How does Zigbee work?

Zigbee does not define its own radio. Silicon Labs, which builds Zigbee chips and software, explains that the Alliance adopted the IEEE 802.15.4 standard for the physical and MAC layers and developed the network, security and application layers itself. The Connectivity Standards Alliance (CSA), formerly the Zigbee Alliance, maintains the specification. The short Zigbee glossary entry summarises the standard.

The radio sets the pace. Silicon Labs gives the 802.15.4 data rate as 250 kbps in the 2.4 GHz band and 40 kbps or 20 kbps in the 900 MHz and 868 MHz bands, and notes that sustainable traffic through a real network is lower. The 802.15.4 MAC handles the basics: listening for a clear channel before transmitting, and retries and acknowledgments between neighbouring devices. Zigbee’s network layer builds end-to-end delivery on top.

Thread uses the same radio. The CSA explains the difference: Thread devices use IP-based technology for the network stack, while Zigbee has its own.

Silicon Labs describes three node types, with at most one coordinator per network:

• Coordinator. Forms the network: it scans the channels, picks one, and chooses an extended PAN ID. It always has network address 0x0000 and acts as a router afterwards. It can also take on the trust centre role, which manages security settings and authorisations for the network.
• Routers. Relay traffic for other devices. They are not designed to sleep and should stay on for as long as the network runs.
• End devices. Leaf nodes that talk only through their parent and cannot relay. A sleepy end device powers its radio down when idle and polls its parent for messages, and the parent holds messages for it in the meantime.

The split matters for power. Sleepy end devices can keep their radios off while idle, and the always-on routers do the relay work. Silicon Labs also cautions that making every line-powered device a router is not always wise in a dense network, because too many routers close together can cause interference.

Silicon Labs lists four routing mechanisms, and one application may use several:

• Table routing. To reach a device with no known route, the sender broadcasts a route request. Once a path is found, each hop forwards the message using its own routing table. If a route breaks, a route error goes back to the sender, which discovers a new one.
• Broadcast. Every router-capable device repeats a broadcast three times. It is reliable but costly in airtime, a form of flooding, so it should be used sparingly.
• Multicast. A message goes to a group, such as a switch turning on a bank of lights. Only group members act on it, and multicasts are never acknowledged.
• Many-to-one and source routing. A central device, the concentrator, announces a single route to itself that every router stores. Messages from the concentrator carry their route in the network header, so routers do not need large tables.

Route choice uses link quality in both directions. Routers exchange periodic link status messages listing the cost of their links to neighbours, so a route discovery can skip links that only work one way. Routes can be rediscovered when a hop fails, and the CSA describes the mesh as self-healing.

Moving bytes is only half the job. Silicon Labs explains that a cluster in the Zigbee Cluster Library (ZCL) is a set of messages for related commands and data, such as a temperature cluster or an on/off cluster. Each cluster has a client end and a server end, and the application layer specifies which clusters a given kind of device must or may support.

Zigbee 3.0 tied this together. According to Silicon Labs, it merged the earlier separate application profiles into one common application layer, so certified products from different domains can share a network. The CSA notes that Matter’s data model borrows heavily from the ZCL, although Matter and Zigbee devices do not interoperate directly and are connected through bridges.

Zigbee 3.0’s Base Device Behavior specification sets out how devices get onto a network, in this order: touchlink commissioning, classical joining, forming a network, and finding and binding. To join, a device scans for open networks with 802.15.4 active scans and joins using a link key derived from an install code or a default key. Silicon Labs notes that a trust centre can admit only devices whose install code it knows, and that devices can then bind to each other, such as a switch to a light.

The CSA describes AES-128 encryption and authentication of messages, along with certificates and elliptic curve cryptography. It also lists Zigbee Direct, which lets a phone or tablet interact with a Zigbee network over Bluetooth, and physical layer support for sub-GHz bands alongside 2.4 GHz.