Most of the Ikea Trådfri (Tradfri) products contain a generic Zigbee Light Link (ZLL) module. Here is a teardown of that module (ICC-1, D-Poly_4B V2.0).

ICC-1 module


IEEE 802.15.4 RF transceiver with EFR32 Blue Gecko Bluetooth® Low Energy SoC
Module size: 18.0 x 24.5 mm
Supports Zigbee and Bluetooth Low Energy (BLE) and Thread.

Top side

Bottom side mirrored

The schematic with a lot of assumptions based on the visual inspection.

Pin descriptions



Sadly the connections to the Flash chip are not exposed outside the module. I will try to find out how I can get to that easily. Is the firmware in the Flash of the SoC or is it stored in the external Flash . .. Would be nice if it is external so I can re-purpose the Trådfri modules for some other purpose. Also I want to find out where the serial (if it even exists) is stored. All devices need to keep their unique identification.

PinID (EFR32 pins)Description
01GND
02PB15
03PB14
04PC10
05PC11Present at 2 locations on PCB
06PF0
07PF1
08PF2
09PF3
10RESETn
11VDDPAVDD, IOVDD,
VREGVDD, VREGSW, VREGVSS
12GND
13PB13
14PB12
15PA1
16PA0
17PC11Present at 2 locations on PCB

Operating conditions


Keep power supply above 1.85V (min 1.62V, max 3.35V). When powering from a coin cell, decouple the device between 20 and 200 uF.

EFR32 markings:
M: Family code: M
G: Gecko
P: Performance Grade: P
1: Feature code: 1
3: TRX code: TXRX
2: Band: 2.4 GHz
I: TemperatureGrade: -40 to 125 Degree

From the datasheet the ordering code should be: EFR32MG1P132F256IM32-C0

From datasheet: ug266-gecko-bootloader-user-guide Supported external flash chips:

Manufacturer Part NumberSize (kB)Quiescent Current (µA Typical)*
Macronix MX25R8035F (low power)10240.007
Macronix MX25R6435SF (low power)81920.007
Spansion S25FL208K102415
Winbond W25X20BVSNIG
(W25X20CVSNJG for high- temperature support)
2561
Winbond W25Q80BVSNIG
(W25Q80BVSNJG for high- temperature support)
10241
Macronix MX25L2006EM1I-12G
(MX25L2006EM1R-12G for high-temperature support)
2562
Macronix MX25L4006E5122
Macronix MX25L8006EM1I-12G
(MX25L8006EM1R-12G for high-temperature support)
10242
Macronix MX25L1606E20482
Macronix MX25U1635E (2V)20482
Atmel/Adesto AT25DF041A51215
Atmel/Adesto AT25DF081A10245
Atmel/Adesto AT25SF0415122
Micron (Numonyx) M25P202561
Micron (Numonyx) M25P405121
Micron (Numonyx) M25P8010241
Micron (Numonyx) M25P1620481
ISSI IS25LQ025B328
ISSI IS25LQ512B648
ISSI IS25LQ010B1288
ISSI IS25LQ020B2568
ISSI IS25LQ040B5128

* Quiescent current values are as of December 2017; check the latest part specifications for any changes.

Ads by Google



Absolute maximum ratings


Information from EFR32 datasheet, the major active component on the board.

ParameterSymbolTest conditionMinTypMaxUnit
Storage temperature rangeTSTG
-50
150
°C
Voltage on any supply pinVDDMAX
-0.3
3.8
V
Total current into VDD power linesIVDDMAXSource
200
mA
Total current into VSS ground linesIVSSMAXSource
200
mA
Current per I/O pinIIOMAXSink or Source
50
mA
Current for all I/O pinsIIOALLMAXSink or Source
200
mA
Junction temperatureTJI grade devices
-40
125
°C

This slideshow requires JavaScript.

Bottom side with printing readable

Ads by Google



Disclaimer


This page and its content is not affiliated with IKEA of Sweden AB.

The purpose of this project is to learn and improve using reverse engineering techniques. Use this information on your own risk.

6 thoughts on “Tradfri Zigbee Light Link module (ZLL), yet another TEARDOWN

  • 2018/03/03 at 15:45
    Permalink

    For SWD:
    PF0 DBG_SWCLKTCK
    PF1 DBG_SWDIOTMS
    The I/O matrix is pretty nice of those chips.

    Reply
  • 2018/11/04 at 22:21
    Permalink

    Any Ideas how I find out what pin 15 – PA1 is and how it is used?

    Reply
    • 2018/11/08 at 09:44
      Permalink

      Any pins on the module can have a different meaning. The module itselves is a generic component and the firmware makes it react on specific I/O’s based on the specific device. Send me pictures of the inner stuff and maybe I can make coffee of it. It comes down to measuring the signal, or tracing the lines back on the other connected PCB.

      Reply
  • 2020/01/12 at 14:03
    Permalink

    Goed werk Marco. Gr. Bart Janisse (oud collega)

    Reply
  • 2020/04/13 at 22:23
    Permalink

    Thank you very much! Great work! I tried to build a „Zigbee controlled candle“ using the module from an ikea bulb + the flicker-led of a LED-candle. I am powering the module by a coin cell (3v). After working very well at the beginning the PWM port mysteriously starts to send a pwm signal again after being switched of for some minutes. Do you have any idea whether it is a problem of the power supply (coin cell) or is the pwm of the flicker LED somehow messing with the Zigbee module (I try to decouple using a 47uf capacitor briding vcc and grounds the ikea module)
    I have no idea what to check next. Thank u so much for any advice

    Reply

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.