optimized by Figure 29, BSYNC should be set to experimentation. 10100101 (0xA5). 17.10.2 Manchester violations PDET.PEN is not cleared by hardware when the preamble is detected, but it will In some RF-applications using Manchester not affect the reception of data. It can be coding, violations of the Manchester cleared or left set, decided by what is coding have been used for start- and end- more practical for the software developer. of-frame delimiters. Furthermore some However, before a new preamble implementations use a sequence of all detection session is initiated, PDET.PEN ones or all zeros for a preamble instead of must be cleared. an alternating zero-one sequence. Although an all zero or all one sequence If manual average filter locking is will certainly be DC-balanced once performed, the average filter should be Manchester coded, the receiver is unable locked after receiving the synchronization to decide whether it is receiving an all zero byte in NRZ mode. (See the Reception or an all one sequence, since only the bit section on page 96 for details.) As synchronization will separate these. mentioned above it is vital that the synchronization byte is DC-balanced and In order to facilitate reception and contains no more than two consecutive transmission of such special cases, ones or zeros in order to achieve a good support has been implemented in CC1010 average filter lock in this case. for allowing the data format to be changed in the middle of a reception or transmission. Furthermore, violations of the Manchester coding format is reported in the status bit RFCON.MVIOL. The SWRS047A Page 103 of 146

CC1010 threshold for determining what constitutes be changed to NRZ mode for the byte in a Manchester coding violation can be question. When in NRZ mode, two bytes configured in RFCON.MLIMIT. must be sent for each Manchester-coded RFCON.MVIOL is set when, in bitmode, byte. A flagrant violation of Manchester the currently available bit in RFBUF.0 was coding could be, for example, the two-byte determined to violate Manchester coding, sequence "11001100"-"00110011". In or in bytemode, when one or more of the order to provide this functionality, bits in the byte currently available in MODEM0.DATA_FORMAT is buffered in RFBUF were determined to violate the much the same way as data so that the Manchester coding. This can be used, for change does not take effect until the example, to detect start of frame and end following byte. of frame delimiter bytes. During transmission, the desired data Note that even if RFCON.MVIOL is set format should be updated in connection when receiving data, RFBUF will still be set with writing new data to RFBUF. The byte currently being transmitted from the shift to the "best guess" data received. In register will not be affected. It is then applications where no Manchester possible to have a NRZ preamble pattern violations are transmitted, it is therefore with Manchester data following. This is advisable to ignore RFCON.MVIOL at illustrated in Figure 30. reception. In order to be able to send Manchester violations, MODEM0.DATA_FORMAT must Manchester data NRZ Preamble Bit value 1 0 1 0 1 0 1 0 1 0 1 0 1 1 0 0 1 0 0 Preamble Byte sync Data Figure 30. Switching data mode after preamble Changing the desired data mode during data and the new DATA_FORMAT will not reception of NRZ preamble and take effect until a valid (NRZ) Manchester data is straightforward. A new synchronization byte is found and an value of MODEM0.DATA_FORMAT does not interrupt request generated. take effect before an RF interrupt request It is not recommended to change the data is generated. After having started a format during reception for new protocols, reception using preamble detection/byte but the functionality is included for synchronization and the NRZ data mode, compatibility with existing protocols. the DATA_FORMAT should be set to Manchester. The whole preamble detection process will then work with NRZ SWRS047A Page 104 of 146

CC1010 17.11 Receiver sensitivity versus data rate and frequency separation The receiver sensitivity depends on the performance the frequency separation data rate, the data format, FSK frequency should be as high as possible especially at separation and the RF frequency. Typical high data rates. figures for the receiver sensitivity (BER = Figure 31 and Figure 32 show typical 10-3) are shown in Table 33 for 64 kHz figures for how sensitivity varies as a frequency separations and in Table 34 for function of the frequency offset between 20 kHz. Optimised sensitivity the transmitter and the receiver. configurations are used. For best Data rate Separation 433 MHz 868 MHz [kBaud] [kHz] NRZ Manchester NRZ Manchester mode mode mode mode 0.6 64 -109 -108 -106 -106 1.2 64 -107 -106 -104 -104 2.4 64 -105 -105 -101 -103 4.8 64 -104 -103 -98 -100 9.6 64 -102 -101 -96 -98 19.2 64 -100 -99 -96 -96 38.4 64 -97 -98 -94 -94 76.8 64 -96 -96 -93 -93 Table 33. Typical receiver sensitivity as a function of data rate at 433 and 868 MHz, BER = 10-3, frequency separation 64 kHz Data rate Separation 433 MHz 868 MHz [kBaud] [kHz] NRZ Manchester NRZ Manchester mode mode mode mode 0.6 20 -105 -105 -100 -102 1.2 20 -104 -103 -99 -101 2.4 20 -101 -101 -97 -99 4.8 20 -98 -100 -96 -98 9.6 20 -98 -99 -94 -96 19.2 20 -97 -98 -94 -94 38.4 20 N/R N/R N/R N/R 76.8 20 N/R N/R N/R N/R Table 34. Typical receiver sensitivity as a function of data rate at 433 and 868 MHz, BER = 10-3, frequency separation 20 kHz N/R = Not recommended (data rate too high compared to frequency separation) SWRS047A Page 105 of 146

CC1010 -96 -97 -98 -99 m] -100 B d y [ -101 vit -102 siti n e -103 S -104 -105 -106 -107 -60 -40 -20 0 20 40 60 80 Frequency offset [kHz] Figure 31. Sensitivity versus frequency offset, 868 MHz, 2.4 kBaud Manchester -98 -99 -100 -101 m] B -102 d y [ vit -103 siti -104 n e S -105 -106 -107 -108 -80 -60 -40 -20 0 20 40 60 Frequency offset [kHz] Figure 32. Sensitivity versus frequency offset, 433 MHz, 2.4 kBaud Manchester SWRS047A Page 106 of 146

CC1010 17.12 Frequency programming RX mode: f f f (low-side) RF f (high-side) vco LO (Receive frequency) LO f f IF IF TX mode: f f f 0 RF 1 f (Lower FSK (Center frequency) (Upper FSK vco frequency) frequency) f sep Figure 33, Relation between f , f , and LO frequency vco if The frequency synthesiser (PLL) is FREQ_2B:FREQ_1B:FREQ_0B for the A controlled by the frequency word in the and B word, respectively. configuration registers. There are two The FSK frequency separation (two times frequency words, A and B, which can be the deviation), FSEP, is programmed in programmed to two different frequencies. the FSEP1:FSEP0 registers (11 bits). One of the frequency words can be used for RX (local oscillator frequency) and The frequency word FREQ can be other for TX (transmitting frequency, f0). calculated from: This makes it possible to switch very fast between RX mode and TX mode. They f = f ⋅FREQ+FSEP⋅TXDATA+8192, can also be used for RX (or TX) on two VCO ref 16384 different channels. Selection of frequency where TXDATA is 0 or 1 in transmit mode word A or B is performed by using the depending on the data bit to be RFMAIN.F_REG control bit. transmitted. In receive mode TXDATA is The frequency word, FREQ, is 24 bits (3 always 0. bytes) located in The reference frequency f is the crystal FREQ_2A:FREQ_1A:FREQ_0A and ref oscillator clock divided by PLL.REFDIV, a SWRS047A Page 107 of 146

CC1010 number between 2 and 24 that should be Clearing PLL.ALARM_DISABLE will chosen such that: enable generation of the frequency alarm bits PLL.ALARM_H and PLL.ALARM_L. 1.00 MHz ≤ f ≤ 2.40 MHz ref These bits indicate that the frequency Thus, the reference frequency f is: synthesis PLL is unable to generate the ref frequency requested, and the PLL should f f = xosc be recalibrated as described in the VCO ref REFDIV and PLL self-calibration section on page 113. f is the Local Oscillator (LO) frequency VCO in receive mode, and the f frequency in It is recommended that the 0 transmit mode (lower FSK frequency). LOCK_CONTINOUS bit in the LOCK register is checked when changing frequencies The LO frequency must be f – f or f + RF IF RF and when changing between RX and TX f giving low-side or high side LO injection IF mode. If lock is not achieved, a calibration respectively. Note that the data in RFBUF should be performed as described on will be inverted if high-side LO is used. page 113. Please also note that f depends on the IF RF frequency (150 and 130 kHz for 433 Chipcon recommends using the frequency and 868 MHz respectively). settings described in the Recommended Settings for ISM Frequencies section on The upper FSK transmit frequency is given page 111. Chipcon recommends the use by: of the SmartRF® Studio software to f = f + f , calculate RF settings for the CC1010. 1 0 sep Using the Print registers to file option in where the frequency separation f is set sep the File menu generates a text file with a C by the 11 bit separation word constant structure that can be passed to (FSEP1:FSEP0): the RF configuration routines in the HAL FSEP library. f = f ⋅ sep ref 16384 FREQ_2A (0xCC) – Frequency A, Control Register 2 Bit Name R/W Reset value Description 7:0 FREQ_A (23:16) R/W 0x75 8 MSB of frequency control word A. It must be programmed such that FREQ_2A ≥ 01000000 FREQ_1A (0xCB) – Frequency A, Control Register 1 Bit Name R/W Reset value Description 7:0 FREQ_A (15:8) R/W 0xA0 Bit 15 to 8 of frequency control word A. FREQ_0A (0xCA) – Frequency A, Control Register 0 Bit Name R/W Reset value Description 7:0 FREQ_A(7:0) R/W 0xCB 8 LSB of frequency control word A. FREQ_2B (0xCF) - Frequency B, Control Register 2 Bit Name R/W Reset value Description 7:0 FREQ_B (23:16) R/W 0x75 8 MSB of frequency control word B. It must be programmed such that FREQ_2B ≥ 01000000 FREQ_1B (0xCE) - Frequency B, Control Register 1 Bit Name R/W Reset value Description 7:0 FREQ_B (15:8) R/W 0xA5 Bit 15 to 8 of frequency control word B. SWRS047A Page 108 of 146

CC1010 FREQ_0B (0xCD) - Frequency B, Control Register 0 Bit Name R/W Reset value Description 7:0 FREQ_B(7:0) R/W 0x4E 8 LSB of frequency control word B. FSEP1 (0xEB) - Frequency Separation Control Register 1 Bit Name R/W Reset value Description 7:3 - R0 0 Reserved, read as 0 2:0 FSEP(10:8) R/W 0x00 3 MSB of the frequency separation control word FSEP FSEP0 (0xEA) - Frequency Separation Control Register 0 Bit Name R/W Reset value Description 7:0 FSEP(7:0) R/W 0x59 8 LSB of the frequency separation control word FSEP PLL (0xE3) - PLL Control Register Bit Name R/W Reset value Description 7:3 REFDIV(4:0) R/W 0x02 Reference divider setting. The main crystal oscillator frequency is divided by REFDIV to create the RF reference frequency f . Valid REFDIV settings are 2 ref through 24, as described above. 2 ALARM_ R/W 0 Disable / Enable the generation of the ALARM_H and DISABLE ALARM_L bits 0 : Alarm function enabled 1 : Alarm function disabled 1 ALARM_H R None Status bit for tuning voltage out of range (too close to VDD) The PLL should be re-calibrated if this bit is set 0 ALARM_L R None Status bit for tuning voltage out of range (too close to GND) The PLL should be re-calibrated if this bit is set SWRS047A Page 109 of 146

CC1010 17.13 Lock Indication The frequency synthesis PLL has a lock Otherwise LOCK_CONTINUOUS should be indicator, which can be read from the used. It is a filtered version of LOCK register. LOCK_INSTANT is a single LOCK_INSTANT, giving a lock accuracy of sample of the phase difference between 99.3 % with PLL_LOCK_ACCURACY the reference frequency and the divided cleared. VCO frequency. This bit gives a lock If lock is not achieved, the PLL should be accuracy of > 25 %, depending on the recalibrated as described on page 113. division ratio set by the FREQ registers. To be used as a lock indicator, this bit must be sampled over a period of time to increase the accuracy. LOCK (0xE4) - PLL Lock Register Bit Name R/W Reset value Description 7:4 - R0 0 Reserved, read as 0 3 PLL_LOCK_ACCURACY R/W 0 0 : Sets Lock Threshold = 127, Reset Lock Threshold = 111 for continuous lock. Corresponds to a worst case accuracy of 99.3% 1 : Sets Lock Threshold = 31, Reset Lock Threshold =15 for continuous lock. Corresponds to a worst case accuracy of 97.2% 2 PLL_LOCK_LENGTH R/W 0 0 : Normal PLL lock window 1 : Not used 1 LOCK_INSTANT R None Status bit from Lock Detector. The result of one sample of the lock window on the PLL reference clock 0 LOCK_CONTINUOUS R None Status bit from Lock Detector, set according to the PLL_LOCK_ACCURACY setting SWRS047A Page 110 of 146

CC1010 17.14 Recommended Settings for ISM Frequencies The recommended frequency synthesiser transmitter is not affected by the settings, settings for a few operating frequencies in but recommended transmitter settings are the popular ISM bands are shown in Table included for completeness. The FSK 35. These settings ensure optimum frequency separation is set to 64 kHz. The configuration of the synthesiser in receive SmartRF® Studio software can be used to mode for best sensitivity. For some generate the optimised configuration data settings of the synthesiser (combinations as well. Also an application note (AN011) of RF frequencies and reference and a spreadsheet are available from frequency), the receiver sensitivity is Chipcon generating configuration data for degraded. The performance of the any frequency giving optimum sensitivity. ISM Actual Crystal Low-side Reference Frequency Frequency Frequency frequency frequency / high- divider word word [MHz] [MHz] [MHz] side REFDIV RX mode RX mode LO* [decimal] FREQ FREQ [decimal] [hex] 315 315.3372 3,6864 low-side 3 4194304 400000 7.3728 6 4194304 400000 11.0592 9 4194304 400000 14.7456 12 4194304 400000 18.4320 15 4194304 400000 22.1184 18 4194304 400000 433.3 433.302000 3.6864 Low-side 3 5767168 580000 7.3728 6 5767168 580000 11.0592 9 5767168 580000 14.7456 12 5767168 580000 18.4320 15 5767168 580000 22.1184 18 5767168 580000 433.9 433.916400 3.6864 Low-side 3 5775360 582000 7.3728 6 5775360 582000 11.0592 9 5775360 582000 14.7456 12 5775360 582000 18.4320 15 5775360 582000 22.1184 18 5775360 582000 434.5 434.530800 3.6864 Low-side 3 5783552 584000 7.3728 6 5783552 584000 11.0592 9 5783552 584000 14.7456 12 5783552 584000 18.4320 15 5783552 584000 22.1184 18 5783552 584000 868.3 868.277200 3.6864 Low-side 2 7708672 75A000 7.3728 4 7708672 75A000 11.0592 6 7708672 75A000 14.7456 8 7708672 75A000 18.4320 10 7708672 75A000 22.1184 12 7708672 75A000 868.95 868.938800 3.6864 high-side 2 7716864 75C000 7.3728 4 7716864 75C000 11.0592 6 7716864 75C000 14.7456 8 7716864 75C000 18.4320 10 7716864 75C000 22.1184 12 7716864 75C000 SWRS047A Page 111 of 146

CC1010 ISM Actual Crystal Low-side Reference Frequency Frequency Frequency frequency frequency / high- divider word word [MHz] [MHz] [MHz] side REFDIV RX mode RX mode LO* [decimal] FREQ FREQ [decimal] [hex] 869.525 869.506000 3.6864 Low-side 3 11583488 B0C000 7.3728 6 11583488 B0C000 11.0592 9 11583488 B0C000 14.7456 12 11583488 B0C000 18.4320 15 11583488 B0C000 22.1184 18 11583488 B0C000 869.85 869.860400 3.6864 High-side 2 7725056 75E000 7.3728 4 7725056 75E000 11.0592 6 7725056 75E000 14.7456 8 7725056 75E000 18.4320 10 7725056 75E000 22.1184 12 7725056 75E000 915 915.018800 3.6864 High-side 2 8126464 7C0000 7.3728 4 8126464 7C0000 11.0592 6 8126464 7C0000 14.7456 8 8126464 7C0000 18.4320 10 8126464 7C0000 22.1184 12 8126464 7C0000 *Note: When using high-side LO injection the data received in RFBUF will be inverted. Table 35. Recommended settings for ISM frequencies SWRS047A Page 112 of 146

CC1010 17.15 VCO Only one external inductor (L101) is Typical tuning range for the integrated required for the VCO. The inductor will varactor is 20-25%. determine the operating frequency range Component values for various frequencies of the circuit. It is important to place the are given in Table 28. Component values inductor as close to the pins as possible in for other frequencies can be found using order to reduce stray inductance. It is the SmartRF® Studio software. recommended to use a high Q, low tolerance inductor for best performance. 17.16 VCO and PLL self-calibration To compensate for supply voltage, Reference frequency Calibration time temperature and process variations the [MHz] [ms] VCO and PLL must be calibrated. The 2.4 10.69 calibration is done automatically and sets 2.0 12.83 optimum VCO tuning range and optimum charge pump current for PLL stability. The 1.5 17.10 calibration is controlled by using the CAL 1.0 25.65 register. Table 36. Calibration times After setting up the device at the operating frequency, the TEST6 register must be The CAL_START bit must be cleared after programmed (depend on operation mode). the calibration is done. This will also clear Then the self-calibration is initiated by the CAL.CAL_COMPLETE status bit. setting the CAL.CAL_START bit. The There are separate calibration values for calibration result is stored internally in the the two frequency registers. If the two chip, and is valid as long as power is not frequencies, A and B, differ more than 1 turned off. If large supply voltage MHz, or different VCO currents are used variations (more than 0.5 V) or (CURRENT.VCO_CURRENT(3:0)), the temperature variations (more than 40 calibration should be done separately. degrees) occur after calibration, a new When using a 10.7 MHz external IF the LO calibration should be performed. For more is 10.7 MHz below/above the transmit details on the calibration data, see the frequency, hence separate calibration description for test and calibration registers page 128. must be done. The CAL.CAL_DUAL bit controls dual or separate calibration. When CAL.CAL_WAIT = 1 the calibration The single frequency calibration algorithm is complete and the CAL.CAL_COMPLETE using separate calibration for RX and TX flag is set after 25650 reference clock frequency is illustrated in Figure 34. cycles (f , see the Frequency REF programming section at page 106). The In Figure 35 the dual calibration algorithm user can poll this bit, or simply wait 25650 is shown for two RX frequencies. It could reference clock cycles. The lowest also be used for two TX frequencies, or permitted reference frequency (1 MHz) even for one RX and one TX frequency if gives a wait time of 25.65 ms, which is the the same VCO current is used. worst case. Some calibration times for In multi-channel and frequency hopping different reference frequencies are listed in applications the PLL calibration values Table 36. When CAL.CAL_WAIT = 0 it may be read and stored for later use. By takes 12825 cycles, but this is not reading back calibration values and recommended. frequency change can be done without doing a re-calibration which could take up to 25 ms. After a calibration is completed, SWRS047A Page 113 of 146

CC1010 the result of the calibration is stored in the TEST5.VCO_AO(3:0) and TEST0 (VCO capacitance array setting) TEST5.CHP_CO(4:0) respectively. and TEST2 (Charge pump current setting) TEST5.VCO_OVERRIDE and registers. The access of these registers TEST6.CHP_OVERRIDE must be set in depend on the RFMAIN.F_REG bit as order to make the override values to take there are two physical registers mapped to effect. the same address, one for frequency A The rest of the TESTn registers are not and one for frequency B. The calibration needed for normal operation of CC1010, but result can be read back from TEST0 and are included here for completeness. TEST2, and later written back in CAL (0xE5) - PLL Calibration Control Register Bit Name R/W Reset value Description 7 CAL_START R/W 0 ↑ 1 : Calibration started 0 : Calibration inactive Calibration is started after a positive transition on CAL_START. CAL_START must manually be written to 0 after calibration is complete (read the CAL_COMPLETE flag) 6 CAL_DUAL R/W 0 1 : Store calibration in both A and B (dual calibration) 0 : Store calibration in A or B defined by RFMAIN.F_REG 5 CAL_WAIT R/W 0 1 : Normal Calibration Wait Time (Recommended) 0 : Half Calibration Wait Time The calibration time is proportional to the internal reference frequency f . See the main text. REF 4 CAL_CURRENT R/W 0 1 : Calibration Current Doubled 0 : Normal Calibration Current (Recommended) 3 CAL_COMPLETE R 0 Status bit which is set when the calibration is complete 2:0 CAL_ITERATE R/W 101 Iteration start value for calibration DAC 000 - 101: Not used 110 : Normal start value 111 : Not used TEST6 (0xFF) – PLL Test Register 6 Bit Name R/W Reset value Description 7 LOOPFILTER_TP1 R/W 0 Testpoint 1 select 0 : CHP_OUT tied to GND 1 : Select testpoint 1 to CHP_OUT 6 LOOPFILTER_TP2 R/W 0 Testpoint 2 select 0 : CHP_OUT tied to GND 1 : Select testpoint 2 to CHP_OUT 5 CHP_OVERRIDE R/W 0 Charge pump current override enable 0 : use calibrated value. Used in RX mode 1 : use CHP_CO[4:0] value. Used in TX mode 4:0 CHP_CO(4:0) R/W 0x10 Charge pump current DAC override value, applied when CHP_OVERRIDE is high. Use 0x1B in TX mode. SWRS047A Page 114 of 146

CC1010 TEST5 (0xFE) – PLL Test Register 5 Bit Name R/W Reset value Description 7:6 - R0 0x00 Reserved, read as 0 5 CHP_DISABLE R/W 0 PLL Charge Pump disable 0 : Charge Pump is enabled (normal function) 1 : Charge Pump is disabled 4 VCO_OVERRIDE R/W 0 VCO array override 0 : VCO array is not overridden (normal function) 1 : VCO array is set by VCO_AO(3:0) 3:0 VCO_AO(3:0) R/W 0x08 VCO Array override value TEST4 (0xFD) – PLL Test Register 4 Bit Name R/W Reset value Description 7:6 - R/W 0x00 Reserved, read as 0 5:0 L2KIO R/W 0x25 Constant charge pump current scaling / rounding factor. Sets bandwidth of PLL. Default value is 0x25 and shall be used for all modes TEST3 (0xFC) – PLL Test Register 3 Bit Name R/W Reset value Description 7:5 - R0 0x00 Reserved, read as 0 4 BREAK_LOOP R/W 0 Break frequency synthesis PLL 0 : PLL loop closed (normal operation) 1 : PLL loop open 3:0 CAL_DAC_OPEN R/W 100 Calibration DAC override value, active when (3:0) BREAK_LOOP is set TEST2 (0xFB) – PLL Test Register 2 Bit Name R/W Reset value Description 7:5 - R0 0x00 Reserved, read as 0 4:0 CHP_CURRENT R None Status vector defining the applied charge pump (4:0) current TEST1 (0xFA) – PLL Test Register 1 Bit Name R/W Reset value Description 7:4 - R0 0x00 Reserved, read as 0 3:0 CAL_DAC(3:0) R None Status vector defining the applied calibration DAC value TEST0 (0xF9) – PLL Test Register 0 Bit Name R/W Reset value Description 7:4 - R0 0x00 Reserved, read as 0 3:0 VCO_ARRAY(3:0) R 0x00 Status vector defining the applied VCO array SWRS047A Page 115 of 146

CC1010 SSttaarrtt ssiinnggllee ccaalliibbrraattiioonn WWrriittee FFRREEQQ__AA,, FFRREEQQ__BB FFrreeqquueennccyy rreeggiisstteerr AA iiss uusseedd ffoorr WWrriittee CCAALL..CCAALL__DDUUAALL == 00 RRXX mmooddee,, rreeggiisstteerr BB ffoorr TTXX RRXX ffrreeqquueennccyy rreeggiisstteerr AA iiss ccaalliibbrraatteedd ffiirrsstt WWrriittee RRFFMMAAIINN:: RRXXTTXX == 00;; FF__RREEGG == 00;; RRXX__PPDD == 00;; TTXX__PPDD == 11;; FFSS__PPDD == 00;; CCOORREE__PPDD==00;; BBIIAASS__PPDD==00;; WWrriittee CCUURRRREENNTT..VVCCOO__CCUURRRREENNTT == RRXX ccuurrrreenntt ‘‘RRXX ccuurrrreenntt’’ iiss tthhee VVCCOO ccuurrrreenntt ttoo WWrriittee PPLLLL..RREEFFDDIIVV == RRXX rreeffeerreennccee ddiivviiddeerr bbee uusseedd iinn RRXX mmooddee WWrriittee TTEESSTT66==00xx11BB CCaalliibbrraattiioonn iiss ppeerrffoorrmmeedd iinn RRXX mmooddee,, WWrriittee CCAALL..CCAALL__SSTTAARRTT==11 RReessuulltt iiss ssttoorreedd iinn TTEESSTT00 aanndd TTEESSTT22,, RRXX rreeggiisstteerr WWaaiitt ffoorr mmaaxxiimmuumm 2266mmss,, oorr CCaalliibbrraattiioonn ttiimmee ddeeppeennddssoonn tthhee rreeffeerreennccee RReeaadd CCAALL aanndd wwaaiitt uunnttiill ffrreeqquueennccyy,, sseeee tteexxtt.. CCAALL..CCAALL__CCOOMMPPLLEETTEE==11 WWrriitteeCCAALL..CCAALL__SSTTAARRTT==00 WWrriittee RRFFMMAAIINN:: RRXXTTXX == 11;; FF__RREEGG == 11 TTXX ffrreeqquueennccyy rreeggiisstteerr BB iiss ccaalliibbrraatteedd sseeccoonndd RRXX__PPDD == 11;; TTXX__PPDD == 00;; FFSS__PPDD == 00 CCOORREE__PPDD == 00;; BBIIAASS__PPDD == 00;; RREESSEETT__NN==11 WWrriittee CCUURRRREENNTT..VVCCOO__CCUURRRREENNTT == TTXX ccuurrrreenntt ‘‘TTXX ccuurrrreenntt’’ iiss tthhee VVCCOO ccuurrrreenntt ttoo bbee WWrriittee PPLLLL..RREEFFDDIIVV == TTXX rreeffeerreennccee ddiivviiddeerr uusseedd iinn TTXX mmooddee WWrriittee TTEESSTT66 == 00xx33BB PPAA iiss ttuurrnneedd ooffff ttoo pprreevveenntt ssppuurriioouuss WWrriittee PPAA__PPOOWW == 00xx0000 eemmiissssiioonn CCaalliibbrraattiioonn iiss ppeerrffoorrmmeedd iinn TTXX mmooddee,, WWrriittee CCAALL..CCAALL__SSTTAARRTT==11 RReessuulltt iiss ssttoorreedd iinn TTEESSTT00 aanndd TTEESSTT22,, TTXX rreeggiisstteerrss WWaaiitt ffoorr 2266mmss,, oorr RReeaadd CCAALL aanndd wwaaiitt uunnttiill CCAALL..CCAALL__CCOOMMPPLLEETTEE==11 WWrriittee CCAALL..CCAALL__SSTTAARRTT==00 EEnndd ooff ccaalliibbrraattiioonn Figure 34. Single calibration algorithm for RX and TX SWRS047A Page 116 of 146

CC1010 SSttaarrtt dduuaall ccaalliibbrraattiioonn WWrriittee FFRREEQQ__AA,, FFRREEQQ__BB FFrreeqquueennccyy rreeggiisstteerrss AA aanndd BB aarree bbootthh uusseedd WWrriittee CCAALL..CCAALL__DDUUAALL == 11 ffoorr RRXX mmooddee((oorr bbootthh ffoorr TTXX mmooddee)) EEiitthheerr ffrreeqquueennccyy rreeggiisstteerr AA oorr BB iiss sseelleecctteedd WWrriittee RRFFMMAAIINN:: RRXXTTXX == 00;; FF__RREEGG == 00;; RRXX__PPDD == 00;; TTXX__PPDD == 11;; FFSS__PPDD == 00;; CCOORREE__PPDD==00;; BBIIAASS__PPDD==00;; WWrriittee CCUURRRREENNTT..VVCCOO__CCUURRRREENNTT == RRXX ccuurrrreenntt ‘‘RRXX ccuurrrreenntt’’ iiss tthhee VVCCOO ccuurrrreenntt ttoo bbee WWrriittee PPLLLL..RREEFFDDIIVV == RRXX rreeffeerreennccee ddiivviiddeerr uusseedd iinn RRXX mmooddee.. WWrriittee TTEESSTT66==00xx11BB TTEESSTT66 == 00xx33BB iiff TTXX mmooddee DDuuaall ccaalliibbrraattiioonn iiss ppeerrffoorrmmeedd.. WWrriittee CCAALL..CCAALL__SSTTAARRTT==11 RReessuulltt iiss ssttoorreedd iinn TTEESSTT00 aanndd TTEESSTT22,, ffoorr bbootthh ffrreeqquueennccyy AA aanndd BB rreeggiisstteerrss WWaaiitt ffoorr mmaaxxiimmuumm 2266mmss,, oorr CCaalliibbrraattiioonn ttiimmee ddeeppeennddssoonn tthhee rreeffeerreennccee RReeaadd CCAALL aanndd wwaaiitt uunnttiill ffrreeqquueennccyy,, sseeee tteexxtt.. CCAALL..CCAALL__CCOOMMPPLLEETTEE==11 WWrriittee CCAALL:: CCAALL__SSTTAARRTT==00 EEnndd ooff ccaalliibbrraattiioonn Figure 35. Dual calibration algorithm for RX mode SWRS047A Page 117 of 146

CC1010 17.17 VCO, LNA and buffer current control The VCO current is programmable and The bias current for the LNA, and the LO should be set according to operating and PA buffers are also programmable frequency, RX/TX mode and output power. through FREND.LNA_CURRENT, The receiver sensitivity will also be FREND.BUF_CURRENT, affected by the current settings. CURRENT.LO_DRIVE and Recommended settings for the CURRENT.PA_DRIVE. CURRENT.VCO_CURRENT bits are shown in the CURRENT register table following below. CURRENT (0xE1) - RF Current Control Register Bit Name R/W Reset value Description 7:4 VCO_CURRENT R/W 1100 Control of current in VCO core for TX and RX (3:0) 0000 : 150µA 0001 : 250µA 0010 : 350µA 0011 : 450µA 0100 : 950µA, use for RX, f< 500 MHz 0101 : 1050µA 0110 : 1150µA, use for RX f>500 MHz 0111 : 1250µA 1000 : 1450µA, use for TX f < 500 MHz 1001 : 1550µA 1010 : 1650µA 1011 : 1750µA 1100 : 2250µA 1101 : 2350µA 1110 : 2450µA 1111 : 2550µA, use for TX, f>500 MHz 3:2 LO_DRIVE R/W 10 Control of current in VCO buffer for LO drive (1:0) 00 : 0.5mA, use for TX 01 : 1.0mA, use for RX when f<500 MHz 10 : 1.5mA 11 : 2.0mA, use for RX, f>500 MHz 1:0 PA_DRIVE R/W 10 Control of current in VCO buffer for PA (1:0) 00 : 1mA, use for RX 01 : 2mA, use for TX, f<500 MHz 10 : 3mA 11 : 4mA, use for TX, f>500 MHz SWRS047A Page 118 of 146

CC1010 FREND (0xEE) - Front End Control Register Bit Name R/W Reset value Description 7:6 - R/W 0 Reserved, should always be written 0 5 BUF_CURRENT R/W 0 Control of current in the LNA_FOLLOWER 0 : 520uA, use for f<500 MHz 1 : 690uA, use for f>500 MHz 4:3 LNA_CURRENT(1:0) R/W 00 Control of current in LNA 00 : 0.8mA 01 : 1.4mA, use for f<500 MHz 10 : 1.8mA, use for f>500 MHz 11 : 2.2mA 2 IF_EXTERNAL R/W 0 Controls where the output from the mixer goes: 0: To internal IF filter and demodulator 1: To the AD2(RSSI/IF) pin for external filtering and demodulation 1 RSSI R/W 0 0: RSSI output disconnected from AD2(RSSI/IF)pin 1: RSSI output connected to AD2(RSSI/IF)pin 0 - R/W 0 Reserved, should always be written 0 SWRS047A Page 119 of 146

CC1010 17.18 Input / Output Matching A few passive external components The register MATCH should initially be set combined with the internal T/R switch as shown in the register description below. circuitry ensures match in both RX and TX The MATCH register controls a capacitor mode. The matching network is shown in array located at the RF_OUT pin. The Figure 36. Component values for various register can be used to fine-tune the frequencies are given in Table 28. impedance match for a particular layout Component values for other frequencies and component selection. The tuning can can be found using the SmartRF® Studio be accomplished by stepping the register software. values until optimum sensitivity and output power is reached. C41 RF_IN TO ANTENNA RF_OUT CC1010 C52 C51 L51 L42 AVDD=3V Figure 36. Input/output matching network MATCH (0xDC) - Match Capacitor Array Control Register Bit Name R/W Reset value Description 7:3 RX_MATCH R/W 0000 Selects matching capacitor array value for RX, step size is (3:0) 0.4 pF 0000: Use for RF frequency > 500 MHz 1100: Use for RF frequency < 500 MHz 3:0 TX_MATCH R/W 0000 Selects matching capacitor array value for TX, step size is (3:0) 0.4 pF. Recommended setting is 0000 SWRS047A Page 120 of 146

CC1010 Figure 37. Typical LNA input impedance, 300 – 1000 MHz SWRS047A Page 121 of 146

CC1010 Figure 38. Typical inactive PA pin impedance, 300 – 1000 MHz SWRS047A Page 122 of 146

CC1010 17.19 Output Power Programming The RF output power is programmable the entire CC1010, with both the RF and controlled by the PA_POW register. transceiver and MCU active. Table 37 shows the closest programmable In power down mode the PA_POW should value for output powers in steps of 1 dB. be set to 0x00 for minimum leakage The typical current consumption is also current. shown for a 14.7456 MHz main oscillator frequency. The current consumption is for Output power RF frequency 433 MHz RF frequency 868 MHz [dBm] PA_POW Current consumption, PA_POW Current consumption, typ. [mA] typ. [mA] -20 0x02 21.7 0x02 24.2 -19 0x02 21.7 0x02 24.2 -18 0x02 21.7 0x03 24.4 -17 0x02 21.7 0x03 24.4 -16 0x02 21.7 0x04 24.6 -15 0x02 21.7 0x04 24.6 -14 0x03 21.9 0x05 24.8 -13 0x03 21.9 0x06 25 -12 0x04 22.2 0x07 25.2 -11 0x04 22.2 0x08 25.4 -10 0x05 22.4 0x09 25.7 -9 0x05 22.4 0x0A 25.9 -8 0x06 22.7 0x0B 26 -7 0x07 22.9 0x0C 26.2 -6 0x08 23.2 0x0E 26.6 -5 0x09 23.5 0x0F 26.8 -4 0x0A 23.8 0x50 29.3 -3 0x0B 24.0 0x60 29.9 -2 0x0D 24.5 0x70 30.5 -1 0x0E 24.9 0x80 31.0 0 0x40 26.0 0xA0 32.1 1 0x50 27.0 0xC0 33.1 2 0x60 28.0 0xE0 34.2 3 0x60 28.0 0xF0 34.7 4 0x70 28.9 0xFF 38.5 5 0x80 30.0 6 0x90 31.0 7 0xB0 33.2 8 0xC0 34.3 9 0xE0 36.7 10 0xFF 42.8 Note: The current consumption is measured at for a 14.7456 MHz main oscillator frequency, and is for the entire CC1010 (both MCU and RF transceiver). If the crystal frequency is changed, the current consumption for the MCU will change, the relationship between crystal frequency and MCU current consumption is shown in Figure 1. Table 37. Output power settings and typical current consumption SWRS047A Page 123 of 146

CC1010 50,0 40,0 A] m n [ 30,0 o pti m su 20,0 n o c nt urre 10,0 C m] / B 0,0 d er [ w po-10,0 ut p ut O-20,0 -30,0 1 2 3 4 5 6 7 8 9 A B C D E F 10 20 30 40 50 60 70 80 90 A0 B0 C0 D0 E0 F0 FF PA_POW (Hexadecimal) Output power Current consumption Figure 39. Typical output power and total current consumption, 433 MHz 40,0 30,0 A] m 20,0 n [ o mpti 10,0 u s n o nt c 0,0 e urr C-10,0 m] / B er [d-20,0 w o p ut -30,0 p ut O -40,0 -50,0 0 1 2 3 4 5 6 7 8 9 A B C D E F 10 20 30 40 50 60 70 80 90 A0 B0 C0 D0 E0 F0 FF PA_POW [Hexadecimal] Output power Current consumption Figure 40. Typical output power and total current consumption, 868 MHz SWRS047A Page 124 of 146

CC1010 PA_POW (0xE2) - PA Output Power Control Register Bit Name R/W Reset value Description 7:4 PA_HIGHPOWER R/W 0x00 Control of output power in high power array. (3:0) Should be 0000 in PD mode. See Table 37 for details. 3:0 PA_LOWPOWER R/W 0x0F Control of output power in low power array. (3:0) Should be 0000 in PD mode. See Table 37 for details. SWRS047A Page 125 of 146

CC1010 17.20 RSSI Output CC1010 has a built-in RSSI (Received The RSSI measures the power referred to Signal Strength Indicator) giving an analog the RF_IN pin. The input power can be output signal at the AD2(RSSI/IF) pin. calculated using the following equations: RSSI is enabled when setting P = -48.8 V – 57.2 [dBm] at 433 MHz FREND.RSSI (see page 119). The output RSSI current of this pin is then inversely P = -46.9 VRSSI– 53.9 [dBm] at 868 MHz proportional to the input signal level. The The external network for RSSI operation is output should be terminated in a resistor to shown in convert the current output into a voltage. A capacitor is used to low-pass filter the Figure 41. R281 = 27 kΩ, C281 = 1nF. signal. A typical plot of RSSI voltage as function The RSSI voltage range is from 0 – 1.2 V of input power is shown in Figure 42. when using a 27 kΩ terminating resistor, When using the on-chip A/D converter, set giving approximately 50 dB/V. This RSSI ADCON = 0x06 to initiate a single voltage can be measured by the on-chip conversion using VDD as reference. The A/D converter using the AD2 input. Note converted RSSI voltage can then be read that a higher voltage means a lower input from the ADDATH and ADDATL registers. signal. CC1010 1,3 AD2 (RSSI/IF) 1,2 1,1 433Mhz 1 868Mhz 0,9 e 0,8 C281 R281 oltag 00,,67 V 0,5 0,4 0,3 0,2 0,1 0 -105 -100 -95 -90 -85 -80 -75 -70 -65 -60 -55 -50 dBm Figure 41. RSSI circuit Figure 42. Typical RSSI voltage vs. input power SWRS047A Page 126 of 146

CC1010 17.21 IF output CC1010 has a built-in 10.7 MHz IF output external IF filter is shown in Figure 43. buffer. This buffer can be used in R281 = 470 Ω, C281 = 3.3nF. This applications requiring image frequency external network provides a 330 Ω source rejection. The system is then built with impedance for the 10.7 MHz ceramic filter. CC1010, a 10.7 MHz ceramic filter, SAW front-end filter and an external 10.7 MHz demodulator. The matching network for an AD2 (RSSI/IF) To 10.7MHz filter CC1010 and demodulator C281 R281 Figure 43. IF Output SWRS047A Page 127 of 146

CC1010 17.22 Optional LC Filter An optional low-pass LC filter may be The design equations for a 3dB equal added between the antenna and the ripple filter are: matching network in certain applications. The filter will reduce the emission of ⎛ 1 ⎞ ω ≈ 2π⋅ f ⋅⎜ ⎟ harmonics and increase the receiver C RF ⎝1−0.1333⎠ selectivity. 35.6 0.067 The filter topology is shown in Figure 44. L = , C = Component values are given in Table 38. ω ω C C The filter is designed for 50 Ω terminations. The component values may where ω is the cut-off frequency and f is c RF have to be tuned to compensate for layout the transmitted RF frequency. parasitics. LL7711 CC7711 CC7722 Figure 44. LC Filter Item 315 MHz 434 MHz 869 MHz 915 MHz C71 30 pF 20 pF 10 pF 10 pF C72 30 pF 20 pF 10 pF 10 pF L71 15 nH 12 nH 5.6 nH 4.7 nH Table 38. LC Filter component values SWRS047A Page 128 of 146

CC1010 18. Reserved registers and test registers The CC1010 contains a few registers to use an external PLL loop filter. intended for test purposes only. Normally However, this is not recommended in a these registers should not be written to. normal application. The FSHAPEn, FSDELAY and FSCTRL The PRESCALER register controls the registers are reserved for future use. A prescaler current, and should always be separate reset signal for the PLL is set to 0x00 (which is the reset state). available in FSCTRL.FS_RESET_N. This The TESTMUX register is not needed for will reset the frequency divider part of the normal operation of CC1010, but is included PLL. The reset is active when a zero is here for completeness. TESTMUX should written, and a one must be written for the always be set to 0x00. reset to be released. FSCTRL.EXT_FILTER can be set in order TESTMUX P0.2 P0.1 P0.0 0000 Normal operation Normal operation Normal operation 0001 CLK_REF CLK_PHASE_DET_OUT MODEM_TX_OUT 0010 LOCK_DET_CONTINUOUS LOCK_DET_INSTANT ANALOG_WINDOW_SYNC 0011 SER_PAR_IRQ TIMER2_IRQ TIMER3_IRQ 0100 RTC_IRQ ADC_IRQ DES_IRQ 0101 ANALOG_ALARM_H ANALOG_ALARM_L CAL_DIG_COMPLETE 0110 MODEM_BIT_CLK MODEM_RX_DATA ANALOG_IF_OUT 0111 MODEM_BIT_CLK MODEM_TX_DATA MODEM_TX_OUT 1000 ADC_SAR_ADCCLK_EN ANALOG_COMP ADC_SAR_EOC 1001 CLK_RTC RTC_IRQ CLK_UC 1010 DES_DEBUG_0 1011 DES_DEBUG_1 1100 DES_DEBUG_2 1101 DES_DEBUG_3 1110 FLASH_WRITE_IRQ 1111 CAL_DIG_COMPLETE Table 39. TESTMUX modes FSHAPEn (0xF1 - 0xF7), n∈1..7 - Frequency Shaping Register n Bit Name R/W Reset value Description 7:5 - R0 0x00 Reserved, read as 0 4:0 FSHAPEn (4:0) R/W 0xXX Reserved for future use. FSDELAY (0xE9) - Frequency Shaping Delay Control Register Bit Name R/W Reset value Description 7:0 FSDELAY (7:0) R/W 0x2F Reserved for future use. SWRS047A Page 129 of 146

CC1010 FSCTRL (0xEC) - Frequency Synthesiser Control Register Bit Name R/W Reset value Description 7:5 - R0 0x00 Reserved, read as 0 4 EXT_FILTER R/W 0 Setting for external loop filter (not recommended) 0 : Internal loop filter (recommended) 1 : External loop filter 3 DITHER1 R/W 0 Reserved for future use. Write as 0. 2 DITHER0 R/W 0 Reserved for future use. Write as 0. 1 SHAPE R/W 0 Reserved for future use. Write as 0. 0 FS_RESET_N R/W 1 Separate reset of frequency synthesiser 0 : Frequency synthesiser is reset 1 : Frequency synthesiser reset is released PRESCALER (0xE6) - Prescaler Control Register Bit Name R/W Reset value Description 7 PRE_SWING R/W 00 Prescaler swing. Fractions for PRE_CURRENT[1:0] = (1:0) 00 00 : 1 * Nominal Swing 01 : 2/3 * Nominal Swing 10 : 7/3 * Nominal Swing 11 : 5/3 * Nominal Swing 5 PRE_CURRENT R/W 00 Prescaler current scaling (1:0) 00 : 1 * Nominal Current 01 : 2/3 * Nominal Current 10 : 1/2 * Nominal Current 11 : 2/5 * Nominal Current 3 IF_INPUT R/W 0 0 : Nominal setting 1 : AD2(RSSI/IF) pin is input to IF-strips 2 IF_FRONT R/W 0 0 : Nominal setting 1 : Output of IF_Front_amp is switched to the AD2(RSSI/IF) pin 1 - R/W 0 Reserved for future use, always write 0 0 - R/W 0 Reserved for future use, always write 0 TESTMUX (0xEF) - Test Multiplexer Control Register (for prototype testing) Bit Name R/W Reset value Description 7:4 - R0 0x00 Reserved, read as 0 3:0 TESTMUX R/W 0x00 Select internal test signals to be output to P0(2:0). (3:0) This function is enabled when TESTMUX ≠ 0000. The port directions are still set by P0DIR. SWRS047A Page 130 of 146

CC1010 19. System Considerations and Guidelines 19.1 SRD regulations 19.4 Narrow-band systems International regulations and national laws CC400, CC900 and CC1020 are regulate the use of radio receivers and recommended for best performance in transmitters. SRDs (Short Range Devices) narrow-band applications. The phase for licence free operation are allowed to noise of these chips is superior, and for operate in the 433 and 868-870 MHz systems with 25 kHz channel spacing or bands in most European countries. In the less with strict requirements to ACP United States such devices operate in the (Adjacent Channel Power), low phase 260–470 and 902-928 MHz bands. CC1010 noise is important. is designed to meet the requirements for The selectivity of CC1010 can be improved operation in all these bands. A summary of by using an external ceramic filter and the most important aspects of these demodulator at 10.7 MHz. Such ceramic regulations can be found in Application filters are typically 180 or 280 kHz wide. Note AN001 SRD regulations for licence free transceiver operation, available on A unique feature in CC1010 is the very fine Chipcon’s web site. frequency resolution of < 250 Hz. This can be used to do the temperature compensation of the crystal if the 19.2 Low cost systems temperature drift curve is known and a In systems where low cost is of great temperature sensor is included in the importance the CC1010 is the ideal choice. system. Even initial adjustment can be Very few external components keep the done using the frequency programmability. total cost at a minimum. The oscillator This eliminates the need for an expensive crystal can then be a low cost crystal with TCXO and trimming in some applications. 50/25 ppm frequency tolerance at 433/868 In less demanding applications a crystal MHz respectively. with low temperature drift and low ageing could be used without further compensation. A trimmer capacitor in the 19.3 Battery operated systems crystal oscillator circuit (in parallel with In low power applications the RF C171) could be used to set the initial Transceiver power down mode should be frequency accurately. The fine frequency used when no communication takes place. step programming cannot be used in RX Using receiver polling, that is, listening for mode if optimised frequency settings are transmissions for a few milliseconds at required (see page 111). regular intervals, will also save a lot of battery power. The RSSI can be used as a 19.5 High reliability systems first indication that a transmission is received. See page 89 for information on Using a SAW filter as a preselector how effective power management can be between the antenna and the RF input will implemented. Utilizing the Idle mode and improve the communication reliability in Power down modes and clock modes of harsh environments by reducing the the MCU will also reduce the power probability of blocking. The receiver consumption significantly. See page 33 for sensitivity and the output power will be details. Also of interest is Application Note reduced due to the filter insertion loss. By AN017 Low Power Systems Using the inserting the filter in the RX path only, CC1010, available on Chipcon’s web site. together with an external RX/TX switch, only the receiver sensitivity is reduced, and output power is unaffected. Any general-purpose I/O pins can be SWRS047A Page 131 of 146

CC1010 configured to control an external LNA, include simple examples, which show off RX/TX switch or power amplifier. the various features of the CC1010, as well as examples showing RF communication and more sophisticated application-related 19.6 Frequency hopping spread examples. Source code as well as pre- spectrum systems compiled HEX files are available for all Due to the very fast frequency shift examples. A ZIP file including all examples properties of the PLL, the CC1010 is very and documentation is available from the suitable for frequency hopping systems. Chipcon web pages. Make sure to check Hop rates of 10-1000 hops/s are usually the web pages regularly, as improvements used depending on the bit rate and the to existing examples as well as all-new amount of data to be sent during each examples are added as they are available. transmission. The two frequency registers (FREQ_A and FREQ_B) are designed such 19.8 Development tools that the ‘next’ frequency can be programmed while the ‘present’ frequency Chipcon supplies a full-featured is used. The switching between the two development kit for the CC1010 that frequencies is done through the includes everything you need to start and RFMAIN.F_REG control bit. Frequency finish your design. The development kit is hopping improves the reliability and documented in the CC1010DK User increases the security of a wireless link. Manual. The US ISM band at 902 – 928 MHz is The development kit includes an very suitable for frequency hopping evaluation version of the Keil C compiler; protocols. The FCC regulations allow the this is limited to a code size of 2 kBytes. If use of transmitted output powers up to 1W the user wishes to compile larger if frequency hopping is used and certain programs, a full version of the compiler requirements are met. Please see must be purchased from Keil. The Keil application note AN001 SRD regulations development environment supports in- for licence free transceiver operation for circuit debugging using the second serial more information about this and other port. radio regulations issues. The CC1010 is supported by several compiler vendors. More information about 19.7 Software compiler support can be found on Chipcon provides world-class software Chipcon’s web pages. support for the CC1010. The HAL (Hardware Abstraction Library) 19.9 PA “splattering” library provides easy-to-use functions and In systems where the PA is turned on and macros to access the CC1010 hardware off rapidly, for example in a system that without having to access SFRs directly. It switches rapidly between RX and TX, so- also provides functions simple RF called “splattering” may occur. This will communications routines. result in a very wide RF spectrum that may The CUL (Chipcon Utility Library) library intrude into neighbouring channels or contains more sophisticated RF extend out of band. To minimise this communication routines with support for effect, Chipcon recommends that the CRC checking, automatic PA_POW register be used to turn the PA acknowledgment and retransmission. gradually on and off. The optimal pattern is to follow the sequence 0x00, 0x01, 0x1E, Both libraries are supplied with full source 0x8F, 0xEF when going from RX to TX code, and are documented in the CC1010 and consequently using 0xEF, 0x8F, IDE User Manual. 0x1E, 0x01, 0x00 when going from TX to Chipcon also supplies a wide range of RX. PA_POW should be left set to 0x00 in examples for the CC1010. These examples RX mode and 0xEF in TX mode. SWRS047A Page 132 of 146

CC1010 19.10 PCB Layout Recommendations Chipcon provide reference layouts that series to prevent noise from coupling from should be followed in order to achieve the one supply pin to another. Please see the best performance. The reference designs reference layouts for more information. For can be downloaded on the Chipcon 433 and 315 MHz operation these beads website. are not required, and can be replaced with 0-ohm resistors or PCB traces. A four layer PCB is highly recommended. The top layer should be used for signal The external components should be as routing, and the open areas should be small as possible and surface mount filled with metallisation connected to devices are required. The VCO inductor ground using many vias. The second layer must be placed as close as possible to the of the PCB should be the “ground-plane”. chip and symmetrical with respect to the Layer three is used for power supply and input pins. It is important to keep the layer four for general routing and coupling between the VCO inductor and decoupling. A few components are also the matching network low in order to placed at the reverse side (VCO inductor reduce LO leakage. Due to this the VCO and power filtering). inductor is placed at the reverse side of the PCB. The ground pins should be connected to ground as close as possible to the A development kit with a fully assembled package pin using individual vias for each PCB is available, and can be used as a pin. The de-coupling capacitors should guideline for layout. also be placed as close as possible to the Full documentation and Gerber PCB supply pins and connected to the ground layout files are available on Chipcon’s web plane by separate vias. For 868 and 915 site. MHz operation, some of the AVDD supply pins should be fitted with ferrite beads in 19.11 Antenna Considerations CC1010 can be used together with various Loop antennas are easy to integrate into types of antennas. The most common the PCB, but are less effective due to antennas for short-range devices are difficult impedance matching because of monopole, helical and loop antennas. their very low radiation resistance if they are made small. Monopole antennas are resonant antennas with a length corresponding to For low power applications the λ/4- one quarter of the electrical wavelength monopole antenna is recommended giving (λ/4). They are very easy to design and the best range and because of its can be implemented simply as a “piece of simplicity. wire” or even integrated into the PCB. The length of the λ/4-monopole antenna is Non-resonant monopole antennas shorter given by: than λ/4 can also be used, but at the L = 7125 / f expense of range. In size and cost critical applications such an antenna may very where f is in MHz, giving the length in cm. well be integrated into the PCB. An antenna for 869 MHz should be 8.2 cm, and 16.4 cm for 434 MHz. Helical antennas can be thought of as a combination of a monopole and a loop The antenna should be connected as antenna. They are a good compromise in close as possible to the IC. If the antenna size critical applications. But helical is located away from the input pin the antennas tend to be more difficult to antenna should be matched to the feeding optimise than the simple monopole. transmission line (50 Ω). SWRS047A Page 133 of 146

CC1010 For a more thorough primer on antennas, SRD Antennas available on Chipcon’s please refer to Application Note AN003 web site. 20. Package Description (TQFP-64) CC1010 is packaged in a TQFP-64 package. The package is shown in Figure 45. Please note that the drawing in Figure 45 is not to scale. Figure 45. TQFP-64 package 21. Soldering Information The recommended soldering profiles for both leaded and Pb-free packages are according to IPC/JEDEC J-STD-020. 22. Tray Specification SWRS047A Page 134 of 146

CC1010 SWRS047A Page 135 of 146

CC1010 SWRS047A Page 136 of 146

CC1010 23. List of Abbreviations • ADC - Analog to Digital Converter • OFB - Output Feedback Mode • AMR – Automatic Meter Reading • PCB - Printed Circuit Board • CFB - Cipher Feedback Mode • PLL - Phase Locked Loop • CMOS – Complementary Metal Oxide • POR - Power On Reset Semiconductor • PWM - Pulse Width Modulation • CPU – Central Processor Unit • RAM – Random Access Memory • DES - Data Encryption Standard • RF - Radio Frequency • DMA - Direct Memory Access • RSSI - Received Signal Strength • FCC – Federal Communication Indicator Committee • RTC – Real-Time Clock • FSK - Frequency Shift Keying • RX - Receive • IDE – Integrated Development • SFR - Special Function Register Environment • SPI - Serial Peripheral Interface • IF - Intermediate Frequency • SRAM – Static RAM • ISM – Industrial Scientific Medical • SRD - Short Range Device • ISR - Interrupt Service Routine • TQFP - Thin Quad Flat Pack • LNA - Low Noise Amplifier • TBD – To Be Defined • LO - Local Oscillator • TX - Transmit • LPF - Loop Filter • UART - Universal Asynchronous • LSB - Least Significant Bit (or Byte) Receiver/Transmitter • MOQ – Minimum Order Quantity • UHF – Ultra High Frequency • MSB - Most Significant Bit (or Byte) • VCO - Voltage Controlled Oscillator • NRZ - Non Return to Zero • XOSC - Crystal Oscillator SWRS047A Page 137 of 146

CC1010 24. SFR Summary A summary of all SFRs with address, register names, bit names and reset values are shown in Table 40 below. Addr Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Reset Page 0x80 P0 P0.7 P0.6 P0.5 P0.4 P0.3 P0.2 P0.1 P0.0 00001111 49 0x81 SP SP.7 SP.6 SP.5 SP.4 SP.3 SP.2 SP.1 SP.0 00000111 24 0x82 DPL0 DPL0.7 DPL0.6 DPL0.5 DPL0.4 DPL0.3 DPL0.2 DPL0.1 DPL0.0 00000000 21 0x83 DPH0 DPH0.7 DPH0.6 DPH0.5 DPH0.4 DPH0.3 DPH0.2 DPH0.1 DPH0.0 00000000 21 0x84 DPL1 DPL1.7 DPL1.6 DPL1.5 DPL1.4 DPL1.3 DPL1.2 DPL1.1 DPL1.0 00000000 21 0x85 DPH1 DPH1.7 DPH1.6 DPH1.5 DPH1.4 DPH1.3 DPH1.2 DPH1.1 DPH1.0 00000000 21 0x86 DPS - - - - - - - SEL 00000000 22 0x87 PCON SMOD0 - - - GF1 GF0 STOP IDLE 00110000 36 0x88 TCON TF1 TR1 TF0 TR0 IE1 IT1 IE0 IT0 00000000 54 0x89 TMOD GATE C/T M1 M0 GATE C/T M1 M0 00000000 53 0x8A TL0 TL0.7 TL0.6 TL0.5 TL0.4 TL0.3 TL0.2 TL0.1 TL0.0 00000000 52 0x8B TL1 TL1.7 TL1.6 TL1.5 TL1.4 TL1.3 TL1.2 TL1.1 TL1.0 00000000 52 0x8C TH0 TH0.7 TH0.6 TH0.5 TH0.4 TH0.3 TH0.2 TH0.1 TH0.0 00000000 52 0x8D TH1 TH1.7 TH1.6 TH1.5 TH1.4 TH1.3 TH1.2 TH1.1 TH1.0 00000000 52 0x8E CKCON - - T2M T1M T0M MD2 MD1 MD0 00000001 55 0x8F - - - - - - - - - 00000000 - 0x90 P1 P1.7 P1.6 P1.5 P1.4 P1.3 P1.2 P1.1 P1.0 11111111 49 0x91 EXIF TF3 ADIF TF2 RFIF - - - - 00001000 30 0x92 MPAGE MPAGE7 MPAGE6 MPAGE5 MPAGE4 MPAGE3 MPAGE2 MPAGE1 MPAGE0 00000000 22 0x93 ADCON AD_PD - ADCM1 ADCM0 ADCREF ADCRUN ADADR1 ADADR0 10000000 81 0x94 ADDATL ADDAT7 ADDAT6 ADDAT5 ADDAT4 ADDAT3 ADDAT2 ADDAT1 ADDAT0 00000000 81 0x95 ADDATH - - - - - - ADDAT9 ADDAT8 00000000 81 0x96 ADCON2 ADCIE ADCIF ADCDIV5 ADCDIV4 ADCDIV3 ADCDIV2 ADCDIV1 ADCDIV0 00000000 82 0x97 ADTRH ADTRH7 ADTRH6 ADTRH5 ADTRH4 ADTRH3 ADTRH2 ADTRH1 ADTRH0 00000000 82 0x98 SCON0 SM0_0 SM1_0 SM2_0 REN_0 TB8_0 RB8_0 TI_0 RI_0 00000000 67 0x99 SBUF0 SBUF0.7 SBUF0.6 SBUF0.5 SBUF0.4 SBUF0.3 SBUF0.2 SBUF0.1 SBUF0.0 00000000 66 0x9A . - - . . . . . . 00000000 - 0x9B - - - - - - - - - 00000000 - 0x9C - - - - - - - - - 00000000 - 0x9D - - - - - - - - - 00000000 - 0x9E - - - - - - - - - 00000000 - 0x9F CHVER CHIP_TYPE5 CHIP_TYPE4 CHIP_TYPE3 CHIP_TYPE2 CHIP_TYPE1 CHIP_TYPE0 CHIP_REV1 CHIP_REV0 00000001 45 SWRS047A Page 138 of 146

CC1010 Addr Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Reset Page 0xA0 P2 P2.7 P2.6 P2.5 P2.4 P2.3 P2.2 P2.1 P2.0 11111111 50 0xA1 SPCR - - SPE DORD CPOL CPHA SPR1 SPR0 00000000 72 0xA2 SPDR SPDR7 SPDR6 SPDR5 SPDR4 SPDR3 SPDR2 SPDR1 SPDR0 00000000 72 0xA3 SPSR - - - - - - SPA WCOL 00000000 72 0xA4 P0DIR - - - - P0DIR3 P0DIR2 P0DIR1 P0DIR0 00001111 50 0xA5 P1DIR P1DIR7 P1DIR6 P1DIR5 P1DIR4 P1DIR3 P1DIR2 P1DIR1 P1DIR0 11111111 50 0xA6 P2DIR P2DIR7 P2DIR6 P2DIR5 P2DIR4 P2DIR3 P2DIR2 P2DIR1 P2DIR0 11111111 51 0xA7 P3DIR - - P3DIR5 P3DIR4 P3DIR3 P3DIR2 P3DIR1 P3DIR0 00111111 51 0xA8 IE EA - - ES0 ET1 EX1 ET0 EX0 00000000 29 0xA9 TCON2 - - - - TR3 M3 TR2 M2 00000000 59 0xAA T2PRE T2PRE7 T2PRE6 T2PRE5 T2PRE4 T2PRE3 T2PRE2 T2PRE1 T2PRE0 00000000 60 0xAB T3PRE T3PRE7 T3PRE6 T3PRE5 T3PRE4 T3PRE3 T3PRE2 T3PRE1 T3PRE0 00000000 60 0xAC T2 T2.7 T2.6 T2.5 T2.4 T2.3 T2.2 T2.1 T2.0 00000000 60 0xAD T3 T3.7 T3.6 T3.5 T3.4 T3.3 T3.2 T3.1 T3.0 00000000 60 0xAE FLADR FLADR7 FLADR6 FLADR5 FLADR4 FLADR3 FLADR2 FLADR1 FLADR0 00000000 43 0xAF FLCON - FLASH_LP1 FLASH_LP0 WRFLASH RMADR3 RMADR2 RMADR1 RMADR0 00000000 43 0xB0 P3 - - P3.5 P3.4 P3.3 P3.2 P3.1 P3.0 00111111 50 0xB1 - - - - - - - - - 00000000 - 0xB2 - - - - - - - - - 00000000 - 0xB3 - - - - - - - - - 00000000 - 0xB4 CRPINI0 CRPINI0.7 CRPINI0.6 CRPINI0.5 CRPINI0.4 CRPINI0.3 CRPINI0.2 CRPINI0.1 CRPINI0.0 00000000 78 0xB5 CRPINI1 CRPINI1.7 CRPINI1.6 CRPINI1.5 CRPINI1.4 CRPINI1.3 CRPINI1.2 CRPINI1.1 CRPINI1.0 00000000 78 0xB6 CRPINI2 CRPINI2.7 CRPINI2.6 CRPINI2.5 CRPINI2.4 CRPINI2.3 CRPINI2.2 CRPINI2.1 CRPINI2.0 00000000 78 0xB7 CRPINI3 CRPINI3.7 CRPINI3.6 CRPINI3.5 CRPINI3.4 CRPINI3.3 CRPINI3.2 CRPINI3.1 CRPINI3.0 00000000 78 0xB8 IP - - - PS0 PT1 PX1 PT0 PX0 10000000 31 0xB9 RDATA RDATA7 RDATA6 RDATA5 RDATA4 RDATA3 RDATA2 RDATA1 RDATA0 00000000 45 0xBA RADRL RADR15 RADR14 RADR13 RADR12 RADR11 RADR10 RADR9 RADR8 00000000 45 0xBB RADRH RADR7 RADR6 RADR5 RADR4 RADR3 RADR2 RADR1 RADR0 00000000 45 0xBC CRPINI4 CRPINI4.7 CRPINI4.6 CRPINI4.5 CRPINI4.4 CRPINI4.3 CRPINI4.2 CRPINI4.1 CRPINI4.0 00000000 78 0xBD CRPINI5 CRPINI5.7 CRPINI5.6 CRPINI5.5 CRPINI5.4 CRPINI5.3 CRPINI5.2 CRPINI5.1 CRPINI5.0 00000000 78 0xBE CRPINI6 CRPINI6.7 CRPINI6.6 CRPINI6.5 CRPINI6.4 CRPINI6.3 CRPINI6.2 CRPINI6.1 CRPINI6.0 00000000 78 0xBF CRPINI7 CRPINI7.7 CRPINI7.6 CRPINI7.5 CRPINI7.4 CRPINI7.3 CRPINI7.2 CRPINI7.1 CRPINI7.0 00000000 78 0xC0 SCON1 SM0_1 SM1_1 SM2_1 REN_1 TB8_1 RB8_1 TI_1 RI_1 00000000 68 0xC1 SBUF1 SBUF1.7 SBUF1.6 SBUF1.5 SBUF1.4 SBUF1.3 SBUF1.2 SBUF1.1 SBUF1.0 00000000 67 0xC2 RFCON - - - MVIOL MLIMIT2 MLIMIT1 MLIMIT0 BYTEMODE 00000110 101 0xC3 CRPCON - CRPIE CRPIF LOADKEYS CRPMD ENCDEC TRIDES CRPEN 00000000 76 0xC4 CRPKEY CRPKEY7 CRPKEY6 CRPKEY5 CRPKEY4 CRPKEY3 CRPKEY2 CRPKEY1 CRPKEY0 00000000 77 SWRS047A Page 139 of 146

CC1010 Addr Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Reset Page 0xC5 CRPDAT CRPDAT7 CRPDAT6 CRPDAT5 CRPDAT4 CRPDAT3 CRPDAT2 CRPDAT1 CRPDAT0 00000000 77 0xC6 CRPCNT CRPCNT7 CRPCNT6 CRPCNT5 CRPCNT4 CRPCNT3 CRPCNT2 CRPCNT1 CRPCNT0 00000000 77 0xC7 RANCON - - - - - - RANEN RANBIT 00000000 78 0xC8 RFMAIN RXTX F_REG RX_PD TX_PD FS_PD CORE_PD BIAS_PD - 00111000 89 0xC9 RFBUF RFBUF7 RFBUF6 RFBUF5 RFBUF4 RFBUF3 RFBUF2 RFBUF1 RFBUF0 00000000 95 0xCA FREQ_0A FREQ_A7 FREQ_A6 FREQ_A5 FREQ_A4 FREQ_A3 FREQ_A2 FREQ_A1 FREQ_A0 11001011 108 0xCB FREQ_1A FREQ_A15 FREQ_A14 FREQ_A13 FREQ_A12 FREQ_A11 FREQ_A10 FREQ_A9 FREQ_A8 10100000 108 0xCC FREQ_2A FREQ_A23 FREQ_A22 FREQ_A21 FREQ_A20 FREQ_A19 FREQ_A18 FREQ_A17 FREQ_A16 01110101 108 0xCD FREQ_0B FREQ_B7 FREQ_B6 FREQ_B5 FREQ_B4 FREQ_B3 FREQ_B2 FREQ_B1 FREQ_B0 01001110 109 0xCE FREQ_1B FREQ_B15 FREQ_B14 FREQ_B13 FREQ_B12 FREQ_B11 FREQ_B10 FREQ_B9 FREQ_B8 10100101 108 0xCF FREQ_2B FREQ_B23 FREQ_B22 FREQ_B21 FREQ_B20 FREQ_B19 FREQ_B18 FREQ_B17 FREQ_B16 01110101 108 0xD0 PSW CY AC F0 RS1 RS0 OV F1 P 00000000 23 0xD1 X32CON - - - - - X32_BYPASS X32_PD CMODE 00000010 36 0xD2 WDT - - - WDTSE WDTEN WDTCLR WDTPRE1 WDTPRE0 00001011 63 0xD3 PDET PEN PLEN6 PLEN5 PLEN4 PLEN3 PLEN2 PLEN1 PLEN0 00000000 102 0xD4 BSYNC BSYNC7 BSYNC6 BSYNC5 BSYNC4 BSYNC3 BSYNC2 BSYNC1 BSYNC0 00000000 102 0xD5 - - - - - - - - - 00000000 - 0xD6 - - - - - - - - - 00000000 - 0xD7 - - - - - - - - - 00000000 - 0xD8 EICON - - FDIE FDIF RTCIF - - - 01000000 30 0xD9 MODEM2 - PLO6 PLO5 PLO4 PLO3 PLO2 PLO1 PLO0 00010110 100 0xDA MODEM1 - LOCK_AVG_IN LOCK_AVG_MO LOCK_AVG_STA SETTLING1 SETTLING0 PEAKDETECT MODEM_RESET 00101111 98 0xDB MODEM0 BAUDRATE2 BAUDRATE1 BAUDRATE0 DATA_FORMAT1 DATA_FORMAT0 XOSC_FREQ2 XOSC_FREQ1 XOSC_FREQ0 01110001 92 0xDC MATCH RX_MATCH3 RX_MATCH2 RX_MATCH1 RX_MATCH0 TX_MATCH3 TX_MATCH2 TX_MATCH1 TX_MATCH0 00000000 120 0xDD FLTIM - - FLWCTIME5 FLWCTIME4 FLWCTIME3 FLWCTIME2 FLWCTIME1 FLWCTIME0 00001010 43 0xDE - - - - - - - - - 00000000 - 0xDF - - - - - - - - - 00000000 - 0xE0 ACC ACC7 ACC6 ACC5 ACC4 ACC3 ACC2 ACC1 ACC0 00000000 23 0xE1 CURRENT VCO_CURRENT3 VCO_CURRENT2 VCO_CURRENT1 VCO_CURRENT0 LO_DRIVE1 LO_DRIVE0 PA_DRIVE1 PA_DRIVE0 11001010 118 0xE2 PA_POW PA_HIGHPOWER PA_HIGHPOWER PA_HIGHPOWER PA_HIGHPOWER PA_LOWPOWER PA_LOWPOWER PA_LOWPOWER PA_LOWPOWER 00001111 123 0xE3 PLL REFDIV4 REFDIV3 REFDIV2 REFDIV1 REFDIV0 ALARM_DISABL ALARM_H ALARM_L 000100xx 109 0xE4 LOCK - - - - PLL_LOCK_ PLL_LOCK_ LOCK_INSTANT LOCK_ 000000xx 110 ACCURACY LENGTH CONTINUOUS 0xE5 CAL CAL_START CAL_DUAL CAL_WAIT CAL_CURRENT CAL_COMPLETE CAL_ITERATE2 CAL_ITERATE1 CAL_ITERATE0 00000101 114 SWRS047A Page 140 of 146

CC1010 Addr Name Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Reset Page 0xE6 PRESCALE PRE_SWING1 PRE_SWING0 PRE_CURRENT1 PRE_CURRENT0 IF_INPUT IF_FRONT PRESCALE.1 PRESCALE.0 00000000 129 0xE7 RESERVED RESERVED.7 RESERVED.6 RESERVED.5 RESERVED.4 RESERVED.3 RESERVED.2 RESERVED.1 RESERVED.0 00000000 45 0xE8 EIE - - - RTCIE ET3 ADIE ET2 RFIE 11100000 29 0xE9 FSDELAY FSDELAY7 FSDELAY6 FSDELAY5 FSDELAY4 FSDELAY3 FSDELAY2 FSDELAY1 FSDELAY0 00101111 129 0xEA FSEP0 FSEP7 FSEP6 FSEP5 FSEP4 FSEP3 FSEP2 FSEP1 FSEP0 01011001 109 0xEB FSEP1 - - - - - FSEP10 FSEP9 FSEP8 00000000 109 0xEC FSCTRL - - - EXT_FILTER DITHER1 DITHER0 SHAPE FS_RESET_N 00000001 130 0xED RTCON RTEN RT6 RT5 RT4 RT3 RT2 RT1 RT0 00000000 65 0xEE FREND - - LNA_BUF_CUR LNA_CURRENT1 LNA_CURRENT0 IF_EXTERNAL RSSI - 00000000 119 0xEF TESTMUX - - - - TESTSEL3 TESTSEL2 TESTSEL1 TESTSEL0 00000000 130 0xF0 B B.7 B.6 B.5 B.4 B.3 B.2 B.1 B.0 00000000 23 0xF1 FSHAPE7 FSHAPE7.7 FSHAPE7.6 FSHAPE7.5 FSHAPE7.4 FSHAPE7.3 FSHAPE7.2 FSHAPE7.1 FSHAPE7.0 00011100 129 0xF2 FSHAPE6 FSHAPE6.7 FSHAPE6.6 FSHAPE6.5 FSHAPE6.4 FSHAPE6.3 FSHAPE6.2 FSHAPE6.1 FSHAPE6.0 00010110 129 0xF3 FSHAPE5 FSHAPE5.7 FSHAPE5.6 FSHAPE5.5 FSHAPE5.4 FSHAPE5.3 FSHAPE5.2 FSHAPE5.1 FSHAPE5.0 00010000 129 0xF4 FSHAPE4 FSHAPE4.7 FSHAPE4.6 FSHAPE4.5 FSHAPE4.4 FSHAPE4.3 FSHAPE4.2 FSHAPE4.1 FSHAPE4.0 00001010 129 0xF5 FSHAPE3 FSHAPE3.7 FSHAPE3.6 FSHAPE3.5 FSHAPE3.4 FSHAPE3.3 FSHAPE3.2 FSHAPE3.1 FSHAPE3.0 00000110 129 0xF6 FSHAPE2 FSHAPE2.7 FSHAPE2.6 FSHAPE2.5 FSHAPE2.4 FSHAPE2.3 FSHAPE2.2 FSHAPE2.1 FSHAPE2.0 00000011 129 0xF7 FSHAPE1 FSHAPE1.7 FSHAPE1.6 FSHAPE1.5 FSHAPE1.4 FSHAPE1.3 FSHAPE1.2 FSHAPE1.1 FSHAPE1.0 00000001 129 0xF8 EIP - - - PRTC PT3 PAD PT2 PRF 11100000 31 0xF9 TEST0 - - - - VCO_ARRAY3 VCO_ARRAY2 VCO_ARRAY1 VCO_ARRAY0 0000xxxx 115 0xFA TEST1 - - - - CAL_DAC3 CAL_DAC2 CAL_DAC1 CAL_DAC0 0000xxxx 115 0xFB TEST2 - - - CHP_CURRENT4 CHP_CURRENT3 CHP_CURRENT2 CHP_CURRENT1 CHP_CURRENT0 000xxxxx 115 0xFC TEST3 - - - BREAK_LOOP CAL_DAC_ CAL_DAC_ CAL_DAC_ CAL_DAC_ 00000100 115 OPEN3 OPEN2 OPEN1 OPEN0 0xFD TEST4 - - L2KIO0.5 L2KIO0.4 L2KIO0.3 L2KIO0.2 L2KIO0.1 L2KIO0.0 00100101 115 0xFE TEST5 - - CHP_DISABLE VCO_OVERRIDE VCO_AO3 VCO_AO2 VCO_AO1 VCO_AO0 00001000 115 0xFF TEST6 LOOPFILTER_ LOOPFILTER_ CHP_OVERRIDE CHP_CO4 CHP_CO3 CHP_CO2 CHP_CO1 CHP_CO0 00010000 114 TP1 TP2 Table 40. SFR Summary (sorted by address) SWRS047A Page 141 of 146

CC1010 25. Alphabetic Register Index ACC (0xE0) - Accumulator Register........................................................................................23 ADCON (0x93) - ADC Control Register...................................................................................81 ADCON 2(0x96) - ADC Control Register 2.............................................................................82 ADDATH (0x95) - ADC Data Register, High Bits....................................................................81 ADDATL (0x94) - ADC Data Register, Low Byte....................................................................81 ADTRH (0x97) - ADC Threshold Register...............................................................................82 B (0xF0) - B Register...............................................................................................................23 BSYNC (0xD4) - Byte Synchronisation Register...................................................................102 CAL (0xE5) - PLL Calibration Control Register.....................................................................114 CHVER (0x9F) - Chip Version / Revision Register.................................................................45 CKCON (0x8E) - Timer Clock rate Control Register...............................................................55 CRPCNT (0xC6) – Encryption / Decryption Counter...............................................................77 CRPCON (0xC3) - Encryption / Decryption Control Register.................................................77 CRPDAT (0xC5) - Encryption / Decryption Data Location Register........................................77 CRPINIn, n∈{0..7} (0xB4-0xB7, 0xBC-0xBF) - DES Initialisation Vector................................78 CRPKEY (0xC4) - Encryption / Decryption Key Location Register.........................................77 CURRENT (0xE1) - RF Current Control Register.................................................................118 DPH0 (0x83) - Data Pointer 0, high byte.................................................................................21 DPH1 (0x85) - Data Pointer 1, high byte.................................................................................21 DPL0 (0x82) - Data Pointer 0, low byte...................................................................................21 DPL1 (0x84) - Data Pointer 1, low byte...................................................................................21 DPS (0x86) - Data Pointer Select............................................................................................22 EICON (0xD8) - Extended Interrupt Control............................................................................30 EIE (0xE8) - Extended Interrupt Enable Register....................................................................29 EIP (0xF8) - Extended Interrupt Priority Register....................................................................31 EXIF (0x91) - Extended Interrupt Flag....................................................................................30 FLADR (0xAE) - Flash Write Address Register.......................................................................43 FLCON (0xAF) - Flash Write Control Register........................................................................43 FLTIM (0xDD) - Flash Write Timing Register..........................................................................43 FREND (0xEE) - Front End Control Register........................................................................119 FREQ_0A (0xCA) – Frequency A, Control Register 0..........................................................108 FREQ_0B (0xCD) - Frequency B, Control Register 0...........................................................109 FREQ_1A (0xCB) – Frequency A, Control Register 1..........................................................108 FREQ_1B (0xCE) - Frequency B, Control Register 1...........................................................108 SWRS047A Page 142 of 146

CC1010 FREQ_2A (0xCC) – Frequency A, Control Register 2..........................................................108 FREQ_2B (0xCF) - Frequency B, Control Register 2...........................................................108 FSCTRL (0xEC) - Frequency Synthesiser Control Register.................................................130 FSDELAY (0xE9) - Frequency Shaping Delay Control Register...........................................129 FSEP0 (0xEA) - Frequency Separation Control Register 0..................................................109 FSEP1 (0xEB) - Frequency Separation Control Register 1..................................................109 FSHAPEn (0xF1 - 0xF7), n∈1..7 - Frequency Shaping Register n.......................................129 IE (0xA8) - Interrupt Enable Register......................................................................................29 IP (0xB8) - Interrupt Priority Register......................................................................................31 LOCK (0xE4) - PLL Lock Register.........................................................................................110 MATCH (0xDC) - Match Capacitor Array Control Register...................................................120 MODEM0 (0xDB) - Modem Control Register 0.......................................................................93 MODEM1 (0xDA) - Modem Control Register 1.....................................................................100 MODEM2 (0xD9) - Modem Control Register 2......................................................................100 MPAGE (0x92) - Memory Page Select Register.....................................................................22 P0 (0x80) - Port 0 Data Register.............................................................................................49 P0DIR (0xA4) - Port 0 Direction Register................................................................................50 P1 (0x90) - Port 1 Data Register.............................................................................................49 P1DIR (0xA5) - Port 1 Direction Register................................................................................50 P2 (0xA0) - Port 2 Data Register.............................................................................................50 P2DIR (0xA6) - Port 2 Direction Register................................................................................51 P3 (0xB0) - Port 3 Data Register.............................................................................................50 P3DIR (0xA7) - Port 3 Direction Register................................................................................51 PA_POW (0xE2) - PA Output Power Control Register.........................................................125 PCON (0x87) - Power Control Register..................................................................................36 PDET (0xD3) - Preamble Detection Control Register...........................................................102 PLL (0xE3) - PLL Control Register........................................................................................109 PRESCALER (0xE6) - Prescaler Control Register................................................................130 PSW (0xD0) - Program Status Word.......................................................................................23 RADRH (0xBB) - Replacement address, high byte.................................................................45 RADRL (0xBA) - Replacement address, low byte...................................................................45 RANCON (0xC7) - Random Bit Generator Control Register...................................................78 RDATA (0xB9) - Replacement Data........................................................................................45 RESERVED (0xE7) - Reserved register, used by Chipcon debugger software.....................45 RFBUF (0xC9) - RF Data Buffer..............................................................................................95 RFCON (0xC2) - RF Control Register...................................................................................101 SWRS047A Page 143 of 146

CC1010 RFMAIN (0xC8) - RF Main Control Register...........................................................................89 RTCON (0xED) - Realtime Clock Control Register.................................................................65 SBUF0 (0x99) - Serial Port 0, data buffer...............................................................................67 SBUF1 (0xC1) – Serial Port 1, data buffer..............................................................................67 SCON0 (0x98) - Serial Port 0 Control Register.......................................................................67 SCON1 (0xC0) - Serial Port 1 Control Register......................................................................68 SP (0x81) - Stack Pointer........................................................................................................24 SPCR (0xA1) - SPI Control Register.......................................................................................72 SPDR (0xA2) - SPI Data Register...........................................................................................72 SPSR (0xA3) - SPI Status Register.........................................................................................72 T2 (0xAC) - Timer 2 Low byte counter value...........................................................................60 T2PRE (0xAA) - Timer 2 Prescaler Control.............................................................................60 T3 (0xAD) - Timer 3 Low byte counter value...........................................................................60 T3PRE (0xAB) - Timer 3 Prescaler Control.............................................................................60 TCON (0x88) - Timer / Counter 0 and 1 control register.........................................................54 TCON2 (0xA9) - Timer Control register 2................................................................................59 TEST0 (0xF9) – PLL Test Register 0....................................................................................115 TEST1 (0xFA) – PLL Test Register 1....................................................................................115 TEST2 (0xFB) – PLL Test Register 2....................................................................................115 TEST3 (0xFC) – PLL Test Register 3...................................................................................115 TEST4 (0xFD) – PLL Test Register 4...................................................................................115 TEST5 (0xFE) – PLL Test Register 5....................................................................................115 TEST6 (0xFF) – PLL Test Register 6....................................................................................114 TESTMUX (0xEF) - Test Multiplexer Control Register (for prototype testing)......................130 TH0 (0x8C) - Timer / Counter 0 High byte counter value........................................................52 TH1 (0x8D) - Timer / Counter 1 High byte counter value........................................................52 TL0 (0x8A) - Timer / Counter 0 Low byte counter value.........................................................52 TL1 (0x8B) - Timer / Counter 1 Low byte counter value.........................................................52 TMOD (0x89) - Timer / Counter 0 and 1 Mode register..........................................................53 WDT (0xD2) - Watchdog Timer Control Register....................................................................63 X32CON (0xD1) - 32.768 kHz Crystal Oscillator Control Register.........................................36 SWRS047A Page 144 of 146

CC1010 26. Ordering Information Orderable Status Package Package Pins Package Eco Plan (2) Lead MSL Peak Device (1) Type Drawing Qty Finish Temp (3) CC1010PAG Active TQFP PAG 64 160 Green (RoHS & Cu NiPdAu LEVEL3-260C no Sb/Br) 1 YEAR CC1010PAGR Active TQFP PAG 64 1500 Green (RoHS & Cu NiPdAu LEVEL3-260C no Sb/Br) 1 YEAR Orderable Evaluation Module Description Minimum Order Quantity CC1010DK-433 CC1010 Development Kit, 433 MHz 1 CC1010DK-868 CC1010 Development Kit, 868/915 MHz 1 SWRS047A Page 145 of 146

CC1010 27. General Information 27.1 Document History Revision Date Description/Changes SWRS047A 2009-09-18 Removed logo from header New package description New ordering information Removed chapter on Package Marking Changes to chapter on Tray Specification SWRS047 2004-12-17 Added history table. (rev 1.3) Various corrections and clarifications. Preliminary status removed. Added Smith charts for LNA input impedance and inactive PA input impedance. Added sensitivity vs. data rate information. Added information about power consumption of Schmitt-trigger input. Added power consumption spec for main crystal oscillator. Added chapter numbering. Reorganized electrical specifications. Ordering info updated. Added current consumption for Power-on reset circuit. Added recommended PCB footprint. Added section about PA “splattering”. Added specification for ADC input voltage. Added specification for 32 kHz oscillator crystal load capacitance. Added information about flash programming times. Added RoHS Pb-free chip and sample kit ordering information. SWRS047A Page 146 of 146

PACKAGE MATERIALS INFORMATION www.ti.com 18-Sep-2009 TAPE AND REEL INFORMATION *Alldimensionsarenominal Device Package Package Pins SPQ Reel Reel A0 B0 K0 P1 W Pin1 Type Drawing Diameter Width (mm) (mm) (mm) (mm) (mm) Quadrant (mm) W1(mm) CC1010PAGR TQFP PAG 64 1500 330.0 24.4 12.35 12.35 1.85 16.0 24.0 Q2 PackMaterials-Page1

PACKAGE MATERIALS INFORMATION www.ti.com 18-Sep-2009 *Alldimensionsarenominal Device PackageType PackageDrawing Pins SPQ Length(mm) Width(mm) Height(mm) CC1010PAGR TQFP PAG 64 1500 378.0 70.0 346.0 PackMaterials-Page2

IMPORTANTNOTICE TexasInstrumentsIncorporatedanditssubsidiaries(TI)reservetherighttomakecorrections,modifications,enhancements,improvements, andotherchangestoitsproductsandservicesatanytimeandtodiscontinueanyproductorservicewithoutnotice.Customersshould obtainthelatestrelevantinformationbeforeplacingordersandshouldverifythatsuchinformationiscurrentandcomplete.Allproductsare soldsubjecttoTI’stermsandconditionsofsalesuppliedatthetimeoforderacknowledgment. TIwarrantsperformanceofitshardwareproductstothespecificationsapplicableatthetimeofsaleinaccordancewithTI’sstandard warranty.TestingandotherqualitycontroltechniquesareusedtotheextentTIdeemsnecessarytosupportthiswarranty.Exceptwhere mandatedbygovernmentrequirements,testingofallparametersofeachproductisnotnecessarilyperformed. TIassumesnoliabilityforapplicationsassistanceorcustomerproductdesign.Customersareresponsiblefortheirproductsand applicationsusingTIcomponents.Tominimizetherisksassociatedwithcustomerproductsandapplications,customersshouldprovide adequatedesignandoperatingsafeguards. TIdoesnotwarrantorrepresentthatanylicense,eitherexpressorimplied,isgrantedunderanyTIpatentright,copyright,maskworkright, orotherTIintellectualpropertyrightrelatingtoanycombination,machine,orprocessinwhichTIproductsorservicesareused.Information publishedbyTIregardingthird-partyproductsorservicesdoesnotconstitutealicensefromTItousesuchproductsorservicesora warrantyorendorsementthereof.Useofsuchinformationmayrequirealicensefromathirdpartyunderthepatentsorotherintellectual propertyofthethirdparty,oralicensefromTIunderthepatentsorotherintellectualpropertyofTI. ReproductionofTIinformationinTIdatabooksordatasheetsispermissibleonlyifreproductioniswithoutalterationandisaccompanied byallassociatedwarranties,conditions,limitations,andnotices.Reproductionofthisinformationwithalterationisanunfairanddeceptive businesspractice.TIisnotresponsibleorliableforsuchaltereddocumentation.Informationofthirdpartiesmaybesubjecttoadditional restrictions. ResaleofTIproductsorserviceswithstatementsdifferentfromorbeyondtheparametersstatedbyTIforthatproductorservicevoidsall expressandanyimpliedwarrantiesfortheassociatedTIproductorserviceandisanunfairanddeceptivebusinesspractice.TIisnot responsibleorliableforanysuchstatements. TIproductsarenotauthorizedforuseinsafety-criticalapplications(suchaslifesupport)whereafailureoftheTIproductwouldreasonably beexpectedtocauseseverepersonalinjuryordeath,unlessofficersofthepartieshaveexecutedanagreementspecificallygoverning suchuse.Buyersrepresentthattheyhaveallnecessaryexpertiseinthesafetyandregulatoryramificationsoftheirapplications,and acknowledgeandagreethattheyaresolelyresponsibleforalllegal,regulatoryandsafety-relatedrequirementsconcerningtheirproducts andanyuseofTIproductsinsuchsafety-criticalapplications,notwithstandinganyapplications-relatedinformationorsupportthatmaybe providedbyTI.Further,BuyersmustfullyindemnifyTIanditsrepresentativesagainstanydamagesarisingoutoftheuseofTIproductsin suchsafety-criticalapplications. TIproductsareneitherdesignednorintendedforuseinmilitary/aerospaceapplicationsorenvironmentsunlesstheTIproductsare specificallydesignatedbyTIasmilitary-gradeor"enhancedplastic."OnlyproductsdesignatedbyTIasmilitary-grademeetmilitary specifications.BuyersacknowledgeandagreethatanysuchuseofTIproductswhichTIhasnotdesignatedasmilitary-gradeissolelyat theBuyer'srisk,andthattheyaresolelyresponsibleforcompliancewithalllegalandregulatoryrequirementsinconnectionwithsuchuse. TIproductsareneitherdesignednorintendedforuseinautomotiveapplicationsorenvironmentsunlessthespecificTIproductsare designatedbyTIascompliantwithISO/TS16949requirements.Buyersacknowledgeandagreethat,iftheyuseanynon-designated productsinautomotiveapplications,TIwillnotberesponsibleforanyfailuretomeetsuchrequirements. FollowingareURLswhereyoucanobtaininformationonotherTexasInstrumentsproductsandapplicationsolutions: Products Applications Amplifiers amplifier.ti.com Audio www.ti.com/audio DataConverters dataconverter.ti.com Automotive www.ti.com/automotive DLP®Products www.dlp.com Broadband www.ti.com/broadband DSP dsp.ti.com DigitalControl www.ti.com/digitalcontrol ClocksandTimers www.ti.com/clocks Medical www.ti.com/medical Interface interface.ti.com Military www.ti.com/military Logic logic.ti.com OpticalNetworking www.ti.com/opticalnetwork PowerMgmt power.ti.com Security www.ti.com/security Microcontrollers microcontroller.ti.com Telephony www.ti.com/telephony RFID www.ti-rfid.com Video&Imaging www.ti.com/video RF/IFandZigBee®Solutions www.ti.com/lprf Wireless www.ti.com/wireless MailingAddress:TexasInstruments,PostOfficeBox655303,Dallas,Texas75265 Copyright©2009,TexasInstrumentsIncorporated