• Cc2540 Usb Driver Software
• Ti Cc2540 Dongle Driver

CC2540 USB dongle Windows7 64 driver. Prodigy 90 points Jan Althaus Replies: 14. Hi, I'm having some trouble getting the CC2540 USB dongle to work with. I know china is playing lottery. The device appear to work: 435.857949 usb 1-1: new full-speed USB device number 5 using xhcihcd 436.001823 usb 1-1: New USB device found, idVendor=0451, idProduct=16a8 436.001828 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 436.001831 usb 1-1: Product: TI CC2531 USB CDC 436.001834 usb 1-1: Manufacturer: Texas Instruments.

NOTICE: The Processors Wiki will End-of-Life on January 15, 2021. It is recommended to download any files or other content you may need that are hosted on processors.wiki.ti.com. The site is now set to read only.

The Bluetooth low energy (BLE) Device Monitor is a Windows application that serves as a monitoring and control application for TI SensorTag devices. In addition it offers some functionality that applies to all BLE devices.

• 4BLE Device Monitor first use
  • 4.2Finding the correct COM port
• 5Connecting to a SensorTag (or any Bluetooth low energy device)
• 7Using the SensorTag tab
• 8Using the LaunchPad tab

Introduction[edit]

BLE Device Monitor connects to a BLE Central Device (Host) via a serial port. The following TI modules may serve as BLE hosts: CC2540 USB dongle, CC2650 LaunchPad, CC1350 LaunchPad and CC2640R2 LaunchPad. The host firmware is the HostTestApplication and is the same that BTOOL uses. The host firmware for all platforms is bundled with BLE Device Monitor.

BLE Device Monitor is available for download here.

The application (latest version 2.9.0) has been tested on Windows 7 and Windows 10.

(*) Providing service is available

(**) Requires Out-of-box firmware

Installation[edit]

After downloading the ZIP-file, unpack and run installer (Setup_BLE_Device_Monitor.exe) and confirm when Windows asks for permission to install executable and drivers. When the installation is complete there will be a short-cut to the application on the Windows Desktop.

Host Firmware[edit]

Before the application can be used it needs to connect to a BLE Host on either a CC2540 USB Dongle or a CC2650/CC2640R2 LaunchPad. The recommended platform is one of the Launchpads, they come with a built-in programming interface and are thus more straightforward to get started with.

• ) Path relative to the applications installation directory. Default: C:Program Files (x86)Texas InstrumentsSmartRF ToolsBLE Device Monitor

The Virtual COM port driver for the CC2540USB dongle and the LaunchPads can be found in (default): C:Program FilesTexas InstrumentsSmartRFToolsdriversvcp.

BLE Device Monitor first use[edit]

Serial port driver installation[edit]

On Windows 7 and 10 the serial port driver installs automatically when the BLE host is connected for the first time. The COM-port number is displayed when the installation completes. The installation should normally not require any intervention from the user.

In the unlikely event that the driver installation files, the device is probably listed as an unknown device. Select the unknown device, right click and install the driver from: C:Program Files (x86)Texas InstrumentsSmartRFToolsdriversvcp.

Finding the correct COM port[edit]

Start application with no BLE host connected[edit]

Open Device Monitor from: C:Program FilesTexas Instruments (x86)BLE Device Monitorble_devmon.exe or from the Windows Start Menu, or from the Desktop shortcut. There will be a message that no TI USB Serial Device is connected.

Connect the BLE Host to a USB port and the application will automatically open it.

Start application with BLE host connected[edit]

If the host is connect before launching the application, it will fail to open the COM port, as the predefined COM port is COM1. This will only happen the first time the application is launched.

If this happens, go to ‘Options’ and ‘Serial Port’ and select the desired COM port and click ‘OK’. This will start communication with the BLE Host.

BLE Host startup[edit]

When a BLE Host is detected, the BLE Device Monitor will display the message 'BLE Host found' and some other messages in the event log. Then it will by default start scanning for BLE devices. Automatic scanning after start-up can be enabled/disabled by the Autoscan checkbox.

Connecting to a SensorTag (or any Bluetooth low energy device)[edit]

Connect CC2541 SensorTag[edit]

Insert a CR2032 (coin cell) battery in the SensorTag and click on the side button to enable advertising. The LED (D1) should start to blink rapidly to indicate that it is ready to communicate with the BLE Device Monitor. If no connection is established within 30 seconds the LED will stop blinking and the SensorTag will go back to sleep. If that happens, push the side button again to make the SensorTag advertise for another 30 seconds. Advertising on/off can be toggled via the side button any time.

Connect CC2650 or CC1350 SensorTag[edit]

Insert a CR2032 (coin cell) battery. The device will first undergo a self-test, and when the test is complete it will start advertising. On the CC2650 SensorTag this indicated by the green LED blinking every second, on the CC1350 SensorTag the red LED serves the same function. The device advertises for 3 minutes, and is started/stopped by pressing the Power Button.

Click ‘Scan’ in BLE Device Monitor to scan for the SensorTag
Select the SensorTag; either by double clicking on the SensorTag name or select the SensorTag and click on ‘Connect’.
The SensorTag will now change status from Not Connected to Connected and all Service Discovery starts, provided the Autodiscover check-box is ticked. Bluetooth low energy Services and Characteristics now appear.

GATT Explorer[edit]

The GATT Explorer appears as soon as service discovery is completed. It is a tree representation of the BLE device's GATT database, and shows all services, characteristics, characteristics descriptors and characteristic values. The latter may be changed by the operator, by double-clicking on the corresponding item and enter a new value.

SensorTag and LaunchPad application tabs[edit]

If a SensorTag or Launchpad is detected, an Application tab appears next to the GATT explorer. For SensorTags the panel displays sensor values, button and relay states, and controls for activating LEDs and buzzer, starting/stopping data acquisition, reset the device or erase the external flash.

The Launchpad application tab is simpler: it shows button states, LED control, Device Reset and External Flash Erase.

Other devices[edit]

For other devices than TI SensorTags or LaunchPads no application panel appears, but the GATT Explorer is till visible and can be used to display and change characteristics values.

Using the GATT Explorer[edit]

The GATT tab will list all the GATT Primary Services that is available for the connected Bluetooth low energy device. Click on the + to display the Characteristics of the Service.

For the Pressure sensor, there is a characteristic, AA41, which shows the raw temperature data from the Pressure sensor (Barometer). Notifications are enabled after connection but the SensorTag will not transmit any data as the sensors are off by default. Click on the Barometer Data characteristics to see the temperature readings (in hex). These will show 00:00:00:00:00:00 when the sensor is off.

Turn on the sensor by double-clicking in the 'Value' field of the Barometer Config characteristic, and enter '1'. Now data from the sensor will appear in the Value column. If the log is set to 'verbose' messages will appear also there. The readout period can be changed by applying a value to the 'Barometer characteristic'. The sensor is then turned off by writing '0' to the Config characteristic.

Explore the other sensors to by opening the corresponding Services. All sensors use a common set of characteristics and are operated in the same way.

Using the SensorTag tab[edit]

Data Monitoring[edit]

Choose the sensors you want to monitor and then click 'Start'. Make sure that you haven't stopped notifications of any of the sensors you want to monitor. By default all sensors are enabled. Both converted and raw values are displayed. If the values are within limits they are displayed green, if not red. When the tab is launched the status of the power-on self-test is displayed.

CC2650 and CC1350 SensorTags are equipped with the following sensors: IR Temperature (*), Barometer, Humidity, Accelerometer, Gyroscope, Magnetometer, Optical sensor.

CC2541 SensorTag is equipped with: Accelerometer, Gyroscope, Magnetometer, Barometer, Humidity Sensor, IR Temperature sensor

(*)The IR Temperature Sensor TMP007 is not fitted on SensorTags produced after July 2017 as the component is no longer manufactured.

Buttons and relays[edit]

From this tab the state of buttons and relay (CC2650/CC1350 SensorTag) is also displayed. The state of those are available also when data monitoring is not running. You will see the effect of a button click immediately.

LED and Buzzer[edit]

The LEDs can be operated from here. Green LED for CC2541 and CC2650 SensorTag, red LED for CC2650 and CC1350 SensorTag. The two latter also has a buzzer that likewise can be activated. Be aware that the buzzer's power consumption is high, and if the battery level is low it may cause the SensorTag to disconnect altogether.

Wake on Motion[edit]

This feature is only available on the CC2650 and CC1350 SensorTag. When enabled data acquisition stops after 10 seconds and is re-activated by touching the device physically.

Cc2540 Usb Driver Software

Other features[edit]

The CC2650 and CC1350 SensorTag can also be reset from the BLE Device Monitor. This is a soft reset of the MCU.

A useful feature for developers is the External Flash Erase command. This will remove any factory or OAD images on the flash. When the device is reset next, the current flash image will be installed on the external flash as 'Factory Default'.

Using the LaunchPad tab[edit]

The LaunchPad panel has the same basic functionality as the SensorTag panel but for obvious reasons no sensors. Nor is there any buzzer or relay.

Buttons[edit]

From this tab the state of buttons is also displayed. You will see the effect of a button click immediately.

LED[edit]

The red and green LED can be operated from here.

Other features[edit]

The CC2650 and CC1350 LaunchPads can also be reset from the BLE Device Monitor. This is a soft reset of the MCU.

A useful feature for developers is the External Flash Erase command. This will remove any factory or OAD images on the flash. When the device is reset next, the current flash image will be installed on the external flash as 'Factory Default'.

Using the Test tab[edit]

(opened from the Options menu or CTR+T).

This is the Production Test facility for the SensorTag. It provides test of all the sensors and peripherals that are available on the SensorTag. The operator will be prompted for action when required, e.g. to confirm that, say, an LED has been turned on or when it is necessary to operate a button. The test results are stored in time stamped log files, one for each calendar day (XML format). Test results are best accessed via File->Open Working Directory. This will open the storage directory used by the SensorTag (DocumentsTexas InstrumentsBLE Device Monitor).

The test limits may be changed in the following XML file: C:Program Files (x86)Texas InstrumentsSmartRFToolsBLE Device Monitorconfigtest_sensortag.xml. Similar configuration files exist for all supported TI platforms (test_launchpad.xml, test_cc2650stk.xml, test_cc1350stk.xml).

Over-the-Air-Download (OAD) for CC2541 SensorTag[edit]

New firmware can be downloaded to the SensorTag using the OAD feature of the BLE Device Monitor. This feature is accessed with File->Program (OAD), alternatively use CTRL + O. Select the image you want to download to the SensorTag. In Program FilesTexas Instruments (x86) SmartRFToolsBLE Device Monitorfirmwarecc254x there are binary images containing the latest available firmware (at the moment version 1.6 based on BLE Stack 1.42).
.
Click start to begin the over-the-air firmware upgrade.

When a new firmware has been successfully downloaded to the SensorTag it will restart and the BLE Device Monitor loses connection with it. When ready the LED on the SensorTag will blink once and the SensorTag is reset and ready to use with the new firmware. Note that the side button must be pushed to restart advertising and the user may now reconnect and verify that the upgrade succeeded. Aborting the OAD upgrade is safe, the BLE device will continue to operate with its current firmware. This is easiest done by inspecting the log where the FW revision and the build date is displayed in bold green.

Note that if the current image is of type 'A', the new image must be type 'B' and vice versa.

Over-the-Air-Download (OAD) for CC2650 and CC1350 SensorTags[edit]

These devices are programmed using a different GUI than the CC2541 SensorTag. It can program hex files directly either by choosing them with a file open dialog or by drag and drop.

The upgrade possibilities are restricted by the firmware that is already present in the SensorTag. The initial batch of SensorTags were programmed with BETA firmware (pre-RTM), given the version number 0.89. This version permits an upgrade to version 0.91 only. When this is done you may upgrade to subsequent CC2650 firmware versions. If you have a SensorTag with 0.89 firmware pre-programmed it is highly recommended that you update to version 1.20 via version 0.91. Note that CC2650/CC1350 SensorTags or LaunchPads do not distinguish between images types A/B as it uses an external flash for temporary storage of the image.

Between version 1.20 and 1.30 it is necessary to update the whole image because the Boot Image Manager changed. Therefore the OAD Flash Programmer must be downloaded as a first step, and then version 1.30 can be downloaded. The correct steps are indicated by which files are made visible in the file opening dialog.

It is possibly to override the restrictions on upgrade paths simply by changing the file filter when you open a file for download. If you set the filter to all you can download any hex- or bin-file, but at your own risk. If the new image doesn't contain an BLE OAD service the only way to reprogram device is via the Debug Devpack (or LaunchPad).

OAD changes in BLE 2.2[edit]

With BLE 2.2 the OAD approach for SensorTag and other TI Bluetooth Smart examples have been harmonized to use the same approach. Thus it is no longer possible to program any hex image on the SensorTag. Only images that start on address 0x1000 and contain a valid OAD record (meta-data) in the first 16 bytes will be accepted. Page 0 and page 31, containing reset vector and BIM (Boot Image Manager) can no longer be reprogrammed over the air.

Ti Cc2540 Dongle Driver

The complete Attribute Table for the SensorTag can be found in here BLE_SensorTag_GATT_Server.pdf

The complete Attribute Table for the CC2650 SensorTag can be found at here. Scroll to the bottom and expand GATT Attribute Table.
Back to Bluetooth SensorTag main page

Changes between version 2.9.0 and version 2.8.0:

• Firmware revision 1.50 on CC2650 SensorTag and LaunchPad

Changes between version 2.8.0 and version 2.7.0:

• Fixed critical error in handling of serial port input (could cause OAD to stop before completion)
• Using the function HCI_Reset (instead of vendor specific functions) to reset BLE host
• Fixed scaling problem in OAD tab for small screens
• Read long characteristics correctly
• Fixed inconsistent/erroneous UUID rendering in tool-tips and GATT HTML export
• Includes OAD firmware files for CC2640R2 LaunchPad on-chip OAD (Oad Target, Simple Peripheral and Project Zero)

Changes between version 2.7.0 and version 2.5.0:

• Display of IR Temperature sensor removed (the component has reached end of life and is not mounted on the SensorTag)
• Automatic USB enumeration (plug-and-play)
• Basic in-tool user interface to SmartRF Flash Programmer 2
• On-chip OAD now working
• Firmware version 1.43 for CC2650 and CC1350 SensorTags
• Firmware version 2.35 for CC2640R2F LaunchPad
• Fixed minor bugs

Changes between version 2.5.0 and version 2.4.0:

• Improved OAD GUI (more information about images)
• Always use safe mode for OAD (removed possibility to tweek)
• Automatically set optimal connection interval for OAD
• OAD working again for CC2541 SensorTag
• Manual selection of OAD method (on-chip v off-chip) for third-party applications (not SensorTag or Launchpad OOB)

Changes between version 2.4.0 and version 2.3.0:

• Update firmware to BLE SDK 2.2.1
• List of firmware versions available from application menu

Changes between version 2.3.0 and version 2.2.0:

• Added firmware for CC1350 SensorTag
• Automatically select correct firmware folder for OAD (according to which device is connected)
• OAD tab now available offline (for generating binary files from hex files)
• Display meta-data (image header) prior to OAD
• Soft reset of BLE Device

Changes between version 2.2.0 and version 2.0.0:

• Provided with BLE 2.2 application firmware for CC2650 SensorTag and CC2650/CC1350 LaunchPad
• Split data monitoring and production test functionality
• HCI data logging to file
• Report firmware revision and battery level in status bar
• OAD upgrade path for SensorTag firmware v 1.20 to 1.30
• Improved scan settings dialog (device name filtering)
• Remembers previously selected device
• Optional autoconnect after scan
• External Flash Erase

Changes between version 1.0.0 and version 2.0.0:

• Support for CC2650 SensorTag with the new sensors
• OAD for CC2650 SensorTag
• OAD uses hex files directly
• OAD customization: possible to choose between 'safe mode' (wait for notification before sending a new block) and 'fast mode' (send at a fixed interval, configurable)
• Optical sensor TI OPT 3001 visualized
• Added possibility to operate LED and buzzer from SensorTag panel
• Fixed bug that made SensorTag panel reports errors with long connection interval + slave latencies
• Scan duration configurable
• Background scans introduced (rate is configured in Scan settings)
• Two pre-set values for GAP settings (fast and slow modes)

• 3Analysis
• 4Protocol
  • 4.2Reading BLE frames

Status

At this point (2017-05-09), the status is:

• it is pretty clear which commands the default sniffer firmware understands
• I wrote a little test program to dump raw BLE frames
• there is no plugin for WireShark yet

Introduction

This page is about the CC2540 bluetooth low-energy sniffer dongle and getting it to work with Linux.A nice end result could be that it becomes possible to sniff directly in WireShark with this dongle.

I have such a 'WeBee' dongle that can be found for about E15,- on websites like Aliexpress.

It's supposedly a CC2540 (or compatible) dongle, the USB id is 0451:16b3.

Interesting links:

Analysis

USB descriptor

When plugging this stick into a Linux machine, you can see it uses only one bulk endpoint.

Reading the identification from the stick with the 0xC0 command, results in the following 8-byte response

You can recognise the 2540 type number in there.

USB logs from Windows

This USB device does actually work with Windows:

I've captured a log of the communication over USB while the BLE is capturing bluetooth traffic from some iBeacon, using USB pcap.

In the logs, I cannot see any firmware blobs being downloaded to the stick.Probably the stick comes with a pre-loaded firmware of itself to do the BLE sniffing.

The USB control transfer request codes seem to match up with the code in https://github.com/christianpanton/ccsniffer/blob/master/ccsniffer.py

• 0xC0, GET_IDENT: returns some kind of identifier
• 0xC5, SET_POWER
• 0xC6, GET_POWER
• 0xC9, no idea, this appears in my USB logs but I can't find it in the python code
• 0xD0, START
• 0xD1, STOP
• 0xD2, SET CHAN

Protocol

In the windows sniffer software, it seems there are only two things communicated:

• towards the stick: which radio channel to sniff, and some other radio settings
• from the stick: raw sniffed BLE frames

Configuring the radio

This appears to be done using USB control transfers.

The following requests are sent:

Request type 0x40 is a vendor-specific device request from host-to-device.Request type 0xC0 is a vendor-specific device request from device-to-host.

Reading BLE frames

This appears to be done using USB bulk input transfers.

I can see a lot of similarities between the USB log and the BLE sniffer log.

Each frame starts with a byte indicating the type of frame, following by two bytes indicating the length of the rest of the frame (encoded as little endian).

data frames

The bulk USB data starts off with two bytes indicating the length of the rest of the data.

In the example image on the right:

• 00: 0 means this is a data frame
• 31 00: length of rest of frame encoded in little endian = 49 bytes decimal
• 39 04 29 54: part of the time stamp
• 2c d6 be ..: data frame contents

unknown frames (tick or 'alive'?)

The stick also returns 4-byte frames, alternating between

and

Interpretation:

• 01: 1 means this is a frame of type 1
• 01 00: length of the rest of the frame encoded in little endian = 1 byte
• 40 or C0: unknown data byte

Software

Preliminary code can be found athttps://github.com/bertrik/cc2540

It connects to the dongle and dumps raw USB packets to stdout.

This software requires libusb-1.0-dev