CC2530: Please help me a working firmware of CC2350ZNP with CC2592 PA

There’s no prebuilt ZNP hex image for CC2530+CC2592. You have to build it by yourself.

yes, I have built it, but not work. It also can't connect to Z-Tool (UART on port 0.2, 0.3). I can interface to it via interface SPI, configure ZC, and ZED. ZC is ok, state is 0x9. But ZED is not ok. It's status always 0x2, never go to 0x6.

This is module E18-MS1PA1-IPX by Ebyte.

Here is in "Defined Symbol" IAR:
===
BDB_FINDING_BINDING_CAPABILITY_ENABLED=0
TC_LINKKEY_JOIN
NWK_MAX_DEVICE_LIST=10
ZDSECMGR_TC_DEVICE_MAX=30
DISABLE_GREENPOWER_BASIC_PROXY
POWER_SAVING
FEATURE_SYSTEM_STATS
MT_GP_CB_FUNC
ASSERT_RESET
FAKE_CRC_SHDW
ZTOOL_P1 => added
MT_APP_FUNC => added
MT_SYS_FUNC => added
MT_ZDO_FUNC => added
===

This is my log of ZED interface via SPI (full built with CC2592). ZED is just in this state, 0x45c0, status 2.
===
###Do SYS_RESET_REQ...
Waiting for SYS_RESET_IND...
Waiting SRDY to HIGH...
Len: 6; Cmd: 0x4180
Data: 2 2 0 2 7 1 END SRDY: 0
###Setting StartupOptions...
Len: 1; Cmd: 0x6605; Status: 0
###Set to END-DEVICE
Len: 1; Cmd: 0x6605; Status: 0
###Register Application
Len: 1; Cmd: 0x6400; Status: 0
###Starting the Application with AFZDO
Len: 1; Cmd: 0x6540; Status: 0

Len: 5; Cmd: 0x4180
Data: 2 2 0 2 7 1
Len: 0; Cmd: 0x45c0
Data: 2
Len: 2; Cmd: 0x4f80
Data: 1 2 4
Len: 0; Cmd: 0x45c0
Data: 2
===

I dit it. I've modified as below (follow guides on this forum)

in file hal_board_cfg.h
#define HAL_PA_LNA_CC2592

/* ----------- Board Initialization ---------- */
#if defined (HAL_BOARD_CC2530EB_REV17) && !defined (HAL_PA_LNA) && !defined (HAL_PA_LNA_CC2590) && \
!defined (HAL_PA_LNA_SE2431L) && !defined (HAL_PA_LNA_CC2592)

#define HAL_BOARD_INIT() st \
( \
uint8 vOSC_32KHZ = OSC_32KHZ; \
uint16 i; \
\
SLEEPCMD &= ~OSC_PD; /* turn on 16MHz RC and 32MHz XOSC */ \
while (!(SLEEPSTA & XOSC_STB)); /* wait for 32MHz XOSC stable */ \
asm("NOP"); /* chip bug workaround */ \
for (i=0; i<504; i++) asm("NOP"); /* Require 63us delay for all revs */ \
CLKCONCMD = (CLKCONCMD_32MHZ | vOSC_32KHZ); /* Select 32MHz XOSC and the source for 32K clock */ \
while (CLKCONSTA != (CLKCONCMD_32MHZ | vOSC_32KHZ)); /* Wait for the change to be effective */ \
SLEEPCMD |= OSC_PD; /* turn off 16MHz RC */ \
\
/* Turn on cache prefetch mode */ \
PREFETCH_ENABLE(); \
)

#elif defined (HAL_BOARD_CC2530EB_REV13) || defined (HAL_PA_LNA) || defined (HAL_PA_LNA_CC2590) || defined (HAL_PA_LNA_CC2592)

/* ----------- LED's ---------- */
#if defined (HAL_BOARD_CC2530EB_REV17) && !defined (HAL_PA_LNA) && !defined (HAL_PA_LNA_CC2590) && !defined (HAL_PA_LNA_CC2592)

...
#elif defined (HAL_BOARD_CC2530EB_REV13) || defined (HAL_PA_LNA) || defined (HAL_PA_LNA_CC2590) || defined (HAL_PA_LNA_CC2592)

===
in znp_app.c (add ZMacSetTransmitPower)
===

static void npInit(void)
{
if (ZNP_CFG1_UART == znpCfg1)
{
halUARTCfg_t uartConfig;

uartConfig.configured = TRUE;
uartConfig.baudRate = ZNP_UART_BAUD;
#ifdef ZNP_ALT
uartConfig.flowControl = FALSE;
#else
uartConfig.flowControl = TRUE;
#endif
uartConfig.flowControlThreshold = HAL_UART_FLOW_THRESHOLD;
uartConfig.rx.maxBufSize = HAL_UART_RX_BUF_SIZE;
uartConfig.tx.maxBufSize = HAL_UART_TX_BUF_SIZE;
uartConfig.idleTimeout = HAL_UART_IDLE_TIMEOUT;
uartConfig.intEnable = TRUE;
uartConfig.callBackFunc = npUartCback;
HalUARTOpen(HAL_UART_PORT, &uartConfig);
MT_UartRegisterTaskID(znpTaskId);
#ifdef HAL_PA_LNA_CC2592
ZMacSetTransmitPower(TX_PWR_PLUS_19);
#else
ZMacSetTransmitPower(TX_PWR_PLUS_4);
#endif
}
else
{
/* npSpiInit() is called by hal_spi.c: HalSpiInit().*/
}

===
in znp_spi.c (add ZMacSetTransmitPower)
===

#if defined CC2530_MK
void npSpiInit(void) // TODO - hard-coded for USART0 alt1 SPI for now.
{
if (ZNP_CFG1_UART == znpCfg1)
{
return;
}

/* Set bit order to MSB */
U0GCR |= BV(5);

/* Set UART0 I/O to alternate 1 location on P1 pins. */
//PERCFG |= 0x02; /* U1CFG */

/* Mode select UART1 SPI Mode as slave. */
U0CSR = NP_CSR_MODE;

/* Select peripheral function on I/O pins. */
P0SEL |= 0x3C; /* SELP0_[5:2] */

/* Give UART1 priority over Timer3. */
//P2SEL &= ~0x20; /* PRI2P1 */

/* Set RDY to inactive high. */
NP_RDYOut = 1;

/* Select general purpose on I/O pins. */
P1SEL &= ~(NP_RDYOut_BIT); /* P1.0 SRDY - GPIO */
P2SEL &= ~(NP_RDYIn_BIT); /* P2.0 MRDY - GPIO */

/* Select GPIO direction */
P1DIR |= NP_RDYOut_BIT; /* P1.0 SRDY - OUT */
P2DIR &= ~NP_RDYIn_BIT; /* P2.0 MRDY - IN */

/* Falling edge on P2 pins triggers interrupt. */
PICTL |= BV(3); /* P2ICON */

/* Trigger an interrupt on MRDY input. */
P2IFG &= ~NP_RDYIn_BIT;
P2IEN |= NP_RDYIn_BIT;
IEN2 |= 0x02;

dmaInit();

U0CSR |= CSR_RE;
#ifdef HAL_PA_LNA_CC2592
ZMacSetTransmitPower(TX_PWR_PLUS_19);
#else
ZMacSetTransmitPower(TX_PWR_PLUS_4);
#endif

}
#else
void npSpiInit(void)
{
if (ZNP_CFG1_UART == znpCfg1)
{
return;
}

/* Set bit order to MSB */
U1GCR |= BV(5);

/* Set UART1 I/O to alternate 2 location on P1 pins. */
PERCFG |= 0x02; /* U1CFG */

/* Mode select UART1 SPI Mode as slave. */
U1CSR = NP_CSR_MODE;

/* Select peripheral function on I/O pins. */
P1SEL |= 0xF0; /* SELP1_[7:4] */

/* Give UART1 priority over Timer3. */
P2SEL &= ~0x20; /* PRI2P1 */

/* Set RDY to inactive high. */
NP_RDYOut = 1;

/* Select general purpose on I/O pins. */
P0SEL &= ~(NP_RDYIn_BIT); /* P0.3 MRDY - GPIO */
P0SEL &= ~(NP_RDYOut_BIT); /* P0.4 SRDY - GPIO */

/* Select GPIO direction */
P0DIR &= ~NP_RDYIn_BIT; /* P0.3 MRDY - IN */
P0DIR |= NP_RDYOut_BIT; /* P0.4 SRDY - OUT */

P0INP &= ~NP_RDYIn_BIT; /* Pullup/down enable of MRDY input. */
P2INP &= ~BV(5); /* Pullup all P0 inputs. */

/* Falling edge on P0 pins triggers interrupt. */
PICTL |= BV(0); /* P0ICON */

/* Trigger an interrupt on MRDY input. */
P0IFG &= ~NP_RDYIn_BIT;
P0IEN |= NP_RDYIn_BIT;
P0IE = 1;

dmaInit();

U1CSR |= CSR_RE;
#ifdef HAL_PA_LNA_CC2592
ZMacSetTransmitPower(TX_PWR_PLUS_19);
#else
ZMacSetTransmitPower(TX_PWR_PLUS_4);
#endif

}
#endif

Also this in hal_board_cfg.h

/* ----------- RF-frontend Connection Initialization ---------- */
#if defined HAL_PA_LNA || defined HAL_PA_LNA_CC2590 || defined HAL_PA_LNA_CC2592
extern void MAC_RfFrontendSetup(void);
#define HAL_BOARD_RF_FRONTEND_SETUP() MAC_RfFrontendSetup()
#else
#define HAL_BOARD_RF_FRONTEND_SETUP()
#endif

Do you add HAL_PA_LNA_CC2592 in "Defined Symbols" in Preprocessor of C/C++ Compiler Options.

Hi Yikai,

I add it in file hal_board_cfg.h. Is there difference between 2 places?

I dont use Ubiqua. I'm just beginner to Zigbee Zstack. I will check it now.

You can attach your sniffer log so I can check what happens.

Thank Yikai.

I 've installed it. But now I dont have required sniffer hardware. I only have CC Debugger.

You have to buy CC2531EMK to make it work.

Hi Cuong,

Can you further describe your system? What is the hardware and software of both your coordinator and end device? Since you are new to TI's Z-Stack solution I would suggest you evaluate a recommended working system and slowly begin to incorporate your desired changes.

Regards,
Ryan

Hi Ryan,

My design is simple. CC2530 is controller by external MCU via SPI interface, in this case, ESP32.

I want to learn ZB by making one ZC, another is ZED. I follow examples from CC2530ZNP Mini Kit.

- ZC is from example_basic_comms_coordinator_sapi.c

- ZED is from example_basic_comms_end_device_afzdo.c

Module CC2530F256 is from Ebyte: http://www.cdebyte.com/en/product-view-news.aspx?id=123

PA front end is CC2592.

I try to build Zstack 3.0.1 with some modifications for CC2592 support. Builing firmware is fine, but not sure whether it is ok or not.

The only thing that ZC board is ok. Status from 0x45c0 is 0x9.

But ZED is not ok. Status from 0x45c0 is always 0x2, not change to 0x6 (ZED).

Pls also refer to my another thread.

e2e.ti.com/.../2498920

My knowledge of Zigbee is limited, also limited tools to debug next. So I can't progress next.

Do you enable permit join on coordinator to allow ZED to join when ZED starts?

Hi Yikai,

I dont know about permit join. I google, but not found how to enable it yet. Could u tell me?

Thanks.

You can refer to section 3.12.1.22 ZDO_MGMT_PERMIT_JOIN_REQ in Z-Stack Monitor and Test API.pdf.

Thank Yikai.

It means that on ZC, I need to execute this command ZDO_MGMT_PERMIT_JOIN_REQ for specific ZED to allow ZED join the network?

No, you send ZDO_MGMT_PERMIT_JOIN_REQ on ZC and enable permit join on itself to allow ZED to join.

Hi Yikai,

I've tested on ZC node.

I add permit join (ZDO_MGMT_PERMIT_JOIN_REQ) on ZC with following info: length 0x4, cmd 0x2536, DstAddr (0x4567) (follow in TI example Mini Kit), Duration 0xff, TCSignificance 0x1.

And result Failure, return 0xc2.

This is my log on ZC node.
===
###Do SYS_RESET_REQ...
Waiting for SYS_RESET_IND...
Waiting SRDY to HIGH...
Len: 6; Cmd: 0x4180
Data: 2 2 0 2 7 1 END SRDY: 1
###Setting StartupOptions...
Len: 1; Cmd: 0x6605; Status: 0
###Set to COORDINATOR
Len: 1; Cmd: 0x6605; Status: 0
###Enabling Callbacks
Len: 1; Cmd: 0x6605; Status: 0
###Register Application
Len: 1; Cmd: 0x660a; Status: 0
###Starting the Application
Len: 0; Cmd: 0x6600
On Network!
###Read Network Info
Len: 5; Cmd: 0x6604
Data: 0x0 0x83 0x2 0xff 0xff
###Permit Join
Len: 1; Cmd: 0x6536; Status: 0xc2

Poll Zigbee for messages...
Polling...
Len: 6; Cmd: 0x4180
Data: 2 2 0 2 7 1
Polling...
Len: 1; Cmd: 0x45c0
Data: 8
Polling...
Len: 1; Cmd: 0x45c0
Data: 9
Polling...
Len: 1; Cmd: 0x4680
Data: 0
Polling...
===

You should set DstAddr to 0x0000 which is ZC's short address.

I see in Mini Kit example, ZC address is also 0x4567 (DeviceID field) when register application.

For ZDO_MGMT_PERMIT_JOIN_REQ, I follow ur advice, with DstAddr set to 0x0000, but return also 0xc2.

Maybe try to use APP_CNF_BDB_START_COMMISSIONING on both ZC and ZED to make them pair.

I see different ZDO_MGMT_PERMIT_JOIN_REQ version. This is in document SWRA198 Revision 1.14.

Length = 0x05 Cmd0 = 0x25 Cmd1 = 0x36 AddrMode DstAddr Duration TCSignificance

And that I use is, in document SWRA198 Revision 1.4
Length = 0x04 Cmd0 = 0x25 Cmd1 = 0x36 DstAddr Duration TCSignificance

So version 1.4 is latest?

I found on this forum that, return status is ZNWK_INVALID_REQUEST (0xC2), meaning that I send wrong command ?

Yes, version 1.4 is latest and you should use "Length = 0x04 Cmd0 = 0x25 Cmd1 = 0x36 DstAddr Duration TCSignificance "

To APP_CNF_BDB_START_COMMISSIONING, which value should I use? is it 0x08 (Finding and Binding)?

I add APP_CNF_BDB_START_COMMISSIONING on both ZC and ZED. The command return is success (Cmd: 0x6f05; Status: 0x00)
Here is my log on ZED:
===
###Do SYS_RESET_REQ...
Waiting for SYS_RESET_IND...
Waiting SRDY to HIGH...
Len: 6; Cmd: 0x4180
Data: 2 2 0 2 7 1 END SRDY: 1
###Setting StartupOptions...
Len: 1; Cmd: 0x6605; Status: 0
###Set to END-DEVICE
Len: 1; Cmd: 0x6605; Status: 0
###Register Application
Len: 1; Cmd: 0x6400; Status: 0
###Starting the Application with AFZDO
Len: 1; Cmd: 0x6540; Status: 0

###APP_CNF_BDB_START_COMMISSIONING
Len: 1; Cmd: 0x6f05; Status: 0x00

###Wait for switching to DEV_END_DEVICE

Len: 5; Cmd: 0x4180
Data: 2 2 0 2 7 1
Len: 0; Cmd: 0x45c0
Data: 2
Len: 2; Cmd: 0x4f80
Data: 1 2 4
Len: 0; Cmd: 0x45c0
Data: 2
===

And Here is my log on ZC:
===
###Do SYS_RESET_REQ...
Waiting for SYS_RESET_IND...
Waiting SRDY to HIGH...
Len: 6; Cmd: 0x4180
Data: 2 2 0 2 7 1 END SRDY: 1
###Setting StartupOptions...
Len: 1; Cmd: 0x6605; Status: 0
###Set to COORDINATOR
Len: 1; Cmd: 0x6605; Status: 0
###Enabling Callbacks
Len: 1; Cmd: 0x6605; Status: 0
###Register Application
Len: 1; Cmd: 0x660a; Status: 0
###Starting the Application
Len: 0; Cmd: 0x6600
On Network!
###Read Network Info
Len: 5; Cmd: 0x6604
Data: 0x0 0x83 0x2 0xff 0xff
###APP_CNF_BDB_START_COMMISSIONING
Len: 1; Cmd: 0x6f05; Status: 0x00

###Permit Join
Len: 1; Cmd: 0x6536; Status: 0xc2

Poll Zigbee for messages...
Polling...
Len: 6; Cmd: 0x4180
Data: 2 2 0 2 7 1
Polling...
Len: 1; Cmd: 0x45c0
Data: 8
Polling...
Len: 3; Cmd: 0x4f80
Data: 2 0 0
Polling...
Len: 1; Cmd: 0x45c0
Data: 9
Polling...
Len: 3; Cmd: 0x4f80
Data: d 0 0
Polling...
Len: 1; Cmd: 0x4680
Data: 0
Polling...
===


Permit join still failed.
There is APP_CNF_BDB_COMMISSIONING_NOTIFICATION (0x4f80) with return data: 0xd, 0x0, 0x0. I also dont understand this.

I cannot effectively judge what happens through these log. Do you enable permit join or call APP_CNF_BDB_START_COMMISSIONING with value 0x02 on ZC before you start ZED and call APP_CNF_BDB_START_COMMISSIONING with value 0x02? Also, have you buy CC2531EMK for sniffer? I think it will be much better that you can provide the sniffer log for better understanding your problem.

I'm sorry for mistake. Last time, I run APP_CNF_BDB_START_COMMISSIONING with mode 0x00.

Now, I run with mode 0x02. And APP_CNF_BDB_COMMISSIONING_NOTIFICATION (0x4f80) with data 2 (BDB_COMMISSIONING_NO_NETWORK ), 1, 0.

Does it work now?

not yet :(

ZED not switch to DEV_END_DEV (0x6). And on ZC, permit join still not success (Cmd: 0x6536; Status: 0xc2)

What should I do...

Here is command data I sent to ZNP ZC.

SPI.transfer(0x05); // length
SPI.transfer(0x25); // cmd0
SPI.transfer(0x36); // cmd1
SPI.transfer(0x02); // AddrMode
SPI.transfer(0x00); // DstAddr
SPI.transfer(0x00); // DstAddr
SPI.transfer(0xb4); // join duration
SPI.transfer(0x00);

But still failed. Permit join Cmd: 0x6536; Status: 0xc2.

Is there issue in ZNP firmware? Are there any option defines when compiling firmware, related to Permit Join?

Permit join command would be included if you have MT_ZDO_MGMT defined in compile options. MT_ZDO_MGMT should be added in ZNP project by default. Anyway, you can check it.

I've just checked it. There's no this option in "Defined symbols". So I added MT_ZDO_MGMT into this list.
But after re-flash ZNP, ZC command permit join also failed with the same code, 0xc2.

Run out of idea. I can only suggest you to set breakpoint on "case MT_ZDO_MGMT_PERMIT_JOIN_REQ:" in MT_ZdoCommandProcessing to debug it.

It's impossible for me now to go deeply inside stack firmware :(

Hi Yikai,

I change to Coordinator by using AFZDO instead of Simple API. Then Permit Join success (ZDO_MGMT_PERMIT_JOIN_RSP 0x45b6, status 0).
So every thing is fine for ZC now.

But ZED still stuck at 0x2, not change to 0x6 (DEV_END_DEV)

This is my log on ZC node.
===
###Do SYS_RESET_REQ...
Waiting for SYS_RESET_IND...
Waiting SRDY to HIGH...
Len: 6; Cmd: 0x4180
Data: 2 2 0 2 7 1 END SRDY: 1
###Setting StartupOptions...
Len: 1; Cmd: 0x6605; Status: 0
###Set to COORDINATOR
Len: 1; Cmd: 0x6605; Status: 0
###Register Application
Len: 1; Cmd: 0x6400; Status: 0
###Starting the Application with AFZDO
Len: 1; Cmd: 0x6540; Status: 0

###Wait for switching to DEV_ZB_COORD

Len: 5; Cmd: 0x4180
Data: 2 2 0 2 7 1
Len: 0; Cmd: 0x45c0
Data: 8
Len: 2; Cmd: 0x4f80
Data: 1 2 4
Len: 0; Cmd: 0x45c0
Data: 8
Len: 0; Cmd: 0x45c0
Data: 8
Len: 0; Cmd: 0x45c0
Data: 9
On Network!
###Read Network Info
Len: 5; Cmd: 0x6604
Data: 0x0 0x83 0x2 0xff 0xff
###APP_CNF_BDB_START_COMMISSIONING
Len: 1; Cmd: 0x6f05; Status: 0x00
###Permit Join
Len: 1; Cmd: 0x6536; Status: 0x00

Poll Zigbee for messages...
Polling...
Len: 3; Cmd: 0x4f80
Data: 0 2 0
Polling...
Len: 3; Cmd: 0x45b6
Data: 0 0 0
Polling...
Len: 3; Cmd: 0x45b6
Data: 0 0 0
Polling...
Len: 3; Cmd: 0x4f80
Data: 0 1 0
Polling...

Polling...

Polling...

Polling...

Polling...

Also, there is small change in ZED,

APP_CNF_BDB_COMMISSIONING_NOTIFICATION (0x4f80) with data 1, 2, 6 vs last time (with ZC Simple API) data 1, 2, 4

I dont understand this difference.

After many observations, I found that, if ZED turned off (in hard reset state), then at ZC side, APP_CNF_BDB_COMMISSIONING_NOTIFICATION (0x4f80) always has data 0, 2, 0.

If ZED is on, then at ZC side, APP_CNF_BDB_COMMISSIONING_NOTIFICATION has data 0, 1, 0. In some cases, it has data 0, 2, 0 (maybe ZED is halted or something else, due to I send SYS_RESET, it does not respond)

Through these observations, I think ZB radio is properly functional via CC2592 PA.

Run out of idea how to help. I suggest you to setup sniffer to check what happens over the air.

Hi Cuong,

Please update us with your progress and whether your issue has been resolved or not.

Edit: Closing this thread until provided with more feedback.

Regards,
Ryan