Bluetooth Baseband

Chingwei Yeh2001/9/10

Outline

¬Introduction¬Masters, Slaves, and Piconets

¬System Timing¬Physical Links: SCO and ACL¬Bluetooth Packets

¬Logical Channels¬Synchronization

¬Higher Protocol Stack¬Link Manager (LM)

¬Link Controller (LC)¬Baseband¬RF

Scope

Link Controller & Baseband (1)

¬LM – Link-level and medium access

management

¬LC– Packet-level access control

¬PHY:– Baseband: packet-level processing and

timing

– RF

Link Controller & Baseband (2)

¬LC: commanded by LM– Local & remote LC entities manage the

packet-by-packet process of establishing the link

– Maintain the link once established

¬Baseband: commanded by LC– Channel coding/decoding

– Low-level timing control and management

Link Controller & Baseband in the Bluetooth Spec.

Bluetooth Device Address

¬BD_Addr[47:32] (NAP[15:0])– Used to initialize the encryption engine stream

LFSR

¬BD_Addr[31:24] (UAP[7:0])– Used to initialize the HEC and CRC calculation

for frequency hopping

¬BD_Addr[23:0] (LAP[23:0])– Used by sync word generation and frequency

hopping

Masters, Slaves, and Piconets

¬Master — the device which initiates an exchange of data

¬Slave — the device which responds to the master

Time Division Multiplexing and Time Slots

¬625 µs/slot

¬CLKN (312.5 µs): 0 to 227 –1, cyclic

Multi-Slot Packets

Frequency Hopping

¬Hopping Mechanism– All devices in a piconet hops in synchrony

with the Master– Each device will hop once per packet*

¬Benefits– Security– Reliability

¬Tradeoff*equivalent for multi-slot packets

Hopping Sequence

¬A pseudo-randomly determined frequency sequence

¬Clocks– CLKN —native clock of the device

– CLK —Master clock of the piconet• CLKN of the piconet Master device

– CLKE —estimate of CLKN of the slaves

¬Hopping sequence determined by the Master (CLK and Master LAP)

Piconet and Scatternet (1)

¬Two or more units sharing the same hopping sequence form a piconet(similar to a LAN)

¬Each piconet can have – only one master

– up to seven slaves

¬Multiple piconets form a scatternet

Piconet and Scatternet (2)

Timing

¬Master clock synchronizes the piconet

Multi-slave Timing

Important Clock Ticks

0123456789101112… .27

Half-slot Rate=312.5 µs

Slot Rate=625 µs

Slot-pair Rate=1.25ms

Page/InquiryScan Rate=1.28s

Clock Wrap

Simple Calculations

¬±10us, ±20ppm between the Master and Slaves– Allows for a Salve to be left alone for up to

800 slots

¬DH5:– 2870µs x 40ppm = 0.12 µs (1/8 symbol

period)

– very simple timing recovery

(20 µs / 625 µs ) / 40ppm = 800

Physical Links

¬Asynchronous Connection-less (ACL)¬Synchronous Connection Oriented

(SCO)

ACL

¬An ACL link is formed immediately after a connection is established.

¬A Master may have multiple ACL links to the slaves, but only one link can exist between any two devices.

¬A slave is permitted to return an ACL packet in the slave-to-master(é) slot if and only if it has been addressed in the preceding master-to-slave slot(ê).

¬Broadcast packets are ACL packets not addressed to any specific slaves.

SCO

¬A SCO provides a symmetric link between Master and Slave with reserved channel bandwidth and slots.¬A Master can support up to three SCO links. ¬A slave

– can support up to three SCO links from the same master

– two SCO links if the links are originated from different masters.

¬SCO packets are never retransmitted. ¬SCO > ACL

SCO

¬TSCO , DSCO , and SCO interval

¬SCO is setup via the Link Manager Protocol (LMP).– LMP control messages (e.g. broadcast) > SCO

slots

¬ Initialization– Master CLK[27:1] mod TSCO = DSCO

– Master (CLK[27], CLK[26:1]) mod TSCO = DSCO

Bluetooth Packets

¬Little Endian

¬Each packet consists of 3 entities:– Access code

– Header

– Payload0–2712

Access Code

¬ To catch– A broadcast packet– The packet to a specific slave

¬ Actions involved – DC offset compensation

– Clock recovery and Synchronization – Identification

0–2712

Different Access Codes (1)

¬Channel Access Code (CAC)– Derived from Master’s LAP and CLKN

– Used by all devices in a piconet during connection

¬Device Access Code (DAC)– Derived from a specific device’s LAP and

CLKN

– Used in Paging/Page Scan

Different Access Codes (2)

¬Inquiry Access Code (IAC)– General Inquiry Access Code (GIAC)

• Used by all devices during the inquiry procedures, as no prior knowledge of anyone’s LAP exists.

• Fixed (0x9E8B33)

– Dedicated Inquiry Access Code (DIAC)• For the inquiry of specific set of devices like printers

and handsets• 0x9E8B00 —0x9E8B3F• Generic Access Profile indicates only the Limited

Inquiry Access Code (LIAC, 0x9E8B00) should be used.• Use on a temporary basis

Different Access Codes (3)

Access Code Format

Access Code — Preamble

¬ The sequence 1010 or 0101, depending on whether the LSB of the following sync word is 1 or 0.

¬ This gives the DC thresholding and clock recovery circuitry only 5µs to create a reliable clock signal, with which to sample and clock in the remainder of the data.

Access Code — Trailer

¬The trailer sequence is either 1010 or 0101 depending on whether the MSB of the sync word is 0 or 1.

Access Code — Sync Word

¬Total 64 bits.

¬The 34-bit BCH parity word is the key element of the sync word– very high autocorrelation

– very low co-correlation

Barker Sequence

LAPBCH Parity

Word34 bits 24 bits 6 bits

Access Code — Sync Word

¬Sync word– Match: the packet is intended for the receiving

device.

– No-match: the radio can be shut down to conserve power.

¬The point in time at which the correlator match —Master is exactly 68µs into its slots.– This allows the Slave to re-adjust its own sub-

slot timing to match up with the Master to within 1 µs.

Header

0–2712

Header Protection against Erross

¬Each field is crucial — total 18 bits protected by a Forward Error Correction (FEC) code of 1/3, resulting in 54 bits.

Header — AM_ADDR

¬Distinguishes the active members participating on the piconet.

¬Max. of 7 slavesà3 bits¬The all-zero address is reserved for

broadcasting packets, with the FHS packet as the only exception.

Header — TYPE

¬Types of traffic: SCO, ACL, NULL, POLL, ID, FHS.

¬Types of error correction used for the payload.¬How many slots the payload will last.

Header — FLOW

¬ Used for flow control of packets over the ACL link.¬When the RX buffer in the recipient is full and is not

emptied, FLOW=0 is returned to stop the transmission of data temporarily. – Only applicable to ACL packets.– Packets containing only link control information

(ID, POLL, and NULL packets) or SCO packets can still be received.

¬When the RX buffer is empty, FLOW=1 is returned. – When no packet is received, or the received

header is in error, FLOW=1 is assumed implicitly.

Header — ARQN

¬ARQN=1(0) informs the sender of a successful (failed) transfer of payload data with a cyclic redundancy check (CRC) code– Positive acknowledge: ACK

– Negative acknowledge: NAK

¬When no return message regarding acknowledge is received, a NAK is assumed and data is re-transmitted. NAK is also the default return information.

Packet Header — SEQN

¬The SEQN bit provides a sequential numbering scheme to order the data packet stream.

¬For each new transmitted packet that contains data with CRC, the SEQN bit is inverted.

¬By comparing the SEQN of consecutive packets, correctly received retransmissions can be discarded.

Header —HEC

¬Header Error Check (HEC) is simply a CRC function performed on the header. The HEC consists of an 8-bit word generated by the polynomial 647(octal representation).¬Before generating the HEC, the HEC

generator is initialized with an the Master or Slave UAP or All-zero 8-bit values, depending on the packet. ¬ If the HEC does not pass, the entire packet

is discarded.

Payload

0–2712

Payload Content

¬ACL packets only have the data field.¬SCO packets only have the voice field

with the exception of the DV packets.¬Voice Field

– 240 bits for HV packets

– 80 bits for DV packets

Payload —Data Field (1)

Undefined

[0 or 4]

Length

[5 or 9]Flow [1]L_CH [2]

CRC [16]Payload

[0-2712]

Payload Header

[8 or 16]

Payload —Data Field (2)

¬ Packets in segments 1 & 2 have a 1-byte payload header (see Packet Types)

¬ Packets in segments 3 & 4 have a 2-bytes payload header (see Packet Types)

¬ The payload header specifies the logical channel (L_CH), controls the flow on the logical channels (FLOW), and the payload length (5 bits and 9 bits for 1-byte and 2-bytes payload header, respectively).

¬ In the case of a 2-byte payload header, the length indicator is extended by four bits into the next byte. The remaining four bits of the second byte are reserved for future use and shall be set to zero.

Payload Header (Data Field)

¬L_CH– 00 Undefined– 01 Continue of an L2CAP message– 10 Start of an L2CAP message– 11 LMP message

¬FLOW– Flow control at the L2CAP level (1 if L_CH=11)– Set by LM

• No real-time requirements (real-time flow control at packet level is carried out via the FLOW bit in thepacket header)

CRC

¬ The 16-bit CRC code is generated by the CRC-CCITT polynomial 210041 (octal representation). Before determining the CRC code, an 8-bit value is used to initialize the CRC generator.

¬ For the CRC code in the FHS packets sent in master page response state, the UAP of the slave is used.

¬ For the FHS packet sent in inquiry response state, the DCI (all-zero) is used.

¬ For all other packets, the UAP of the master is used.

Packet Types (1)

¬ It is the responsibility of LM to monitor the quality and reliability of the link and decide what packet types to use at any given time.

¬LMP_max_slot_req– LMP_accepted, LMP_not_accepted

¬Single-slot packet is used by default.

¬Asymmetric bandwidthàdifferent packet type in different transmission directions

Packet Types (2)

¬ Segment 1 (NULL, POLL, FHS, DM1): reserved for the four control packets common to all physical link types.

¬ Segment 2 (HV1-3, DV, DH, AUX1): reserved for packets occupying a single time slot.

¬ Segment 3 (DM3, DH3): reserved for packets occupying three time slots. ACL defined only.

¬ Segment 4 (DM5, DH5): reserved for packets occupying five time slots. ACL defined only.

Common Packet Types

¬ID packet¬NULL packet

¬POLL packet¬FHS packet¬DM1 packet

ID Packet

¬The identity (ID) packet consists of the device access code (DAC) or inquiry access code (IAC).

¬ It has a fixed length of 68 bits.

¬ It is a very robust packet since the only info it carries is the access code of the sender.

NULL Packet

¬The NULL packet has no payload and therefore consists of the channel access code and packet header only.

¬ Its total (fixed) length is 126 bits.

¬The NULL packet is used to return link information to the source regarding the success of the previous transmission (ARQN), or the status of the RX buffer (FLOW).

POLL Packet

¬ Similar to the NULL packet —does not have a payload

¬ In contrast to the NULL packet — requires a confirmation from the recipient

¬ Used by the master in a piconet to check the presence of the slaves, which must then respond even if they do not have information to send. The return packet is an implicit acknowledgement of the POLL packet.

¬ The POLL packet does not affect the ARQN and SEQN fields.

FHS Packet (1)

¬ A special control packet revealing, among other things, the Bluetooth device address and the clock of the sender.

¬ The payload contains 144 information bits plus a 16-bit CRC code. The payload is coded with a rate 2/3 FEC which brings the gross payload length to 240 bits.

¬ Used in page master response, inquiry response and in master slave switch.

¬ The payload consists of 11 fields.

FHS Packet (2)

BCH Parity Word

FHS Packet (3)

FHS Packet (5)

FHS Packet (6)

DM1 Packet

¬Data – Medium rate

¬DM1 serves as part of segment 1 in order to support control messages in any link type. However, it can also carry regular user data.

¬Since the DM1 packet is recognized on the SCO link, it can interrupt the synchronous information to send control information.

SCO Packets

¬Typically used for 64kb/s speech transmission

¬HV1 packet¬HV2 packet¬HV3 packet

¬DV packet

HV1 Packet

¬High-quality Voice

¬The HV1 packet carries 10 information bytes. The bytes are protected with a rate 1/3 FEC.

¬Payload length is fixed at 240 bits.

¬No CRC. No payload header.

¬A HV1 packet can carry 1.25ms of speech at a 64 kb/s rate. In that case, an HV1 packet has to be sent every two time slots (TSCO =2).

HV2 Packet

¬The HV2 packet carries 20 information bytes protected with a rate 2/3 FEC.

¬The payload length is fixed at 240 bits.

¬No payload header, No CRC.

¬ If the HV2 packet is used for voice at a 64 kb/s rate, it can carry 2.5ms of speech. In that case, an HV2 packet has to be sent every four time slots (TSCO =4).

HV3 Packet

¬The HV3 packet carries 30 information bytes. The bytes are not protected by FEC.

¬The payload length is fixed at 240 bits.

¬No CRC. No payload header.

¬ If the HV3 packet is used for voice at a 64 kb/s rate, it can carry 3.75ms of speech. In that case, an HV3 packet has to be sent every six time slots (TSCO =6).

DV Packet (1)

¬ The DV packet is a combined data-voice packet. ¬ The payload is divided into a voice field of 80 bits

and a data field containing up to 150 bits.¬ The voice field is not protected by FEC. The data

field contains up to 10 infor-mation bytes (including the 1-byte payload header) and includes a 16-bit CRC. The data field is encoded with a rate 2/3 FEC.

¬ The voice field is handled like normal SCO data and is never retransmitted; that is, the voice field is always new. The data field is checked for errors and is retransmitted if necessary.

DV Packet (2)

ACL Packets

¬DM1 packet¬DH1 packet

¬DM3 packet¬DH3 packet¬DM5 packet

¬DH5 packet¬AUX1 packet

DM1 Packet

¬ The DM1 packet is a packet that carries data information only.¬ The payload contains up to 18 information bytes (including

the 1-byte payload header) plus a 16-bit CRC code. The DM1 packet may cover up to a single time slot.

¬ The information plus CRC bits are coded with a rate 2/3 FEC which adds 5 parity bits to every 10-bit segment. If necessary,extra zeros are appended after the CRC bits to get the total number of bits(information bits, CRC bits, and tail bits) equal a multiple of 10.

¬ The payload header in the DM1 packet is only 1 byte long. The length indicator in the payload header specifies the number of user bytes(excluding payload header and the CRC code).

DH1 Packet

¬ This packet is similar to the DM1 packet, except that the information in the pay-load is not FEC encoded.

¬ DH1 packet can carry up to 28 information bytes plus a 16-bit CRC code.

¬ The DH1 packet may cover up to a single time slot.

DM3 Packet

¬ The DM3 packet is a DM1 packet with an extended payload. The DM3 packet may cover up to three time slots.

¬ The payload contains up to 123 information bytes (including the 2-bytes payload header) plus a 16-bit CRC code. The pay-load header in the DM3 packet is 2 bytes long,

¬ The length indicator in the payload header specifies the number of user bytes (excluding payload header and the CRC code).

¬ When a DM3 packet is sent or received, the RF hop frequency shall not change for a duration of three time slots (the first time slot being the slot where the channel access code was transmitted).

DH3 Packet

¬ This packet is similar to the DM3 packet, except that the information in the pay-load is not FEC encoded.

¬ DH3 packet can carry up to 185 information bytes (including the two bytes payload header) plus a 16-bit CRC code.

¬ The DH3 packet may cover three time slots. When a DH3 packet is sent or received, the hop frequency shall not change for a duration of three time slots (the first time slot being the slot where the channel access code was transmitted).

DM5 Packet

¬ The DM5 packet is a DM1 packet with an extended payload. The DM5 packet may cover up to five time slots.

¬ The payload contains up to 226 information bytes (including the 2-bytes payload header) plus a 16-bit CRC code.

¬ The pay-load header in the DM5 packet is 2 bytes long. The length indicator in the pay-load header specifies the number of user bytes (excluding payload header and the CRC code). When a DM5 packet is sent or received, the hop frequencyshall not change for a duration of five time slots (the first time slot being the slot where the channel access code was transmitted).

DH5 Packet

¬ This packet is similar to the DM5 packet, except that the information in the pay-load is not FEC encoded.

¬ DH5 packet can carry up to 341 information bytes (including the two bytes payload header) plus a 16-bit CRC code.

¬ The DH5 packet may cover five time slots. When a DH5 packet is sent or received, the hop frequency shall not change for a duration of five time slots (the first time slot being the slot where the channel access code was transmitted).

AUX1 Packet

¬ This packet resembles a DH1 packet but has no CRC code. ¬ The AUX1 packet can carry up to 30 information bytes

(including the 1-byte payload header).

¬ The AUX1 packet may cover up to a single time slot.

Packet Summary (1)

Packet Summary (2)

ISM Overhead

¬ACL data packets– 142 non-data bits (72b access code, 54b packet

header, 16b CRC)

¬DH5 packets in asymmetric transmission– 5 slots– 339 bytes = 2712 bits of data– 2712+142 = 2854 bits transmitted in total– 2712 bits / (6 * 625µs) = 723.2 kb/s < 1Mb/s

¬Necessary overhead to provide a robust link over the ISM band.

More Calculations

¬DH5 Asymmetric (DH5, DH1)– 339 bytes / (6 * 625µs) = 723.2 kb/s

– 27 bytes / (6 * 625µs) = 57.6 kb/s

¬DH5 Symmetric (DH5, DH5)– 339 bytes / (10 * 625µs) = 433.9 kb/s

Packet Summary (3)

Logic Channels

¬ LC (Link Control)– Carried out via the packet header

¬ LM (Link Manager)– Typically carried by DM0 type packets with L_CH=11– DM1 is common to SCO and ACL, allowing LMP messages

to be carried over an active SCO link

¬ UA / UI (User Asynchronous)– Carried by ACL payload

¬ US (User Synchronous)– Carried by SCO payload

Synchronization (1)

Correlator open RX Timeout

TMatch

TX Slot RX Slot

Synchronization (2)

¬Start of packet header– TMatch + 1 µs for 68b access code

– TMatch + 5 µs for 72b access code (with trailer)

¬Offset from the Master = TMatch - 68µs– The updated CLKE and sub-slot count are

applied immediately.

Link Control

Chingwei Yeh2001/9/10

Outline

¬Link Control Protocol¬Link Controller States and Operations

¬Master / Slave Role Switching¬Low-power Operation

Link Control Protocol

¬Carried in the LC channel¬Responsible for maintaining a link once

it has been set up

ARQN

¬ARQN=0: previous receive failed– Access code failure

• A Slave fails to detect an access code (not possible)• A Master fails to detect an access code

– Header failure• Slave side: an access code is detected but HEC fails

(not possible due to corrupted AM_ADDR)• Master side: an access code is detected but HEC fails

– Payload failure• An access code is detected but CRC fails • The usual reason for re-transmission during connection

SEQN

¬SEQN– Toggled each time a new packet with a CRC is

transmitted

– Remains the same otherwise

¬Used to differentiate – receiver NAK’d the previous packet

– transmitter failed to receive the receiver’s ACK

¬Same SEQNàpacket ignored, but ACK returned

ARQ/SEQ under Broadcast

¬ARQ scheme is not applicable

¬Re-transmit broadcast packets a specified number of times (NBC )

¬Each new broadcast packet in a sequence is identified by toggling SEQN– Spec 1.0B resets SEQN upon each start of LMP

and L2CAP ?!

Link Controller States

¬Standby¬Inquiry

¬Inquiry Scan¬Page¬Page Scan

¬Connection– Active, Hold, Sniff, Park

In Standby, Hold, Parkthe device may be drivenby a LPO with ±250ppm.

Inquiry and Inquiry Scan

Inquiry (1)

¬To discover all Bluetooth enabled devices in its local area¬Baseband end of the Service Discovery

Protocol (SDP)¬May be initiated one-shot or periodically

(HCI_Periodic_Inquiry_Mode) ¬ Inquired upon devices supply FHS

– CLKN, BD_ADDR, etc

Inquiry (2)

¬A device in the inquiry substate does not acknowledge the inquiry response. – It just keeps probing at different hop

channels and in between listens for response packets.

¬Stops when– Instructed

– inquiryTO

What to Inquire

¬No knowledge of the environment– No BD_ADDR, CLK, etc

¬Both the inquirer and inquiry scanner uses the same hopping sequence determined by GIAC LAP– Still can not communicate even the same

hopping sequence is used

Inquiry Objective

¬Objective: to capture the scanners as quickly as possible.¬Only need to match the frequency for one

slot pair to allow information retrieval. ¬Basic Concept

– Use the same hopping sequence– The inquirer hops fast– The inquiry scanners hop slow– Eventually they will meet

The Hop of the Inquirer

¬GIAC+CLKN(inquirer)→the hopping sequence for inquiry.

¬A train of identical GIACs at different hopping frequencies

¬Frequencies in the train is designed to surround a central frequency– Although it seems alright to use any sequence

through the spectrum, the spec. aligned the inquiry sequence to that of the page.

Inquirer — Fast Hopping

¬ TX transmits on two different hop frequencies.

¬ RX listens on two different hop frequencies.

¬ ID packet (68bits)→312.5–68–20(uncertainty) = 224.5us to switch the freq. synthesizer.

Inquiry Trains (1)

¬A train of identical GIACs at different hopping frequencies.

¬Frequencies in the train is designed to surround a central frequency

¬The central frequency is determined by the hopping sequence.

¬The hopping sequence is determined by the general inquiry address– GIAC LAP + 4 LSBs of the DCI (pp. 137, pp. 54)

Inquiry Trains (2)

Inquiry Train A

¬16 different hop frequencies in 16 slots (10 ms)

¬Train A– f(k-8), f(k-7), … ,f(k), … ,f(k+7)

– Covers –8x1.28s to 7x1.28s deviation from CLKN(inquirer)

– f(k) is one frequency in the hopping sequence, which is determined by CLKN16-12 (CLKN15-12) (changed every 1.28s, regardless of Ninquiry ≥ 256)

16 * 625µs = 10ms

Inquiry Train B

¬16 different hop frequencies in 16 slots (10 ms)

¬Train B– f(k-16), f(k-15), … ,f(k-9),f(k+8) … ,f(k+15)

– Covers drifts from CLKN that are• Less than –8*1.28s• More than 7*1.28s• f(k) is one frequency in the hopping sequence, which is

determined by CLKN16-12 (CLKN15-12) (changed every 1.28s, regardless of Ninquiry ≥ 256)

Inquiry Train Usage (1)

¬Ninquiry of train A → Ninquiry of train B →Ninquiry of train A → Ninquiry of train B (three train switches)

¬Ninquiry ≥ 256¬Alternately use train A and B until

– A response is received

– inquiryTO is exceeded

Inquiry Train Usage (2)

¬Train A and B– Each train is repeated at least Ninquiry≥256 times

– At least three train switches must be taken place

– So, inquiry substate lasts for at least 256*10ms*4=10.24s

¬ If inquiry is activated periodically, the interval between two inquiry instances must be determined randomly (avoiding inquiry synchrony, HCI_Periodic_Inquiry_Mode )

Inquiry Train Illustration

128TB… .128 TA128 TB128 TB128 TA128 TA

Ninquiry (=256)

3 train switches, 4*256*10ms = 10.24s

16151413121110987654321

128*(16*625us)=1.28s

16*625us = 10ms

Entering Inquiry

¬ Inquiry can be entered from– STANDBY

– CONNECTION

¬Entering from connection– Hold or Park ACL– Interrupted by SCO — increase scan window

Inquiry Scan (1)

¬A device wanting to be discovered could conduct an inquiry scan until it has responded to an inquiry, then do a mandatory page scan. If that doesn’t result in a connection, go back into inquiry scan.– Battery, radio receiver power consumption– Continuous scanning would cause existing

connections to timeout

¬So, scan in short bursts!– Short bursts (18 slots,11.25ms), short interval (≤

2.56s)

Inquiry Scan (2)

¬Hop sequence is determined by GIAC.¬The phase is determined by CLKN16-12 of the

scanner. – Scan at a single hop frequency in 1.28s– Hops every 1.28s

¬Listen to GIAC/DIAC for at least 18 slots in Tscan interval (≤ 2.56s in spec, and stay in discoverable mode for at least 30.72s

Entering Inquiry Scan

¬Inquiry scan can be entered from– STANDBY

– CONNECTION

¬Entering from connection– Hold or Park ACL

– Interrupted by SCO — increase scan window

Inquiry Scan with SCO

¬One SCO link(HV3, TSCO = 6 slots)– Tw inquiry scan at least 36 slots(22.5ms)

¬Two SCO link(HV3, TSCO = 6 slots)– Tw inquiry scan at least 54 slots(33.75ms)

¬The inquiry scan interval shall be at most 2.56s

SCO During Inquiry Scan

Correlator O

pensFor inquiry scan

2x625us

625us 366us

Ratio Settle Time150us — 200us

±10us

RX TX

ID FHS

Correlator O

pensFor inquiry scan

Inquiry ScanSlot Pair Starts

SCO SlotPair Starts

êêééêêééêêéé= 50% waste if one SCO inevery 3 slot pairs

Inquiry Response (1)

¬Only slave responds (with FHS packet)¬Multiple devices may respond at the

same timeàcollision!

Inquiry Response (2)

¬Response steps (to avoid collision)– Received inquiry messageàRAND 0~1023– Memorize the phase in the hopping sequence– Return to CONNECTION or STANDBY for at

least RAND time slots– inqrespTO counter starts– Listen for inquiry message with inqrespTO, and if

correctly received• Return FHS (Master collects information now)• Phase++

– Return to inquiry scan

Inquiry Response (3)

¬In 1.28s, the slave responds 4 times in average.

(1.28s/625µs)/(RAND/2)=4

Page and Page Scan

Page

¬To establish a connection, the Master is instructed by the application to carry out the paging procedure.

¬Using the Slave’s access code and timing information gathered previously.

¬FHS packets in-between

What to Page

¬The Master knows the device– BD_ADDR (DAC)

– CLKE

¬Need to make CLKE as precise as possible

¬Both the pager and page scanner use the same hopping sequence determined by DAC LAP– Still may not communicate properly even the

same hopping sequence is used

Page Objective

¬Objective: to capture the offset of phase as quickly as possible.

¬Basic Concept– Use the same hopping sequence (DAC)

– The pager hops fast

– The page scanner hops slow

– Eventually they will meet

The Hop of the Pager

¬DAC+CLKE(pager)→the hopping sequence for inquiry.¬A train of identical DACs at different hopping

frequencies¬Frequencies in the train is designed to

surround a central frequency¬CLKE(pager)

– Last encounter with the Slave (e.g., the previous inquiry)

Pager — Fast Hopping

¬ TX transmits on two different hop frequencies.

¬ RX listens on two different hop frequencies.

¬ ID packet (68bits)→312.5-68-20(uncertainty) = 224.5us to switch the freq. synthesizer.

Paging Trains (1)

¬A train of identical DACs at different hopping frequencies.

¬Frequencies in the train is designed to surround a central frequency¬The central frequency is determined by

the hopping sequence.

¬The hopping sequence is determined by the DAC

Paging Trains (2)

Paging Train A

¬16 different hop frequencies in 16 slots (10 ms)¬Train A

– f(k-8), f(k-7), … ,f(k), … ,f(k+7)– Covers –8*1.28s to 7*1.28s deviation from

CLKE(pager)

– f(k) is one frequency in the hopping sequence, which is determined by CLKE16-12 (pager) (CLKE15-12 (pager) in half-hop systems)

– Phase changed every 1.28s, regardless of Npage

16 * 625µs = 10ms

Paging Train B

¬16 different hop frequencies in 16 slots (10 ms)¬Train B

– f(k-16), f(k-15), … ,f(k-9),f(k+8) … ,f(k+15)– Covers drifts from CLKE(pager) that are

• Less than –8*1.28s• More than 7*1.28s

– f(k) is one frequency in the hopping sequence, which is determined by CLKE16-12 (pager) (CLKE15-12 (pager) in half-hop systems)

– Phase changed every 1.28s, regardless of Npage

Paging Train A & B Usage

¬Npage of train A → Npage of train B → … .¬Alternately use train A and B until

– Receive a response

– pageTO is exceeded

Paging Train Illustration

128TB… .128 TA128 TB128 TB128TA128 TA

Npage (=256)

Alternately use train A and B until

a response is received or pageTO

16151413121110987654321

128*(16*625us)=1.28s

16*625us = 10ms

(Npage can be 1, 128, 256)

Page Modes

¬R0: Npage ≥ 1 (16 slots,16 slots … )– Continuous, Tw page scan = Tpage scan

¬R1: Npage ≥ 128– Once in a while– Tw page scan ≥ 18 slots– Tpage scan ≤ 1.28s

¬R2: Npage ≥ 256– … .

Entering Page

¬Page from– STANDBY– CONNECTION

¬Entering from connection– Hold or Park ACL– Interrupted by SCO — increase scan

window

Paging with SCO (1)

Paging with SCO (2)

Paging Scheme

¬Mandatory paging scheme– First met

– Paging directly following inquiry

¬Optional paging/scanning scheme– After the mandatory scheme

Page Scan (1)

¬Like inquiry scan, a device may enter page scan periodically to allow connection with it.

¬When page scan completes, the Slave updates CLK, sync word, and access code before entering the connection state.

Page Scan (2)

¬Can be entered from – STANDBY

– CONNECTION

¬Entering from connection– Hold or Park ACL

– Interrupted by SCO →increase scan window

Page Scan (3)

¬Listen for its DAC for – Tw page scan ≥ 18 slots– Tpage scan determined by SR (scan repetition)

¬Hop sequence determined by the Slave’s BD_ADDR.¬Phase in the hopping sequence is

determined by CLKE16-12 (pager) (CLKE15-12 (pager) in half-hop systems) ¬Phase changed every 1.28s, regardless of

Npage

Page Scan Repetition (SR)

¬SR field in the FHS packet¬The paging unit must choose R0, R1,

or R2 accordingly.

Page / Page Scan Modes

¬R0: Npage ≥ 1 (16 slots,16 slots … )– Continuous, Tw page scan = Tpage scan

¬R1: Npage ≥ 128– Once in a while– Tw page scan ≥ 18 slots– Tpage scan ≤ 1.28s

¬R2: Npage ≥ 256– … .

Page Scan with SCO

¬One SCO link(HV3, TSCO = 6 slots)– Tw page scan at least 36 slots(22.5ms)

¬Two SCO link(HV3, TSCO = 6 slots)– Tw page scan at least 54 slots(33.75ms)

Page Response Procedure (1)

Page Response Procedure (2)

Page Response Procedure (3)

Slave Response

¬The ‘X’ input to hop sequence generator is fixed at CLKN16-12

¬The Slave awaits FHS within pagerespTO¬Within pagerespTO, the Slave advances to

the next phase every 1.25ms to match with the Master’s next paging frequency.¬After pagerespTO

– Page scan for one additional scan period, if not successful, return to the state prior to page scan.

Master Response

¬FHS packet– Real-time Bluetooth clock (26 MSBs only),

Master’s BD_ADDR, BCH parity bits, etc (all information to construct the channel access code without requiring a math derivation from the Master’s BD_ADDR)

¬Repeat FHS with updated phase until either successful or pagerespTO¬If failed, report to LM

Connection Confirmation

¬On entry, both devices move to the pager’s hop sequence. ¬To verify the success of the link set-up

– The Master transmits a POLL packet which the Slave must respond (typically with NULL).

– Both ARQN=NAK (still a response!).

¬ If everything goes well– Master transmits and starts ARQ, SEQ for real.– LMP configuration starts.– Master/Slave role switch can proceed, if desired.

Connection Time-out

¬When both the Master and Slave switches to the Master’s normal hopping sequence, newconnectionTO (in terms of #slots) is ticked.

¬ If after newconnectionTO, either– POLL is not received by the Slave

– POLL response is not received by the Master

then connection is regarded “failed”, and both return to the page and page scan states

Synchronization–the Slave

¬ The Slave stays synchronized to the Master during a connection by correlating against the Master’s access code (CAC) in each packet the Mater transmits, even if it’s not destined for that Slave.

¬ If AM_ADDR does not match– abort the remainder of the reception, and use packet type

field to reduce power consumption for the duration of Master’s transmission

– any device in connection state may move into Low Power mode as described above

Synchronization–the Master

¬The Master must keep transmitting periodically, even if there is no data to send.

¬A NULL packet is usually used for this purpose.

Connection

Active, Hold, Sniff, Park

Connection Modes

¬Active¬Low-power

– Hold: Allows device to be inactive for a single short period.

– Sniff: Allows devices to be inactive except for periodic sniff slots.

– Park: Similar to Sniff, except parked devices give up their active member addresses.

Connection — Active

¬The Master schedules transmission based on traffic demands to and from different slaves.

¬Constant Master transmission to keep synchronization (channel access code).

¬ If an active slave is not addressed, it may sleep until the next master transmission.

¬Type of packet→the number of slots

Connection — Hold (1)

¬A device ceases to support ACL for a negotiated period of time to free up bandwidth for other operations like– Scanning, paging, inquiry.

– SCO is not affected.

¬AM_ADDR is maintained.

¬Re-synchronizes to CAC after holdTO.

Connection — Hold (2)

¬HCI_Hold_Mode– Connection Handle, Max/Min hold periods

– HCI_Write_Hold_Mode_Activity

¬LMP_hold_req (1st or refresh)– LMP_accepted, LMP_not_accepted

– LMP_hold_req (negotiating different parameters)

¬LMP_hold (after the 1st hold)

Connection — Sniff (1)

¬The Slave is given a pre-defined slot time and periodicity to listen for traffic.

¬The Master can only transmit at the specified time slots.

¬Starting at every Dsniff instant, repeat for Nsniff

attempt times. – Master CLKN[27:1] mod Tsniff = Dsniff

– Master (CLKN[27], CLKN[26:1]) mod TSniff = Dsniff

¬Received Master’s call(s) within Nsniff attempt

→continues listening for Sniff_Timeout

Connection — Sniff (2)

¬HCI_Sniff_Mode– Connection_Handle, Max/Min Sniff periods

– Sniff_attempt, Sniff_Timeout

¬LMP_sniff_req– LMP_accepted, LMP_not_accepted

– LMP_sniff_req (negotiating sniff parameters)

¬LMP_sniff

¬HCI_Exit_Sniff_Mode, LMP_unsniff_req

Connection — Park

¬Similar to Sniff, but the Slave gives up its AM_ADDR.– Cannot transmit

– Cannot be addressed directly by the Master

¬The Slave only needs to wake up at a defined “Beacon” instant to listen for broadcasts to synchronize.

Park Mode

¬Purpose– Low Power

– To accommodate more than 7 slaves

¬Parked Slaves still synchronized to the channel ¬Give up AM_ADDR and receive

– PM_ADDR [8] (Parked Member Address)– AR_ADDR [8] (Access Request Address)

¬Park only one slave at a time¬All messages sent to the parked Slaves must be

carried by broadcast packets.

Beacon Instants and Slots (1)

¬ Transmission for synchronization of the parked devices¬ Carrying messages to the parked devices to change the

beacon parameters

¬ Carrying general broadcast messages to the parked devices¬ Unparking of one or more parked devices

Beacon Instants and Slots (2)

¬NB and TB are chosen so that there are sufficient beacon slots for a parked slave to synchronize.

¬The Slave receives beacon parameters through an LMP command.– CLK27-1 mod TB = DB for initialization 1

– (CLK27, CLK26-1) mode TB = DB for initialization 2

¬Any packet can be used for synchronization

¬May be interrupted by SCO link

Beacon Access Window (1)

¬Parked slaves send requests to be unparked

¬Fixed delay Daccess after beacon instant

¬Repeat Maccess times

Beacon Access Window (2)

¬ Parked Slaves can only respond if the Master has broadcast in the preceding even slot.

¬ Polling¬ Wait for the Master to broadcast an unpark message.

Beacon Access Window (3)

Sleeping Through Beacon Slots

¬Sleep window = NB_sleep * TB

Park Mode Addressing

¬Master initiated unpark uses– PM_ADDR

– BD_ADDR

– (All zero PM_ADDR is reserved for those that can only be unparked by BD_ADDR)

¬Slave initiated unpark uses– AR_ADDR

Entering Park Mode

¬HCI_Park_Mode– Connection_Handle, Max/Min interval

between beacon slots

¬LMP_park_req– (a whole lot of parameters, see the spec)– LMP_park, LMP_accepted,

LMP_not_accepted– LMP_set_broadcast_scan_window,

LMP_modify_beacon

Master-Activated Unparking

¬ HCI_Exit_Park_Mode w/ connection handle.¬ LMP_unpark broadcast in a beacon slot

– PM_ADDR or BD_ADDR– A new AM_ADDR

¬ The Slave receives the unpark message →returns to active mode.

¬ The Master POLLs with the new AM_ADDR.¬ LMP_accepted to confirm the Slave has been

unparked.¬ newconnectionTO

– Master : unpark the slave in the next beacon slot– Slave : return to park with the same beacon parameters

Slave-Activated Unparking (1)

¬ Send an access request message in the access window only when a broadcast packet has been received.– The message is an ID packet with Master’s DAC

¬ Listen for Master’s unpark message. If not, try in the next access window (total: Maccess windows).

¬ After the last access window, the Slave shall listen for NPOLL slots for the unpark message.

¬ Fail→sleep until the next beacon instant.

Slave-Activated Unparking (2)

¬Unpark message received– The Slave listens for POLL with its

AM_ADDR, and then responds.

¬If the Master did not receive response after NPOLL + newconnectionTO– Master : send unpark message again

– Slave : return to park with the same beacon parameter

Polling Schemes

¬Polling in active mode– ACL: A slave is allowed to transmit in a slot only

if it was addressed by the preceding slot.

– SCO: A slave is allowd to transmit unless the (valid) AM_ADDR in the preceding slot indicates a different slave.

¬Polling in park mode– A slave can only respond after a broadcast

packet is received in the preceding slot.

Broadcast Scheme

¬All-zero AM_ADDR

¬New broadcast message shall start with the flush indication(L_CH=10)

¬Never acknowledged

¬no traffic at the beacon event→broadcast packets shall be sent.

Scatternet

¬Each piconet has their own channel hopping sequence and phase as determined by the respective Master.

¬The packets are preceded by different channel access codes.

Inter-Piconet Communications

¬ACL only– Hold or park the current piconet connection, then– Join the other piconet by changing channel

parameters.– Sniff mode : in between the sniff slots

¬SCO– In the non-reserved slots– Four slots in between, two for misalignment

¬Regular updates is necessary as the clocks of various piconets drift independently.

Master-Slave Switch

¬Happens when slave wants to be a Master

¬Redefinition of the piconet¬New piconet parameter

Master-Slave Switch Process (1)

¬Slave A and master B agree to exchange roles (LMP)

¬When confirmed, A & B do the TDD switch but keep the former hopping sequence.¬A now becomes the Master of the

piconet

Master-Slave Switch Process (2)

¬A now becomes the Master of the piconet– The 1.25ms resolution in FHS is not enough to

align the slot boundary– A sends LMP packet giving the delay of the old

and new “master-to-slave” slots (0 to 1249µs, resolution=1µs)

¬After LMP time alignment, A sends FHS including the new AM_ADDR to B, still using the old piconet parameters¬After ACK (ID) by B, both A & B switch to the

new channel parameters of the new piconet.

Master-Slave Switch Process (3)

¬A piconet switch is enforced on each Slave separately. For each Slave,– A sends a time alignment and FHS packets using

old parameters.– Upon ACK (ID), the Slave switches to the new

parameters.– The FHS sent to each Salve has the old

AM_ADDR in the FHS packet header and their new AM_ADDR in the FHS packet payload.

– A polls each Slave to verify the swtich within newconnectionTO. Repeat if verification failed.

Link Supervision

¬Break down– Out of range

– Power failure

¬Supervision Timer (Master, Slave, SCO, ACL)– Reset when access code & HEC & correct

AM_ADDR is received

– supervisionTO negotiated at LM level, longer than hold and sniff period

– Connection is reset when supervisionTO expires

Link Controller States Revisited

¬ Major states– Standby– Connection

¬ Substates– Page– Page scan– Inquiry– Inquiry scan– Master response– Slave response– Inquiry response

Complicated Context Switching

¬The previous figure represents only the state of one link between two devices at any one time.

¬A Master may be in connection with one Slave while simultaneously inquiring, paging, and scanning several other devices.

¬ Inquiry/paging may last for several seconds

HW/SW Partitioning

¬Needs a unique context for the LC protocol, ARQN, SEQN, and re-transmit packets of an active interaction.

¬The area of state control and link context management is at the sharp end of the hardware/software (HW/SW) partitioning problem.

Other Baseband Topics Left

¬Hop Selection Algorithms¬Audio

¬Error Corrections and Security Related Algorithms