Entering the bootloader remotely?


To enter the bootloader you have to set DTR, RTS, and DIN when the bootloader is coming up. If the device is local you can do this with the reset pin. What if it’s not? Are there any conventions for dealing with this for fielded (physically inaccessible or difficult to access) units?


Hello Christopher,

To enter the bootloader menu remotely the Programmable XBee has to be in the “bootloader menu” previously. Then you can send a 0x0A (
) or a 0x0D (\r) to the module and it will answer with the bootloader menu (except for the “B - Bypass” option).

How do you set the module in the “bootloader menu”? There are several ways:

1- The module has not a valid application. For example, when a firmware update failed or when a module has been just flashed a new bootloader.

2.- The application reset by watchdog and is waiting in the bootloader menu instead of jumping to application. This is very similar to the previous case.

3.- The application intentionally rebooted to the bootloader menu with function “sys_reset(APP_CAUSE_BOOTLOADER_MENU);” Notice that in this case may be more interesting to use another reset cause like APP_CAUSE_BYPASS_MODE or APP_CAUSE_FIRMWARE_UPDATE (this is used in OTA Firmware update example in the lastest SDK version).

Regarding to “sending” the 0x0A or 0x0D, it may be done in several ways:

1- From a module in transparent/at mode. Set DH and DL parameters to the target module’s SH and SL respectively (MAC address), then you can send an intro in the serial console.

2.- From a module in API mode. Send an Transmit Data (0x10 frame type) to the module’s. This will send an 0x0A to the module with MAC address (SH-SL) “00 13 A2 00 11 11 11 11”
7E 00 0F 10 01 00 13 A2 00 11 11 11 11 FF FE 00 00 0A EE

OR an explicit frame (0x11 frame type) to Digi Serial Cluster (0x0011), ProfileID=C105 and destination/source endpoints = E8. With the previous MAC address:
7E 00 15 11 01 00 13 A2 00 11 11 11 11 FF FE E8 E8 00 11 C1 05 00 00 0A 46

Find an API frame Builder here: ftp://ftp1.digi.com/support/utilities/digi_apiframes.htm

Hope it helps! Regards,


That does help, thank you. I think what I will do is make my application smart enough to receive a special ZB message that tells it to reboot into the bootloader using the sys_reset() function you mentioned. I also bought a BDM programming cable, if I need to re-flash the device from scratch hopefully I will be able to do so fairly easily.

I have a followup question.

It seems it would be useful to define a zcl (if I am using that term right) zigbee message that would tell the end device “Enter the bootloader now.” I can make one up, but I’m wondering whether or not there is already a convention for doing this. Have you heard of one?


Hello Chris,

There is no specific message or cluster for doing that, so feel free to do it as you prefer. Regards,