Most of the Ikea Tradfri products contain a generic Zigbee Light Link (ZLL) module. Here is a teardown of that module (ICC-1, D-Poly_4B V2.0).
IEEE 802.15.4 RF transceiver with EFR32 Blue Gecko Bluetooth® Low Energy SoC
Module size: 18.0 x 24.5 mm
Supports Zigbee and Bluetooth Low Energy (BLE) and Thread.
Sadly the connections to the Flash chip are not exposed outside the module. I will try to find out how I can get to that easily. Is the firmware in the Flash of the SoC or is it stored in the external Flash . .. Would be nice if it is external so I can repurpose the tradfri modules for some other purpose. Also I want to find out where the serial (if it even exists) is stored. All devices need to keep their unique identification.
|Pin||ID (EFR32 pins)||Description|
|05||PC11||Present at 2 locations on PCB|
VREGVDD, VREGSW, VREGVSS
|17||PC11||Present at 2 locations on PCB|
Keep power supply above 1.85V (min 1.62V, max 3.35V). When powering from a coin cell, decouple the device between 20 and 200 uF.
M: Family code: M
P: Performance Grade: P
1: Feature code: 1
3: TRX code: TXRX
2: Band: 2.4 GHz
I: TemperatureGrade: -40 to 125 Degree
Absolute maximum ratings
Information from EFR32 datasheet, the major active component on the board.
|Storage temperature range||TSTG||°C|
|Voltage on any supply pin||VDDMAX||V|
|Total current into VDD power lines||IVDDMAX||Source||mA|
|Total current into VSS ground lines||IVSSMAX||Source||mA|
|Current per I/O pin||IIOMAX||Sink or Source||mA|
|Current for all I/O pins||IIOALLMAX||Sink or Source||mA|
|Junction temperature||TJ||I grade devices||°C|
This page and its content is not affiliated with IKEA of Sweden AB.
The purpose of this project is to learn and improve using reverse engineering techniques. Use this information on your own risk.