BLUETOOTH LOW ENERGY

TECHNOLOGY TRAINING

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

1

Agenda High Level View

Coverage What is low energy? Optimizations? Comparisons with Bluetooth, New Models, Gateways, Application Stores morning break Physical Layer, Direct Test Mode, Link Layer, Host Controller Interface lunch break L2CAP, Security Manager, Attribute Protocol, Generic Attribute Profile, Generic Access Profile afternoon break Client / Server, State & Behavior, Remote, Proximity, Automation, Medical, Qualification

Core Spec : Controller

Core Spec : Host

Applications / Use Cases

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

2

WHAT IS LOW ENERGY? IT IS NEW TECHNOLOGY blank sheet of paper design optimized for ultra low power different to classic Bluetooth technology

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

3

NEW TECHNOLOGY? Yes efficient discovery / connection procedures very short packets asymmetric design for peripherals client server architecture No reuse existing BR radio architecture reuse existing HCI llogicall and physicall t i ti i d h i transports t reuse existing L2CAP packets
All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

4

BASIC CONCEPTS Optimize *EVERYTHING* for lowest power consumption p y from the physics to the users Why? button cells will be main power source for peripherals p p < 15 mA peak current < 1 µA average current

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

5

BASIC CONCEPTS Receiving more expensive, Transmitting cheap p possible best optimize to reduce Rx time as much p Advertising Channels – discovery / connections just use 3 channels – requires modulation index change lowest power device advertises “Peripheral”

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

6

BASIC CONCEPTS Memory is expensive y q y Memory requires silicon area – costs money Memory increases leakage current – costs battery life Reduce dynamic memory footprint for specs keep packets short – less buffer memory keep protocol simple – less state information keep services simple – one protocol / defined behavior

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

7

BASIC CONCEPTS Keep packets short p when Tx – short packets don’t need constant calibration reduces peak current during Tx when Rx – radio on for less time reduces total current usage Optimized for low power consumption

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

8

Security. Application Architecture All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 9 .BASIC CONCEPTS Peripherals are simple – very resource constrained p peripherals first optimize p p Central devices are complex – lots of memory & battery not critical to optimize here Asymmetric is good Link Layer.

BASIC CONCEPTS Design for success able to discover thousands of devices in local area unlimited number of slaves connected to a master unlimited number of masters state of the art encryption security including privacy / authentication / authorization class leading robustness. data integrity future proof All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 10 .

BASIC CONCEPTS Everything has STATE p devices expose their state these are servers Clients can use the state exposed on servers read it – get current temperature write it – increase set point temperature for room Servers can tell clients when state updates notify it – temperature up to set point All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 11 .

BASIC CONCEPTS Client Server Architecture p proven architecture for web-infrastructure Gateways allow interconnect of internet & low energy weighing scales send reports to doctor home security web site shows all windows closed assisted living for your parents allows low cost monitoring sports data immediately uploaded via cellular phone All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 12 .

BASIC CONCEPTS Modular architecture allows gradual innovation g g emerging markets well served Phase 1: Smart Meters Meters publish rates / usage to home Phase 2: Smart Appliances Appliance Power controlled from web site Phase 3: Smart Energy Brokers Automatically schedule appliances depending on costs All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 13 .

BASIC CONCEPTS Cellular phones will create billion unit market in 2 years gy go phones Dual mode BR/EDR & low energy devices g into p and computers and televisions and anything else that has classic Bluetooth now Single mode low energy devices will connect to these huge pull from market for low energy devices All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 14 .

35 +20 dBm (class 1) +4 dBm (class 2) -85 dBm 30 meters LE 40 GFSK 0. .45 to 0.COMPARISON WITH CLASSIC BLUETOOTH Feature RF Channels Modulation Modulation Index Max Tx Power Rx Sensitivity (typical) g (typical) Range ( yp ) BR/EDR 79 GFSK 0.25 to 0.55 +10 dBm -85 dBm 50 meters Notes 2 MHz spacing in LE Simple and effective Wider signal – more robust No “class” structure +10 dBm regulatory limit Pathloss = 90 dB for BR Pathloss = 95 dB for LE Modulation Index. increased power for class 2 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 15 .

DM. DH.2 s.1 kb/s 2178 1 kb/ DH1 = 18. FHS. 3-DH5 = 2. 2-DH.COMPARISON WITH CLASSIC BLUETOOTH Feature Packet Format BR/EDR 6 (BR / EDR) LE 2 (LE) Notes ID.8 s. DH5 = 8.9 s 16 Safer+ 80 µs 144 µs 305 kb/ kb/s 13. 3-DH Advertising / Data 63% shorter 67% shorter LE very short EDR much faster hf t LE less efficient for large packets LE stronger LE stronger Ack Packet Len 8 octet Packet Max Data Rate M D t R t Time to transfer 1Mbyte CRC Strength Encryption 126 µs 214 µs 2178.9 s (LE) 24 AES-128 Max Packet Size 2875 µs = 1021 octets 328 µs = 27 octets All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 16 .

25 Advertising 1.25 ms / 1.25 s 75 59 LE every packet sliding window pure star Advertising 1.5 ms / 1.25 Inquiry + Page Scan 22.COMPARISON WITH CLASSIC BLUETOOTH Feature Authentication Acknowledge Topology Discoverable Connectable Discoverable + Connectable LMP PDUs Feature Bits BR/EDR once immediate flexible Inquiry Scanning 11.25 ms / 1.25 ms / 1.25 s 14 1 Notes more secure lower power LE simpler 10x lower power 10x lower power 20x lower power 5x simpler 59x simpler All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 17 .25 s Page Scanning 11.25 1 25 ms / 1 25 s 1.25 11 25 ms / 1 25 s 1.25 s Advertising 1.

25 ms 2.COMPARISON WITH CLASSIC BLUETOOTH Feature BR/EDR LE 2.5 ms 10x i k 10 quicker no penalty for coexistence no penalty for low power All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 18 .5 ms no negotiation required uses fixed channel no negotiation required 3 ms instant instant Notes 8x quicker instant instant Connection time 20 ms (R0 Page Scan) LMP negotiation min 5 ms time ~ 50 ms L2CAP connection setup time Time to Ti t send d application data Time to AFH Time to Sniff Subrating min 5 ms ~ 50 ms 30 ms ~ 120 ms 1.

COMPARISON WITH CLASSIC BLUETOOTH Feature Protocols Supported by Host Min protocols for application 1 MB using BR 1 MB using EDR 1 MB using HS i L2CAP overhead g L2CAP configuration options L2CAP commands BR/EDR 14 3 (SDP.81 s 2.93 s 13. App Protocol) ) 8.93 13 93 s 4 octets 0 1 Notes Only ATT required for all plain text applications LE uses ATT for service discovery and apps y BR 60% faster for data EDR ~5x faster LE very slow l LE basic headers only Nothing configured in LE g g LE very simple All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 19 . L2CAP) 13. L2CAP.93 s <1 1s 4 to 12 octets 7 17 LE 3 2 (ATT.93 s 13.

15 and many proprietary radios All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 20 .4 GHz ISM Band Industrial Scientific Medical band License Free – with certain rules 2400 MHz to 2483.5 MHz Used by many other standards IEEE 802.11. IEEE 802.COMPARISON WITH CLASSIC BLUETOOTH Uses 2.

NEW CONNECTION MODELS Bluetooth BR/EDR is largely cable replacement: Headset Cables Mouse Cables Keyboard Cables Bluetooth low energy is application enabling: Accessories for smartphone apps Internet connected devices New billion unit markets All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 21 .

NEW MARKETS NEED NEW TOPOLOGIES TAM Phone accessories Smart Energy (meters & displays). Wellness. Home Automation Health. Sports & Fitness Assisted Living Animal Tagging Intelligent Transport Systems M2M (Internet connected devices) > 10 billion ~ 1 billion > 5 billion > 10 billion > 5 billion ~ 3 billion > 1 billion > 10 billion Topology P2P / Gateway Gateway Hub Gateway / Mesh P2P / Gateway Gateway P2P ? Gateway Over 90% of the next 50 billion devices may use a gateway topology All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 22 .

Internet apps communicate directly with the device – the gateway is just a tunnel. All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 23 .GATEWAYS. Bluetooth low energy supports this better than any other standard. END TO END & APPS G Internet Devices talk through gateways to web apps. They can cause specific apps to be loaded on a gateway device. Gateways are generic.

Gateways enable Internet connected devices. All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 24 . Handsets can ship with generic gateways apps The connect ANY device to its internet host Users don’t need to load any drivers or software. transparent tunnel to that destination.GATEWAYS ARE GENERIC A Gateway application has limited functionality It finds out what the device wants to connect to. It provides a secure.

DEVICES SHIP WITH A WEB ADDRESS All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 25 .

patientslikeme.com All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 26 .DEVICES SHIP WITH A WEB ADDRESS www.

THEY CONNECT TO A GENERIC GATEWAY APP All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 27 .

THEY CONNECT TO A GENERIC GATEWAY APP All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 28 .

THEY CONNECT TO A GENERIC GATEWAY APP Pedometer All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 29 .

THENCE TO THE WEB Internet All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 30 .

AND AUTOMATICALLY TRANSFER DATA The phone is just a pipe. All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 31 . running a generic application.

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 32 .AND AUTOMATICALLY TRANSFER DATA The phone is just a pipe. running a generic application.

THE APPS STORE MODEL The user paradigm has changed p g pp Smartphones are enabling a new application market Today that stops at the phone Bluetooth low energy allows it to extend to devices Operators can make revenue without the keyboard being touched. Connected devices mean many new applications low energy devices can make Apps selection easy All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 33 .

DEVICES TELL THE PHONE WHAT THEY ARE All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 34 .

DEVICES TELL THE PHONE WHAT THEY ARE All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 35 .

DEVICES TELL THE PHONE WHAT THEY ARE Pedometer P d t Acme Model XYZ Steps per Minute Total Steps Calories Used Find me an APP… All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 36 .

The user experience is significantly improved.MAKING APPS DOWNLOADS EASY A low energy device can tell a client device exactly what it can do. by having its services read. This can include the location of preferred apps for a smartphone. as choosing a compatible app is made much easier. A generic application on a handset can use this information to interrogate an Apps store to provide a list of applications that are know to work with the device. All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 37 .

TAILORING THE APPLICATION STORE CHOICE Easy to buy = More revenue Guaranteed to work = More downloads All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 38 .

MORNING BREAK return at 11:00 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 39 .

STACK ARCHITECTURE Applications Generic Access Profile Generic Attribute Profile Attribute Protocol Security Manager Apps Host H t Logical Link Control and Adaptation Protocol g p Host Controller Interface Link Layer Physical Layer Direct Test Mode Controller All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 40 .

PHYSICAL LAYER Applications Generic Access Profile Generic Attribute Profile Attribute Protocol Security Manager Apps Host H t Logical Link Control and Adaptation Protocol g p Host Controller Interface Link Layer Physical Layer Direct Test Mode Controller All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 41 .

11.4 GHz ISM Band Industrial Scientific Medical band License Free – with certain rules 2400 MHz to 2483. IEEE 802.PHYSICAL LAYER Uses 2.5 MHz Used by many other standards IEEE 802.15 and many proprietary radios All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 42 .

Frequen ncy RF 40 PHYSICAL CHANNELS f = 2402 + 2∙k MHz All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 43 2402 MH Hz 2404 MH Hz 2406 MH Hz 2408 MH Hz 2410 MH Hz 2412 MH Hz 2414 MH Hz 2416 MH Hz 2418 MH Hz 2420 MH Hz 2422 MH Hz 2424 MH Hz 2426 MH Hz 2428 MH Hz 2430 MH Hz 2432 MH Hz 2434 MH Hz 2436 MH Hz 2438 MH Hz 2440 MH Hz 2442 MH Hz 2444 MH Hz 2446 MH Hz 2448 MH Hz 2450 MH Hz 2452 MH Hz 2454 MH Hz 2456 MH Hz 2458 MH Hz 2460 MH Hz 2462 MH Hz 2464 MH Hz 2466 MH Hz 2468 MH Hz 2470 MH Hz 2472 MH Hz 2474 MH Hz 2476 MH Hz 2478 MH Hz 2480 MH Hz 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 .

05 PHY Bandwidth = 1 million bits / seconds Why GFSK? 0 1 “pulse shaping” pulse shaping Gaussian filter smoothes transitions from zero to one reduces spectral width p All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 44 .5 ± 0.MODULATION GFSK Modulation bit period product BT = 0.5 modulation index = 0.

GFSK MODULATION EXAMPLE 1 0 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 45 .

GFSK MODULATION EXAMPLE 1 0 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 46 .

WHEN TRANSMITTING A ‘0’ 0 1 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 47 .

WHEN TRANSMITTING A ‘1’ 0 1 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 48 .

1% All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 49 .POWER Minimum Output Power ( ) 0.01 mW (-20 dBm) Maximum Output Power 10 mW (10 dBm) Receiver sensitivity < -70 dBm When BER of 0 1% 0.

RANGE With Tx = 0 dBm and Rx = -70 dBm Range ~ 30m With Tx = 10 dBm and Rx = -90 dBm Range > 100m All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 50 .

5 40 channels 2 MHz channel spacing 2402 MHz to 2480 MHz Range 30m to further than 100 m All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 51 .PHYSICAL LAYER SUMMARY 2.4 GHz GFSK Modulation Index = ~0.

DIRECT TEST MODE Applications Generic Access Profile Generic Attribute Profile Attribute Protocol Security Manager Apps Host H t Logical Link Control and Adaptation Protocol g p Host Controller Interface Link Layer Physical Layer Direct Test Mode Controller All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 52 .

DIRECT TEST MODE Used to test Physical Layer y g packets by commanding a device to transmit or receive test p Used for PHY RF qualification tests Can also be used to production line tests Can run over standard HCI interface can also use specific 2 wire UART interface 2-wire All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 53 .

4 GHz) TXD RXD Upper Tester Physical Layer Lower Tester All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 54 .DIRECT TEST MODE Can use 2-wire UART interface Uses very simple commands Allows all controllers to b t t d simply All ll t ll t be tested i l Controller RXD TXD RF (2.

etc… t t 3 i UART USB SDIO t Controller HCI HCI Upper Tester Physical Layer RF (2.4 GHz) Lower Tester All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 55 . SDIO.DIRECT TEST MODE Can also use standard HCI Uses very simple HCI commands / events Can C use any transport: 3-wire. USB. UART.

starting test Command received. test ended. number of packets received LE_RECEVIER_TEST LE RECEVIER TEST LE_TEST_END _ _ LE_STATUS LE_PACKET_REPORT All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 56 . stop transmitting or .TEST SEQUENCES RF Test Command / Event LE_RESET LE_TRANSMITTER_TEST LE TRANSMITTER TEST Description Resets controller to known state Commands DUT to transmit LE Test Packets until told to stop with LE_TEST_END Commands DUT to receive LE Test Packets until told to stop with LE_TEST_END The test has ended. p g receiving. send LE_PACKET_REPORT to Tester Command received.

TRANSMITTER TEST All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 57 .

RECEIVER TEST All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 58 .

DIRECT TEST MODE SUMMARY Used to test Physical Layer RF q for qualification tests or for production line tests Works over standard HCI transport layer special 2-wire transport All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 59 .

LINK LAYER Applications Generic Access Profile Generic Attribute Profile Attribute Protocol Security Manager Apps Host H t Logical Link Control and Adaptation Protocol g p Host Controller Interface Link Layer Physical Layer Direct Test Mode Controller All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 60 .

LINK LAYER (LL) Link Layer State Machine p can have multiple state machines active in device Link Layer Channels Advertising Channels & Data Channels Advertising Packets & Data Packets Link Layer Control Procedures All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 61 .

LINK LAYER STATE MACHINE Scanning Advertising Standby Initiating Slave Connection Master All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 62 .

LINK LAYER STATE MACHINE Scanning Scanning Advertising Standby Initiating Advertising Standby Initiating Slave Connection C ti Master Slave Connection Master Scanning Scanning Advertising Standby Initiating Advertising Standby Initiating Slave Connection Master Slave Connection Master All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 63 .

LINK LAYER STATE MACHINE Scanning Scanning Advertising Standby Initiating Advertising Standby Initiating Slave Connection C ti Master Slave Connection Master Scanning Scanning Advertising Standby Initiating Advertising Standby Initiating Slave Connection Master Slave Connection Master All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 64 .

TWO TYPES OF CHANNELS Advertising Channels Advertising Channel Packets g Used for Discoverability / Connectability Used for Broadcasting / Observing Data Channels Data Channel Packets Used to send application data in Connection All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 65 .

Frequen ncy LL LINK LAYER CHANNELS 3 Advertising Channels and 37 Data Channels All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 66 2402 MH Hz 2404 MH Hz 2406 MH Hz 2408 MH Hz 2410 MH Hz 2412 MH Hz 2414 MH Hz 2416 MH Hz 2418 MH Hz 2420 MH Hz 2422 MH Hz 2424 MH Hz 2426 MH Hz 2428 MH Hz 2430 MH Hz 2432 MH Hz 2434 MH Hz 2436 MH Hz 2438 MH Hz 2440 MH Hz 2442 MH Hz 2444 MH Hz 2446 MH Hz 2448 MH Hz 2450 MH Hz 2452 MH Hz 2454 MH Hz 2456 MH Hz 2458 MH Hz 2460 MH Hz 2462 MH Hz 2464 MH Hz 2466 MH Hz 2468 MH Hz 2470 MH Hz 2472 MH Hz 2474 MH Hz 2476 MH Hz 2478 MH Hz 2480 MH Hz 37 0 1 2 3 4 5 6 7 8 9 10 38 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 39 .

Frequen ncy LL LINK LAYER CHANNELS 3 Advertising Channels All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 67 2402 MH Hz 2404 MH Hz 2406 MH Hz 2408 MH Hz 2410 MH Hz 2412 MH Hz 2414 MH Hz 2416 MH Hz 2418 MH Hz 2420 MH Hz 2422 MH Hz 2424 MH Hz 2426 MH Hz 2428 MH Hz 2430 MH Hz 2432 MH Hz 2434 MH Hz 2436 MH Hz 2438 MH Hz 2440 MH Hz 2442 MH Hz 2444 MH Hz 2446 MH Hz 2448 MH Hz 2450 MH Hz 2452 MH Hz 2454 MH Hz 2456 MH Hz 2458 MH Hz 2460 MH Hz 2462 MH Hz 2464 MH Hz 2466 MH Hz 2468 MH Hz 2470 MH Hz 2472 MH Hz 2474 MH Hz 2476 MH Hz 2478 MH Hz 2480 MH Hz 37 0 1 2 3 4 5 6 7 8 9 10 38 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 39 .

Frequen ncy LL LINK LAYER CHANNELS 37 Data Channels All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 68 2402 MH Hz 2404 MH Hz 2406 MH Hz 2408 MH Hz 2410 MH Hz 2412 MH Hz 2414 MH Hz 2416 MH Hz 2418 MH Hz 2420 MH Hz 2422 MH Hz 2424 MH Hz 2426 MH Hz 2428 MH Hz 2430 MH Hz 2432 MH Hz 2434 MH Hz 2436 MH Hz 2438 MH Hz 2440 MH Hz 2442 MH Hz 2444 MH Hz 2446 MH Hz 2448 MH Hz 2450 MH Hz 2452 MH Hz 2454 MH Hz 2456 MH Hz 2458 MH Hz 2460 MH Hz 2462 MH Hz 2464 MH Hz 2466 MH Hz 2468 MH Hz 2470 MH Hz 2472 MH Hz 2474 MH Hz 2476 MH Hz 2478 MH Hz 2480 MH Hz 37 0 1 2 3 4 5 6 7 8 9 10 38 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 39 .

Frequen ncy LL LINK LAYER CHANNELS 3 Advertising Channels and 37 Data Channels All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 69 2402 MH Hz 2404 MH Hz 2406 MH Hz 2408 MH Hz 2410 MH Hz 2412 MH Hz 2414 MH Hz 2416 MH Hz 2418 MH Hz 2420 MH Hz 2422 MH Hz 2424 MH Hz 2426 MH Hz 2428 MH Hz 2430 MH Hz 2432 MH Hz 2434 MH Hz 2436 MH Hz 2438 MH Hz 2440 MH Hz 2442 MH Hz 2444 MH Hz 2446 MH Hz 2448 MH Hz 2450 MH Hz 2452 MH Hz 2454 MH Hz 2456 MH Hz 2458 MH Hz 2460 MH Hz 2462 MH Hz 2464 MH Hz 2466 MH Hz 2468 MH Hz 2470 MH Hz 2472 MH Hz 2474 MH Hz 2476 MH Hz 2478 MH Hz 2480 MH Hz 37 0 1 2 3 4 5 6 7 8 9 10 38 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 39 .

6 Wi-Fi Ch Wi Fi Ch. 11 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 70 2402 MH Hz 2404 MH Hz 2406 MH Hz 2408 MH Hz 2410 MH Hz 2412 MH Hz 2414 MH Hz 2416 MH Hz 2418 MH Hz 2420 MH Hz 2422 MH Hz 2424 MH Hz 2426 MH Hz 2428 MH Hz 2430 MH Hz 2432 MH Hz 2434 MH Hz 2436 MH Hz 2438 MH Hz 2440 MH Hz 2442 MH Hz 2444 MH Hz 2446 MH Hz 2448 MH Hz 2450 MH Hz 2452 MH Hz 2454 MH Hz 2456 MH Hz 2458 MH Hz 2460 MH Hz 2462 MH Hz 2464 MH Hz 2466 MH Hz 2468 MH Hz 2470 MH Hz 2472 MH Hz 2474 MH Hz 2476 MH Hz 2478 MH Hz 2480 MH Hz 37 0 1 2 3 4 5 6 7 8 9 10 38 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 39 .Frequen ncy LL LINK LAYER CHANNELS Wi-Fi Ch Wi Fi Ch. 1 9 LL Data Channels still available Wi-Fi Ch Wi Fi Ch.

ONE PACKET FORMAT Not Whitened Whitened Preamble e Access Address PDU CRC Protected by CRC All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 71 .

BIT STREAM PROCESSING

Tx payload

encryption

CRC generation

whitening

RF interface

Rx payload

decryption

CRC checking

dewhitening

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

72

WHITENING Avoids long sequences of ‘0’s or ‘1’s Uses same 7 bit LFSR as BR/EDR LFSR defined as: x7+x4+x0 x x initialized with LL Channel Index
x0 0 1 2 3 x4 + 4 5 6 x7 + Data in (LSB first) Data out

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

73

PREAMBLE

Preamble

Access Address

PDU

CRC

0 1

1 0

0 1

1 0

0 1

1 0

0 1

1 0

0 1

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

74

ACCESS ADDRESS

Preamble

Access Address

PDU

CRC

Access Address (32 bits) Advertising Packets = 0x8E89BED6 Data Packets = random value per connection

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

75

CRC

Preamble

Access Address

PDU

CRC

Protected by P t t d b CRC

Cyclic Redundancy Check (24 bits) x24+x10+x9+x6+x4+x3+x1+x0 Detects all 1,2,3,4,5,odd bit errors in PDU
All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 76

ADVERTISING PACKET
Advertising Header H Payload Le ength

Advertisi ing Access Add dress

Preamble

AdvA Advertiser Address CRC

0 to 31 bytes of Advertising data
Advertisin Header ng Payload Length d Adver rtising Access Address Prea amble AdvA Advertiser Address Advertising Data CR RC
All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 77

PDU HEADERS
PDU

Access Address

Pa ayload Length h

Preamble

Header

Payload

CRC

Advertising channel PDU Header / Payload Length PDU Type Length (6 – 37) RFU TxAdd RxAdd RFU

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

78

ADVERTISING PACKET PDU TYPES

PDU Type 0000 0001 0010 0011 0100 0101 0110

Packet Name ADV_IND ADV_DIRECT_IND ADV DIRECT IND ADV_NONCONN_IND SCAN_REQ SCAN_RSP SCAN RSP CONNECT_REQ ADV_DISCOVER_IND

Description connectable undirected advertising event connectable directed advertising event non-connectable undirected advertising event Scanner wants information from Advertiser Advertiser i Ad ti gives more iinformation t S f ti to Scanner Initiator wants to connect to Advertiser non-connectable undirected advertising event

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

79

DEVICE ADDRESS Public Device Address 48 bit bits company_assigned (24 bits) company_id (24 bits) TxAdd RxAdd 0 Random Device Address 48 bits random (48 bits) TxAdd RxAdd 1 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 80 .

STANDBY
Scanning

Advertising

Standby

Initiating

Slave

Connection

Master

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

81

ADVERTISING Passive Scanner
Scanning

Advertiser
Scanning

Advertising

Standby

Initiating

Advertising

Standby

Initiating

Slave

Connection

Master

Slave

Connection

Master

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

82

PASSIVE SCANNING

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

83

ADVERTISING DATA
Advertising Header H Payload Le ength

Advertisi ing Access Add dress

Preamble

AdvA Advertiser Address Advertising Data CRC
All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

Advertising Data Im discoverable” “I’m generally discoverable , transmitting at +4 dBm, the t th temperature is 20.5 C t i 20 5 C, I support Battery and Temperature services

84

ADVERTISING DATA
16 bit Service UUIDs = «Temperature Service», S «Battery Ser rvice» Service Data D «Temperature Service» S = 20.5 C Advertising Header H Payload Le ength Flags= ‘LE General G Discoverable Flag’ e TX Power Le = evel 4 dBm m

Advertisi ing Access Add dress

Preamble

AdvA Advertiser Address

LE General Discoverable Tx P T Power Levell = 4 dBm L dB Service Data «Temperature Service» = 20.5 C Services Supports = «Temperature Service», «Battery Service»
All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

CRC

85

ADVERTISING DATA
«Temperature Service» Length = 0x05 0 Type = 0x x02 «Temperature Service» Advertising Header H Payload Le ength «Battery Ser rvice»

Advertisi ing Access Add dress

Preamble

AdvA Advertiser Address

Length = 0x02 0 Type = 0x x01 0x02 Length = 0x02 0 Type = 0x x0A 0x04 Length = 0x05 0 Type = 0x x16

Length, Type, Data formatted Length = length of (Type | Data) Type = assigned number defined in GAP Data = typed data defined by GAP or Service
All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 86

CRC

20.5

ACTIVE SCANNING Active Scanner
Scanning

Discoverable Advertising
Scanning

Advertising

Standby

Initiating

Advertising

Standby

Initiating

Slave

Connection

Master

Slave

Connection

Master

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

87

ACTIVE SCANNING

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

88

SCAN_REQ Advertising Header H Payload Length Advertising dress Access Add Preambl le ScanA Scanner Address AdvA Advertiser Address CRC Sent from scanner to advertiser to ask for additional data All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 89 .

SCAN_RSP Advertising Header H Payload Length Advertising dress Access Add Preambl le AdvA Advertiser Address Advertising Data CRC All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential Scan Response Data Device name is “Outside Thermostat” I support Battery and Temperature services 90 .

SCAN_RSP 16 bit Service UUIDs = U «Temperature Service». «Battery Service» All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential CRC 91 . S «Battery Ser rvice» Advertising Header H Payload Length Advertising dress Access Add Preambl le AdvA Advertiser Address Complete Local Name = “Outside Thermostat” Complete Local Name = “Outside Thermostat Outside Thermostat” Services Supports = «Temperature Service».

Type. Data formatted Length = length of ( yp | Data) g g (Type ) Type = assigned number defined in GAP yp y Data = typed data defined by GAP or Service All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 92 CRC .SCAN_RSP «Temperature Service» S Advertising Header H Payload Length «Battery Ser rvice» Advertising dress Access Add Length = 0x0B x09 Type = 0x Preambl le AdvA Advertiser Address Length = 0x05 0 Type = 0x x02 “Outside Thermostat” Length.

INITIATING CONNECTIONS Initiator Scanning Connectable Advertiser Scanning Advertising Standby Initiating Advertising Standby Initiating Slave Connection Master Slave Connection Master All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 93 .

INITIATING CONNECTIONS All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 94 .

Latency. including: link Access Address. Timeout. WinOffset. Interval Latency Timeout Channel Map Hop Interval Map. Connection Interval. Interval.CONNECT_REQ Advertising Header H Payload Le ength Advertisi ing Access Add dress Access Add dress Hop / SC CA WinOffs set Preamble Timeou ut WinSize e Latency y CRCIni it Interva al InitA Initiator Address AdvA Advertiser Address Channel Map M Sent from Initiator to Advertiser Contains all information for link. Sleep Clock Accuracy All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential CRC 95 . CRCInit. WinSize.

DIRECTED CONNECTIONS All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 96 .

TIME FROM DISCONNECTED TO DATA ~ 3MS (RADIO ACTIVE ~ 1MS) Time (us) 0 326 1928 2158 2452 2682 2928 ADV_DIRECT_IND Master Tx Radio Active (us) 176 352 80 144 Slave Tx ADV_DIRECT_IND CONNECT_REQ Empty Packet Attribute Protocol Handle Value Indication LL_TERMINATE_IND Empty Packet Empty Packet LL_TERMINATE_IND ATT HVI Empty Packet (Acknowledgement) Empty Packet (Acknowledgement) CONNECT_REQ 80 96 80 Empty Packet ~ 3 ms All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 97 .

DIRECTED ADVERTISING Advertising He eader Payload Length Advertising ress Access Addr Preamble e AdvA Advertiser Address InitA Initiator Address CRC Sent from Advertiser to Initiator says “I want you t connect t me” t to t to ” All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 98 .

WHITE LISTS Because advertising channels will be “busy” y sometimes useful to filter out devices you don’t care about White List set of devices in advertising packets that will be processed consist of an array of device addresses of a known size All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 99 .

WHITE LISTS AND LINK LAYER STATES Scanning Advertising Standby Initiating Slave Connection Master All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 100 .

This is the default on reset • The Link Layer shall process scan requests from all devices and shall only process connection requests from devices that are in the White List • The Link Layer shall process connection requests from all devices and shall only process scan requests from devices that are in the White List All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 101 .ADVERTISING FILTER POLICY Determines how controller will process scan and/or connection requests when as advertiser • The Link Layer shall process scan and connection requests only from devices in the White List • The Link Layer shall process scan and connection requests from all devices (i.e. the White List is not in use).

SCANNER FILTER POLICY Determines how controller will process advertising packets when scanning: • The Link Layer shall process advertising packets only from devices in the White List • The Link Layer shall process all advertising packets (i.. the White List is not used). This is the default on reset used) All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 102 .e.

INITIATOR FILTER POLICY Determines how controller will process advertising packets when initiating: • The Link Layer shall process connectable advertising packets from all devices in the White List • The Link Layer shall ignore the White List and process connectable advertising packets from a specific single device specified by the Host All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 103 .

WHITE LISTS No need to send every advertising packet to Host y only send information from devices in white list Allows “connect to white list” semantics connect list a master can automatically connect to a set of devices will connect when sees adverts from these devices allows very fast connections from many devices All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 104 .

INITIATING CONNECTIONS Initiator Scanning Connectable Advertiser Scanning Advertising Standby Initiating Advertising Standby Initiating Slave Connection Master Slave Connection Master All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 105 .

CONNECTIONS Master Scanning Slave Scanning Advertising Standby Initiating Advertising Standby Initiating Slave Connection Master Slave Connection Master All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 106 .

TOPOLOGY AdvertAdvert iser Slave Slave Scanner Master/ Scanner Slave Advertiser Slave Advertiser All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 107 .

TOPOLOGY AdvertAdvert iser Slave Slave Scanner Master/ Initiator Slave Advertiser Slave Advertiser All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 108 .

TOPOLOGY AdvertAdvert iser Slave Slave Scanner Master/ Scanner Slave Advertiser Slave Slave All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 109 .

LIMITS A single master can address ~231 slaves p ~ 2 billion addressable slaves per master Max Connection Interval = 4.0 seconds Can address a slave every ~ 5 ms (assuming 250 ppm clocks) ~ 800 active slaves per master All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 110 .

robustly Includes ultra low power connection mode adaptive frequency hopping connection supervision timeout All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 111 .CONNECTIONS Used to send application data y. y reliably.

DATA PACKET Access Add dress Data Hea ader Payload Le ength Preamble 0 to 27 bytes of Payload Access Address Data Header H Payload Length d L2CAP Length L2CA CID AP CRC Empty Packet Payload Prea amble All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential CR RC 112 .

DATA PACKET 0 to 27 bytes of Payload (unencrypted) CRC protects Data Header Payload Length Payload Payload Access Address Data Header H Payload Length d L2CAP Length L2CA CID AP Prea amble All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential CR RC 113 .

protects it MIC is part of “Payload”.ENCRYPTED DATA PACKET 4 to 31 bytes of payload length p y . CRC p MIC can be computed / checked in background Payload Access Address Data Header H Payload Length d L2CAP Length L2CA CID AP Prea amble All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential RC CR MIC 114 .

PDU HEADERS PDU Access Address Pa ayload Length h Preamble Header Payload CRC Data channel PDU Header / Payload Length LLID NESN Length (0 – 31) SN MD RFU RFU All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 115 .

LOGICAL LINK IDENTIFIER LLID 00 01 Description Reserved LL Data PDU Continuation of an L2CAP message or an Empty PDU LL Data PDU Start of an L2CAP message Complete L2CAP message C l t LL Control PDU 10 11 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 116 .

SEQUENCE NUMBERS SN = Sequence Number p q NESN = Next Expected Sequence Number Sliding Window Algorithm window size of 1 lazy acknowledgement possible – saves power All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 117 .

SN TX new data. SN Rx new data Ignore RX data All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 118 .TRANSMITTING DATA transmit packet received packet SN = NESN? same (nack) different (ack) SN = NESN? different (old data) same (new data) Inc SN Inc NESN TX old data.

CONNECTION EVENTS Masters transmits periodically at a connection events Q Connection Interval sent in CONNECT_REQ Connection events continue until MD = 0 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 119 .

CONNECTION EVENTS Each connection event uses a different channel ( p) fn+1 = (fn + hop) mod 37 fn fn+1 fn+2 fn+3 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 120 .

LATENCY Master Latency how often the master will transmit to slave Slave Latency how often the slave will listen to master The two latencies don’t have to be the same Master Latency = Connection Interval (7.0 Slave Latency = Connection Interval * Slave Latency All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 121 .5 ms to 4 0 s) (7 5 4.

Master has no more data. Slave has data no more data. Sl ti Slave should li t h ld listen.MORE DATA Master MD = 0 Neither device has more data to send. MD = 0 Connection event closed MD = 1 Master has more data. listen All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 122 . Slave should Master M t may continue. listen Both devices have more data. Sllave MD = 1 Slave has more data. Master may continue. Slave should y . Master may continue.

CONNECTION EVENTS More Data bit automatically extends connection events All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 123 .

PACKET TIMINGS Peer device transmits 150 μs after last packet Minimum size packet = 80 μs (Preamble + Access Address + Header + CRC) Maximum size packet = 328 μs (Preamble + Access Address + Header + Payload + MIC + CRC) Tx Rx Tx Rx Tx Rx Tx Rx T All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 124 .

MAXIMUM DATA RATE Asymmetric Tx/Rx Packet Sequence μ 328 + 150 + 80 + 150 = 708 μs Transmitting 27 octets of application data ~305 kbps Tx Rx Tx Rx Tx Rx Tx Rx T All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 125 .

use as is used If fn is an “unused” channel. 11 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 126 . 6 Wi-Fi Ch Wi Fi Ch. 1 Wi-Fi Ch Wi Fi Ch.ADAPTIVE FREQUENCY HOPPING Frequency Hopping algorithm is very simple ( p) fn+1 = (fn + hop) mod 37 If fn is a “used” channel. remap to set of good channels Wi-Fi Ch Wi Fi Ch.

10. 22. fn+1 = fn + 7 mod 37 = 7 mod 37 → 7 0 mod 9 → 0. 23. 1 Wi-Fi Ch Wi Fi Ch. 34. 11 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 127 . 36] . used[0] → 9 Wi-Fi Ch Wi Fi Ch.ADAPTIVE FREQUENCY HOPPING fn = 0. 21. 6 Wi-Fi Ch Wi Fi Ch. hop = 7. 35. “unused”. 33. used = [9.

23. hop = 7. 33. 35. 10. fn+1 = fn + 7 mod 37 = 14 mod 37 → 14 7 mod 9 → 7. 6 Wi-Fi Ch Wi Fi Ch. 21. used = [9. “unused”. 34. 11 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 128 . 1 Wi-Fi Ch Wi Fi Ch. used[7] → 35 Wi-Fi Ch Wi Fi Ch. 36] . 22.ADAPTIVE FREQUENCY HOPPING fn = 7.

34. used[5] → 33 Wi-Fi Ch Wi Fi Ch. hop = 7. 33. 10. fn+1 = fn + 7 mod 37 = 21 mod 37 → 21 14 mod 9 → 5. 22. 21. 6 Wi-Fi Ch Wi Fi Ch. used = [9. “unused”. 35. 1 Wi-Fi Ch Wi Fi Ch. 11 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 129 .ADAPTIVE FREQUENCY HOPPING fn = 14. 36] . 23.

36] . 33. 21. 11 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 130 . 35. 10. 6 Wi-Fi Ch Wi Fi Ch. used = [9. 1 Wi-Fi Ch Wi Fi Ch.ADAPTIVE FREQUENCY HOPPING fn = 21. 22. hop = 7. “used”. 23. fn+1 = fn + 7 mod 37 = 28 mod 37 → 28 Wi-Fi Ch Wi Fi Ch. 34.

hop = 7. 33. “unused”. 21. 6 Wi-Fi Ch Wi Fi Ch. 35.ADAPTIVE FREQUENCY HOPPING fn = 28. used = [9. 11 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 131 . 10. used[1] → 10 Wi-Fi Ch Wi Fi Ch. 34. fn+1 = fn + 7 mod 37 = 35 mod 37 → 35 28 mod 9 → 1. 23. 36] . 1 Wi-Fi Ch Wi Fi Ch. 22.

fn+1 = fn + 7 mod 37 = 42 mod 37 → 5 Wi-Fi Ch Wi Fi Ch. hop = 7. “used”. 36] . 6 Wi-Fi Ch Wi Fi Ch. used = [9. 11 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 132 . 21. 1 Wi-Fi Ch Wi Fi Ch.ADAPTIVE FREQUENCY HOPPING fn = 35. 34. 33. 23. 35. 22. 10.

“unused”. 21. used[5] → 33 Wi-Fi Ch Wi Fi Ch. 36] . fn+1 = fn + 7 mod 37 = 12 mod 37 → 12 5 mod 9 → 5. 34.ADAPTIVE FREQUENCY HOPPING fn = 5. 22. 11 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 133 . used = [9. 6 Wi-Fi Ch Wi Fi Ch. 10. 33. hop = 7. 35. 23. 1 Wi-Fi Ch Wi Fi Ch.

35. used = [9. 10. hop = 7. fn+1 = fn + 7 mod 37 = 19 mod 37 → 19 12 mod 9 → 3. 34. 36] .ADAPTIVE FREQUENCY HOPPING fn = 12. 6 Wi-Fi Ch Wi Fi Ch. 11 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 134 . used[3] → 22 Wi-Fi Ch Wi Fi Ch. “unused”. 22. 23. 1 Wi-Fi Ch Wi Fi Ch. 33. 21.

10. used[1] → 10 Wi-Fi Ch Wi Fi Ch. 21.ADAPTIVE FREQUENCY HOPPING fn = 19. hop = 7. 34. “unused”. 11 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 135 . 33. 6 Wi-Fi Ch Wi Fi Ch. 36] . 1 Wi-Fi Ch Wi Fi Ch. fn+1 = fn + 7 mod 37 = 26 mod 37 → 26 19 mod 9 → 1. 22. 35. used = [9. 23.

10. used[8] → 36 Wi-Fi Ch Wi Fi Ch. 6 Wi-Fi Ch Wi Fi Ch.ADAPTIVE FREQUENCY HOPPING fn = 26. used = [9. 21. “unused”. 1 Wi-Fi Ch Wi Fi Ch. 22. 34. 11 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 136 . fn+1 = fn + 7 mod 37 = 33 mod 37 → 33 26 mod 9 → 8. 23. hop = 7. 36] . 33. 35.

used = [9. hop = 7. 22. 34. 1 Wi-Fi Ch Wi Fi Ch.ADAPTIVE FREQUENCY HOPPING fn = 33. 36] . 11 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 137 . 10. 33. fn+1 = fn + 7 mod 37 = 40 mod 37 → 3 Wi-Fi Ch Wi Fi Ch. 6 Wi-Fi Ch Wi Fi Ch. 21. 35. “used”. 23.

10. 35.ADAPTIVE FREQUENCY HOPPING fn = 3. fn+1 = fn + 7 mod 37 = 10 mod 37 → 10 3 mod 9 → 3. 34. 33. 36] . used[3] → 22 Wi-Fi Ch Wi Fi Ch. “unused”. 23. 1 Wi-Fi Ch Wi Fi Ch. 11 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 138 . 22. used = [9. hop = 7. 6 Wi-Fi Ch Wi Fi Ch. 21.

11 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 139 . used = [9. 6 Wi-Fi Ch Wi Fi Ch. 34. 21. 23. fn+1 = fn + 7 mod 37 = 17 mod 37 → 17 Wi-Fi Ch Wi Fi Ch. 10. hop = 7.ADAPTIVE FREQUENCY HOPPING fn = 10. 22. 35. 36] . “used”. 33. 1 Wi-Fi Ch Wi Fi Ch.

Pretty Patterns All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 140 .

Pretty Patterns Wi-Fi Ch Wi Fi Ch. 1 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 141 .

Pretty Patterns Wi-Fi Ch Wi Fi Ch. 6 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 142 .

11 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 143 .Pretty Patterns Wi-Fi Ch Wi Fi Ch.

11 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 144 .Pretty Patterns Wi-Fi Ch Wi Fi Ch. 1 Wi-Fi Ch Wi Fi Ch.

1 Wi-Fi Ch Wi Fi Ch.Pretty Patterns Wi-Fi Ch Wi Fi Ch. 6 Wi-Fi Ch Wi Fi Ch. 11 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 145 .

LINK LAYER CONTROL PROCEDURES LLID = 11 Most procedures can only be initiated from Master except Termination Procedure except Version Exchange All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 146 .

to change Long Term Key Exchange the current supported feature set Exchange the current version information Voluntary terminate the connection All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 147 .LINK LAYER CONTROL PROCEDURES Name N Connection Update Procedure p p Channel Map Update Procedure Encryption Start Procedure Encryption Pause Procedure Feature Exchange Procedure Version Exchange Procedure Termination Procedure Description D i i Update the connection intervals Update the adaptive frequency hopping map p p q y pp g p Start encryption using a Long Term Key Pause encryption.

Opcode 0x00 0X01 0X02 0X03 0X04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D Control PDU Name LL_CHANNEL_MAP_REQ LL_TERMINATE_IND LL_ENC_REQ LL ENC REQ LL_ENC_REQ LL_START_ENC_REQ LL_START_ENC_RSP LL_UNKNOWN_RSP LL_FEATURE_REQ LL_FEATURE_RSP LL_PAUSE_ENC_REQ LL_PAUSE_ENC_RSP LL PAUSE ENC RSP LL_VERSION_IND LL_REJECT_IND Description Update Channel Maps Disconnect the connection Encryption Request Encryption Response 3-way Handshake for Starting Encryption 3-way Handshake for Starting Encryption Control PDU Unknown Master sends Features to Slave Slave sends Features to Master Pause Encryption to Refresh Keys Pause Encryption to Refresh Keys Version Exchange Reject Control PDU LL_CONNECTION_UPDATE_REQ Update Connection Intervals All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 148 .

CONNECTION UPDATE All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 149 .

CHANNEL MAP UPDATE All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 150 .

START ENCRYPTION All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 151 .

RESTART ENCRYPTION All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 152 .

FEATURE EXCHANGE All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 153 .

VERSION EXCHANGE All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 154 .

VERSION EXCHANGE All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 155 .

TERMINATE All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 156 .

TERMINATE All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 157 .

LINK LAYER ENCRYPTION Uses AES 128 encryption block Counter Mode Cipher Block Chaining Message Authentication Code All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 158 .

LINK LAYER ENCRYPTION Uses AES 128 encryption block Counter Mode CBC MAC All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 159 .

LINK LAYER ENCRYPTION Uses AES 128 encryption block y and CCM as defined by RFC 3610 Payload0 15 encrypted 0-15 with Block A1 Payload16 27 encrypted 16-27 with Block A2 MAC encrypted with Block A0 Acc cess Address D Data Header Pay yload Length L2C Length CAP L L2CAP CID P Preamble All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential CRC MIC 160 .

1 FS = Form State KE = Key Expansion AR = Add Round Key SB = Substitute Bytes SR = Shift Rows MC = Mix Columns GO = Get Output SB SR MC AR SB SR MC GO Cipher Text K0 Key KE (Nr + 1) Keys Ki KNr All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 161 .AES ENCRYPTION Plain Text FS AR Repeat Nr .

AES BLOCK Plain Text Key AES 128 Cipher Text All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 162 .

CIPHER BLOCK CHAINING MESSAGE AUTHENTICATION CODE Nonce Payload0-15 Payload16-27 + Key AES 128 Key AES 128 Key + AES 128 MAC Nonce Packet Cou te ac et Counter (39 bits) Directio Bit on Initialization Vector t a at o ecto (64 bits) All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 163 .

AES CCM ENCRYPTION Block A1 Key AES 128 Key Block A2 AES 128 Key Block A0 AES 128 Payload0-15 + Cipher0-15 Payload16-27 + Cipher16-27 MAC + MIC All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 164 .

Block A1 AES 128 (Key) Block A2 AES 128 (Key) Payload0-15 + Cipher0-15 Payload16-27 + Cipher16-26 Nonce + AES 128 (Key) AES 128 (Key) + AES 128 (Key) MAC AES 128 (Key) Block A0 + MIC P AA H L Cipher0-15 Cipher16-26 MIC CRC All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 165 .

5 Terabytes of data per connection 12 ~12 years at maximum data rate Then you have to change the encryption key using Restart Encryption Procedure All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 166 .LIMITS Maximum 239 packets per LTK per direction p p Each packet can contain up to 27 octets data Max 13.

LINK LAYER SUMMARY Low Complexity • • • • 1 packet format 2 PDU types – depending on Advertising / Data Channel 7 Advertising PDU Types 7 Link Layer Control Procedures Useful Features • Adaptive Frequency Hopping • L P Low Power Acknowledgement A k l d t • Very Fast Connections All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 167 .

HOST CONTROLLER INTERFACE Applications Generic Access Profile Generic Attribute Profile Attribute Protocol Security Manager Apps Host H t Logical Link Control and Adaptation Protocol g p Host Controller Interface Link Layer Physical Layer Direct Test Mode Controller All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 168 .

HOST CONTROLLER INTERFACE (HCI) Transport Layer UART USB SD 3-wire UART Functional Layer Commands / Events / Data All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 169 .

COMMANDS / EVENTS / COMMANDS Four HCI Packet Types HCI Command Packet HCI ACL Data Packet HCI Synchronous Data Packet (not used in LE) HCI Event Packet Transports describe how to send these HCI Packet Types All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 170 .

UART HCI TRANSPORT LAYER Each packet type assigned a HCI packet indicator . Event = 0x04 Send HCI packet indicator. Command = 0x01. Data = 0x02. . and then HCI packet 0x01 0x02 0x04 HCI Command Packet HCI ACL Data Packet HCI Event Packet All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 171 .

UART HCI TRANSPORT LAYER RS232 Settings p Baud rate : manufacturer specific Data bits : 8 Parity : none Stop bits : 1 Flow Control : RTS / CTS Flow-off response time : manufacturer specific Configured as null modem null-modem All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 172 .

USB HCI TRANSPORT LAYER Defines one endpoint for ACL Data Packets p (out) ( ) Endpoint ( ) 0x02 / (in) 0x82 suggested max packet size is 32 or 64 Uses Control Endpoint for Commands Uses Interrupt Endpoint for Events Endpoint (in) 0x81 1 ms interval All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 173 .

SECURE DIGITAL HCI TRANSPORT LAYER Uses SDIO to transport HCI packets yp p references SDIO Card Type-A Specification Uses same codes as UART for SDIO Type-A service ID Type A 0x01 = Command. 0x04 = Event All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 174 . 0x02 = Data.

software flow control All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 175 .3-WIRE UART HCI TRANSPORT LAYER Places all HCI Packets on top of a SLIP layer RFC 1055 Adds framing to detect bit errors on UART allows use of long UART wires on product ideal for use when lots of interference in UART cables Can support automatic UART Baud rate detection scheme has support for low power.

HCI FUNCTIONAL LAYER Reuses existing HCI commands / events / data packets p except where LE is different All LE specific HCI commands have LE in name All LE specific HCI events have LE in name All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 176 .

HCI BUFFERS Dual mode controllers can either: Expose one set of HCI buffers Shared between BR/EDR and LE OR Expose two sets of HCI buffers One set for BR/EDR and one set for LE All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 177 .

RANDOM DEVICE ADDRESSES LE Rand g asks controller to generate a random number very good random number using non-linear algorithms LE Encrypt asks controller to encrypt some plain text with key LE Set Random Address sets the random address used by controller All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 178 .

WHITE LISTS LE Read Write List Size gets the size of the controllers white list LE Clear White List removes all devices from white list LE Add Device To White List adds a single d i t th white li t dd i l device to the hit list LE Remove Device From White List removes a single device from the white list All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 179 .

turn on and off advertising All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 180 . filter policy LE Read Advertising Channel Tx Power allows filling in the Advertising Data for Tx Power LE Set Advertising Data . address to use. channel map. advertising event type.defines the data to be broadcast LE Set Scan Response Data .ADVERTISING LE Set Advertising Parameters sets timing.defines the data contained in scan responses LE Set Advertising Enable .

p y. yp . filter policy.SCANNING LE Set Scan Parameters g. scan type LE Set Scan Enable turn on/off scanning LE Advertising Report we found something interesting All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 181 . address type. yp sets timing.

filter policy. connection interval. supervision timeout. expected length of communication events LE Create Connection Cancel stop trying to create a connection LE Connection Complete a connection was created (or cancelled. connect to white list. address type. or timed out) All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 182 . target address.INITIATING LE Create Connection set timing.

expected length of communication events p g LE Connection Update Complete p p connect update has succeeded All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 183 . supervision timeout.CONNECTION MANAGEMENT LE Connection Update p g parameters update connection event timing p connection interval. slave latency.

AFH CHANNEL MAP MANAGEMENT LE Set Host Channel Classification g which LE data channels are “good / bad” controller still determines if channels are “used / unused” LE Read Channel Map read the current LE channel map for a connection All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 184 .

INFORMATIONAL EXCHANGES LE Read Local Supported Features pp reads what LE features a controller supports LE Read Remote Used Features requests what a remote device supports LE Read Remote Used Features Complete report on what the remote device supports All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 185 .

STARTING ENCRYPTION LE Start Encryption q yp request that encryption is started on a connection requires random numbers & LTK LE Long Term Key Request Controller needs an LTK from Host to start encryption LE Long Term Key Request Reply Host gives LTK to Controller for encyption All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 186 .

LUNCH return at 13:30 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 187 .

L2CAP Applications Generic Access Profile Generic Attribute Profile Attribute Protocol Security Manager Apps Host H t Logical Link Control and Adaptation Protocol g p Host Controller Interface Link Layer Physical Layer Direct Test Mode Controller All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 188 .

L2CAP Logical Link Control and Adaptation Protocol g p protocol multiplexer segmentation and reassembly Provides logical channels multiplexed over one or more logical links All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 189 .

L2CAP PACKETS All application data is sent using L2CAP packets g g y Length is the length of the L2CAP Information Payload CID is the destination logical channel CIDs can be either fixed channels connection oriented channels (not used in LE) Length CID Information Payload All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 190 .

FIXED L2CAP CHANNELS CIDs from 0x0001 to 0x003F are fixed channels y y 0x0040 to 0xFFFF are dynamically allocated CID 0x0000 0x0001 0x0002 0x0003 0x0004 0x0005 0x0006 Description Null identifier L2CAP Signaling Channel Connectionless Channel AMP Manager Protocol Attribute Protocol LE L2CAP Signaling Channel Security Manager Protocol Notes Not used (ever) Used over BR/EDR Used over BR/EDR Used over BR/EDR Used over LE only Used over LE only Used over LE only All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 191 .

LE L2CAP SIGNALING PROTOCOL Identical to L2CAP Signaling Protocol except only one command per packet supported commands limited Command reject Connection Parameter Update request Connection Parameter Update response All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 192 .

L2CAP SUMMARY Three fixed channels for LE Attribute Protocol LE L2CAP Signaling Protocol Security Manager Protocol Retains existing L2CAP packet structure All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 193 .

SECURITY MANAGER Applications Generic Access Profile Generic Attribute Profile Attribute Protocol Security Manager Apps Host H t Logical Link Control and Adaptation Protocol g p Host Controller Interface Link Layer Physical Layer Direct Test Mode Controller All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 194 .

and here is a key to prove it Security Toolbox generating hashes confirmation values generate short term keys during pairing All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 195 .SECURITY MANAGER (SM) Security Manager Protocol Pairing & Key Distribution I trust this device.

Infinite Flush Timeout Code Data All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 196 . Basic Mode.SECURITY MANAGER PROTOCOL Uses L2CAP fixed channel 0x0006 MTU = 23 octets Best Effort.

BASIC CONCEPTS Use distributing key model Slave generates and distributes key information to master Master can use this key information when reconnecting Pairing authentication b d on their capabilities / security requirements th ti ti based th i biliti it i t side effect is encrypted link / key distribution Signing Data Signing allows authentication of sender without encryption Bonding GAP concept – device save keys for bonded devices All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 197 .

SM PROTOCOL CODES Code 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0 07 0x08 0x09 0x0A 0x0B Name Pairing Request Pairing Response Pairing Confirm Pairing Random Pairing Failed Encryption Information Master Identification M t Id tifi ti Identity Information Identify Address Information Signing Information Security Request Description starts the pairing procedure completes pairing exchange sends confirm value used in pairing sends random value used in pairing oh no. its failed – including reason distributed Long Term Key iinformation used when reconnecting t a master f ti d h ti to t distributed Identity Resolving Key address information used for reconnecting distributed Signature Key slave wants security – master always initiates All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 198 .

PAIRING MODEL Phase 1 : Exchange IO Capabilities Phase 2 : Authenticate Link L Li k Layer E Encryption ti Phase 3 : Key Distribution All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 199 .

IO CAPABILITIES No Input No Output Numeric O t t N i Output No Input No Output Display Onl Displa Only Yes / No No Input No Output Display Displa Yes No Keyboard Keyboard Only Keyboard Display Ke board Displa All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 200 .

IO CAPABILITIES TO ALGORITHM Display Only Display Yes No Keyboard Only No Input No Output Just Works Keyboard Display Passkey Entry Display Only Just Works Just Works Passkey Entry Unauthenticated Unauthenticated Authenticated Display Yes No Just Works Just Works Passkey Entry Unauthenticated Authenticated Just Works Passkey Entry Unauthenticated Unauthenticated Authenticated Keyboard Only Passkey Entry Authenticated No Input No Output Keyboard Display Just Works Passkey Entry Authenticated Just Works Passkey Entry Authenticated Just Works Unauthenticated Authenticated Just Works Passkey Entry Unauthenticated Authenticated Just Works Just Works Unauthenticated Unauthenticated Unauthenticated Unauthenticated Unauthenticated Passkey Entry Authenticated Passkey Entry Authenticated Passkey Entry Authenticated Just Works Passkey Entry Unauthenticated Authenticated All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 201 .

OTHER PAIRING REQUIREMENTS OOB Data y g has any authentication data been exchanged over OOB Authentication Requirements No Bonding / Bonding Man In The Middle protection required Key Distribution which keys does this device want from peer All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 202 .

ALGORITHMS Just Works TK = 0 Passkey Entry TK = passkey (6 digit number. 000000 to 999999) Out Of Band TK = from out of band All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 203 .

SlaveADDR) ( . Sconfirm = fc1 (TK. Mrand. MasterADDR) fc1 = AESTK (padding || ADDR || random) Mconfirm Sconfirm Mrand Srand All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 204 .AUTHENTICATION Mconfirm = fc1 (TK. Srand.

Srand.SHORT TERM KEY Need to generate a Short Term Key after authentication STK = fs1 (TK. Mrand) fs1 = AESTK (Srand || Mrand) 1 d d All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 205 .

KEY DISTRIBUTION Many keys can be distributed in both directions Long Term Key Identity Resolving Key Signature Resolving Key Encrypted Diversifier / Random Number All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 206 .

Rand) e.g. NIST Special Publication 800-108 could be used All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 207 .LONG TERM KEY 128 bit random number given by slave to master If a device can be both master and slave then a master can also give key to slave Can be “derived” from EDIV / Rand derived LTK = f (EDIV.

IDENTITY RESOLVING KEY Two types of address Public Address Random Address GAP defines sub-categories of Random Address Static Address Non-Resolvable Private Address Resolvable Private Address ← derived from IRK All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 208 .

can search all known IRKs with address random. and check if hash matches All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 209 .RESOLVABLE PRIVATE ADDRESSES Resolvable addresses need to use a known secret y g y (IRK) Identify Resolving Key ( ) hash = AESIRK (random) hash (24 bits) random (24 bits) 1 When receive an address.

SIGNED DATA Allows authentication without encryption Uses SignCounter incremented on each new message sent between devices Message Authentication Code calculated over plain text and SignCounter uses CMAC as defined by RFC 4493 plain text SignCounter (32 bits) MAC (64 bits) All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 210 .

1 allows upgrade to public key cryptography uses Key Distribution Defines cryptographic algorithms for privacy Resolvable Private Addresses Allows authentication using Signed Data All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 211 .SUMMARY Pairing / Authentication p uses same IO Capabilities as SSP from v2.

ATTRIBUTE PROTOCOL Applications Generic Access Profile Generic Attribute Profile Attribute Protocol Security Manager Apps Host H t Logical Link Control and Adaptation Protocol g p Host Controller Interface Link Layer Physical Layer Direct Test Mode Controller All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 212 .

ATTRIBUTE PROTOCOL (ATT) Client Server Architecture servers have data clients request data to/from servers Protocol Methods request. command. request response command notification. indication. confirmation All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 213 . response.

CLIENT SERVER ARCHITECTURE Servers have data. Clients want to use this data Servers expose Data using Attributes Client Requests Responses p Data Data Data Server All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 214 .

SERVERS EXPOSE DATA USING ATTRIBUTES Attributes have values y array of octets 0 to 512 octets in length can be fixed or variable length Value 0x54656d70657261747572652053656e736f72 0x04 0x0802 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 215 .

Read (0x0098) => 0x0802 Handle 0x0009 0x0022 0x0098 Value 0x54656d70657261747572652053656e736f72 0x04 0x0802 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 216 .ATTRIBUTES ARE ADDRESSABLE Each attribute has a “handle” y used to address an individual attribute by a client Clients use handles to address attributes Read (0x0022) => 0x04 .

type is a «UUID». determines what the value means Types are defined by “Characteristic Specifications Characteristic Specifications” or Generic Access Profile or Generic Attribute Profile Handle 0x0009 0x0022 0x0098 Type «Device Name» «Battery State» «Temperature» Value 0x54656d70657261747572652053656e736f72 0x04 0x0802 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 217 .ATTRIBUTES ARE TYPED Attributes have a type yp .

ATTRIBUTES ARE TYPED «Device Name» y defined by GAP formatted as UTF-8 0x54656d70657261747572652053656e736f72 = “Temperature Sensor” p Handle 0x0009 0x0022 0x0098 Type «Device Name» «Battery State» «Temperature» Value “Temperature Sensor” Temperature Sensor 0x04 0x0802 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 218 .

ATTRIBUTES ARE TYPED «Battery State» y y p defined by “Battery State Characteristic” specification enumerated value 0x04 = Discharging Handle 0x0009 0x0022 0x0098 Type «Device Name» «Battery State» «Temperature» Value “Temperature Sensor” Temperature Sensor Discharging 0x0802 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 219 .

5 ºC All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 220 .01 ºC 0x0802 = 2050 * 0.5 ºC Handle 0x0009 0x0022 0x0098 Type «Device Name» «Battery State» «Temperature» Value “Temperature Sensor” Temperature Sensor Discharging 20.ATTRIBUTES ARE TYPED «Temperature» y p p defined by “Temperature Characteristic” specification Signed 16 bit Integer in 0.01 ºC = 20.

ATTRIBUTE TYPE Type is a «UUID» g UUIDs are 128 bits in length Bluetooth defines a Bluetooth Base UUID allowing a 16 bit «UUID» to be defined 00000000-0000-1000-8000-00805F9B34FB Same Bluetooth Base UUID as SDP All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 221 .

ATTRIBUTE TYPE Type is a «UUID» g UUIDs are 128 bits in length Bluetooth defines a Bluetooth Base UUID allowing a 16 bit «UUID» to be defined 0000xxxx-0000-1000-8000-00805F9B34FB All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 222 .

ATTRIBUTE TYPE Type is a «UUID» g UUIDs are 128 bits in length Bluetooth defines a Bluetooth Base UUID allowing a 16 bit «UUID» to be defined 00001234-0000-1000-8000-00805F9B34FB = 16 bit UUID 0x1234 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 223 .

ATTRIBUTE HANDLE Handle is a 16 bit value 0x0000 is reserved – shall never be used 0x0001 to 0xFFFF can be assigned to any attributes Handles are “sequential” 0x0005 is “before” 0x0006 before 0x0104 is “after” 0x00F8 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 224 .

ATTRIBUTE TYPE Type is a «UUID» g UUIDs are 128 bits in length Bluetooth defines a Bluetooth Base UUID allowing a 16 bit «UUID» to be defined 0000xxxx-0000-1000-8000-00805F9B34FB All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 225 .

ATTRIBUTE PERMISSIONS Attributes values may be: readable / not readable writeable / not writeable readable & writeable / not readable & not writeable Attribute values may require: authentication to read / write authorization to read / write encryption / pairing with sufficient strength to read / write All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 226 .

ATTRIBUTE PERMISSIONS Permissions not “discoverable” over Attribute Protocol determined by implication If request to read an attribute value that cannot be read Error Response «Read Not Permitted» If request to write an attribute value that requires authentication Error Response «Insufficient Authentication» Client must create authenticated connection and then retry There is no “pending” state All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 227 .

ATTRIBUTE PERMISSIONS Attribute Handles are public information Attribute Types are public information Attribute Values can be protected It is up to the server to not reveal any values that it considers are protected to a client it does not “trust” enough Server responds by saying what is wrong – not with value Insufficient Authentication / Authorization / Key Size Read / Write Not Permitted All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 228 .

LOGICAL ATTRIBUTE REPRESENTATION 2 octets 2 or 16 octets variable length (0 to 512 octets) implementation specific Attribute Handle Attribute Type Attribute Value yp Attribute Permissions All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 229 .

PROTOCOL METHODS Protocol PDU Type Request Response Command Notification Indication Sent by Client Server Client Server Server Description Client requests something from server – always causes a response Server sends response to a request from a client Client commands something to server – no response Server notifies client of new value – no confirmation Server indicates to client new value – always causes a confirmation Confirmation to an indication Confirmation Client All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 230 .

PROTOCOL IS STATELESS After transaction complete p no state is stored in protocol A transaction is: Request -> Response Command Notification Indication -> Confirmation > All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 231 .

SEQUENTIAL PROTOCOL Client can only send one request at a time q p p request completes after response received in client Server can only send one indication at a time indication completes after confirmation received in server Commands and Notifications are no response / confirmation can be sent at any time could be dropped if buffer overflows – consider unreliable All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 232 .

ATOMIC OPERATIONS Each request / command is an atomic operation y cannot be affected by another client at the same time If link is disconnected halfway through a transaction value of attribute(s) undefined there is no “rollback” or “transactional processing” All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 233 .

ATTRIBUTE GROUPING Generic Attribute Profile defines a concept of Grouping Grouping is done by Attribute Type «Grouping Type» p g yp «Another Grouping Type» «Data» «Data» «Another Grouping Type» «Data» «Data» «Grouping Type» «Data» «Another Grouping Type» «Data» «Data» All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 234 .

ATTRIBUTE GROUPING Generic Attribute Profile defines a concept of Grouping Grouping is done by Attribute Type «Secondary Service» «Characteristic» «Data» «Data» «Characteristic» «Data» «Data» «Primary Service» «Data» «Characteristic» «Data» «Data» All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 235 .

MTU SIZES Over BR/EDR Attribute protocol uses a dynamic channel ( p y (fixed PSM) ) MTU negotiated by L2CAP Over LE Attribute protocol uses a fixed channel MTU “exchanged” by ATT ATT_MTU ATT MTU = min (Server_Rx_MTU. Client Rx MTU) (Server Rx MTU Client_Rx_MTU) ATT_MTU is symmetrical (same on client / server) All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 236 .

ATTRIBUTE PDU FORMAT Attribute Opcode bit 6-0 : Method bit 7 : Authentication Signature Flag = 0 Can append Signed Data to some methods Attribute Opcode e Access Address Data Header H Payload Length d L2CAP Length 0x0004 (ATT) 4 Prea amble Attribute Parameters All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential CR RC 237 .

ATTRIBUTE PDU FORMAT Attribute Opcode bit 6-0 : Method bit 7 : Authentication Signature Flag = 1 Can append Signed Data to some methods Attribute Opcode e Access Address Data Header H Payload Length d L2CAP Length 0x0004 (ATT) 4 SignC Counter Prea amble Attribute Parameters Signed Data MAC All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential CR RC 238 .

Name Error Response Exchange MTU R E h Request / Response t R Find Information Request / Response Find By Type Value Request / Response Read By Group Type Request / Resposne Read By Type Request / Response Read Read / Response Read Blob Request / Response Read Multiple Request / Response Write Command W it C d Write Request / Response Prepare Write Request / Response Execute Write Request / Response Handle Value Notification Handle Value Indication / Confirmation Description Something was wrong with a request Exchange new ATT MTU E h ATT_MTU Find information about attributes Find specific attributes Find specific group attributes and ranges Read attribute values of a given type Read an attribute value Read part of a long attribute value Read multiple attribute values Write this W it thi – no response Write an attribute value Prepare to write a value (long) Execute these prepared values Notify attribute value – no confirmation This attribute now has this value All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 239 .

don’t server has no control over if this is done All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 240 .MTU EXCHANGE Exchange MTU (Client Rx MTU) => (Server Rx MTU) Only O used on LE ( on BR/EDR) (not / ) ATT_MTU ATT MTU = min (Client Rx MTU. Server Rx MTU) i (Cli t R MTU S R Can only be sent once during a connection only be initiated by client optional to initiate this – if you are happy with 23 don t 23.

Type]*) Handles / Types are public information Find Information used to find this information Responds with a list of attribute handles and their types p yp can only send all 16 bit or all 128 bit UUIDs in response p q if mix of 16/128 UUIDs. [Handle. Ending Handle) => (format. multiple requests must be used each with different format All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 241 .FINDING INFORMATION Find Information (Starting Handle.

Attribute Value) => ([HandlePair]*) Returns the handle of all found attribute with type and value matching exactly AND handle of the last attribute in the attribute group All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 242 . Ending Handle.FINDING INFORMATION Find By Type Value (Starting Handle. Attribute Type.

UUID) => (Length.READING ATTRIBUTES Read By Group Type (Starting Handle. Ending Handle. [Handle:EndGroupHandle:Value]*) Reads the value of each attribute of a given type in a range responds with h dl d ith handle:end group h dl d handle:value t l l tuples allows reading group semantics If multiple values have the size length. then many can be returned iin a single response t d i l All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 243 .

UUID) => (Length. Ending Handle.READING ATTRIBUTES Read By Type (Starting Handle. [Handle:Value]*) Reads the value of each attribute of a given type in a range responds with h dl d ith handle:value pairs l i If multiple values h li l l have the size llength. then many can b h i h h be returned in a single response All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 244 .

READING ATTRIBUTES Read (Handle) => (Value) Simple? Only works up to ATT_MTU – 1 octets All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 245 .

READING LONG ATTRIBUTES Read Blob (Handle. Offset) => (Part Value) Can be used to read very long attributes If ATT_MTU = 23 (default on LE) q a 512 octet value would require 24 transactions to read If ATT_MTU = 48 (default on BR/EDR) ( ) a 512 octet value would require 11 transactions to read All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 246 .

READ MULTIPLE Read Multiple ([Handle]*) => ([Value]*) Used to read multiple values at the same time Can only be used if len (value) < ATT_MTU – 1 Can only be used if size of each value is known p except last value All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 247 .

value) => I want this attribute set to this value NOW with no response Used for “sending commands” to a “state machine” g can also be signed if need authentication with cost of encryption setup / confidentiality requirements All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 248 .WRITING ATTRIBUTES Write Command (handle.

WRITING ATTRIBUTES Write (handle. value) => () Simple? Includes a Response to allow: flow control of transactions – no buffer overflows confirm that the value has been written All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 249 .

value) Execute Write (exec/cancel) => () > Prepared writes are queued in server until they are executed queue size can be discovered response includes value again (double checking) offset parameter allows writes to long attributes execution is a single atomic transaction All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 250 . offset. value) => (handle.COMPLEX WRITES Prepare Write (handle. offset.

SERVER INITIATED METHODS => Handle Value Notification (handle. no flow control y pp y inherently unreliable – can be dropped by buffer overflow Typically used to notify client of state updates yp y y p turned on / off by clients using Generic Attribute Profile All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 251 . value) Server notifies client of an attribute with a new value Can be sent at any time.

SERVER INITIATED METHODS Handle Value Indication(handle. value) => Handle Value Confirmation () Server indicates to client an attribute with a new value Client Cli t must confirm receipt b f server can send again t fi i t before d i Used h flow U d when fl controll iis iimportant or when confirmation of state change is required All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 252 .

Handle. Error Code) Any request can cause an error response must always be sent error response includes information about error Opcode from the request – what request caused this error q Handle from the request – what handle caused this error Error Code – reason why this error is raised All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 253 .ERROR RESPONSE (any) Request (*) => Error Response (Opcode.

Name Invalid Handle Read Not Permitted Write Not Permitted Invalid PDU Insufficient Authentication Request Not Supported Invalid Offset Insufficient Authorization Prepare Queue Full Attribute Not Found Attribute Not L Att ib t N t Long Insufficient Encryption Key Size Invalid Attribute Value Length Unlikely E U lik l Error Insufficient Encryption Application Error Description for example handle = 0x0000 not readable attribute : permissions not writeable attribute : permissions PDU was invalid – wrong size? needs authentication : permissions server doesn’t support request offset beyond end of attribute need authorization : permissions server has run out of prepare queue space no attributes in attribute range found should use R d requests h ld Read t needs encryption key size : permissions value written was invalid size something went wrong – oops hi needs encryption : permissions application didn’t like what you requested All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 254 .

SECURITY CONSIDERATIONS All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 255 .

Addressable Attributes Handle Type Value Methods for finding reading writing attributes by client finding. reading.ATTRIBUTE PROTOCOL SUMMARY Exposes Data using Typed. Methods for sending notifications / indications by server All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 256 .

GENERIC ATTRIBUTE PROFILE Applications Generic Access Profile Generic Attribute Profile Attribute Protocol Security Manager Apps Host H t Logical Link Control and Adaptation Protocol g p Host Controller Interface Link Layer Physical Layer Direct Test Mode Controller All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 257 .

GENERIC ATTRIBUTE PROFILE (GATT) Defines concepts of: p Service Group Characteristic Group Declarations Descriptors Does not define rules for their use this is separate but essential to understand All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 258 .

CLIENT SERVER ARCHITECTURE Same client server architecture as Attribute Protocol Client Requests Responses p Data Server Data Data All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 259 .

Server Service Char.CLIENT SERVER ARCHITECTURE Same client server architecture as Attribute Protocol p p except that data is encapsulated in “Services” and data is exposed in “Characteristic” Client Requests Responses p Service Char. Service Char. All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 260 .

WHAT IS A CHARACTERISTIC? It’s a value. with a known type. and a known format p defined in a “Characteristic Specification” Characteristic Declaration Characteristic Value Characteristic Descriptors Declaration Value Descriptor Descriptor All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 261 .

WHAT IS A CHARACTERISTIC? Characteristics are grouped by «Characteristic» y y Value attribute is always immediately after «Characteristic» followed by descriptors Descriptors additional information any number any order can be vendor specific «Characteristic» Value «Presentation Format» «Client Configuration» All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 262 .

WHAT IS A SERVICE? A service is: p defined in a “Service Specification” collection of characteristics references to other services Service Declaration Includes Characteristics All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 263 .

TWO TYPES OF SERVICE: Primary Service y • A primary service is a service that exposes primary usable functionality of this device. th i Secondary Service • A secondary service is a service that is subservient to another secondary service or p y primary service. A secondary service is only y y y relevant in the context of another service. All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 264 . A primary service can be included by another service.

GENERIC ATTRIBUTE PROFILE Attribute Protocol defines a server with a set of attributes addressable with a handle typed using a UUID with data in an attribute value with some permissions 2 octets 2 or 16 octets variable length (0 to 512 octets) implementation specific Attribute Handle Attribute Type Attribute Value Attribute Permissions All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 265 .

pp } «Thermometer» «GATT» {r. 0x0003. 0x0006. «Device Name»} “Temperature Sensor” {.ATTRIBUTES ARE FLAT Handle 0x0001 0x0002 0x0003 0x0004 0x0006 0x000F 0x0010 0 0010 0x0012 0x0020 0x0021 0x0022 Type «Primary Service» «Characteristic» «Device Name» «Characteristic» «Appearance» «Primary Service» «Characteristic» Ch t i ti «Attribute Opcodes Supported» «Primary Service» «Characteristic» «Temperature Celsius» Value «GAP» {r. «Appearance»} . «Attribute O d S t d } 0x00003FDF «Temperature» {r. 0x0022. {r. 0 0012 Att ib t Opcodes Supported»} { 0x0012. «Temperature Celsius»} 0x0802 Permissions R R R R R R R R R R R* All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 266 .

GENERIC ATTRIBUTE PROFILE IMPOSES STRUCTURE Primary Service «GAP» «Device Name» “Temperature Sensor” «Appearance» «Thermometer» Primary Service «GATT» «Attribute Opcodes Supported» 0x03FDF p pp Primary Service «Temperature» «Temperature Celsius» 0x0802 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 267 .

0 0012 Att ib t Opcodes Supported»} { 0x0012. pp } «Thermometer» «GATT» {r.GROUPING GIVES STRUCTURE Handle 0x0001 0x0002 0x0003 0x0004 0x0006 0x000F 0x0010 0 0010 0x0012 0x0020 0x0021 0x0022 Type «Primary Service» «Characteristic» «Device Name» «Characteristic» «Appearance» «Primary Service» «Characteristic» Ch t i ti «Attribute Opcodes Supported» «Primary Service» «Characteristic» «Temperature Celsius» Value «GAP» {r. «Device Name»} “Temperature Sensor” {. «Attribute O d S t d } 0x00003FDF «Temperature» {r. «Appearance»} . 0x0006. 0x0022. 0x0003. «Temperature Celsius»} 0x0802 Permissions R R R R R R R R R R R* All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 268 . {r.

«Appearance»} .GROUPING GIVES STRUCTURE Handle 0x0001 0x0002 0x0003 0x0004 0x0006 0x000F 0x0010 0 0010 0x0012 0x0020 0x0021 0x0022 Type «Primary Service» «Characteristic» «Device Name» «Characteristic» «Appearance» «Primary Service» «Characteristic» Ch t i ti «Attribute Opcodes Supported» «Primary Service» «Characteristic» «Temperature Celsius» Value «GAP» {r. 0x0022. «Device Name»} “Temperature Sensor” {. 0 0012 Att ib t Opcodes Supported»} { 0x0012. «Temperature Celsius»} 0x0802 Permissions R R R R R R R R R R R* All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 269 . {r. pp } «Thermometer» «GATT» {r. «Attribute O d S t d } 0x00003FDF «Temperature» {r. 0x0006. 0x0003.

«Temperature Celsius»} 0x0802 Permissions R R R R R R R R R R R* All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 270 . 0x0022. 0x0003. «Attribute O d S t d } 0x00003FDF «Temperature» {r. 0x0006. {r 0x0003 «Device Name»} “Temperature Sensor” {r.GROUPING GIVES STRUCTURE Handle 0x0001 0x0002 0x0003 0x0004 0x0006 0x000F 0x0010 0 0010 0x0012 0x0020 0x0021 0x0022 Type «Primary Service» «Characteristic» «Device Name» «Characteristic» «Appearance» «Primary Service» «Characteristic» Ch t i ti «Attribute Opcodes Supported» «Primary Service» «Characteristic» «Temperature Celsius» Value «GAP» {r. 0 0012 Att ib t Opcodes Supported»} { 0x0012. «Appearance»} «Thermometer» «GATT» {r.

no authorization All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 271 .«INCLUDE» DECLARATION Allows services to reference other services Value is reference to another Service: Service Handle End Group Handle Service UUID Type «Include» Value Service Handle End Group Handle Service UUID Permissions Read only. no authentication.

no authentication. «Battery» etc… e g «GAP» «GATT» «Temperature» «Battery». etc Type «Primary Service» Value UUID for Service Permissions Read only. «GAP».g. no authorization All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 272 . «Temperature».«PRIMARY SERVICE» DECLARATION Groups attributes for a primary service y followed by «Include» then followed by «Characteristic» Attribute value is UUID for Service e. «GATT».

«Battery» etc… e g «GAP» «GATT» «Temperature» «Battery». «GAP». etc Type «Secondary Service» Value UUID for Service Permissions Read only. «Temperature». no authentication. no authorization All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 273 . «GATT».g.«SECONDARY SERVICE» DECLARATION Groups attributes for a secondary service y followed by «Include» then followed by «Characteristic» Attribute value is UUID for Service e.

w. no authentication. no authorization All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 274 .«CHARACTERISTICS» DECLARATION Groups attributes for a characteristic within a service followed by Characteristic Value attribute. Value Handle.a.i.e) handle of characteristic value type of characteristic Type «Characteristic» Value Properties.r.c.n. descriptors Attribute Value is: properties for characteristic value (b. Characteristic UUID Permissions Read only.

«CHARACTERISTICS» PROPERTIES Properties for Characteristic Value Broadcast Read Command Write Notify Indicate Signed Command Extended Properties All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 275 .

Write. Notify or Indicate are called “Control-Point Characteristics” Cannot read Control-Point Characteristics they expose no state can represent “instantaneous” state All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 276 . . y Command.CONTROL-POINT CHARACTERISTICS Characteristics that are only: .

0x0003.«CHARACTERISTIC» HANDLE AND TYPE Handle for Characteristic Value not incremental to Declaration Type is repeated for optimized searches Read By Type «Device Name» Read By Type «Characteristic» Handle 0x0001 0x0002 0x0003 0x0004 0x0006 Type «Primary Service» «Characteristic» «Device Name» «Characteristic» «Appearance» Value «GAP» {r. 0x0006. «Device Name»} “Temperature Sensor” Temperature Sensor {r. «Appearance»} «Thermometer» Permissions R R R R R All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 277 .

CHARACTERISTIC DESCRIPTORS «Characteristic Extended Properties» Additional properties ( p p (that didn’t fit in «Characteristic») ) Bit: Reliable Write can “prepare / execute write” Bit: Writable Descriptors can write descriptors (when allowed) All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 278 .

CHARACTERISTIC DESCRIPTORS «Characteristic User Description» g UTF-8 string Description of this characteristic typically written by user to label a characteristic may require authentication / authorization to write max of one User Description per Characteristic All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 279 .

CHARACTERISTIC DESCRIPTORS «Client Characteristic Configuration» g Notification / Indication configuration Allows each client to turn on / off notifications / indications does not define when these are sent just that they are sent Different value for each client that is “bonded” with device bonded may require authentication / authorization to write All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 280 .

CHARACTERISTIC DESCRIPTORS «Server Characteristic Configuration» g Broadcast configuration Allows any client to turn on / off broadcast does not define when these are sent just that they are sent One value for all clients may require authentication / authorization to write All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 281 .

float32. etc…) All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 282 . utf8s. etc…) Exponent (multiply value by 10Exponent) Unit (SI Units / Derived Units) Name Space (Who allocated Description: Bluetooth. uint8. sint16. Continua) Description (Above. Below.CHARACTERISTIC DESCRIPTORS «Characteristic Presentation Format» defines how the characteristic value if formatted used to “present” value to user via a “Generic Client” Fields include: Format (boolean. Armpit. Inside. Outside. Ear.

«Latitude». «Elevation» «3D Position» Aggregate Longitude / Latitude / Elevation All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 283 .CHARACTERISTIC DESCRIPTORS «Characteristic Aggregate» p list of characteristic presentation formats for each part of the aggregated value «Longitude».

GATT PROCEDURES Procedure Server C fi S Configuration ti Primary Service Discovery Relationship Discovery Characteristic Discovery Characteristic Descriptor Discovery Characteristic Value Read Sub-Procedures Exchange MTU E h Discovery All Primary Service Discover Primary Service by Service UUID Find Included S Services Discover All Characteristics of a Service Discover Characteristics by UUID Discover All Characteristic Descriptors Read Characteristic Value Read Using Characteristic UUID Read L R d Long Ch Characteristic V l t i ti Values Read Multiple Characteristic Values All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 284 .

GATT PROCEDURES Procedure Characteristic Value Write Sub-Procedures Write Without Response Write Without Response With Authentication Write Characteristic Value Write Long Characteristic Values Reliable Writes Notifications Indications Read Characteristic Descriptors Read Long Characteristic Descriptors Write Characteristic Descriptors Write Long Characteristic Desc Characteristic Value Notifications Characteristic Value Indications Characteristic Descriptors All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 285 .

GATT CHARACTERISTICS GATT defines it own «GATT» Service. and characteristics g «Service Changed» «Attribute Opcodes Supported» All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 286 .

«SERVICE CHANGED» CHARACTERISTIC Control-Point Characteristic notified when client uses attributes on a server after server has change attribute handles or after server has added or removed services Client must perform “Service Discovery procedure Service Discovery” re-establish services / characteristics All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 287 .

GATT CHARACTERISTICS «Attribute Opcodes Supported» p p pp What attribute protocol opcodes are supported just a bit mask All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 288 .

GATT SUMMARY Defines grouping of attributes Services Include Characteristics Descriptors Grouping Attributes are called Descriptors «Primary Service» «Secondary Service» «Characteristic» Service». All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 289 . Service».

GENERIC ACCESS PROFILE Applications Generic Access Profile Generic Attribute Profile Attribute Protocol Security Manager Apps Host H t Logical Link Control and Adaptation Protocol g p Host Controller Interface Link Layer Physical Layer Direct Test Mode Controller All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 290 .

Central Defines standard ways for devices to connect Discoverable. Connectable. Broadcaster. Observer Peripheral.GENERIC ACCESS PROFILE (GAP) Profile Roles . Discoverable Connectable Bonding Privacy Resolvable Private Addresses All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 291 .

can discover devices All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 292 .PROFILE ROLES Broadcaster g sends advertising events including characteristics including service data Doesn t Doesn’t need Receiver if it does have Receiver. can be discoverable Observer receives advertising events g listens for characteristics listens for service data Doesn t Doesn’t need Transmitter if it does have Transmitter.

PROFILE ROLES Peripheral Central Has Transmitter & Receiver Has Transmitter & Receiver Always slave Always master Connectable advertising Never advertisers Must support All LL Control Procedures Encryption optional Must support active or passive scanning All LL Control Procedures Encryption optional All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 293 .

LINK LAYER STATE MACHINES FOR BROADCASTER AND OBSERVER Broadcaster Scanning Observer Scanning Advertising Standby Initiating Advertising Standby Initiating Slave Connection Master Slave Connection Master All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 294 .

LINK LAYER STATE MACHINES FOR PERIPHERAL AND CENTRAL Peripheral Scanning Central Scanning Advertising Standby Initiating Advertising Standby Initiating Slave Connection Master Slave Connection Master All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 295 .

ADVERTISING DATA
Can be sent when broadcaster / discoverable peripheral Many Advertising Data (AD) Types defined: Flags Service UUIDs Local Name TX Power Level Slave Connection I t Sl C ti Intervall R Range Signed Data Service Solicitation Service Data Manufacturer Specific Data
All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

296

FLAGS AD TYPE

Tag Value 0x01

Bit 0 1 2 3 4 5-7

Description LE Limited Discoverable Mode LE General Discoverable Mode BR/EDR Not Supported Simultaneous LE and BR/EDR to Same Device Capable (Controller) Simultaneous LE and BR/EDR t S Si lt d to Same D i Capable (H t) Device C bl (Host) Reserved

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

297

Tag Value 0x02 0x03 0x06 0x07 0x08 0x09 0x0A 0x12 0x14 0x15 0x16 0xFF

Description Non-complete list of 16-bit Service UUIDs Complete list of 16-bit Service UUIDs Non-complete list of 128-bit Service UUIDs Complete list of 128-bit Service UUIDs Non-complete shortened local name Complete local name Tx Power Level (-127 dBm to +127 dBm) Slave Connection Interval Range (min, max) Service Solicitation for 16 bit Service UUIDs Service Solicitation for 128 bit Service UUIDs Service Data (16 bit Service UUID, service data) ( ) Manufacturer Specific Data (Company Identifier Code, data)

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

298

INTERESTING AD TYPES Service UUIDs pp can determine which services a device supports without connecting to it Tx Power Level g packet combined with RSSI of advertising p allows sorting of devices by distance in UI sort by distance = Tx Power Level - RSSI

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

299

SERVICE SOLICITATION DATA “I’m desperate – I want a simple remote control to talk to me” Allows a Peripheral to “advertise” what services it use e.g. Central wants to expose «Simple Remote Service» but is not advertising Peripheral wants to use this service Central connects to peripherals that solicit its services
All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

300

BROADCASTER & OBSERVER MODES AND PROCEDURES Broadcast Mode g yp Flags AD Type LE General Discoverable Mode = 0 LE Limited Discoverable Mode = 0 Uses ADV_NONCONN_IND or ADV_DISCOVER_IND Observation Procedure Listens for all advertising packets Can active or passive scan
All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

301

DISCOVERABLE MODES - PERIPHERAL Non-Discoverable Mode not connectable – default mode can advertise Flags AD Type LE Limited Discoverable Mode flag = 0 LE General Discoverable Mode flag = 0

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

302

DISCOVERABLE MODES - PERIPHERAL Limited Discoverable Mode (p p ) used after user interaction (power on / button press) Flags AD Type LE Limited Discoverable Mode flag = 1 LE General Discoverable Mode flag = 0 can only be limited discoverable for 30.72 seconds ensures that limited discoverable devices have recently been touched by user

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

303

Service UUIDs AD.PERIPHERAL General Discoverable Mode y used at any time Flags AD Type LE Limited Discoverable Mode flag = 0 LE General Discoverable Mode flag = 1 typically used with low duty cycle advertising should include: TX Power Level AD Local Name AD AD. AD. Slave Connection Interval Range AD All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 304 .DISCOVERABLE MODES .

DISCOVERY PROCEDURES Limited Discovery Procedures g finds devices where LE Limited Discoverable Mode flag = 1 finds only “Limited Discoverable” devices General Discovery Procedures finds devices where LE Limited Discoverable Mode flag = 1 or LE General Discoverable Mode flag = 1 finds all “Discoverable” devices Discoverable All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 305 .

WHAT CAN DISCOVER TO WHAT? Non-Discoverable Limited Discovery General Discovery No No Limited Discoverable Yes Yes General Discoverable No Yes All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 306 .

CONNECTABLE MODES .PERIPHERAL Non-Connectable Mode not connectable – default mode Directed Connectable Mode connect to specific device – using ADV_DIRECT_IND Undirected Connectable Mode connect to any device – using ADV_IND ADV IND All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 307 .

CENTRAL Auto Connection Establishment Procedures automatically connect to a set of devices – uses white lists General Connection Establishment Procedure connect to any device – supports p y pp private connections Selective Connection Establishment Procedure connect t set of d i t to t f devices – separate configuration per device t fi ti d i Direct Connection Establishment Procedure connect to “that” device – any private / unknown device possible All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 308 .CONNECTION ESTABLISHMENT PROCEDURES .

WHAT CAN CONNECT TO WHAT? Non-Connectable Non Connectable Auto Connection General Connection Selective Connection Direct Connection No No No No Directed Connectable Yes if in list Yes if in list Yes if in list Yes Undirected Connectable Yes if in list Yes if in list Yes if in list Yes All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 309 .

BONDING Security Manager defines how to “pair” devices yp authenticate and then encrypt a link Bonding is the storing of Security and Identity Information Once bonded a device can reconnect using the stored information GATT will store service change information for device All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 310 .

BONDING IS SIMPLE Non-Bondable Mode g default mode – does not allow bonding Bondable Mode allows bonding Bonding Procedure only when both devices are in bondable mode All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 311 .

ONLY BOND IF BOTH ARE BONDABLE Non-Bondable Non-Bondable Bondable No No Bondable No Yes All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 312 .

no encryption) Level 2: Unauthenticated pairing with encryption Level 3: Authenticated pairing with encryption LE Security Mode 2 (Signed Data) Authenticated Pairing with Data Signing All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 313 .LE SECURITY MODES GAP defines two security modes: LE Security Mode 1 (Link Layer Encryption) Level 1: No Security (no authentication.

PRIVACY Two characteristics on Peripheral p y g Peripheral Privacy Flag Characteristic Reconnection Address Characteristic Peripheral Privacy Flag Characteristic Disabled Di bl d Enabled Disabled Enabled Reconnection Address Characteristic Not E i t N t Exists Not Exists Exists Exists Privacy Support in Peripheral No P i N Privacy Privacy in Undirected Connectable Mode only Not Allowed Privacy in Directed Connectable Mode and in Undirected Connectable Mode All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 314 .

PRIVATE ADDRESSES A type of Random Device Address g sub-categorized into either: Non-Resolvable Private Address Resolvable Private Address Static Add St ti Address Random Device Address Address Public Device Address Private Address Resolvable Private Address Non-Resolvable Private Address All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 315 .

ADDRESS TYPES TxAdd RxAdd Public Device Add D i Address Static Device Address Non-Resolvable Device Address Resolvable Device Address company_assigned (24 bit ) bits) company_id (24 bit ) bits) 11 0 random part of static address (46 bits) random part of static address (46 bits) hash (24 bits) prand (22 bits) 1 00 1 10 1 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 316 .

prand) All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 317 .ADDRESS TYPES TxAdd RxAdd Resolvable Device Add D i Address hash (24 bit ) bits) prand (22 bit ) bits) 10 1 hash = func (IRK.

GAP CHARACTERISTICS Characteristic «Device Name» «Appearance» «Peripheral Privacy Flag» «Reconnection Address» «Peripheral Preferred Connection Parameters» Description the local name of the device enumeration of what the device “looks like” looks like does this peripheral support privacy – is it enabled address to use when reconnecting to a private device what this peripheral would prefer the central connect with All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 318 .

Broadcaster. . Central Defines modes and procedures for Discovery. Peripheral.GAP SUMMARY Profile Roles . Connections. p . Observer. Bonding Privacy Non-Resolvable Non Resolvable and Resolvable Private Addresses All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 319 .

AFTERNOON BREAK return at 15:45 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 320 .

APPLICATIONS Applications Generic Access Profile Generic Attribute Profile Attribute Protocol Security Manager Apps Host H t Logical Link Control and Adaptation Protocol g p Host Controller Interface Link Layer Physical Layer Direct Test Mode Controller All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 321 .

APPLICATIONS Client Server Architecture p Services – exposes behavior that have characteristics Use Cases– define how to use services on a peer Client Use C U Case Use Case Use Case Requests Responses p Service Char. All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 322 . Service Char. Server Service Char.

Service != Profile All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 323 .

Use Case != Profile All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 324 .

Use Case != Service All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 325 .

WHY SPLIT PROFILES? There is not a one to one link between services and use cases «Immediate Alert» Service Could be used by Proximity Use Case Device Selection Use Case All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 326 .

Service B Char.APPLICATIONS Use Case 1 uses Service «A» Use Case 2 uses Service «A» and Service «B» Client Use Case 1 Server Service S i A Char. Use Case 2 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 327 .

Service B Char. Use Case 2 All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 328 .APPLICATIONS Device Selection uses «Immediate Alert» y Proximity uses «Immediate Alert» and «Transmit Power» Client Use Case 1 Server Service S i A Char.

WHY ATOMIZE SERVICES Services expose an atomic bit of behavior in a device If you have an X. you implement Service «X» If you have a temperature sensor you implement «Temperature» Service If you have the ability to monitor the battery status you implement «Battery Status» Service All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 329 .

«Link Loss Alert» Device S l ti D i Selection uses: «Immediate Alert» All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 330 . «Immediate Alert».SERVICE != USE CASE Services expose what the device does not how a peer device uses it Use Cases determine what Service are required Proximity uses: «Transmit Power».

CLIENTS AND SERVICES Clients implement Use Cases. Servers implement Services A device can be a client and a server at the same time Phone may implement: «Network Availability» Service (as a Server) «Immediate Alert» Service (as a Server) Proximity Use Case (as a Client) Sports Sensor Use Case (as a Client) All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 331 .

«Inclination». «Position». «Peddle Power». «Elevation». «Foot Fall». «Pedometer». «Cadence». etc… All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 332 . «Speed».SCHEMAS CAN USE MANY SERVICES Sports Sensor Use Case y p defines how to talk to many sports sensor services can use one or more of these services: «Heart Rate».

WHAT IS AN APPLICATION? An Application uses a set of Use Cases Use Cases use a set of Services on a peer device Services expose Characteristics Services define behavior exposed by Characteristics All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 333 .

HOW DO CREATE LE APPLICATIONS Steps: • • • • • • • • What state is there? Where is this state? What data does the state expose? How does the data work? How is the state machine controlled? What is common and can be abstracted? What if the client disconnects? What is the final set of schemas? All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 334 .

WHAT STATE IS THERE? Application Thermometer Light Clock Radio Clock State Current Temperature On / Off Current Time Current Time Trigger Time Synchronization Time Synchronization Progress All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 335 .

WHERE IS THE STATE? Application Thermometer Light Clock Radio Clock State Current Temperature On / Off Current Time Current Time Trigger Time Synchronization Time Synchronization Progress Server is located in Sensor Device Light Controller Clock Clock All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 336 .

10-1. Celsius uint8. 100. Binary Localtime Characteristic Localtime Characteristic All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 337 .WHAT DATA DOES THE STATE EXPOSE? Application Thermometer Light Clock Radio Clock Characteristic Current Temperature On / Off Current Time Current Time Trigger Time Synchronization Time Synchronization Progress Data Format sint16.

progress All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 338 .HOW DOES THE DATA WORK? Application Thermometer Light Clock Radio Clock Service Temperature Service Light Controller Service Current Time Time Synchronization Behavior Read current temperature Read current light state Write light on / off / toggle Read current time Read current time Start time synchronization Cancel time synchronization Notification of sync.

HOW IS THE STATE MACHINE CONTROLLED? State idle idle searching searching searching searching Signal StartSync CancelSync StartSync CancelSync “found” “timeout” “found” “f d” “timeout” CancelSync y New State searching idle searching idle idle idle idle StartSync CancelSync searching g StartSync y All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 339 .

HOW IS THE STATE MACHINE CONTROLLED? Define “Control Point” characteristics p p enumerate all possible inputs define behavior when input received define even when input is received in “invalid” state invalid Also expose “State Machine state characteristic State Machine” allows a client to discover current state even after a reconnection allows lower power “disconnected” modes All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 340 .

Time Sync. y Current Time.WHAT IS COMMON AND CAN BE ABSTRACTED? Time Synchronization Service requires . y . State Local Time Service requires Current Time Abstract Current Time into own Service Time Synchronization references Current Time «Current Time» Service may be useful in other contexts All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 341 . Time Sync. CP.

WHAT IF THE CLIENT DISCONNECTS? No state or behavior in clients y clients can disconnect at any time clients can cache information from server Upon reconnection clients can re-establish current server state re establish servers should keep state small – to speed this up All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 342 .

WHAT IF THE CLIENT DISCONNECTS? Server can remember that client wants state updates g reconnect to client when state changes then notify client with new state Alternatively provide control points to allow control without state “Toggle Light” instead of read light state. write !light state Toggle Light state All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 343 .

WHAT IS THE FINAL SET OF SCHEMAS? An Application uses a set of Use Cases p Use Cases use a set of Services on a peer device Services expose Characteristics Services define behavior exposed by Characteristics Remember: Use Cases define how to use services for given application Services define behavior on characteristics Characteristics define interoperable data formats All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 344 .

EXAMPLE APPLICATIONS Proximity Device Selection All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 345 .

alert on link loss if the device is too far away cause an alert away. cause an alert How will this work? if a device disconnects cause an alert disconnects. alert on “path loss” All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 346 . When is a device close / far away / very far away.PROXIMITY APPLICATION Description: y y y.

PROXIMITY APPLICATION What state is there? y ability to cause an alert – on server ability to measure Tx Power of peer device – on server ability to get RSSI of packets from peer device – on client Server Characteristics: «Tx Power» «Alert Level» All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 347 .

mild. enumeration All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 348 . 100. 100.PROXIMITY APPLICATION How does the data work? «Tx Power» Characteristic dBm of transmitter when in a connection Range: -20 dBm to +10 dBm Format: sint8. dBm «Alert Level» Characteristic enumeration of {none. high} ti f{ ild hi h} Format: uint8.

alert on “path loss” «Immediate Alert» Service «Tx Power» Service All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 349 .PROXIMITY APPLICATION What behavior is exposed: if a device disconnects. cause an alert alert on link loss «Link Loss» Service if the device is too far away cause an alert away.

«Immediate Alert» Service «Alert Level» Characteristic Behavior: when written.PROXIMITY APPLICATION «Link Loss» Service «Alert Level» Characteristic Behavior: On link loss cause alert as enumerated loss. reports current Tx Power for connection All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 350 . cause alert as enumerated «Tx Power» Service «Tx Power» Characteristic Behavior: when read.

disabled this service . allows client to gracefully disconnect All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 351 .PROXIMITY APPLICATION Proximity Use Case Defines use of «Tx Power» Service with local RSSI calculate “Path Loss Path Loss” write «Immediate Alert» «Alert Level» above threshold Link Loss Use Case Defines use of «Link Loss» Service write «Link L it Li k Loss» «Alert L l with alert llevell Al t Level» ith l t could cause alert on client also if write ‘none’.

0x0012.PROXIMITY APPLICATION Handle 0x0010 0x0011 0x0012 0x0020 0x0021 0x0022 0 0022 0x0030 0x0031 0x0032 Type «Primary Service» «Characteristic» «Alert Level» «Primary Service» «Characteristic» «Tx P T Power dBm» dB «Primary Service» «Characteristic» «Alert Level» Value «Link Loss» {rw. 0x0022. «Alert Level»} 0x00 «Tx Power» {r. 0x0032. «Tx Power dBm»} 0x04 0 04 «Immediate Alert» {w. «Alert Level»} All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 352 .

{w 0x0032 «Alert Level»} All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 353 . 0x0022. 0x0032. «Tx Power dBm»} 0x04 0 04 «Immediate Alert» {w.PROXIMITY APPLICATION Handle 0x0010 0x0011 0x0012 0x0020 0x0021 0x0022 0 0022 0x0030 0x0031 0x0032 Type «Primary Service» «Characteristic» «Alert Level» «Primary Service» «Characteristic» «Tx P T Power dBm» dB «Primary Service» «Characteristic» «Alert Level» Value «Link Loss» {rw. 0x0012. «Alert Level»} 0x00 «Tx Power» {r.

DEVICE SELECTION APPLICATION Description: When is a device is selected on user interface cause that device to alert user State: device selected on client alert level on server All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 354 .

DEVICE SELECTION APPLICATION What state is there? y ability to cause an alert – on server Server Characteristics: «Alert Level» All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 355 .

enumeration All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 356 . high} Format: uint8.DEVICE SELECTION APPLICATION How does the data work? «Alert Level» Characteristic enumeration of {none. 100. mild.

cause an alert alert on device selection on client «Immediate Alert» Service All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 357 .DEVICE SELECTION APPLICATION What behavior is exposed: when the device is selected.

cause alert as enumerated All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 358 .DEVICE SELECTION APPLICATION «Immediate Alert» Service «Alert Level» Characteristic Behavior: when written.

DEVICE SELECTION APPLICATION Device Selection Use Case Defines use of «Immediate Alert» Service write «Alert Level» when selected clear «Alert Level» when unselected All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 359 .

«Alert Level»} All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 360 .DEVICE SELECTION APPLICATION Handle 0x0030 0x0031 0x0032 0 0032 Type «Primary Service» «Characteristic» «Alert L l Al t Level» Value «Immediate Alert» {w. 0x0032.

«Alert Level»} 0x00 «Tx Power» {r. 0x0012. 0x0032. «Tx Power dBm»} 0x04 0 04 «Immediate Alert» {w. {w 0x0032 «Alert Level»} All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 361 . 0x0022.WHAT DOES THIS DEVICE SUPPORT? Handle 0x0010 0x0011 0x0012 0x0020 0x0021 0x0022 0 0022 0x0030 0x0031 0x0032 Type «Primary Service» «Characteristic» «Alert Level» «Primary Service» «Characteristic» «Tx P T Power dBm» dB «Primary Service» «Characteristic» «Alert Level» Value «Link Loss» {rw.

WHAT USE CASES DOES THIS SERVER SUPPORT? Services «Link L Li k Loss» «Immediate Alert». «Tx Power» «Immediate Alert» Use Cases Link Loss Li k L Proximity Device Selection Behavior of «Tx Power» and «Immediate Alert» separated interaction defined in Use Cases no multi profile issues multi-profile All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 362 .

«Tx Power» «Immediate Alert» Behavior of «Tx Power» and «Immediate Alert» separated interaction defined in Use Cases no multi profile issues multi-profile All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 363 .WHAT SERVICES DOES THIS CLIENT SUPPORT? Use Cases Link Loss Li k L Proximity Device Selection Services «Link L Li k Loss» «Immediate Alert».

SERVICES ARE ATOMIC A service exposes behavior around one bit of a device y y must not be effected by any other service in the device If a bit of a device is effected a service must be defined that defined the behavior between referenced services All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 364 .

network effect 1 Service = 1 Use Case A All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 365 .

network effect 2 Services = 3 Use Cases A. B. AB All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 366 .

B.network effect 3 Services = 7 Use Cases A. BC. C. AC. ABC All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 367 . AB.

ACD.network effect 4 Services = 15 Use Cases A. AB. BD. ABC. AD. D. BC. ABD. ABCD All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 368 . BCD. B. C. CD. AC.

ABCD. BDE. C. ABD. ABE. BCDE. DE. B. AE. AB. ACDE. ADE. CDE.network effect 5 Services = 31 Use Cases A. CD. BE. ABDE. BCD. AD. ABC. ACE. BCE. ACD. ABCE. E. AC. D. ABCDE All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 369 . BD. BC. CE.

BCD. ABC. BCF. BDEF. ABE. BCDE. CEF. DEF. BCE.network effect 6 Services = 63 Use Cases A. ABCF. ACF. ABDEF. ACDF. ABDEF CDEF ACDEF BCDEF ABCDEF All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 370 . ACD. AC. CE. CF. CDF. AEF. AF. ABDF. C. ABDE. ABCD. CDEF. BF. ABCEF. BDF. BCDF. EF. ACDEF. BD. F. ABEF. ABCDE. E. AD. CDE. D. BCDEF. ADE. ADEF. ABD. AE. ADF. AB. BCEF. ACEF. BE. DF. ABCDF. ACDE. BEF. B. BDE. ABF. ACE. ABCE. DE. CD. BC.

ABCDE. ABCFG. ACF. ACEF. ABCE. ACDEFG. ABG. BCF. AC. ABEFG. ADEF. BEF. ABFG. E. ACDEG. ABCDF. DG. EFG. ABEF. ABCDFG. CEG. ABDEF. ABCEG. ACDF. BCEFG. C. CD. CE. ACE. BCDF. BCDEFG. CDF. ABDEG CDEG ACDEG BCDEG ABCDEG FG AFG BFG ABFG CFG ACFG BCFG ABCFG DFG ADFG. CDEF. ABCDEFG All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 371 . ABCD. BCDEF. ABCEF. ADEFG. CG. BCDFG. ACFG. ABF. BDG. ABDEFG. ABCF. BFG. BDEF. B. ADG. BE. AD. ADF. DE ADE. BCEF. BEFG. ABCDEF. ABDFG. CFG. BDEG. ACDEF. ACEG. ABE. AEF. AEFG. ACDE. BCDE. BCEG. DF. CEFG. BCDG. BCD. DE. AB. AEG. ADEG. BDEFG. FG. CDEFG. CEF. DFG. BF. ABCDEG. BDF. BCFG. ABCG. ABDG. BC. G. BCDEG. BG. ACDG. EF. D. CDEG. ABEG. ADE BDE. ACG. BCE. BCG. CDE. BEG. DEG. AF. ABC. AG. ABDE. AE. DEF. BD. ACDFG. CF. DEFG. ACEFG. AFG. CDFG. ABCEFG. ACD. F. ABCDG.network effect 7 Services = 127 Use Cases A. BDE ABDE CDE ACDE BCDE ABCDE F AF BF ABF CF ACF BCF ABCF DF ADF BDF ABDF. CDG. EG. BDFG. ABDEG. ABD.

ACFG. ABCDEH. AF. BEGH. CDH. ABCDFH. BCGH. BDFG. BCFGH. AE. DEF. EF. BDE. ABCEG. DEGH. ABCDEG. ACEFGH. DEH. BGH. ABCD. ABEFGH. BCEG. BEFGH. BDEG. ABDF. AEFGH. ABCFG. BEFG. ACDF. ACDEH. ACEFH. ADFGH. BFG. ADH. ADF. E. ADFH. BEG. ABC. CGH. CDFH. ACD. CDEH. ABDFG. ABDEFH. AFGH. ABEG. BEH. ABCEH. F. BCDEFGH. ABCDFG. BDEFG. FG. CE. B. BG. ACEGH. ABE. ABD. ACDGH. DF. CEFG. ADEG. ABCDEGH. EH. ABDEG. ACEH. BCDEFG. BCDEG. ABDH. ACEF. ACDH. ACF. ABCDEF. CEGH. BCDFH. ABCG. DH. ABDEGH. AEG. BCDGH. CEFH. CDGH. ABCF. BDFGH. BF. ABDFH. CG. BFGH. BDF. ACDFG. CDEG. ABCDEFG. BCDEH. ABFH. BCDEGH. BDFH. GH. BCDFGH. ABCEF. BCEH. C. ABDEFG. ABFG. AEFH. AEH. EGH. BDEH. CDEF. CFH. ADFG BDFG ABDFG CDFG ACDFG BCDFG ABCDFG EFG AEFG BEFG ABEFG CEFG ACEFG BCEFG. ACDEFH. EFH. AC. ABCDFGH. ABDEH. CEG. BCF. AH. ABGH. BC. BE. BDEFH. CEF. BDEF. DEG. All Hands Meeting 19-22 April 2010 ABCEFGH. ABCDG. ABCGH. BCEFGH. DFG. ABCH. ABCDEFH. D. ADE. ACEG. ABEGH. ABDGH. CDFGH. CDFG. ADEFH. ABG. ADGH. BCDEFH. ABCDEFGH Bluetooth SIG Proprietary and Confidential 372 . ABH. BCEFH. BDGH. BDEGH. BCFG. ACDFH. DEFH. BD. CDEFG. ABEF. BH. H. ACDEF. ADG. BCEF. CDF. ABCFH. AD. ABCDE. AG. DE. BCDEF. CF. BFH. CEH. ADEH. DEFG. BCDH. ABEFH. ABCDH. ABEFG. CFGH. EFG. BCDE. DFGH. AFG. CD. BCEGH. AEFG. AGH. ACFGH. ABCE. BCE. DG. BCG. ACDE. ABDE. CDEFGH. ACDEFG. ABCDGH. BCDF. CH. ADEF. BCDFG. ACDG. ACFH. BEFH. ADFG. FGH. ACH.network effect 8 Services = 255 Use Cases A. FH. ACGH. ADEGH. BDH. ABCEGH. ACDFGH. AEGH. CEFGH. G. BDEFGH. ACDEFGH. ADEFGH. DEFGH. ABEH. BDG. AEF. ACG. CDE. ACE. EFGH. ABDEFGH. EG. AB. CDG. ABDG. BCH. BEF. DFH. BCDG. ABCFGH. ABDF CDF ACDF BCDF ABCDF EF AEF BEF ABEF CEF ACEF BCEF ABCEF DEF ADEF BDEF ABDEF. DGH. BCD. ABCEFG. AFH. ACDEG. ABFGH. ABDFGH. CDEGH. ABCEFH. ABCDF. CFG. ABF. CDEFH. ACEFG. ADEFG. BCFH. ACDEGH.

BCEH. FGH. BEFGH. BEH. CEG. ABCDGH. AEFG. ACEG. BCEG. ABCDEFH. BCH. BDEGH. CFG. CDFG. BFG. DFH. DGH. ACDEGH. B. ABCDFGH. CDFH. G. F. ACEGH. CEGH. BDFG. ABCDEF. CDEF. BCGH. BCDEFG. ADFG. ACDH. C. CDE. ABDFG. CDEFGH. ABCG. ABDE. FG. CF. ACG. ADE. AGH. ABCEG. ABCD. CDH. CE. ABCDEG. ABCDFH. ABFG. BD. AEFGH. CDEG. ACDE. ACDFH. CGH. DEH. DEFGH. ACDEG. BCD. AD. ABCDG. CEFG. BFGH. ABG. CG. ABCDF. BG. BH. ABCDE. ACDEFH. ACDFGH. ACDG. EH. ADFGH. ACF. BCDG. BDEFG. ADEGH. ABCFG. ABCEF. ABCFGH. ADEH. ABCDH. ABDEG. ABCH. ABDF. AFGH. BDH. BE. BCDEGH. ACFG. DEG. BDF. EGH. ABDFH. ADEFGH. CEFH. ABCE. BCDEG. AB. AH. ABEFH. ACEH. DH. ADG. CDFGH. BF. ADFH. DEFH. DG. D. BDG. ABEGH. GH. AEGH. ACEFGH. ABCDEH. ABD. BCF. ABCF. ABDEGH. EFH. BDEG. DE. E. CDGH. ABFH. CEF. EFGH. ACDEF. ABDGH. ADEFG. ABCDEGH. ADEF. BGH. DF. CFH. ABDEFG. ACGH. BCFH. All Hands April 2010 ABCEFGH. EF. CDEFG. BEFG. BCDE. CDEH. ABCFH. BCEF. ABCGH. ABEH. ADEG. AFG. ADEFH. CD.network effect 9 Services = 511 Use Cases A. BDE. BCDGH. ACH. ADH. CEH. BCEGH. ACEF. BCDH. ADGH. ABDEFH. BCFGH. ACE. BDFGH. ABEF. ABE. ABC. AE. ACDEFGH. DFG. BFH. BDEFGH. ABCEGH. BCE. AFH. BCDEH. AEG. ABEFG. ABDEFGH. EFG. ABDEH. ACDEH. EG. AEFH. ABDH. ACD.Meeting 19-22and Confidential… ABCDEFGH. BCDFG. CFGH. BCG. DFGH. ACEFG. CDEGH. ABEG. ACFGH. ACDFG. AG. BCDEF. CDEFH. ACDEFG. ACEFH. BCDEFH. BCEFGH. ABCEFG. ABDG. BCDFGH. BEF. BDEF. BEGH. AEH. ABFGH. BDGH. ACDF. AC. ABDEF. ADF. CDF. BCEFG. CDG. BEFH. DEFG. ABH. ACFH. BCDF. BCDFH. ABCEFH. Bluetooth SIG Proprietary 373 . BDEH. ABCDFG. BCFG. ABEFGH. CEFGH. ABCEH. ABF. FH. DEGH. BEG. CH. ABDFGH. ABCDEFG. ACDGH. AEF. BCDEFGH. BCEFH. BDEFH. BDFH. H. BC. ABGH. AF. DEF.

ABHI. DHI. ABDI. DEFGHI. ABCDI. ABEFI. CDFHI. BCFGHI. ABCEFI. BCI. BCDEFGHI. BGI. ADI. ABDEFHI. ABGI. ABCEHI. ABCFGHI. BCGI. ABFHI. CEFGHI. AEGI. EI. BCDGI. BCEFGI. BCFHI. CGHI. BCHI. ABDEHI. DFGI. CFHI. ABDEFGI. EGHI. CI. ABCDFGI. BCDHI. ABDHI. ABCDEI. ABDGI. ABCDGI. CDEFHI. ACDEFI. AEHI. AEFHI. ABEFHI. CFI. GI. BFGHI. ABCDEGI. BEFGHI. ABFI. BCDI. BDI. ABDEFGHI. ABCFI. ABEFGHI. ADEGHI. BCEGHI. BEGHI. ACFHI. DEGHI. ABGHI. BCEFI. ADGHI. ABI. BCFGI. CDFI. ACEI. ABFGI. ABEHI. ACI. AHI. ACEHI. ACDEI. ACDFGI. BEHI. ABCDEFGI. ACDFGHI. ADHI. GHI. AEFGHI. ADFI. BEFHI. ABCDEHI. ACGI. BCEI. AFGI. CDEFGHI. ADEFHI. BCDEGI. BCEGI. DEGI. ABCI. ACDFHI. ACDEFGHI. CHI. BHI. CFGHI. DI. ABDGHI. ADFGHI. ABCDFGHI. BCFI. ACDFI. BCDEFI. BDEGHI. CDI. BCDFI. ABDFHI. DEFHI. AFGHI. ABCDEFI. DFGHI. BDHI. ADFGI. BDEFI. AEFI. BCDEGHI. ACEFHI. CEHI. FGI. ACEFGHI. FGHI. BCDEHI. ADEFGI. DFHI. ABEGI. EFI. CDHI. FI. BCDEI. EGI. BCDEFGI. ABCDGHI. ABEFGI. ABCEGHI. CDEGHI. ADFHI. BDFHI. AFHI. ACDHI. AGI. ABCEFGHI. EFGI. BDGHI. DEHI. ACDEGI. DEFI. ABCDHI. ABEI. ABCEFGI. CDGI. CEFGI. AGHI. ADEHI. BDEFHI. BCEFHI. EFGHI. ACEFGI. BEGI. CEGHI. DEI. ACEGI. DGI. ABDFGI. BDEFGI. BGHI. BDEFGHI. CDEFGI. BCDEFHI.… I. ABDEFI. BDEHI. BEFI. BCDFGHI. BFI. CDEI. ABCFHI. HI. ACDEFGI. BDFGHI. CDEHI. BCDGHI. EHI. BCDFGI. ADGI. ACHI. AI. ADEFI. ADEGI. CEFHI. CDGHI. CDEGI. EFHI. ABCDFI. ABDFI. ADEFGHI. ABDEGI. ADEI. ABCDEFHI. ACDEGHI. BDFGI. ABCHI. DGHI. CEFI. ABDFGHI. ABCEI. BFHI. ACFGHI. AEGHI. ABFGHI. AEI. CEGI. ABDEI. BCEHI. BCFI ABCFI DFI ADFI BDFI ABDFI CDFI ACDFI BCDFI ABCDFI EFI AEFI BEFI ABEFI CEFI ACEFI. ABCDFHI. DEFGI. BFGI. ACDI. ABCDEFGHI All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 374 . ACEGHI. BDFI. ACDGI. BDEGI. BI. ABCDEGI FGI AFGI BFGI ABFGI CFGI ACFGI BCFGI ABCFGI DFGI ADFGI BDFGI ABDFGI CDFGI. CGI. ABCEFHI. AEFGI. ACDEHI. ABCFGI. FHI. DFI. BCGHI. ACDGHI. ABEGHI. ACFI. BCEFGHI. AFI. ACDEFHI. BDGI. ABCGHI. CEI. ACGHI. ABCEGI. ABCGI. BDEI. ABCDEGHI. CFGI. ACFGI. ABDEGHI. CDFGHI. CDEFI. BEFGI. BCDFHI. BEI.

267.401.703.network effect 100 Services = 1.375 1 267 650 600 228 229 401 496 703 205 375 Possible Use Cases All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 375 .600.496.229.205.228.650.

network effect 200 S i Services = ~1.6 * 1060 P ibl Use C 16 Possible U Cases All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 376 .

just 200 Services ≈ novemdecillion Use Cases All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 377 .

SIMPLE REMOTE CONTROL SERVICES AND SCHEMAS «Simple Remote Control» service on TV / DVD / Player g «Immediate Target CP» characteristic When written to – command performed Remote Control Device Use Case just a client to the «Simple Remote Control» service All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 378 .

PROXIMITY SERVICES «Immediate Alert» service «Alert Level» characteristic immediately alert to given level «Tx Power» service «dBm» characteristic readable transmit power level «Link Loss Alert» service «Alert Level» characteristic alert upon link loss All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 379 .

PROXIMITY USE CASES Link Loss Proximity Use Case p use the «Link Loss Alert» service to alert upon link loss can also alert locally upon link loss Range Proximity Use Case read «Tx Power» service s characteristic service’s calculate path loss based on Tx Power and RSSI use «Immediate Alert» service to alert when outside range All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 380 .

AUTOMATION SERVICES «Light Control» service «Power On Off» characteristic readable / writable. or toggle state «Appliance Power» service «Power On Off» characteristic readable / writable. turns light on and off «Power CP» characteristic control point to turn light on and off. turns appliance on and off All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 381 .

AUTOMATION SCHEMAS Lighting Control Use Case uses «Light Control» service to turn lights on and off can read «Light Control» to determine if lights still on or off Appliance Control Use Case uses «Appliance Control» service to turn on appliances Timed Appliance Use Case uses «Appliance C t l and «Current Ti A li Control» d C t Time» services i allows appliances to turn on / off at set times All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 382 .

etc. 45. week) All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 383 . day. minutes time «Historic Usage Data» characteristic averaged usage data (per hour. 30.AUTOMATION SERVICES «Utility Meter» service «Current Use» characteristic how much are you using now «Current Cost» characteristic how much is it costing per unit «Future Costs» characteristic how much will it cost in 15.

AUTOMATION SERVICES «Energy Broker» service gy q «Energy Request CP» characteristic written by appliances that want to “book” energy can include QoS requirements «Energy Grant» characteristic notified to appliances with energy grants can be re-notified if grant is taken away due to high priority demands / grid demands / cost All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 384 .

MEDICAL SERVICES «Heart Rate» Service «Heart Rate» characteristic what is the current heart rate can be notified once a second «Heart Rate RR» characteristic what is the current heart rate / RR value can be notified once a second All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 385 .

MEDICAL SERVICES «Weighing Scale» Service g g «Weight kg» characteristic what was the last weight being measured «Weight lbs» characteristic what was the last weight being measured All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 386 .

MEDICAL SERVICES «MDS» Service p y characteristics for IEEE 11073-20601 compatibility can be referenced by other services All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 387 .

either when it wants or will setup notifications to get constant reports just one schema for all sports devices Continua Use Case uses «MDS» service to recreate 20601 state information optimized over the air – interoperable functionality after LE All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 388 .MEDICAL SCHEMA Sports & Fitness Use Case y p can use any of the sport device services will read data.

PTS OVERVIEW All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 389 .

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 390 . qualification thus making Bluetooth product development more accessible and efficient.MISSION Strengthen Bluetooth technology by creating a wireless testing tool with unmatched quality and test coverage Lower cost of coverage.

RESPONSIBILITY Test suite Validated Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes No Support existing test suites Add test support for new specifications • Basic Rate • Low Energy • High Speed A2DP AVRCP BPP HCRP DUN HFP15 IOPT PBAP FTP HID BIP OPP SAP PAN HDP HSP MAP SYNC L2CAP MCAP Improve usefulness of PTS • • • • Improve usability Debugging functionality gg g y Test Reporting Automation All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 391 .

Low Energy and High Speed Rate Release PTS test suites together with new specifications Provide tools required for members to automate their testing All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 392 .VISION Support Bluetooth testing for all profiles and protocols above HCI Work toward a standardized PTS hardware that supports Bluetooth Basic Rate.

NEW TOOLS MAKE PAIRING EASIER All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 393 .

NEW TOOLS MAKE PAIRING EASIER All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 394 .

NEW TOOLS MAKE PAIRING EASIER All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 395 .

NEW TOOLS MAKE PAIRING EASIER Bluetooth Search Choose Device Scroll to select device Acme Pedometer Acme P d A Pedometer ? Acme Pedometer Connect Exit All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 396 .

NEW TOOLS MAKE PAIRING EASIER Bluetooth Search Choose Device Scroll to select device Acme Pedometer Acme P d A Pedometer ? Acme Pedometer Connect Exit All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 397 .

NEW TOOLS MAKE PAIRING EASIER Bluetooth Search Choose Device Scroll to select device Acme Pedometer Acme P d A Pedometer ? Acme Pedometer Connect Exit All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 398 .

NEW TOOLS MAKE PAIRING EASIER

Bluetooth Search Choose Device

Scroll to select device Acme Pedometer Acme P d A Pedometer ? Acme Pedometer

Connect

Exit

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

399

PTS OVERVIEW

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

400

MISSION Strengthen Bluetooth technology by creating a wireless testing tool with unmatched quality and test coverage Lower cost of coverage. qualification thus making Bluetooth product development more accessible and efficient.

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

401

RESPONSIBILITY
Test suite Validated Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes No

Support existing test suites Add test support for new specifications
• Basic Rate • Low Energy • High Speed

A2DP AVRCP BPP HCRP DUN HFP15 IOPT PBAP FTP HID BIP OPP SAP PAN HDP HSP MAP SYNC L2CAP MCAP

Improve usefulness of PTS
• • • • Improve usability Debugging functionality gg g y Test Reporting Automation

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

402

VISION Support Bluetooth testing for all profiles and protocols above HCI Work toward a standardized PTS hardware that supports Bluetooth Basic Rate, Low Energy and High Speed Rate Release PTS test suites together with new specifications Provide tools required for members to automate their testing

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

403

BLUETOOTH LOW ENERGY TESTING

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

404

GOALS Dynamic product development Interoperable products Simple testing Enable E bl generic clients i li t Inexpensive solution

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

405

PRODUCTS
# Implementations

HCI

All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential

406

PRODUCTS # Implementations HCI LE chip Below HCI Few Implementations TTCN test vectors All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 407 .

 GATT More implementations HCI LE chip Below HCI Few Implementations TTCN test vectors All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 408 .PRODUCTS # Implementations PTS LE stacks L2CAP. ATT . SM L2CAP SM GAP.

 ATT . SM L2CAP SM GAP.PRODUCTS # Implementations Low Energy Tester LE use cases PTS LE stacks L2CAP. GATT More implementations HCI LE chip Below HCI Few Implementations TTCN test vectors All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 409 .

LOW ENERGY DEVICES GATT and below will be qualified as before GATT based specifications will have a new model Applications SW Module GATT  SM ATT L2AP            HCI LL  RF  All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 410 .

GAP and GATT will be tested by PTS GATT testing will include several configurations A virtual device library can be used All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 411 .PTS TESTING SM.

XML CREATION TOOL AND PTS Member product definition Product A LE product  definition tool (Online) www.org Testing PTS + XML = TC XML  Document All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 412 .bluetoth.

ENABLING TECHNOLOGY XML • XSD (Schema Definition) created for GATT ( ) Profile authoring tool • Enable existing characteristics and services to be reused and configured • Allow new characteristics and services to be defined and configured f f • Export XML describing profile Device de o au o g tool e ce definition authoring oo • Enable profiles to be selected and configured for the device • Exports xml schema for the device • Exports sample device data structure for the device Live attribute browser in PTS All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 413 .

LOW ENERGY PROFILE TESTING TOOLS All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 414 .

RECENT UPDATES LOW ENERGY Low Energy Beta test suites • • • • L2CAP SM (not released) GAP (not released) GATT Testing approach All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 415 .

J l Testing (first i ) July H2 – LE higher layer specs All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 416 .ACTIVITIES LOW ENERGY L2CAP completed but need updates for spec changes GAP test suite .May GATT T ti (fi t version) .May SM test suite .

PROBLEMS AND RISKS Test Specifications is changing Features not supported in stack and hardware No products available for testing PTS L Energy hardware availability Low E h d il bilit All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 417 .

PTS HARDWARE Temporary USB based solution • Ready this summer • Limited samples available A permanent USB dongle will come later All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 418 .

SUMMARY All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 419 .

co-sponsored by Frontline Test Equipment. Inc. All Hands Meeting 19-22 April 2010 Bluetooth SIG Proprietary and Confidential 420 .THANK YOU! Join Us at 17:30 at Fox Sports Grill for the Welcome Reception.

Sign up to vote on this title
UsefulNot useful