OPERATIONAL DESCRIPTION

FCC ID: H9PL470

Operational Description

Download: PDF
FCCID_701746

71-61643-01 Rev B REV DESCRIPTION DATE Author A Initial Release Per EDR712 11/20/2003 J. Chin. B Updated part numbers for RoHS EC24058 05/04/2006 C.Klicpera Theory of Operation: Mesa Scanner Theory of Op: Mesa Scanner DOC. NO: 71-61643-01 Rev.B Page 1 of 20 Theory of Operation (Mesa RF Scanner) Symbol Confidential Unless marked otherwise, printed copies are uncontrolled Page 1 of 20

71-61643-01 Rev B Theory of Operation: Mesa Scanner 1. Purpose The purpose of this document and the respective schematic is to provide a complete description of the detailed design of the Mesa RF (a flat top derivative of the Phaser RF) scanner hardware subsystem. 2. References [1] Schematic: Mesa Scanner PCB 17-83514-01, RoHS; 17-61643-01, non-RoHS [2] Vanguard RF System Definition Document 00-09845-SD0 [3] Vanguard RF Software Functional Specification 00-09845-FS0 [4] Vanguard Microprocessor Selection Update, June 25, 1997, Tom Bianculli (Project Folder) [5] Microprocessor Update for Vanguard Project, September 19, 1997, Tom Bianculli (Project Folder) [6] Theory of Operation: Vanguard RF Base 71-36036-01 [7] Printed Circuit Board Design Techniques for EMC Compliance, Mark I. Montrose [8] Thorough tolerance analysis of a resistor divider auto-ID scheme, Kevin Cordes (Project Folder) [9] Schematic: Vanguard RF Handle PCB 17-82498-01, RoHS; 17-36035-01, non-RoHS [10] Vanguard Radio Theory of Operation (Project Folder) [11] Patent: An RF encoding scheme for UART communications Docket # [12] Patent: UART Synchronization for RF communication Docket # 748 [13] Analysis of the performance impact by processing raw radio data, Dana DeMeo (Project Folder) 3. Overview The P370 flat top (“Mesa”) scanner is a direct line extension to the P370 Phaser scanner. It is derived from the P370 by removing the keypad and display creating what is essentially a LS3070 replacement. Many parts are shared with the existing P370 line; however, a new main PCB and flex board are required to compensate for the missing display and keypad. The “flat top” of the unit is inherited from the P304 corded scanner. Section 4 details the differences between the keypad and display Phaser RF scanners and Mesa. The system is powered by a single 3.6V Lithium Ion cell, stepped up to 5V by a SEPIC DC-DC converter. The scanner contains a small PCB in the handle to hold the trigger, battery contacts and connection to external contacts. A second PCB in the head of the scanner (the main PCB) contains the DC-DC converter, the radio and the entire digital system. LEDs and beepers, the only user interface on the scanner, are located on the top as in the P304. An SE1200-family scan engine is used to provide scanning capability and is connected to the main PCB via a flex cable. The handle board is also connected to the main PCB with a flex cable. Theory of Operation (Mesa RF Scanner) Symbol Confidential Unless marked otherwise, printed copies are uncontrolled Page 2 of 20

71-61643-01 Rev B The digital system has been designed to decode 100 scan/second one dimensional data; support for 2-D symbologies is not included. References [4] and [5] detail the requirements needed to obtain the requisite 1-D performance and provides benchmark data which justifies the core architecture chosen for this design. The radio system is designed to communicate 100 feet reliably. Calculations show that using 8dBm transmit power, with –85dBm sensitivity, the radios should meet this requirement with sufficient margin. In order to achieve the highest antenna gain possible and still remain inside the scanner, an inverted-F type antenna is used. It sits high up in the front, directly above the scan engine. The center conductor and two ground pins connect to the PC board using compliant pins. The base uses a center-fed split dipole external rubber-duck antenna, with excellent gain and radiation patterns. The radios use metal covers that snap onto a metal “fence” that is soldered to the PCB. This technology allows easy shield removal to gain access to the radio components. 4. Comparing Mesa to Phaser RF Visually, the Mesa and its Phaser RF siblings are fairly similar. The major external difference is Mesa’s lack of an LCD display and keypad. The P304’s top bezel is used, with identical LED and beeper locations. Note that the metal hook bar has no embossed logo, unlike the P304. The P370 cradle and power supply are used without any changes. Internally, a new main PCB and flex board have been created. The PCB is very similar to the Phaser RF main PCB. However, leads to/from the microprocessor for the LCD and keypad have been removed. This leaves microprocessor pins 56-59 and 94 unused and floating. Subsets of the address and data buses are no longer used to drive and collect signal from the keypad, as it does not exist in Mesa. The LEDs and beeper in Mesa are different than those in Phaser RF, so the driver circuits for these elements are updated. Support for short-range and advanced long-range scan engines is retained. The ENTER key is used to wake the Phaser RF scanner from sleep and forcibly reset the unit. That functionality does not exist in Mesa, so the ENTER/ON* inputs to the wakeup and reset circuitry are eliminated. Pull-up resistors tied to Vcc are either left in place as is or added to compensate for this deletion. Microprocessor pin 9 is left floating. The new flex board design features the LED and beeper locations from P304, as well as current-limiting resistors for the LEDs. The 18-pin connector and its complementary socket on the PCB are held over from Phaser, although the cable pinout is wholly different. Mesa’s flex board pinout was arranged such that accidentally connecting a Mesa flex to a Phaser RF main PCB would not cause a dangerous situation (Vcc-ground short, etc). The opposite situation is also safe; connecting a Phaser RF flex to a Mesa main PCB will not produce deleterious effects. Aside from the aforementioned changes, main PCBs for Mesa and Phaser RF are the same. The radio, UART, SEPIC DC-DC converter, and startup circuit are identical. Reset and sleep circuits are identical save for the ENTER/ON* omission. Theory of Operation (Mesa RF Scanner) Symbol Confidential Unless marked otherwise, printed copies are uncontrolled Page 3 of 20

71-61643-01 Rev B 5. System Partitions The Vanguard memory scanner electronic design has been partitioned into eight major sub-systems: 1. The SEPIC DC-DC Converter 2. The System Core 3. The Reset Circuit 4. The Power Up/Down Circuit 5. The User Interface (trigger, beeper, and LEDs) 6. The Scan Engine 7. The A/D Monitoring Functions (low battery, battery temperature, scan engine ID) 8. The Radio Each of these eight sub-systems are discussed in detail in the following sections. 5.1 The SEPIC DC-DC Converter The external power supply chosen for the Phaser system is 9 volts ± 5%, 1 amp. This provides head room both in voltage and current. Note that since the scanner itself is a cordless RF device, it does not receive power from this 9V power supply. A plug is inserted in the bottom of the scanner, where the cable normally goes. However, the supply is used to power the base station. Since the scanner receives power from the base when inserted, the scanner’s voltage regulator still needs to accept the 9V. The LT1302 (U14) switching regulator is used in a SEPIC (Single-Ended Primary Inductance Converter) configuration. In this topology, the LT1302 can operate over an input range of 2 to 10 volts. This meets the specifications for the Lithium Ion battery (2.3 to 4.25 volts) and the external power supply (9 volts +/- 5%). R9, R12 and the reference inside U14 (1.24 volts typical) determine the regulation voltage of 5V. Note that above 8V, the regulator’s efficiency drops; however, this does not pose a problem since the power is provided from an external 9V power supply. Although the scanner is not connected to a cable, it is powered from the external power supply when in the base via the AUX_POWER connection. Note that the base uses a SEPIC Li-Ion battery charger to charge the scanner’s battery. It uses two of the six contacts on the bottom of the scanner, V_CHARGE and BATT_SENSE+. V_CHARGE connects to the battery’s positive lead via diode CR3 (on the handle PC board). The diode prevents a massive current discharge should a customer accidentally short the V_CHARGE contact to the GND contact (on the bottom of the scanner). Current is only allowed to flow into the battery, not out of it. Although the battery is charged through the diode, it’s drop does not pose a problem because the charger uses the voltage on the BATT_SENSE+ signal to measure the battery’s voltage. Since the BATT_SENSE+ contact needs to connect directly to the battery, it poses the same danger (of shorting) as the V_CHARGE. To handle this problem, MOSFET Q1 (on the handle PC board) acts as a switch to isolate the sense line from the contacts. The FET turns on only when AUX_POWER is present, which can only happen when docked in a cradle. Thus, the BATT_SENSE+ contact is electrically isolated from the battery when the scanner is not in the cradle. A diode can not be used here to isolate (as with Theory of Operation (Mesa RF Scanner) Symbol Confidential Unless marked otherwise, printed copies are uncontrolled Page 4 of 20

71-61643-01 Rev B V_CHARGE) because a diode drop in the sense line will severely affect charging. The MOSFET’s low RDS(on), coupled with the minute current in the sense line, will not affect charging, however. Refer to section 4.6 and reference [6] for further information about the charging scheme and the scanner/base interface. 5.2 The System Core The system core of the Mesa scanner consists of a Toshiba 95C061A microprocessor (U6), a 4Mbit flash memory (U8) and an SRAM that can be 32Kx8, 64Kx8, or 128Kx8 in size (U5). The 95C061A is packaged in a 100-pin MFP. The microprocessor (max freq. is 25MHz) runs at 24.800 MHz with zero wait states. The operating frequency is chosen to meet standard baud rates and decoding performance requirements (greater than 20MHz required). All baud rates are generated within 1.5% of their nominal value given crystal accuracy plus stability of 17ppm. Although the scanner is not connected to a cable, standard baud rates are required to communicate on the secondary UART channel to the base, and for flash downloading. Also, the radio synthesizer requires a reference frequency that is a multiple of 100 kHz. The CLK output (pin 25) of the 95C061A provides a square wave ¼ the frequency of the crystal. Using 24.800 MHz generates a 6.200 MHz reference frequency. The crystal (Y2) has a load capacitance of 18pF and therefore has 27pF external load capacitors (C72, C77). Note that the parallel combination of these capacitors is slightly less than 18pF because the PCB capacitance must be included. Since the 95C061A is a ROM-less part, and this design uses an 8-bit external bus (as opposed to 16 bits), the EA* pin is tied low while the AM8/16* pin is tied high. The address and data bus are completely demultiplexed so no external latches are needed to address the memory. The port pins are capable of sourcing 400µA (at 2.4v) and sinking 1.6mA (at .45v). The linear address space of the 95C061A has four chip select banks, which control the data bus size, wait states, and chip select control signals for up to four sections of memory. There are also a pair of memory address start registers and memory address mask registers for each chip select allowing a large amount of flexibility in configuring the memory map. In this design CS0* (set to two wait states) is used to address the keypad, CS1* is used to select the SRAM, and CS2* addresses the flash memory. Chip select one is active low when the SRAM is accessed, which resides from EE0000H~EFFFFFH. Chip select two is active low when addresses F00000H~FFFFFFH are accessed. During flash writes the CS2 bank control register is changed so that the flash is accessed with one wait state to ensure that the WR* signal pulse widths satisfy the flash memory timing requirements. A static timing analysis is depicted in Appendix A. The area of the memory map from 0H~7FH contains the internal registers of the microprocessor. The system has been designed to accept a 32Kx8, 64Kx8, or 128Kx8 SRAM and one 4Mbit flash memory. The memory map for the system is depicted in figure 1. Theory of Operation (Mesa RF Scanner) Symbol Confidential Unless marked otherwise, printed copies are uncontrolled Page 5 of 20

71-61643-01 Rev B FFFFFFH Mirror Image of Vector Table (256 bytes) Mirror Image of External 4Mbit Flash Memory F80000H CS2 Vector Table (256 bytes) External 4Mbit Flash Memory F00000H External RAM 32KB, 64KB, or 128KB CS1 EE0000H Unused ED00FFH Keypad (256 bytes) CS0 ED0000H Unused 000080H Internal I/O (128 bytes) 000000H Figure 1. The Mesa Scanner Memory Map Note that this memory map was designed around the fact that the vectors are located in the upper-most part of memory (defined by the microprocessor). Also, the microprocessor leaves RESET with CS2* activated for the entire address space. After leaving reset, the software immediately sets up the chip selects to reflect the memory map shown above. Here, CS2* is configured to start at F00000H. This causes a shadowing effect in the flash memory area (as shown in Figure 1). Although the flash is only 512Kbytes, the chip select is configured for 1Mbyte in length. This must be done to allow access to the vectors. The microprocessor doesn’t care if the flash is not big enough, it will address the upper-most part of memory for the vectors. This is not a problem, however, since the upper-most bits (A19-A23) simply “fall off” when the micro tries to access the vectors. Thus, addressing FFFFFFH results in a read from the highest address in the flash – where the vectors are. Using similar reasoning, all addresses read above F80000H are mirrored down to F00000 (since the 8 in F80000H corresponds to A19, a bit that does not connect to the flash). Thus, when the microprocessor reads the vectors, it accesses the upper portion of the flash. Finally, when the microprocessor accesses code (F00000H to 7FFFFFH), it reads the corresponding addresses from the flash (with the upper bits ignored). Theory of Operation (Mesa RF Scanner) Symbol Confidential Unless marked otherwise, printed copies are uncontrolled Page 6 of 20

71-61643-01 Rev B 5.3 The Reset Circuit The reset circuit consists of U3 and the surrounding circuitry and performs several key tasks: 1. Provides a power-on reset 2. Initiates a shutdown sequence if the battery voltage gets too low 3. Forces a reset if the watchdog expires 4. Holds the system in reset if VCC falls below 4.5v 5.3.1 Power On Reset The DS1708 (U3) provides a power-on reset that lasts between 130ms and 285ms once VCC passes the reset trip point which is between 4.25 and 4.5v. 5.3.2 Battery Fail Condition If voltage on the IN pin (U3-4) drops below 1.25V the NMI* pin transitions from high to low for a minimum of 200µs. The resistor divider formed by R23 and R21 divide the VIN voltage down so that when a low battery condition exists the IN input falls below 1.25V. Capacitor C51 forms a low pass filter with R23 and R21 to filter any noise from the Vin signal. Since the NMI* pin is only capable of sourcing 350uA, U7-3,4 and U10-1,2 are used to form a current buffer. The instant a battery fail condition occurs, the output of U7-4 becomes high impedance. The pull-up resistor R49 causes Q12 to saturate. This pulls the IN input to ground, latching the battery fail condition. The latching action occurs since the NMI* output cannot go high until the IN input rises above 1.25V. This cannot happen since Q12 keeps it pulled to ground. The NMI* signal controls the state of the voltage regulator. Once it becomes active (low), the voltage regulator is turned off and power is removed from the system. From this point forward, the circuit will remain latched in the battery-fail state. The only way to recover is to remove the battery and re-insert it or place the scanner in a base. Removing the battery will kill the entire system, causing the latching condition to extinguish. Inserting the scanner in the base provides aux power, which causes the regulator to turn on (see §4.5). Voltage dividers R61/R62 and R40/R18 prevent false re-triggering of U10 pin 1 & 2 and Q1 as their Vcc voltage drops (after the regulator turns off). The purpose of Q13 is discussed in §4.5. 5.3.3 The Watchdog Reset The microprocessor has a built in watchdog timer that is configured to generate a hardware reset upon overflow. The watchdog overflow time can be configured from 2.64ms to 169.13ms by setting internal registers of the microprocessor via software. By default the watchdog will not reset the microprocessor on overflow but by setting a bit in the WDMOD register it can be configured to do so. However, if this bit is flipped by a noise event or erratic program execution then a watchdog overflow will not initiate a hardware reset. However, the WDTOUT* signal (U6-31) will go low and stay low until the watchdog is cleared. Note that even after reset, the WDTOUT* signal remains low until the software executes the WDT clear sequence. During normal operation U12-13 is low (i.e., the RESET* signal is not active) and U12-12 is high causing U12-11 to be high charging C52 through R35 and CR5 in about 40ms (neglecting R93). If a watchdog overflow occurs Theory of Operation (Mesa RF Scanner) Symbol Confidential Unless marked otherwise, printed copies are uncontrolled Page 7 of 20

71-61643-01 Rev B U12-9 goes low causing U12-8 to go low discharging C52 through R53 and Q4 causing the PBRST* (U3-1, a push-button reset input) pin to go low in about 3ms. U12-1,2,3 is used as a buffer to isolate C52 from U3-1, since its input impedance is low enough to slowly drain the capacitor. Once U3-1 goes low U3-7 (RESET*) goes low and U3-8 goes high causing the system to enter reset. U3-8 is connected to U12-10 which also goes high and C52 will begin to charge through R35 and CR5 reaching with a time constant of about 40ms. This brings U3-1 high (the equivalent of releasing the push-button) and the system will come out of reset 130ms-285ms later. Thus, upon a watchdog timer expiration, the circuit behaves similar to a one-shot to reset the system. The end result: should a watchdog time-out occur, the reset circuitry provides a reset pulse to start the system over. Since the reset signal (U3-8) is fed back into its own reset circuit, monostable behavior is achieved (stable when not in reset, unstable when in reset). 5.3.4 Low VCC Reset If VCC falls below 4.5v then U3 issues a reset until the voltage comes back into regulation. In this design this should never occur since VCC is regulated to 5.0v +/- 5%. However, should this condition occur for any reason this low voltage reset condition will ensure that the scanner does not exhibit erratic behavior. 5.3.5 The State of the System While in Reset While the system is in reset, precautions have been taken to ensure that all significant signals are in the proper state. All port pins are configured as inputs with pull-ups when the system is in reset. This causes the scan engine to be off (ENGINE_ENB* is high), the beeper is off (BEEPER* is high), and both LEDs are off (LED_GREEN* and LED_RED* are high). 5.4 The Power Up/Down Circuit 5.4.1 Cold Power Up/Down Circuit The power-up circuit is contained on page one of the schematic under “startup circuit.” This circuit handles power switching between the cradle (AUX_POWER) and the battery (VBATT). If AUX_POWER is not present, pass transistor U4 is on and passes VBATT to VIN, which is then sent to the reset circuitry and DC-DC converter. If AUX_POWER is present then U4 is off and AUX_POWER is present on VIN after passing through CR1. The diode drop of CR1 is not important since a 9V power supply is used. MOSFET U4 has a very low Rds(on), which barely impacts the battery life of the product. Once the system powers down due to a battery fail condition (as presented in §4.3.2) the system can only be woken up by the removal and insertion of a battery or when placed into the cradle. Assume for now that C57 is completely discharged upon insertion of a new battery. This causes a surge of current to flow through the emitter- base junction of Q5 since C57 appears like a short until it charges up. This surge of current causes Q5 to saturate for a short period of time which turns on Q6. This pulls down the node connected to U9-1,2. Acting like a buffer, U9 drives low, turning on the SEPIC voltage regulator. As C57 charges, eventually Q5 exits saturation and cuts off. A base current in Q5 of about 0.92uA is necessary to keep the transistor from starving. Following the current loop from Vin through Q5 and C57 to ground, t − Vin − 0.7 − 200 K * Ib − Vin + Vin ( e τ ) = 0 Solving for t: Theory of Operation (Mesa RF Scanner) Symbol Confidential Unless marked otherwise, printed copies are uncontrolled Page 8 of 20

71-61643-01 Rev B 0.7 + 200 K * Ib t = −( 0.02) ln( ) Vin Using worst case values: Ib = 0.92uA, Vin = 2.75V, βsat = 50, we find that Q5 will be on for approximately 22ms. During this 22ms power-up pulse, the regulator outputs a stable Vcc and the system awakens, held in reset by the DS1708 (U3). As long as the battery is not completely dead, the NMI* output of U3 will be high. This causes Q1 to saturate, latching the voltage regulator on. As described above, after 22ms, the power-up pulse disappears. As long as Q1 turns on within this time, the scanner remains powered-up. Note that 22ms is a theoretical time for Q5 to leave saturation. In actuality, the power-up pulse lasts much longer (around 100ms) since Q5 and Q6 still cross through an active region. Also, U9 thresholds Q6’s collector voltage at 2.5V, which extends the pulse time. Having a longer pulse does not impact the performance of the startup circuit. As long as it is greater than 10ms (the time for the regulator to stabilize), it works fine. Note that U9 is a single chip AND gate. It is used because it must be powered from VIN, as opposed to Vcc. A “chicken before the egg” scenario would exist if U9 was powered from Vcc, since it is the buffer that enables the regulator. Since the battery voltage (VIN) can never fall below 2.75V, the minimum supply voltage of 2V is always satisfied for U9. Once the battery and aux power are removed, C57 begins discharging through CR3, R23 and, R21 of the U3 low battery resistor divider. After about 200ms C57 is sufficiently discharged to support another battery insertion and power-up sequence. The time it takes to physically remove the battery and re-insert it by the user exceeds this time and therefore ensures a valid power-up sequence every time a battery is inserted. If the scanner is placed in the base, AUX_POWER is present and the battery is disconnected from VIN (because of U4). At the same time Q6-2,3,4 saturates, ensuring that the LT1302 is turned on if it is not already on, allowing the scanner to be powered while in the cradle regardless of the state of the battery. In fact, if a battery is not present, the scanner will power up once placed in the cradle. 5.4.2 Low Power Mode The regulated voltage (Vcc) is not removed when the scanner is not in use unless a battery fail condition occurs, as mentioned above. Typically, the system enters a low power mode after a scan session is completed. The LT1302 continues to generate 5V but is under a very low load (much less than 200µA). The LT1302 under this type of load draws between 200µa and 300µa resulting in a total system current draw in low power mode of less than 500µA. This scheme is preferred over a cold power down because of the desire to retain LCD RAM data, general system status, and increased flexibility in low power mode exit conditions. Although the digital system draws 500µA, inefficiencies in the SEPIC regulator cause a current draw of about 1mA. The battery capacity of 1.2AH swamps out this small current draw. Once the system enters low power mode the oscillator of the microprocessor halts and all CMOS devices stop switching leaving only leakage currents on the board. The system exits sleep mode due to one of the following events: • A system reset • A transition from low to high on INT0 (U6-43) • Auxiliary power becomes available Theory of Operation (Mesa RF Scanner) Symbol Confidential Unless marked otherwise, printed copies are uncontrolled Page 9 of 20

71-61643-01 Rev B • The trigger is pulled The above list shows that 2 independent events can actually cause the scanner to exit low power mode. All these events trigger INT0 at which point the software polls several pins to determine the actual nature of the wake-up condition. As depicted in the schematic, U11 generates an interrupt when any of its inputs go low. Further, all the inputs to U11 also connect to general purpose pins on the microprocessor (for polling). 5.5 The User Interface The user interface consists of the following components: 1. Decode and Status LEDs 2. Trigger 3. Beeper 5.5.1 Decode and Status LEDs A single red and three green LEDs (signaling good decode and laser on, respectively) are surface-mounted on the flex board. Flex board resistors R1 through R4 limit LED current. On the main PCB, current is supplied from Vcc through PNP dual-transistor package Q5. Ferrite beads are placed on the main PCB in series with the leads to and from the flex for potential EMI mitigation. These may be removed and replaced with jumpers/0 Ω resistors if EMI is not a concern. The LED_RED* and LED_GREEN* signals are held high during a microprocessor reset, so no untoward LED illumination will occur. 5.5.2 Trigger The trigger is contained on the handle board and the signal is supplied to the main PCB as TRIGGER*. This signal is connected to U6-8 and U11-3 which has a pull-up keeping the TRIGGER* signal high. To add flexibility to the design, an AIM* signal is also provided, to allow a 2 position trigger switch in the future. AIM* connects to U6- 32. 5.5.3 Beeper The pair of beepers used are taken from the P304 scanner. For each beeper, two 14 Ω resistors are used to limit current. CR4 is an avalanche diode, which protects the beeper driver circuit from ESD. As with the LEDs, ferrite beads are placed on the main PCB in series with the beeper signals. When BEEPER* is low, both Q10 digital PNP BJTs turn on, turning on NPN transistors Q2 and Q7 and allowing current to flow through the beepers. The BEEPER* signal is high while the microprocessor is in reset ensuring that the beeper is off during reset and no clicking sound is heard during battery or cradle insertion. 5.6 The Scanner/Base Interface The scanner communicates with the cradle via a radio and a secondary asynchronous channel. Theory of Operation (Mesa RF Scanner) Symbol Confidential Unless marked otherwise, printed copies are uncontrolled Page 10 of 20

71-61643-01 Rev B 5.6.1 Radio Channel The interface to the radio consists of eleven signals. Three are for various power enables. RF_VCC_ENB* enables power to the radio, RF_TXV_ENB* enables power to the transmitter output stages, and RF_RXV_ENB* enables power to the receiver circuitry. Note that a fourth signal is generated by inverter U10, RF_/RXV_ENB*. This is simply the inversion of the receiver-enable signal and is used to apply power to the first amplifier stage of the transmitter. The next three, RF_SYNTH_DATA, RF_SYNTH_CLK, and RF_SYNTH_LATCH are used to serially program the frequency synthesizer on the radio. The synthesizer needs to be reprogrammed during each RF session because the PLL is used as a reference for both receive and transmit. Thus, it must change frequency by 10.7Mhz (the IF frequency) each time it switches between receive and transmit. For example, the synthesizer is programmed to 2402 MHz to transmit, after the data is transmitted the synthesizer is reprogrammed to 2412.7 MHz and set to receive to await an acknowledgment. The next signal is RF_SYNTH_REF. The RF synthesizer needs a reference clock to generate its timing and synchronization. This signal is connected to the 95C061’s CLK output pin (U6-25). This pin is a divide by four derivative of the system clock. The system clock is 24.8 MHz, making the reference clock 6.2 MHz. Setting the synthesizer’s reference divide ratio to 62 allows the RF frequency to be resolved in 100 kHz steps (6.2 MHz/62 = 100 kHz). This will provide for the 10.7 MHz difference between TX and RX frequencies. The next two signals are RF_RXD, and RF_TXD. These are the raw data signals to and from the radio. They are connected to a UART in the microprocessor (U6-11 & 12) . The baud rate used on this channel is approximately 48 kbps. This is the closest we can get to the desired 50 kbps, still have reasonable baud rates for the host, and attain the 100 kHz internal reference for the RF synthesizer. The last signal is RF_CARR_SENS. This signal originates from a comparator on the radio’s RSSI line. It provides an indication about the received RF signal’s strength. It is used to alert the micro that the receiver senses a strong carrier signal. So far this signal has not proved to be sensitive enough to be used reliably as an indicator of RF data. (It’s threshold is approximately –40dBm, the receiver’s sensitivity is approximately –80 dBm) 5.6.2 Secondary Channel The scanner communicates with the base microprocessor via the secondary asynchronous channel. Two of the six pins that make contact when the scanner is inserted in the base, TXD_SECONDARY, RXD_SECONDARY, comprise the secondary channel. These signals connect a UART in the base microprocessor to a UART in the scanner microprocessor. The scanner can be in any state (battery charged, battery dead, battery not installed) when placed in the cradle. Regardless of its state, the scanner must let the base know that it is present so that AUX_POWER is switched on by the base and battery charging may begin. The TXD signal originating from the base’s microprocessor normally remains idle, which is a logic 1. When the scanner is inserted into the base, this +5V is looped back on the receive line of the base’s secondary channel. When the scanner is placed in the cradle R27 loops RXD_SECONDARY back to TXD_SECONDARY regardless of the condition of the battery in the scanner. Components CR6, Q3, and Q11-2,3,4 ensure that the scanner is not back-powered by the voltages on the communication contacts. After the base senses the presence of the scanner via the loop back mechanism it turns on AUX_POWER which causes Theory of Operation (Mesa RF Scanner) Symbol Confidential Unless marked otherwise, printed copies are uncontrolled Page 11 of 20

71-61643-01 Rev B Q11-1,5,6 to become saturated enabling the secondary transmit line which drives through R46 and CR6 and sinks through Q11-2,3,4. Further details regarding hardware associated with the base station can be found in reference [6]. The pin-out of the six scanner/base contacts are designed to be compatible with the Vanguard Memory design. Thus, if a memory scanner is placed in an RF base (or visa versa), no hardware damage will occur. Note that the systems will not function properly, however. 5.7 Scan Engine Interface The Mesa scanner will make use of the SE1200 family of scan engines utilizing the MERCI ASIC. A ten pin interface is used, where VCC is always connected to the engine. When the ENGINE_ENB* signal is in the high state, GAIN_LIMIT and LASER_ENB* can be in either the high or low state since precautions have been taken on the scan engine side to allow for active control inputs when the engine is in the off state. The CONFIG1 and CONFIG2 signals must be held in the low state, however, to prevent the scan engine from back-powering. 5.8 The A/D Converter Monitoring Functions The 95C061A microprocessor has four A/D conversion channels, all of these channels are used in this design. The A/D converter has 10 bits of resolution with a maximum conversion error of +/- 4 LSBs. The reference for the A/D converter is setup by the 4.1v LM4040 reference (VR1) which can be switched on by software through the V_SW_CNTL* signal. The voltage reference is switchable to reduce low power mode quiescent current draw. The three voltages which are monitored are: 1. The battery voltage 2. The battery pack thermistor 3. The scan engine ID signal 5.8.1 Monitoring Battery Voltage The battery voltage is monitored on U6-21 (channel 1 of the A/D converter) to detect a low battery condition. The software performs an A/D conversion on this channel during each scan session to determine if a low battery capacity condition exists. Since the conversion error of the A/D is +/- 4 LSBs the total battery voltage error will Vref max 4.14v be: • ( conv. _ error + quan. _ error ) = • 4.5 = .018v . This allows the system to know the battery 1024 1024 voltage within ±18mv of its actual value, ignoring noise and other losses. 5.8.2 Monitoring Battery Pack Thermistor The battery pack thermistor is monitored to ensure that the battery is not operated (charged or discharged) outside of its temperature. The dynamic range of the thermistor over temperature (-20 to +60 degrees C) is about 3K to 80K. A 10K resistor, R28, is placed in series with the thermistor and connected to VR1. The node between R28 and the thermistor is fed to the A/D converter on channel 0 (U6-20). The software performs an A/D conversion on this channel each scan session to ensure that the battery pack temperature is operating within specification. Taking Theory of Operation (Mesa RF Scanner) Symbol Confidential Unless marked otherwise, printed copies are uncontrolled Page 12 of 20

71-61643-01 Rev B all sources of error into account (A/D conversion error and resistor tolerances) the system can monitor the battery pack temperature within 3 degrees Celsius. See Appendix B for a cross-reference between temperature and digital A/D conversion values. 5.8.3 Scan Engine ID There are several variants of the scan engine - some of which require unique software. The SCAN_ID signal is provided to help software differentiate among scan engine types. The SCAN_ID signal is connected to channel 3 of the A/D converter (U6-23). A resistor divider on the scan engine provides a unique voltage on the SCAN_ID pin for each scan engine variant. This allows one body of software to support multiple scan engines such as long range engines which require aim capabilities and standard engines which do not support such features. See [8] for the complete tolerance analysis on this identification system. 5.8.4 Keypad/display flex Detector The Mesa main PC board is intended to be the same for all product configurations – both with and without keypad/display. Thus, one PC board configuration must support all modes of operation, and auto-identify if a keypad/display is connected. In order to identify if a keypad/display flex is attached to the main PC board, the voltage across the green LED (which is populated on the keypad flex) is read using an A/D input of the microprocessor (U6-22). If the LED (and thus the flex) is present, approximately 2.0V is read at the A/D input. If the flex is missing, the LED_GREEN signal is unterminated. Thus, no current flows through R44, causing 5V appear at the A/D. When the system first leaves reset, the green LED is turned on for a second (to indicate power-up). At this time, the software checks the A/D and determines if the keypad/display flex is present. 5.9 Radio Refer to section 4.6.1 for details about the interconnection between the digital section and the radio. The radio used in the Vanguard design is based on the older Nomad architecture, with many improvements. It is tuned for 50Kbps operation, using 82 1Mhz channels between 2402MHz and 2483MHz. Based on the standard single conversion super-heterodyne FM digital radio design, the scanner contains transmit and receive sections designed to communicate half-duplex. A brief overview of the radio is provided here; for a detailed analysis of the circuitry, refer to [10]. Note that all radio components have been assigned reference designators greater than 300 to easily separate them from digital and analog components not in the radio section. 5.9.1 Transmit section To produce the FM signal at the desired RF channel frequency, the output from a VCO is directly modulated with the transmit data. A self-contained VCO (U310) working in conjunction with the RF synthesizer (U307) and low pass filter U312 to form a PLL. In an attempt to lock the VCO to a certain phase and frequency, U307 provides an error voltage which becomes the VCOADJ signal. Once locked, the output of the VCO is a constant frequency. This frequency (the carrier) is set by the microprocessor via the three serial control signals Theory of Operation (Mesa RF Scanner) Symbol Confidential Unless marked otherwise, printed copies are uncontrolled Page 13 of 20

71-61643-01 Rev B (RF_SYNTH_DATA, RF_SYNTH_CLK,RF_SYNTH_LATCH). The transmit data arrives at comparator U309 via the RF_TXD signal. The comparator’s output is directly coupled to the VCO error signal. Thus, as the data switches between 1 and 0, the frequency of the VCO shifts slightly around some middle frequency (the carrier). Note that if the data contained on RF_TXD contains too many consecutive 1’s or 0’s, the PLL will have time to correct and depth of modulation reduces to zero. Thus, the radio has certain limitations on the transmit data, discussed in the a later section. Resistor R322 controls the amount of “pull” the transmit data has on the VCO, thus controlling the FM deviation (or modulation). The VCO output is passed through two stages of RF amplifiers (U305 & U308) and enters the RF switch, U302. In transmit mode, this switch is set to pass the output signal through the filter FL301 and onto the antenna. Potentiometer R335 controls the bias current into amplifier U305, which allows for adjustment of the transmit output power. The nominal output power is adjusted to 8dBm at the antenna connector. 5.9.2 Receive section The incoming RF signal arrives at the antenna and passes through a band pass filter FL301. In receive mode, the RF signal passes through two stages of high gain RF amplifiers (U303 & U304). Then it enters a mixer (U306) which down converts the signal to the IF frequency of 10.7Mhz. Note that the previously discussed VCO is used to mix with the incoming RF signal. Thus, the microprocessor sets the synthesizer (U307) to 10.7Mhz above the desired receive frequency. The IF signal then passes through FL302, a 10.7Mhz ceramic filter with a 3db bandwidth of 280Khz. Finally, the IF signal enters the FM demodulator (U311) which reduces the signal to baseband and feeds the data slicer (U309). The output signal of U309 is the received data. U312 is used to create a carrier sense signal, based on the RSSI output from the FM demodulator chip. Its output thresholds at approximately –40dBm of input power (at the antenna). Note that if no RF energy is present at the tuned channel, the data slicer will operate near the noise floor. Thus, complete random garbage will pour out of the RF_RXD signal. As mentioned previously, the microprocessor must sift through all this garbage to find a valid transmit frame. 5.9.3 Power control To conserve power, Vcc to the entire radio is controlled via the RF_VCC_ENB* signal. As shown in the schematic, this signal removes power to both receive and transmit sections by turning off Q302 (2,3,4). Further, during normal operation, only the receiver or the transmitter may be on at once (half duplex). Thus, RF_RXV_ENB*, RF_/RXV_ENB* and RF_TXV_ENB* control MOSFETs which apply power to the respective sections of the circuitry. The TXV signal is the power for all the transmitter-only components and the RXV signal is the power for all the receiver-only components. Note that the RXV* signal is only used to power the first RF output stage. This allows for phase-lock stabilization without having to actually transmit. In order to stabilize and center the PLL, a square wave must be input to the PLL for 10ms before meaningful data can be sent. Transmitting this square wave uses up a good portion of the limited transmit time the FCC allows. However, the VCO cannot properly stabilize if the input impedance of the first stage amplifier is not correct. Thus, only this stage receives power during this stabilization period. RF energy is not transmitted until the TXV signal activates, when the second stage receives power. In order to properly transmit, the software keeps both RF_RXV_ENB* and RF_TXV_ENB* signals deasserted. This turns off all receiver-only and transmitter-only components. However, the first stage amp receives power (from RXV*), along with the PLL/synthesizer (which are powered directly from Theory of Operation (Mesa RF Scanner) Symbol Confidential Unless marked otherwise, printed copies are uncontrolled Page 14 of 20

71-61643-01 Rev B SVCC). After the 10ms of square wave are complete, the software asserts RF_TXV_ENB* and begins sending data. 5.9.4 RF Data Limitations As mentioned before, the nature of the transmitted RF data is limited by the radio. In this design, the DC bias and run-rate of the data is the predominant factors in determining RF performance. DC bias is measured by subtracting the total number of 1’s from the total number of 0’s in a transmitted byte. Experiments have shown that the radio operates properly with data up to ±2 DC bias (2 more 1’s than 0’s or visa-versa). The run rate measures the maximum consecutive identical bits in a byte. It is measured by counting the maximum number of 0’s or 1’s in a row. Experiments have shown that the radio operates properly with data containing a maximum run rate of 5 (no more than five 0’s or five 1’s in a row). Should the transmitted data exceed either of these bounds, the transmitter’s PLL may lock and the data transmitted may be garbled (loss of depth of modulation). Also, the receiver’s data slicer may begin to output noise. To handle this situation, a data encoding scheme is implemented in software. Since this system uses UARTs set for 8N1 to transmit over the radio, 1 byte is always sent between a start and stop bit. Drawing out all possible combinations of these 10 bits (start, 1 byte, stop) shows that about 30% violate the restrictions. Thus, a look-up table is used to determine if the byte being sent is an “offending” one. If it is not, the byte is transmitted with no encoding. For offending bytes, a lookup table is used to map the byte to a “valid” byte. A special “flag” byte is transmitted directly before this encoded byte to inform the receiver it must decode the byte. Thus, the overall throughput cuts in half when sending encoded bytes. Luckily, the majority of the data normally transmitted (i.e. ASCII data) does not need encoding. Should the need arise to send the “flag” byte as a normal data character, it is simply sent twice. The software in the receiver expects this to happen and, thus can handle it. Refer to Appendix D and reference [11] for further information about this encoding scheme. Another problem exists when UARTs are connected directly to digital radios. If the transmitter simply begins sending data, the receiving UART cannot tell where the noise stops (from the data slicer, as explained earlier) and the valid data begins. To solve this problem, before a frame is transmitted from the transmitter’s UART, five consecutive 0’s followed by five consecutive 1’s are transmitted. This can be accomplished by sending a 0x0F using 8N1, or 0x7F using 7E1 settings; either way the same waveform is transmitted (Note that this includes start and stop bits). The key to synchronization is to let the receiving UART know where the start bit of the first byte in the data frame is. From there, synchronization is naturally maintained between the receiver and transmitter UARTs, assuming the baud rate/parity settings are identical. Refer to [12] for further details. 6. EMI and ESD Countermeasures In order to ensure proper operation of any digital system, an ample amount of EMI and power supply filtration is implemented. EMI countermeasures are components on a PC board that filter unwanted high frequency signals from power supply and signal trace. Power supply filters are components that smooth and lessen ripples and other AC components from the DC power source. Besides relying on components to reduce the effects of EMI and ESD, careful PC board design techniques are implemented. All components providing protection from ESD are depicted in the Vanguard RF Handle PCB schematic [9]. Tranzorbs (CR2) are placed on the two communication lines to the contacts on the scanner Theory of Operation (Mesa RF Scanner) Symbol Confidential Unless marked otherwise, printed copies are uncontrolled Page 15 of 20

71-61643-01 Rev B (RXD_SECONDARY and TXD_SECONDARY). AUX_POWER, BATT_SENSE+ and V_CHARGE are also connected to the contacts and are protected by tranzorbs VR2 and CR1, respectfully. To inhibit excessive ground bounce during ESD events VR1 is placed between VBATT and ground. If ground bounces very high due to an ESD event VR1 will short the event to the battery in an attempt to clamp the voltage. To reduce EMI radiated emissions, resistors R64 through R68 are placed in series with all the chip select, read and write signals. The addition of these resistors on the memory version of Vanguard (previous design) improved EMI performance considerably. The radio synthesizer requires a clock source to operate. This clock is derived from the microprocessor. The CLK pin (pin 25) outputs a square wave at 6.2Mhz. This high frequency square wave is a large source of EMI, especially because of its harmonics. Thus, FL1, a semi-felt distributed L-C filter is inserted right next to pin 25. This component removes almost all the harmonic content of the square wave, practically turning it into a sine wave. This significantly reduces the EMI. Note that this level of filtering normally cannot be done because digital signals require sharp edges. However, the radio synthesizer can work just as well with a sine wave input. As shown on the Handle PCB [9] schematic, ferrite beads are placed in series with the signals connecting to all 6 external contacts. CMOS signals are protected with 0603 ferrites, while power signals are protected with 1206 ferrites (3A rating). The worst case EMI test configuration (for the Mesa product) is when the scanner is in the base, charging. Here, there are two interconnected microprocessor systems, two radios, and cables for the power supply and host. Past experience with the memory version showed that EMI generated in the scanner propagates through the base and out the host and power supply cables. These ferrites help to minimize this EMI impact. Theory of Operation (Mesa RF Scanner) Symbol Confidential Unless marked otherwise, printed copies are uncontrolled Page 16 of 20

71-61643-01 Rev B 7. Appendix A - Static Timing Analysis at 24.800MHz Read Cycle (ns) Parameter RAM FLASH Inequality 95C061 95C061 (1-WS) Timing TRC 70-MN 90-MN <= 161.29 241.94 TAA 70-MX 90-MX <= 106.13 106.13 TACS 70-MX 90-MX <= 106.13 188.77 TOE 35-MX 50-MX <= 60.81 141.45 TOHZ (0,30) (0,23*) RANGE (0,?) (0,?) Write Cycle (ns) Parameter RAM FLASH Inequality 95C061 95C061 (1-WS) Timing TWC 70-MN x <= 161.29 241.94 TCW 65-MN x <= 101.13 181.77 TAW 65-MN x <= 81.13 161.77 TWP 55-MN 90-MN <= 60.81 141.45 TDW 35-MN 50-MN <= 40.65 121.29 TAH x 50-MN <= 60.97 141.61 TWPH x 100-MN <= 100.48 100.48 Read Cycle Parameters Trc (Read Cycle Time) - The time required between successive reads. Taa (Address Access Times) - The time from address valid to data valid. Tacs (Chip Select Access Time) - The time from chip select valid to valid data. Toe (Output Enable to Output Valid) - The time from output enable valid to valid data. Tchz (Output Disable to High-Z Output) - The time from chip select disable to high-z data output. Tohz (Output Disable to High-Z Output) - The time from output enable disable to high-z data output. Write Cycle Parameters Twc (Write Cycle Time) - The time required between successive writes. Tcw (Chip Select to Write End) - The time from chip select enable to write enable disable. Taw (Address Valid to Write End) - Address valid to write enable disable. Twp (Write Pulse Width) - The time write enable is active. Tdw (Data Setup to Write End) - The time from data valid to write enable disable. Tah (Address Hold Time) - The time from write enable to address invalid. Theory of Operation (Mesa RF Scanner) Symbol Confidential Unless marked otherwise, printed copies are uncontrolled Page 17 of 20

71-61643-01 Rev B Twph (Write Pulse Width High) - The time the write pulse width is high (disabled). 8. Appendix B - Battery Temperature A/D Digital Values Battery Thermistor A/D Analysis Temp. (degrees C) Rtmax(Kohms) Rttyp(Kohms) Rtmin(Kohms) Max. Dig. Value Min. Dig. Value -23 80.75 78.33 75.96 916 900 -19 66.44 64.57 62.74 895 878 -16 57.51 55.97 54.47 878 860 -13 49.95 48.68 47.43 859 840 -10 43.52 42.47 41.44 838 819 -7 37.92 37.06 36.21 816 797 -4 33.15 32.44 31.74 793 773 -1 29.06 28.48 27.9 768 748 2 25.52 25.03 24.56 742 722 5 22.45 22.05 21.66 715 694 8 19.81 19.48 19.16 687 667 11 17.51 17.24 16.98 658 638 14 15.5 15.28 15.06 629 609 17 13.75 13.58 13.4 599 580 20 12.24 12.09 11.95 570 551 22 11.32 11.2 11.07 550 531 25 10.1 10 9.9 521 503 28 9.043 8.944 8.845 493 474 31 8.112 8.014 7.917 465 446 34 7.288 7.192 7.096 438 419 37 6.56 6.467 6.375 412 392 40 5.918 5.827 5.738 387 367 43 5.342 5.255 5.169 363 343 46 4.832 4.749 4.666 340 320 49 4.379 4.299 4.22 318 298 52 3.972 3.896 3.821 297 277 56 3.496 3.425 3.354 271 251 60 3.087 3.02 2.954 247 228 Theory of Operation (Mesa RF Scanner) Symbol Confidential Unless marked otherwise, printed copies are uncontrolled Page 18 of 20

71-61643-01 Rev B 9. Appendix C – Microprocessor port pin definitions, operating and low-power states Masked / OTP Microprocessor Pin Number Pin Name Function Capability Operating State Power-down State Signal Name 1 TO3/P57 Timer output, I/O port Input port Output, driven low Not Connected 2 NMI* Non-Maskable Interrupt NMI* Not Programmable GND 3 DAOUT0 D/A converter 1 output 4.0 V (Vref) Not Programmable Not Connected 4 DAOUT1 D/A converter 2 output 0V Not Programmable Not Connected 5 VREF A/D converter voltage reference VREF Not Programmable 4.0 V 6 AGND A/D converter ground reference AGND Not Programmable GND 7 AN0/P60 A/D input, general input port Input port Analog Input ID_HOST 8 AN1/P61 A/D input, general input port Input port Analog Input BATT_LEVEL 9 AN2/P62 A/D input, general input port Input port Analog Input RADIO_ID 10 AN3/P63 A/D input, general input port Input port Analog Input GND 11 AN4/P64 A/D input, general input port Input port Analog Input GND 12 AN5/P65 A/D input, general input port Input port Analog Input GND 13 AN6/P66 A/D input, general input port Input port Analog Input GND 14 AN7/P67 A/D input, general input port Input port Analog Input GND 15 VCC Vcc Vcc Not Programmable VCC 16 RXD0/P70 RXD channel 0, I/O port Input port RXD0 PCE_RXD 17 TXD0/P71 TXD channel 0, I/O port Input port, pulled high TXD0 Not Connected 18 RXD1/P72 RXD channel 1, I/O port Input port RXD1 TTL_RXD 19 SCLK1/CTS1*/P73 CTS channel 1, serial clock 1, I/O port Input port CTS1* TTL_CTS 20 TXD1/P74 RXD channel 1, I/O port Input port, pulled high TXD1 TTL_TXD 21 RESET* Reset* signal RESET* Not Programmable RESET* 22 CLK Clock out CLK Not Programmable Not Connected 23 VSS (GND) Gnd Gnd Not Programmable GND 24 X1 Oscillator 1 X1 Not Programmable Crystal 25 X2 Oscillator 2 X2 Not Programmable Crystal 26 EA* External Addressing EA* Not Programmable MASKED/FLASH* 27 RXD2/P75 RXD channel 2, I/O port Input port Outport, driven low Not Connected 28 SCLK2/P76 Serial clock 2, I/O port Input port Output port TTL_RTS 29 TXD2/P77 RXD channel 2, I/O port Input port, pulled high Output, driven low Not Connected 30 WDTOUT*/P80 Watchdog out, I/O port Pulled high Watchdog Output Not Connected 31 INT0/P81 Interrupt 0, I/O port Input port Output, driven low Not Connected 32 STBY*/P82 Hardware standby, I/O port Input port Output, driven low Not Connected 33 ALE/P83 Address Latch Enable, I/O port Pulled low Output, driven low Not Connected 34 VCC Vcc Vcc Not Programmable VCC 35 ~ 42 AD0 ~ AD7 / P00 ~ P07 AD0 - AD7, I/O ports Input ports Outputs, driven low Not Connected 43 ~ 50 A8 ~ A15 / P10 ~ P17 A8 - A15, I/O ports Input ports Outputs, driven low Not Connected 51 VSS (GND) Gnd Gnd Not Programmable GND 52 TPG00/P20 Pulse Generator, I/O port Input port Bi-directional port SYN_CLK 53 TPG01/P21 Pulse Generator, I/O port Input port Bi-directional port SYN_DATA 54 TPG02/P22 Pulse Generator, I/O port Input port Bi-directional port SYN_IBM-DATA 55 TPG03/P23 Pulse Generator, I/O port Input port Bi-directional port SYN_IBM_CLK 56 TPG04/TPG17/P24 Pulse Generator, I/O port Input port Output, driven low Not Connected 57 TPG05/TPG16/P25 Pulse Generator, I/O port Input port Output, driven low Not Connected 58 TPG06/TPG15/P26 Pulse Generator, I/O port Input port Output, driven low Not Connected 59 TPG07/TPG14/P27 Pulse Generator, I/O port Input port Input port COMMAND_MODE* 60 RD*/P30 External read, I/O port Output, driven high Output, driven high Not Connected 61 WR*/P31 External write, I/O port Output, driven high Output, driven high Not Connected 62 PWM0/P32 PWM channel 0, I/O port Input port Output, driven low Not Connected 63 PWM1/P33 PWM channel 1, I/O port Input port Output, driven low Not Connected 64 TPG10/P40 Pulse Generator, I/O port Input port Outport Port LED* 65 TPG11/P41 Pulse Generator, I/O port Input port Input Port MASKED/FLASH* 66 TPG12/P42 Pulse Generator, I/O port Input port Output, driven low HI_CHARGE 67 TPG13/P43 Pulse Generator, I/O port Input port Output, driven low CHARGE_ENABLE 68 CAP0/P44 Capture 0, I/O port Input port Output Port EE_DOUT 69 CAP1/P45 Capture 1, I/O port Input port Input Port EE_DIN 70 CAP2/P46 Capture 2, I/O port Input port Bi-directional port EE_CS 71 CAP3/P47 Capture 3, I/O port Input port Bi-directional port EE_CLK 72 EXIN/P50 External clock input, I/O port Input port Output, driven low Not Connected 73 TO4/P51 Timer output, I/O port Input port Output, driven low Not Connected 74 TO5/P52 Timer output, I/O port Input port Output, driven low Not Connected 75 VCC Vcc Vcc Not Programmable VCC 76 INT1/TI4/P53 Interrupt 1, timer input, I/O port Input port Output, driven low Not Connected 77 INT2/TI5/P54 Interrupt 2, timer input, I/O port Input port Output, driven low Not Connected 78 VSS (GND) Gnd Vcc Not Programmable GND 79 WAIT*/TO1/P55 Wait, timer output, I/O port Input port Timer 1 BEEPER* 80 INT3/TI2/P56 Interrupt 3, timer input, I/O port Input port Output, driven low Not Connected Theory of Operation (Mesa RF Scanner) Symbol Confidential Unless marked otherwise, printed copies are uncontrolled Page 19 of 20

71-61643-01 Rev B 10. Appendix D: RF Encoding Table Data(hex) Mapping New DC Bias New Run Rate Data(hex) Mapping New DC Bias New Run Rate 0x0 0x0f 0 4 0x80 0x6c 0 3 0x1 0x17 0 3 0x81 0x71 0 3 0x2 0x1b 0 3 0x82 0x72 0 3 0x3 0x1d 0 3 0x84 0x74 0 3 0x4 0x1e 0 4 0x88 0x78 0 4 0x5 0x27 0 3 0x90 0x87 0 4 0x6 0x2b 0 2 0x9F 0x8b 0 3 0x7 0x2d 0 2 0xA0 0x8d 0 3 0x8 0x2e 0 3 0xAA 0xd1 0 3 0x9 0x33 0 2 0xaf 0x2a -2 2 0x0A 0x35 0 2 0xb7 0x32 -2 2 0x0C 0x36 0 2 0xbb 0x49 -2 2 0x0D 0x39 0 3 0xbd 0x4a -2 2 0x10 0x3a 0 3 0xBE 0x8e 0 3 0x11 0xf0 0 5 0xBF 0x93 0 2 0x12 0xd8 0 4 0xC0 0x95 0 2 0x14 0xe8 0 4 0xCA 0xd4 0 3 0x18 0x3c 0 4 0xCB 0xd2 0 3 0x20 0x47 0 3 0xcf 0x52 -2 2 0x21 0xe2 0 4 0xd0 0x5b 2 2 0x22 0x25 -2 2 0xd7 0x6b 2 2 0x24 0x26 -2 2 0xdb 0x6d 2 2 0x28 0x4b 0 2 0xDD 0x96 0 2 0x30 0x4d 0 2 0xDE 0x99 0 2 0x3F 0x4e 0 3 0xDF 0x9a 0 2 0x40 0x53 0 2 0xe7 0x92 -2 2 0x41 0x55 0 1 0xEB 0x9c 0 3 0x42 0x56 0 2 0xED 0xa3 0 3 0x44 0xe1 0 4 0xEE 0xa5 0 2 0x48 0xe4 0 4 0xEF 0xa6 0 2 0x50 0x59 0 2 0xf1 0x9b 2 2 0x5F 0x5a 0 2 0xF3 0xa9 0 2 0x60 0x5c 0 3 0xF4 0xab 2 2 0x6F 0x63 0 3 0xF5 0xac 0 3 0x77 0x29 -2 2 0xF6 0xb1 0 3 0x7B 0x65 0 2 0xF7 0xb2 0 2 0x7D 0x66 0 2 0xf8 0xad 2 2 0x7E 0x69 0 2 0xF9 0xb4 0 3 0x7F 0x6a 0 2 0xFA 0xb8 0 4 0xFB 0xc3 0 4 0xFC 0xc5 0 3 0xFD 0xc6 0 3 0xFE 0xc9 0 3 0xFF 0xcc 0 3 Theory of Operation (Mesa RF Scanner) Symbol Confidential Unless marked otherwise, printed copies are uncontrolled Page 20 of 20


Document Created: 2006-05-09 16:15:19
Document Modified: 2006-05-09 16:15:19
© 2024 FCC.report
This site is not affiliated with or endorsed by the FCC