XBee®/XBee-PRO® ZB RF Modules ZigBee RF Modules by Digi International Models: XBEE2, XBEEPRO2, PRO S2B Hardware: S2 and S2B Firmware Versions: - 20xx - Coordinator - AT/Transparent Operation - 21xx - Coordinator - API Operation - 22xx - Router - AT/Transparent Operation - 23xx - Router - API Operation - 28xx - End Device - AT/Transparent Operation - 29xx - End Device - API Operation Digi International Inc. 11001 Bren Road East Minnetonka, MN 55343 877 912-3444 or 952 912-3444 http://www.digi.
XBee®/XBee‐PRO® ZB RF Modules © 2009 Digi International, Inc. All rights reserved No part of the contents of this manual may be transmitted or reproduced in any form or by any means without the written permission of Digi International, Inc. ZigBee® is a registered trademark of the ZigBee Alliance. XBee® and XBee‐PRO® are registered trademarks of Digi International, Inc. Technical Support: Phone: (866) 765-9885 toll-free U.S.A. & Canada (801) 765-9885 Worldwide 8:00 am - 5:00 pm [U.S.
XBee®/XBee‐PRO® ZB RF Modules Contents Overview 6 Security Policy 28 Persistent Data 28 What's New in 2x7x 6 XBee ZB Coordinator Startup 28 Firmware 6 Permit Joining 29 Manual 7 Resetting the Coordinator 29 Key Features 8 Leaving a Network 30 Worldwide Acceptance 8 Replacing a Coordinator (Security Disabled Only) 30 Specifications 9 Mechanical Drawings 10 Example: Starting a Coordinator 31 SIF Header Interface 11 Example: Replacing a Coordinator (security disabled) 31 Mounting Consideration
XBee®/XBee‐PRO® ZB RF Modules Contents Addressing 43 Using a Trust Center 67 64-bit Device Addresses 43 XBee Security Examples 67 16-bit Device Addresses 43 Example 1: Forming a network with security (pre-configured link keys) 67 Application Layer Addressing 43 Example 2: Forming a network with security (obtaining keys during joining) 68 Data Transmission 43 Broadcast Transmissions 44 Network Commissioning and Diagnostics 69 Unicast Transmissions 44 Device Configuration 69 Data Transmission Exa
XBee®/XBee‐PRO® ZB RF Modules Contents XBee Analog and Digital IO Lines 86 Module Support 128 IO Configuration 86 X-CTU Configuration Tool 128 IO Sampling 86 Customizing XBee ZB Firmware 128 Queried Sampling 88 Periodic IO Sampling 88 Design Considerations for Digi Drop-In Networking 128 Change Detection Sampling 88 XBee Bootloader 128 Programming XBee Modules 129 RSSI PWM 88 Serial Firmware Updates 129 IO Examples 89 Invoke XBee Bootloader 129 API Operation 90 Send Firmware Image 129 API F
1. Overview This manual describes the operation of the XBee/XBeePRO ZB RF module, which consists of ZigBee firmware loaded onto XBee S2 and S2B hardware, models: XBEE2, XBEEPRO2 and PRO S2B. The XBee/XBee-PRO ZB RF Modules are designed to operate within the ZigBee protocol and support the unique needs of low-cost, lowpower wireless sensor networks. The modules require minimal power and provide reliable delivery of data between remote devices. The modules operate within the ISM 2.
XBee®/XBee‐PRO® ZB RF Modules • Rejoining now can proceed without a NR or NRO command after a Mgmt_Leave_req is processed. • Command ranges were changed for the SC, IR, and LT commands. • A PAN Id corruption problem was fixed. See the 2x7x release notes for a complete list of new features and bug fixes at www.digi.com/ support. Manual The XBee/XBee-PRO/S2B ZB 2x7x manual includes the following corrections over the 2x6x manual: • Descriptions and specification for the PRO S2B.
XBee®/XBee‐PRO® ZB RF Modules Key Features High Performance, Low Cost XBee Low Power XBee • Indoor/Urban: up to 133’ (40 m) • TX Peak Current: 40 mA (@3.3 V) • Outdoor line-of-sight: up to 400’ (120 m) • RX Current: 40 mA (@3.
XBee®/XBee‐PRO® ZB RF Modules Specifications Specifications of the XBee®/XBee‐PRO® ZB RF Module Specification XBee XBee-PRO (S2) XBee-PRO (S2B) Indoor/Urban Range up to 133 ft. (40 m) Up to 300 ft. (90 m), up to 200 ft (60 m) Up to 300 ft. (90 m), up to 200 ft (60 m) international variant international variant Outdoor RF line-of-sight Range up to 400 ft.
XBee®/XBee‐PRO® ZB RF Modules Specifications of the XBee®/XBee‐PRO® ZB RF Module Specification XBee XBee-PRO (S2) Japan R201WW07215215 R201WW08215142 RoHS Compliant Compliant XBee-PRO (S2B) Compliant Mechanical Drawings Mechanical drawings of the XBee®/XBee‐PRO® ZB RF Modules (antenna options not shown) . Mechanical Drawings for the RPSMA Variant © 2009 Digi International, Inc.
XBee®/XBee‐PRO® ZB RF Modules SIF Header Interface The XBee/XBee-PRO ZB modules include a SIF programming header that can be used with Ember's programming tools to upload custom firmware images onto the XBee module. The SIF header orientation and pinout are shown below. A male header can be populated on the XBee that mates with Ember's 2x5 ribbon cable. The male header and ribbon cables are available from Samtec: 2x5 Male Header - FTSH-105-01-F-DV-K 2x5 Ribbon Cable - FFSD-05-D-12.
XBee®/XBee‐PRO® ZB RF Modules • Surface-mount single-row receptacles - Samtec P/N: SMM-110-02-SM-S Digi also recommends printing an outline of the module on the board to indicate the orientation the module should be mounted. Pin Signals XBee®/XBee‐PRO® ZB RF Module Pin Number (top sides shown ‐ shields on bottom) Pin Assignments for the XBee‐PRO Modules (Low‐asserted signals are distinguished with a horizontal line above signal name.
XBee®/XBee‐PRO® ZB RF Modules EM250 Pin Mappings The following table shows how the EM250 pins are used on the XBee. EM250 Pin Number XBee Pin Number 13 (Reset) 5 19 (GPIO 11) 16 20 (GPIO 12) 12 21 (GPIO 0) 15 Other Usage Connected to pin 8 on 2x5 SIF header. 22 (GPIO 1) XBee Tied to ground (module identification) XBee-PRO (S2) Low-asserting shutdown line for output power compensation circuitry. XBee-PRO (S2B) Used to communicate with Temp Sensor and control Shutdown for low power mode.
XBee®/XBee‐PRO® ZB RF Modules All unused pins should be left disconnected. All inputs on the radio can be pulled high with 30k internal pull-up resistors using the PR software command. No specific treatment is needed for unused outputs. For applications that need to ensure the lowest sleep current, inputs should never be left floating. Use internal or external pull-up or pull-down resistors, or set the unused I/O lines to outputs.
XBee®/XBee‐PRO® ZB RF Modules © 2009 Digi International, Inc.
XBee®/XBee‐PRO® ZB RF Modules Electrical Characteristics DC Characteristics of the XBee/XBee‐PRO Symbol Parameter Condition VIL Input Low Voltage All Digital Inputs VIH Input High Voltage All Digital Inputs Min Typical Max Units - - 0.2 * VCC V 0.8 * VCC - - V VOL Output Low Voltage VCC >= 2.7 V - - 0.18*VCC V VOH Output High Voltage VCC >= 2.7 V 0.82*VCC - - V IIIN Input Leakage Current VIN = VCC or GND, all inputs, per pin - - 0.
2. RF Module Operation Serial Communications The XBee RF Modules interface to a host device through a logic-level asynchronous serial port. Through its serial port, the module can communicate with any logic and voltage compatible UART; or through a level translator to any serial device (for example: through a RS-232 or USB interface board). UART Data Flow Devices that have a UART interface can connect directly to the pins of the RF module as shown in the figure below.
XBee®/XBee‐PRO® ZB RF Modules TInternal Data Flow Diagram Serial Receiver Buffer DIN RF TX Buffer Transmitter RF Switch CTS Antenna Port Processor DOUT Serial Transmit Buffer RF RX Buffer Receiver RTS Serial Receive Buffer When serial data enters the RF module through the DIN Pin (pin 3), the data is stored in the serial receive buffer until it can be processed. Under certain conditions, the module may not be able to process data in the serial receive buffer immediately.
XBee®/XBee‐PRO® ZB RF Modules RTS Flow Control If RTS flow control is enabled (D6 command), data in the serial transmit buffer will not be sent out the DOUT pin as long as RTS is de-asserted (set high). The host device should not de-assert RTS for long periods of time to avoid filling the serial transmit buffer. If an RF data packet is received, and the serial transmit buffer does not have enough space for all of the data bytes, the entire RF data packet will be discarded.
XBee®/XBee‐PRO® ZB RF Modules A Comparison of Transparent and API Operation The following table compares the advantages of transparent and API modes of operation: Transparent Operation Features Simple Interface All received serial data is transmitted unless the module is in command mode. Easy to support It is easier for an application to support transparent operation and command mode API Operation Features Transmitting RF data to multiple remotes only requires changing the address in the API frame.
XBee®/XBee‐PRO® ZB RF Modules Modes of Operation Idle Mode When not receiving or transmitting data, the RF module is in Idle Mode.
XBee®/XBee‐PRO® ZB RF Modules When data is transmitted from one node to another, a network-level acknowledgement is transmitted back across the established route to the source node. This acknowledgement packet indicates to the source node that the data packet was received by the destination node. If a network acknowledgement is not received, the source node will re-transmit the data.
XBee®/XBee‐PRO® ZB RF Modules Command Response When a command is sent to the module, the module will parse and execute the command. Upon successful execution of a command, the module returns an “OK” message. If execution of a command results in an error, the module returns an “ERROR” message. Applying Command Changes Any changes made to the configuration command registers through AT commands will not take effect until the changes are applied.
3. XBee ZigBee Networks Introduction to ZigBee ZigBee is an open global standard built on the IEEE 802.15.4 MAC/PHY. ZigBee defines a network layer above the 802.15.4 layers to support advanced mesh routing capabilities. The ZigBee specification is developed by a growing consortium of companies that make up the ZigBee Alliance. The Alliance is made up of over 300 members, including semiconductor, module, stack, and software developers.
XBee®/XBee‐PRO® ZB RF Modules A router has the following characteristics: it • Must join a ZigBee PAN before it can transmit, receive, or route data • After joining, can allow routers and end devices to join the network • After joining, can assist in routing data • Cannot sleep--should be mains powered. • Can buffer RF data packets for sleeping end device children.
XBee®/XBee‐PRO® ZB RF Modules Routers and end devices are typically configured to join a network with any 16-bit PAN ID as long as the 64-bit PAN ID is valid. Coordinators typically select a random 16-bit PAN ID for their network. Since the 16-bit PAN ID only allows up to 65,535 unique values, and since the 16-bit PAN ID is randomly selected, provisions exist in ZigBee to detect if two networks (with different 64-bit PAN IDs) are operating on the same 16-bit PAN ID.
XBee®/XBee‐PRO® ZB RF Modules Clusters A cluster is an application message type defined within a profile. Clusters are used to specify a unique function, service, or action. For example, the following are some clusters defined in the home automation profile: • On/Off - Used to switch devices on or off (lights, thermostats, etc.) • Level Control - Used to control devices that can be set to a level between on and off • Color Control - Controls the color of color capable devices.
XBee®/XBee‐PRO® ZB RF Modules any nearby operating PANs (PAN scan). The process for selecting the channel and PAN ID are described in the following sections. Channel Selection When starting a network, the coordinator must select a "good" channel for the network to operate on. To do this, it performs an energy scan on multiple channels (frequencies) to detect energy levels on each channel. Channels with excessive energy levels are removed from its list of potential channels to start on.
XBee®/XBee‐PRO® ZB RF Modules NK Set the network security key for the network. If set to 0 (default), a random network security key will be used. KY Set the trust center link key for the network. If set to 0 (default), a random link key will be used. EO Set the security policy for the network. Once the coordinator starts a network, the network configuration settings and child table data persist through power cycles as mentioned in the "Persistent Data" section.
XBee®/XBee‐PRO® ZB RF Modules Leaving a Network There are a couple of mechanisms that will cause the coordinator to leave its current PAN and start a new network based on its network formation parameter values. These include the following: • Change the ID command such that the current 64-bit PAN ID is invalid. • Change the SC command such that the current channel (CH) is not included in the channel mask. • Change the ZS or any of the security command values (excluding NK).
XBee®/XBee‐PRO® ZB RF Modules ZS Set the stack profile to match the read ZS value. Note: II is the initial 16-bit PAN ID. Under certain conditions, the ZigBee stack can change the 16bit PAN ID of the network. For this reason, the II command cannot be saved using the WR command. Once II is set, the coordinator leaves the network and starts on the 16-bit PAN ID specified by II. Example: Starting a Coordinator 1. Set SC and ID to the desired scan channels and PAN ID values. (The defaults should suffice.
XBee®/XBee‐PRO® ZB RF Modules scanned. If all channels have been scanned and a valid PAN was not discovered, all channels will be scanned again. The ZigBee Alliance requires that certified solutions not send beacon request messages too frequently. To meet certification requirements, the XBee firmware attempts 9 scans per minute for the first 5 minutes, and 3 scans per minute thereafter. If a valid PAN is within range of a joining router, it should typically be discovered within a few seconds.
XBee®/XBee‐PRO® ZB RF Modules The following commands control the router joining process. Command Description ID Sets the 64-bit PAN ID to join. Setting ID=0 allows the router to join any 64-bit PAN ID. SC Set the scan channels bitmask that determines which channels a router will scan to find a valid network. SC on the router should be set to match SC on the coordinator. For example, setting SC to 0x281 enables scanning on channels 0x0B, 0x12, and 0x14, in that order.
XBee®/XBee‐PRO® ZB RF Modules These behaviors are configurable using the following commands: Command Description NJ Sets the permit-join time on the router, or the time that it will allow new devices to join the network, measured in seconds. If NJ=0xFF, permit joining will always be enabled. D5 Enables the Associate LED functionality. LT Sets the Associate LED blink time when joined. Default is 2 blinks per second (router).
XBee®/XBee‐PRO® ZB RF Modules Network Watchdog The NW command (network watchdog timeout) can be used for a powered router to periodically check for the presence of a coordinator to verify network connectivity. The NW command specifies a timeout in minutes where the router must receive communication from the coordinator or data collector.
XBee®/XBee‐PRO® ZB RF Modules Network Watchdog Behavior Clear Network Watchdog Failure Count Restart Network Watchdog Timer Yes Received RF Communication from Coordinator or Data Collector No No Network Watchdog Timer Expired? Yes Discover Coordinator Network Watchdog Failure Count =3? Yes Coordinator Found? No Network Watchdog Failure Count +=1 No Yes Leave Leaving a Network There are a couple of mechanisms that will cause the router to leave its current PAN and attempt to discover and join
XBee®/XBee‐PRO® ZB RF Modules • Press the commissioning button 4 times or issue the CB command with a parameter of 4. Note that changes to ID, SC, ZS, and security command values only take effect when changes are applied (AC or CN commands). Resetting the Router When the router is reset or power cycled, it checks its PAN ID, operating channel and stack profile against the network configuration settings (ID, SC, ZS).
XBee®/XBee‐PRO® ZB RF Modules If scanning all SC channels fails to discover a valid PAN, XBee ZB modules will attempt to enter a low power state and will retry scanning all SC channels after the module wakes from sleeping. If the module cannot enter a low power state, it will retry scanning all channels, similar to the router. To meet ZigBee Alliance requirements, the end device will attempt up to 9 scans per minute for the first 5 minutes, and 3 scans per minute thereafter.
XBee®/XBee‐PRO® ZB RF Modules Orphan Scans When an end device comes up from a power cycle, it performs an orphan scan to verify it still has a valid parent. The orphan scan is sent as a broadcast transmission and contains the 64-bit address of the end device. Nearby routers and coordinator devices that receive the broadcast check their child tables for an entry that contains the end device's 64-bit address.
XBee®/XBee‐PRO® ZB RF Modules When a ZB end device has successfully started a network, it • Sets AI=0 • Starts blinking the Associate LED • Sends an API modem status frame ("associated") out the UART (API firmware only) • Attempts to enter low power modes. These behaviors are configurable using the following commands: Command Description D5 Enables the Associate LED functionality. LT Sets the Associate LED blink time when joined. Default is 2 blinks per second (end devices).
XBee®/XBee‐PRO® ZB RF Modules • The end device's parent is powered down or the end device is moved out of range of the parent such that the end device fails to receive poll acknowledgment messages. Note that changes to command values only take effect when changes are applied (AC or CN commands). Example: Joining a Network After starting a coordinator (that is allowing joins), the following steps will cause an XBee end device to join the network: 1.
XBee®/XBee‐PRO® ZB RF Modules PAN ID Filtering The XBee can be configured with a fixed PAN ID by setting the ID command to a non-zero value. If the PAN ID is set to a non-zero value, the XBee will only join a network with the same PAN ID. Preconfigured Security Keys Similar to PAN ID filtering, this method requires a known security key be installed on a router to ensure it will join a ZigBee network with the same security key.
4. Data Transmission, Addressing, and Rout‐ ing Addressing All ZigBee devices have two different addresses, a 64-bit and a 16-bit address. The characteristics of each are described below. 64-bit Device Addresses The 64-bit address is a unique device address assigned during manufacturing. This address is unique to each physical device. The 64-bit address includes a 3-byte Organizationally Unique Identifier (OUI) assigned by the IEEE. The 64-bit address is also called the extended address.
XBee®/XBee‐PRO® ZB RF Modules Broadcast Transmissions Broadcast transmissions within the ZigBee protocol are intended to be propagated throughout the entire network such that all nodes receive the transmission. To accomplish this, the coordinator and all routers that receive a broadcast transmission will retransmit the packet three times.
XBee®/XBee‐PRO® ZB RF Modules Address Resolution As mentioned previously, each device in a ZigBee network has both a 16-bit (network) address and a 64-bit (extended) address. The 64-bit address is unique and assigned to the device during manufacturing, and the 16-bit address is obtained after joining a network. The 16-bit address can also change under certain conditions.
XBee®/XBee‐PRO® ZB RF Modules etc. • Transmit status frame (0x8B) The application should always update the 16-bit address in the address table when one of these frames is received to ensure the table has the most recently known 16-bit address. If a transmission failure occurs, the application should set the 16-bit address in the table to 0xFFFE (unknown). Fragmentation Each unicast transmission may support up to 84 bytes of RF payload. (Enabling security or using source routing can reduce this number.
XBee®/XBee‐PRO® ZB RF Modules c. ATCN\r 3. Verify that each of the 3 commands returned an OK\r response. 4. After setting these command values, all serial characters will be sent as a unicast transmission to the coordinator. Alternatively, if the coordinator's 64-bit address is known, DH and DL can be set to the coordinator's 64-bit address. Suppose the coordinator's address is 0x0013A200404A2244. 1. Enter command mode ('+++') 2. After receiving an OK\r, issue the following commands: a. ATDH13A200\r b.
XBee®/XBee‐PRO® ZB RF Modules 7E 00 0F 10 01 0000 0000 0000 FFFF FFFE 00 00 31 C2 Notice the destination 16-bit address is set to 0xFFFE for broadcast transmissions. RF Packet Routing Unicast transmissions may require some type of routing. ZigBee includes several different ways to route data, each with its own advantages and disadvantages. These are summarized in the table below.
XBee®/XBee‐PRO® ZB RF Modules This mechanism enables devices A and B to recognize that the link is not reliable in both directions and select a different neighbor when establishing routes. (Such links are called asymmetric links, meaning the link quality is not similar in both directions.) When a router or coordinator device powers on, it sends link status messages every couple seconds to attempt to discover link qualities with its neighbors quickly.
XBee®/XBee‐PRO® ZB RF Modules AODV (Ad-hoc On-demand Distance Vector) Routing Algorithm Routing under the AODV protocol is accomplished using tables in each node that store the next hop (intermediary node between source and destination nodes) for a destination node. If a next hop is not known, route discovery must take place in order to find a path.
XBee®/XBee‐PRO® ZB RF Modules Sample Route Reply (Unicast) Where R6 Sends a Route Reply to R3. Note: R6 could send multiple replies if it identifies a better route. Retries and Acknowledgments ZigBee includes acknowledgment packets at both the Mac and Application Support (APS) layers. When data is transmitted to a remote device, it may traverse multiple hops to reach the destination.
XBee®/XBee‐PRO® ZB RF Modules Applications that require multiple data collectors can also use many-to-one routing. If more than one data collector device sends a many-to-one broadcast, devices will create one reverse routing table entry for each collector. In ZB firmware, the AR command is used to enable many-to-one broadcasting on a device. The AR command sets a time interval (measured in 10 second units) for sending the many to one broadcast transmission. (See the command table for details.
XBee®/XBee‐PRO® ZB RF Modules A remote device sends an RF data packet to the data collector. (This is prefaced by a route record transmission to the data collector.) After obtaining a source route, the data collector sends a source routed transmission to the remote device. The data collector sends a many-to-one route request broadcast to create reverse routes on all devices. © 2009 Digi International, Inc.
XBee®/XBee‐PRO® ZB RF Modules Acquiring Source Routes Acquiring source routes requires the remote devices to send a unicast to a data collector (device that sends many-to-one route request broadcasts). There are several ways to force remotes to send route record transmissions. 1. If the application on remote devices periodically sends data to the data collector, each transmission will force a route record to occur. 2.
XBee®/XBee‐PRO® ZB RF Modules R3 0xEEFF Then the Create Source Route API frame would be: 7E 0012 21 00 0013A200 404A1234 EEFF 00 02 CCDD AABB 5C Where: 0x0012 - length 0x21 - API ID (create source route) 0x00 - frame ID (set to 0 always) 0x0013A200 404A1234 - 64-bit address of R3 (destination) 0xEEFF - 16-bit address of R3 (destination) 0x00 - Route options (set to 0) 0x02 - Number of intermediate devices in the source route 0xCCDD - Address of furthest device (1-hop from target) 0xAABB - Address of nex
XBee®/XBee‐PRO® ZB RF Modules Maximum RF Payload Size XBee ZB firmware includes a command (ATNP) that returns the maximum number of RF payload bytes that can be sent in a unicast transmission. Querying the NP command, like most other commands, returns a HEXADECIMAL value. This number will change based on whether security is enabled or not. If security is enabled (EE command), the maximum number of RF payload bytes decreases since security requires additional overhead.
XBee®/XBee‐PRO® ZB RF Modules ZigBee Device Objects (ZDO) The ZigBee Device Objects (ZDO) is supported to some extent on all ZigBee devices. The ZDO is an endpoint that implements services described in the ZigBee Device Profile in the ZigBee specification. Each service has an assigned cluster ID, and most service requests have an associated response. The following table describes some common ZDO services.
XBee®/XBee‐PRO® ZB RF Modules API Frame: 7E 0016 11 01 0013A200 40401234 FFFE 00 00 0031 0000 00 00 76 00 CE 0x0016 - length 0x11 - Explicit transmit request 0x01 - frame ID (set to a non-zero value to enable the transmit status message, or set to 0 to disable) 0x0013A200 40401234 - 64-bit address of the remote 0xFFFE - 16-bit address of the remote (0xFFFE = unknown). Optionally, set to the 16-bit address of the destination if known.
XBee®/XBee‐PRO® ZB RF Modules 0x34124040 00A21300 00 00 - Required payload for Network Address Request command 0x33 - Checksum (0xFF - SUM (all bytes after length)) Description: This API frame sends a broadcast ZDO Network Address Request to obtain the 16-bit address of a device with a 64-bit address of 0x0013A200 40401234. Note the bytes for the 64-bit address were inserted in little endian byte order.
XBee®/XBee‐PRO® ZB RF Modules To ensure the end device has adequate time to wake and receive the data, the extended transmission timeout to an end device is: (50 * NH) + (1.2 * SP) This timeout includes the packet buffering timeout (1.2 * SP) and time to account for routing through the mesh network (50 * NH). If an acknowledgment is not received within this time, the sender will resend the transmission up to two more times.
XBee®/XBee‐PRO® ZB RF Modules 0x01 - frame ID (set to a non-zero value to enable the tx-status response) 0x00000000 0000FFFF - Broadcast definition (including sleeping end devices 0xFFFE - Required 16-bit address to send broadcast transmission. 0x00 - Broadcast radius (0 = max hops) 0x00 - Tx options 0x54 78 44 61 74 61 - ASCII representation of "TxData" string 0xAD - Checksum (0xFF - SUM (all bytes after length)) Description: This transmission sends the string "TxData" as a broadcast transmission.
5. Security ZigBee supports various levels of security that can be configured depending on the needs of the application. Security provisions include: • 128-bit AES encryption • Two security keys that can be preconfigured or obtained during joining • Support for a trust center • Provisions to ensure message integrity, confidentiality, and authentication.
XBee®/XBee‐PRO® ZB RF Modules Frame Counter The network header of encrypted packets includes a 32-bit frame counter. Each device in the network maintains a 32-bit frame counter that is incremented for every transmission. In addition, devices track the last known 32-bit frame counter for each of its neighbors. If a device receives a packet from a neighbor with a smaller frame counter than it has previously seen, the packet is discarded. The frame counter is used to protect against replay attacks.
XBee®/XBee‐PRO® ZB RF Modules Since network encryption is performed at each hop, packet latency is slightly longer in an encrypted network than in a non-encrypted network. Also, security requires 18 bytes of overhead to include a 32-bit frame counter, an 8-byte source address, 4-byte MIC, and 2 other bytes. This reduces the number of payload bytes that can be sent in a data packet. Network Key Updates ZigBee supports a mechanism for changing the network key in a network.
XBee®/XBee‐PRO® ZB RF Modules APS Layer Encryption and Decryption Packets with APS layer encryption are encrypted at the source and only decrypted by the destination. Since APS encryption requires a 5-byte header and a 4-byte MIC, the maximum data payload is reduced by 9 bytes when APS encryption is used. Network and APS Layer Encryption Network and APS layer encryption can both be applied to data.
XBee®/XBee‐PRO® ZB RF Modules that are not pre-configured with the link key. Sending the network key unencrypted is not recommended as it can open a security hole in the network. To maximize security, devices should be pre-configured with the correct link key. Implementing Security on the XBee If security is enabled in the XBee ZB firmware, devices acquire the network key when they join a network.
XBee®/XBee‐PRO® ZB RF Modules is only decrypted by the destination device. The XBee must be configured with security enabled (EE set to 1) to use APS encryption. APS encryption can be enabled in API firmware on a per-packet basis. To enable APS encryption for a given transmission, the "enable APS encryption" transmit options bit should be set in the API transmit frame. Enabling APS encryption decreases the maximum payload size by 9 bytes.
XBee®/XBee‐PRO® ZB RF Modules 3. Read the AI setting on the coordinator and joining devices until they return 0 (formed or joined a network). In this example, EE, ID, and KY are set the same on all devices. After successfully joining the secure network, all application data transmissions will be encrypted by the network key. Since NK was set to 0 on the coordinator, a random network key was selected.
6. Network Commissioning and Diagnostics Network commissioning is the process whereby devices in a mesh network are discovered and configured for operation. The XBee modules include several features to support device discovery and configuration. In addition to configuring devices, a strategy must be developed to place devices to ensure reliable routes. To accommodate these requirements, the XBee modules include various features to aid in device placement, configuration, and network diagnostics.
XBee®/XBee‐PRO® ZB RF Modules and DL commands should be set to the address of the remote (0 for the coordinator, or the 64-bit address of the remote). After exiting command mode, any received serial characters will be transmitted to the remote device, and returned to the sender. API Firmware Send an Explicit Addressing ZigBee Command API frame (0x11) using 0x12 as the cluster ID and 0xE8 as the source and destination endpoint. Data packets received by the remote will be echoed back to the sender.
XBee®/XBee‐PRO® ZB RF Modules The 16-bit and 64-bit addresses are received in little-endian byte order (LSB first). See the ZigBee specification for details. Commissioning Pushbutton and Associate LED The XBee modules support a set of commissioning and LED behaviors to aid in device deployment and commissioning. These include the commissioning pushbutton definitions and associate LED behaviors. These features can be supported in hardware as shown below.
XBee®/XBee‐PRO® ZB RF Modules Button Presses If module is joined to a network • Causes the device to leave the PAN. 4 • Issues ATRE to restore module parameters to default values, including ID and SC. • The device attempts to join a network based on its ID and SC settings. If module is not joined to a network • Issues ATRE to restore module parameters to default values, including ID and SC. • The device attempts to join a network based on its ID and SC settings.
XBee®/XBee‐PRO® ZB RF Modules The following figures demonstrate these behaviors. AI = 0x22 Associate (D5 = 1 Device not joined) AD0/DIO0 A single comm issioning button press when the device has not joined a network that causes the associate pin to blink to indicate the AI Code where : AI = # blinks + 0x20. In this example, AI = 0x22.
7. Managing End Devices ZigBee end devices are intended to be battery-powered devices capable of sleeping for extended periods of time. Since end devices may not be awake to receive RF data at a given time, routers and coordinators are equipped with additional capabilities (including packet buffering and extended transmission timeouts) to ensure reliable data delivery to end devices.
XBee®/XBee‐PRO® ZB RF Modules Since the end device children are not guaranteed to be awake at a given time, the parent is responsible for managing incoming data packets in behalf of its end device children. If a parent receives an RF data transmission destined for one of its end device children, and if the parent has enough unused buffer space, it will buffer the packet. The data packet will remain buffered until a timeout expires, or until the end device sends a poll request to retrieve the data.
XBee®/XBee‐PRO® ZB RF Modules Non-Parent Device Operation Devices in the ZigBee network treat data transmissions to end devices differently than transmissions to other routers and coordinators. Recall that when a unicast transmission is sent, if a network acknowledgment is not received within a timeout, the device resends the transmission. When transmitting data to remote coordinator or router devices, the transmission timeout is relatively short since these devices are powered and responsive.
XBee®/XBee‐PRO® ZB RF Modules In the figure above, t1, t2, and t3 represent the following events: • T1 - Time when Sleep_RQ is asserted (high) • T2 - Time when the XBee enters sleep (CTS state change only if hardware flow control is enabled) • T3 - Time when Sleep_RQ is de-asserted (low) and the module wakes. The time between T1 and T2 varies depending on the state of the module.
XBee®/XBee‐PRO® ZB RF Modules Demonstration of Pin Sleep Parent and remote devices must be configured to buffer data correctly and to utilize adequate transmission timeouts. See the XBee Router / Coordinator Configuration section in this chapter for details. Cyclic Sleep Cyclic sleep allows the module to sleep for a specified time and wake for a short time to poll its parent for any buffered data messages before returning to sleep again. Cyclic sleep mode is enabled by setting the SM command to 4 or 5.
XBee®/XBee‐PRO® ZB RF Modules In the figure above, t1, t2, and t3 represent the following events: • T1 - Time when the module wakes from cyclic sleep • T2 - Time when the module returns to sleep • T3 - Later time when the module wakes from cyclic sleep. The wake time and sleep time are configurable with software commands as described in the sections below. Wake Time (Until Sleep) In cyclic sleep mode (SM=4 or 5), if serial or RF data is received, the module will start a sleep timer (time until sleep).
XBee®/XBee‐PRO® ZB RF Modules DIN ST = Time Awake On/Sleep A cyclic sleep end device enters sleep mode when no serial or RF data is received for ST time . Legend On/Sleep Transmitting Poll Request Sleep Period The sleep period is configured based on the SP, SN, and SO commands. The following table lists the behavior of these commands. Command Range Description SP 0x20 - 0xAF0 (x 10 ms) (320 - 28,000 ms) Configures the sleep period of the module.
XBee®/XBee‐PRO® ZB RF Modules On/Sleep (SN = 3) On/Sleep (SN = 1) Δt = SP * SN Δt = SP * SN Transmitting poll request to parent Δt = SP Transmitting poll request to parent Δt = SP Setting SN > 1 allows the XBee to silently poll for data without asserting On /Sleep. If RF data is received when polling, On/Sleep will immediately assert . Legend Sleep_RQ Transmitting Poll Request Note: SP controls the packet buffer time on routers and coordinators.
XBee®/XBee‐PRO® ZB RF Modules The XBee ZB 2x6x firmware includes an adaptive polling enhancement where, if an end device receives RF data from its parent, it sends another poll after a very short delay to check for more data. The end device continues to poll at a faster rate as long as it receives data from its parent. This feature greatly improves data throughput to end devices. When the end device no longer receives data from its parent, it resumes polling every 100ms.
XBee®/XBee‐PRO® ZB RF Modules XBee Router/Coordinator Configuration XBee routers and coordinators may require some configuration to ensure the following are set correctly: • RF packet buffering timeout • Child poll timeout • Transmission timeout. The value of these timeouts depends on the sleep time used by the end devices. Each of these timeouts are discussed below.
XBee®/XBee‐PRO® ZB RF Modules Putting it all Together Short Sleep Periods Pin and cyclic sleep devices that sleep less than 30 seconds can receive data transmissions at any time since their parent device(s) will be able to buffer data long enough for the end devices to wake and poll to receive the data. SP should be set the same on all devices in the network.
XBee®/XBee‐PRO® ZB RF Modules SN = 1 SO = 0 ST = 0x7D0 (2000 decimal). This sets the sleep timer to 2 seconds. IR = 0x258 (600 decimal). Set IR to a value greater than (2 seconds / 4) to get 4 samples in 2 seconds. The end device sends an IO sample at the IR rate until the sleep timer has expired. At least one analog or digital IO line must be enabled for IO sampling to work.
8. XBee Analog and Digital IO Lines XBee ZB firmware supports a number of analog and digital IO pins that are configured through software commands. Analog and digital IO lines can be set or queried. The following table lists the configurable IO pins and the corresponding configuration commands.
XBee®/XBee‐PRO® ZB RF Modules • Queried Sampling • Periodic Sampling • Change Detection Sampling. IO sample data is formatted as shown in the table below Bytes 1 Name Sample Sets Description Number of sample sets in the packet. (Always set to 1.) Indicates which digital IO lines have sampling enabled. Each bit corresponds to one digital IO line on the module.
XBee®/XBee‐PRO® ZB RF Modules The reading in the sample frame represents voltage inputs of 1143.75 and 342.1875mV for AD0 and AD1 respectively. Queried Sampling The IS command can be sent to a device locally, or to a remote device using the API remote command frame (see chapter 8 for details). When the IS command is sent, the receiving device samples all enabled digital IO and analog input channels and returns an IO sample. If IS is sent locally, the IO sample is sent out the UART.
XBee®/XBee‐PRO® ZB RF Modules RSSI/PWM pin is driven low. RP is measured in 100ms units and defaults to a value of 40 (4 seconds). The RSSI PWM runs at 12MHz and has 2400 total counts (200us period). RSSI (in dBm) is converted to PWM counts using the following equation: PWM counts = (41 * RSSI_Unsigned) - 5928 IO Examples Example 1: Configure the following IO settings on the XBee.
9. API Operation As an alternative to Transparent Operation, API (Application Programming Interface) Operations are available. API operation requires that communication with the module be done through a structured interface (data is communicated in frames in a defined order). The API specifies how commands, command responses and module status messages are sent and received from the module using a UART Data Frame.
XBee®/XBee‐PRO® ZB RF Modules Data bytes that need to be escaped: • 0x7E – Frame Delimiter • 0x7D – Escape • 0x11 – XON • 0x13 – XOFF Example - Raw UART Data Frame (before escaping interfering bytes): 0x7E 0x00 0x02 0x23 0x11 0xCB 0x11 needs to be escaped which results in the following frame: 0x7E 0x00 0x02 0x23 0x7D 0x31 0xCB Note: In the above example, the length of the raw data (excluding the checksum) is 0x0002 and the checksum of the non-escaped data (excluding frame delimiter and length) is calcul
XBee®/XBee‐PRO® ZB RF Modules Checksum To test data integrity, a checksum is calculated and verified on non-escaped data. To calculate: Not including frame delimiters and length, add all bytes keeping only the lowest 8 bits of the result and subtract the result from 0xFF. To verify: Add all bytes (include checksum, but not the delimiter and length). If the checksum is correct, the sum will equal 0xFF.
XBee®/XBee‐PRO® ZB RF Modules API UART Exchanges AT Commands The following image shows the API frame exchange that takes place at the UART when sending an AT command request to read or set a module parameter. The response can be disabled by setting the frame ID to 0 in the request. Transmitting and Receiving RF Data The following image shows the API exchanges that take place at the UART when sending RF data to another device.
XBee®/XBee‐PRO® ZB RF Modules Source Routing The following image shows the API frame exchanges that take place at the UART when sending a source routed transmission. Supporting the API Applications that support the API should make provisions to deal with new API frames that may be introduced in future releases.
XBee®/XBee‐PRO® ZB RF Modules Frame Fields Start Delimiter Offset Example Description 0 0x7E Length MSB 1 0x00 A P Frame-specific Data Frame Type I Frame ID P a c k e t AT Command LSB 2 0x04 3 0x08 4 0x52 (R) 5 0x4E (N) 6 0x4A (J) Identifies the UART data frame for the host to correlate with a subsequent ACK (acknowledgement). If set to 0, no response is sent. Command Name - Two ASCII characters that identify the AT Command.
XBee®/XBee‐PRO® ZB RF Modules to multiple destinations. If a 16-bit address is not known, this field should be set to 0xFFFE (unknown). The Transmit Status frame (0x8B) will indicate the discovered 16-bit address, if successful. The broadcast radius can be set from 0 up to NH. If set to 0, the value of NH specifies the broadcast radius (recommended). This parameter is only used for broadcast transmissions. The maximum number of payload bytes can be read with the NP command.
XBee®/XBee‐PRO® ZB RF Modules Example: The example above shows how to send a transmission to a module where escaping is disabled (AP=1) with destination address 0x0013A200 40014011, payload "TxData1B".
XBee®/XBee‐PRO® ZB RF Modules Frame Fields Start Delimiter Offset Example Description 0 0x7E Length MSB 1 0x00 LSB 2 0x1A Frame-specific Data Frame Type Frame ID Number of bytes between the length and the checksum 3 0x11 4 0x01 Identifies the UART data frame for the host to correlate with a subsequent ACK (acknowledgement). If set to 0, no response is sent. MSB 5 0x00 6 0x00 64-bit Destination Address 7 0x00 8 0x00 9 0x00 10 0x00 Set to the 64-bit address of the destination device.
XBee®/XBee‐PRO® ZB RF Modules Remote AT Command Request Frame Type: 0x17 Used to query or set module parameters on a remote device. For parameter changes on the remote device to take effect, changes must be applied, either by setting the apply changes options bit, or by sending an AC command to the remote.
XBee®/XBee‐PRO® ZB RF Modules Create Source Route Frame Type: 0x21 This frame creates a source route in the module. A source route specifies the complete route a packet should traverse to get from source to destination. Source routing should be used with many-to-one routing for best results. Note: Both the 64-bit and 16-bit destination addresses are required when creating a source route. These are obtained when a Route Record Indicator (0xA1) frame is received.
XBee®/XBee‐PRO® ZB RF Modules AT Command Response Frame Type: 0x88 In response to an AT Command message, the module will send an AT Command Response message. Some commands will send back multiple frames (for example, the ND (Node Discover) command).
XBee®/XBee‐PRO® ZB RF Modules ZigBee Transmit Status Frame Type: 0x8B When a TX Request is completed, the module sends a TX Status message. This message will indicate if the packet was transmitted successfully or if there was a failure. Frame Fields Start Delimiter Offset Example Length MSB 1 0x00 LSB 2 0x07 Frame Type 3 0x8B Frame ID 4 0x01 5 0x7D Number of bytes between the length and the checksum Identifies the UART data frame being reported.
XBee®/XBee‐PRO® ZB RF Modules ZigBee Receive Packet Frame Type: (0x90) When the module receives an RF packet, it is sent out the UART using this message type. Frame Fields Start Delimiter Offset Example Description 0 0x7E Length MSB 1 0x00 LSB 2 0x11 Frame Type Number of bytes between the length and the checksum 3 0x90 MSB 4 0x00 5 0x13 64-bit Source Address A P I 6 0xA2 7 0x00 8 0x40 9 0x52 64-bit address of sender.
XBee®/XBee‐PRO® ZB RF Modules ZigBee Explicit Rx Indicator Frame Type:0x91 When the modem receives a ZigBee RF packet it is sent out the UART using this message type (when AO=1). Frame Fields Offset Start Delimiter Example Description 0 0x7E Length MSB 1 0x00 Number of bytes between the length and the checksum LSB 2 0x18 Frame Type 3 0x91 MSB 4 0x00 5 0x13 64-bit Source Address 6 0xA2 7 0x00 8 0x40 64-bit address of sender.
XBee®/XBee‐PRO® ZB RF Modules ZigBee IO Data Sample Rx Indicator Frame Type: 0x92 When the module receives an IO sample frame from a remote device, it sends the sample out the UART using this frame type (when AO=0). Only modules running API firmware will send IO samples out the UART.
XBee®/XBee‐PRO® ZB RF Modules Example: Suppose an IO sample is received with analog and digital IO, from a remote with a 64bit address of 0x0013A200 40522BAA and a 16-bit address of 0x7D84. If pin AD1/DIO1 is enabled as an analog input, AD2/DIO2 and DIO4 are enabled as a digital inputs (currently high), and AD3/ DIO3 is enabled as a digital output (low) the IO sample is shown in the API example in the table above.
XBee®/XBee‐PRO® ZB RF Modules T = 0x016A To convert these to temperature and humidity values, the following equations should be used. Temperature (°C) = (T / 16), for T < 2048 = - (T & 0x7FF) / 16, for T >= 2048 Vsupply = (AD2 * 5.1) / 255 Voutput = (AD3 * 5.1) / 255 Relative Humidity = ((Voutput / Vsupply) - 0.16) / (0.0062) True Humidity = Relative Humidity / (1.0546 - (0.00216 * Temperature (°C))) Looking at the sample data, we have: Vsupply = (234 * 5.1 / 255) = 4.68 Voutput = (82 * 5.1 / 255) = 1.
XBee®/XBee‐PRO® ZB RF Modules Node Identification Indicator Frame Type: 0x95 This frame is received when a module transmits a node identification message to identify itself (when AO=0). The data portion of this frame is similar to a network discovery response frame (see ND command).
XBee®/XBee‐PRO® ZB RF Modules Example: If the commissioning push button is pressed on a remote router device with 64-bit address 0x0013A200 40522BAA, 16-bit address 0x7D84, and default NI string, the following node identification indicator would be received. Remote Command Response Frame Type: 0x97 If a module receives a remote command response RF data frame in response to a Remote AT Command Request, the module will send a Remote AT Command Response message out the UART.
XBee®/XBee‐PRO® ZB RF Modules Over-the-Air Firmware Update Status Frame Type: 0xA0 The Over-the-Air Firmware Update Status frame provides a status indication of a firmware update transmission attempt. If a query command (0x01 0x51) is sent to a target with a 64-bit address of 0x0013A200 40522BAA through an updater with 64-bit address 0x0013A200403E0750 and 16-bit address 0x0000, the following is the expected response.
XBee®/XBee‐PRO® ZB RF Modules Route Record Indicator Frame Type: 0xA1 The route record indicator is received whenever a device sends a ZigBee route record command. This is used with many-to-one routing to create source routes for devices in a network.
XBee®/XBee‐PRO® ZB RF Modules Many-to-One Route Request Indicator Frame Type: 0xA3 The many-to-one route request indicator frame is sent out the UART whenever a many-to-one route request is received Frame Fields Start Delimiter Offset Example Description 0 0x7E MSB 1 0x00 Length LSB 2 0x0C Frame Type Number of bytes between the length and the checksum 3 0xA3 MSB 4 0x00 A P I 5 0x13 64-bit Source P Address a c Frame-specific Data k e t Source 16-bit Address Reserved Checksum 6 0xA2 7 0x00 8 0x
XBee®/XBee‐PRO® ZB RF Modules Sending ZigBee Device Objects (ZDO) Commands with the API ZigBee Device Objects (ZDOs) are defined in the ZigBee Specification as part of the ZigBee Device Profile. These objects provide functionality to manage and map out the ZigBee network and to discover services on ZigBee devices.
XBee®/XBee‐PRO® ZB RF Modules Frame Fields Offset Start Delimiter Example Description 0 0x7E Length MSB 1 0x00 LSB 2 0x17 Frame Type 3 0x11 Frame ID 4 0x01 Number of bytes between the length and the checksum Identifies the UART data frame for the host to correlate with a subsequent transmit status. If set to 0, no transmit status frame will be sent out the UART.
XBee®/XBee‐PRO® ZB RF Modules Sending ZigBee Cluster Library (ZCL) Commands with the API The ZigBee Cluster Library defines a set of attributes and commands (clusters) that can be supported in multiple ZigBee profiles. The ZCL commands are typically required when developing a ZigBee product that will interoperate in a public profile such as home automation or smart energy, or when communicating with ZigBee devices from other vendors.
XBee®/XBee‐PRO® ZB RF Modules Note: When sending ZCL commands, the AO command should be set to 1 to enable the explicit receive API frame. This will provide indication of the source 64- and 16-bit addresses, cluster ID, profile ID, and endpoint information for each received packet. This information is required to properly decode received data.
XBee®/XBee‐PRO® ZB RF Modules In the above example, the Frame Control field (offset 23) was constructed as follows: Name Bits Example Value Description Frame Type 0-1 00 - Command acts across the entire profile Manufacturer Specific 2 0 - The manufacturer code field is omitted from the ZCL Frame Header. Direction 3 0 - The command is being sent from the client side to the server side. Disable Default Response 4 0 - Default response not disabled Reserved 5-7 Set to 0.
XBee®/XBee‐PRO® ZB RF Modules Frame Fields Offset Start Delimiter Example Description 0 0x7E Length MSB 1 0x00 LSB 2 0x19 Frame Type 3 0x11 Frame ID 4 0x01 Number of bytes between the length and the checksum Identifies the UART data frame for the host to correlate with a subsequent transmit status. If set to 0, no transmit status frame will be sent out the UART.
XBee®/XBee‐PRO® ZB RF Modules Frame Fields Offset Example 26 0x78 4-byte unique identifier. Note the 4-byte ID is sent in little endian byte order (0x78563412). The event ID in this example (0x12345678) was arbitrarily selected. 27 0x56 Issuer Event ID 28 0x34 29 0x12 30 0x14 Device Class Utility Enrollment Group Description to apply the load control event. A bit value of 0x0014 enables smart appliances and water heaters. Note the 2-byte bit field value is sent in little endian byte order.
10. XBee Command Reference Tables Addressing Addressing Commands AT Name and Description Command Node Type1 Parameter Range Default DH Destination Address High.Set/Get the upper 32 bits of the 64-bit destination address. When combined with DL, it defines the 64-bit destination address for data transmission. CRE Special definitions for DH and DL include 0x000000000000FFFF (broadcast) and 0x0000000000000000 (coordinator). 0 - 0xFFFFFFFF 0 DL Destination Address Low.
XBee®/XBee‐PRO® ZB RF Modules Networking Networking Commands AT Name and Description Command Node Type1 Parameter Range Default CH Operating Channel. Read the channel number used for transmitting and receiving between RF modules. Uses 802.15.4 channel numbers. A value of 0 means the device CRE has not joined a PAN and is not operating on any channel. 0, 0x0B - 0x1A (XBee) 0, 0x0B - 0x18 (XBeePRO) [read-only] ID Extended PAN ID. Set/read the 64-bit extended PAN ID.
XBee®/XBee‐PRO® ZB RF Modules Networking Commands AT Name and Description Command Node Parameter Range Default NW Network Watchdog Timeout. Set/read the network watchdog timeout value. If NW is set > 0, the router will monitor communication from the coordinator (or data collector) and leave the network if it cannot communicate with the coordinator for 3 NW periods. R The timer is reset each time data is received from or sent to a coordinator, or if a manyto-one broadcast is received.
XBee®/XBee‐PRO® ZB RF Modules Security Security Commands AT Name and Description Command Node Parameter Range Type1 EE Encryption Enable. Set/Read the encryption enable setting. CRE EO Encryption Options. Configure options for encryption. Unused option bits should be set to 0. Options include: CRE 0x01 - Send the security key unsecured over-the-air during joins 0x02 - Use trust center (coordinator only 0 - 0xFF NK Network Encryption Key. Set the 128-bit AES network encryption key.
XBee®/XBee‐PRO® ZB RF Modules Serial Interfacing (I/O) Serial Interfacing Commands AT Name and Description Command Node Parameter Range Type1 Default CRE 1 - 2 1 = API-enabled 2 = API-enabled 1 (w/escaped control characters) CRE 0 - Default receive API indicators enabled 1 - Explicit Rx data indicator API frame enabled (0x91) 3 - enable ZDO passthrough of ZDO requests to the UART which are not supported by the stack, as well as Simple_Desc_req, Active_EP_req, and Match_Desc_req.
XBee®/XBee‐PRO® ZB RF Modules I/O Commands I/O Commands AT Name and Description Command Node Parameter Range Type1 Default IR IO Sample Rate. Set/Read the IO sample rate to enable periodic sampling. For periodic sampling to be enabled, IR must be set to a non-zero value, and at least one module pin CRE must have analog or digital IO functionality enabled (see D0-D8, P0-P2 commands). The sample rate is measured in milliseconds. 0, 0x32:0xFFFF (ms) 0 IC IO Digital Change Detection.
XBee®/XBee‐PRO® ZB RF Modules I/O Commands AT Name and Description Command D3 D4 AD3/DIO3 Configuration. Select/Read function for AD3/DIO3. DIO4 Configuration. Select/Read function for DIO4. Node Parameter Range Type1 Default CRE 0, 2-5 0 – Disabled 2 - Analog input, single ended 3 – Digital input 4 – Digital output, low 5 – Digital output, high 0 CRE 0, 3-5 0 – Disabled 3 – Digital input 4 – Digital output, low 5 – Digital output, high 0 D5 DIO5 Configuration.
XBee®/XBee‐PRO® ZB RF Modules Diagnostics Diagnostics Commands AT Name and Description Command Node Parameter Range Type1 Default CRE 0 - 0xFFFF [read-only] Factory-set CRE 0 - 0xFFFF [read-only] Factory-set 0 - 0xFF [read-only] -- Firmware Version. Read firmware version of the module. The firmware version returns 4 hexadecimal values (2 bytes) "ABCD". Digits ABC are the main release number and D is the revision number from the main release. "B" is a variant designator.
XBee®/XBee‐PRO® ZB RF Modules Sleep Commands Sleep Commands Node Parameter Range Type1 AT Name and Description Command Default SM Sleep Mode Sets the sleep mode on the RF module. An XBee loaded with router firmware can be configured as either a router (SM set to 0) or an end device (SM > 0). RE Changing a device from a router to an end device (or vise versa) forces the device to leave the network and attempt to join as the new device type when changes are applied.
XBee®/XBee‐PRO® ZB RF Modules Execution Commands AT Name and Description Command Node Type1 Parameter Range Default ND Node Discover. Discovers and reports all RF modules found. The following information is reported for each module discovered.
11. Module Support This chapter provides customization information for the XBee/XBee-PRO ZB modules. In addition to providing an extremely flexible and powerful API, the XBee and XBee-PRO ZB modules are a robust development platform that have passed FCC and ETSI testing. Developers can customize default parameters, or even write or load custom firmware for Ember's EM250 chip. X-CTU Configuration Tool Digi provides a Windows X-CTU configuration tool for configuring module parameters and updating firmware.
XBee®/XBee‐PRO® ZB RF Modules 6. Commands can be sent to the bootloader at 115200bps. Note: Hardware flow control should be disabled when entering and communicating with the EM250 bootloader. Programming XBee Modules Firmware on the XBee and XBee-PRO ZB modules can be updated through one of two means: • Serially • SIF header. Each method is described below. Serial Firmware Updates Serial firmware updates make use of the XBee custom bootloader which ships in all units.
XBee®/XBee‐PRO® ZB RF Modules Hex Error Code Description 0x26 The frame that the bootloader was trying to parse was deemed incomplete (some bytes missing or lost). 0x27 The bootloader encountered a duplicate of the previous XModem frame. 0x41 No .ebl header was received when expected. 0x42 Header failed CRC. 0x43 File failed CRC. 0x44 Unknown tag detected in .ebl image. 0x45 Invalid .ebl header signature. 0x46 Trying to flash odd number of bytes. 0x47 Indexed past end of block buffer.
XBee®/XBee‐PRO® ZB RF Modules following table lists values for these bits that enable GPIO 1 and 2. Other functionality is affected by these settings. See the EM250 datasheet from Ember for a complete listing of functionality.
XBee®/XBee‐PRO® ZB RF Modules XBee-PRO modules must also set a couple of IO lines to enable output power compensation. This is shown below. Once the IO lines are initialized (after powerup), the XBee will enable the power amplifier and LNA as needed. On Powerup: /* GPIO 2 should be set low for at least 10 milliseconds when coming up from power cycle.
Appendix A: Definitions Definitions ZigBee Node Types Coordinator A node that has the unique function of forming a network. The coordinator is responsible for establishing the operating channel and PAN ID for an entire network. Once established, the coordinator can form a network by allowing routers and end devices to join to it. Once the network is formed, the coordinator functions like a router (it can participate in routing packets and be a source or destination for data packets).
XBee®/XBee‐PRO® ZB RF Modules Joining The process of a node becoming part of a ZigBee PAN. A node becomes part of a network by joining to a coordinator or a router (that has previously joined to the network). During the process of joining, the node that allowed joining (the parent) assigns a 16-bit address to the joining node (the child). Network Address The 16-bit address assigned to a node after it has joined to another node. The coordinator always has a network address of 0.
Appendix B: Agency Certifications United States FCC The XBee RF Module complies with Part 15 of the FCC rules and regulations. Compliance with the labeling requirements, FCC notices and antenna usage guidelines is required. To fulfill FCC Certification, the OEM must comply with the following regulations: 1.The system integrator must ensure that the text on the external label provided with this device is placed on the outside of the final product. [Figure A-01] 2.
XBee®/XBee‐PRO® ZB RF Modules If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures: Re-orient or relocate the receiving antenna, Increase the separation between the equipment and receiver, Connect equipment and receiver to outlets on different circuits, or Consult the dealer or an experienced radio/TV technician for hel
XBee®/XBee‐PRO® ZB RF Modules Antennas approved for use with the XBee RF Module YAGI CLASS ANTENNAS Part Number Type (Description) Gain Application* Min. Separation Cable-loss Required A24-Y6NF A24-Y7NF A24-Y9NF A24-Y10NF A24-Y12NF A24-Y13NF A24-Y15NF A24-Y16NF A24-Y16RM A24-Y18NF Yagi (6-element) Yagi (7-element) Yagi (9-element) Yagi (10-element) Yagi (12-element) Yagi (13-element) Yagi (15-element) Yagi (16-element) Yagi (16-element, RPSMA connector) Yagi (18-element) 8.8 dBi 9.0 dBi 10.
XBee®/XBee‐PRO® ZB RF Modules Antennas approved for use with the XBee‐PRO (S2) RF Module YAGI CLASS ANTENNAS Part Number Type (Description) Gain Application* Min. Separation Cable-loss Required A24-Y6NF A24-Y7NF A24-Y9NF A24-Y10NF A24-Y12NF A24-Y13NF A24-Y15NF A24-Y16NF A24-Y16RM A24-Y18NF Yagi (6-element) Yagi (7-element) Yagi (9-element) Yagi (10-element) Yagi (12-element) Yagi (13-element) Yagi (15-element) Yagi (16-element) Yagi (16-element, RPSMA connector) Yagi (18-element) 8.8 dBi 9.
XBee®/XBee‐PRO® ZB RF Modules Antennas approved for use with the XBee‐PRO (S2B) RF Module YAGI CLASS ANTENNAS for Channels 11 to 24 Part Number Type (Description) Gain Application* Min. Separation Minimum Cable Loss/ Power Reduction/ Attenuation Required for 18dBm Output A24-Y6NF A24-Y7NF A24-Y9NF A24-Y10NF A24-Y12NF A24-Y13NF A24-Y15NF A24-Y16NF A24-Y16RM A24-Y18NF 8.8 dBi 9.0 dBi 10.0 dBi 11.0 dBi 12.0 dBi 12.0 dBi 12.5 dBi 13.5 dBi 13.5 dBi 15.
XBee®/XBee‐PRO® ZB RF Modules YAGI CLASS ANTENNAS for Channels 11 to 24 Part Number Type (Description) Gain Application* Min. Separation Minimum Cable Loss/ Power Reduction/ Attenuation Required for 18dBm Output A24-P15NF A24-P16NF A24-P19NF 15.0 dBi 16.0 dBi 19.0 dBi Fixed Fixed Fixed 2m 2m 2m 1.8 dB 2.8 dB 5.
XBee®/XBee‐PRO® ZB RF Modules Declarations of Conformity Digi has issued Declarations of Conformity for the XBee RF Modules concerning emissions, EMC and safety. Files can be obtained by contacting Digi Support. Important Note: Digi does not list the entire set of standards that must be met for each country. Digi customers assume full responsibility for learning and meeting the required guidelines for each country in their distribution market.
XBee®/XBee‐PRO® ZB RF Modules Canada (IC) Labeling Requirements Labeling requirements for Industry Canada are similar to those of the FCC. A clearly visible label on the outside of the final product enclosure must display the following text: Contains Model XBee Radio, IC: 4214A-XBEE2 The integrator is responsible for its product to comply with IC ICES-003 & FCC Part 15, Sub. B Unintentional Radiators. ICES-003 is the same as FCC Part 15 Sub.
Appendix C: Migrating from ZNet 2.5 to XBee ZB The following paragraph contains the significant differences in XBee ZB compared to its predecessor, ZNet 2.5. • Command Set • Firmware Versions • New Features. Command Set The following ZNet 2.5 commands have changed for XBee ZB: • ZA - Set / read the ZigBee Addressing enable command. This command was required in ZNet 2.5 to enable application level addressing commands SE, DE, CI. XBee ZB does not support ZA.
Appendix D:Additional Information 1-Year Warranty XBee RF Modules from Digi International, Inc. (the "Product") are warranted against defects in materials and workmanship under normal use, for a period of 1-year from the date of purchase. In the event of a product failure due to materials or workmanship, Digi will repair or replace the defective product. For warranty service, return the defective product to Digi International, shipping prepaid, for prompt repair or replacement.
