Technically, ZigBee is a kind of an application of IEEE 802.15.4. 802.15.4 defines various types of PHY implementation and a single (common) MAC layer that applies to all the different PHY implementation.  In terms of MAC layer, you may say ZigBee complies to 802.15.4 and in terms of PHY layer, you can say ZigBee implements a sub set of 802.15.4 PHY specification. In a very detailed implementation, there is some possibility that ZigBee PHY layer has a little bit of variations from 802.15.4 PHY specification since ZigBee has been in the market for pretty long time and it was commercialized even before every details of 802.15.4 PHY has clearly been defined. In addition, ZigBee has been driven by its own alliance group (ZigBee Alliance) as you might have seen how Bluetooth has been evolved/promoted by Bluetooth Alliance (or Bluetooth Special Interest Group). If you are seriously interested in the technical details of ZigBee, you would need to cover both IEEE 802.15.4 and various documents published by ZigBee Alliance.

• How is the ZigBee stack built on top of 802.15.4 ?
• PHY Property/Requirement
• Frame Structure

How is the ZigBee stack built on top of 802.15.4 ?

Before we look at any ZigBee numbers, let's place ZigBee in its protocol stack. ZigBee and 6LoWPAN both run on the IEEE 802.15.4 MAC. So the useful question is where the two stacks start to differ, and what ZigBee adds on top of the MAC.

Following is overall sturcture of ZigBee in comparison with 6LoWPAN. As you see here, ZigBee uses its own PHY (though it is very similar to 802.15.4 PHY) and the biggest difference is Network Layer. ZigBee uses its own proprietary Network Layer protocl. Since it is Proprietary, it was difficult to communicate to other network(non-ZigBee network), but now it is evolving into more common IP Network Layer concept.

Figure 1. 6LoWPAN and ZigBee side by side. Both use the 802.15.4 MAC, and they differ at the network layer.

• The MAC is common to both stacks : the network layer reaches 802.15.4 (MAC) through two service access points, MCPS SAP for data and MLME SAP for management.
• The PHY is reached the same way : the MAC uses PD SAP for data and PLME SAP for management. The 6LoWPAN column labels this block 802.15.4 (PHY), and the ZigBee column labels it ZigBee (PHY).
• The network layer is where the stacks split : 6LoWPAN Network Layer carries IPv6, while ZigBee Network Layer is ZigBee's own. The arrow on the right lists its versions, from ZigBee 2007 to ZigBee IP.

The diagram stops at the network layer, but ZigBee also defines the layers above it. The Application Support sublayer, APS, carries data between endpoints on two devices. The ZigBee Device Object, ZDO, handles device discovery, binding and network management. Each application object sits on its own endpoint, numbered from 1 to 240, and the ZDO uses endpoint 0.

The ZigBee network layer also gives each device one of three roles. The ZigBee Coordinator starts the network and chooses its PAN ID and its channel. A ZigBee Router forwards frames for other devices and lets new devices join. A ZigBee End Device talks only to its parent, so it can sleep most of the time. With routers in place, the network can form a mesh. A frame can then reach a device far outside the range of a single hop.

Now let's come back to the arrow on the right of Figure 1. ZigBee 2007 added the ZigBee PRO feature set, and most ZigBee products today are built on it. ZigBee IP went in the other direction. It replaced the ZigBee network layer with IPv6 over 6LoWPAN, which is the left column of Figure 1. ZigBee 3.0 later merged the older application profiles into one standard on top of ZigBee PRO. The ZigBee Alliance itself is now called the Connectivity Standards Alliance.

• ZigBee and 6LoWPAN share the 802.15.4 MAC : the difference starts at the network layer.
• ZigBee adds a full stack above the MAC : NWK routes the frames, APS carries application data, and ZDO manages the device.
• Routers build the mesh : an End Device can sleep, because the Coordinator and the Routers relay frames for it.

PHY Property/Requirement

The table below summarises the radio side of ZigBee. Its values come from the three original IEEE 802.15.4 PHYs, one for each frequency band. When you read it, keep in mind that the band decides both the data rate and the number of channels.

Let's see where the 250 kbps at 2.4 GHz comes from. The O-QPSK PHY maps every 4 bits onto one symbol. Each symbol is spread into a 32-chip sequence, and the chip rate is 2 Mchip/s. This gives 62.5 ksymbol/s, and 4 bits per symbol at that rate is 250 kbps. The two BPSK PHYs use a simpler scheme. They spread each bit into a 15-chip sequence. At 300 kchip/s in the 868 MHz band this gives 20 kbps, and at 600 kchip/s in the 915 MHz band it gives 40 kbps.

The channels are numbered across all three bands. Channel 0 is at 868.3 MHz. Channels 1 to 10 sit in the 915 MHz band, at f_c = 906 + 2 (k - 1) MHz. Channels 11 to 26 sit in the 2.4 GHz band, at f_c = 2405 + 5 (k - 11) MHz. So the channel number alone tells you the band.

The 2.4 GHz band is available worldwide, so most ZigBee products use it. It is also the WiFi band. An 802.15.4 channel is 2 MHz wide, which is much narrower than a WiFi channel. The choice of channel therefore matters. Channels 15, 20, 25 and 26 fall between or above WiFi channels 1, 6 and 11, and they are the usual choice when WiFi is nearby.

The Addressing row lists two address types. Every device has a 64-bit IEEE extended address from manufacturing. When it joins a network, it also gets a 16-bit short address, and most frames use the short one to save space.

• 2.4 GHz gives the highest rate : 250 kbps comes from 4 bits per symbol and 32-chip spreading at 2 Mchip/s.
• The channel number tells the band : 0 for 868 MHz, 1 to 10 for 915 MHz, and 11 to 26 for 2.4 GHz.
• Choose the channel around WiFi : channels 15, 20, 25 and 26 avoid the WiFi channels 1, 6 and 11.

Frame Structure

ZigBee uses two different PHY out of 6 different PHYs defined in IEEE 802.15.4. The two PHYs are BPSK and O-QPSK. Refer to BPSK Frame structure and O-QPSK Frame structure of IEEE 802.15.4 page

The PHY frame is the same for both PHYs, and it is short. So let's follow one ZigBee data frame from the air to the application. Figure 2 shows how each layer places its own frame inside the payload of the layer below. The PHY and MAC rows come from IEEE 802.15.4. The NWK and APS rows are defined by ZigBee.

Figure 2. Nesting of a ZigBee data frame. Every layer adds its own header, so the application payload is much smaller than the 127 octets of the PSDU.

• PHY : the 4 octet Preamble and the 1 octet SFD let the receiver find the frame. The PHR carries the frame length, so the PSDU is at most 127 octets.
• MAC : the Frame Control field tells which addressing fields are present. The FCS is a 16-bit CRC over the MAC header and the MAC payload.
• NWK : the network header carries the 16-bit short addresses of the final source and destination. The Radius limits the number of hops the frame can take.
• APS : the endpoints, the Cluster ID and the Profile ID tell the receiver which application and which command the payload belongs to.

These headers add up quickly. Security adds even more, because a secured frame carries an auxiliary security header and a 4 octet MIC. So a single ZigBee frame usually carries well under 100 octets of application data. A larger message needs fragmentation at the APS layer.

• ZigBee reuses the 802.15.4 PHY and MAC frames : the ZigBee headers start inside the MAC payload.
• 127 octets is the whole budget : the MAC, NWK, APS and security overhead all come out of the PSDU.