Low power ism transceiver evaluation kit (30 pages)
Summary of Contents for Semtech LR1121
Page 1
LR1121 Transceiver User Manual LR1121 www.semtech.com 1 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary & Confidential...
Page 2
LR-FHSS technology. Your use of LR-FHSS software made available by Semtech Corp. or its affiliates does not grant any rights to their patents for LR-FHSS technology. Rights under Semtech patents may be available via various...
Page 5
9.1.2 High Power PA........................87 9.2 PA Output Power ..........................88 9.2.1 Low Power PA........................88 9.2.2 High Power PA........................89 9.2.3 High Frequency PA ......................90 9.3 PA Current Consumption ......................91 LR1121 www.semtech.com 5 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP...
Page 10
Table 9-2: Optimized Settings for HP PA with the Same Matching Network ......95 Table 9-3: Optimized Settings for HF PA with the Same Matching Network ......95 Table 9-4: SetPaConfig Command......................99 Table 9-5: DutyCycle Parameters........................ 99 LR1121 www.semtech.com 10 of 130 User Manual Rev 1.1...
Page 11
Table 13-2: System Configuration / Status Operations ..............122 Table 13-3: Radio Configuration / Status Operations ............... 123 Table 13-4: CryptoElement Configuration / Status Operations............. 125 Table 13-5: Bootloader Commands......................126 Table 14-1: Revision History ........................127 LR1121 www.semtech.com 11 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP...
Figure 1-1: LR1121 Block Diagram 1.2 Overview The LR1121 chip is a long range, ultra-low power transceiver that provides ISM sub-GHz, a global 2.4 GHz band, and 1.9GHz-2.2GHz S-Band communication targeting terrestrial and satellite connectivity. For LPWAN use cases, the LR1121 supports LoRa®...
2.1.2 Standby This is the default mode of the LR1121. It is the return state from all other modes (except for specific fall-back options), and the mode from which transitions to other modes are possible. All commands to configure the device should be issued in this mode.
In the case of POR, or when the device is recovering from power-down or sleep mode without retention, the image calibration is performed as part of the initial calibration process and for optimal image rejection in the band 902 - 928MHz. If a TCXO is fitted, the calibration fails. LR1121 www.semtech.com 15 of 130 User Manual Rev 1.1...
Exiting this mode, the device performs a firmware restart, and sets the BUSY signal to low, indicating that the startup phase has been performed successfully and that the device is ready to accept a command. LR1121 www.semtech.com 16 of 130 User Manual Rev 1.1...
RAM. The BUSY signal is set to 1 with a pull-up and all MISO SPI signals are high-Z when the LR1121 is in sleep mode. In sleep mode, all DIOs are in Hi-Z mode.
POR and BRN. 2.1.6.2 NRESET Putting the NRESET signal to low for at least 100μs restarts the LR1121. The restart is equivalent to a Power-On Reset, and the device follows the same restart sequence. 2.1.6.3 Reboot Command Reboot(...) triggers a restart of the LR1121 firmware.
(LoRa, (G)FSK, or LR-FHSS). After ramping-up the PA, the LR1121 transmits the data buffer at the given frequency, PA, output power and packet and modulation configurations. When the last bit of the packet has been sent, a TX_DONE interrupt is generated, the PA regulator is ramped down, the selected PA is switched OFF and the device goes back to Standby RC or Xosc mode, depending on the FallBackMode configuration.
When the power management unit and RC oscillator become available, the embedded CPU starts and executes the internal firmware. • At the end of the startup sequence, the device is set in Standby RC mode, the BUSY signal goes low and the device accepts commands. LR1121 www.semtech.com 20 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP...
2.3 Firmware Upgrade The LR1121 can be upgraded with a new firmware image, supplied by Semtech. Complete details are provided in the Application note AN1200.57 “LR1110: Upgrade of the Program Memory”, available from the Semtech website. The related commands are described hereafter.
2.3.3 WriteFlashEncrypted The WriteFlashEncrypted() command writes a new firmware image to the LR1121. More details are supplied in the AN1200.57 Application Note. Table 2-14: WriteFlashEncrypted Command Byte Offset Offset Offset Data1 Data1 Data from Host 0x80 0x03 Offset (7:0) (31:24)
There is no check when reaching the end of Info Page. Therefore the first word of data after Info Page (at address 512) will correspond to other LR11x flash memory data outside of the Info Page. LR1121 www.semtech.com 24 of 130 User Manual Rev 1.1...
The LR1121 exposes an API which allows the Host controller to communicate with the LR1121 through a set of SPI commands / responses. The BUSY signal is used as a handshake to indicate if the LR1121 is ready to accept a command.
3.3 Command Endianness The following figures are examples of an SPI transaction for command GetVersion(...). Figure 3-3: GetVersion Write Capture Figure 3-4: GetVersion Read Capture LR1121 www.semtech.com 26 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary & Confidential...
Note that there is an alternate method for retrieving this status information: If a sequence of zeros (NOP) is written to the MOSI signal, the LR1121 clocks out either the response to the last command, or the status information if no response is pending.
(7:4) (3:1) Name Reset Status Chip Mode Bootloader • Reset Status indicates the origin of a LR1121 reset: 0: Cleared (no active reset). 1: Analog reset (Power On Reset, Brown-Out Reset). 2: External reset (NRESET pin). 3: System reset.
) depends on the nature of the SW Mode command. The most common switching times T are indicated in Section 2.4 "Mode Transitions & Timings" on page 22 SW Mode LR1121 www.semtech.com 29 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary &...
Command ClearErrors(...) clears all errors flags pending in the device. The error flags cannot be cleared individually. Table 3-6: ClearErrors Command Byte Data from Host 0x01 0x0E Data to Host Stat1 Stat2 LR1121 www.semtech.com 30 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary & Confidential...
• The address is auto incremented after each data byte so that data is read from contiguous register locations. • Len is the number of words to read, and is maximum 64. LR1121 www.semtech.com 31 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP...
Data to Host Stat1 Stat2 0x00 0x00 (31:24) (23:16) (15:8) (7:0) • Data: N bytes of data. The value of N is maximum 255. LR1121 www.semtech.com 32 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary & Confidential...
Data to Host Stat1 Stat2 Table 3-16: GetRandomNumber Response Byte Data from Host 0x00 0x00 0x00 0x00 0x00 Data to Host Stat1 RandomNo(31:24) RandomNo(23:16) RandomNo(15:8) RandomNo(7:0) LR1121 www.semtech.com 33 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary & Confidential...
0: Disabled. No CRC is expected or sent on the SPI (default). 1: Enabled. A CRC is expected and sent on the SPI. Other values are RFU. • CRC: cyclic redundancy check. LR1121 www.semtech.com 34 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023...
4.1 Interrupts The LR1121 features numerous interrupt sources, allowing the host to react to a large variety of events in the LR1121 system without the need to poll registers, therefore allowing power-optimized applications.
An error other than a command error occurred (see GetErrors) FskLenError IRQ raised if the packet was received with a length error FskAddrError IRQ raised if the packet was received with an address error 26-31 LR1121 www.semtech.com 36 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP...
(31:24) (23:16) (15:8) (7:0) IrqStatus IrqStatus IrqStatus IrqStatus Data to Host Stat1 Stat2 (31:24) (23:16) (15:8) (7:0) The IrqToClear is identical to IrqToEnable assignment. LR1121 www.semtech.com 37 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary & Confidential...
By default, no DIO is used as RF switch: all RFSW outputs are in High-Z state. This command only works with the chip in Standby RC mode, otherwise it returns a CMD_FAIL on the next GetStatus command. LR1121 www.semtech.com 38 of 130 User Manual Rev 1.1...
Enables or disables the addition of pull ups or pull downs resistors on the configured RF switch and IRQ line DIOs. This command allows to save power consumption in an application where the RF switches are supplied by the LR1121 DIOs, when the LR1121 is in sleep mode.
4.3 Temperature Sensor The LR1121 has a built-in temperature sensor which gives an indication of the internal device temperature. 4.3.1 GetTemp The temperature measurement can be triggered using command GetTemp(...). Table 4-7: GetTemp Command Byte Data from Host 0x01 0x1A...
5.5 Over Current Protection The LR1121 has a built-in Over Current Protection (OCP) block which prevents surge currents when the device is used at its highest power levels, thus protecting the battery that may power the application. The current clamping values are trimmable by register access.
For example, in LoRa modulation when the Low Data Rate (LDRO) is used, a frequency drift rate of the transmitted packet of 120Hz/s typically implies a 3dB sensitivity reduction in the LR1121 receiver for all SF and BW. This maximum drift rate is 110Hz/s when the LDRO is not used.
Refer to the LR1121 PCB reference design on www.semtech.com for an implementation example in PCB design. Figure 6-1: LR1121 Thermal Insulation on PCB Top Layer 6.2.3 32MHz TCXO In environments with extreme temperature variation, it may be required to use a TCXO (Temperature Compensated Crystal Oscillator) to achieve better frequency accuracy.
2: When to release BUSY signal: 0: Wait for Xtal 32k ready. 1: Wait for Xtal 32k to be ready before releasing the BUSY signal. • bits 3-7: RFU. LR1121 www.semtech.com 46 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary &...
1: Sets TCXO mode. A complete Reset of the chip is required to get back to normal XOSC operation. Command only operates in Standby RC mode, otherwise it returns CMD_FAIL on the next GetStatus() command. LR1121 www.semtech.com 47 of 130 User Manual Rev 1.1...
HF radio, therefore no simultaneous sub-GHz /HF radio operation is possible. The LR1121 frequency synthesizer is clocked by a 32MHz reference, provided by either a crystal oscillator, or a TCXO. Refer Section 6. "Clock Sources" on page 44 for details.
• RfFreq: RF Frequency of the radio in Hz. All frequency dependent parameters are automatically recomputed by the LR1121 firmware when processing this command. 7.2.2 SetRx Command SetRx(...) sets the sub-GHz radio in RX mode. The sub-GHz path is selected for RfFreq frequencies below or equal to 1.50GHz.
0x000000 disables the timeout function. If no packet type was configured, or the packet type does not allow Tx operations, the command fails. The BUSY signal goes to 0 after the device is set into TX mode. LR1121 www.semtech.com 50 of 130 User Manual Rev 1.1...
Timeout defines the timeout of the second mode, after the automatic transition. It is expressed in periods of the 32.768kHz RTC. The maximum timeout value corresponds to 512s. 0x000000: Disables the timeout function. LR1121 www.semtech.com 51 of 130 User Manual Rev 1.1...
The fallback mode is also used for an Rx Duty Cycle after the RX_DONE interrupt, or for an AutoRxTx after the RX to TX, or when the TX to RX sequence is completed. LR1121 www.semtech.com 52 of 130 User Manual Rev 1.1...
When this command is sent in Standby mode, the context (device configuration) is saved and the device enters in a loop defined by the following steps, and depicted in Figure 7-2: LR1121 Current Profile During RX Duty Cycle Operation 1. The device enters RX and listens for an incoming RF packet for a period of time defined by RxPeriod.
Table 7-9: GetRssiInst Response Byte Data from Host 0x00 0x00 Data to Host Stat1 Rssi The RSSI is calculated using the following formula: RSSI (dBm)= -Rssi/2. LR1121 www.semtech.com 55 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary & Confidential...
Command ResetStats(...) resets the internal statistics of the received RF packets: Table 7-12: ResetStats Command Byte Data from Host 0x02 0x00 Data to Host Stat1 Stat2 LR1121 www.semtech.com 56 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary & Confidential...
GainOffset: Global offset added to the Gain Tune values. The offset is a 12-bit signed value, where 1lsb = 0.5dB. The power seen by the LR1121 analog front-end is affected by external components such as the matching network, or RF switches.
Page 60
Gain Tune and Gain Offset values can be determined using an RF generator with the LR1121 hardware implementation as follows: 1. Setup the device in Gfsk mode and set the desired RF frequency. 2. Setup the device in manual gain mode (disable the AGC (Auto Gain Control)).
Page 61
*/ lr11xx_radio_get_rssi_inst( context, rssi_in_dbm ); /* Add a way to log (gain[i], power[i], rssi_in_dbm) triplet to be able to compute offset and tunes for the RSSI calibration */ LR1121 www.semtech.com 61 of 130 User Manual Rev 1.1...
8. Modems 8.1 Modem Configuration The LR1121 contains different modems capable of handling different constant envelope modulations. For the LoRa®/(G)FSK modems and LR-FHSS modulation, the suitable command order is the following: • The user must specify the modem to be used in command SetPacketType(...) •...
PacketType corresponds to the modem used for the following RF transactions: 0: None 1: (G)FSK 2: LoRa 4: LR-FHSS Other values are RFU LR1121 www.semtech.com 63 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary & Confidential...
8.2.1.3 Coding Rate (CR) To further improve the robustness of the link, the LoRa modem employs cyclic error coding to perform forward error detection and correction. Such error coding incurs a transmission overhead. LR1121 www.semtech.com 64 of 130 User Manual Rev 1.1...
The receiver undertakes a preamble detection process that periodically restarts. For this reason the preamble length should be configured as identical to the transmitter preamble length. Where the preamble length is not known, or can vary, the maximum preamble length should be programmed on the receiver side. LR1121 www.semtech.com 65 of 130 User Manual Rev 1.1...
An optional CRC may be appended. 8.2.2.4 LoRa Packet Time On Air The Time On Air of the LoRa packet is shown in the LR1121 drivers. 8.2.3 Channel Activity Detection (CAD) Used only in LoRa packets, the Channel Activity Detection (CAD) is a LoRa specific mode of operation where the device searches for the presence of a LoRa preamble signal.
2.Long Interleaver (CR=4/5, 4/6 and 4/8) is supported for packets of minimum Payload length of 8 bytes, and maximum Payload length of 253 bytes if the CRC is activated (255 bytes if the CRC is deactivated). LR1121 www.semtech.com 67 of 130 User Manual Rev 1.1...
This command fails if no packet type has been set. 8.3.3 SetCad Command SetCad(...) activates the CAD feature. Table 8-6: SetCad Command Byte Data from Host 0x02 0x18 Data to Host Stat1 Stat2 LR1121 www.semtech.com 68 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary & Confidential...
SignalRssiPkt provides an estimation of RSSI of the LoRa signal (after despreading) on last packet received. In two’s complement format [negated, dBm, fixdt(0,8,1)]. Actual Rssi in dB is -SignalRssiPkt/2. Additional information on the RSSI can be found in section Section 8.9 "RSSI Functionality" on page LR1121 www.semtech.com 70 of 130 User Manual Rev 1.1...
Preamble Detection in Receiver Mode The LR1121 can gate the reception of a packet if an insufficient number of alternating preamble symbols (usually referred to 0x55 or 0xAA in hexadecimal form) has been detected. The parameter PreambleDetectorLength in command SetPacketParams(...) allows the user to select a value ranging from:...
0 to 254 bytes if address filtering is activated • the Length field is 1 byte long, except for SX128x compatibility, when it is 9 bits (see 8.4.4 SX128x Compatibility) Figure 8-5: Variable-Length Packet LR1121 www.semtech.com 72 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP...
8.4.3.5 CRC The LR1121 offers full flexibility to select the CRC polynomial and initial value of the selected polynomial. The user can also select a complete inversion of the computed CRC to comply with some international standards.
IrqStatus (31:24) IrqStatus (23:16) • NodeAddr: Default 0x00 • BroadcastAddr: Default 0x00 If the address comparison fails then the packet reception is aborted and the adrsErr flag is set. LR1121 www.semtech.com 76 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary &...
Data from Host 0x02 0x025 Seed (15:8) Seed (7:0) Data to Host Stat1 Stat2 IrqStatus (31:24) IrqStatus (23:16) • Seed default value is 0x0100 LR1121 www.semtech.com 77 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary & Confidential...
Bit 1: PktRcvd, Packet reception status. Indicates that the packet reception is done. Only show the completion of the receive process and not the packet validity. Only applicable in Rx. Bit 0: PktSent, Packet transmission status. Indicates that the packet transmission is done. Only applicable in Tx. LR1121 www.semtech.com 78 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP...
LR-FHSS can nearly equate the link-budget of SF12 BW125kHz of LoRa, allowing many devices to coexist on the same spectral allocation. LR-FHSS implementation in the LR1121 is transmit only. The LR1121 fully controls the following functionality: •...
A FCC use case corresponds to a use case where BW = 0x08/0x09, Hopping = 0x01, Grid = 0x00. Note: This command does not send the LR-FHSS packet. The transmission will be triggered using SetTx(...) command. LR1121 www.semtech.com 81 of 130 User Manual Rev 1.1...
Syncword: LR-FHSS Syncword. Default value is {0x2C, 0x0F, 0x79, 0x95}. 8.7.4 Circuit Configuration for Long Range FHSS Transmission After power up (battery insertion or hard reset) the LR1121 runs automatically a calibration procedure and goes to STDBY_RC mode. This is indicated by a low state on BUSY pin.
WriteBuffer8) 8.9 RSSI Functionality The RSSI information of the LR1121 is available either in the radio chain, or after demodulation at the end of the reception stage. A summary of the RSSI information and their meaning is summarized in table...
9. Power Amplifiers The LR1121 features 2 power amplifiers for sub-GHz operation, and one power amplifier for HF (2.4GHz) operation: • A high power PA (HP PA), optimized for +22dBm operation • A low power PA (LP PA), optimized for +14dBm operation, capable of +15dBm output power •...
VREG whenever the required VR_PA is 1.35V or below, in order to benefit from the Buck converter. The LR1121 incorporates a precise duty cycle trimmer shared between the three power amplifiers. This duty cycle trimmer can be used to trade-off the output power, efficiency, and harmonic emission to address the different regional standard requirements.
Note: All figures in this chapter are indicative and typical, and are not a specification. These figures only highlight the behavior of the PA over the various parameters and conditions. Figure 9-3: Low Power PA VR_PA Voltage vs. TxPower LR1121 www.semtech.com 86 of 130 User Manual Rev 1.1...
Below 2.7V, the output power degrades as VBAT reduces At 1.8V of supply voltage, the maximum VR_PA value is 1.6V (1.8V - 200mV), allowing therefore a +17dBm output power. Figure 9-4: High Power PA VR_PA Voltage vs. TxPower LR1121 www.semtech.com 87 of 130 User Manual Rev 1.1...
TxPower=14 and PaDutyCycle=4 gives +14dBm whatever the supply voltage (1.8V, 3.3V and 3.7V) • TxPower=14 and PaDutyCycle=7 gives +15dBm whatever the supply voltage (1.8V, 3.3V and 3.7V) Figure 9-5: Low Power PA Output Power vs. TxPower LR1121 www.semtech.com 88 of 130 User Manual Rev 1.1...
PA regulator, the +22dBm output power can only be obtained from a 3.3V to 3.7V supply voltage range. • For +17dBm, VR_PA around 2V is required. Therefore the LR1121 output power will drop to +17dBm for the minimum supply voltage 1.8V.
The supply voltage has no impact on the output power, since the HF PA is internally regulated. Therefore the plots for 1.8V, 3.3V and 3.7V are superimposed, and only the plots for 3.7V are visible. Figure 9-7: High Frequency PA Output Power vs. TxPower LR1121 www.semtech.com 90 of 130 User Manual Rev 1.1...
PaDutyCycle=7 approx. 62mA. • For PaDutyCycle=4, the current consumption is approx. 47mA for 3.3V and 3.7V, and approx. 49mA for 1.8V. Figure 9-8: IDDTX vs TxPower, Low Power PA, DC-DC Configuration LR1121 www.semtech.com 91 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP...
For 1.8V, the current consumption is approx. 69mA for PaDutyCycle=2, and approx. 81mA for PaDutyCycle=4. This is due to the fact that at 1.8V supply voltage, the maximum VR_PA voltage is 1.6V, therefore a maximum output power of +17dBm. LR1121 www.semtech.com 92 of 130 User Manual Rev 1.1...
DC-DC or the LDO modes during the high power PA operation. Figure 9-10: IDDTX vs TxPower, High Power PA, DC-DC Configuration Figure 9-11: IDDTX vs TxPower, High Power PA, LDO Configuration LR1121 www.semtech.com 93 of 130 User Manual Rev 1.1...
Figure 9-13: IDDTX vs TxPower, High Frequency PA, LDO Configuration Figure 9-12 Figure 9-13 show that the power efficiency of the High Frequency PA is maximized when the internal DC-DC regulator is used at, or above, 3.3V. LR1121 www.semtech.com 94 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP...
Table 9-3 show the optimal settings for the PA when using the Semtech matching network obtained on Semtech' s reference design. The user can fine-tune the PaDutyCycle and PaHpSel according to their requirements of matching network, efficiency, output power, and harmonic emission.
Page 96
Table 9-3: Optimized Settings for HF PA with the Same Matching Network Target Power TxPower PaSel RegPASupply PaDutyCycle PaHPSel +11dBm +10dBm LR1121 www.semtech.com 96 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary & Confidential...
The RF switch implementation optimizes the impedance presented to the PA and the impedance presented to the LNA separately. Therefore one can optimize TX efficiency without compromising RX sensitivity. The RF switch can be controlled either by the host controller, or by the LR1121 itself (pins DIO5, DIO6, DIO7, DIO8 and DIO10), using the SetDioAsRfSwitch(...) command.
In such a configuration, the PA and the RX differential stages are connected as depicted in the figure hereafter. Please note that series capacitances are required between the PA and the RX stage in order to avoid damaging the LR1121 due to current flow in the RX stage.
0 ≤ PaDutyCycle ≤ 0x07 Range For frequency ≥ 400MHz, PaDutyCycle ≤ 0x03 Default PaDutyCycle = 0x04 value • PaHPSel controls the size of the high power PA. LR1121 www.semtech.com 99 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023...
0x0D SET_RAMP_272U 0x0E SET_RAMP_304U 0x0F A RampTime of 48s allows the best trade-off between a fast RF power establishment and minimum RF spurious emissions, therefore complying with radio standards. LR1121 www.semtech.com 100 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary &...
Application CryptoSetKey(...) GpKEKey0 GpKEKey1 From any other Gp CryptoDeriveKey(...) GpKEKey2 CryptoSetKey(...) GpTransport Transport key or from GpKEKey3 Any multicast Key Application Key GpKEKey4 GpKEKey5 LR1121 www.semtech.com 101 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary & Confidential...
Page 102
Only from GpTransport CryptoVerifyAesCmac(...) Multicast McNwkSKey0 CryptoSetKey(...) McNwkSKey1 McNwkSKey2 McNwkSKey3 CryptoAesEncrypt(...) General CryptoAesDecrypt(...) Not Allowed Purpose CryptoSetKey(...) 1. Built-in the device, derived upon DeriveRootKeysAndGetPin() command. LR1121 www.semtech.com 102 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary & Confidential...
CEStatus on page 103. Note: At the end of the CryptoDeriveKey() process, the generated key is located in the dedicated Crypto Engine RAM, and can be stored in the flash memory using the CryptoStoreToFlash() command. LR1121 www.semtech.com 104 of 130 User Manual Rev 1.1...
• Data1 to DataM: Data. Data size M is either 16 or 32 bytes. Data must include the encrypted MIC. • CEStatus is defined in section CEStatus on page 103. LR1121 www.semtech.com 105 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP...
Table 10-11: CryptoComputeAesCmac Response Example Byte Data from Host 0x00 0x00 0x00 0x00 0x00 0x00 Data to Host Stat1 CEStatus 0x07 0x0a 0x16 0xb4 LR1121 www.semtech.com 106 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary & Confidential...
Data1, Data2 to DataN: Provided data, considered as byte buffers. • CEStatus: Defined in section CEStatus on page 103. If the 2 MICs are identical, the command returns CRYP_API_SUCCESS, otherwise, CRYP_API_FAIL_CMAC. LR1121 www.semtech.com 107 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP...
Data1, Data2 to DataN: Provided data, considered as byte buffers. • CEStatus: Defined in section CEStatus on page 103. • EncryptedData1, EncryptedData2,... , EncryptedDataN: Encrypted data, considered as byte buffers. LR1121 www.semtech.com 108 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary &...
Data1, Data2 to DataN: Provided data, considered as byte buffers. • CEStatus: Defined in section CEStatus on page 103. • EncryptedData1, EncryptedData2 to EncryptedDataN: Encrypted data, considered as byte buffers. LR1121 www.semtech.com 109 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary &...
Data1, Data2 to DataN: Provided data, considered as byte buffers. • CEStatus: Defined in section CEStatus on page 103. • DecryptedData1, DecryptedData2 to DecryptedDataN: Decrypted data, considered as byte buffers. LR1121 www.semtech.com 110 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary &...
Table 10-23: CryptoRestoreFromFlash Response Byte Data from Host 0x00 0x00 Data to Host Stat1 CEStatus • CEStatus: Defined in section CEStatus on page 103. LR1121 www.semtech.com 111 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary & Confidential...
Data(31:24) Data(23:16) Data(15:8) Data(7:0) • ParamID: Parameter ID, values 0 to 119 • Data: Parameter Data • CEStatus: Defined in CEStatus on page 103 LR1121 www.semtech.com 112 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary & Confidential...
Command GetChipEui(...) reads the LR1121’s pre-provisioned ChipEui. It is a globally-unique number, assigned by Semtech in production, using one of Semtech’s IEEE assigned EUIs. In the standard use-case, the ChipEui is used to derive the two LoRaWAN root keys (AppKey, NwkKey), and should also be used as DevEui (in the LoRaWAN definition) to generate the Join Request (which itself transports the DevEui).
11.2.2 GetSemtechJoinEui Command GetSemtechJoinEui(...) reads LR1121’s pre-programmed JoinEui, installed in production by Semtech. The two LoRaWAN root keys (AppKey, NwkKey) in the device are derived from this JoinEui, amongst other numbers. On top, in the standard use-case, the user should use SemtechJoinEui as the LoRaWAN JoinEui field to build the Join Request frame (which itself transports the JoinEui).
Command DeriveRootKeysAndGetPin(...) derives the AppKey and NwkKey root keys, and calculates the corresponding PIN, required to claim a device on the Semtech Join Server. It is a very versatile function with a standard use and a more advanced use, as described in the coming sections: Three use-cases are possible: •...
11.2.3.3 Alternate Use The LR1121 can be used outside of the Join Server service and its built-in root key derivation schemes. In this scenario, the PIN concept becomes irrelevant, and the user can provision his own NwkKey and AppKey, but still leverage the Crypto Engine for any of the authentication, signature and encryption tasks, for improved security.
FNwkSIntKey = CryptoDeriveKey(NwkKey, 0x01 | JoinNonce | NetID | DevNonce | pad Where pad is the required number of 0x00 bytes to expand to a 16-byte number. LR1121 www.semtech.com 117 of 130 User Manual Rev 1.1...
The key derivation scheme is available from the LoRaWAN specification: Figure 11-2: Key Derivation Scheme for LoRaWAN 1.0.x Although the crypto engine of the LR1121 follows the key naming convention of the LoRaWAN 1.1.x Standard, it can be used for LoRaWAN 1.0.x. The correspondence table is delivered below: Table 11-9: LoRaWAN 1.0.x vs.
The EN 300 220 standards describe 4 test signals which the EUT (Equipment Under Test) must be able to transmit for CE certification. These test signals are listed in the table hereafter, with the operating mode correspondence for the LR1121.
This command immediately starts transmission of the infinite preamble sequence. Therefore, the operating frequency, the PA configuration commands (including the RF output power) and the packet type have to be called prior to this command. LR1121 www.semtech.com 120 of 130 User Manual Rev 1.1...
ClearRxBuffer 0x010B Clears all data from radio RX buffer Reads-Modifies-Writes data at given register/memory address. WriteRegMemMask32 0x010C Addr(4), Mask(4), Data(4) Address must be 32-bit aligned. LR1121 www.semtech.com 121 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary & Confidential...
Returns the 8-byte factory DeviceEui GetSemtechJoinEui 0x0126 Returns the 8-byte factory JoinEui DeriveRootKeysAndGet Returns the 4-byte PIN which can be used to 0x0127 register the device with LoRa Cloud Services LR1121 www.semtech.com 122 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023...
Restores all Keys (and Parameters) from flash ParamID(1), CryptoSetParam 0x050D Sets a parameter in RAM Data(4) CryptoGetParam 0x050E ParamID(1) Gets a parameter from RAM LR1121 www.semtech.com 125 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary & Confidential...
Reads the 8-byte factory ChipEui of the device (big endian) GetJoinEui 0x800D Reads the 8-byte factory JoinEui of the device (big endian) 1. See AN1200.57 LR1110 Program Memory Update for usage. LR1121 www.semtech.com 126 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP...
14. Revision History The following table details the versions of the User Manual documentation issued, and the corresponding LR1121 versions supported (Use Case and FW Major.FW Minor), as returned by command GetVersion(...). Table 14-1: Revision History User Manual Date Applicable to...
Page 128
First In First Out Frequency Synthesis Frequency Shift Keying Intermediate Frequencies Interrupt Request Low-Dropout LDRO Low Data Rate Optimization LFSR Linear-Feedback Shift Register Low-Noise Amplifier LR1121 www.semtech.com 128 of 130 User Manual Rev 1.1 Semtech UM.LR1121.W.APP Mar 2023 Proprietary & Confidential...
Page 129
List of Acronyms and their Meaning (Sheet 2 of 2) Acronym Meaning Long Range Communication LoRa® the LoRa® Mark is a registered trademark of the Semtech Corporation LR-FHSS Long Range Frequency Hopping Spread Spectrum Least Significant Bit Message Integrity Code...
Page 130
Information relating to this product and the application or design described herein is believed to be reliable, however such information is provided as a guide only and Semtech assumes no liability for any errors in this document, or for the application or design described herein.
Need help?
Do you have a question about the LR1121 and is the answer not in the manual?
Questions and answers