Using CC1111EMK dongle to sniff chronos data

Hi homer ,

I have got the same problem:

CC1111 EMK dongle programmed as Packet Sniffer, but can't capture the packets I want.

I try to use Packet Sniffer to capture packets between a pair of eZ430 Chrono Watch and Access Point (CC1111 that comes with the watch). But I captured some strange packets instead.

Here is how I did it, please advise if anything might be wrong.

1) I programmed a CC1111 usb dongle as a Packet Sniffer use the firmware image<sniffer_fw_ccxx11.hex> use SmartRF Flash Programmer

2) I power up and configured eZ430 Chrono Watch and AP to transmit under the ACC mode, so that I can see the real time acceleration data sent from the watch use Control Center.

Problem: 

I Can't see the packets that contains Acceleration data/Application payloads, Instead, the packet sniffer captures 1 packet every 3~9 mins. All captured packet has a FCS error

Please help and advise on this.

ming

I just got this to work myself. The clues were in the Chronos Watch Software. Deep in the source -> Software Projects\Chronos Watch\CCS\Sports Watch\simpliciti there is a file called simpliciti.h. in the header comments:

// SimpliciTI packet size (TX only mode)
// -------------------------------------
//
//   * packet rate   (100/3) packets/second = 33.3 packets/second    
//  * packet length   28 bytes
//  * packet structure  4 bytes  preamble
//        4 bytes  sync
//        1 bytes  length
//        1 bytes  address
//        16 bytes  data
//          12 byte network data
//          4  byte user data
//        2 bytes  crc
//
// SimpliciTI frequency overview
// -----------------------------
//
// CC430_End_Device_433MHz.lib (433MHz ISM band)
//
//  * base frequency  433.92 MHz
//  * deviation    32 kHz
//  * channel spacing  25 kHz
//  * used channel number 0 (frequency agility/hopping disabled)
//  * data rate    76.8 kBaud
//  * output power   1.4 dBm
//  * duty     9,6% (TX only mode, 32 packets / second)
//
// CC430_End_Device_868MHz.lib (868MHz ISM band)
//
//  * base frequency  869.525 MHz
//  * deviation    32 kHz
//  * channel spacing  25 kHz
//  * used channel number 0 (frequency agility/hopping disabled)
//  * data rate    76.8 kBaud
//  * output power   1.1 dBm
//  * duty     9,6% (TX only mode, 32 packets / second)
//
// CC430_End_Device_915MHz.lib (915MHz ISM band)
//
//  * base frequency  902.000 MHz
//  * deviation    32 kHz
//  * channel spacing  200 kHz
//  * used channel number 20 (frequency agility/hopping disabled)
//  * data rate    76.8 kBaud
//  * output power   1.3 dBm
//  * duty     9.6% (TX only mode, 32 packets / second)

I then brought up SmartRF Studio 7, double-clicked on CC1111, left it in Easy Mode, but clicked the check box for displaying the registers and RF parameters. I plugged in the 915MHz parametrics for the watch, left the crystal at 48MHz. I also set the Filter BW to  around 3X niquist of the data rate.

I selected simpliciTi 1.1.0 as the protocol in the SmartRF Packet Sniffer S/W. Entered all the register values from SmartRF Studio, WROTE a chronos_watch_sniffer.prs file (important step!) and Voila!  Packets from my Watch and Access point started streaming by.

My register settings in Packet Sniffer S/W w/ CC1111EMK

PKTCTRL0 | 0xDF04|0x05|Packet Automation Control

FSCTRL1 | 0xDF07|0x0C|Frequency Synthesizer Control

FREQ2 | 0xDF09|0x25|Frequency Control Word, High Byte

FREQ1 | 0xDF0A|0x95|Frequency Control Word, Middle Byte

FREQ0 | 0xDF0B|0x55|Frequency Control Word, Low Byte

MDMCFG4 | 0xDF0C|0x7B|Modem Configuration

MDMCFG3 | 0xDF0D|0xA3|Modem Configuration

MDMCFG2 | 0xDF0E|0x13|Modem Configuration

MDMCFG1 | 0xDF0F|0x23|Modem Configuration

MDMCFG0 | 0xDF10|0x11|Modem Configuration

DEVIATN | 0xDF11|0x43|Modem Deviation Setting

MCSM0 | 0xDF14|0x18|Main Radio Control State Machine Configuration

FOCCFG | 0xDF15|0x1D|Frequency Offset Compensation Configuration

BSCFG | 0xDF16|0x1C|Bit Synchronization configuration

AGCCTRL2 | 0xDF17|0xC7|AGC control

AGCCTRL1 | 0xDF18|0x00|AGC control

AGCCTRL0 | 0xDF19|0xB0|AGC control

FREND1 | 0xDF1A|0xB6|Front end RX configuration

FSCAL3 | 0xDF1C|0xEA|Frequency Synthesizer Calibration

FSCAL2 | 0xDF1D|0x2A|Frequency Synthesizer Calibration

FSCAL1 | 0xDF1E|0x00|Frequency Synthesizer Calibration

FSCAL0 | 0xDF1F|0x1F|Frequency Synthesizer Calibration

TEST1 | 0xDF24|0x31|Various Test Settings

TEST0 | 0xDF25|0x09|Various Test Settings

PA_TABLE0| 0xDF2E|0x8E|PA Power Setting 0

IOCFG0 | 0xDF31|0x06|Radio Test Signal Configuration

The latest firmware has changed in the channel spacing I have noticed from my file, for example the EU parameters are now:

// ISM_EU configuration
//
// Chipcon
// Product = CC1101
// Chip version = A   (VERSION = 0x04)
// Crystal accuracy = 10 ppm
// X-tal frequency = 26 MHz
// RF output power = 0 dBm
// RX filterbandwidth = 232.142857 kHz
// Deviation = 32 kHz
// Datarate = 76.766968 kBaud
// Modulation = (1) GFSK
// Manchester enable = (0) Manchester disabled
// RF Frequency = 869.524963 MHz
// Channel spacing = 199.951172 kHz
// Channel number = 0
// Optimization = -
// Sync mode = (3) 30/32 sync word bits detected
// Format of RX/TX data = (0) Normal mode, use FIFOs for RX and TX
// CRC operation = (1) CRC calculation in TX and CRC check in RX enabled
// Forward Error Correction = (0) FEC disabled
// Length configuration = (1) Variable length packets, packet length configured by the first received byte after sync word.
// Packetlength = 255
// Preamble count = (2)  4 bytes
// Append status = 1
// Address check = (0) No address check
// FIFO autoflush = 0
// Device address = 0
// GDO0 signal selection = ( 6) Asserts when sync word has been sent / received, and de-asserts at the end of the packet
// GDO2 signal selection = (41) CHIP_RDY