Page 1 XBee/XBee-PRO ZigBee RF Module User Guide...
Page 2 0x98 frame. Added another ANATEL label. Trademarks and copyright Digi, Digi International, and the Digi logo are trademarks or registered trademarks in the United States and other countries worldwide. All other trademarks mentioned in this document are the property of their respective owners.
Page 3 Applicable firmware and hardware Hardware: S2C Firmware: 401x, 402x, 403x, 404x, 405x Hardware: S2D Firmware: 705x XBee/XBee-PRO ZigBee RF Modules User Guide...
Page 4 Contents Overview of the XBee ZigBee RF Module Worldwide acceptance ................What’s new in 40xx/70xx firmware .
Page 5 Operating channel ................ZigBee application layers: in depth .
Page 6 64-bit device addresses ............... . 16-bit device addresses .
Page 7 Network commissioning and diagnostics Device configuration ................Device placement .
Page 8 Design considerations for Digi drop-in networking ........
Page 9 Invoke the XBee Bootloader ..............Send a firmware image .
Page 10: Worldwide Acceptance
Manufactured under ISO 9001:2000 registered standards • XBee/XBee-PRO ZB RF Modules are optimized for use in US, Canada, Australia, Europe (XBee only) and Japan (XBee only). Contact Digi for a complete list of agency approvals What’s new in 40xx/70xx firmware •...
Page 11: Specifications
Under ZigBee, if all radios in a network have EE and EO set to 0x01, then the network key will be sent in the clear (unencrypted) at association time. Specifications Hardware specifications The following table provides the specifications for the module. Specification XBee ZigBee S2C XBee-PRO ZigBee S2C Performance Indoor/Urban Range Up to 200 ft. (60 m) Up to 300 ft. (90 m) Outdoor RF line-of-sight Range Up to 4000 ft.
Page 12 Specifications Specification XBee ZigBee S2C XBee-PRO ZigBee S2C Receiver Sensitivity -102 dBm, Boost mode -101 dBm -100 dBm, Normal mode Power Requirements Adjustable Power Supply Voltage 2.1 - 3.6 V 2.7 - 3.6 V 2.2 - 3.6 V for Programmable Version...
Page 13: Agency Approvals
Serial communications specifications Agency approvals The following table provides the agency approvals for the module. Note Legacy XBee-PRO SMT (model: PRO S2C; hardware version 21xx) has different FCC and IC IDs; see Agency certifications on page 212. XBee XBee-PRO XBee XBee-PRO Approval (Surface Mount)
Page 14: Gpio Specifications
GPIO specifications The SC2 (Serial Communication Port 2) of the Ember 357 is connected to the SPI port. Specifications Module Pin Number SPI Pins XBee (Surface Mount) XBee (Through-hole) SPI_SCLK SPI_SSEL SPI_MOSI SPI_MISO For more information on SPI operation, see the SPI section in Module operation on page 36.
Page 15: Hardware Specifications For The Programmable Variant
Hardware specifications for the programmable variant Hardware specifications for the programmable variant If the module has the programmable secondary processor, add the following table values to the specifications listed on page 8. For example, if the secondary processor is running at 20 MHz and the primary processor is in receive mode then the new current value will be I = 14 mA + 9 mA = 23 mA, where I is the runtime...
Page 16 Mechanical drawings XBee/XBee-PRO ZigBee RF Modules User Guide...
Page 17: Pin Signals For The Surface Mount Module
Pin signals for the surface mount module The drawings below show the XBee-PRO TH model. Pin signals for the surface mount module Pin # Name Direction Default State Description Ground Power Supply DOUT / DIO13 Both Output UART Data Out / GPIO DIN / CONFIG / DIO14 Both Input...
Page 18 Pin signals for the surface mount module Pin # Name Direction Default State Description Serial Peripheral Interface Attention SPI_ATTN / BOOTMODE / DIO19 Output Output Do not tie low on reset Ground SPI_CLK / DIO18 Input Input Serial Peripheral Interface Clock / GPIO SPI_SSEL / DIO 17 Input Input...
Page 19: Pin Signals For The Through-Hole Module
Pin signals for the through-hole module Pin # Name Direction Default State Description [reserved] Disabled Do Not Connect Signal Direction is specified with respect to the module Design notes for SMT RF pad modules on page 25 for details on pin connections * Refer to the Writing Custom Firmware section for instructions on using these pins if JTAG functions are needed Pin signals for the through-hole module Pin #...
Page 20: Em357 Pin Mappings
Pin signals for the through-hole module EM357 pin mappings The following table shows how the EM357 pins are used on the XBee. Note Some lines may not go to the external XBee pins in the programmable secondary processor version. XBee (SMT) XBee (TH) EM357 Pin # EM357 Pin Name...
Page 21: Design Notes
Design notes Design notes The XBee modules do not specifically require any external circuitry or specific connections for proper operation. However, there are some general design guidelines that are recommended for help in troubleshooting and building a robust design. Power supply design Poor power supply can lead to poor radio performance, especially if the supply voltage is not kept within tolerance or is excessively noisy.
Page 22 Design notes radiate perpendicular to the direction they point. Thus a vertical antenna emits across the horizon. Metal objects near the antenna cause reflections and may reduce the ability for an antenna to radiate efficiently. Metal objects between the transmitter and receiver can also block the radiation path or reduce the transmission distance, so external antennas should be positioned away from them as much as possible.
Page 23 Design notes SMT keepout area XBee/XBee-PRO ZigBee RF Modules User Guide...
Page 24 Design notes TH keepout area XBee/XBee-PRO ZigBee RF Modules User Guide...
Page 25 Design notes Design notes for SMT RF pad modules The RF Pad is a soldered antenna connection. The RF signal travels from pin 36 on the module to the antenna through an RF trace transmission line on the PCB. Note that any additional components between the module and antenna will violate modular certification.
Page 26: Module Operation For The Programmable Variant
Digi provides a bootloader that can take care of programming the processor over the air or through the serial interface. This means that over the air updates can be supported through an XMODEM protocol. The processor can also be programmed and debugged through a one wire interface BKGD (Pin 9/SMT, Pin 8/TH).
Page 27 Module operation for the programmable variant The following figure shows the programmable connections for the SMT. XBee/XBee-PRO ZigBee RF Modules User Guide...
Page 28 Module operation for the programmable variant The following illustration shows the programmable connections for the TH Module. XBee/XBee-PRO ZigBee RF Modules User Guide...
Page 29: Xbee Programmable Bootloader
XBee programmable bootloader XBee programmable bootloader Overview The XBee Programmable module is equipped with a Freescale MC9S08QE32 application processor. This application processor comes with a supplied bootloader. This section describes how to interface the customer's application code running on this processor to the XBee Programmable module's supplied bootloader. Bootloader software specifics Memory layout The illustration to the right shows the...
Page 30 XBee programmable bootloader Bootloader operation Upon reset of any kind, the execution control begins with the bootloader. If the reset cause is Power-On reset (POR), Pin reset (PIN), or Low Voltage Detect (LVD) reset (LVD) the bootloader will not jump to the application code if the override bits are set to RTS(D7)=1, DTR(D5)=0, and DIN(B0)=0. Otherwise, the bootloader writes the reset cause “NOTHING”...
Page 31 XBee programmable bootloader last page has the vector table specifically the redirected reset vector. The version string pointer and reset vector are used to determine if the application is valid. Application interrupt vector table and linker command file Since the bootloader flash region is read-only, the interrupt vector table is redirected to the region 0xF1C0 to 0xF1FD so that application developers can use hardware interrupts.
Page 32 XBee programmable bootloader extern void _Startup(void);/* _Startup located in Start08.c */ extern void vSci1Rx(void);/* sci1 rx isr */ extern short iWriteToSci1(unsigned char *); void vDummyIsr(void); #pragma CONST_SEG VECTORS void (* const vector_table[])(void) = /* Relocated Interrupt vector table vDummyIsr,/* Int.no. 0 Vtpm3ovf (at F1C0)Unassigned */ vDummyIsr, /* Int.no.
Page 33: Bootloader Menu Commands
XBee programmable bootloader Bootloader menu commands The bootloader accepts commands from both the local UART and OTA. All OTA commands sent must be Unicast with only 1 byte in the payload for each command. A response will be returned to the sender. All Broadcast and multiple byte OTA packets are dropped to help prevent general OTA traffic from being interpreted as a command to the bootloader while in the menu.
Page 34: Firmware Updates
XBee programmable bootloader Firmware updates Wired Updates A user can update their application using the bootloader in a wired configuration with the following steps: 1. Plug XBee programmable module into a suitable serial port on a PC. 2. Open a hyperterminal (or similar dumb terminal application) session with 115200 baud, no parity, and 8 data bits with one stop bit.
Page 35: Output File Configuration
XBee programmable bootloader Output file configuration BKGD programming P&E Micro provides a background debug tool that allows flashing applications on the MC9S08QE parts through their background debug mode port. By default, the Codewarrior tool produces an “ABS” output file for use in programming parts through the background debug interface.
Page 36: Serial Communications
RS-232 or USB interface board), or through a Serial Peripheral Interface, which is a synchronous interface to be described later. Two Wire serial Interface (TWI) is also available, but not supported by Digi. For information on the TWI, see the EM357 specification.
Page 37: Spi Communications
Serial communications UART data packet 0x1F (decimal number “31”) as transmitted through the RF module Example Data Format is 8-N-1 (bits - parity - # of stop bits) Serial communications depend on the two UARTs (the microcontroller's and the RF module's) to be configured with compatible settings (baud rate, parity, start bits, stop bits, data bits).
Page 38: Serial Buffers
Serial communications SPI operation When the slave select (SPI_SSEL) signal is asserted by the master, SPI transmit data is driven to the output pin (SPI_MISO), and SPI data is received from the input pin SPI_MOSI. The SPI_SSEL pin has to be asserted to enable the transmit serializer to drive data to the output signal SPI_MISO.
Page 39: Uart Flow Control
Serial communications Serial receive buffer When serial data enters the RF module through the serial port, the data is stored in the serial receive buffer until it can be processed. Under certain conditions, the module may receive data when the serial receive buffer is already full.
Page 40: Break Control
Serial communications Note If the XBee is sending data out the UART when RTS is de-asserted (set high), the XBee could send up to 5 characters out the UART or SPI port after RTS is de-asserted. Break control If break is enabled for over five seconds, the XBee will reset. Then it will boot with default baud settings into command mode.
Page 41 Serial communications • Transmitting data to multiple destinations without entering Command Mode • Receive success/failure status of each transmitted RF packet • Identify the source address of each received packet Comparing Transparent and API operation The following table compares the advantages of transparent and API modes of operation: Transparent Operation Features Simple Interface All received serial data is transmitted unless the module is in command mode.
Page 42: Modes Of Operation
Modes of operation If the above conditions do not apply (e.g. a sensor node, router, or a simple application), then transparent operation might be suitable. It is acceptable to use a mixture of devices running API mode and transparent mode in a network.
Page 43: Receive Mode
Modes of operation Successful Transmission 16-bit Network Idle Mode Route Known? Transmit Data Address Known? Transmission 16-bit Network Route Discovery Address Discovery 16-bit Network Route Discovered? Address Discovered? Data Discarded When data is transmitted from one node to another, a network-level acknowledgment is transmitted back across the established route to the source node.
Page 44 Modes of operation • No characters sent for one second [GT (Guard Times) parameter = 0x3E8] • Input three plus characters (“+++”) within one second [CC (Command Sequence Character) parameter = 0x2B.] • No characters sent for one second [GT (Guard Times) parameter = 0x3E8] Once the AT command mode sequence has been issued, the module sends an “OK\r”...
Page 45: Sleep Mode
Modes of operation [OR] 2. If no valid AT Commands are received within the time specified by CT (Command Mode Timeout) Command, the RF module automatically returns to Idle Mode. Note For an example of programming the RF module using AT Commands and descriptions of each configurable parameter, see Command reference tables on page 188.
Page 46: Introduction To Zigbee
ZigBee networks Introduction to ZigBee ZigBee is an open global standard built on the IEEE 802.15.4 MAC/PHY. ZigBee defines a network layer above the 802.15.4 layers to support advanced mesh routing capabilities. The ZigBee specification is developed by a growing consortium of companies that make up the ZigBee Alliance.
Page 47: Zigbee Networking Concepts
ZigBee networking concepts A description of each layer appears in the following table: ZigBee Layer Description Defines the physical operation of the ZigBee device including receive sensitivity, channel rejection, output power, number of channels, chip modulation, and transmission rate specifications. Most ZigBee applications operate on the 2.4 GHz ISM band at a 250kb/s data rate.
Page 48 ZigBee networking concepts In ZigBee networks, the coordinator must select a PAN ID (64-bit and 16-bit) and channel to start a network. After that, it behaves essentially like a router. The coordinator and routers can allow other devices to join the network and can route data.
Page 49: Operating Channel
ZigBee stack that are not required in many cases. Skip this section if • The XBee does not need to interoperate or talk to non-Digi ZigBee devices • The XBee simply needs to send data between devices Read this section if •...
Page 50: Application Profiles
Alliance has defined a ZigBee Cluster Library (ZCL) that contains definitions or various general use clusters that could be implemented in any profile. XBee modules implement various clusters in the Digi private profile. In addition, the API can be used to send or receive messages on any cluster ID (and profile ID or endpoint). See Explicit Addressing ZigBee Command frame on page 149 for details.
Page 51: Zigbee Coordinator Operation
ZigBee Coordinator operation ZigBee Device Profile Profile ID 0x0000 is reserved for the ZigBee Device Profile. This profile is implemented on all ZigBee devices. Device Profile defines many device and service discovery features and network management capabilities. Endpoint 0 is a reserved endpoint that supports the ZigBee Device Profile. This endpoint is called the ZigBee Device Objects (ZDO) endpoint.
Page 52: Persistent Data
ZigBee Coordinator operation Persistent data Once a coordinator has started a network, it retains the following information through power cycle or reset events: • PAN ID • Operating channel • Security policy and frame counter values • Child table (end device children that are joined to the coordinator). •...
Page 53: Permit Joining
ZigBee Coordinator operation Command Description Sets the permit-join time on the coordinator, measured in seconds. Enables the Associate LED functionality. Sets the Associate LED blink time when joined. Default is 1 blink per second. If any of the command values in the network formation commands table changes, the coordinator will leave its current network and start a new network, possibly on a different channel.
Page 54: Replacing A Coordinator (Security Disabled Only)
ZigBee Coordinator operation • Change the ID command such that the current 64-bit PAN ID is invalid • Change the SC command such that the current channel (CH) is not included in the channel mask • Change the ZS or any of the security command values (excluding NK) •...
Page 55: Example: Starting A Coordinator
ZigBee Router operation Note II is the initial 16-bit PAN ID. Under certain conditions, the ZigBee stack can change the 16-bit PAN ID of the network. For this reason, the II command cannot be saved using the WR command. Once II is set, the coordinator leaves the network and starts on the 16-bit PAN ID specified by II.
Page 56: Joining A Network
ZigBee Router operation • Has the correct stack profile (ZS command) • Is allowing joining If a valid PAN is not found, the router performs the PAN scan on the next channel in its scan channels list and continues scanning until a valid network is found, or until all channels have been scanned. If all channels have been scanned and a valid PAN was not discovered, all channels will be scanned again.
Page 57: Permit Joining
ZigBee Router operation Command Description Sets the 64-bit PAN ID to join. Setting ID=0 allows the router to join any 64-bit PAN ID. Set the scan channels bitmask that determines which channels a router will scan to find a valid network. SC on the router should be set to match SC on the coordinator.
Page 58: Joining Always Enabled
ZigBee Router operation Joining always enabled If NJ=0xFF (default), joining is permanently enabled. This mode should be used carefully. Once a network has been deployed, the application should strongly consider disabling joining to prevent unwanted joins from occurring. Joining temporarily enabled If NJ <...
Page 59: Leaving A Network
ZigBee Router operation If the watchdog timer expires (no valid data received for NW time), the router will attempt to discover the 64-bit address of the coordinator. If the address cannot be discovered, the router records one watchdog timeout. Once three consecutive network watchdog timeouts have expired (3 * NW) and the coordinator has not responded to the address discovery attempts, the router will leave the network and attempt to join a new network.
Page 60: Network Locator Option
End Device operation • Press the commissioning button 4 times or issue the CB command with a parameter of 4 • Issue a network leave command Note that changes to ID, SC, ZS, and security command values only take effect when changes are applied (AC or CN commands).
Page 61: Discovering Zigbee Networks
End Device operation end devices are intended to be battery powered and therefore support low power (sleep) modes, end devices cannot allow other devices to join, nor can they route data packets. Discovering ZigBee networks End devices go through the same process as routers to discover networks by issuing a PAN scan. After sending the broadcast beacon request transmission, the end device listens for a short time in order to receive beacons sent by nearby routers and coordinators on the same channel.
Page 62: Authentication
End Device operation additional end devices to join. ZigBee networks should have sufficient routers to ensure adequate end device capacity. The initial release of software on this platform supports up to 20 end devices when configured as a coordinator or a router.
Page 63: Parent Connectivity
End Device operation Command Description Sets the 64-bit PAN ID to join. Setting ID=0 allows the router to join any 64-bit PAN ID. Set the scan channels bitmask that determines which channels an end device will scan to find a valid network. SC on the end device should be set to match SC on the coordinator and routers in the desired network.
Page 64: Resetting The End Device
End Device operation Resetting the End Device When the end device is reset or power cycled, if the orphan scan successfully locates a parent, the end device then checks its PAN ID, operating channel and stack profile against the network configuration settings (ID, SC, ZS).
Page 65: Zigbee Channel Scanning
ZigBee channel scanning ZigBee channel scanning As mentioned previously, routers and end devices must scan one or more channels to discover a valid network to join. When a join attempt begins, the XBee sends a beacon request transmission on the lowest channel specified in the SC (scan channels) command bitmask.
Page 66: Application Messaging
ZigBee channel scanning Application messaging If the above mechanisms are not feasible, the application could build in a messaging framework between the coordinator and devices that join its network. For example, the application code in joining devices could send a transmission to the coordinator after joining a network, and wait to receive a defined reply message.
Page 67: Addressing
49). Application layer addressing allows data transmissions to be addressed to specific profile IDs, cluster IDs, and endpoints. Application layer addressing is useful if an application must • Interoperate with other ZigBee devices outside of the Digi application profile XBee/XBee-PRO ZigBee RF Modules User Guide...
Page 68: Data Transmission
Data transmission • use service and network management capabilities of the ZDO • Operate on a public application profile such as Home Controls or Smart Energy API mode provides a simple yet powerful interface that can easily send data to any profile ID, endpoint, and cluster ID combination on any device in a ZigBee network.
Page 69: Unicast Transmissions
Data transmission For each broadcast transmission, the ZigBee stack must reserve buffer space for a copy of the data packet. This copy is used to retransmit the packet as needed. Large broadcast packets will require more buffer space. This information on buffer space is provided for general knowledge; the user does not and cannot change any buffer spacing.
Page 70 Data transmission Address table Each ZigBee device maintains an address table that maps a 64-bit address to a 16-bit address. When a transmission is addressed to a 64-bit address, the ZigBee stack searches the address table for an entry with a matching 64-bit address, in hopes of determining the destination's 16-bit address.
Page 71: Binding Transmissions
Data transmission Binding transmissions Binding transmissions use indirect addressing to send one or more messages to other destination devices. An Explicit Addressing ZigBee Command Frame (0x11) using the Indirect Tx Option (0x04) is treated as a binding transmission request. Address resolution The source endpoint and cluster ID values of a binding transmission are used as keys to lookup matching binding table entries.
Page 72: Data Transmission Examples
Data transmission The transmit frame can include up to 255 bytes of data, which will be broken up into multiple transmissions and reassembled on the receiving side. If one or more of the fragmented messages are not received by the receiving device, the receiver will drop the entire message, and the sender will indicate a transmission failure in the Tx Status API frame.
Page 73 If the explicit transmit frame is used, the cluster ID should be set to 0x0011, the profile ID to 0xC105, and the source and destination endpoints to 0xE8 (recommended defaults for data transmissions in the Digi profile.) The same transmission could be sent using the following explicit transmit frame: 7E 00 15 11 01 0000 0000 0000 0000 FFFE E8 E8 0011 C105 00 00 31 18 Notice the 16-bit address is set to 0xFFFE.
Page 74: Rf Packet Routing
RF packet routing manufacturing specific profile message using profile ID 0xC105, command ID 0x00, a ZCL Header of 151E10, transaction number EE, and a ZCL payload of 000102030405. 7E 001E 11 e4 FFFFFFFFFFFFFFFF FFFE E7 FF 0011 C105 00 04 151E10EE000102030405 14 Note The 64 bit destination address has been set to all 0xFF values, and the destination endpoint set to 0xFF.
Page 75: Link Status Transmission
RF packet routing Link status transmission Before discussing the various routing protocols, it is worth understanding the primary mechanism in ZigBee for establishing reliable bi-directional links. This mechanism is especially useful in networks that may have a mixture of devices with varying output power and/or receiver sensitivity levels. Each coordinator or router device periodically sends a link status message.
Page 76 RF packet routing AODV routing algorithm Routing under the AODV protocol is accomplished using tables in each node that store the next hop (intermediary node between source and destination nodes) for a destination node. If a next hop is not known, route discovery must take place in order to find a path.
Page 77: Many-To-One Routing
RF packet routing destination node will transmit a route reply packet to the node that originated the route request. Intermediate nodes receive and forward the route reply packet to the source node (the node that originated route request). Sample route reply (unicast) where R6 sends a route reply to R3: Note R6 could send multiple replies if it identifies a better route.
Page 78: High/Low Ram Concentrator Mode
RF packet routing a path back to the data collector. The ZigBee stack on a device uses historical link quality information about each neighbor to select a reliable neighbor for the reverse route. When a device sends data to a data collector, and it finds a many-to-one route in its routing table, it will transmit the data without performing a route discovery.
Page 79 RF packet routing The data collector sends a many-to-one route request Route request broadcast broadcast to create reverse routes on all devices. Route reply unicast Data collector Router A remote device sends an RF data packet to the data collector. After obtaining a source route, the data collector sends a This is prefaced by a route record transmission to the data source routed transmission to the remote device.
Page 80 RF packet routing 2. The data collector can issue a network discovery command (ND command) to force all XBee devices to send a network discovery response. Each network discovery response will be prefaced by a route record. 3. Periodic IO sampling can be enabled on remotes to force them to send data at a regular rate. Each IO sample would be prefaced by a route record.
Page 81 RF packet routing Device 16-bit address 0xAABB 0xCCDD 0xEEFF Then the Create Source Route API frame would be: 7E 0012 21 00 0013A200 404A1234 EEFF 00 02 CCDD AABB 5C Where: 0x0012 - length 0x21 - API ID (create source route) 0x00 - frame ID (set to 0 always) 0x0013A200 404A1234 - 64-bit address of R3 (destination) 0xEEFF - 16-bit address of R3 (destination)
Page 82: Encrypted Transmissions
Encrypted transmissions Disabling MTO routing To disable MTO (many-to-one) routing in a network, first reconfigure the AR setting on the aggregator and then broadcast a network wide power reset (0x08 of the RE command) to rebuild the routing tables. 1. Set AR on the aggregator to 0xFF. 2.
Page 83: Maximum Rf Payload Size
Maximum RF payload size Maximum RF payload size The NP command returns the maximum payload size in bytes. The actual maximum payload is a function of: • message type (broadcast or unicast) • AP setting • APS encryption option • source-routing.
Page 84: Throughput
Throughput Hops Maximum encrypted payload Maximum unencrypted payload Throughput Throughput in a ZigBee network can vary by a number of variables, including: number of hops, encryption enabled/disabled, sleeping end devices, failures/route discoveries. Our empirical testing showed the following throughput performance in a robust operating environment (low interference). Data throughput Configuration Data Throughput...
Page 85: Latency Timing Specifications
Latency timing specifications Configuration Data Throughput RR = router to router RE = router to end device (non-sleeping) ER = end device (non-sleeping) to router SD = security disabled SE = security enabled 4 hops = 5 nodes total, 3 intermediate router nodes 1.
Page 86: Sending A Zdo Command
ZDO transmissions Refer to the ZigBee specification for a detailed description of all ZigBee Device Profile services. Sending a ZDO command To send a ZDO command, an explicit transmit API frame must be used and formatted correctly. The source and destination endpoints must be set to 0, and the profile ID must be set to 0.
Page 87 ZDO transmissions 0x00 - Required payload for LQI request command 0xCE - Checksum (0xFF - SUM (all bytes after length)) Description This API frame sends a ZDO LQI request (neighbor table request) to a remote device to obtain data from its neighbor table.
Page 88: Transmission Timeouts
Transmission timeouts Transmission timeouts The ZigBee stack includes two kinds of transmission timeouts, depending on the nature of the destination device. For destination devices such as routers whose receiver is always on, a unicast timeout is used. The unicast timeout estimates a timeout based on the number of unicast hops the packet should traverse to get data to the destination device.
Page 89: Transmission Examples
Transmission timeouts (50 * NH) + (1.2 * SP) This timeout includes the packet buffering timeout (1.2 * SP) and time to account for routing through the mesh network (50 * NH). If an acknowledgment is not received within this time, the sender will resend the transmission up to two more times.
Page 90 Transmission timeouts known, the 64-bit address of 0 could be replaced with the coordinator's 64-bit address, and the 16-bit address could be set to 0. Example 2: send a broadcast API data transmission that all devices can receive (including sleeping end devices), with payload “TxData”. API frame 7E 0014 10 01 00000000 0000FFFF FFFE 00 00 54 78 44 61 74 61 AD Field composition...
Page 91 Transmission timeouts Setting AO=1 is required for the XBee to use the explicit receive API frame (0x91) when RF data packets are received. This is required if the application needs indication of source or destination endpoint, cluster ID, and/or profile ID values used in received ZigBee data packets.
Page 92: Security Modes
ZigBee Security ZigBee supports various levels of security that can be configured depending on the needs of the application. Security provisions include: • 128-bit AES encryption • Two security keys that can be preconfigured or obtained during joining • Support for a trust center •...
Page 93: Frame Counter
ZigBee security model Packets are encrypted and authenticated using 128-bit AES. This is shown in the figure below. Frame counter The network header of encrypted packets includes a 32-bit frame counter. Each device in the network maintains a 32-bit frame counter that is incremented for every transmission. In addition, devices track the last known 32-bit frame counter for each of its neighbors.
Page 94: Network Layer Encryption And Decryption
ZigBee security model Network layer encryption and decryption Packets with network layer encryption are encrypted and decrypted by each hop in a route. When a device receives a packet with network encryption, it decrypts the packet and authenticates the packet. If the device is not the destination, it then encrypts and authenticates the packet, using its own frame counter and source address in the network header section.
Page 95: Aps Link Keys
ZigBee security model APS link keys There are two kinds of APS link keys – trust center link keys and application link keys. A trust center link key is established between a device and the trust center, where an application link key is established between a device and another device in the network where neither device is the trust center.
Page 96: Forming And Joining A Secure Network
Implementing security on the XBee Forming and joining a secure network The coordinator is responsible for selecting a network encryption key. This key can either be preconfigured or randomly selected. In addition, the coordinator generally operates as a trust center and must therefore select the trust center link key.
Page 97: Setting The Aps Trust Center Link Key
Implementing security on the XBee Setting the APS Trust Center Link Key The coordinator must also select the trust center link key, using the KY command. If KY=0 (default), the coordinator will select a random trust center link key (not recommended). Otherwise, if KY is set greater than 0, this value will be used as the pre-configured trust center link key.
Page 98: Xbee Security Examples
XBee security examples coordinator and routers in the network down for about 10 seconds, and will likely cause the 16-bit PAN ID and 16- bit addresses of the devices to change. XBee security examples This section covers some sample XBee configurations to support different security modes. Several AT commands are listed with suggested parameter values.
Page 99 XBee security examples d. WR (save networking parameters to preserve them through power cycle) 3. Read the AI setting on the coordinator and joining devices until they return 0 (formed or joined a network). In this example, EE, ID, and KY are set the same on all devices. Since NK was set to 0 on the coordinator, a random network key was selected.
Page 100: Device Configuration
Network commissioning and diagnostics Network commissioning is the process whereby devices in a mesh network are discovered and configured for operation. The XBee modules include several features to support device discovery and configuration. In addition to configuring devices, a strategy must be developed to place devices to ensure reliable routes. To accommodate these requirements, the XBee modules include various features to aid in device placement, configuration, and network diagnostics.
Page 101: Rssi Indicators
Device discovery Network discovery The network discovery command can be used to discover all Digi modules that have joined a network. Issuing the ND command sends a broadcast node discovery command throughout the network. All devices that receive the command will send a response that includes the device’s addressing information, node identifier string (see NI...
Page 102: Zdo Discovery
The ZigBee Device Profile includes provisions to discover devices in a network that are supported on all ZigBee devices (including non-Digi products). These include the LQI Request (cluster ID 0x0031) and the Network Update Request (cluster ID 0x0038). The LQI Request can be used to read the devices in the neighbor table of a remote device, and the Network Update Request can be used to have a remote device do an active scan to discover all nearby ZigBee devices.
Page 103: Commissioning Pushbutton
Commissioning Pushbutton and Associate LED Commissioning Pushbutton The commissioning pushbutton definitions provide a variety of simple functions to aid in deploying devices in a network. The commissioning button functionality on pin 33 (SMT) or pin 20 (TH) is enabled by setting the D0 command to 1 (enabled by default).
Page 104: Binding
All devices that receive this transmission blink their associate pin rapidly for one second if the associate LED functionality is enabled. (D5 = 1) Binding There are three binding request messages supported by the Digi XBee firmware: End Device Bind, Bind, and Unbind. End_Device_Bind_req The End Device Bind request (ZDO cluster 0x0020) is described in the ZigBee Specification.
Page 105 Commissioning Pushbutton and Associate LED sends messages to bind the devices together. When the process is over, both devices will have entries in their binding tables which support indirect addressing of messages between their bound endpoints. R1->C End_Device_Bind_req R2->C End_Device_Bind_req R1, R2 send End_Device_Bind_req within 60 s of each other to C C matches the requests.
Page 106 Commissioning Pushbutton and Associate LED R1-<C End_Device_Bind_rsp R2-<C End_Device_Bind_rsp End Device binding sequence (removal) This example shows a correctly formatted End_Device_Bind_req (ZDO cluster 0x0020) using a Digi 0x11 Explicit API Frame: The frame as a bytelist: 7e002811010000000000000000fffe000000200000000001f2995cb5474000a21300e605c101010001020046 Same frame broken into labeled fields. Note the multibyte fields are represented in big-endian format.
Page 107: Group Table Api
The design of the Group Table API of the XBee firmware is derived from the ZCL Group Cluster 0x0006. Developers should use the Explicit API frame 0x11 addressed to the Digi Device Object endpoint (0xE6) with the Digi XBee ProfileID (0xC105) to send commands and requests to the local device.
Page 108 Commissioning Pushbutton and Associate LED ZCL_payload = “3412 04 41 42 43 44" The first two bytes is the group Id to add in little endian representation. The next byte is the string name length (00 if no string is wanted). The other bytes are the descriptive ASCII string name (“ABCD”) for the group table entry.
Page 109 Commissioning Pushbutton and Associate LED View Group The purpose of the View Group command is to get the name string which is associated with a particular endpoint and groupID. The intent of the example is to get the name string associated with the endpoint E7 and groupID 1234. The packet: Preamble = “11 01 “+LocalDevice64Addr+”FFFE E6 E7 0006 C105 00 00"...
Page 110 Commissioning Pushbutton and Associate LED API 0x8B FrameID 0x01 16DestAddr 0xFFFE Transmit Retries 0x00 Delivery Status 0x00 Discovery Status 0x00 Success Get Group Membership (1 of 2) The purpose of this first form of the Get Group Membership command is to get all the groupIDs associated with a particular endpoint.
Page 111 Commissioning Pushbutton and Associate LED capacity of the group table is unknown. The second byte is the group count (0x01). The remaining bytes are the groupIDs in little-endian representation. And here is the decoded second message, which is a Tx Status for the original command request. If the FrameId value in the original command request had been zero, or if no space was available in the transmit UART buffer, then no Tx Status message would occur.
Page 112 Commissioning Pushbutton and Associate LED ZCL_header = “09 ee 02" The first field is a frame control field which specifies a Cluster Specific command (0x01) using a Server->Client direction (0x08). The second field is a transaction sequence number which is used to associate the response with the command request.
Page 113 Commissioning Pushbutton and Associate LED RF_Data 0x09EE03003412 The response in terms of Preamble, ZCL Header, and ZCL payload: Preamble = “910013a2004047b55cfffee7e68006c10500” The packet has its endpoint values reversed from the request, and the clusterID is 0x8006 indicating a Group cluster response. ZCL_header = “09 ee 03"...
Page 114 Commissioning Pushbutton and Associate LED API 0x91 64DestAddr 0x0013A2004047B55C 16DestAddr 0xFFFE SrcEP 0xE7 DestEP 0xE6 ClusterID 0x8006 ProfileID 0xC105 Options 0x00 RF_Data 0x09ee0400 The response in terms of Preamble, ZCL Header, and ZCL payload. Preamble = “910013a2004047b55cfffee7e68006c10500” The packet has its endpoints values reversed from the request, and the clusterID is 0x8006 indicating a Group cluster response.
Page 115 Commissioning Pushbutton and Associate LED 0x8b EMBER_ZCL_STATUS_NOT_FOUND: An attempt at Get Group Membership or Remove Group could not find a matching entry in the group table A full set of status codes appears in the documentation [4]. Bibliography [1] ZigBee Cluster Library, document 075123r02, section 3.6. The following cross references all appear in the ZigBee Cluster Library document: [2] Add Group Command, section 3.6.2.2.3.
Page 116: End Device Operation
Managing End Devices ZigBee end devices are intended to be battery-powered devices capable of sleeping for extended periods of time. Since end devices may not be awake to receive RF data at a given time, routers and coordinators are equipped with additional capabilities (including packet buffering and extended transmission timeouts) to ensure reliable data delivery to end devices.
Page 117: Parent Operation
Parent operation device to enter idle mode and turn its receiver off when RF data is not expected in order to reduce current consumption and conserve battery life. The end device can only send data directly to its parent. If an end device must send a broadcast or a unicast transmission to other devices in the network, it sends the message directly to its parent and the parent performs any necessary route or address discoveries to route the packet to the final destination.
Page 118: Packet Buffer Usage
Non-Parent device operation Packet buffer usage Packet buffer usage on a router or coordinator varies depending on the application. The following activities can require use of packet buffers for up to several seconds: • Route and address discoveries • Application broadcast transmissions •...
Page 119: Pin Sleep
XBee End Device configuration Once the module enters sleep mode, the On/Sleep pin (pin 26/SMT, pin13/TH) is de-asserted (low) to indicate the module is entering sleep mode. If CTS hardware flow control is enabled (D7 command), the CTS pin (pin 25/SMT, pin 12/TH) is de-asserted (high) when entering sleep to indicate that serial data should not be sent to the module.
Page 120 XBee End Device configuration The following figure shows the XBee TH pin sleep pins. The following figure show the pin sleep waveforms. In the figure above, t and t represent the following events: • - Time when Sleep_RQ is asserted (high) •...
Page 121: Cyclic Sleep
XBee End Device configuration Demonstration of pin sleep Parent and remote devices must be configured to buffer data correctly and to use adequate transmission timeouts. See XBee Router/Coordinator configuration on page 128 for details. Cyclic sleep Cyclic sleep allows the module to sleep for a specified time and wake for a short time to poll its parent for any buffered data messages before returning to sleep again.
Page 122 XBee End Device configuration The following figures shows the XBee S2C TH cyclic sleep pins. The following figure shows the cyclic sleep waveforms. In the figure above, t1, t2, and t3 represent the following events: • T1 - Time when the module wakes from cyclic sleep •...
Page 123 XBee End Device configuration ST = Time Awake On/Sleep A cyclic sleep end device enters sleep mode when no serial or RF data is received for ST time . Legend On/Sleep Transmitting Poll Request Sleep period The sleep period is configured based on the SP, SN, and SO commands. The following table lists the behavior of these commands.
Page 124 XBee End Device configuration On/Sleep On/Sleep (SN = 3) (SN = 1) ∆t = SP * SN ∆t = SP * SN Transmitting poll request to parent Transmitting poll request to parent ∆t = SP ∆t = SP Setting SN > 1 allows the XBee to silently poll for data without asserting On /Sleep. If RF data is received when polling, On/Sleep will immediately assert .
Page 125: Recommended Sleep Current Measurements
XBee End Device configuration Deep sleep There are preconditions for maintaining low current draw during sleep: • You must maintain the supply voltage within a valid operating range (2.1 to 3.6 V for the XBee, 3.0 to 3.6 V for the XBee-PRO (S2), 2.7 to 3.
Page 126: Transmitting Rf Data
XBee End Device configuration Internal pin pull-ups can pull excess current and cause the sleep current readings to be higher than desired if you drive or float the pull-ups. Disable all pull-ups for input lines that have a low driven state during sleep. Enable pull-ups for floating lines or inputs that do not connect to other circuitry.
Page 127: I/O Sampling
XBee End Device configuration is started (serial or RF data is received). If the sleep timer is started, the end device will continue to poll every 100 ms until the sleep timer expires. This firmware includes an adaptive polling enhancement where, if an end device receives RF data from its parent, it sends another poll after a very short delay to check for more data.
Page 128: Xbee Router/Coordinator Configuration
XBee Router/Coordinator configuration To enable rejoining, NJ should be set less than 0xFF on the device that will join. If NJ < 0xFF, the device assumes the network is not allowing joining and first tries to join a network using rejoining. If multiple rejoining attempts fail, or if NJ=0xFF, the device will attempt to join using association.
Page 129: Transmission Timeout
Putting it all together Transmission timeout As mentioned in Transmission, addressing, and routing on page 67, when sending RF data to a remote router, since routers are always on, the timeout is based on the number of hops the transmission may traverse. This timeout it settable using the NH command;...
Page 130 Sleep examples SP = 0x7D0 (2000 decimal). This causes the end device to sleep for 20 seconds since SP is measured in units of 10ms. SN = 3. (With this setting, the On/Sleep pin will assert once every 3 sleep cycles, or when RF data is received) SO = 0 All router and coordinator devices on the network should set SP to match SP on the end device.
Page 131 Sleep examples IR = 0x800 (send 1 IO sample after waking). At least one analog or digital IO sample should be enabled for IO sampling. With these settings, the end device will wake after 4 minutes and send 1 IO sample. It will then remain awake for 2 seconds before returning to sleep.
Page 132: Analog And Digital I/O Lines
Analog and digital I/O lines XBee ZB firmware supports a number of analog and digital I/O pins that are configured through software commands. Analog and digital I/O lines can be set or queried. The following table lists the configurable I/O pins and the corresponding configuration commands.
Page 133: Xbee Zb Through-Hole Rf Module
I/O configuration Module Pin Names Module Pin AT Command Command Range AD2/DIO2 0, 2-5 PTI_En/AD1/DIO1 0, 2-6 AD0/DIO0/Comm XBee ZB through-hole RF module Module Pin Names Module Pin AT Command Command Range DIO13/DOUT 0, 1, 3-5 DIO14/DIN/nCONFIG 0, 1, 3-5 DIO12/PWM2/SWDIO/SPI_MISO 0, 1, 3-5 DIO10/PWM RSSI/DAC0...
Page 134: I/O Sampling
I/O sampling Pin Command Parameter Description Data in monitored. (See below) Data out default low Data out default high RS485 enable low / packet trace interface RS485 enable high >7 Unsupported When the pin command parameter is a 0 or a 3, it operates the same on this platform, except that the pin will not be monitored by I/O sampling if the parameter is 0.
Page 135 I/O sampling Bytes Name Description Sample Sets Number of sample sets in the packet. (Always set to 1.) Digital Channel Indicates which digital IO lines have sampling enabled. Each bit corresponds to one digital IO Mask line on the module. bit 0 = AD0/DIO0 bit 1 = AD1/DIO1 bit 2 = AD2/DIO2...
Page 136: Queried Sampling
I/O sampling The sampled data set will include 2 bytes of digital I/O data only if one or more I/O lines on the device are configured as digital I/O. If no pins are configured as digital IO, these 2 bytes will be omitted. Pins are configured as digital I/O by setting them to a value of 3, 4, or 5.
Page 137: Change Detection Sampling
RSSI PWM A sleeping end device will transmit periodic IO samples at the IR rate until the ST timer expires and the device can resume sleeping. Change detection sampling Modules can be configured to transmit a data sample immediately whenever a monitored digital I/O pin changes state.
Page 138: Pwm1
PWM1 With a total of 2400 counts, this yields an ON time of (1124 / 2400) = 46.8% Example 3: configure the RSSI/PWM pin to operate for 2 seconds after each received RF packet First, ensure the RSSI/PWM functionality is enabled by reading the P0 (P-zero) command. It should be set to 1 (default).
Page 139: Api Frame Specifications
Data Frame. Note that Digi may add new API frames to future versions of firmware, so build into your software interface the ability to filter out additional API frames with unknown Frame Types.
Page 140 API frame specifications API Operation - with Escape Characters (AP parameter = 2) This mode is only available on the UART, not on the SPI serial port. When this API mode is enabled (AP = 2), the UART data frame structure is defined as the following figure shows. The figure illustrates the UART data frame structure with escape control characters.
Page 141 API frame specifications The cmdID frame (API-identifier) indicates which API messages will be contained in the cmdData frame (Identifier-specific data). Note that multi-byte values are sent big endian.The XBee modules support the following API frames: API Frame Names API ID 0x08 AT Command 0x09...
Page 142: Api Examples
API frame specifications API examples Example: create an API AT command frame to configure an XBee to allow joining (set NJ to 0xFF). The frame should look like: 0x7E 0x00 0x05 0x08 0x01 0x4E 0x4A 0xFF 5F Where 0x0005 = length 0x08 = AT Command API frame type 0x01 = Frame ID (set to non-zero value) 0x4E4A = AT Command ('NJ')
Page 143: Api Serial Port Exchanges
API serial port exchanges 0x03 = Command Parameter (the parameter could also be sent as 0x0003 or 0x00000003) 0x70 = Checksum API serial port exchanges AT commands The following image shows the API frame exchange that takes place at the serial port when sending an AT command request to read or set a module parameter.
Page 144: Source Routing
Supporting the API Source routing The following image shows the API frame exchanges that take place at the serial port when sending a source routed transmission. Supporting the API Applications that support the API should make provisions to deal with new API frames that may be introduced in future releases.
Page 145: Api Frames
API frames void XBee_HandleRxAPIFrame(_apiFrameUnion *papiFrame){ switch(papiFrame->api_id){ case RX_RF_DATA_FRAME: //process received RF data frame break; case RX_IO_SAMPLE_FRAME: //process IO sample frame break; case NODE_IDENTIFICATION_FRAME: //process node identification frame break; default: //Discard any other API frame types that are not being used break;...
Page 146: At Command - Queue Parameter Value
API frames Frame Fields Offset Example Description Parameter If present, indicates the requested parameter value to set the given Value register. (optional) If no characters present, register is queried. Checksum 0x0D 0xFF - the 8 bit sum of bytes from offset 3 to this byte. The above example illustrates an AT command when querying an NJ value.
Page 147: Zigbee Transmit Request
API frames ZigBee Transmit Request Frame Type: 0x10 A Transmit Request API frame causes the module to send data as an RF packet to the specified destination. The 64-bit destination address should be set to 0x000000000000FFFF for a broadcast transmission (to all devices).
Page 148 API frames Frame Fields Offset Example Description Frame ID 0x01 Identifies the serial port data frame for the host to correlate with a subsequent ACK (acknowledgment). If set to 0, no response is sent. 64-bit MSB 5 0x00 Set to the 64-bit address of the destination device. The Destination following addresses are also supported: 0x13...
Page 149: Explicit Addressing Zigbee Command Frame
API frames Example: The example above shows how to send a transmission to a module where escaping is disabled (AP=1) with destination address 0x0013A200 40014011, payload “TxData1B”. If escaping is enabled (AP=2), the frame should look like: 0x7E 0x00 0x16 0x10 0x01 0x00 0x7D 0x33 0xA2 0x00 0x40 0x0A 0x01 0x27 0xFF 0xFE 0x00 0x00 0x54 0x78 0x44 0x61 0x74 0x61 0x30 0x41 0x7D 0x33 The checksum is calculated (on all non-escaped bytes) as [0xFF - (sum of all bytes from API frame type through data payload)].
Page 150 API frames Frame Fields Offset Example Description Start Delimiter 0x7E Length MSB 1 0x00 Number of bytes between the length and the checksum LSB 2 0x1A Frame-specific Frame Type 0x11 Data Frame ID 0x01 Identifies the serial port data frame for the host to correlate with a subsequent ACK (acknowledgment).
Page 151 API frames Frame Fields Offset Example Description Transmit 0x00 Bitfield of supported transmission options. Supported values Options include the following: 0x01 - Disable retries 0x04- Indirect Addressing 0x08- Multicast Addressing 0x20 - Enable APS encryption (if EE=1) 0x40 - Use the extended transmission timeout for this destination Enabling APS encryption decreases the maximum number of RF payload bytes by 4 (below the value reported by NP).
Page 152: Remote At Command Request
API frames Remote AT Command Request Frame Type: 0x17 Used to query or set module parameters on a remote device. For parameter changes on the remote device to take effect, changes must be applied, either by setting the apply changes options bit, or by sending an AC command to the remote.
Page 153: Create Source Route
API frames Frame Fields Offset Example Description AT Command 0x42 (B) Name of the command Frame-specific 0x48 (H) data Command 0x01 If present, indicates the requested parameter value to set the Parameter given register. If no characters present, the register is queried. Checksum 0xF5 0xFF - the 8 bit sum of bytes from offset 3 to this byte.
Page 154 API frames Frame Fields Offset Example Description 16-bit MSB 13 0x33 Set to the 16-bit address of the destination device, if known. Set to Destination 0xFFFE if the address is unknown, or if sending a broadcast. LSB 14 0x44 Network Address Route 0x00...
Page 155: At Command Response
API frames AT Command Response Frame Type: 0x88 In response to an AT Command message, the module will send an AT Command Response message. Some commands will send back multiple frames (for example, the ND (Node Discover) command). Frame Fields Offset Example Description Start Delimiter...
Page 156: Modem Status
API frames Modem Status Frame Type: (0x8A) RF module status messages are sent from the module in response to specific conditions. The following API frame is returned when an API coordinator forms a network. Frame Fields Offset Example Description Start Delimiter 0x7E Length MSB 1...
Page 157: Zigbee Transmit Status
API frames ZigBee Transmit Status Frame Type: 0x8B When a TX Request is completed, the module sends a TX Status message. This message will indicate if the packet was transmitted successfully or if there was a failure. Frame Fields Offset Example Description Start Delimiter 0x7E...
Page 158: Zigbee Receive Packet
API frames ZigBee Receive Packet Frame Type: (0x90) When the module receives an RF packet, it is sent out the serial port using this message type. Frame Fields Offset Example Description Start Delimiter 0x7E Length MSB 1 0x00 Number of bytes between the length and the checksum LSB 2 0x11 Frame Type...
Page 159: Zigbee Explicit Rx Indicator
API frames Suppose a device with a 64-bit address of 0x0013A200 40522BAA, and 16-bit address 0x7D84 sends a unicast data transmission to a remote device with payload “RxData”. If AO=0 on the receiving device, it would send the above example frame out its serial port. ZigBee Explicit Rx Indicator Frame Type:0x91 When the modem receives a ZigBee RF packet it is sent out the serial port using this message type (when AO=1).
Page 160 API frames Frame Fields Offset Example Description Source 0xE0 Endpoint of the source that initiated the transmission Endpoint Destination 0xE0 Endpoint of the destination the message is addressed to. Endpoint Cluster ID 0x22 Cluster ID the packet was addressed to. 0x11 Profile ID 0xC1...
Page 161: Zigbee Io Data Sample Rx Indicator
API frames ZigBee IO Data Sample Rx Indicator Frame Type: 0x92 When the module receives an I/O sample frame from a remote device, it sends the sample out the serial port using this frame type (when AO=0). Only modules running in API mode will send I/O samples out the serial port. Frame Fields Offset Example...
Page 162 API frames Frame Fields Offset Example Description Analog Sample 0x02 If the sample set includes any analog input lines (Analog Channel Mask > 0), each enabled analog input returns a 2-byte value Frame-specific 0x25 indicating the A/D measurement of that input. Analog samples are Data ordered sequentially from AD0/DIO0 to AD3/DIO3, to the supply voltage.
Page 163: Xbee Sensor Read Indicator
API frames XBee Sensor Read Indicator Frame Type: 0x94 When the module receives a sensor sample (from a Digi 1-wire sensor adapter), it is sent out the serial port using this message type (when AO=0). Frame Fields Offset Example Description...
Page 164 API frames Frame Fields Offset Example Description A/D Values 0x00 Indicates a two-byte value for each of four A/D sensors (A, B, C, D) 0x02 Set to 0xFFFFFFFFFFFFFFFF if no A/Ds are found. 0x00 0xCE 0x00 Frame-specific Data 0xEA 0x00 0x52 Temperature 0x01...
Page 165: Node Identification Indicator
API frames Relative H = (161.2903 * ((1.64/4.68) - 0.16)) = 161.2903 * (0.19043) = 30.71% True H = (30.71 / (1.0546 - (0.00216 * 22.625))) = (30.71 / 1.00573) = 30.54% Node Identification Indicator Frame Type: 0x95 This frame is received when a module transmits a node identification message to identify itself (when AO=0). The data portion of this frame is similar to a network discovery response frame (see ND command).
Page 166 2 = Frame sent after joining event occurred (see JN command). 3 = Frame sent after power cycle event occurred (see JN command). Digi Profile ID 0xC1 Set to Digi's application profile ID. 0x05 Manufacturer ID 33 0x10 Set to Digi's Manufacturer ID.
Page 167: Remote Command Response
API frames Remote Command Response Frame Type: 0x97 If a module receives a remote command response RF data frame in response to a Remote AT Command Request, the module will send a Remote AT Command Response message out the serial port. Some commands may send back multiple frames--for example, Node Discover (ND) command.
Page 168: Extended Modem Status
API frames Frame Fields Offset Example Description Command Data 0x40 Register data in binary format. If the register was set, then this field is not returned. Frame-specific 0x52 Data 0x2B 0xAA Checksum 0xF0 0xFF - the 8 bit sum of bytes from offset 3 to this byte. If a remote command is sent to a remote device with 64-bit address 0x0013A200 40522BAA and 16-bit address 0x7D84 to query the SL command, and if the frame ID=0x55, the response is shown in the example API frame in the table above.
Page 169 API frames Status code descriptions The following table describes the various Verbose Join trace messages in the order of their Status Code. The AT Mode String column shows the string which will appear if Verbose Join is run in AT Command Mode. The Description column gives a fuller explanation of what a particular message means.
Page 170 API frames Status Data AT Mode Status Code String Description Data Description 0x03 Joined Joined - Coordinator “Formed:”, Router/End Device “Joined” 0x04 Beacon Data received from a ZS[stackProfile](1) See ZS in Command reference tables Response neighboring node in page 188. response to a beacon extendedPanId(8) 64 bit PAN Identifier for network...
Page 171 API frames Status Data AT Mode Status Code String Description Data Description 0x0A Beacon Saved This beacon response is a radioChannel(1) channel number ranging from 11 to 26 suitable candidate for an (0x0B to 0x1A) association request. radioTxPower(1) low level signed byte value for transmit power, values range from 0xC9 to 0x05 inclusive panid(2)
Page 172 API frames Status Data AT Mode Status Code String Description Data Description 0x16 Reset for DC80 With DC80 enabled, reset if no joinable beacon responses are received within 60s of joining. 0x18 ScanCh Scanning on Channel radioChannel(1) channel number ranging from 11 to 26 (0x0B to 0x1A) 0x19 Scan Mode...
Page 173: Over-The-Air Firmware Update Status
API frames ...applying changes to the configuration V AI - Searching for Parent:FF ...search has started V AI - Searching for Parent:FF ...and started again V Scanning:03FFF800 ...Channels 11 through 25 are enabled by the SC setting for the Active Search. V Beacon Rsp:0000000000000042A6010B949AC8FF ...ZS(0), extendedPanId(00000000000042A6), allowingJoin(1), radiochannel(0x0B), panid(949A), rssi(C8), lqi(FF) V Reject ID...
Page 174 API frames Frame Fields Offset Example Description Frame Type 0xA0 64-bit Source MSB 4 0x00 The address of the remote radio returning this response. (remote) 0x13 Address 0xA2 0x00 0x40 0x3E 0x07 LSB 11 0x50 16-bit 0x00 16-bit address of the updater device Destination 0x00 Address...
Page 175: Route Record Indicator
API frames If a query returns a 0x51 (QUERY) status, then the target's bootloader is not active and will not respond to query messages. Route Record Indicator Frame Type: 0xA1 The route record indicator is received whenever a device sends a ZigBee route record command. This is used with many-to-one routing to create source routes for devices in a network.
Page 176: Many-To-One Route Request Indicator
API frames Frame Fields Offset Example Description Address n 0xAA Two bytes per 16-bit address. Frame-specific (neighbor of Data 0xBB source) Checksum 0x80 0xFF - the 8 bit sum of bytes from offset 3 to this byte. Suppose device E sends a route record that traverses multiple hops en route to data collector device A as shown below.
Page 177: Sending Zigbee Device Objects (Zdo) Commands With The Api
Sending ZigBee Device Objects (ZDO) commands with the API Frame Fields Offset Example Description Frame Type 0xA3 64-bit Source MSB 4 0x00 64-bit address of the device that sent the many-to-one route request Address 0x13 0xA2 0x00 Frame-specific 0x40 Data 0x40 0x11 LSB 11...
Page 178 Sending ZigBee Device Objects (ZDO) commands with the API ZDO Command Cluster ID 0x0006 Match Descriptor Request 0x0031 Mgmt LQI Request 0x0032 Mgmt Routing Request 0x0034 Mgmt Leave Request 0x0036 Mgmt Permit Joining Request 0x0038 Mgmt Network Update Request The Explicit Transmit API frame (0x11) is used to send ZigBee Device Objects commands to devices in the network.
Page 179 Sending ZigBee Device Objects (ZDO) commands with the API Frame Fields Offset Example Description Start Delimiter 0x7E Length MSB 1 0x00 Number of bytes between the length and the checksum LSB 2 0x17 Frame Type 0x11 Frame ID 0x01 Identifies the serial port data frame for the host to correlate with a subsequent transmit status.
Page 180: Sending Zigbee Cluster Library (Zcl) Commands With The Api
Sending ZigBee Cluster Library (ZCL) commands with the API Frame Fields Offset Example Description Broadcast 0x00 Sets the maximum number of hops a broadcast Radius transmission can traverse. If set to 0, the transmission radius will be set to the network maximum hops value.
Page 181 Sending ZigBee Cluster Library (ZCL) commands with the API Command (Command ID) Description Read Attributes (0x00) Used to read one or more attributes on a remote device. Read Attributes Response (0x01) Generated in response to a read attributes command. Write Attributes (0x02) Used to change one or more attributes on a remote device.
Page 182 Sending ZigBee Cluster Library (ZCL) commands with the API Frame Fields Offset Example Description Start 0x7E Delimiter Length MSB 1 0x00 Number of bytes between the length and the checksum LSB 2 0x19 Frame Type 0x11 Frame ID 0x01 Identifies the serial port data frame for the host to correlate with a subsequent transmit status.
Page 183 Sending ZigBee Cluster Library (ZCL) commands with the API Frame Fields Offset Example Description Broadcast 0x00 Sets the maximum number of hops a Radius broadcast transmission can traverse. If set to 0, the transmission radius will be set to the network maximum hops value.
Page 184: Sending Public Profile Commands With The Api
Sending Public Profile Commands with the API Sending Public Profile Commands with the API Commands in public profiles such as Smart Energy and Home Automation can be sent with the XBee API using the Explicit Transmit API frame (0x11). Sending public profile commands with the Explicit Transmit API frame requires some formatting of the data payload field.
Page 185 Sending Public Profile Commands with the API Frame Fields Offset Example Description Source 0x41 Set to the source endpoint on the sending Endpoint device. (0x41 arbitrarily selected). Destination 0x42 Set to the destination endpoint on the Endpoint remote device. (0x42 arbitrarily selected) Cluster ID MSB 17 0x07...
Page 186 Sending Public Profile Commands with the API Frame Fields Offset Example Description Issuer Event ID 26 0x78 4-byte unique identifier. Note the 4-byte ID is sent in little endian 0x56 byte order (0x78563412). 0x34 The event ID in this example (0x12345678) was arbitrarily selected.
Page 187 Sending Public Profile Commands with the API Frame Fields Offset Example Description Heating 0x00 Requested heating set point in 0.01 Temperature degrees Celsius. 0x80 Set Point A value of 0x8000 means the set point field is not used in this event. Note the 0x80000 is sent in little endian byte order.
Page 188: Addressing Commands
Command reference tables Addressing commands Command Name and Description Parameter Range Default Destination Address High.Set/Get the upper 32 bits of 0 - 0xFFFFFFFF the 64-bit destination address. When combined with DL, it defines the 64-bit destination address for data transmission. Special definitions for DH and DL include 0x000000000000FFFF (broadcast) and 0x0000000000000000 (coordinator).
Page 189 This value will be used as the source endpoint for all data transmissions. SE is only used in transparent mode.The default value 0xE8 (Data endpoint) is the Digi data endpoint Destination Endpoint. Set/read ZigBee application 0 - 0xFF 0xE8 layer destination ID value.
Page 190: Networking Commands
0 - 0xFFFFFFFF 0xA0000 value can be used to differentiate different XBee-based devices. Digi reserves the range 0 - 0xFFFFFF. For the XBee ZB SMT module, the device type is 0xA0000. Conflict Report. The number of PAN id conflict reports...
Page 191 Networking commands Command Name and Description Parameter Range Default Maximum Unicast Hops. Set / read the maximum hops limit. This 0 - 0xFF 0x1E limit sets the maximum broadcast hops value (BH) and determines the unicast timeout. The timeout is computed as (50 * NH) + 100 ms. The default unicast timeout of 1.6 seconds (NH=0x1E) is enough time for data and the acknowledgment to traverse about 8 hops.
Page 192 Networking commands Command Name and Description Parameter Range Default Scan Channels. Set/Read the list of channels to scan. 1 - 0xFFFF [bitfield] 7FFF Coordinator - Bit field list of channels to choose from prior to starting network. Router/End Device - Bit field list of channels that will be scanned to find a Coordinator/Router to join.
Page 193 Networking commands Command Name and Description Parameter Range Default Scan Duration. Set/Read the scan duration exponent. Changes to 0 - 7 [exponent] SD should be written using WR command. Note: If channel 26 (0x8000) is enabled in the search channel mask (SC), transmit power on all channels will be capped at 3 dBm during network formation or joining.
Page 194: Security Commands
Security commands Command Name and Description Parameter Range Default Network Watchdog Timeout. Set/read the network watchdog 0 - 0x64FF 0 (disabled) timeout value. If NW is set > 0, the router will monitor [x 1 minute] communication from the coordinator (or data collector) and leave (up to over 17 days) the network if it cannot communicate with the coordinator for 3 NW periods.
Page 195: Rf Interfacing Commands
RF interfacing commands RF interfacing commands Command Name and Description Parameter Range Default Power Level. Select/Read the power level at which the RF module XBee transmits conducted power. For XBee-PRO (S2B) Power Level 4 is (boost mode disabled) calibrated and the other power levels are approximate. Calibration occurs 0 = -5 dBm every 15 seconds based on radio characteristics determined at manufacturing time, the ambient temperature, and how far off the voltage...
Page 196: Serial Interfacing (I/O) Commands
Serial interfacing (I/O) commands Serial interfacing (I/O) commands Command Name and Description Parameter Range Default API Enable. Enable API Mode. This command is ignored 0 = API-disabled when using SPI. API mode 1 is always used. (operate in transparent mode) 1 = API-enabled 2 = API-enabled (w/escaped control...
Page 197: I/O Commands
I/O commands Command Name and Description Parameter Range Default DIO7 Configuration. Select/Read options for the DIO7 line 0 = Unmonitored digital input of the RF module. 1 = CTS Flow Control 3 = Digital input 4 = Digital output, low 5 = Digital output, high 6 = RS-485 transmit enable (low enable)
Page 198 I/O commands Command Name and Description Parameter Range Default PWM1 / DIO11 Configuration. Configure options for the 0 - Unmonitored digital input DIO11 line of the RF module. 1 - Output 50% duty cycle clock at 32.787 kHz 3- Digital input, monitored 4- Digital output, default low 5- Digital output, default high DIO12 Configuration.
Page 199 I/O commands Command Name and Description Parameter Range Default AD0/DIO0 Configuration. Select/Read function for AD0/ 0 - Unmonitored digital input DIO0. 1 - Commissioning button enabled 2 - Analog input, single ended 3 - Digital input 4 - Digital output, low 5 - Digital output, high AD1/DIO1 / PTI_En Configuration.
Page 200 I/O commands Command Name and Description Parameter Range Default DIO5 / Associate Configuration. Configure options for the 0 - Unmonitored digital input DIO5 line of the RF module. 1 - Associated indication LED 3 - Digital input 4 - Digital output, default low 5 - Digital output, default high DIO8 / DTR / Slp_Rq.
Page 201 I/O commands Command Name and Description Parameter Range Default Pull-up / down direction. Set/read an internal pull-up or 0 - 0x7FFF 0x1FBF pull-down resistor for the corresponding bits in the PR command. If the bit is set, an internal pull-up resistor is used. If it is clear, an internal pull-down resistor is used.
Page 202: Diagnostics Commands
Diagnostics commands Command Name and Description Parameter Range Default Voltage Supply Monitoring. The voltage supply threshold is 0-0xFFFF set with the V+ command. If the measured supply voltage falls below or equal to this threshold, the supply voltage will be appended to the IO sample set, and bit 7 of the Analog Channel Mask will be set.
Page 203: At Command Options
AT command options Parameter Command Name and Description Range Default Hardware Version. Read the hardware version of the module.version of the 0 - 0xFFFF [read- Factory- module. This command can be used to distinguish among different hardware only] platforms. The upper byte returns a value that is unique to each module type. The lower byte indicates the hardware revision.
Page 204: Sleep Commands
Sleep commands Command Name and Description Parameter Range Default Guard Times. Set required period of silence before and after the 1 - 0x0CE4 [x 1 ms] 0x3E8 Command Sequence Characters of the AT Command Mode Sequence (max of 3.3 decimal sec) (1000d) (GT + CC + GT).
Page 205: Execution Commands
Execution commands Command Name and Description Parameter Range Default Wake Host. Set/Read the wake host timer value. If the wake host timer 0 - 0xFFFF (x 1ms) is set to a non-zero value, this timer specifies a time (in millisecond units) that the device should allow after waking from sleep before sending data out the serial port or transmitting an I/O sample.
Page 206 Execution commands Parameter Command Name and Description Range Default Software Reset. Resets module. Responds immediately with an OK status, and then performs a software reset. As of revision 4050, there is no longer a 2 second delay between command and reset, and the modem status code for this reset changes from 0x01 to 0x00 for consistency with other XBee platforms.
Page 207 Execution commands Parameter Command Name and Description Range Default Node Discover. Discovers and reports all RF modules found. The following optional 20- information is reported for each module discovered. Byte MY<CR> NI or MY value SH<CR> SL<CR> NI<CR> (Variable length) PARENT_NETWORK ADDRESS (2 Bytes)<CR>...
Page 208: Xctu Configuration Tool
Contact Digi to create a custom configuration. Design considerations for Digi drop-in networking XBee RF modules contain a variety of features that allow for interoperability with Digi's full line of Drop-in Networking products. Interoperability with other “DIN” products can offer these advantages: •...
Page 209: Xbee Bootloader
4, 10, and 29 (DIN, DTR, and RTS respectively) on the SMT, and pins 3, 9, 16 on the TH. The XCTU program can update firmware serially on the XBee. Contact Digi support for details. If an application requires custom firmware to update the XBee firmware serially, the following steps are required.
Page 210: Writing Custom Firmware
Writing custom firmware 2. Send an ASCII “1” character to initiate a firmware update 3. After sending a “1”, the EM357 waits for an XModem CRC upload of an.ebl image over the serial line at 115200 b/s. The .ebl file must be sent to the EM357 in order. If the firmware image is successfully loaded, the bootloader will output a “complete”...
Page 211: Detecting Xbee Versus Xbee-Pro
Writing custom firmware GPIO Mode GPIO_PxCFGH/L Description Open-drain output. GPIO_PxOUT controls the output. If a pull-up is required, Output (open-drain) it must be external. Alternate Output (push- Push-pull output. An on-board peripheral controls the output. pull) Alternate Output (open- Open-drain output. An on-board peripheral controls the output. If a pull-up drain) is required, it must be external.
Page 212: United States Fcc
Agency certifications United States FCC The XBee RF Modules comply with Part 15 of the FCC rules and regulations. Compliance with the labeling requirements, FCC notices and antenna usage guidelines is required. To fulfill FCC Certification, the OEM must comply with the following regulations: 1.
Page 213: Fcc Notices
IMPORTANT: The XBee and XBee-PRO RF Modules have been certified by the FCC for use with other products without any further certification (as per FCC section 2.1091). Modifications not expressly approved by Digi could void the user's authority to operate the equipment.
Page 214 Agency certifications The antennas in the tables below have been approved for use with this module. Cable loss is required when using gain antennas as shown in the tables. Digi does not carry all of these antenna variants. Contact Digi Sales for available antennas. The following table shows the antennas approved for use with the XBee ZB Surface Mount RF Module.
Page 215 Agency certifications Minimum Cable Loss/ Power Reduction/ Attenuation Required Min. Channels Part Number Type (Description) Gain Application* Separation 11-25 Channel 26 A24-W7NF Omni-directional (Fiberglass base station) 7.2 dBi Fixed A24-M7NF Omni-directional (Mag-mount base station) 7.2 dBi Fixed A24-F15NF Omni-directional (Fiberglass base station) 15.0 dBi Fixed 5.0 dB...
Page 216 Agency certifications Minimum Cable Loss/ Power Reduction/ Attenuation Required Min. Channels Part Number Type (Description) Gain Application* Separation 11-25 Channel 26 A24-Y16NF Yagi (16-element) 13.5 dBi Fixed 7.5 dB A24-Y16RM Yagi (16-element, RPSMA connector) 13.5 dBi Fixed 7.5 dB A24-Y18NF Yagi (18-element) 15.0 dBi Fixed...
Page 217 Agency certifications Minimum Cable Loss/ Power Reduction/ Attenuation Required Min. Channels Part Number Type (Description) Gain Application* Separation 11-25 Channel 26 A24-F3NF Omni-directional (Fiberglass base station) 3.0 dBi Fixed/Mobile 25 cm A24-F5NF Omni-directional (Fiberglass base station) 5.0 dBi Fixed 25 cm A24-F8NF Omni-directional (Fiberglass base station) 8.0 dBi...
Page 218 Agency certifications Minimum Cable Loss/ Power Reduction/ Attenuation Required Min. Channels Part Number Type (Description) Gain Application* Separation 11-25 Channel 26 A24-Y7NF Yagi (7-element) 9.0 dBi Fixed 3 dB A24-Y9NF Yagi (9-element) 10.0 dBi Fixed 4 dB A24-Y10NF Yagi (10-element) 11.0 dBi Fixed 5 dB...
Page 219 Agency certifications The following table shows antennas approved for use with the XBee-PRO ZB Surface Mount RF Module. Minimum Cable Loss/Power Reduction/Attenuation Required Part Number Type (Description) Gain Application* Separation Channels 11-25 Channel 26 Internal Antennas 29000313 Integral PCB antenna 0.0 dBi Fixed/Mobile 25 cm...
Page 220 Agency certifications Minimum Cable Loss/Power Reduction/Attenuation Required Part Number Type (Description) Gain Application* Separation Channels 11-25 Channel 26 A24-M7NF Omni-directional (Mag-mount base station) 7.2 dBi Fixed 0.5 dB A24-F15NF Omni-directional (Fiberglass base station) 15.0 dBi Fixed 4.7 dB 8.3 dB Panel Antennas A24-P8SF Flat Panel...
Page 221 Agency certifications The following table shows the antennas approved for use with the XBee-PRO ZB Through Hole RF Module. Minimum Cable Loss/Power Reduction/Attenuation Required Min. Part Number Type (Description) Gain Application* Separation Channels 11-25 Channel 26 Integral Antennas 29000294 Integral PCB antenna -0.5 dBi Fixed/Mobile 25 cm...
Page 222 Agency certifications Minimum Cable Loss/Power Reduction/Attenuation Required Min. Part Number Type (Description) Gain Application* Separation Channels 11-25 Channel 26 A24-M7NF Omni-directional (Mag-mount base station) 7.2 dBi Fixed A24-F15NF Omni-directional (Fiberglass base station) 15.0 dBi Fixed 2.5 dB 3.9 dB Panel Antennas A24-P8SF Flat Panel 8.5 dBi...
Page 223: Rf Exposure
The XBee ZB modules (non-PRO versions only) have been tested for use in several European countries. For a complete list, refer to www.digi.com. If the modules are incorporated into a product, the manufacturer must ensure compliance of the final product to the European harmonized EMC and low-voltage/safety standards.
Page 224: Restrictions
Digi Support. Important Note: Digi does not list the entire set of standards that must be met for each country. Digi customers assume full responsibility for learning and meeting the required guidelines for each country in their distribution market. For...
Page 225: For Xbee-Pro Zb Surface Mount
Australia (RCM/C-Tick) The integrator is responsible for its product to comply with IC ICES-003 & FCC Part 15, Sub. B -Unintentional Radiators. ICES-003 is the same as FCC Part 15 Sub. B and Industry Canada accepts FCC test report or CISPR 22 test report for compliance with ICES-003.
Page 226: Anatel (Brazil) Certification
ANATEL (Brazil) certification Contact Digi for questions related to locating a contact in Australia. ANATEL (Brazil) certification The XBee ZB RF modules (models noted below) comply with Brazil ANATEL standards in Resolution No. 506. The following information is required in the user manual for the product containing the radio and on the product...
Page 227 ANATEL (Brazil) certification XBee/XBee-PRO ZigBee RF Modules User Guide...
Page 228: Pin Mapping
Migrating from XBee through-hole to XBee surface mount modules The XBee surface mount and through-hole modules were designed to be compatible with each other and offer the same basic feature set. As indicated elsewhere in this manual, the surface mount form factor has more I/O pins. Because originally the XBee was offered only in a Through-hole form factor, we offer this section to help users migrate from the Surface Mount to the Through-hole form factor.
Page 229: Mounting
One of the important differences between the Surface Mount and the Through-hole modules is the way they mount to the PCB. Different mounting techniques are required. Digi International has designed a footprint which will allow either module to be attached to a PCB. The layout is shown below. All dimensions are in inches.
Page 230: Manufacturing Information
Mounting The round holes in the diagram are for the Through-hole design, and the semi-oval pads are for the SMT design. Pin 1 of the Through-hole design is lined up with pad 1 of the SMT design, but the pins are actually offset by one pad (see Pin Mapping above).
Page 231: Manufacturing Information
Manufacturing information The XBee is designed for surface mount on the OEM PCB. It has castellated pads to allow for easy solder attach inspection. The pads are all located on the edge of the module, so that there are no hidden solder joints on these modules.
Page 232 d. Baking is required if conditions b) or c) are not met. e. Baking is required if the humidity indicator inside the bag indicates a RH of 10% more. f. If baking is required, bake modules in trays stacked no more than 10 high for 4-6 hours at 125°C. Recommended footprint It is recommended that you use the PCB footprint shown below for surface mounting.
Page 233 Flux and cleaning It is recommended that a “no clean” solder paste be used in assembling these modules. This will eliminate the clean step and ensure unwanted residual flux is not left under the module where it is difficult to remove. In addition: •...
Page 234: Definitions
Definitions Definitions ZigBee node types Coordinator A node that has the unique function of forming a network. The coordinator is responsible for establishing the operating channel and PAN ID for an entire network. Once established, the coordinator can form a network by allowing routers and end devices to join to it.
Page 235 Definitions ZigBee node types Router A node that creates/maintains network information and uses this information to determine the best route for a data packet. A router must join a network before it can allow other routers and end devices to join to it. A router can participate in routing packets and is intended to be a mains-powered node.

This manual is also suitable for:

Xbee-pro zigbee s2c

Digi XBee ZigBee S2C User Manual

Quick Links

Related Manuals for Digi XBee ZigBee S2C

Summary of Contents for Digi XBee ZigBee S2C

This manual is also suitable for:

Table of Contents