Digi, Digi International, the Digi logo, XBee®and XBee-PRO® are trademarks or registered trademarks of Digi International
®
Inc. in the United Sates and other countries worldwide. ZigBee
trademarks mentioned in this document are the property of their respective owners.
Information in this document is subject to change without notice and does not represent a commitment on the part of Digi
International.
Digi provides this document “as is,” without warranty of any kind, expressed or implied, including, but not limited to, the
implied warranties of fitness or merchantability for a particular purpose. Digi may make improvements and/or changes in this
manual or in the product(s) and/or the program(s) described in this manual at any time.
This product could include technical inaccuracies or typographical errors. Changes are periodically made to the information
herein; these changes may be incorporated in new editions of the publication.
For basic information to help get you started on the XBee/XBee-PRO ZB RF Module, navigate to the Getting Started Guide at
digi.com/support. Enter the keyword 'XBee-PRO ZB' and select the Documentation tab. Under the Documentation tab, you
will find the XBee-PRO ZB RF Module Development Kit Getting Started Guide.
This manual describes the operation of the XBee/XBee-PRO ZB RF module, which consists of ZigBee firmware loaded
onto XBee S2C and PRO S2C hardware.
®
XBee
and XBee-PRO® ZB embedded RF modules provide wireless connectivity to end-point devices in ZigBee mesh
networks. Utilizing the ZigBee PRO Feature Set, these modules are inter-operable with other ZigBee devices, including
devices from other vendors. With the XBee, users can have their ZigBee network up-and-running in a matter of minutes
without configuration or additional development.
The XBee/XBee-PRO ZB modules are compatible with other devices that use XBee ZB technology. These include ConnectPortX gateways, XBee and XBee-PRO Adapters, Wall Routers, XBee Sensors, and other products with the ZB name.
Worldwide Acceptance
• FCC Approval (USA): Refer to Appendix A for FCC Requirements. Systems that
contain XBee/XBee-PRO ZB RF Modules inherit Digi Certifications
• ISM (Industrial, Scientific & Medical) 2.4 GHz frequency band
• Manufactured under ISO 9001:2000 registered standards
• XBee/XBee-PRO ZB RF Modules are optimized for use in US, Canada, Australia, Europe (XBee
only) and Japan (XBee only). Contact Digi for a complete list of agency approvals
What’s New in 40xx Firmware
• An alternative serial port is available using SPI slave mode operation.
• Six software images (Coordinator AT, Coordinator API, Router AT, Router API, End Device AT,
and End Device API) are combined into a single software
• Fragmentation is now available in both API mode and transparent mode
• P3 (DOUT), P4 (DIN), D8 (SleepRq), and D9 (On-Sleep
• Both pull-up and pull-down resistors can now be applied to pins configured for inputs
• 401D - ATVL command added for long version information
• 401E - ATDO command added for configuring device options
• 4020 - ATAS command added for Active Scan
• 4021 - Self addressed Tx Status messages return a status code of 0x23
• ATDO has HIGH_RAM_CONCENTRATOR and NO_ACK_IO_SAMPLING options added
• 4040 - Binding and Multicasting transmissions are supported
• AT&X command added to clear binding and group tables
-26 to +8 dBm -0.7 to +19.4 dBm-26 to +8 dBm+1 to +19 dBm
XBee-PRO (Surface
Mount)
XBee (Through-hole)XBee-PRO (Through-hole)
Serial Communications Specifications of the XBee ZigBee RF Module
XBee RF modules support both UART (Universal Asynchronous Receiver / Transmitter) and SPI (Serial
Peripheral Interface) serial connections.
UART
The SC1 (Serial Communication Port 1) of the Ember 357 is connected to the UART port.
UARTPinAssignments
SpecificationsModule Pin Number
UART PinsXBee (Surface Mount)XBee (Through-hole)
DOUT32
DIN / CONFIG
/ DIO72512
CTS
/ DIO62916
RTS
More information on UART operation is found in the UART section in Chapter 2.
43
SPI
The SC2 (Serial Communication Port 2) of the Ember 357 is connected to the SPI port.
SPIPinAssignments
SpecificationsModule Pin Number
SPI PinsXBee (Surface Mount)XBee (Through-hole)
SPI_SCLK1418
SPI_SSEL
SPI_MOSI1611
SPI_MISO174
For more information on SPI operation, see the SPI section in Chapter 2.
1517
GPIO Specifications
XBee RF modules have 15 GPIO (General Purpose Input / Output) ports available. The exact list will depend on
the module configuration, as some GPIO pads are used for purposes such as serial communication.
See GPIO section for more information on configuring and using GPIO ports.
ElectricalSpecificationsforGPIOLines
GPIO Electrical SpecificationValue
Voltage - Supply2.1 - 3.6 V
Low Schmitt switching threshold0.42 - 0.5 x VCC
High Schmitt switching threshold0.62 - 0.8 x VCC
Input current for logic 0-0.5 A
Input current for logic 10.5 A
Input pull-up resistor value29 k
Input pull-down resistor value29 k
Output voltage for logic 00.18 x VCC (maximum)
Output voltage for logic 10.82 x VCC (minimum)
Output source/sink current for pad numbers 3, 4, 5, 10, 12, 14, 15, 16, 17,
25, 26, 28, 29, 30, and 32 on the SMT modules
Output source/sink current for pin numbers 2, 3, 4, 9, 12, 13, 15, 16, 17,
and 19 on the TH modules
Output source/sink current for pad numbers 7, 8, 24, 31, and 33 on the
SMT modules
Output source/sink current for pin numbers 6, 7, 11, 18, and 20 on the TH
modules
Total output current (for GPIO pads)40 mA
Hardware Specifications for Programmable Variant
4 mA
4 mA
8 mA
8 mA
If the module has the programmable secondary processor, add the following table values to the specifications
listed on page 8. For example, if the secondary processor is running at 20 MHz and the primary processor is in
receive mode then the new current value will be I
33PC2 / JTDO / SWO2613JTAG (see Writing Custom Firmware section)
34PC3 / JTDI2815JTAG (see Writing Custom Firmware section)
35PC4 / JTMS / SWDIO54JTAG (see Writing Custom Firmware section)
36PB0109
38 PC1 / ADC33017
41 PB7 / ADC23118
42 PB6 / ADC13320
43PB5 / ADC0Temperature sensor on PRO version
PA5 / PTI_DATA /
BOOTMODE
1517Used for SPI
12NA
OTA pacet tracing, force embedded serial bootloader, and SPI
attention line
Note: Some lines may not go to the external XBee pins in the programmable secondary processor version.
Design Notes for the XBee ZigBee RF Module
The XBee modules do not specifically require any external circuitry or specific connections for proper
operation. However, there are some general design guidelines that are recommended for help in
troubleshooting and building a robust design.
Power Supply Design
Poor power supply can lead to poor radio performance, especially if the supply voltage is not kept within
tolerance or is excessively noisy. To help reduce noise, we recommend placing both a 1F and 8.2pF capacitor
as near to (pad 2/SMT, pin 1/TH) on the PCB as possible. If using a switching regulator for your power supply,
switching frequencies above 500kHz are preferred. Power supply ripple should be limited to a maximum 50mV
peak to peak.
Note: For designs using the programmable modules, an additional 10F decoupling cap is recommended near
(pad 2/SMT, pin 1/TH) of the module. The nearest proximity to (pad 2/SMT, pin 1/TH) of the three caps should
be in the following order: 8.2pf, 1F followed by 10F.
Recommended Pin Connections
The only required pin connections are VCC, GND, DOUT and DIN. To support serial firmware updates, VCC,
GND, DOUT, DIN, RTS, and DTR should be connected.
All unused pins should be left disconnected. All inputs on the radio can be pulled high or low with 30k internal
pull-up or pull-down resistors using the PR and PD software commands. No specific treatment is needed for
unused outputs.
For applications that need to ensure the lowest sleep current, unconnected inputs should never be left
floating. Use internal or external pull-up or pull-down resistors, or set the unused I/O lines to outputs.
Other pins may be connected to external circuitry for convenience of operation, including the Associate LED
pad (pad 28/SMT, pin 15/TH) and the Commissioning pad (pad 33/SMT, pin 20/TH). The Associate LED pad
will flash differently depending on the state of the module to the network, and a pushbutton attached to pad
33 can enable various join functions without having to send serial port commands. See the commissioning
pushbutton and associate LED section in chapter 7 for more details. The source and sink capabilities are
limited to 4mA for pad numbers 3, 4, 5, 10, 12, 14, 15, 16, 17, 25, 26, 28, 29, 30 and 32, and 8mA for pad
numbers 7, 8, 24, 31 and 33 on the SMT module. The source and sink capabilities are limited to 4mA for pin
numbers 2, 3, 4, 9, 12, 13, 15, 16, 17, and 19, and 8mA for pin numbers 6, 7, 11, 18, and 20 on the TH
module.
The VRef pad ( pad 27) is only used on the programmable versions of the SMT modules. For the TH modules, a
VRef pin (Pin #14) is used. For compatibility with other XBee modules, we recommend connecting this pin to
a voltage reference if analog sampling is desired. Otherwise, connect to GND.
Board Layout
XBee modules are designed to be self sufficient and have minimal sensitivity to nearby processors, crystals or
other PCB components. As with all PCB designs, Power and Ground traces should be thicker than signal traces
and able to comfortably support the maximum current specifications. A recommended PCB footprint for the
module can be found in Appendix C. No other special PCB design considerations are required for integrating
XBee radios except in the antenna section.
The choice of antenna and antenna location is very important for correct performance. With the exception of
the RF Pad variant, XBees do not require additional ground planes on the host PCB. In general, antenna
elements radiate perpendicular to the direction they point. Thus a vertical antenna emits across the horizon.
Metal objects near the antenna cause reflections and may reduce the ability for an antenna to radiate
efficiently. Metal objects between the transmitter and receiver can also block the radiation path or reduce the
transmission distance, so external antennas should be positioned away from them as much as possible. Some
objects that are often overlooked are metal poles, metal studs or beams in structures, concrete (it is usually
reinforced with metal rods), metal enclosures, vehicles, elevators, ventilation ducts, refrigerators, microwave
ovens, batteries, and tall electrolytic capacitors.
Design Notes for PCB Antenna Modules
PCB Antenna modules should not have any ground planes or metal objects above or below the antenna.
For best results, the module should not be placed in a metal enclosure, which may greatly reduce the
range. The module should be placed at the edge of the PCB on which it is mounted. The ground, power
and signal planes should be vacant immediately below the antenna section. The drawings on the
following pages illustrate important recommendations when designing with PCB antenna modules. It
should be noted that for optimal performance, this module should not be mounted on the RF Pad
footprint described in the next section because the footprint requires a ground plane within the PCB
Antenna keep out area.
The RF Pad is a soldered antenna connection. The RF signal travels from pin 36 on the module to the
antenna through an RF trace transmission line on the PCB. Note that any additional components
between the module and antenna will violate modular certification. The RF trace should have a
controlled impedance of 50 ohms. We recommend using a microstrip trace, although coplanar
waveguide may also be used if more isolation is needed. Microstrip generally requires less area on the
PCB than coplanar waveguide. Stripline is not recommended because sending the signal to different PCB
layers can introduce matching and performance problems.
It is essential to follow good design practices when implementing the RF trace on a PCB. The following
figures show a layout example of a host PCB that connects an RF Pad module to a right angle, through
hole RPSMA jack. The top two layers of the PCB have a controlled thickness dielectric material in
between. The second layer has a ground plane which runs underneath the entire RF Pad area. This
ground plane is a distance d, the thickness of the dielectric, below the top layer. The top layer has an RF
trace running from pin 36 of the module to the RF pin of the RPSMA connector. The RF trace's width
determines the impedance of the transmission line with relation to the ground plane. Many online tools
can estimate this value, although the PCB manufacturer should be consulted for the exact width.
Assuming d=0.025", and that the dielectric has a relative permittivity of 4.4, the width in this example
will be approximately 0.045" for a 50 ohm trace. This trace width is a good fit with the module
footprint's 0.060" pad width. Using a trace wider than the pad width is not recommended, and using a
very narrow trace (under 0.010") can cause unwanted RF loss. The length of the trace is minimized by
placing the RPSMA jack close to the module. All of the grounds on the jack and the module are
connected to the ground planes directly or through closely placed vias. Any ground fill on the top layer
should be spaced at least twice the distance d (in this case, at least 0.050") from the microstrip to
minimize their interaction.
Implementing these design suggestions will help ensure that the RF Pad module performs to its
specifications.
The modules with the programmable option have a secondary processor with 32k of flash and 2k of RAM. This
allows module integrators to put custom code on the XBee module to fit their own unique needs. The DIN,
DOUT, RTS, CTS, and RESET lines are intercepted by the secondary processor to allow it to be in control of the
data transmitted and received. All other lines are in parallel and can be controlled by either the EM357 or the
MC9SO8QE micro (see Block Diagram for details). The EM357 by default has control of certain lines. These
lines can be released by the EM357 by sending the proper command(s) to disable the desired DIO line(s) (see
XBee Command Reference Tables).
In order for the secondary processor to sample with ADCs, the XBee VREF pin (27/SMT, 14/TH) must be
connected to a reference voltage.
Digi provides a bootloader that can take care of programming the processor over the air or through the serial
interface. This means that over the air updates can be supported through an XMODEM protocol. The processor
can also be programmed and debugged through a one wire interface BKGD (Pin 9/SMT, Pin 8/TH).
The XBee Programmable module is equipped with a Freescale MC9S08QE32 application processor. This
application processor comes with a supplied bootloader. This section describes how to interface the customer's
application code running on this processor to the XBee Programmable module's supplied bootloader.
The first section discusses how to initiate firmware updates using the supplied bootloader for wired and overthe-air updates.
Bootloader Software Specifics
Memory Layout
Figure 1 shows the memory map for the MC9S08QE32 application processor.
The supplied bootloader occupies the bottom pages of the flash from 0xF200 to 0xFFFF. Application
code cannot write to this space.
The application code can exist in Flash from address 0x8400 to 0xF1BC. 1k of Flash from 0x8000 to
0x83FF is reserved for Non Volatile Application Data that will not be erased by the bootloader during a
flash update.
A portion of RAM is accessible by both the application and the bootloader. Specifically, there is a shared
data region used by both the application and the bootloader that is located at RAM address 0x200 to
0x215. Application code should not write anything to BLResetCause or AppResetCause unless
informing the bootloader of the impending reset reason. The Application code should not clear
BLResetCause unless it is handling the unexpected reset reason.
To prevent a malfunctioning application from running forever, the Bootloader increments BLResetCause
after each watchdog or illegal instruction reset. If this register reaches above 0x10 the bootloader will
stop running the application for a few minutes to allow an OTA or Local update to occur. If no update is
initiated within the time period, BLResetCause is cleared and the application is started again. To
prevent unexpected halting of the application, the application shall clear or decrement BLResetCause
just before a pending reset. To disable this feature, the application shall clear BLResetCause at the
start of the application.
Upon reset of any kind, the execution control begins with the bootloader.
If the reset cause is Power-On reset (POR), Pin reset (PIN), or Low Voltage Detect (LVD) reset (LVD)
the bootloader will not jump to the application code if the override bits are set to RTS(D7)=1,
DTR(D5)=0, and DIN(B0)=0. Otherwise, the bootloader writes the reset cause "NOTHING" to the
shared data region, and jumps to the Application.
Reset causes are defined in the file common. h in an enumeration with the following definitions:
// 0x0000 to 0x00FF are considered valid for APP use.
APP_CAUSE_USE255 = 0x00FF,
APP_CAUSE_FIRMWARE_UPDATE = 0x5981,
APP_CAUSE_BYPASS_MODE = 0x4682,
APP_CAUSE_BOOTLOADER_MENU = 0x6A18,
} APP_RESET_CAUSES;
Otherwise, if the reset cause is a "watchdog" or other reset, the bootloader checks the shared memory
region for the APP_RESET_CAUSE. If the reset cause is:
1."APP_CAUSE_NOTHING" or 0x0000 to 0x00FF, the bootloader increments the
BL_RESET_CAUSES, verifies that it is still less than BL_CAUSE_BAD_APP, and jumps back to
the application. If the Application does not clear the BL_RESET_CAUSE, it can prevent an
infinite loop of running a bad application that continues to perform illegal instructions or
watchdog resets.
2."APP_CAUSE_FIRMWARE_UPDATE", the bootloader has been instructed to update the
application "over-the-air" from a specific 64-bit address. In this case, the bootloader will
attempt to initiate an Xmodem transfer from the 64-bit address located in shared RAM.
3."APP_CAUSE_BYPASS_MODE", the bootloader executes bypass mode. This mode passes the
local UART data directly to the EM357 allowing for direct communication with the EM357.
The only way to exit bypass mode is to reset or power cycle the module.
If none of the above is true, the bootloader will enter "Command mode". In this mode, users can
initiate firmware downloads both wired and over-the-air, check application/bootloader version strings,
and enter Bypass mode.
Application version string
Figure 1 shows an "Application version string pointer" area in application flash which holds the pointer
to where the application version string resides. The application's linker command file ultimately
determines where this string is placed in application flash.
It is preferable that the application version string be located at address 0x8400 for MC9S08QE32 parts.
The application string can be any characters terminated by the NULL character (0x00). There is not a
strict limit on the number of characters in the string, but for practical purposes should be kept under
100 bytes including the terminating NULL character. During an update the bootloader erases the entire
application from 0x8400 on. The last page has the vector table specifically the redirected reset vector.
The version string pointer and reset vector are used to determine if the application is valid.
Application Interrupt Vector table and Linker Command File
Since the bootloader flash region is read-only, the interrupt vector table is redirected to the region
0xF1C0 to 0xF1FD so that application developers can use hardware interrupts. Note that in order for
Application interrupts to function properly, the Application's linker command file (*.prm extension)
must be modified appropriately to allow the linker to place the developers code in the correct place in
memory. For example, the developer desires to use the serial communications port SCI1 receive
interrupt. The developer would add the following line to the Codewarrior linker command file for the
project:
VECTOR ADDRESS 0x0000F1E0 vSci1Rx
This will inform the linker that the interrupt function "vSci1Rx()" should be placed at address
0x0000F1E0. Next, the developer should add a file to their project "vector_table.c" that creates an
array of function pointers to the ISR routines used by the application.
extern void _Startup(void);/* _Startup located in Start08.c */
The interrupt routines themselves can be defined in separate files. The "vDummyIsr" function is used
in conjunction with "iWritetoSci1" for debugging purposes.
Bootloader Menu Commands
The bootloader accepts commands from both the local UART and OTA. All OTA commands sent must be
Unicast with only 1 byte in the payload for each command. A response will be returned to the sender. All
Broadcast and multiple byte OTA packets are dropped to help prevent general OTA traffic from being
interpreted as a command to the bootloader while in the menu.
The bootloader provides a "bypass" mode of operation that essentially connects the SCI1 serial
communications peripheral of the freescale mcu to the EM357's serial Uart channel. This allows direct
communication to the EM357 radio for the purpose of firmware and radio configuration changes. Once
in bypass mode, the XCTU utility can change modem configuration and/or update EM357 firmware.
Bypass mode automatically handles any baud rate up to 115.2kbps. Note that this command is
unavailable when module is accessed remotely.
Update Firmware - "F"
The "F" command initiates a firmware download for both wired and over-the-air configurations.
Depending on the source of the command (received via Over the Air or local UART), the download will
proceed via wired or over-the-air respectively.
Adjust Timeout for Update Firmware - "T"
The "T" command changes the timeout before sending a NAK by Base-Time*2^(T). The Base-Time for
the local UART is different than the Base-Time for Over the Air. During a firmware update, the
bootloader will automatically increase the Timeout if repeat packets are received or multiple NAKs for
the same packet without success occur.
Application Version String - "A"
The "A" command provides the version of the currently loaded application. If no application is present,
"Unkown" will be returned.
Bootloader Version String - "V"
The "V" command provides the version of the currently loaded bootloader. The version will return a
string in the format BLFFF-HHH-XYZ_DDD where FFF represents the Flash size in kilo bytes, HHH is the
hardware, XYZ is the version, and DDD is the preferred XMODEM packet size for updates. Double the
preferred packet size is also possible, but not guaranteed. For example "BL032-2B0-023_064" will take
64 byte CRC XMODEM payloads and may take 128 byte CRC XMODEM payloads also. In this case, both
64 and 128 payloads are handled, but the 64 byte payload is preferred for better Over the Air
reliability.
Bootloader Version BL032-2x0-025_064 only operates at 9600 baud on the local UART as well as
communications to the EM357 Radio. A newer version of the Bootloader BL032-2x0-033_064 or newer
BL032-2B0-XXX_064 has changed the baud rate to 115200 between the Programmable and the EM357