Receive NRF24 traffic with TI CC2543/CC2544


This article describes how to configure a Texas Instruments CC2543 or CC2544 radio to receive traffic from a NRF24L01+ chipset.


  • TI CC2543/CC2544 development kit
  • 2x Arduino Uno
  • 2x Nordic Semiconductor NRF24L01+ from Amazon
  • Example code running on Arduino to send a known packet between two NRF24s.

Set up

I used the RF24 library and the included sample to send a known packet between two NRF24L01 nodes. The sample code is linked above. I basically configure it on the network address, address with, data rate as I want to mimic on the TI chips, then send a 10 byte packet with data that’s easy to find in a bitstream (0x55, 0xAA, will be alternating 010101010) since we may not capture the data aligned exactly on a byte level.

Once I had the two NRF24 nodes communicating I set up the CC2543-CC2544 DK with the SmartRF Studio 7 under Packet RX.

SmartRF Studio 7

The key to get it to capture the NRF24 traffic is in all the register settings, to make it behave like the NRF24 when it comes to sync words, packet format, etc. I’ll list out all the registry settings that are relevant here.

Register settings

Here’s the table with all register settings that match the Arduino sample above.

Register Value Description
PRF_CHAN 0x44 The RF channel. I set this to what match 2447 MHz (channel 0x2F in NRF24), but there’s another register called FREQCTRL, I’m not 100% sure which one is used
PRF_TASK_CONF.MODE 0x02 Operation mode, 0x02 means Auto mode, 9-bit header
PRF_FIFO_CONF.RX_ADDR_CONF 0x03 Just for debugging, shows the received address (1-byte) and config byte in the output. Doesn’t affect how the chipset is actually operating
PRF_PKT_CONF.ADDR_LEN 0x01 Set to 1 to capture the full 5 network address bytes from NRF24 (first 4 are handled by the 32-bit sync word)
PRF_CRC_LEN 0x02 Length of CRC. 2 bytes in my NRF24 sample. Note that the SmartRF tool will still output data that doesn’t pass CRC check, so it’s not critical that you get this right initially
PRF_CRC_INIT_2 & 3 0xFF Default values of 0xFF. This is just the initial value for the CRC calculation, and the default is correct, but I want to have it listed here for reference.
BSP_P3 0x10 For CRC calculation
BSP_P2 0x21 For CRC calculation
PRF_ADDR_ENTRY_0_0.VARLEN 0x01 Bit 4 says VARLEN (variable length), but SmartRF says it’s reserved. I didn’t test a lot with changing this value, but since the NRF24 is configured to use the Enhanced ShockBurst with variable length we should support that
PRF_ADDR_ENTRY_0_0.ENA0 0x01 Enable primary sync word (default I think)
PRF_ADDR_ENTRY_0_1.RXLENGTH 0x20 Max length to receive. I wasn’t 100% sure this was used since we wanted variable length, but 0x20 showed all my data at least
PRF_ADDR_ENTRY_0_2 0x71 Address for the 5th byte network id matching
FRMCTRL0.SW_CRC_MODE 0x01 The NRF24 includes the network address in the CRC calculation
FRMCTRL0.ENDIANNESS 0x01 Important setting, the data goes MSB first over the air
FREQCTRL 0x44 This is the setting that seems to be duplicated with PRF_CHAN. I didn’t both figuring out which is used, I just configured both to the same value.
SW3 0xAB This is the first byte in the network address as configured in the NRF24 chip
SW2 0xCD This is the second byte in the network address as configured in the NRF24 chip
SW1 0xAB This is the third byte in the network address as configured in the NRF24 chip
SW0 0xCD This is the fourth byte in the network address as configured in the NRF24 chip
MDMCTRL0.MODULATION 0x07 0x07 means GFSK 320 kHz deviation, 2 Mbps data rate
MDMCTRL0.PHASE_INVERT 0x00 Normal operation (default, but I want to have it here for reference)
MDMCTRL2.SW_BIT_ORDER 0x01 The sync word is transmitted MSB to LSB (from SYNC_WORD[31] to SYNC_WORD[0])
MDMCTRL2.PREAM_SEL 0x00 Preamble is set based on first bit in the sync word
MDMCTRL2.NUM_PREAM_BYTES 0x00 Preamble from NRF24 is always 1 byte (0x00 value)
MDMCTRL3.SYNC_MODE 0x01 Correlation value above threshold and all bits in the sync words match (lots of noise if you don’t select this option, maybe it can be used to grab unknown sync words if you know the rest of the bytes?)
SW_CONF.SW_LEN 0x00 Expect 32-bit sync words (4 bytes)


  1. Leave a comment

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: