The project · Zigbee · Zephyr · nRF52

Zigbee, Engineered

Most Zigbee tutorials end at "hello, network." This one ends at a product: a standards-compliant occupancy sensor you designed, commissioned, bound to a real bulb, signed, and updated over the air, with the packet captures to prove all of it.

11 chapters 28 to 35 hours Intermediate Labs + quizzes every chapter
Get the course. US$79 Preview chapter 1

Preview build: the full course is readable here; checkout opens at launch.

An electronics workbench with a monitor, oscilloscope, meters and a development board
The problem

Knowing Zigbee words isn't knowing Zigbee

The usual way

  • Slides about clusters you'll never declare yourself
  • A vendor demo that joins a network someone else formed
  • "It works on my desk", until the first failed join, with no idea where to look
  • Updates, security and rollback left as an exercise for your future self

This course

  • You declare the endpoint and the cluster, the standard way, so any ecosystem accepts it
  • You form the network from a shell and watch every key change hands
  • A field guide for failed joins, and a sniffer capstone to diagnose from the air
  • Signed images, rollback drills, and OTA, treated as part of the product, not extras
What you build

One desk, one product

An HLK-LD2410 mmWave radar watches the room. Your nRF52840 DK turns its raw UART frames into the standard Zigbee Occupancy Sensing cluster. A coordinator on a dongle, driven entirely from its shell, runs the network. An IKEA TRÅDFRI bulb obeys. In Chapter 11 a second dongle sniffs the air and you decode the whole system in Wireshark.

Your computer west build / flash serial terminals · the shell Wireshark (Chapter 11) Dongle 1 · Coordinator (Ch 5) Dongle 2 · Sniffer (Ch 11) USB USB One Zigbee network formed in Chapter 5 · everything joins it PAN ID · channel · network key nRF52840 DK the device you write — a Zigbee router Occupancy Sensing endpoint (Ch 7) reports & binding switch the bulb (Ch 8) HLK-LD2410 mmWave sensor (Ch 4) UART · 5 V · GND IKEA TRÅDFRI bulb joins in Ch 6 · switched in Ch 8 forms the network joins as router joins as a light USB — flash + logs + shell

The whole course on one desk, the actual architecture figure from the course front matter.

Peek inside

Real pages, real diagrams

37 diagrams across the course, block, sequence and state diagrams wherever a flow exists. Three of them:

The network's cast

Coordinator, routers, end devices, and who holds the keys. (Chapter 5)

802.15.4 · ch 11–26

🟡 Coordinator — dongle
0x0000 · trust center
forms the network, holds the keys

🔵 Router — IKEA bulb
relays, parents children

🔵 Router — our DK sensor
(Chapter 6 firmware)

⚪ End device — (Part 2)
sleepy sensor, child of a router

⚪ End device — remote
wakes, asks parent, sleeps

Joining is a key exchange

The full join sequence, frame by frame. (Chapter 5)

Trust center(= the coordinator)Parent (coordinator or routerwith joining permitted)Joining deviceTrust center(= the coordinator)Parent (coordinator or routerwith joining permitted)Joining devicethe device is now ADDRESSABLEbut cannot read network traffic yetfull member: holds the key,routes or sleeps per its roleBeacon Request (scanning channels)Beacon — "network here, joining open"Association RequestAssociation Response — short address assignedTransport Key — the network key,encrypted under the link keyDevice Announce (broadcast) —"this EUI-64 is now at this short address"

From radio wave to Wireshark

The sniffer capture chain you build in the capstone. (Chapter 11)

Your computer

Sniffer dongle

On the air

radio waves

USB serial text:
received: … power: … lqi: …

Sensor DK, bulb, coordinator
talking Zigbee

802.15.4 radio
promiscuous RX, one channel

802154_sniffer firmware
prints each frame as text

extcap plugin
parses the text, rebuilds frames
wraps them in 802.15.4 TAP

Wireshark dissectors
wpan, NWK, APS, ZCL

Course profile
colors and saved filters

You, reading fields

Read chapter 1 free in this preview
Watch it move

Real animations from inside the lessons

Join sequences and frame formats are hard to learn from a static picture, so the lessons animate them, and hand you the controls. These three are lifted straight out of the chapters, untouched: press play, or step through them frame by frame.

Animated diagram

Joining is a key exchange, the five moves

Joining deviceknows nothing yetParentcoordinator or routerTrust center= the coordinatorBeacon Request, "who is out there?"
Joining deviceknows nothing yetParentcoordinator or routerTrust center= the coordinatorBeacon: "network here, joining open"
Joining deviceaddressable nowParentcoordinator or routerTrust center= the coordinatorAssociation RequestAssociation Response. You are 0x3F2A…but it holds NO network key: it can be spoken to, and can decrypt nothing.
Joining deviceabout to be trustedParentrelays if remoteTrust center= the coordinatorTransport Key: network key, wrapped in the link key🔑 the security perimeter, in one frame
Joining deviceFULL MEMBER ✓Parentcoordinator or routerTrust center= the coordinatorDevice Announce (broadcast): EUI-64 ↔ 0x3F2Anaming preceded trusting: mechanically, it could not be the other way round

Animated diagram

One LD2410 frame, byte by byte

LD2410 frame on the wire: 256,000 baud, ~24 bytes per reportF4F3F2F10D0001AA55··F8F7F6F5headerlengthdata: target state, distance, energy…tailSEEK→HEADER→LENGTH→DATA→TAIL→EMIThunting for F4…parser state: one byte in, one decision, never a guess
LD2410 frame on the wire: 256,000 baud, ~24 bytes per reportF4F3F2F10D0001AA55··F8F7F6F5headerlengthdata: target state, distance, energy…tailSEEK→HEADER→LENGTH→DATA→TAIL→EMITheader matched → HEADERparser state: one byte in, one decision, never a guess
LD2410 frame on the wire: 256,000 baud, ~24 bytes per reportF4F3F2F10D0001AA55··F8F7F6F5headerlengthdata: target state, distance, energy…tailSEEK→HEADER→LENGTH→DATA→TAIL→EMITlength = 13 data bytesparser state: one byte in, one decision, never a guess
LD2410 frame on the wire: 256,000 baud, ~24 bytes per reportF4F3F2F10D0001AA55··F8F7F6F5headerlengthdata: target state, distance, energy…tailSEEK→HEADER→LENGTH→DATA→TAIL→EMITcollecting… no interpretation yetparser state: one byte in, one decision, never a guess
LD2410 frame on the wire: 256,000 baud, ~24 bytes per reportF4F3F2F10D0001AA55··F8F7F6F5headerlengthdata: target state, distance, energy…tailSEEK→HEADER→LENGTH→DATA→TAIL→EMITtail matched → frame completeparser state: one byte in, one decision, never a guess
LD2410 frame on the wire: 256,000 baud, ~24 bytes per reportF4F3F2F10D0001AA55··F8F7F6F5headerlengthdata: target state, distance, energy…tailSEEK→HEADER→LENGTH→DATA→TAIL→EMITbad tail → drop, re-sync at next F4parser state: one byte in, one decision, never a guess

Animated diagram

The OTA conversation: the client sips, never gulps

OTA clientproduct · EP 5Networkthe meshOTA serverNCP DK + nrfutilMatch Descriptor Request (broadcast), who serves 0x0019?Match Descriptor Response. "I do"
OTA clientproduct · EP 5Networkthe meshOTA serverNCP DK + nrfutilQuery Next Image: mfr 0x127F, type 0x0141, v0x01020100…SUCCESS: v0x01030000 available
OTA clientwriting slot 1Networkthe meshOTA serverNCP DK + nrfutilImage Block Request (offset 0, ≤64 B)Image Block Response (data)Image Block Request (offset 64…)block 12 of ~6,800
OTA clientstill sensing ✓Networkthe meshOTA serverNCP DK + nrfutilImage Block Request (offset ~278,000…)Image Block Response (data)≈ 63%, and the room is still being watched
OTA clientrebooting…MCUbootborder guardOTA serverjob doneUpgrade End Request, SUCCESSUpgrade End Response, nowreset → verify signature → swap (trial)
Productv1.3.0 ✓ confirmedNetworkrejoinedOTA serveridleboot_write_img_confirmed()same signed update, no cable. The product is finished

Curriculum

Chapter by chapter

Eleven chapters, one growing firmware. Total: about 28 to 35 hours of building, depending on your pace.

1

Setup the pinned way, and your first debug session

Install the pinned toolchain, flash your first app, and learn the two skills that decide whether embedded work is fun or misery: reading logs and driving the board from a shell.

~2 to 3 h
2

Zephyr essentials (only what this course uses)

Devicetree, Kconfig, threads, logging and work queues, the five Zephyr ideas everything later stands on, and no more.

~3 to 3½ h
3

GPIO and interrupts, done properly

Interrupt-driven buttons with debounce done properly, by timestamp, measured in your own logs, not guessed.

~2 to 2½ h
4

Talk to the LD2410: a UART driver from the datasheet

Interrupt UART, a ring buffer and a frame-parser state machine: a real LD2410 driver built from the datasheet, not a library.

~3 to 3½ h
5

Zigbee from zero, and the coordinator on a dongle

Roles, channels and keys in plain words; forming a network from the coordinator shell, and the bdb / zdo / zcl toolkit every later lab is driven from.

~2½ to 3 h
6

Commissioning: our device and an IKEA bulb join the network

Steering, the association handshake and transport-key delivery. Your device and a store-bought IKEA bulb join the same network.

~2 to 2½ h
7

Write the ZCL Occupancy Sensing endpoint & cluster

The heart of the course: declare a standards-compliant Occupancy Sensing endpoint (0x0406) and wire it to the LD2410.

~2½ to 3½ h
8

Reporting & binding: occupancy switches the bulb

Attribute reporting and binding close the loop. Walk into the room and the bulb turns on; walk out and it turns off.

~3 to 3½ h
9

MCUboot: signing, swap, and rollback

Two slots, signatures and a strict border guard: MCUboot swap, confirmation, and a rollback drill with a deliberately broken image.

~2½ to 3 h
10

OTA updates over the Zigbee network

The same signed update with no cable: OTA packaging, block pacing and version policy, while the sensor keeps sensing.

~2½ to 3 h
11

See it on the air: the sniffer capstone

A second dongle sniffs the air into Wireshark. Capture a full join and decode every frame against what Chapters 5 to 8 taught.

~3 to 3½ h
What's inside

Everything is a deliverable

  • 11 hands-on labs: step-by-step builds in a repo layout, each ending in something you can observe working
  • 94 quiz questions with full answer keys: self-check cards, graded as you go
  • 37 diagrams: architecture, join/OTA sequences, parser and bootloader state machines
  • The Zigbee shell toolkit bdb, zdo, zcl taught once, then used to drive and debug every lab
  • Hardware validation checklist: the honest desk checks for every chapter, in one page
  • Stretch exercises. Break it on purpose, extend it, prove you understood
Photo of the nRF52840 DK (PCA10056) development board
Hardware needed

The shopping list

Hardware is not included. It's the standard Nordic desk kit, reusable for every future course on this shelf. One-time cost is roughly US$70 to 110 depending on region.

nRF52840 DK

The board you program: the occupancy sensor itself. (PCA10056)

nRF52840 Dongle ×1 to 2

One runs the coordinator; a second becomes the Chapter 11 sniffer. (PCA10059)

HLK-LD2410

The mmWave presence sensor. Four wires: power, ground, TX, RX.

IKEA TRÅDFRI bulb

Any E26/E27 Zigbee TRÅDFRI bulb, the thing your sensor will switch.

A computer

Windows, macOS or Linux: the pinned toolchain (NCS v3.4.1) installs the same way on all three.

USB cables + jumpers

Two micro-USB cables and a handful of female-to-female jumper wires.

Who it's for

  • Firmware engineers who know basic C and have seen a microcontroller
  • Embedded folks adding Zigbee/Zephyr to a real skill set
  • People who learn by building, and want the artifact to show for it

Who it's not for

  • Complete beginners to C. Learn the language basics first
  • Anyone wanting a video course. This is text, labs and doing
  • Anyone shopping for a certificate. You leave with a product, not a PDF badge
Owner perks

What owners get

Buying the course is the start, not the whole deal. This is what's included with it, and the headline is a human being on the other end of an email.

Headline perk

Lifetime email support

Stuck on a lab, or a concept won't click? Email your question about the course to [email protected] and a working engineer answers, within 1 to 2 working days. Support covers questions about the course material and its labs. It is not general consulting, and it does not extend to debugging projects unrelated to the course. For as long as you own the course: no support tiers, no expiry, no ticket bot.

Animated diagrams

The hard ideas (the join handshake, the frame parser, an update crossing the air), are taught as animations you play, pause and step through, not slides that wash past.

94 quiz questions, with answer keys

Every chapter ends in a self-check quiz with full answers, so you find the gaps while they're still cheap to fix.

The troubleshooting appendix

When it breaks. The field guide to the failures this build actually produces: symptom, cause, fix. Kept open beside the labs, it earns its place in the first week.

Exercise-by-exercise code

The product grows one verified step at a time, and the code grows with it, every exercise a buildable checkpoint, nothing dropped on you all at once.

Coming soon

More perks on the way

Owning a course here will keep getting better. More owner perks are in the works, and when they land, owners get them, free.

Course FAQ

Before you ask

How much experience do I need?

Basic C and having seen a microcontroller is enough. Everything Zephyr and Zigbee is taught from zero (devicetree, Kconfig, clusters, all of it), but the course won't teach you what a pointer is.

Which SDK version does it use?

One pinned stack, on purpose: nRF Connect SDK v3.4.1 with the Zigbee R23 add-on v1.4.0 (Zephyr 4.4.2). Chapter 1 installs exactly that. Pinning means every chapter builds the same bits on your machine as on ours.

How long do I have access?

Access doesn't expire. Buy once, build at your pace, come back whenever, including course updates.

What if I get stuck?

Every lab ends in observable behaviour ("you are done when…"), the join-failure field guide covers the common traps, and email support is included. Write to [email protected] and a working engineer answers, not a bot.

Can I do it without the IKEA bulb?

Chapters 1 to 7 work with just the DK and dongle. The bulb is where reporting and binding become real (Chapter 8 on), so you'll want one by then. Any Zigbee 3.0 bulb works; the course uses TRÅDFRI because it's cheap everywhere.

Zigbee, Engineered
US$79 one-time
  • All 11 chapters, labs, quizzes and diagrams
  • Lifetime access in the online player, nothing to install, read anywhere
  • Hardware validation checklist
  • Email support from the instructor
  • Free updates to the course
Get the course

Placeholder price for this preview build. Secure checkout opens at launch; the refund policy (14 days, no questions) will apply from day one.

About the instructor

A working embedded firmware engineer with 10 years in the field. The course is the desk manual he wishes he'd had: every pattern in it is one he uses in products.

More on the About page →