Digi XBee ZigBee S2D User Manual
  1. Manuals
  2. Brands
  3. Digi Manuals
  4. Control Unit
  5. XBee ZigBee S2D
  6. User manual

Digi XBee ZigBee S2D User Manual

Hide thumbs
Table of Contents

Advertisement

Quick Links

Download this manual
XBee/XBee-PRO ZigBee RF Module
User Guide

Advertisement

Table of Contents
loading
Need help?

Need help?

Do you have a question about the XBee ZigBee S2D and is the answer not in the manual?

Questions and answers

Subscribe to Our Youtube Channel

Related Manuals for Digi XBee ZigBee S2D

Summary of Contents for Digi XBee ZigBee S2D

  • Page 1 XBee/XBee-PRO ZigBee RF Module User Guide...
  • Page 2 To view product warranties online, visit www.digi.com/howtobuy/terms. Customer support Digi offers multiple technical support plans and service packages to help our customers get the most out of their Digi product. For information on Technical Support plans and pricing, please contact us at 952.912.3456 or visit www.digi.com/support.
  • Page 3 If you have a customer account, sign in to the Customer Support Web Portal at www.digi.com/support. Applicable firmware and hardware Hardware: S2C Firmware: 401x, 402x, 403x, 404x, 405x Hardware: S2D Firmware: 705x XBee/XBee-PRO ZigBee RF Modules User Guide...

  • Page 4: Table Of Contents

    Contents Overview of the XBee ZigBee RF Module Worldwide acceptance ................Firmware release notes .
  • Page 5 ZigBee networks Introduction to ZigBee ................ZigBee stack layers .
  • Page 6 Pre-configured security keys ..............Permit joining .
  • Page 7 Setting the Network Security Key ............. . . Setting the APS Trust Center Link Key .
  • Page 8 I/O sampling ..................Queried sampling .
  • Page 9 Design considerations for Digi drop-in networking ........

  • Page 10: Overview Of The Xbee Zigbee Rf Module

    • XBee/XBee-PRO ZB RF Modules are optimized for use in US, Canada, Australia, Europe (XBee only) and Japan (XBee only). Contact Digi for a complete list of agency approvals Firmware release notes You can view the current release notes in the Firmware Explorer section of XCTU.
  • Page 11 Specifications Specification XBee ZigBee S2C XBee-PRO ZigBee S2C XBee ZigBee S2D Performance Indoor/Urban Range Up to 200 ft. (60 m) Up to 300 ft. (90 m) Up to 200 ft. (60m) Outdoor RF line-of-sight Range Up to 4000 ft. (1200 m) Up to 2 miles (3200 m) Up to 4000 ft.

  • Page 12: Agency Approvals

    Specifications Specification XBee ZigBee S2C XBee-PRO ZigBee S2C XBee ZigBee S2D Channels 11 to 26 Addressing Options PAN ID and Addresses, Cluster IDs and Endpoints (optional) Interface Options UART 1 Mb/s maximum (burst) 5 Mb/s maximum (burst) Agency approvals The following table provides the agency approvals for the module.

  • Page 13: Serial Communications Specifications

    Serial communications specifications Serial communications specifications XBee RF modules support both UART (Universal Asynchronous Receiver / Transmitter) and SPI (Serial Peripheral Interface) serial connections. UART The SC1 (Serial Communication Port 1) of the Ember 357 is connected to the UART port. The following table provides the UART pin assignments.

  • Page 14: Hardware Specifications For The Programmable Variant

    Hardware specifications for the programmable variant GPIO Electrical Specification Value Input pull-up resistor value 29 k Input pull-down resistor value 29 k Output voltage for logic 0 0.18 x VCC (maximum) Output voltage for logic 1 0.82 x VCC (minimum) Output source/sink current for pad numbers 3, 4, 5, 10, 12, 14, 15, 16, 17, 25, 26, 4 mA 28, 29, 30, and 32 on the SMT modules...
  • Page 15 Mechanical drawings The drawings below show the XBee through-hole module. XBee/XBee-PRO ZigBee RF Modules User Guide...

  • Page 16: Pin Signals For The Surface Mount Module

    Pin signals for the surface mount module The drawings below show the XBee-PRO through-hole model. Pin signals for the surface mount module Pin # Name Direction Default State Description Ground Power Supply DOUT / DIO13 Both Output UART Data Out / GPIO DIN / CONFIG / DIO14 Both Input...
  • Page 17 Pin signals for the surface mount module Pin # Name Direction Default State Description Serial Peripheral Interface Attention SPI_ATTN / BOOTMODE / DIO19 Output Output Do not tie low on reset Ground SPI_CLK / DIO18 Input Input Serial Peripheral Interface Clock / GPIO SPI_SSEL / DIO 17 Input Input...

  • Page 18: Pin Signals For The Through-Hole Module

    Pin signals for the through-hole module Pin # Name Direction Default State Description [reserved] Disabled Do Not Connect Signal Direction is specified with respect to the module Design notes for SMT RF pad modules on page 23 for details on pin connections * Refer to the Writing Custom Firmware section for instructions on using these pins if JTAG functions are needed Pin signals for the through-hole module Pin #...

  • Page 19: Em357 Pin Mappings

    Pin signals for the through-hole module EM357 pin mappings The following table shows how the EM357 pins are used on the XBee. Note Some lines may not go to the external XBee pins in the programmable secondary processor version. XBee (SMT) XBee (TH) EM357 Pin # EM357 Pin Name...

  • Page 20: Design Notes

    Design notes Design notes The XBee modules do not specifically require any external circuitry or specific connections for proper operation. However, there are some general design guidelines that are recommended for help in troubleshooting and building a robust design. Power supply design Poor power supply can lead to poor radio performance, especially if the supply voltage is not kept within tolerance or is excessively noisy.
  • Page 21 Design notes radiate perpendicular to the direction they point. Thus a vertical antenna emits across the horizon. Metal objects near the antenna cause reflections and may reduce the ability for an antenna to radiate efficiently. Metal objects between the transmitter and receiver can also block the radiation path or reduce the transmission distance, so external antennas should be positioned away from them as much as possible.
  • Page 22 Design notes Surface-mount keepout area XBee/XBee-PRO ZigBee RF Modules User Guide...
  • Page 23 Design notes Through-hole keepout area Design notes for SMT RF pad modules The RF Pad is a soldered antenna connection. The RF signal travels from pin 36 on the module to the antenna through an RF trace transmission line on the PCB. Note that any additional components between the module and antenna will violate modular certification.
  • Page 24 Design notes the ground plane. Many online tools can estimate this value, although the PCB manufacturer should be consulted for the exact width. Assuming d=0.025”, and that the dielectric has a relative permittivity of 4.4, the width in this example will be approximately 0.045" for a 50 ohm trace. This trace width is a good fit with the module footprint's 0.060"...

  • Page 25: Module Operation For The Programmable Variant

    Digi provides a bootloader that can take care of programming the processor over the air or through the serial interface. This means that over the air updates can be supported through an XMODEM protocol. The processor can also be programmed and debugged through a one wire interface BKGD (Pin 9/SMT, Pin 8/TH).
  • Page 26 Overview of the XBee ZigBee RF Module The following figure shows the programmable connections for the SMT. XBee/XBee-PRO ZigBee RF Modules User Guide...
  • Page 27 Overview of the XBee ZigBee RF Module The following illustration shows the programmable connections for the TH Module. XBee/XBee-PRO ZigBee RF Modules User Guide...

  • Page 28: Module Operation

    RS-232 or USB interface board), or through a Serial Peripheral Interface, which is a synchronous interface to be described later. Two Wire serial Interface (TWI) is also available, but not supported by Digi. For information on the TWI, see the EM357 specification.

  • Page 29: Spi Communications

    Serial communications UART data packet 0x1F (decimal number “31”) as transmitted through the RF module Example Data Format is 8-N-1 (bits - parity - # of stop bits) Serial communications depend on the two UARTs (the microcontroller's and the RF module's) to be configured with compatible settings (baud rate, parity, start bits, stop bits, data bits).

  • Page 30: Serial Buffers

    Serial communications SPI operation When the slave select (SPI_SSEL) signal is asserted by the master, SPI transmit data is driven to the output pin (SPI_MISO), and SPI data is received from the input pin SPI_MOSI. The SPI_SSEL pin has to be asserted to enable the transmit serializer to drive data to the output signal SPI_MISO.

  • Page 31: Uart Flow Control

    Serial communications Serial receive buffer When serial data enters the RF module through the serial port, the data is stored in the serial receive buffer until it can be processed. Under certain conditions, the module may receive data when the serial receive buffer is already full.

  • Page 32: Break Control

    Serial communications Note If the XBee is sending data out the UART when RTS is de-asserted (set high), the XBee could send up to 5 characters out the UART or SPI port after RTS is de-asserted. Break control If break is enabled for over five seconds, the XBee will reset. Then it will boot with default baud settings into command mode.
  • Page 33 Serial communications • Transmitting data to multiple destinations without entering Command Mode • Receive success/failure status of each transmitted RF packet • Identify the source address of each received packet Comparing Transparent and API operation The following table compares the advantages of transparent and API modes of operation: Transparent Operation Features Simple Interface All received serial data is transmitted unless the module is in command mode.

  • Page 34: Modes Of Operation

    Modes of operation If the above conditions do not apply (e.g. a sensor node, router, or a simple application), then transparent operation might be suitable. It is acceptable to use a mixture of devices running API mode and transparent mode in a network.

  • Page 35: Receive Mode

    Modes of operation Successful Transmission 16-bit Network Idle Mode Route Known? Transmit Data Address Known? Transmission 16-bit Network Route Discovery Address Discovery 16-bit Network Route Discovered? Address Discovered? Data Discarded When data is transmitted from one node to another, a network-level acknowledgment is transmitted back across the established route to the source node.
  • Page 36 Modes of operation • No characters sent for one second [GT (Guard Times) parameter = 0x3E8] • Input three plus characters (“+++”) within one second [CC (Command Sequence Character) parameter = 0x2B.] • No characters sent for one second [GT (Guard Times) parameter = 0x3E8] Once the AT command mode sequence has been issued, the module sends an “OK\r”...

  • Page 37: Sleep Mode

    Modes of operation [OR] 2. If no valid AT Commands are received within the time specified by CT (Command Mode Timeout) Command, the RF module automatically returns to Idle Mode. Note For an example of programming the RF module using AT Commands and descriptions of each configurable parameter, see Command reference tables on page 178.

  • Page 38: Zigbee Networks

    ZigBee networks Introduction to ZigBee ZigBee is an open global standard built on the IEEE 802.15.4 MAC/PHY. ZigBee defines a network layer above the 802.15.4 layers to support advanced mesh routing capabilities. The ZigBee specification is developed by a growing consortium of companies that make up the ZigBee Alliance.

  • Page 39: Zigbee Networking Concepts

    ZigBee networking concepts A description of each layer appears in the following table: ZigBee Layer Description Defines the physical operation of the ZigBee device including receive sensitivity, channel rejection, output power, number of channels, chip modulation, and transmission rate specifications. Most ZigBee applications operate on the 2.4 GHz ISM band at a 250kb/s data rate.
  • Page 40 ZigBee networking concepts In ZigBee networks, the coordinator must select a PAN ID (64-bit and 16-bit) and channel to start a network. After that, it behaves essentially like a router. The coordinator and routers can allow other devices to join the network and can route data.

  • Page 41: Pan Id

    ZigBee stack that are not required in many cases. Skip this section if • The XBee does not need to interoperate or talk to non-Digi ZigBee devices • The XBee simply needs to send data between devices Read this section if •...

  • Page 42: Application Support Sublayer (Aps)

    Alliance has defined a ZigBee Cluster Library (ZCL) that contains definitions or various general use clusters that could be implemented in any profile. XBee modules implement various clusters in the Digi private profile. In addition, the API can be used to send or receive messages on any cluster ID (and profile ID or endpoint). See Explicit Addressing ZigBee Command frame on page 139 for details.

  • Page 43: Zigbee Coordinator Operation

    ZigBee Coordinator operation The APS layer includes supports for endpoints. An endpoint can be thought of as a running application, similar to a TCP/IP port. A single device can support one or more endpoints. Each application endpoint is identified by a 1- byte value, ranging from 1 to 240.

  • Page 44: Security Policy

    ZigBee Coordinator operation Security policy The security policy determines which devices are allowed to join the network, and which device(s) can authenticate joining devices. See ZigBee Security on page 84 for a detailed discussion of various security policies. Persistent data Once a coordinator has started a network, it retains the following information through power cycle or reset events: •...

  • Page 45: Permit Joining

    ZigBee Coordinator operation These behaviors are configurable using the following commands: Command Description Sets the permit-join time on the coordinator, measured in seconds. Enables the Associate LED functionality. Sets the Associate LED blink time when joined. Default is 1 blink per second. If any of the command values in the network formation commands table changes, the coordinator will leave its current network and start a new network, possibly on a different channel.

  • Page 46: Leaving A Network

    ZigBee Coordinator operation Leaving a network There are a couple of mechanisms that will cause the coordinator to leave its current PAN and start a new network based on its network formation parameter values. These include the following: • Change the ID command such that the current 64-bit PAN ID is invalid •...

  • Page 47: Example: Starting A Coordinator

    ZigBee Router operation AT Command Description Set the 64-bit PAN ID to match the read OP value. Set the initial 16-bit PAN ID to match the read OI value. Set the scan channels bitmask to enable the read operating channel (CH command). For example, if the operating channel is 0x0B, set SC to 0x0001.

  • Page 48: Discovering Zigbee Networks

    ZigBee Router operation Discovering ZigBee networks To discover nearby ZigBee networks, the router performs a PAN (or active) scan, just like the coordinator does when it starts a network. During the PAN scan, the router sends a beacon request (broadcast) transmission on the first channel in its scan channels list.

  • Page 49: Zb Router Joining

    ZigBee Router operation ZB Router joining When the router is powered on, if it is not already joined to a valid ZigBee network, it immediately attempts to find and join a valid ZigBee network. Note The DJ command can be set to 1 to disable joining. The DJ parameter cannot be written with WR, so a power cycle always clears the DJ setting.

  • Page 50: Permit Joining

    ZigBee Router operation Permit joining The permit joining attribute on the router is configurable with the NJ command. NJ can be configured to always allow joining, or to allow joining for a short time. Joining always enabled If NJ=0xFF (default), joining is permanently enabled. This mode should be used carefully. Once a network has been deployed, the application should strongly consider disabling joining to prevent unwanted joins from occurring.

  • Page 51: Leaving A Network

    ZigBee Router operation • RF data received from the coordinator • RF data sent to the coordinator and an acknowledgment was received • Many-to-one route request was received (from any device) • Changing the value of NW If the watchdog timer expires (no valid data received for NW time), the router will attempt to discover the 64-bit address of the coordinator.

  • Page 52: Network Locator Option

    ZigBee Router operation • Issue the NR0 command to cause the router to leave. • Issue the NR1 command to send a broadcast transmission, causing all devices in the network to leave and migrate to a different channel • Press the commissioning button 4 times or issue the CB command with a parameter of 4 •...

  • Page 53: End Device Operation

    End Device operation End Device operation Similar to routers, end devices must also discover and join a valid ZigBee network before they can participate in a network. After an end device has joined a network, it can communicate with other devices on the network. Since end devices are intended to be battery powered and therefore support low power (sleep) modes, end devices cannot allow other devices to join, nor can they route data packets.

  • Page 54: End Device Capacity

    End Device operation End Device capacity Routers and coordinators maintain a table of all child devices that have joined called the child table. This table is a finite size and determines how many end devices can join. If a router or coordinator has at least one unused entry in its child table, the device is said to have end device capacity.

  • Page 55: Parent Connectivity

    End Device operation Command Description Sets the 64-bit PAN ID to join. Setting ID=0 allows the router to join any 64-bit PAN ID. Set the scan channels bitmask that determines which channels an end device will scan to find a valid network. SC on the end device should be set to match SC on the coordinator and routers in the desired network.

  • Page 56: Resetting The End Device

    End Device operation Resetting the End Device When the end device is reset or power cycled, if the orphan scan successfully locates a parent, the end device then checks its PAN ID, operating channel and stack profile against the network configuration settings (ID, SC, ZS).

  • Page 57: Zigbee Channel Scanning

    ZigBee channel scanning ZigBee channel scanning As mentioned previously, routers and end devices must scan one or more channels to discover a valid network to join. When a join attempt begins, the XBee sends a beacon request transmission on the lowest channel specified in the SC (scan channels) command bitmask.

  • Page 58: Application Messaging

    ZigBee channel scanning Application messaging If the above mechanisms are not feasible, the application could build in a messaging framework between the coordinator and devices that join its network. For example, the application code in joining devices could send a transmission to the coordinator after joining a network, and wait to receive a defined reply message.

  • Page 59: Transmission, Addressing, And Routing

    41). Application layer addressing allows data transmissions to be addressed to specific profile IDs, cluster IDs, and endpoints. Application layer addressing is useful if an application must • Interoperate with other ZigBee devices outside of the Digi application profile XBee/XBee-PRO ZigBee RF Modules User Guide...

  • Page 60: Data Transmission

    Data transmission • use service and network management capabilities of the ZDO • Operate on a public application profile such as Home Controls or Smart Energy API mode provides a simple yet powerful interface that can easily send data to any profile ID, endpoint, and cluster ID combination on any device in a ZigBee network.

  • Page 61: Unicast Transmissions

    Data transmission For each broadcast transmission, the ZigBee stack must reserve buffer space for a copy of the data packet. This copy is used to retransmit the packet as needed. Large broadcast packets will require more buffer space. This information on buffer space is provided for general knowledge; the user does not and cannot change any buffer spacing.
  • Page 62 Data transmission Address table Each ZigBee device maintains an address table that maps a 64-bit address to a 16-bit address. When a transmission is addressed to a 64-bit address, the ZigBee stack searches the address table for an entry with a matching 64-bit address, in hopes of determining the destination's 16-bit address.

  • Page 63: Binding Transmissions

    Data transmission Binding transmissions Binding transmissions use indirect addressing to send one or more messages to other destination devices. An Explicit Addressing ZigBee Command Frame (0x11) using the Indirect Tx Option (0x04) is treated as a binding transmission request. Address resolution The source endpoint and cluster ID values of a binding transmission are used as keys to lookup matching binding table entries.

  • Page 64: Data Transmission Examples

    Data transmission The transmit frame can include up to 255 bytes of data, which will be broken up into multiple transmissions and reassembled on the receiving side. If one or more of the fragmented messages are not received by the receiving device, the receiver will drop the entire message, and the sender will indicate a transmission failure in the Tx Status API frame.
  • Page 65 If the explicit transmit frame is used, the cluster ID should be set to 0x0011, the profile ID to 0xC105, and the source and destination endpoints to 0xE8 (recommended defaults for data transmissions in the Digi profile.) The same transmission could be sent using the following explicit transmit frame: 7E 00 15 11 01 0000 0000 0000 0000 FFFE E8 E8 0011 C105 00 00 31 18 Notice the 16-bit address is set to 0xFFFE.

  • Page 66: Rf Packet Routing

    RF packet routing manufacturing specific profile message using profile ID 0xC105, command ID 0x00, a ZCL Header of 151E10, transaction number EE, and a ZCL payload of 000102030405. 7E 001E 11 e4 FFFFFFFFFFFFFFFF FFFE E7 FF 0011 C105 00 04 151E10EE000102030405 14 Note The 64 bit destination address has been set to all 0xFF values, and the destination endpoint set to 0xFF.

  • Page 67: Link Status Transmission

    RF packet routing Link status transmission Before discussing the various routing protocols, it is worth understanding the primary mechanism in ZigBee for establishing reliable bi-directional links. This mechanism is especially useful in networks that may have a mixture of devices with varying output power and/or receiver sensitivity levels. Each coordinator or router device periodically sends a link status message.
  • Page 68 RF packet routing AODV routing algorithm Routing under the AODV protocol is accomplished using tables in each node that store the next hop (intermediary node between source and destination nodes) for a destination node. If a next hop is not known, route discovery must take place in order to find a path.

  • Page 69: Many-To-One Routing

    RF packet routing destination node will transmit a route reply packet to the node that originated the route request. Intermediate nodes receive and forward the route reply packet to the source node (the node that originated route request). Sample route reply (unicast) where R6 sends a route reply to R3: Note R6 could send multiple replies if it identifies a better route.

  • Page 70: High/Low Ram Concentrator Mode

    RF packet routing a path back to the data collector. The ZigBee stack on a device uses historical link quality information about each neighbor to select a reliable neighbor for the reverse route. When a device sends data to a data collector, and it finds a many-to-one route in its routing table, it will transmit the data without performing a route discovery.
  • Page 71 RF packet routing The data collector sends a many-to-one route request Route request broadcast broadcast to create reverse routes on all devices. Route reply unicast Data collector Router A remote device sends an RF data packet to the data collector. After obtaining a source route, the data collector sends a This is prefaced by a route record transmission to the data source routed transmission to the remote device.
  • Page 72 RF packet routing 2. The data collector can issue a network discovery command (ND command) to force all XBee devices to send a network discovery response. Each network discovery response will be prefaced by a route record. 3. Periodic IO sampling can be enabled on remotes to force them to send data at a regular rate. Each IO sample would be prefaced by a route record.
  • Page 73 RF packet routing Device 16-bit address 0xAABB 0xCCDD 0xEEFF Then the Create Source Route API frame would be: 7E 0012 21 00 0013A200 404A1234 EEFF 00 02 CCDD AABB 5C Where: 0x0012 - length 0x21 - API ID (create source route) 0x00 - frame ID (set to 0 always) 0x0013A200 404A1234 - 64-bit address of R3 (destination) 0xEEFF - 16-bit address of R3 (destination)

  • Page 74: Encrypted Transmissions

    Encrypted transmissions Disabling MTO routing To disable MTO (many-to-one) routing in a network, first reconfigure the AR setting on the aggregator and then broadcast a network wide power reset (0x08 of the RE command) to rebuild the routing tables. 1. Set AR on the aggregator to 0xFF. 2.

  • Page 75: Maximum Rf Payload Size

    Maximum RF payload size Maximum RF payload size The NP command returns the maximum payload size in bytes. The actual maximum payload is a function of: • message type (broadcast or unicast) • AP setting • APS encryption option • source-routing.

  • Page 76: Throughput

    Throughput Hops Maximum encrypted payload Maximum unencrypted payload Throughput Throughput in a ZigBee network can vary by a number of variables, including: number of hops, encryption enabled/disabled, sleeping end devices, failures/route discoveries. Our empirical testing showed the following throughput performance in a robust operating environment (low interference). Data throughput Configuration Data Throughput...

  • Page 77: Latency Timing Specifications

    Latency timing specifications Configuration Data Throughput RR = router to router RE = router to end device (non-sleeping) ER = end device (non-sleeping) to router SD = security disabled SE = security enabled 4 hops = 5 nodes total, 3 intermediate router nodes 1.

  • Page 78: Sending A Zdo Command

    ZDO transmissions Refer to the ZigBee specification for a detailed description of all ZigBee Device Profile services. Sending a ZDO command To send a ZDO command, an explicit transmit API frame must be used and formatted correctly. The source and destination endpoints must be set to 0, and the profile ID must be set to 0.
  • Page 79 ZDO transmissions 0x00 - Required payload for LQI request command 0xCE - Checksum (0xFF - SUM (all bytes after length)) Description This API frame sends a ZDO LQI request (neighbor table request) to a remote device to obtain data from its neighbor table.

  • Page 80: Transmission Timeouts

    Transmission timeouts Transmission timeouts The ZigBee stack includes two kinds of transmission timeouts, depending on the nature of the destination device. For destination devices such as routers whose receiver is always on, a unicast timeout is used. The unicast timeout estimates a timeout based on the number of unicast hops the packet should traverse to get data to the destination device.

  • Page 81: Transmission Examples

    Transmission timeouts (50 * NH) + (1.2 * SP) This timeout includes the packet buffering timeout (1.2 * SP) and time to account for routing through the mesh network (50 * NH). If an acknowledgment is not received within this time, the sender will resend the transmission up to two more times.
  • Page 82 Transmission timeouts known, the 64-bit address of 0 could be replaced with the coordinator's 64-bit address, and the 16-bit address could be set to 0. Example 2: send a broadcast API data transmission that all devices can receive (including sleeping end devices), with payload “TxData”. API frame 7E 0014 10 01 00000000 0000FFFF FFFE 00 00 54 78 44 61 74 61 AD Field composition...
  • Page 83 Transmission timeouts Setting AO=1 is required for the XBee to use the explicit receive API frame (0x91) when RF data packets are received. This is required if the application needs indication of source or destination endpoint, cluster ID, and/or profile ID values used in received ZigBee data packets.

  • Page 84: Zigbee Security

    ZigBee Security ZigBee supports various levels of security that can be configured depending on the needs of the application. Security provisions include: • 128-bit AES encryption • Two security keys that can be preconfigured or obtained during joining • Support for a trust center •...

  • Page 85: Frame Counter

    ZigBee security model Packets are encrypted and authenticated using 128-bit AES. This is shown in the figure below. Frame counter The network header of encrypted packets includes a 32-bit frame counter. Each device in the network maintains a 32-bit frame counter that is incremented for every transmission. In addition, devices track the last known 32-bit frame counter for each of its neighbors.

  • Page 86: Network Key Updates

    ZigBee security model Since network encryption is performed at each hop, packet latency is slightly longer in an encrypted network than in a non-encrypted network. Also, security requires 18 bytes of overhead to include a 32-bit frame counter, an 8-byte source address, 4-byte MIC, and 2 other bytes. This reduces the number of payload bytes that can be sent in a data packet.

  • Page 87: Aps Layer Encryption And Decryption

    ZigBee security model APS layer encryption and decryption Packets with APS layer encryption are encrypted at the source and only decrypted by the destination. Since APS encryption requires a 5-byte header and a 4-byte MIC, the maximum data payload is reduced by 9 bytes when APS encryption is used.

  • Page 88: Implementing Security On The Xbee

    Implementing security on the XBee Implementing security on the XBee If security is enabled in the XBee ZB firmware, devices acquire the network key when they join a network. Data transmissions are always encrypted with the network key, and can optionally be end-to-end encrypted with the APS link key.

  • Page 89: Enabling Aps Encryption

    XBee security examples If the coordinator uses a pre-configured link key (KY > 0), then the coordinator will not send the network key unencrypted to joining devices. Only devices with the correct pre-configured link key will be able to join and communicate on the network.

  • Page 90: Example 2: Forming A Network With Security (Obtaining Keys During Joining)

    XBee security examples d. EE=1 e. NK=0 f. KY=4455 g. WR (save networking parameters to preserve them through power cycle) 3. Configure one or more routers or end devices with the following settings: a. ID=2234 b. EE=1 c. KY=4455 d. WR (save networking parameters to preserve them through power cycle) 4.

  • Page 91: Network Commissioning And Diagnostics

    Network commissioning and diagnostics Network commissioning is the process whereby devices in a mesh network are discovered and configured for operation. The XBee modules include several features to support device discovery and configuration. In addition to configuring devices, a strategy must be developed to place devices to ensure reliable routes. To accommodate these requirements, the XBee modules include various features to aid in device placement, configuration, and network diagnostics.

  • Page 92: Rssi Indicators

    Device discovery Network discovery The network discovery command can be used to discover all Digi modules that have joined a network. Issuing the ND command sends a broadcast node discovery command throughout the network. All devices that receive the command will send a response that includes the device’s addressing information, node identifier string (see NI command), and other relevant information.

  • Page 93: Zdo Discovery

    The ZigBee Device Profile includes provisions to discover devices in a network that are supported on all ZigBee devices (including non-Digi products). These include the LQI Request (cluster ID 0x0031) and the Network Update Request (cluster ID 0x0038). The LQI Request can be used to read the devices in the neighbor table of a remote device, and the Network Update Request can be used to have a remote device do an active scan to discover all nearby ZigBee devices.

  • Page 94: Commissioning Pushbutton

    Commissioning Pushbutton and Associate LED Commissioning Pushbutton The commissioning pushbutton definitions provide a variety of simple functions to aid in deploying devices in a network. The commissioning button functionality on pin 33 (SMT) or pin 20 (TH) is enabled by setting the D0 command to 1 (enabled by default).

  • Page 95: Binding

    All devices that receive this transmission blink their associate pin rapidly for one second if the associate LED functionality is enabled. (D5 = 1) Binding There are three binding request messages supported by the Digi XBee firmware: End Device Bind, Bind, and Unbind. End_Device_Bind_req The End Device Bind request (ZDO cluster 0x0020) is described in the ZigBee Specification.
  • Page 96 Commissioning Pushbutton and Associate LED R1->C End_Device_Bind_req R2->C End_Device_Bind_req R1, R2 send End_Device_Bind_req within 60 s of each other to C C matches the requests. C tests one to see if binding is already in place: R2<-C Unbind_req R2->C Unbind-rsp (status code - NO_ENTRY) C proceeds to create binding table entries on the two devices.
  • Page 97 Commissioning Pushbutton and Associate LED End Device binding sequence (removal) This example shows a correctly formatted End_Device_Bind_req (ZDO cluster 0x0020) using a Digi 0x11 Explicit API Frame: The frame as a bytelist: 7e002811010000000000000000fffe000000200000000001f2995cb5474000a21300e605c101010001020046 Same frame broken into labeled fields. Note the multibyte fields are represented in big-endian format.

  • Page 98: Group Table Api

    The design of the Group Table API of the XBee firmware is derived from the ZCL Group Cluster 0x0006. Developers should use the Explicit API frame 0x11 addressed to the Digi Device Object endpoint (0xE6) with the Digi XBee ProfileID (0xC105) to send commands and requests to the local device.
  • Page 99 Commissioning Pushbutton and Associate LED ZCL_payload = “3412 04 41 42 43 44" The first two bytes is the group Id to add in little endian representation. The next byte is the string name length (00 if no string is wanted). The other bytes are the descriptive ASCII string name (“ABCD”) for the group table entry.
  • Page 100 Commissioning Pushbutton and Associate LED View Group The purpose of the View Group command is to get the name string which is associated with a particular endpoint and groupID. The intent of the example is to get the name string associated with the endpoint E7 and groupID 1234. The packet: Preamble = “11 01 “+LocalDevice64Addr+”FFFE E6 E7 0006 C105 00 00"...
  • Page 101 Commissioning Pushbutton and Associate LED API 0x8B FrameID 0x01 16DestAddr 0xFFFE Transmit Retries 0x00 Delivery Status 0x00 Discovery Status 0x00 Success Get Group Membership (1 of 2) The purpose of this first form of the Get Group Membership command is to get all the groupIDs associated with a particular endpoint.
  • Page 102 Commissioning Pushbutton and Associate LED capacity of the group table is unknown. The second byte is the group count (0x01). The remaining bytes are the groupIDs in little-endian representation. And here is the decoded second message, which is a Tx Status for the original command request. If the FrameId value in the original command request had been zero, or if no space was available in the transmit UART buffer, then no Tx Status message would occur.
  • Page 103 Commissioning Pushbutton and Associate LED ZCL_header = “09 ee 02" The first field is a frame control field which specifies a Cluster Specific command (0x01) using a Server->Client direction (0x08). The second field is a transaction sequence number which is used to associate the response with the command request.
  • Page 104 Commissioning Pushbutton and Associate LED RF_Data 0x09EE03003412 The response in terms of Preamble, ZCL Header, and ZCL payload: Preamble = “910013a2004047b55cfffee7e68006c10500” The packet has its endpoint values reversed from the request, and the clusterID is 0x8006 indicating a Group cluster response. ZCL_header = “09 ee 03"...
  • Page 105 Commissioning Pushbutton and Associate LED API 0x91 64DestAddr 0x0013A2004047B55C 16DestAddr 0xFFFE SrcEP 0xE7 DestEP 0xE6 ClusterID 0x8006 ProfileID 0xC105 Options 0x00 RF_Data 0x09ee0400 The response in terms of Preamble, ZCL Header, and ZCL payload. Preamble = “910013a2004047b55cfffee7e68006c10500” The packet has its endpoints values reversed from the request, and the clusterID is 0x8006 indicating a Group cluster response.
  • Page 106 Commissioning Pushbutton and Associate LED 0x8b EMBER_ZCL_STATUS_NOT_FOUND: An attempt at Get Group Membership or Remove Group could not find a matching entry in the group table A full set of status codes appears in the documentation [4]. Bibliography [1] ZigBee Cluster Library, document 075123r02, section 3.6. The following cross references all appear in the ZigBee Cluster Library document: [2] Add Group Command, section 3.6.2.2.3.

  • Page 107: Managing End Devices

    Managing End Devices ZigBee end devices are intended to be battery-powered devices capable of sleeping for extended periods of time. Since end devices may not be awake to receive RF data at a given time, routers and coordinators are equipped with additional capabilities (including packet buffering and extended transmission timeouts) to ensure reliable data delivery to end devices.

  • Page 108: Parent Operation

    Parent operation The end device can only send data directly to its parent. If an end device must send a broadcast or a unicast transmission to other devices in the network, it sends the message directly to its parent and the parent performs any necessary route or address discoveries to route the packet to the final destination.

  • Page 109: Non-Parent Device Operation

    Non-Parent device operation • Route and address discoveries • Application broadcast transmissions • Stack broadcasts (e.g. ZDO “Device Announce” messages when devices join a network) • Unicast transmissions (buffered until acknowledgment is received from destination or retries exhausted) • Unicast messages waiting for end device to wake. Applications that use regular broadcasting or that require regular address or route discoveries will use up a significant number of buffers, reducing the buffer availability for managing packets for end device children.

  • Page 110: Pin Sleep

    XBee End Device configuration light the LED. Finally, the Sleep_Rq pin will be configured as a pulled-down input so that an external device must drive it high to wake the module. All other pins will be left unmodified during sleep so that they can operate as previously configured by the user.
  • Page 111 XBee End Device configuration The following figure shows the XBee TH pin sleep pins. The following figure show the pin sleep waveforms. In the figure above, t and t represent the following events: • - Time when Sleep_RQ is asserted (high) •...

  • Page 112: Cyclic Sleep

    XBee End Device configuration Demonstration of pin sleep Parent and remote devices must be configured to buffer data correctly and to use adequate transmission timeouts. See XBee Router/Coordinator configuration on page 119 for details. Cyclic sleep Cyclic sleep allows the module to sleep for a specified time and wake for a short time to poll its parent for any buffered data messages before returning to sleep again.
  • Page 113 XBee End Device configuration The following figures shows the XBee S2C through-hole cyclic sleep pins. The following figure shows the cyclic sleep waveforms. In the figure above, t1, t2, and t3 represent the following events: • T1 - Time when the module wakes from cyclic sleep •...
  • Page 114 XBee End Device configuration Sleep period The sleep period is configured based on the SP, SN, and SO commands. The following table lists the behavior of these commands. Command Range Description 0x20 - 0xAF0 (x 10 ms) Configures the sleep period of the module. (320 - 28,000 ms) 1 - 0xFFFF Configures the number of sleep periods multiplier.
  • Page 115 XBee End Device configuration Note SP controls the packet buffer time on routers and coordinators. SP should be set on all router and coordinator devices to match the longest end device SP time. See the XBee Router / Coordinator Configuration section for details. Extended cyclic sleep In extended cyclic sleep operation, an end device can sleep for a multiple of SP time which can extend the sleep time up to several days.

  • Page 116: Recommended Sleep Current Measurements

    XBee End Device configuration Deep sleep There are preconditions for maintaining low current draw during sleep: • You must maintain the supply voltage within a valid operating range (2.1 to 3.6 V for the XBee, 3.0 to 3.6 V for the XBee-PRO (S2), 2.7 to 3.

  • Page 117: Transmitting Rf Data

    XBee End Device configuration Internal pin pull-ups can pull excess current and cause the sleep current readings to be higher than desired if you drive or float the pull-ups. Disable all pull-ups for input lines that have a low driven state during sleep. Enable pull-ups for floating lines or inputs that do not connect to other circuitry.

  • Page 118: I/O Sampling

    XBee End Device configuration is started (serial or RF data is received). If the sleep timer is started, the end device will continue to poll every 100 ms until the sleep timer expires. This firmware includes an adaptive polling enhancement where, if an end device receives RF data from its parent, it sends another poll after a very short delay to check for more data.

  • Page 119: Xbee Router/Coordinator Configuration

    XBee Router/Coordinator configuration To enable rejoining, NJ should be set less than 0xFF on the device that will join. If NJ < 0xFF, the device assumes the network is not allowing joining and first tries to join a network using rejoining. If multiple rejoining attempts fail, or if NJ=0xFF, the device will attempt to join using association.

  • Page 120: Transmission Timeout

    Putting it all together Transmission timeout As mentioned in Transmission, addressing, and routing on page 59, when sending RF data to a remote router, since routers are always on, the timeout is based on the number of hops the transmission may traverse. This timeout it settable using the NH command;...
  • Page 121 Sleep examples SP = 0x7D0 (2000 decimal). This causes the end device to sleep for 20 seconds since SP is measured in units of 10ms. SN = 3. (With this setting, the On/Sleep pin will assert once every 3 sleep cycles, or when RF data is received) SO = 0 All router and coordinator devices on the network should set SP to match SP on the end device.
  • Page 122 Sleep examples IR = 0x800 (send 1 IO sample after waking). At least one analog or digital IO sample should be enabled for IO sampling. With these settings, the end device will wake after 4 minutes and send 1 IO sample. It will then remain awake for 2 seconds before returning to sleep.

  • Page 123: Analog And Digital I/O Lines

    Analog and digital I/O lines XBee ZB firmware supports a number of analog and digital I/O pins that are configured through software commands. Analog and digital I/O lines can be set or queried. The following table lists the configurable I/O pins and the corresponding configuration commands.

  • Page 124: Xbee Zb Through-Hole Rf Module

    I/O configuration Module Pin Names Module Pin AT Command Command Range AD2/DIO2 0, 2-5 PTI_En/AD1/DIO1 0, 2-6 AD0/DIO0/Comm XBee ZB through-hole RF module Module Pin Names Module Pin AT Command Command Range DIO13/DOUT 0, 1, 3-5 DIO14/DIN/nCONFIG 0, 1, 3-5 DIO12/PWM2/SWDIO/SPI_MISO 0, 1, 3-5 DIO10/PWM RSSI/DAC0...

  • Page 125: I/O Sampling

    I/O sampling Pin Command Parameter Description Data in monitored. (See below) Data out default low Data out default high RS485 enable low / packet trace interface RS485 enable high >7 Unsupported When the pin command parameter is a 0 or a 3, it operates the same on this platform, except that the pin will not be monitored by I/O sampling if the parameter is 0.
  • Page 126 I/O sampling Bytes Name Description Sample Sets Number of sample sets in the packet. (Always set to 1.) Digital Channel Indicates which digital IO lines have sampling enabled. Each bit corresponds to one digital IO Mask line on the module. bit 0 = AD0/DIO0 bit 1 = AD1/DIO1 bit 2 = AD2/DIO2...

  • Page 127: Queried Sampling

    I/O sampling The sampled data set will include 2 bytes of digital I/O data only if one or more I/O lines on the device are configured as digital I/O. If no pins are configured as digital IO, these 2 bytes will be omitted. Pins are configured as digital I/O by setting them to a value of 3, 4, or 5.

  • Page 128: Change Detection Sampling

    RSSI PWM A sleeping end device will transmit periodic IO samples at the IR rate until the ST timer expires and the device can resume sleeping. Change detection sampling Modules can be configured to transmit a data sample immediately whenever a monitored digital I/O pin changes state.

  • Page 129: Pwm1

    PWM1 With a total of 2400 counts, this yields an ON time of (1124 / 2400) = 46.8% Example 3: configure the RSSI/PWM pin to operate for 2 seconds after each received RF packet First, ensure the RSSI/PWM functionality is enabled by reading the P0 (P-zero) command. It should be set to 1 (default).

  • Page 130: Api Operation

    Data Frame. Note that Digi may add new API frames to future versions of firmware, so build into your software interface the ability to filter out additional API frames with unknown Frame Types.
  • Page 131 API frame specifications API Operation - with Escape Characters (AP parameter = 2) This mode is only available on the UART, not on the SPI serial port. When this API mode is enabled (AP = 2), the UART data frame structure is defined as the following figure shows. The figure illustrates the UART data frame structure with escape control characters.
  • Page 132 API frame specifications The cmdID frame (API-identifier) indicates which API messages will be contained in the cmdData frame (Identifier-specific data). Note that multi-byte values are sent big endian.The XBee modules support the following API frames: API Frame Names API ID 0x08 AT Command 0x09...

  • Page 133: Api Examples

    API frame specifications API examples Example: create an API AT command frame to configure an XBee to allow joining (set NJ to 0xFF). The frame should look like: 0x7E 0x00 0x05 0x08 0x01 0x4E 0x4A 0xFF 5F Where 0x0005 = length 0x08 = AT Command API frame type 0x01 = Frame ID (set to non-zero value) 0x4E4A = AT Command ('NJ')

  • Page 134: Api Serial Port Exchanges

    API serial port exchanges 0x03 = Command Parameter (the parameter could also be sent as 0x0003 or 0x00000003) 0x70 = Checksum API serial port exchanges AT commands The following image shows the API frame exchange that takes place at the serial port when sending an AT command request to read or set a module parameter.

  • Page 135: Source Routing

    Supporting the API Source routing The following image shows the API frame exchanges that take place at the serial port when sending a source routed transmission. Supporting the API Applications that support the API should make provisions to deal with new API frames that may be introduced in future releases.

  • Page 136: Api Frames

    API frames API frames The following sections illustrate the types of frames encountered while using the API. AT command Frame Type: 0x08 Used to query or set module parameters on the local device. This API command applies changes after executing the command.

  • Page 137: Zigbee Transmit Request

    API frames Frame Fields Offset Example Description Frame-specific Frame Type 0x09 Data Frame ID 0x01 Identifies the serial port data frame for the host to correlate with a subsequent ACK (acknowledgment). If set to 0, no response is sent. AT Command 0x42 (B) Command Name - Two ASCII characters that identify the AT Command.
  • Page 138 API frames Frame Fields Offset Example Description Frame ID 0x01 Identifies the serial port data frame for the host to correlate with a subsequent ACK (acknowledgment). If set to 0, no response is sent. 64-bit MSB 5 0x00 Set to the 64-bit address of the destination device. The Destination following addresses are also supported: 0x13...

  • Page 139: Explicit Addressing Zigbee Command Frame

    API frames Example: The example above shows how to send a transmission to a module where escaping is disabled (AP=1) with destination address 0x0013A200 40014011, payload “TxData1B”. If escaping is enabled (AP=2), the frame should look like: 0x7E 0x00 0x16 0x10 0x01 0x00 0x7D 0x33 0xA2 0x00 0x40 0x0A 0x01 0x27 0xFF 0xFE 0x00 0x00 0x54 0x78 0x44 0x61 0x74 0x61 0x30 0x41 0x7D 0x33 The checksum is calculated (on all non-escaped bytes) as [0xFF - (sum of all bytes from API frame type through data payload)].
  • Page 140 API frames Frame Fields Offset Example Description Start Delimiter 0x7E Length MSB 1 0x00 Number of bytes between the length and the checksum LSB 2 0x1A Frame-specific Frame Type 0x11 Data Frame ID 0x01 Identifies the serial port data frame for the host to correlate with a subsequent ACK (acknowledgment).
  • Page 141 API frames Frame Fields Offset Example Description Transmit 0x00 Bitfield of supported transmission options. Supported values Options include the following: 0x01 - Disable retries 0x04- Indirect Addressing 0x08- Multicast Addressing 0x20 - Enable APS encryption (if EE=1) 0x40 - Use the extended transmission timeout for this destination Enabling APS encryption decreases the maximum number of RF payload bytes by 4 (below the value reported by NP).

  • Page 142: Remote At Command Request

    API frames Remote AT Command Request Frame Type: 0x17 Used to query or set module parameters on a remote device. For parameter changes on the remote device to take effect, changes must be applied, either by setting the apply changes options bit, or by sending an AC command to the remote.

  • Page 143: Create Source Route

    API frames Frame Fields Offset Example Description AT Command 0x42 (B) Name of the command Frame-specific 0x48 (H) data Command 0x01 If present, indicates the requested parameter value to set the Parameter given register. If no characters present, the register is queried. Checksum 0xF5 0xFF - the 8 bit sum of bytes from offset 3 to this byte.
  • Page 144 API frames Frame Fields Offset Example Description 16-bit MSB 13 0x33 Set to the 16-bit address of the destination device, if known. Set to Destination 0xFFFE if the address is unknown, or if sending a broadcast. LSB 14 0x44 Network Address Route 0x00...

  • Page 145: At Command Response

    API frames AT Command Response Frame Type: 0x88 In response to an AT Command message, the module will send an AT Command Response message. Some commands will send back multiple frames (for example, the ND (Node Discover) command). Frame Fields Offset Example Description Start Delimiter...

  • Page 146: Modem Status

    API frames Modem Status Frame Type: (0x8A) RF module status messages are sent from the module in response to specific conditions. The following API frame is returned when an API coordinator forms a network. Frame Fields Offset Example Description Start Delimiter 0x7E Length MSB 1...

  • Page 147: Zigbee Transmit Status

    API frames ZigBee Transmit Status Frame Type: 0x8B When a TX Request is completed, the module sends a TX Status message. This message will indicate if the packet was transmitted successfully or if there was a failure. Frame Fields Offset Example Description Start Delimiter 0x7E...

  • Page 148: Zigbee Receive Packet

    API frames ZigBee Receive Packet Frame Type: (0x90) When the module receives an RF packet, it is sent out the serial port using this message type. Frame Fields Offset Example Description Start Delimiter 0x7E Length MSB 1 0x00 Number of bytes between the length and the checksum LSB 2 0x11 Frame Type...

  • Page 149: Zigbee Explicit Rx Indicator

    API frames Suppose a device with a 64-bit address of 0x0013A200 40522BAA, and 16-bit address 0x7D84 sends a unicast data transmission to a remote device with payload “RxData”. If AO=0 on the receiving device, it would send the above example frame out its serial port. ZigBee Explicit Rx Indicator Frame Type:0x91 When the modem receives a ZigBee RF packet it is sent out the serial port using this message type (when AO=1).
  • Page 150 API frames Frame Fields Offset Example Description Source 0xE0 Endpoint of the source that initiated the transmission Endpoint Destination 0xE0 Endpoint of the destination the message is addressed to. Endpoint Cluster ID 0x22 Cluster ID the packet was addressed to. 0x11 Profile ID 0xC1...

  • Page 151: Zigbee Io Data Sample Rx Indicator

    API frames ZigBee IO Data Sample Rx Indicator Frame Type: 0x92 When the module receives an I/O sample frame from a remote device, it sends the sample out the serial port using this frame type (when AO=0). Only modules running in API mode will send I/O samples out the serial port. Frame Fields Offset Example...
  • Page 152 API frames Frame Fields Offset Example Description Analog Sample 0x02 If the sample set includes any analog input lines (Analog Channel Mask > 0), each enabled analog input returns a 2-byte value Frame-specific 0x25 indicating the A/D measurement of that input. Analog samples are Data ordered sequentially from AD0/DIO0 to AD3/DIO3, to the supply voltage.

  • Page 153: Xbee Sensor Read Indicator

    API frames XBee Sensor Read Indicator Frame Type: 0x94 When the module receives a sensor sample (from a Digi 1-wire sensor adapter), it is sent out the serial port using this message type (when AO=0). Frame Fields Offset Example Description...
  • Page 154 API frames Frame Fields Offset Example Description A/D Values 0x00 Indicates a two-byte value for each of four A/D sensors (A, B, C, D) 0x02 Set to 0xFFFFFFFFFFFFFFFF if no A/Ds are found. 0x00 0xCE 0x00 Frame-specific Data 0xEA 0x00 0x52 Temperature 0x01...

  • Page 155: Node Identification Indicator

    API frames Relative H = (161.2903 * ((1.64/4.68) - 0.16)) = 161.2903 * (0.19043) = 30.71% True H = (30.71 / (1.0546 - (0.00216 * 22.625))) = (30.71 / 1.00573) = 30.54% Node Identification Indicator Frame Type: 0x95 This frame is received when a module transmits a node identification message to identify itself (when AO=0). The data portion of this frame is similar to a network discovery response frame (see ND command).
  • Page 156 2 = Frame sent after joining event occurred (see JN command). 3 = Frame sent after power cycle event occurred (see JN command). Digi Profile ID 0xC1 Set to Digi's application profile ID. 0x05 Manufacturer ID 33 0x10 Set to Digi's Manufacturer ID.

  • Page 157: Remote Command Response

    API frames Remote Command Response Frame Type: 0x97 If a module receives a remote command response RF data frame in response to a Remote AT Command Request, the module will send a Remote AT Command Response message out the serial port. Some commands may send back multiple frames--for example, Node Discover (ND) command.

  • Page 158: Extended Modem Status

    API frames Frame Fields Offset Example Description Command Data 0x40 Register data in binary format. If the register was set, then this field is not returned. Frame-specific 0x52 Data 0x2B 0xAA Checksum 0xF0 0xFF - the 8 bit sum of bytes from offset 3 to this byte. If a remote command is sent to a remote device with 64-bit address 0x0013A200 40522BAA and 16-bit address 0x7D84 to query the SL command, and if the frame ID=0x55, the response is shown in the example API frame in the table above.
  • Page 159 API frames Status code descriptions The following table describes the various Verbose Join trace messages in the order of their Status Code. The AT Mode String column shows the string which will appear if Verbose Join is run in AT Command Mode. The Description column gives a fuller explanation of what a particular message means.
  • Page 160 API frames Status Data AT Mode Status Code String Description Data Description 0x03 Joined Joined - Coordinator “Formed:”, Router/End Device “Joined” 0x04 Beacon Data received from a ZS[stackProfile](1) See ZS in Command reference tables Response neighboring node in page 178. response to a beacon extendedPanId(8) 64 bit PAN Identifier for network...
  • Page 161 API frames Status Data AT Mode Status Code String Description Data Description 0x0A Beacon Saved This beacon response is a radioChannel(1) channel number ranging from 11 to 26 suitable candidate for an (0x0B to 0x1A) association request. radioTxPower(1) low level signed byte value for transmit power, values range from 0xC9 to 0x05 inclusive panid(2)
  • Page 162 API frames Status Data AT Mode Status Code String Description Data Description 0x16 Reset for DC80 With DC80 enabled, reset if no joinable beacon responses are received within 60s of joining. 0x18 ScanCh Scanning on Channel radioChannel(1) channel number ranging from 11 to 26 (0x0B to 0x1A) 0x19 Scan Mode...

  • Page 163: Over-The-Air Firmware Update Status

    API frames ...applying changes to the configuration V AI - Searching for Parent:FF ...search has started V AI - Searching for Parent:FF ...and started again V Scanning:03FFF800 ...Channels 11 through 25 are enabled by the SC setting for the Active Search. V Beacon Rsp:0000000000000042A6010B949AC8FF ...ZS(0), extendedPanId(00000000000042A6), allowingJoin(1), radiochannel(0x0B), panid(949A), rssi(C8), lqi(FF) V Reject ID...
  • Page 164 API frames Frame Fields Offset Example Description Frame Type 0xA0 64-bit Source MSB 4 0x00 The address of the remote radio returning this response. (remote) 0x13 Address 0xA2 0x00 0x40 0x3E 0x07 LSB 11 0x50 16-bit 0x00 16-bit address of the updater device Destination 0x00 Address...

  • Page 165: Route Record Indicator

    API frames If a query returns a 0x51 (QUERY) status, then the target's bootloader is not active and will not respond to query messages. Route Record Indicator Frame Type: 0xA1 The route record indicator is received whenever a device sends a ZigBee route record command. This is used with many-to-one routing to create source routes for devices in a network.

  • Page 166: Many-To-One Route Request Indicator

    API frames Frame Fields Offset Example Description Address n 0xAA Two bytes per 16-bit address. Frame-specific (neighbor of Data 0xBB source) Checksum 0x80 0xFF - the 8 bit sum of bytes from offset 3 to this byte. Suppose device E sends a route record that traverses multiple hops en route to data collector device A as shown below.

  • Page 167: Sending Zigbee Device Objects (Zdo) Commands With The Api

    Sending ZigBee Device Objects (ZDO) commands with the API Frame Fields Offset Example Description Frame Type 0xA3 64-bit Source MSB 4 0x00 64-bit address of the device that sent the many-to-one route request Address 0x13 0xA2 0x00 Frame-specific 0x40 Data 0x40 0x11 LSB 11...
  • Page 168 Sending ZigBee Device Objects (ZDO) commands with the API ZDO Command Cluster ID 0x0006 Match Descriptor Request 0x0031 Mgmt LQI Request 0x0032 Mgmt Routing Request 0x0034 Mgmt Leave Request 0x0036 Mgmt Permit Joining Request 0x0038 Mgmt Network Update Request The Explicit Transmit API frame (0x11) is used to send ZigBee Device Objects commands to devices in the network.
  • Page 169 Sending ZigBee Device Objects (ZDO) commands with the API Frame Fields Offset Example Description Start Delimiter 0x7E Length MSB 1 0x00 Number of bytes between the length and the checksum LSB 2 0x17 Frame Type 0x11 Frame ID 0x01 Identifies the serial port data frame for the host to correlate with a subsequent transmit status.

  • Page 170: Sending Zigbee Cluster Library (Zcl) Commands With The Api

    Sending ZigBee Cluster Library (ZCL) commands with the API Frame Fields Offset Example Description Broadcast 0x00 Sets the maximum number of hops a broadcast Radius transmission can traverse. If set to 0, the transmission radius will be set to the network maximum hops value.
  • Page 171 Sending ZigBee Cluster Library (ZCL) commands with the API Command (Command ID) Description Read Attributes (0x00) Used to read one or more attributes on a remote device. Read Attributes Response (0x01) Generated in response to a read attributes command. Write Attributes (0x02) Used to change one or more attributes on a remote device.
  • Page 172 Sending ZigBee Cluster Library (ZCL) commands with the API Frame Fields Offset Example Description Start 0x7E Delimiter Length MSB 1 0x00 Number of bytes between the length and the checksum LSB 2 0x19 Frame Type 0x11 Frame ID 0x01 Identifies the serial port data frame for the host to correlate with a subsequent transmit status.
  • Page 173 Sending ZigBee Cluster Library (ZCL) commands with the API Frame Fields Offset Example Description Broadcast 0x00 Sets the maximum number of hops a Radius broadcast transmission can traverse. If set to 0, the transmission radius will be set to the network maximum hops value.

  • Page 174: Sending Public Profile Commands With The Api

    Sending Public Profile Commands with the API Sending Public Profile Commands with the API Commands in public profiles such as Smart Energy and Home Automation can be sent with the XBee API using the Explicit Transmit API frame (0x11). Sending public profile commands with the Explicit Transmit API frame requires some formatting of the data payload field.
  • Page 175 Sending Public Profile Commands with the API Frame Fields Offset Example Description Source 0x41 Set to the source endpoint on the sending Endpoint device. (0x41 arbitrarily selected). Destination 0x42 Set to the destination endpoint on the Endpoint remote device. (0x42 arbitrarily selected) Cluster ID MSB 17 0x07...
  • Page 176 Sending Public Profile Commands with the API Frame Fields Offset Example Description Issuer Event ID 26 0x78 4-byte unique identifier. Note the 4-byte ID is sent in little endian 0x56 byte order (0x78563412). 0x34 The event ID in this example (0x12345678) was arbitrarily selected.
  • Page 177 Sending Public Profile Commands with the API Frame Fields Offset Example Description Heating 0x00 Requested heating set point in 0.01 Temperature degrees Celsius. 0x80 Set Point A value of 0x8000 means the set point field is not used in this event. Note the 0x80000 is sent in little endian byte order.

  • Page 178: Command Reference Tables

    Command reference tables Addressing commands Command Name and Description Parameter Range Default Destination Address High.Set/Get the upper 32 bits of the 0 - 0xFFFFFFFF 64-bit destination address. When combined with DL, it defines the 64-bit destination address for data transmission. Special definitions for DH and DL include 0x000000000000FFFF (broadcast) and 0x0000000000000000 (coordinator).
  • Page 179 0xE8 destination ID value. This value will be used as the destination endpoint all data transmissions. DE is only used in transparent mode.The default value (0xE8) is the Digi data endpoint. Cluster Identifier. Set/read ZigBee application layer cluster 0 - 0xFFFF 0x11 ID value.

  • Page 180: Networking Commands

    0 - 0xFFFFFFFF 0xA0000 value can be used to differentiate different XBee-based devices. Digi reserves the range 0 - 0xFFFFFF. For the XBee ZB SMT module, the device type is 0xA0000. Conflict Report. The number of PAN id conflict reports that...
  • Page 181 Networking commands Command Name and Description Parameter Range Default Maximum Unicast Hops. Set / read the maximum hops limit. This 0 - 0xFF 0x1E limit sets the maximum broadcast hops value (BH) and determines the unicast timeout. The timeout is computed as (50 * NH) + 100 ms. The default unicast timeout of 1.6 seconds (NH=0x1E) is enough time for data and the acknowledgment to traverse about 8 hops.
  • Page 182 Networking commands Command Name and Description Parameter Range Default Scan Channels. Set/Read the list of channels to scan. 1 - 0xFFFF [bitfield] 7FFF Coordinator - Bit field list of channels to choose from prior to starting network. Router/End Device - Bit field list of channels that will be scanned to find a Coordinator/Router to join.
  • Page 183 Networking commands Command Name and Description Parameter Range Default Scan Duration. Set/Read the scan duration exponent. Changes to 0 - 7 [exponent] SD should be written using WR command. Note: If channel 26 (0x8000) is enabled in the search channel mask (SC), transmit power on all channels will be capped at 3 dBm during network formation or joining.

  • Page 184: Security Commands

    Security commands Command Name and Description Parameter Range Default Channel Verification. Set/Read the channel verification parameter. 0 - Channel verification If JV=1, a router or end device will verify the coordinator is on its disabled operating channel when joining or coming up from a power cycle. If 1 - Channel verification a coordinator is not detected, the router or end device will leave its enabled...

  • Page 185: Rf Interfacing Commands

    RF interfacing commands Command Name and Description Parameter Range Default Network Encryption Key. Set the 128-bit AES network encryption key. 128-bit value This command is write-only; NK cannot be read. If set to 0 (default), the module will select a random network key. Link Key.

  • Page 186: Serial Interfacing (I/O) Commands

    Serial interfacing (I/O) commands Command Name and Description Parameter Range Default Received Signal Strength. This command reports the received signal 0 - 0xFF strength of the last received RF data packet or APS acknowledgment. The Observed range for DB command only indicates the signal strength of the last hop. It does not XBee-PRO: provide an accurate quality measurement for a multihop link.
  • Page 187 Serial interfacing (I/O) commands Command Name and Description Parameter Range Default Interface Data Rate. Set/Read the serial interface data 0 - 0x0A rate for communication between the module serial port (standard baud rates) and host. 0 = 1200 bps Any value above 0x0A will be interpreted as an actual baud 1 = 2400 rate.

  • Page 188: I/O Commands

    I/O commands I/O commands Command Name and Description Parameter Range Default I/O Sample Rate. Set/Read the I/O sample rate to enable 0, 0x32:0xFFFF (ms) periodic sampling. For periodic sampling to be enabled, IR must be set to a non-zero value, and at least one module pin must have analog or digital I/O functionality enabled (see D0- D9, P0-P4 commands).
  • Page 189 I/O commands Command Name and Description Parameter Range Default DIO13 / DOUT Configuration. Set/Read function for DIO13. 0 – Unmonitored digital input Configure options for the DIO13 line of the RF module. 1 – Data out for UART 3 – Monitored digital input 4 –...
  • Page 190 I/O commands Command Name and Description Parameter Range Default AD1/DIO1 / PTI_En Configuration. Select/Read function for 0 – Unmonitored digital input AD1/DIO1. 1 – SPI_nATTN* – Analog input, single ended 3 – Digital input 4 – Digital output, low 5 – Digital output, high 6 - Packet trace interface enable.
  • Page 191 I/O commands Command Name and Description Parameter Range Default DIO8 / DTR / Slp_Rq. Set/Read function for DIO8. 0 – Unmonitored digital input 1 – Input to sleep and wake module 3 – Digital input 4 – Digital output, low 5 –...
  • Page 192 I/O commands Command Name and Description Parameter Range Default RSSI PWM Timer. Time the RSSI signal will be output on the 0 - 0xFF [x 100 ms] 0x28 PWM after the last RF data reception or APS (40d) acknowledgment. When RP = 0xFF, output will always be on. Device Controls.

  • Page 193: Diagnostics Commands

    Diagnostics commands Command Name and Description Parameter Range Default Voltage Supply Monitoring. The voltage supply threshold is 0-0xFFFF set with the V+ command. If the measured supply voltage falls below or equal to this threshold, the supply voltage will be appended to the IO sample set, and bit 7 of the Analog Channel Mask will be set.

  • Page 194: At Command Options

    AT command options Parameter Command Name and Description Range Default Hardware Version. Read the hardware version of the module.version of the 0 - 0xFFFF [read- Factory- module. This command can be used to distinguish among different hardware only] platforms. The upper byte returns a value that is unique to each module type. The lower byte indicates the hardware revision.

  • Page 195: Sleep Commands

    Sleep commands Command Name and Description Parameter Range Default Guard Times. Set required period of silence before and after the 1 - 0x0CE4 [x 1 ms] 0x3E8 Command Sequence Characters of the AT Command Mode Sequence (max of 3.3 decimal sec) (1000d) (GT + CC + GT).

  • Page 196: Execution Commands

    Execution commands Command Name and Description Parameter Range Default Wake Host. Set/Read the wake host timer value. If the wake host timer 0 - 0xFFFF (x 1ms) is set to a non-zero value, this timer specifies a time (in millisecond units) that the device should allow after waking from sleep before sending data out the serial port or transmitting an I/O sample.
  • Page 197 Execution commands Parameter Command Name and Description Range Default Software Reset. Resets module. Responds immediately with an OK status, and then performs a software reset. As of revision 4050, there is no longer a 2 second delay between command and reset, and the modem status code for this reset changes from 0x01 to 0x00 for consistency with other XBee platforms.
  • Page 198 Execution commands Parameter Command Name and Description Range Default Node Discover. Discovers and reports all RF modules found. The following optional 20- information is reported for each module discovered. Byte MY<CR> NI or MY value SH<CR> SL<CR> NI<CR> (Variable length) PARENT_NETWORK ADDRESS (2 Bytes)<CR>...

  • Page 199: Module Support

    Contact Digi to create a custom configuration. Design considerations for Digi drop-in networking XBee RF modules contain a variety of features that allow for interoperability with Digi's full line of Drop-in Networking products. Interoperability with other “DIN” products can offer these advantages: •...

  • Page 200: Xbee Bootloader

    4, 10, and 29 (DIN, DTR, and RTS respectively) on the SMT, and pins 3, 9, 16 on the TH. The XCTU program can update firmware serially on the XBee. Contact Digi support for details. If an application requires custom firmware to update the XBee firmware serially, the following steps are required.

  • Page 201: Writing Custom Firmware

    Writing custom firmware 2. Send an ASCII “1” character to initiate a firmware update 3. After sending a “1”, the EM357 waits for an XModem CRC upload of an.ebl image over the serial line at 115200 b/s. The .ebl file must be sent to the EM357 in order. If the firmware image is successfully loaded, the bootloader will output a “complete”...

  • Page 202: Detecting Xbee Versus Xbee-Pro

    Writing custom firmware GPIO Mode GPIO_PxCFGH/L Description Open-drain output. GPIO_PxOUT controls the output. If a pull-up is required, Output (open-drain) it must be external. Alternate Output (push- Push-pull output. An on-board peripheral controls the output. pull) Alternate Output (open- Open-drain output. An on-board peripheral controls the output. If a pull-up drain) is required, it must be external.

  • Page 203: Agency Certifications

    Agency certifications United States FCC The XBee RF Modules comply with Part 15 of the FCC rules and regulations. Compliance with the labeling requirements, FCC notices and antenna usage guidelines is required. To fulfill FCC Certification, the OEM must comply with the following regulations: 1.

  • Page 204: Fcc Notices

    IMPORTANT: The XBee and XBee-PRO RF Modules have been certified by the FCC for use with other products without any further certification (as per FCC section 2.1091). Modifications not expressly approved by Digi could void the user's authority to operate the equipment.
  • Page 205 The antennas in the tables below have been approved for use with this module. Cable loss is required when using gain antennas as shown in the tables. Digi does not carry all of these antenna variants. Contact Digi Sales for available antennas.
  • Page 206 Agency certifications Minimum Cable Loss/ Power Reduction/ Attenuation Required Min. Channels Part Number Type (Description) Gain Application* Separation 11-25 Channel 26 Integral Antennas 29000313 Integral PCB antenna 0.0 dBi Fixed/Mobile 20 cm A24-QI Monopole (Integrated whip) 1.5 dBi Fixed/Mobile 20 cm Dipole Antennas A24-HASM-450 Dipole (Half-wave articulated RPSMA - 4.5”)
  • Page 207 Agency certifications Minimum Cable Loss/ Power Reduction/ Attenuation Required Min. Channels Part Number Type (Description) Gain Application* Separation 11-25 Channel 26 A24-M7NF Omni-directional (Mag-mount base station) 7.2 dBi Fixed A24-F15NF Omni-directional (Fiberglass base station) 15.0 dBi Fixed 5.0 dB Panel Antennas A24-P8SF Flat Panel 8.5 dBi...
  • Page 208 Agency certifications Minimum Cable Loss/ Power Reduction/ Attenuation Required Min. Channels Part Number Type (Description) Gain Application* Separation 11-25 Channel 26 A24-Y16NF Yagi (16-element) 13.5 dBi Fixed 7.5 dB A24-Y16RM Yagi (16-element, RPSMA connector) 13.5 dBi Fixed 7.5 dB A24-Y18NF Yagi (18-element) 15.0 dBi Fixed...
  • Page 209 Agency certifications Minimum Cable Loss/ Power Reduction/ Attenuation Required Min. Channels Part Number Type (Description) Gain Application* Separation 11-25 Channel 26 A24-F2NF Omni-directional (Fiberglass base station) 2.1 dBi Fixed/Mobile 20 cm A24-F3NF Omni-directional (Fiberglass base station) 3.0 dBi Fixed/Mobile 20 cm A24-F5NF Omni-directional (Fiberglass base station) 5.0 dBi...
  • Page 210 Agency certifications Minimum Cable Loss/ Power Reduction/ Attenuation Required Min. Channels Part Number Type (Description) Gain Application* Separation 11-25 Channel 26 Yagi Antennas A24-Y6NF Yagi (6-element) 8.8 dBi Fixed 2.8 dB A24-Y7NF Yagi (7-element) 9.0 dBi Fixed 3 dB A24-Y9NF Yagi (9-element) 10.0 dBi Fixed...
  • Page 211 Agency certifications The following table shows antennas approved for use with the XBee-PRO ZB Surface Mount RF Module. Minimum Cable Loss/Power Reduction/Attenuation Required Part Number Type (Description) Gain Application* Separation Channels 11-25 Channel 26 Internal Antennas 29000313 Integral PCB antenna 0.0 dBi Fixed/Mobile 20 cm...
  • Page 212 Agency certifications Minimum Cable Loss/Power Reduction/Attenuation Required Part Number Type (Description) Gain Application* Separation Channels 11-25 Channel 26 A24-M7NF Omni-directional (Mag-mount base station) 7.2 dBi Fixed 0.5 dB A24-F15NF Omni-directional (Fiberglass base station) 15.0 dBi Fixed 4.7 dB 8.3 dB Panel Antennas A24-P8SF Flat Panel...
  • Page 213 Agency certifications The following table shows the antennas approved for use with the XBee-PRO ZB Through Hole RF Module. Minimum Cable Loss/Power Reduction/Attenuation Required Min. Part Number Type (Description) Gain Application* Separation Channels 11-25 Channel 26 Integral Antennas 29000294 Integral PCB antenna -0.5 dBi Fixed/Mobile 20 cm...
  • Page 214 Agency certifications Minimum Cable Loss/Power Reduction/Attenuation Required Min. Part Number Type (Description) Gain Application* Separation Channels 11-25 Channel 26 A24-M7NF Omni-directional (Mag-mount base station) 7.2 dBi Fixed A24-F15NF Omni-directional (Fiberglass base station) 15.0 dBi Fixed 2.5 dB 3.9 dB Panel Antennas A24-P8SF Flat Panel 8.5 dBi...
  • Page 215 Agency certifications The following table shows the antennas approved for use with the XBee S2D SMT surface-mount module. See Associated antenna descriptions on page 218 for additional cable loss required beyond the antennas listed below. Required Required Cable-loss or Cable-loss or Required Required Power...
  • Page 216 Agency certifications Required Required Cable-loss or Cable-loss or Required Required Power Power Cable-loss or Cable-loss or reduction reduction Power Power from from Min. reduction reduction Part Number Type (Description) Gain Application Separation from +8dBm from +8dBm +1dBm +1dBm Channels 11 to 24 Channel 25 Channel 26...
  • Page 217 Agency certifications Required Required Cable-loss or Cable-loss or Required Required Power Power Cable-loss or Cable-loss or reduction reduction Power Power from from Min. reduction reduction Part Number Type (Description) Gain Application Separation from +8dBm from +8dBm +1dBm +1dBm Channels 11 to 24 Channel 25 Channel 26...

  • Page 218: Associated Antenna Descriptions

    The XBee ZB modules (non-PRO versions only) have been tested for use in several European countries. For a complete list, refer to www.digi.com. If the modules are incorporated into a product, the manufacturer must ensure compliance of the final product to the European harmonized EMC and low-voltage/safety standards.

  • Page 219: Restrictions

    Digi Support. Important Note: Digi does not list the entire set of standards that must be met for each country. Digi customers assume full responsibility for learning and meeting the required guidelines for each country in their distribution market. For more...

  • Page 220: Ic (Industry Canada) Certification

    IC (Industry Canada) Certification IC (Industry Canada) Certification Labeling requirements Labeling requirements for Industry Canada are similar to those of the FCC. A clearly visible label on the outside of the final product enclosure must display the following text. For XBee ZB surface mount: Contains Model XBee S2C Radio, IC: 1846A-XBS2C The integrator is responsible for its product to comply with IC ICES-003 &...

  • Page 221: For Xbee S2D Smt

    IC (Industry Canada) Certification For XBee S2D SMT: Contains Model S2D SMT, IC: 1846A-S2DSM The integrator is responsible for its product to comply with IC ICES-003 & FCC Part 15, Sub. B -Unintentional Radiators. ICES-003 is the same as FCC Part 15 Sub. B and Industry Canada accepts FCC test report or CISPR 22 test report for compliance with ICES-003.

  • Page 222: Australia (Rcm/C-Tick)

    Australia. b. have a company/distributor/agent in Australia that will sponsor the importing of the end product. Contact Digi for questions related to locating a contact in Australia. ANATEL (Brazil) certification The XBee ZB RF modules (models noted below) comply with Brazil ANATEL standards in Resolution No. 506. The...
  • Page 223 ANATEL (Brazil) certification XBee/XBee-PRO ZigBee RF Modules User Guide...
  • Page 224 ANATEL (Brazil) certification XBee/XBee-PRO ZigBee RF Modules User Guide...

  • Page 225: Migrating From Xbee Through-Hole To Xbee Surface-Mount Modules

    Migrating from XBee through-hole to XBee surface-mount modules The XBee surface mount and through-hole modules were designed to be compatible with each other and offer the same basic feature set. As indicated elsewhere in this manual, the surface mount form factor has more I/O pins. Because originally the XBee was offered only in a Through-hole form factor, we offer this section to help users migrate from the Surface Mount to the Through-hole form factor.

  • Page 226: Mounting

    One of the important differences between the Surface Mount and the Through-hole modules is the way they mount to the PCB. Different mounting techniques are required. Digi International has designed a footprint which will allow either module to be attached to a PCB. The layout is shown below. All dimensions are in inches.
  • Page 227 Mounting The round holes in the diagram are for the Through-hole design, and the semi-oval pads are for the SMT design. Pin 1 of the Through-hole design is lined up with pad 1 of the SMT design, but the pins are actually offset by one pad (see Pin Mapping above).

  • Page 228: Manufacturing Information

    Manufacturing information The XBee is designed for surface mount on the OEM PCB. It has castellated pads to allow for easy solder attach inspection. The pads are all located on the edge of the module, so that there are no hidden solder joints on these modules.
  • Page 229 d. Baking is required if conditions b) or c) are not met. e. Baking is required if the humidity indicator inside the bag indicates a RH of 10% more. f. If baking is required, bake modules in trays stacked no more than 10 high for 4-6 hours at 125°C. Recommended footprint It is recommended that you use the PCB footprint shown below for surface mounting.
  • Page 230 Flux and cleaning It is recommended that a “no clean” solder paste be used in assembling these modules. This will eliminate the clean step and ensure unwanted residual flux is not left under the module where it is difficult to remove. In addition: •...

  • Page 231: Definitions

    Definitions Definitions ZigBee node types Coordinator A node that has the unique function of forming a network. The coordinator is responsible for establishing the operating channel and PAN ID for an entire network. Once established, the coordinator can form a network by allowing routers and end devices to join to it.
  • Page 232 Definitions ZigBee node types Router A node that creates/maintains network information and uses this information to determine the best route for a data packet. A router must join a network before it can allow other routers and end devices to join to it. A router can participate in routing packets and is intended to be a mains-powered node.

This manual is also suitable for:

Xbee-pro zigbee s2cXbee zigbee s2cXbee s2d smtXbee-pro s2c smt

Table of Contents