Flashing Z-Stack on a CC2530+CC2591 using a Wemos D1 mini

I’m messing about with Zigbee for a comms protocol to various temperature sensors, and this requires a Zigbee Coordinator. There’s a few ways of doing this, but ultimately I settled on a zigbee2mqtt bridge and a cheapie AliExpress CC2530+CC2591 module.

This module incorporates an RF amplifier, but does not have the normal debug header that the CC2530 Zigbee transceivers have and also lacks the USB-TTL adapter chip. Not a problem if you’re using a RPi as the bridge, which is what I plan on doing.

However first, you need to get Z-Stack firmware on it, so you can use it as a coordinator. This proves to be… non-trivial. Especially if you want to use a Wemos D1 Mini as the flashing device (these Wemos things are really good, incidentally).

First Steps – Getting CClib-Proxy onto the Wemos

Assuming you have a Wemos D1 mini, your first steps are to install the Arduino IDE (available from the Windows Store). Once that’s in, in Preferences, add the following URL to the Additional Boards Manager URL field;


From there, you should now be able to go to the Boards Manager, and install the esp8266 package. Once that is installed, configure your board as a “LOLIN(WEMOS) D1 R2 & Mini” and select the correct COM port.

Now it’s as simple as downloading CCLib-Proxy from this link. Open up CCLib_Proxy.ino, then change the following lines for the pinout;

 int CC_RST   = 5;
int CC_DC = 4;
int CC_DD_I = 14;
int CC_DD_O = 12;

These mappings are required. Upload to your device. You now have CClib-Proxy onto the Wemos and ready to go.

Wiring up the Wemos to the CC2530+CC2591 Module

You will need to map various pins on the Wemos to pins on the module, using the following chart;

DC (Debug Clock)P2_2D2 (GPIO4)
DD (Debug Data)P2_1D5 (GPIO14)
D6 (GPIO12)
RST (Reset)RSTD1 (GPIO5)
VCC (Supply)VCC3V3
GND (Ground)GNDG
RXD (Receive Data)P0_2RPI Pin 8 (TXD)
TXD (Transmit Data)P0_3RPI Pin 10 (RXD)
CTS (Clear To Send)P0_5RPI Pin 11 (RTS)
RTS ( Ready To Send)P0_4RPI Pin 36 (CTS)

When using a Wemos as the flashing device, it’s safe to tie the two I/O pins together (D5 and D6) and connect them to the DD pin on the CC2530. It works fine. The P0_2 through P0_5 pins are used when you’re using the finished device, not when flashing (so you don’t need to connect them up).

Pinout for CC2530+CC2591 module

The above diagram shows the pin mappings on the CC2530+CC2591 module itself. Follow those numbers and the pins above to wire it up.

Pinout of Debug Header on CC2530 (not present on combined module)

This diagram shows the pinout of the debug header (which is not present on the CC2591). However, it does show which pins on the CC2591 marry up to what purposes on the debug header (which correspond to pins on the Wemos).

After this is done, you need to use CClib to flash the firmware.

Flashing the Z-Stack Firmware

Get the firmware from this link. You will also need to install Python 2.7 for your system. Once that’s done, install pyserial with;

pip install pyserial==3.0.1

Edit the firmware .hex you downloaded, and remove the second to last line (it won’t work with the flasher you’re using). Once that is done, connect your Wemos to your computer, and then from the Python directory in your CClib download, run;

python cc_info.py -p COM9

Assuming that COM9 is your Wemos. You should see output giving you data on the CC2530. If so, fantastic. Now flash it;

python cc_write_flash.py -e -p COM9 --in=YOURFIRMWAREHERE.hex

This will take an extremely long time. Several hours. But you should see progress fairly quickly. Just hang tight. Once that’s done, you have a coordinator!

Next post will deal with testing the coordinator out.

References and Links

ADS-B Reception on RPI3

Well, that was straightforward.  I present you with;

ADS-B Output from dump1090

Output collected using the dump1090 tool.  Setup was pretty straightforward;

apt-get install librtlsdr-dev git cmake libusb-1.0-0-dev build-essential
git clone git://github.com/MalcolmRobb/dump1090.git
cd dump1090

Once that’s done, you have a build of dump1090, which can be used with your SDR to decode ADS-B signals from nearby aircraft.  Run this to collect data;

./dump1090 --interactive --net

You should start seeing some dumped output for nearby aircraft.  If you see stuff, great!  Pop open your browser, go to http://YOURRPI:8080/ and then drag the map to near where you are.  Aircraft will appear!

I’m pretty surprised with how well I’m picking up aircraft, given how badly placed my antenna is, and how poor the antenna itself is.  Should work even better once I get a decent antenna.

Software-Defined Radio on RPI3 – First Steps!

Got myself a RTL-SDR Software-Defined Radio (also known as a cheap-as-hell USB DVB-T tuner), and hooked it up to a Raspberry Pi 3 running Raspbian.  My objective here was to just get it working, and eventually I’ll use it for spectrum analysis and ADS-B tracking.

So, I hooked it up, installed GNU Radio (by gods this is a complicated toolkit), and shoved on the default terribad antenna and put it in the shed.

The results?  Well, I got something out of it, but by oath it’s noisy.  I was expecting that, since I have an awful antenna and no ferrite chokes on anything.  But it works!

Example Waterfall plot

The above is a waterfall plot of a small subsection of the regular FM radio band.  It was created using rtl_power (a standard part of the rtl-sdr kit), and a heatmap generator (available here).  The horizontal axis is frequency in MHz, and the vertical axis is time.  Each pixel represents 1kHz of bandwidth and 1s of time.  Brightness indicates received power.

You can clearly see the thick wideband FM transmission at 103.9MHz – that’s a commercial radio station.  There’s a dull band at 103.7MHz (it sounds like noise when tuning into it), and many smaller bands all across the spectrum, which all sound like buzzes when tuning in.  That’s interference.  It’s pretty obvious the antenna is terrible.  But the concept works!

That chart was generated like this;

rtl_power -f 103.5M:104.5M:1k -p 20 -g 35 -i 1s -e 10m sample.csv
python heatmap.py sample.csv sample.jpeg

Now, you can also record arbitrary things.  Here’s a command to record audio to a playable WAV file from the radio station in the above waterfall;

rtl_fm -f 103.9e6 -M wbfm -s 200000 -r 48000 | sox -t raw -e signed -c 1 -b 16 -r 48000 - recording.wav


Now to wait for my new antenna bits to arrive…