Most of the Ikea Trådfri (Tradfri) products contain a generic Zigbee Light Link (ZLL) module. Here is a teardown of that module (ICC-1, D-Poly_4B V2.0).
ICC-1 module
IEEE 802.15.4 RF transceiver with EFR32 Blue Gecko Bluetooth® Low Energy SoC
Module size: 18.0 x 24.5 mm
Supports Zigbee and Bluetooth Low Energy (BLE) and Thread.
Top side
Bottom side mirrored
The schematic with a lot of assumptions based on the visual inspection.
Pin descriptions

Sadly the connections to the Flash chip are not exposed outside the module. I will try to find out how I can get to that easily. Is the firmware in the Flash of the SoC or is it stored in the external Flash . .. Would be nice if it is external so I can re-purpose the Trådfri modules for some other purpose. Also I want to find out where the serial (if it even exists) is stored. All devices need to keep their unique identification.
Pin | ID (EFR32 pins) | Description |
---|---|---|
01 | GND | |
02 | PB15 | |
03 | PB14 | |
04 | PC10 | |
05 | PC11 | Present at 2 locations on PCB |
06 | PF0 | |
07 | PF1 | |
08 | PF2 | |
09 | PF3 | |
10 | RESETn | |
11 | VDD | PAVDD, IOVDD, VREGVDD, VREGSW, VREGVSS |
12 | GND | |
13 | PB13 | |
14 | PB12 | |
15 | PA1 | |
16 | PA0 | |
17 | PC11 | Present at 2 locations on PCB |
Operating conditions
Keep power supply above 1.85V (min 1.62V, max 3.35V). When powering from a coin cell, decouple the device between 20 and 200 uF.
EFR32 markings:
M: Family code: M
G: Gecko
P: Performance Grade: P
1: Feature code: 1
3: TRX code: TXRX
2: Band: 2.4 GHz
I: TemperatureGrade: -40 to 125 Degree
From the datasheet the ordering code should be: EFR32MG1P132F256IM32-C0
From datasheet: ug266-gecko-bootloader-user-guide Supported external flash chips:
Manufacturer Part Number | Size (kB) | Quiescent Current (µA Typical)* |
---|---|---|
Macronix MX25R8035F (low power) | 1024 | 0.007 |
Macronix MX25R6435SF (low power) | 8192 | 0.007 |
Spansion S25FL208K | 1024 | 15 |
Winbond W25X20BVSNIG (W25X20CVSNJG for high- temperature support) | 256 | 1 |
Winbond W25Q80BVSNIG (W25Q80BVSNJG for high- temperature support) | 1024 | 1 |
Macronix MX25L2006EM1I-12G (MX25L2006EM1R-12G for high-temperature support) | 256 | 2 |
Macronix MX25L4006E | 512 | 2 |
Macronix MX25L8006EM1I-12G (MX25L8006EM1R-12G for high-temperature support) | 1024 | 2 |
Macronix MX25L1606E | 2048 | 2 |
Macronix MX25U1635E (2V) | 2048 | 2 |
Atmel/Adesto AT25DF041A | 512 | 15 |
Atmel/Adesto AT25DF081A | 1024 | 5 |
Atmel/Adesto AT25SF041 | 512 | 2 |
Micron (Numonyx) M25P20 | 256 | 1 |
Micron (Numonyx) M25P40 | 512 | 1 |
Micron (Numonyx) M25P80 | 1024 | 1 |
Micron (Numonyx) M25P16 | 2048 | 1 |
ISSI IS25LQ025B | 32 | 8 |
ISSI IS25LQ512B | 64 | 8 |
ISSI IS25LQ010B | 128 | 8 |
ISSI IS25LQ020B | 256 | 8 |
ISSI IS25LQ040B | 512 | 8 |
* Quiescent current values are as of December 2017; check the latest part specifications for any changes.
Absolute maximum ratings
Information from EFR32 datasheet, the major active component on the board.
Parameter | Symbol | Test condition | Min | Typ | Max | Unit |
---|---|---|---|---|---|---|
Storage temperature range | TSTG | °C | ||||
Voltage on any supply pin | VDDMAX | V | ||||
Total current into VDD power lines | IVDDMAX | Source | mA | |||
Total current into VSS ground lines | IVSSMAX | Source | mA | |||
Current per I/O pin | IIOMAX | Sink or Source | mA | |||
Current for all I/O pins | IIOALLMAX | Sink or Source | mA | |||
Junction temperature | TJ | I grade devices | °C | |||
Bottom side with printing readable
Disclaimer
This page and its content is not affiliated with IKEA of Sweden AB.
The purpose of this project is to learn and improve using reverse engineering techniques. Use this information on your own risk.
For SWD:
PF0 DBG_SWCLKTCK
PF1 DBG_SWDIOTMS
The I/O matrix is pretty nice of those chips.
Lots of interesting information on the FCC registration page, including a at least little bit interesting user manual. https://fccid.io/FHO-ICC-1
Any Ideas how I find out what pin 15 – PA1 is and how it is used?
Any pins on the module can have a different meaning. The module itselves is a generic component and the firmware makes it react on specific I/O’s based on the specific device. Send me pictures of the inner stuff and maybe I can make coffee of it. It comes down to measuring the signal, or tracing the lines back on the other connected PCB.
Goed werk Marco. Gr. Bart Janisse (oud collega)
Thank you very much! Great work! I tried to build a „Zigbee controlled candle“ using the module from an ikea bulb + the flicker-led of a LED-candle. I am powering the module by a coin cell (3v). After working very well at the beginning the PWM port mysteriously starts to send a pwm signal again after being switched of for some minutes. Do you have any idea whether it is a problem of the power supply (coin cell) or is the pwm of the flicker LED somehow messing with the Zigbee module (I try to decouple using a 47uf capacitor briding vcc and grounds the ikea module)
I have no idea what to check next. Thank u so much for any advice