CC2538 DIY Zigbee Coordinator

Maybe many people knows the CC2530 / CC2531 based Zigbee sniffer modules, what can be re-programmed to work as a Zigbee Coordinator for local Home Automatization.
Although these modules only have 8kB memory, which is a bit low for handling a lot of devices and route informations, for this reason it is limited to directly accept max 15 devices. (And based on the feedbacks, it is not really fast)

For this reason the Zigbee2MQTT developers added support for CC1352P / 2CC26X2R1 chips also. These chips have got a lot bigger price tag, but luckily another cheaper alternative showed up: the CC2538! It has 32kB memory and powered by an ARM M3 MCU.

The module has IPEX connector for external antenna, and an integrated antenna also, it can be changed by soldering a little SMD resistor, which defaults to the external antenna. For better range use an external antenna.

Original project page:

https://bitekmindenhol.blog.hu/2020/07/24/diy_zigbee_bridge_ujratoltve_cc2538

• CC2538 Zigbee Wireless module (8-9 USD)
• 2.4Ghz antenna with IPEX connector (2 USD)
• CP2102 UART programmer (not necessary for normal use, only needed for programming)

There are several modules with different pin layouts, so be sure to check the module you bought. Distance is 1.27mm in between the pins, so steady hand and good eye needed for soldering.

The following connections needs to be created between the programmer and the CC2538:

Programmer --- CC2538

TX --- PA0 (RX)

RX --- PA1 (TX)

GND --- GND

VCC 3V3 --- VDD

If you are using the modified Modkamru firmware (by MadDoct, link at next step) and at a later time a firmware refresh is needed the PA7 pin needs to be connected to GND, it will start the serial bootloader, so it is a wise idea to solder a pin/cable to PA7 also. (Thanks for informations to MadDoct!)

*Be advised that CC2538 are rated 175mA consumption (at max transmitting power) but the CP2102 can only supply 100mA, so it will work for programming, but may be insufficient for normal use.

The ARM MCU normally can be programmed/erased with a JTAG programmer. But fortunately it is sold with empty flash at the factory, in its condition it can also be programmed by a simple serial programmer, with 2 wire. (TX/RX)

This serial programming works when the module has no valid image OR contains a proper image which maintains serial bootloader mode. (so choose firmware wisely before uploading or prepare your JTAG programmer)

Lets grab a (Debian/Ubuntu/Raspbian or similar) Linux machine, download the programmer software and its dependencies:

sudo apt install python3 python3-pip git
git clone https://github.com/JelmerT/cc2538-bsl.git
cd cc2538-bsl 
sudo pip3 install pyserial intelhex

Then download the Zigbee Coordinator firmware with serial communication mode:

wget https://raw.githubusercontent.com/MadDoct/zigbee2mqtt-cc2538firmware-modded/master/MODKAMRU_V3_UART-no-flow-control-mod.hex

Connect the USB programmer to the PC and check if the connection works: (/dev/ttyUSB0 is the CP2102 address in the Linux system, you can check it with dmesg | tail after connecting it)

sudo python3 cc2538-bsl.py -p /dev/ttyUSB0

The reply has to be something like this:

Opening port /dev/ttyUSB0, baud 500000
Connecting to target... CC2538 PG2.0: 512KB Flash, 32KB SRAM, CCFG at 0x0027FFD4
Primary IEEE Address: 00:12:4B:00:06:0E:4B:FB

If connection is OK, lets upload the program:

sudo python3 cc2538-bsl.py -e -w -v -p /dev/ttyUSB0 -w MODKAMRU_V3_UART-no-flow-control-mod.hex

The reply has to be something like this:

Opening port /dev/ttyUSB0, baud 500000
Reading data from MODKAMRU_V3_UART-no-flow-control-mod.hex
Firmware file: Intel Hex
Connecting to target...
CC2538 PG2.0: 512KB Flash, 32KB SRAM, CCFG at 0x0027FFD4
Primary IEEE Address: 00:12:4B:00:06:0E:4B:FB
Performing mass erase
Erasing 524288 bytes starting at address 0x00200000
Erase done
Writing 524256 bytes starting at address 0x00200000
Write 232 bytes at 0x0027FEF88
Write done
Verifying by comparing CRC32 calculations.
Verified (match: 0x7eb88ab9)

Congratulations, if the programming succeded, you have become the proud owner of a Zigbee 3.0 compatible Coordinator with serial connections and with max 100/200 (direct/indirect) zigbee device limit!

To use it, you need a small, Linux capable SingleBoardComputer with serial connection, for example a Raspberry PI Zero W. The RPI has an integrated PAM2306 1A DC-DC converter, maybe half of it used by onboard devices but the remaining ~500mA (3V3) power is more than enough for the CC2358 to operate normally.

Wiring for Raspberry Pi:

RPI --- CC2538
TX --- PA0 (RX)
RX --- PA1 (TX)
GND --- GND
VCC 3V3 --- VDD

Installation of Zigbee2MQTT for using this coordinator is not part of this Instructable, the process comprehensively documented on its own website.

Some more hints:

• Do not forget to enable onboard serial port and disable serial kernel logging (raspi-config)
• For RPI Zero, RPI3 and newer versions with integrated Bluetooth, you have to disable Bluetooth first if you want to use integrated serial (serial vs ble)
• In Zigbee2MQTT configuration.yaml set rtscts: false otherwise the communication will never be started