Most of the Ikea Trådfri (Tradfri) products contain a generic Zigbee Light Link (ZLL) module. Here is a teardown of that module (ICC-1, D-Poly_4B V2.0).

ICC-1 module


IEEE 802.15.4 RF transceiver with EFR32 Blue Gecko Bluetooth® Low Energy SoC
Module size: 18.0 x 24.5 mm
Supports Zigbee and Bluetooth Low Energy (BLE) and Thread.

Top side

Bottom side mirrored

The schematic with a lot of assumptions based on the visual inspection.

Pin descriptions



Sadly the connections to the Flash chip are not exposed outside the module. I will try to find out how I can get to that easily. Is the firmware in the Flash of the SoC or is it stored in the external Flash . .. Would be nice if it is external so I can re-purpose the Trådfri modules for some other purpose. Also I want to find out where the serial (if it even exists) is stored. All devices need to keep their unique identification.

Pin ID (EFR32 pins) Description
01 GND
02 PB15
03 PB14
04 PC10
05 PC11 Present at 2 locations on PCB
06 PF0
07 PF1
08 PF2
09 PF3
10 RESETn
11 VDD PAVDD, IOVDD,
VREGVDD, VREGSW, VREGVSS
12 GND
13 PB13
14 PB12
15 PA1
16 PA0
17 PC11 Present at 2 locations on PCB

Operating conditions


Keep power supply above 1.85V (min 1.62V, max 3.35V). When powering from a coin cell, decouple the device between 20 and 200 uF.

EFR32 markings:
M: Family code: M
G: Gecko
P: Performance Grade: P
1: Feature code: 1
3: TRX code: TXRX
2: Band: 2.4 GHz
I: TemperatureGrade: -40 to 125 Degree

From the datasheet the ordering code should be: EFR32MG1P132F256IM32-C0

From datasheet: ug266-gecko-bootloader-user-guide Supported external flash chips:

Manufacturer Part Number Size (kB) Quiescent Current (µA Typical)*
Macronix MX25R8035F (low power) 1024 0.007
Macronix MX25R6435SF (low power) 8192 0.007
Spansion S25FL208K 1024 15
Winbond W25X20BVSNIG
(W25X20CVSNJG for high- temperature support)
256 1
Winbond W25Q80BVSNIG
(W25Q80BVSNJG for high- temperature support)
1024 1
Macronix MX25L2006EM1I-12G
(MX25L2006EM1R-12G for high-temperature support)
256 2
Macronix MX25L4006E 512 2
Macronix MX25L8006EM1I-12G
(MX25L8006EM1R-12G for high-temperature support)
1024 2
Macronix MX25L1606E 2048 2
Macronix MX25U1635E (2V) 2048 2
Atmel/Adesto AT25DF041A 512 15
Atmel/Adesto AT25DF081A 1024 5
Atmel/Adesto AT25SF041 512 2
Micron (Numonyx) M25P20 256 1
Micron (Numonyx) M25P40 512 1
Micron (Numonyx) M25P80 1024 1
Micron (Numonyx) M25P16 2048 1
ISSI IS25LQ025B 32 8
ISSI IS25LQ512B 64 8
ISSI IS25LQ010B 128 8
ISSI IS25LQ020B 256 8
ISSI IS25LQ040B 512 8

* Quiescent current values are as of December 2017; check the latest part specifications for any changes.

Ads by Google



Absolute maximum ratings


Information from EFR32 datasheet, the major active component on the board.

Parameter Symbol Test condition Min Typ Max Unit
Storage temperature range TSTG
-50
150
°C
Voltage on any supply pin VDDMAX
-0.3
3.8
V
Total current into VDD power lines IVDDMAX Source
200
mA
Total current into VSS ground lines IVSSMAX Source
200
mA
Current per I/O pin IIOMAX Sink or Source
50
mA
Current for all I/O pins IIOALLMAX Sink or Source
200
mA
Junction temperature TJ I grade devices
-40
125
°C

This slideshow requires JavaScript.

Bottom side with printing readable

Ads by Google



Disclaimer


This page and its content is not affiliated with IKEA of Sweden AB.

The purpose of this project is to learn and improve using reverse engineering techniques. Use this information on your own risk.

4 thoughts on “Tradfri Zigbee Light Link module

  • 2018/03/03 at 15:45
    Permalink

    For SWD:
    PF0 DBG_SWCLKTCK
    PF1 DBG_SWDIOTMS
    The I/O matrix is pretty nice of those chips.

    Reply
  • 2018/11/04 at 22:21
    Permalink

    Any Ideas how I find out what pin 15 – PA1 is and how it is used?

    Reply
    • 2018/11/08 at 09:44
      Permalink

      Any pins on the module can have a different meaning. The module itselves is a generic component and the firmware makes it react on specific I/O’s based on the specific device. Send me pictures of the inner stuff and maybe I can make coffee of it. It comes down to measuring the signal, or tracing the lines back on the other connected PCB.

      Reply

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.