CC1101 Sub-GHz Transceiver Guide: Configuration & Diagnostics

Core Technical Specifications

center Freq 300–348, 387–464, 779–928 MHz (3 bands)

modulation OOK / ASK / 2-FSK / 4-FSK / GFSK / MSK

data Encoding Configurable: Manchester, NRZ, 4/8 whitening

operating Range 50–500 m (depends on config and antenna)

antenna External via SMA or wire, frequency-dependent

tx Power Up to +12 dBm (varies by frequency)

bandwidth 58–812 kHz (configurable)

channel Spacing Programmable (25–400 kHz typical)

Real-World Devices & Applications

Multi-Protocol Tools

Flipper Zero (sub-GHz capture/replay/emulate)
Custom ISM-band transceivers
AMR (Automatic Meter Reading) equipment
Proprietary sensor networks
RC control links

Replacement for Fixed-Frequency Modules

Replaces dedicated 315/433/868/915 MHz modules
Frequency-agile applications
Multi-region products (same hardware, different config)

Reference Circuits & Schematics

CC1101 Module Wiring

The CC1101 communicates via 4-wire SPI. SmartRF Studio (TI) generates optimal register configurations for target frequency, modulation, and data rate.

Pin	Description
`VCC`	1.8–3.6V supply (3.3V recommended)
`GND`	Ground
`SCLK`	SPI Clock
`MOSI (SI)`	SPI data in
`MISO (SO)`	SPI data out / GDO1
`CSn`	SPI Chip Select (active LOW)
`GDO0`	Configurable digital output (sync word, CRC, FIFO)
`GDO2`	Configurable digital output
`ANT`	50Ω antenna (matched to operating frequency)

Circuit Walk-Through

The CC1101 is a universal sub-GHz transceiver. Configure via SPI registers for: carrier frequency (300–928 MHz), modulation type (OOK/FSK/GFSK/MSK), data rate (0.6–500 kbps), RX bandwidth, deviation, sync word, packet format, and TX power. Use SmartRF Studio to calculate register values from desired parameters. The GDO pins can be configured to signal various events (packet received, CRC OK, FIFO status) via interrupts.

Signal Structure & Waveform Analysis

CC1101 Packet Format

The CC1101 supports both fixed and variable length packets with optional address filtering, CRC, and whitening.

Preamble

4–24 bytes

Alternating 1/0 pattern for bit sync

Sync Word

2–4 bytes

Configurable pattern for frame detection

Length

1 byte (variable mode)

Payload length in bytes

Address

1 byte (optional)

Device address for filtering

Payload

1–61 bytes

Application data (64-byte FIFO)

CRC

2 bytes

CRC-16 error detection

Timing Notes: FIFO: 64 bytes TX, 64 bytes RX. For longer packets, use FIFO threshold interrupt to stream data. WOR (Wake-on-Radio) mode enables duty-cycled listening for battery-powered nodes. The CC1101 can also operate in transparent/asynchronous mode for raw bitstream TX/RX (used by Flipper Zero for unknown protocol capture).

Analysis & Capture Tips

SmartRF Studio: enter desired params, export register config
Flipper Zero uses CC1101 in async mode for raw sub-GHz capture
Read register 0x30 (PARTNUM) and 0x31 (VERSION) to verify SPI
Check MARCSTATE register (0x35) for current radio state
Use GDO0 as CRC_OK indicator for packet-mode debugging

Bench Troubleshooting & Repair Guide

1. SPI Communication

Logic Analyser / SmartRF Studio

Read PARTNUM (0x30) = 0x00, VERSION (0x31) = 0x14 for CC1101. If wrong, check SPI wiring, voltage levels, and clock speed (≤6.5 MHz). CSn must be LOW during transaction.

2. Frequency Accuracy

Frequency Counter / Spectrum Analyser

CC1101 uses a 26 MHz crystal. Verify crystal frequency with a counter. Frequency offset can be measured and compensated via FREQOFF register. Temperature affects crystal — allow warm-up.

3. Antenna Mismatch

NanoVNA

The CC1101 covers 300–928 MHz — no single antenna covers all bands. Match antenna to operating frequency. Use a NanoVNA to verify SWR. A poor match at 868 MHz doesn’t mean it’s poor at 433 MHz.

4. Modulation Configuration

URH / Audacity / SmartRF Studio

Wrong modulation/deviation/data rate settings = no decode. If capturing an unknown signal, use async mode to record raw bitstream, then analyse in Audacity or URH to determine parameters.

CC1101 Sub-GHz