Most of the Ikea Trådfri (Tradfri) products contain a generic Zigbee Light Link (ZLL) module. Here is a teardown of that module (ICC-1, D-Poly_4B V2.0).

ICC-1 module

IEEE 802.15.4 RF transceiver with EFR32 Blue Gecko Bluetooth® Low Energy SoC
Module size: 18.0 x 24.5 mm
Supports Zigbee and Bluetooth Low Energy (BLE) and Thread.

Top side

Bottom side mirrored

The schematic with a lot of assumptions based on the visual inspection.

Pin descriptions

Sadly the connections to the Flash chip are not exposed outside the module. I will try to find out how I can get to that easily. Is the firmware in the Flash of the SoC or is it stored in the external Flash . .. Would be nice if it is external so I can re-purpose the Trådfri modules for some other purpose. Also I want to find out where the serial (if it even exists) is stored. All devices need to keep their unique identification.

Pin ID (EFR32 pins) Description
01 GND
02 PB15
03 PB14
04 PC10
05 PC11 Present at 2 locations on PCB
06 PF0
07 PF1
08 PF2
09 PF3
12 GND
13 PB13
14 PB12
15 PA1
16 PA0
17 PC11 Present at 2 locations on PCB

Operating conditions

Keep power supply above 1.85V (min 1.62V, max 3.35V). When powering from a coin cell, decouple the device between 20 and 200 uF.

EFR32 markings:
M: Family code: M
G: Gecko
P: Performance Grade: P
1: Feature code: 1
3: TRX code: TXRX
2: Band: 2.4 GHz
I: TemperatureGrade: -40 to 125 Degree

From the datasheet the ordering code should be: EFR32MG1P132F256IM32-C0

From datasheet: ug266-gecko-bootloader-user-guide Supported external flash chips:

Manufacturer Part Number Size (kB) Quiescent Current (µA Typical)*
Macronix MX25R8035F (low power) 1024 0.007
Macronix MX25R6435SF (low power) 8192 0.007
Spansion S25FL208K 1024 15
Winbond W25X20BVSNIG
(W25X20CVSNJG for high- temperature support)
256 1
Winbond W25Q80BVSNIG
(W25Q80BVSNJG for high- temperature support)
1024 1
Macronix MX25L2006EM1I-12G
(MX25L2006EM1R-12G for high-temperature support)
256 2
Macronix MX25L4006E 512 2
Macronix MX25L8006EM1I-12G
(MX25L8006EM1R-12G for high-temperature support)
1024 2
Macronix MX25L1606E 2048 2
Macronix MX25U1635E (2V) 2048 2
Atmel/Adesto AT25DF041A 512 15
Atmel/Adesto AT25DF081A 1024 5
Atmel/Adesto AT25SF041 512 2
Micron (Numonyx) M25P20 256 1
Micron (Numonyx) M25P40 512 1
Micron (Numonyx) M25P80 1024 1
Micron (Numonyx) M25P16 2048 1
ISSI IS25LQ025B 32 8
ISSI IS25LQ512B 64 8
ISSI IS25LQ010B 128 8
ISSI IS25LQ020B 256 8
ISSI IS25LQ040B 512 8

* Quiescent current values are as of December 2017; check the latest part specifications for any changes.

Ads by Google

Absolute maximum ratings

Information from EFR32 datasheet, the major active component on the board.

Parameter Symbol Test condition Min Typ Max Unit
Storage temperature range TSTG
Voltage on any supply pin VDDMAX
Total current into VDD power lines IVDDMAX Source
Total current into VSS ground lines IVSSMAX Source
Current per I/O pin IIOMAX Sink or Source
Current for all I/O pins IIOALLMAX Sink or Source
Junction temperature TJ I grade devices

This slideshow requires JavaScript.

Bottom side with printing readable

Ads by Google


This page and its content is not affiliated with IKEA of Sweden AB.

The purpose of this project is to learn and improve using reverse engineering techniques. Use this information on your own risk.

6 thoughts on “Tradfri Zigbee Light Link module (ZLL), yet another TEARDOWN

  • 2018/03/03 at 15:45

    For SWD:
    The I/O matrix is pretty nice of those chips.

  • 2018/11/04 at 22:21

    Any Ideas how I find out what pin 15 – PA1 is and how it is used?

    • 2018/11/08 at 09:44

      Any pins on the module can have a different meaning. The module itselves is a generic component and the firmware makes it react on specific I/O’s based on the specific device. Send me pictures of the inner stuff and maybe I can make coffee of it. It comes down to measuring the signal, or tracing the lines back on the other connected PCB.

  • 2020/01/12 at 14:03

    Goed werk Marco. Gr. Bart Janisse (oud collega)

  • 2020/04/13 at 22:23

    Thank you very much! Great work! I tried to build a „Zigbee controlled candle“ using the module from an ikea bulb + the flicker-led of a LED-candle. I am powering the module by a coin cell (3v). After working very well at the beginning the PWM port mysteriously starts to send a pwm signal again after being switched of for some minutes. Do you have any idea whether it is a problem of the power supply (coin cell) or is the pwm of the flicker LED somehow messing with the Zigbee module (I try to decouple using a 47uf capacitor briding vcc and grounds the ikea module)
    I have no idea what to check next. Thank u so much for any advice


Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.