This manual describes the operation of the XBee/XBeePRO ZB RF module, which consists of ZigBee firmware
loaded onto XBee S2 and S2B hardware, models: XBEE2,
XBEEPRO2 and PRO S2B. The XBee/XBee-PRO ZB RF
Modules are designed to operate within the ZigBee
protocol and support the unique needs of low-cost, lowpower wireless sensor networks. The modules require
minimal power and provide reliable delivery of data
between remote devices.
The modules operate within the ISM 2.4 GHz frequency band and are compatible with the
following:
• XBee RS-232 Adapter
• XBee RS-485 Adapter
• XBee Analog I/O Adapter
• XBee Digital I/O Adapter
• XBee Sensor
• XBee USB Adapter
•XStick
• ConnectPort X Gateways
• XBee Wall Router.
The XBee/XBee-PRO ZB firmware release can be installed on XBee ZNet or ZB modules. The XBee
ZB firmware is based on the EmberZNet 3.x ZigBee PRO Feature Set mesh networking stack, while
the XBee ZNet 2.5 firmware is based on Ember's proprietary "designed for ZigBee" mesh stack
(EmberZNet 2.5.x). ZB and ZNet 2.5 firmware are similar in nature, but not over-the-air
compatible. Devices running ZNet 2.5 firmware cannot talk to devices running the ZB firmware.
What's New in 2x7x
Firmware
XBee/XBee-PRO ZB firmware includes the following new features (compared with 2x6x):
• Using Ember stack version 3.4.1.
• Support for the PRO S2B with temperature compensati on and an overvoltage chec k. Within 15
seconds of the supply voltage exceeding 3.9V, the API will emit a 0x08 modem status (Overvoltage) message, and then the AT/API versions will do a watchdog reset.
• ZDO passthru added. If AO=3, then ZDO requests which are not supported by the stack will
be passed out the UART.
• An attempt to send an oversized packet (256+ bytes) will result in a Tx Status message with
a status code of 0x74.
• End devices have two speed polling. 7.5 seconds is the slow rate, which switches to the fast
rate to trasact with its parent. When transactions are done, it switches back to the slow rate.
• A new receive option bit (0x40) indicates if the packet came from an end device.
• If the extended timeout option is enabled, then use it because end devices need more time
than routers to ack their packets.
• An option bit (0x01) was added to disable APS retries.
• If an end device has not had its polls answered for 5 secs, it will leave and attempt to rejoin
the network.
• XBee S2B has a new TP command which returns the temperature compensation sensor reading in units if Celsius degrees.
• The PP command returns the power dBm setting when PL4 is selected.
• The PO command sets the slow polling rate on end devices. Range is 1-0x1770 in units of 10
msec (10 msec to 60 sec). Default is 0 which invokes a 100 msec delay.
• Indoor/Urban: up to 300’ (90 m), 200' (60
m) for International variant
• Outdoor line-of-sight: up to 1 mile (1600
m), 2500' (750 m) for International variant
• Transmit Power: 50mW (17dBm), 10mW
(10dBm) for International variant
• Receiver Sensitivity: -102 dBm
XBee-PRO (S2B)
• Indoor/Urban: up to 300’ (90 m), 200' (60
m) for International variant
• Outdoor line-of-sight: up to 1 mile (1600
m), 2500' (750 m) for International variant
• Transmit Power: 68mW (18dBm), 10mW
(10dBm) for International variant
• Receiver Sensitivity: -102 dBm
Advanced Networking & Security
Retries and Acknowledgements
DSSS (Direct Sequence Spread Spectrum)
Each direct sequence channel has over
65,000 unique network addresses available
Point-to-point, point-to-multipoint
and peer-to-peer topologies supported
Self-routing, self-healing and fault-tolerant
mesh networking
Low Power
XBee
• TX Peak Current: 40 mA (@3.3 V)
• RX Current: 40 mA (@3.3 V)
• Power-down Current: < 1 uA
XBee-PRO (S2)
• TX Peak Current: 295mA (170mA for
international variant)
• RX Current: 45 mA (@3.3 V)
• Power-down Current: < 10 uA
XBee-PRO (S2B)
• TX Peak Current: 205mA (117mA for
international variant)
• RX Current: 47 mA (@3.3 V)
• Power-down Current: < 10 uA
Easy-to-Use
No configuration necessary for out-of box
RF communications
AT and API Command Modes for
configuring module parameters
Small form factor
Extensive command set
Free X-CTU Software
(Testing and configuration software)
Free & Unlimited Technical Support
Key Features
Worldwide Acceptance
FCC Approval (USA) Refer to Appendix A for FCC Requirements.
Systems that contain XBee®/XBee-PRO® ZB RF Modules inherit Digi Certifications.
ISM (Industrial, Scientific & Medical) 2.4 GHz frequency band
Manufactured under ISO 9001:2000 registered standards
XBee®/XBee-PRO® ZB RF Modules are optimized for use in US, Canada, Europe,
Australia, and Japan (contact Digi for complete list of agency approvals).
RF Data Rate250,000 bps250,000 bps250,000 bps
Data Throughputup to 35000 bps (see chapter 4)up to 35000 bps (see chapter 4)up to 35000 bps (see chapter 4)
Serial Interface Data Rate
(software selectable)
Receiver Sensitivity
Power Requirements
Supply Voltage2.1 - 3.6 V3.0 - 3.4 V2.7 - 3.6 V
Operating Current
(Transmit, max output
power)
Operating Current
(Receive))
Idle Current (Receiver off) 15mA15mA15mA
Power-down Current
General
Operating Frequency
Band
Dimensions0.960” x 1.087” (2.438cm x 2.761cm) 0.960 x 1.297 (2.438cm x 3.294cm)0.960 x 1.297 (2.438cm x 3.294cm)
Operating Temperature-40 to 85º C (industrial)-40 to 85º C (industrial)-40 to 85º C (industrial)
Antenna Options
Networking & Security
Supported Network
Topologies
Number of Channels16 Direct Sequence Channels14 Direct Sequence Channels15 Direct Sequence Channels
Addressing Options
Agency Approvals
United States (FCC Part
15.247)
Industry Canada (IC)IC: 4214A-XBEE2IC: 1846A-XBEEPRO2IC: 1846A-PROS2B
Europe (CE) ETSIETSIETSI
AustraliaC-TickC-TickC-Tick
Up to 300 ft. (90 m), up to 200 ft (60 m)
international variant
up to 400 ft. (120 m)
2mW (+3dBm), boost mode enabled
1.25mW (+1dBm), boost mode
disabled
1200 bps - 1 Mbps
(non-standard baud rates also
supported)
-96 dBm, boost mode enabled
-95 dBm, boost mode disabled
40mA (@ 3.3 V, boost mode
enabled)
35mA (@ 3.3 V, boost mode
disabled)
40mA (@ 3.3 V, boost mode
enabled)
38mA (@ 3.3 V, boost mode
disabled)
o
< 1 uA @ 25
ISM 2.4 GHzISM 2.4 GHzISM 2.4 GHz
Integrated Whip, Chip, RPSMA, or
U.FL Connector
Point-to-point, Point-to-multipoint,
Peer-to-peer, and Mesh
PAN ID and Addresses, Cluster IDs
and Endpoints (optional)
The XBee/XBee-PRO ZB modules include a SIF programming header that can be used with
Ember's programming tools to upload custom firmware images onto the XBee module. The SIF
header orientation and pinout are shown below.
A male header can be populated on the XBee that mates with Ember's 2x5 ribbon cable. The male
header and ribbon cables are available from Samtec:
2x5 Male Header - FTSH-105-01-F-DV-K
2x5 Ribbon Cable - FFSD-05-D-12.00-01-N
Mounting Considerations
The XBee modules were designed to mount into a receptacle (socket) and therefore does not
require any soldering when mounting it to a board. The XBee-PRO Development Kits contain RS232 and USB interface boards which use two 20-pin receptacles to receive modules.
The receptacles used on Digi development boards are manufactured by Century Interconnect.
Several other manufacturers pro vide compar able mounting sol utions; however, Digi currently uses
the following receptacles:
The following table shows how the EM250 pins are used on the XBee.
EM250 Pin Number XBee Pin NumberOther Usage
13 (Reset)5Connected to pin 8 on 2x5 SIF header.
19 (GPIO 11)16
20 (GPIO 12)12
21 (GPIO 0)
22 (GPIO 1)
24 (GPIO 2)
25 (GPIO 3)13
26 (GPIO 4 / ADC 0)20Connected to pin 9 on 2x5 SIF header.
27 (GPIO 5 / ADC 1)19Connected to pin 10 on 2x5 SIF header.
29 (GPIO 6 /ADC 2)18
30 (GPIO 7 / ADC 317
31 (GPIO 8)4
32 (GPIO 9)2
33 (GPIO 10)3
34 (SIF_CLK)Connected to pin 6 on 2x5 SIF header.
35 (SIF_MISO)Connected to pin 2 on 2x5 SIF header.
36 (SIF_MOSI)Connected to pin 4 on 2x5 SIF header.
37 (SIF_LOAD)Connected to pin 7 on 2x5 SIF header.
40 (GPIO 16)7
41 (GPIO 15)6
42 (GPIO 14)9
43 (GPIO 13)11
15
XBee
Tied to ground (module identification)
XBee-PRO (S2)
Low-asserting shutdown line for output power compensation circuitry.
XBee-PRO (S2B)
Used to communicate with Temp Sensor and control Shutdown for low power mode.
XBee
Not connected. Configured as output low.
XBee-PRO (S2)
Powers the output power compensation circuitry.
XBee-PRO (S2B)
Used to communicate with Temp Sensor and control Shutdown for low power mode.
Design Notes
The XBee modules do not specifically require any external circuitry or specific connections for
proper operation. However, there are some general design guidelines that are recommended for
help in troubleshooting and building a robust design.
Power Supply Design
Poor power supply can lead to poor radio performance especially if the supply voltage is not kept
within tolerance or is excessively noisy. To help reduce noise a 1uF and 8.2pF capacitor are
recommended to be placed as near to pin1 on the PCB as possible. If using a switching regulator
for your power supply, switching frequencies above 500kHz are preferred. Power supply ripple
should be limited to a maximum 250mV peak to peak.
Recommended Pin Connections
The only required pin connections are VCC, GND, DOUT and DIN. To support serial firmware
updates, VCC, GND, DOUT, DIN, RTS, and DTR should be connected.
All unused pins should be left disconnected. All inputs on the radio can be pulled high with 30k
internal pull-up resistors using the PR software command. No specific treatment is needed for
unused outputs.
For applications that need to ensu re th e l owe st sleep current, inputs should never be left floating.
Use internal or external pull-up or pull-down resistors, or set the unused I/O lines to outputs.
Other pins may be connected to external circuitry for convenience of operation including the
Associate LED pin (pin 15) and the Commissioning pin (pin 20). The Associate LED pin will flash
differently depending on the state of the module to the network, and a pushbutton attached to pin
20 can enable various join functions without having to send UART commands. Please see the
commissioning pushbutton and associate LED section in chapter 7 for more details. The source
and sink capabilities are limited to 4mA for all pins on the modu le.
The VRef pin (pin 14) is not used on this module. For compatibility with other XBee modules, we
recommend connecting this pin to a voltage reference if analog sampling is desired. Otherwise,
connect to GND.
Board Layout
XBee modules do not have any specific sensitivity to nearby processors, crystals or other PCB
components. Other than mechanical considerations, no special PCB placement is required for
integrating XBee radios except for those with integral antennas. In general, Power and GND tr aces
should be thicker than signal traces and be able to comfortably support the maximum currents.
The radios are also designed to be self sufficient and work with the integrated and external
antennas without the need for additional ground planes on the host PCB. However, considerations
should be taken on the choice of antenna and antenna location. Metal objects that are near an
antenna cause reflections and may reduce the ability for an antenna to efficiently radiate. Using an
integral antenna (like a wire whip antenna) in an enclosed metal box will greatly reduce the range
of a radio. For this type of application an external antenna would be a better choice.
External antennas should be positioned away from metal objects as much as possible. Metal
objects next to the antenna or between transmitting and receiving antennas can often block or
reduce the transmission distance. Some objects that are often overlooked are metal poles, metal
studs or beams in structures, concrete (it is usua lly reinforced with metal rods), metal enclosures,
vehicles, elevators, ventilation ducts, refrigerators and microwave ovens.
Wire Whip Antennas should be straight and perpendicular to the ground plane and/or chassis. It
should reside above or away from any metal objects like batteries, tall electrolytic capacitors or
metal enclosures. If the antenna is bent to fit into a tight space, it should be bent so that as much
of the antenna as possible is away from metal. Caution should be used when bending the antenna,
since this will weaken the solder joint where the antenna connects to the module. Antenna
elements radiate perpendicular to the direction they point. Thus a vertical antenna emits across
the horizon.
Embedded or Chip Antennas should not have any ground planes or metal objects above or below
the module at the antenna location. For best results the module should be in a plastic enclosure,
instead of metal one. It should be placed at t he edge of the PCB to which it is mounted. The
ground, power and signal planes should be vacant immediately below the antenna section (See
drawing for recommended keepout area).
The XBee RF Modules interface to a host device through a logic-level asynchronous serial port.
Through its serial port, the module can communicate with any logic and voltage compatible UART ;
or through a level translator to an y se rial devic e (for e xample: through a RS-232 or USB int erface
board).
UART Data Flow
Devices that have a UART interface can connect directly to the pins of the RF module as shown in
the figure below.
Data enters the module UART through the DIN (pin 3) as an asynchronous serial signal. The signal
should idle high when no data is being transmitted.
Each data byte consists of a start bit (low), 8 data bits (least significant bit first) and a stop bit
(high). The following figure illustrates the serial bit pattern of data passing through the module.
Serial communications depend on the two UAR Ts (the microcontroller's and the RF module's) to be
configured with compatible settings (baud rate, parity, start bits, stop bits, data bits).
The UART baud rate, parity, and stop bits settings on the XBee module can be configured with the
BD, NB, and SB commands respectively. See the command table in chapter 10 for details.
Serial Buffers
The XBee modules maintain small buffers to collect received serial and RF data, which is illustrated
in the figure below. The serial receive buffer collects incoming serial characters and holds them
until they can be processed. The serial transmit buffer collects data that is received via the RF link
that will be transmitted out the UART.
When serial data enters the RF module through the DIN Pin (pin 3), the data is st ored in the serial
receive buffer until it can be processed. Under certain conditions, the module may not be able to
process data in the serial receive buffer immediately. If large amounts of serial data are sent to
the module, CTS
Cases in which the serial receive buffer may become full and possibly overflow:
1.If the module is receiving a continuous stream of RF data, the data in the serial receive buffer
will not be transmitted until the module is no longer receiving RF data.
2.If the module is transmitting an RF data packet, the module may need to discover the destination address or establish a route to the destination. After transmitting the data, the module
may need to retransmit the data if an acknowledgment is not received, or if the transmission is
a broadcast. These issues could delay the processing of data in the serial receive buffer.
flow control may be required to avoid overflowing the serial receive buffer.
Serial Transmit Buffer
When RF data is received, the data is moved into the serial tr ansmit buffer and se nt out the UAR T.
If the serial transmit buffer becomes full enough such that all data in a received RF packet won’t fit
in the serial transmit buffer, the entire RF data packet is dropped.
Cases in which the serial transmit buffer may become full resulting in dropped RF
packets
1. If the RF data rate is set higher than the interface data rate of the module, the module
could receive data faster than it can send the data to the host.
2. If the host does not allow the module to transmit data out from the serial transmit buffer
because of being held off by hardware flow control.
Serial Flow Control
The RTS and CTS module pins can be used to provide RTS and/or CTS flow control. CTS flow
control provides an indication to the host to stop sending serial data to the module. RTS flow
control allows the host to signal the module to not send data in the serial transmit buffer out the
uart. RTS
CTS Flow Control
If CTS flow control is enabled (D7 command), when the serial receive buffer is 17 bytes away from
being full, the module de-asserts CTS
serial data. CTS
and CTS flow control are enabled using the D6 and D7 commands.
(sets it high) to signal to the host device to stop sending
is re-asserted after the serial receive buffer has 34 bytes of space.
If RTS flow control is enabled (D6 command), data in the serial transmit buffe r will not be sent out
the DOUT pin as long as RTS
for long periods of time to avoid filling the serial transmit buffer. If an RF data packet is received,
and the serial transmit buffer does not have enough space for all of the data bytes, the entire RF
data packet will be discarded.
Note: If the XBee is sending data out the UART when RTS
could send up to 5 characters out the UART after RTS
Serial Interface Protocols
The XBee modules support both transparent and API (Application Programming Interface) serial
interfaces.
Transparent Operation
When operating in transparent mode, the modules act as a serial line replacement. All UART data
received through the DIN pin is queued up for RF transmission. When RF data is received, the data
is sent out through the DOUT pin. The module configuration parameters are configured using the
AT command mode interface.
Data is buffered in the serial receive buffer until one of the following causes the data to be
packetized and transmitted:
• No serial characters are received for the amount of time determined by the RO (Packetization
Timeout) parameter. If RO = 0, packetization begins when a character is received.
• The Command Mode Sequence (GT + CC + GT) is received. Any character buffered in the
serial receive buffer before the sequence is transmitted.
• The maximum number of characters that will fit in an RF packet is received.
RF modules that contain the following firmware versions will support Transparent Mode:
20xx (AT coordinator), 22xx (AT router), and 28xx (AT end device).
is de-asserted (set high). The host device should not de-assert RTS
is de-asserted (set high), the XBee
is de-asserted.
API Operation
API operation is an alternative to transparent operati on. The fr ame-bas ed API ext ends th e lev el to
which a host application can interact with the networking capabilities of the module. When in API
mode, all data entering and leaving the module is contained in frames that define operations or
events within the module.
Transmit Data Frames (received through the DIN pin (pin 3)) include:
• RF Transmit Data Frame
• Command Frame (equivalent to AT commands)
Receive Data Frames (sent out the DOUT pin (pin 2)) include:
• RF-received data frame
• Command response
• Event notifications such as reset, associate, disassociate, etc.
The API provides alternative means of configuring modules and routing data at the host
application layer. A host application can send data frames to the module that contain address and
payload information instead of using command mode to modify addresses. The module will send
data frames to the application containing status packets; as well as source, and payload
information from received data packets.
The API operation option facilitates many operations such as the examples cited below:
-> Transmitting data to multiple destinations without entering Command Mode
->Receive success/failure status of each transmitted RF packet
-> Identify the source address of each received packet
RF modules that contain the following firmware versions will support API operation: 21xx (API
coordinator), 23xx (API router), and 29xx (API end device).
The following table compares the advantages of transparent and API modes of operation:
Simple InterfaceAll received serial data is transmitted unless the module is in command mode.
Easy to supportIt is easier for an application to support transparent operation and command mode
Easy to manage data
transmissions to multiple
destinations
Received data frames
indicate the sender's
address
Advanced ZigBee
addressing support
Advanced networking
diagnostics
Remote Configuration
Transparent Operation Features
API Operation Features
Transmitting RF data to mu ltiple remotes only requires changing the address in the API frame. This
process is much faster than in transparent operation where the app lication must e nter AT command
mode, change the address, exit command mode, and then transmit data.
Each API transmission can return a transmit status frame indicating the success or reason for
failure.
All received RF data API frames indicate the source address.
API transmit and receive frames can expose ZigBee addressing fields including source and
destination endpoints, cluster ID and profile ID. This makes it easy to support ZDO commands and
public profile traffic.
API frames can provide indication of IO samples from remote devices, and node identifica tion
messages.
Set / read configuration commands can be sent to remote devices to configure them as needed
using the API.
As a general rule of thumb, API firmware is recommended when a device:
• sends RF data to multiple destinations
• sends remote configuration commands to manage devices in the network
• receives IO samples from remote devices
• receives RF data packets from multiple devices, and the application needs to know which
device sent which packet
• must support multiple ZigBee endpoints, cluster IDs, and/or profile IDs
• uses the ZigBee Device Profile services.
If the above conditions do not apply (e.g. a sensor node, router, or a simp le application), then AT
firmware might be suitable. It is acceptable to use a mixture of devices running API and AT
firmware in a network.
When not receiving or transm itting data, the RF modu le is in Idle Mode. The module shifts into the
other modes of operation under the following conditions:
• Transmit Mode (Serial data in the serial receive buffer is ready to be packetized)
• Receive Mode (Valid RF data is received through the antenna)
• Sleep Mode (End Devices only)
• Command Mode (Command Mode Sequence is issued)
Transmit Mode
When serial data is received and is ready for packetization, the RF module will exit Idle Mode and
attempt to transmit the data. The destination address determines which node(s) will receive the
data.
Prior to transmitting the dat a, th e m o dul e en su re s th at a 1 6-bi t n e twork address and route to the
destination node have been established.
If the destination 16-bit network address is not known, network address discovery will take place.
If a route is not known, route discovery will take place for the purpose of establishing a route to
the destination node. If a module with a matching network address is not discovered, the packet is
discarded. The data will be transmitted once a route is established. If route discovery fails to
establish a route, the packet will be discarded.
When data is transmitted from one node to another, a network-level acknowledgement is
transmitted back across the established route to the source node. This acknowledgement packet
indicates to the source node that the data packet was received by the destination node. If a
network acknowledgement is not received, the source node will re-transmit the data.
It is possible in rare circumstances for the destination to receiv e a data packet, but for the source
to not receive the network acknowledgment. In this case, the source will retransmit the data,
which could cause the destination to receive the same data packet multiple times. The XBee
modules do not filter out duplicate packets. The application should include provisions to address
this potential issue
See Data Transmission and Routing in chapter 4 for more information.
Receive Mode
If a valid RF packet is received, the data is transferred to the serial transmit buffer.
Command Mode
To modify or read RF Module parameters, the module must first enter into Command Mode - a
state in which incoming serial characters are interpreted as commands. Refer to the API Mode
section in chapter 9 for an alternate means of configuring modules.
AT Command Mode
To Enter AT Command Mode:
Send the 3-character command sequence “+++” and observe guard times before and after the
command characters. [Refer to the “Default AT Command Mode Sequence” below.]
Default AT Command Mode Sequence (for transition to Command Mode):
• No characters sent for one second [GT (Guard Times) parameter = 0x3E8]
• Input three plus characters (“+++”) within one second [CC (Command Sequence Character)
parameter = 0x2B.]
• No characters sent for one second [GT (Guard Times) parameter = 0x3E8]
Once the AT command mode sequence has been issued, the module sends an "OK\r" out the
DOUT pin. The "OK\r" characters can be delayed if the module has not finished transmitting
received serial data.
When command mode has been entered, the command mode timer is started (CT command), and
the module is able to receive AT commands on the DIN pin.
All of the parameter values in the sequence can be modified to reflect user preferences.
NOTE: Failure to enter AT Command Mode is most commonly due to baud rate mismatch. By default,
the BD (Baud Rate) parameter = 3 (9600 bps).
To Send AT Commands:
Send AT commands and parameters using the syntax shown below.
Figure2‐01.SyntaxforsendingATCommands
To read a parameter value stored in the RF module’s register, omit the parameter field.
The preceding example would change the RF module Destination Address (Low) to “0x1F”. To store
the new value to non-volatile (long term) memory, subsequently send the WR (Write) command.
For modified parameter values to persist in the module’s registry after a reset, changes must be
saved to non-volatile memory using the WR (Write) Command. Otherwise, parameters are
restored to previously saved values after the module is reset.
Command Response
When a command is sent to the module, the module will parse and execute the command. Upon
successful execution of a command, the module returns an “OK” message. If execution of a
command results in an error, the module returns an “ERROR” message.
Applying Command Changes
Any changes made to the configuration command registers through AT commands will not take
effect until the changes are applied. For example, sending the BD command to change the baud
rate will not change the actual baud r ate until changes are applied. Changes can be applied in one
of the following ways:
• The AC (Apply Changes) command is issued.
• AT command mode is exited.
To Exit AT Command Mode:
1. Send the ATCN (Exit Command Mode) command (followed by a carriage return).
[OR]
2. If no valid AT Commands are received within the time specified by CT (Command Mode
Timeout) Command, the RF module automatically returns to Idle Mode.
For an example of programming the RF module using AT Commands and descriptions of each configurable parameter, please see the Command Reference Table chapter.
Sleep Mode
Sleep modes allow the RF module to enter states of low power consumption when not in use. The
XBee RF modules support both pin sleep (sleep mode entered on pin transition) and cyclic sleep
(module sleeps for a fixed time). XBee sleep modes are discussed in detail in chapter 6.
ZigBee is an open global standard built on the IEEE 802.15.4 MAC/PHY. ZigBee defines a network
layer above the 802.15.4 layers to support advanced mesh routing capabilities. The ZigBee
specification is developed by a growing consortium of companies that make up the ZigBee
Alliance. The Alliance is made up of over 300 members, including semiconductor, module, stack,
and software developers.
ZigBee Stack Layers
The ZigBee stack consists of several layers including the PHY, MAC, Network, Application Support
Sublayer (APS), and ZigBee Device Objects (ZDO) layers. Technically, an Application Framework
(AF) layer also exists, but will be grouped with the APS layer in remaining discussions. The ZigBee
layers are shown in the figure below.
A description of each layer appears in the following table:
ZigBee LayerDescription
PHYDefines the physical operation of the ZigBee device
MACManages RF data transactions between neighboring
NetworkAdds routing capabilities that allows RF data packets
APS (AF)Application layer that defines various addressing
ZDOApplication layer that provides device and service
including receive sensitivity , channel reje ction, outpu t
power, number of channels, chip modulation, and
transmission rate specifications. Most ZigBee
applications operate on the 2.4 GHz ISM band at a
250kbps data rate. See the IEEE 802.15.4
specification for details.
devices (point to point). The MAC includes services
such as transmission retry and acknowledgment
management, and collision avoidance techniques
(CSMA-CA).
to traverse multiple devices (multiple "hops") to route
data from source to destination (peer to peer).
objects including profiles, clusters, and endpoints.
discovery features and advanced network
management capabilities.
Networking Concepts
Device Types
ZigBee defines three different device types: coordinator, router, and end device.
Node Types / Sample of a Basic ZigBee Network Topology
A coordinator has the following characteristics: it
• Selects a channel and PAN ID (both 64-bit and 16-bit) to start the network
• Can allow routers and end devices to join the network
• Can assist in routing data
• Cannot sleep--should be mains powered
• Can buffer RF data packets for sleeping end device children.
• Must join a ZigBee PAN before it can transmit, receive, or route data
• After joining, can allow routers and end devices to join the network
• After joining, can assist in routing data
• Cannot sleep--should be mains powered.
• Can buffer RF data packets for sleeping end device children.
An end device has the following characteristics: it
• Must join a ZigBee PAN before it can transmit or receive data
• Cannot allow devices to join the network
• Must always transmit and receive RF data through its parent. Cannot route data.
• Can enter low power modes to conserve power and can be battery-powered.
An example of such a network is shown below:
In ZigBee networks, the coordinator must select a P AN ID (64-bi t and 16-bit ) and channel to start
a network. After that, it behaves essentially like a router. The coordinator and routers can allow
other devices to join the network and can route data.
After an end device joins a router or coordinator, it must be able to transmit or receive RF data
through that router or coordinator. The router or coordinator that allowed an end device to join
becomes the "parent" of the end device. Since the end device can sleep, the parent must be able
to buffer or retain incoming data packets destined for the end device until the end device is able to
wake and receive the data.
PAN ID
ZigBee networks are called personal area networks or P ANs. Each network is defined with a unique
PAN identifier (P AN ID ). Thi s i den ti fie r is common among all devices of the same network. ZigBee
devices are either preconfigured with a PAN ID to join, or they can discovery nearby networks and
select a PAN ID to join.
ZigBee supports both a 64-bit and a 16-bit PAN ID. Both PAN IDs are used to uniquely identify a
network. Devices on the same ZigBee network must share the same 64-bit and 16-bit PAN IDs. If
multiple ZigBee networks are operating within range of each other, each should have unique PAN
IDs.
The 16-bit PAN ID is used as a MAC layer addressing field in all RF data transmissions between
devices in a network. However, due to the limited addressing space of the 16-bit PAN ID (65,535
possibilities), there is a possibility that multiple ZigBee networks (within range of each other)
could use the same 16-bit PAN ID . To resolve potential 16-bit PAN ID conflicts, the ZigBee Alliance
created a 64-bit PAN ID.
The 64-bit PAN ID (also called the extended PAN ID), is intended to be a unique, non-duplicated
value. When a coordinator starts a network, it can either start a network on a preconfigured 64-bit
PAN ID, or it can select a random 64-bit PAN ID. The 64-bit PAN ID is used during joining; if a
device has a preconfigured 64-bit PAN ID, it will only join a network with the same 64-bit PAN ID.
Otherwise, a device could join any detected PAN and inherit the PAN ID from the network when it
joins. The 64-bit PAN ID is included in all ZigBee beaco ns and is used in 16-bit PAN ID conflict
resolution.
Routers and end devices are typically configured to join a network with any 16-bit PAN ID as long
as the 64-bit PAN ID is valid. Coordinators typically select a random 16-bit PAN ID for their
network.
Since the 16-bit PAN ID only allows up to 65,535 unique values, and since the 16-bit PAN ID is
randomly selected, provisions exist in ZigBee to detect if two networks (with different 64-bit PAN
IDs) are operating on the same 16-bit PAN ID. If such a conflict is detected, the ZigBee stack can
perform PAN ID conflict resolution to change the 16-bit PAN ID of the network in order to resolve
the conflict. See the ZigBee specification for details.
To summarize, ZigBee routers and end devices should be configured with the 64-bit PAN ID of the
network they want to join. They typically acquire the 16-b it PAN ID when they join a network.
Operating Channel
ZigBee utilizes direct-sequ ence s pread spectru m modulation and oper ates on a fixe d channel. The
802.15.4 PHY defines 16 operating channels in the 2.4 GHz frequency band. XBee modules
support all 16 channels and XBee-PRO modules support 14 of the 16 channels.
ZigBee Application Layers: In Depth
This section provides a more in-depth look at the ZigBee application stack layers (APS, ZDO)
including a discussion on ZigBee endpoints, clusters, and profiles. Much of the material in this
section can introduce unnecessary details of the ZigBee stack that are not required in many cases.
Skip this section if
• The XBee does not need to interoperate or talk to non-Digi ZigBee devices
• The XBee simply needs to send data between devices.
Read this section if
• The XBee may talk to non-Digi ZigBee devices
• The XBee requires network management and discovery capabilities of the ZDO layer
• The XBee needs to operate in a public application profile (smart energy, home automation,
etc.)
Application Support Sublayer (APS)
The APS layer in ZigBee adds support for application profiles, cluster IDs, and endpoints.
Application Profiles
Application profiles specify various device descriptions including required functionality for various
devices. The collection of device descriptions forms an application profile. Application profiles can
be defined as "Public" or "Private" profiles. Private profiles are defined by a manufacturer whereas
public profiles are defined, developed, and maintained by the ZigBee Alliance. Each application
profile has a unique profile identifier assigned by the ZigBee Alliance.
Examples of public profiles include:
• Home Automation
• Smart Energy
• Commercial Building Automation
The Smart Energy profile, for example, defines various device types including an energy service
portal, load controller, thermostat, in-home display, etc. The Smart Energy profile defines required
functionality for each device type. For example, a load controller must respond to a defined
command to turn a load on or off. By defining standard communication protocols and device
functionality, public profiles allow interoperable ZigBee solutions to be developed by independent
manufacturers.
Digi XBee ZB firmware operates on a private profile called the Digi Drop-In Networking profile.
However, the API firmware in the module can be used in many cases to talk to devices in public
profiles or non-Digi private profiles. See the API Operations chapter for details.
A cluster is an application message type defined within a profile. Clusters are used to specify a
unique function, service, or action. For example, the following are some clusters defined in the
home automation profile:
• On/Off - Used to switch devices on or off (lights, thermostats, etc.)
• Level Control - Used to control devices that can be set to a level between on and off
• Color Control - Controls the color of color capable devices.
Each cluster has an associated 2-byte cluster identifi er (cluster ID). The cluster ID is inc luded in all
application transmissions. Clusters often have associated request and response messages. For
example, a smart energy gateway (service portal) might send a load control event to a load
controller in order to schedule turning on or off an appliance. Upon executing the event, the load
controller would send a load control report message back to the gateway.
Devices that operate in an application profile (private or public) must respond correctly to all
required clusters. For example, a light switch that will operate in the home automation public
profile must correctly implement the On/Off and other required clusters in order to interoperate
with other home automation devices. The ZigBee Alliance has defined a ZigBee Cluster Library
(ZCL) that contains definitions or various general use clusters that could be implemented in any
profile.
XBee modules implement various clusters in the Digi private profile. In addition, the API can be
used to send or receive messages on any cluster ID (and profile ID or endpoint). See the Explicit
Addressing ZigBee Command API frame in chapter 3 for details.
Endpoints
The APS layer includes supports for endpoints. An endpoint can be thought of as a running
application, similar to a TCP/IP port. A single device can support one or more endpoints. Each
application endpoint is identified by a 1-byte value, ranging from 1 to 240. Each defined endpoint
on a device is tied to an application profile. A device could, for example, implement one endpoint
that supports a Smart Energy load controller, and another endpoint that supports other
functionality on a private profile.
ZigBee Device Profile
Profile ID 0x0000 is reserved for the ZigBee Device Profile. This profile is implemented on all
ZigBee devices. Device Profile defines many device and service discovery features and network
management capabilities. Endpoint 0 is a reserved endpoint that supports the ZigBee Device
Profile. This endpoint is called the ZigBee Device Objects (ZDO) endpoint.
ZigBee Device Objects (ZDO)
The ZDO (endpoint 0) supports the discovery and management capabilities of the ZigBee Device
Profile. A complete listing of all ZDP services is included in the ZigBee specification. Each service
has an associated cluster ID.
The XBee ZB firmware allows applications to e asily send ZDO messages to devices in the networ k
using the API. See the ZDO Transmissions section in chapter 4 for details.
Coordinator Operation
Forming a Network
The coordinator is responsible for selecting the channel, PAN ID (16-bit and 64-bit), security
policy, and stack profile for a network. Since a coordinator is the only device type that can start a
network, each ZigBee network must have one coordinator. After the coordinator has started a
network, it can allow new devices to join the network. It can also route data packets and
communicate with other devices on the network.
To ensure the coordinator starts on a good channel and unused PAN ID, the coordinator performs
a series of scans to discover any RF activity on different channels (energy scan) and to discover
any nearby operating PANs (PAN scan). The process for selecting the channel and PAN ID are
described in the following sections.
Channel Selection
When starting a network, the coordinator must select a "good" channel for the net work to oper ate
on. To do this, it performs an energy scan on multiple channels (frequencies) to detect energy
levels on each channel. Channels with excessive energy levels are removed from its list of
potential channels to start on.
PAN ID Selection
After completing the energy scan, the coordinator scans its list of potential channels (remaining
channels after the energy scan) to obtain a list of neighboring PANs. To do this, the coordinator
sends a beacon request (broadcast) transmission on each potential channel. All nearby
coordinators and routers (that have already joined a ZigBee network) will respond to the beacon
request by sending a beacon back to the coordinator. The beacon contains information about the
PAN the device is on, including the PAN identifiers (16-bit and 64-bit). This scan (collecting
beacons on the potential channels) is typically called an active scan or PAN scan.
After the coordinator completes the channel and PAN scan, it selects a random channe l and
unused 16-bit PAN ID to start on.
Security Policy
The security policy determines wh ich devices are allowed to join the network, and which device(s)
can authenticate joining devices. See chapter 5 for a detailed discussion of various security
policies.
Persistent Data
Once a coordinator has started a network, it retains the following information through power cycle
or reset events:
•PAN ID
•Operating channel
• Security policy and frame counter values
• Child table (end device children that are joined to the coordinator).
The coordinator will retain this information indefinitely until it leaves the network. Wh en the
coordinator leaves a network and starts a new network, the previous PAN ID, operating channel,
and child table data are lost.
XBee ZB Coordinator Startup
The following commands control the coordinator network formation process.
IDUsed to determine the 64-bit PAN ID. If set to 0 (default), a random 64-bit PAN ID will be selected.
SCDetermines the scan channels bitmask (up to 16 channels) used by the coordinator when forming a
SDSet the scan duration period. This value determines how long the coordinator performs an energy scan or
ZSSet the ZigBee stack profile for the netw ork.
EEEnable or disable security in the network.
network. The coordinator will perform an energy scan on all enabled SC channels. It will then perform a
PAN ID scan and th en form the network on one of the SC channels.
NKSet the network security key for the network. If set to 0 (default), a random network security key will be
KYSet the trust center link key for the network. If set to 0 (default), a random link key will be used.
EOSet the security policy for the network.
Once the coordinator starts a network, the network configuration settings and child table data
persist through power cycles as mentioned in the "Persistent Data" section.
When the coordinator has successfully started a network, it
These behaviors are configurable using the following commands:
CommandDescription
NJSets the permit-join time on the coordinator,
D5Enables the Associate LED functionality.
LTSets the Associate LED blink time when
If any of the command values in the network formation commands table changes, the coordinator
will leave its current network and start a new network, possibly on a different channel. Note that
command changes must be applied (AC or CN command) before taking effect.
used.
• Allows other devices to join the network for a time (see NJ command)
•Sets AI=0
• Starts blinking the Associate LED
• Sends an API modem status frame ("coordinator started") out the UART (API firmware only).
measured in seconds.
joined. Default is 1 blink per second.
Permit Joining
The permit joining attribute on the coordinator is configurable with the NJ command. NJ can be
configured to always allow joining, or to allow joining for a short time.
Joining Always Enabled
If NJ=0xFF (default), joining is permanently enabled. This mode should be used carefully. Once a
network has been deployed, the application should strongly consider disabling joining to prevent
unwanted joins from occurring.
Joining Temporarily Enabled
If NJ < 0xFF, joining will be enabled only for a number of seconds, based on the NJ parameter. The
timer is started once the XBee joins a network. Joining will not be re-enabled if the module is
power cycled or reset. The following mechanisms can restart the permit-joining timer:
• Changing NJ to a different value (and applying changes with the AC or CN commands)
• Pressing the commissioning button twice (enables joining for 1 minute)
• Issuing the CB command with a parameter of 2 (software emulation of a 2 button press enables joining for 1 minute).
Resetting the Coordinator
When the coordinator is reset or power cycled, it checks its PAN ID, operating channel and stack
profile against the network configuration settings (ID, CH, ZS). It also verifies the saved security
policy against the security configuration settings (EE, NK, KY). If the coordinator's PAN ID,
operating channel, stack profile, or security policy is not valid based on its network and security
configuration settings, then the coordinator will leave the network and attempt to form a new
network based on its network formation command values.
To prevent the coordinator from leaving an existing network, the WR command should be issued
after all network formation commands have been configured in order to retain these settings
through power cycle or reset events.
There are a couple of mechanisms that will caus e the coordinator to leav e its current P AN and start
a new network based on its network formation parameter values. These include the following:
• Change the ID command such that the current 64-bit PAN ID is invalid.
• Change the SC command such that the current channel (CH) is not included in the channel
mask.
• Change the ZS or any of the security command values (excluding NK).
• Issue the NR0 command to cause the coordinator to leave.
• Issue the NR1 command to send a broadcast transmission, causing all devices in the network
to leave and migrate to a different channel.
• Press the commissioning button 4 times or issue the CB command with a parameter of 4.
Note that changes to ID, SC, ZS, and security command values only take effect when changes are
applied (AC or CN commands).
Replacing a Coordinator (Security Disabled Only)
In rare occasions, it may become necessary to replace an existing coordinator in a network with a
new physical device. If security is not enabled in the network, a replacement XBee coordinator can
be configured with the PAN ID (16-bit and 64-bit) , channel, and stack profil e settings of a running
network in order to replace an existing coordinator.
NOTE: Having two coordinators on the same channel, stack profil e, and P AN ID (16-bit and 64-bit)
can cause problems in the network and should be avoided. When replacing a coordinator, the old
coordinator should be turned off before starting the new coordinator.
To replace a coordinator, the following commands should be read from a device on the network:
AT C o m m andDescription
OPRead the operating 64-bit PAN
OIRead the operating 16-bit PAN
CHRead the operating channel.
ZSRead the stack profile.
Each of the commands listed above can be read from any device on the network. (These
parameters will be the same on all devi ces in t he network. ) Af ter re ading the se comman ds from a
device on the network, these parameter values should be programmed into the new coordinator
using the following commands.
AT C o m m andDescription
IDSet the 64-bit PAN ID to match
IISet the initial 16-bit PAN ID to
SCSet the scan channels bitmask
ID.
ID.
the read OP value.
match the read OI value.
to enable the read operating
channel (CH command). For
example, if the operating
channel is 0x0B, set SC to
0x0001. If the operating channel
is 0x17, set SC to 0x1000.