I want to study this pdf in 30 minutes, first gimme an index of is included in the pdf and then gimme a comprehensive description of the main ideas covered in this pdf

BluetoothBluetooth
26/04/23
A cable replacement
technology
• Up to 3 Mb/s symbol rate
• Range 10+ meters
• Single chip radio+baseband
§ at low power & low price
Why not use WLANs?
§ power
§ cost
Why not use IrDA?
§ Line of sight
§ Short distance range
(1m)26/04/23
The Bluetooth Idea
• Bluetooth has been named after a
Scandinavian king, who lived in the X
century A.D., called Harald Bluetooth
• Harald Bluetooth took over several
tribes which had different cultures
and habits
• Bluetooth technology aims to be
“universal” and suitable for any
kind of environment
• Several versions of the standard26/04/23
Basic
Characteristics26/04/23
• Dynamic reconfigurability for a very flexible system
suited to many environments
§ Piconet: all ad hoc networks with at most 8
simultaneously active devices
w 1 master: controls the channel access within
the piconet and handles all the traffic within the
piconet
w up to 7 slaves
§ Scatternet: Many piconets coexisting in the same
area (interconnected or not)
• Any device can be either a master or a slave in a
piconet
Network Architecture26/04/23
An Example26/04/23
Technical Overview26/04/23
The Bluetooth Technology
• The Specifications describe how the
technology works (i.e., the Bluetooth protocol
architecture)
• The Profiles describe how the technology is
used (i.e., how different parts of the specification
can be used to fulfill a desired function for a
Bluetooth device)
Bluetooth documentation is divided in two parts:26/04/23
Bluetooth
Specifications26/04/23
Design Considerations
data signal
recovered
data signal
cost
power
spectrum
noise, interference
Goals
• high bandwidth
• conserve battery power
• cost < $10
• robust system26/04/23
Bluetooth Radio Link
• 2.402 GHz + k MHz, k=1, …, 79
(79 channels spaced by 1MHz)
• Modulations:
§ GFSK (basic rate): 1 Mb/s symbol rate
§ p/4-DQPSK (EDR): 2 Mb/s
§ 8DPSK (EDR): 3 Mb/s
. . .
1Mhz
12 3 79
83.5 Mhz26/04/23
Bluetooth Radio
• Low Power
§ Low voltage RF
§ Standby modes (Sniff, Hold, Park)
• Power Classes: devices can be classified into 3
power classes
§ Power Class 1: long range (~100m) devices,
max output power = 20dBm
§ Power Class 2: ordinary range devices (~10m),
max output power = 4dBm
§ Power Class 3: short range devices (~10cm),
max output power = 0dBm26/04/23
Bluetooth Radio
• Low Cost
§ Single chip radio (minimize external components)
§ Today’s technology
§ Time division duplex26/04/23
Bluetooth Radio
• Robust operation
§ Fast frequency hopping: 1600 hops/sec
§ Strong interference protection
w Fast ARQ
w Robust access code
w Forward header correction26/04/23
Bluetooth
Protocol Stack26/04/23
Protocol Stack Comparison
RF
Baseband
Audio
LM
L2CAP
Data
SDP
RFCOMM
IP
Control
ApplicationsBluetooth Protocol Stack
26/04/23
• A hardware/software/protocol description
• An application framework
RF
Baseband
Audio
Data
SDP
RFCOMM
IP
Single chip (RF, BB, LM, HCI)
With RS-232,USB, or
PC card interface
Applications
Link Mng
L2CAP
HCI
Software
Control26/04/23
Bluetooth Radio Specification
RF
Baseband
Audio
LMP
L2CAP
Data
SDP
RFCOMM
IP
Control
Applications
defines the
requirements of
the Bluetooth
transceiver26/04/2326/04/23
• Each BT device has a free-running clock that is the
heart-beat of the tranceiver
• Slaves synchronize with the master by adding an
offset to its native clock; offsets have to be updated
regularly
Piconet Synchronization26/04/23
• Once created, each piconet uses its own frequency
hopping sequence which is derived from the
address of the master node
§ Interference between neighboring piconets is
reduced
§ The hopping sequence is defined so that there is
equal probability to hop on any of the available
frequency channels (pseudo-random sequence)
§ channel hopping prob.=1/79
Piconet Synchronization26/04/23
AFH (Adaptive Freq. Hopping)
Bluetooth 1.1
• Improves the performance of physical links in the
presence of interference
• Limits interference on/from other devices
• A channel map indicates which RF channels shall
be used and which shall be unused
• Unused RF channels are re-mapped uniformly
onto used RF channels26/04/23
Baseband
RF
Baseband
Audio
LMP
L2CAP
Data
SDP
RFCOMM
IP
Control
ApplicationsPiconet Formation
26/04/23
Master
Active Slave
Parked Slave
Standby26/04/23
• A Hopping Sequence is used to select the next
radio channel
§ It is only related to master’s hardware address
§ The phase in the hopping sequence is determined
by the master’s BT clock
• Channel is temporally slotted (slot duration= 625 µs)
• A packet is transmitted within a single radio channel
Physical Channel26/04/23
Piconet Channel
m
s1
s2
625µs
f0 f1 f2 f3
1600 hops/s
f4 f5
FH/TDD
366µs
tx/rx turn around time26/04/23
Channel Access
• Slaves can transmit only if polled by the master
§ The packet header indicates the intended
recipient
• Master always starts transmitting on even slots
• Slaves always start transmitting on odd slots26/04/23
Multi-Slot Packets
m
s1
s2
625µs
f0 f3 f4 f5
FH/TDD
Data rate depends on packet type: 1- 3-, or 5-slot long26/04/23
Physical Link Types
m
s1
s2
SCO SCO SCO
• Synchronous Connection Oriented (SCO) Link
• slot reservation at fixed intervals
• Extended Synchronous Connection Oriented (eSCO) Link
• SCO with configurable asymmetric data rate and retx
• Asynchronous Connection-less (ACL) Link
• Polling access method
ACL ACL ACL ACL ACL ACL26/04/23
• Point-to-point connection
• Two duplex slots are allocated periodically
• All packets are 1-slot long
• Packets are never retransmitted, but are protected by
FEC
SCO26/04/23
• A master can support up to 3 SCO links with the
same slave or with different slaves
• A slave can support up to 3 SCO links with the
same master and up to 2 SCO links if they originate
from different piconets
• The SCO link is established by the master sending
the SCO period TSCO and the SCO offset DSCO
• Even if a slave fails in decoding the slave address in
the SCO packet header, it can access the channel in
the following slot
SCO26/04/23
Same as SCO but:
• configurable data rate: packet length & periodicity
• Packet length and periodicity are fixed at link connection
establishment and remain unchanged
• Links can be asymmetric
• Packets may not be protected by FEC, but they always
carry a CRC
• Limited retransmissions of lost or damaged packets inside
a retransmission window (retx must be done in the slots
following the reserved ones)
eSCO (bluetooth 1.1)26/04/23
• Point-to-multipoint link between the master and the
slaves within the piconet and point-to-point link
between a slave and the master
• Can use all the slots not allocated to (e)SCO traffic
• ACL traffic is scheduled by the master
• Multi-slot packets can be used
• Packets can be retransmitted
ACL26/04/23
• Between a master and a slave one ACL link only
can exist
• One ACL link is always established between a
master and any slave since it must be used to
exchange LMP messages
• If a slave fails in decoding the slave address in
the packet header, it cannot access the channel
in the following slot
ACL26/04/23
Packet Types
Control
packets
Data/voice/transparent data packets
ID*
Null
Poll
FHS
Voice Data
HV1
HV2
HV3
DV
DM1
DM3
DM5
x-DH1
x-DH3
x-DH5
combines voice
and data (voice
field+data field)
Transparent data
x-EV3
x-EV4
x-EV5
x = 2, 3: it indicates the
used modulation
(2=p/4DQPSK; 3=8DPSK)26/04/2326/04/23
• SCO and eSCO traffic always have priority due
to delay requirements
• ACL link: a round-robin scheduling has been
proposed by Ericsson
§ Not the most efficient solution in the case of
asymmetric traffic
§ For asymmetric traffic, it’s better to transmit to the
same slave (or let the slave transmit) for a longer time
§ DH/M-3 and DH/M-5 packets can be used to reduce
the overhead
Traffic Scheduling26/04/23
• Fast Stop-and-Wait
§ Applied to x-EV and x-DM/H packets only
§ If the master is receiving, it can send the
ACK in the slot next to the received packet
even if the master transmission is toward a
different slave (fast Stop&Wait)
§ the time latency is reduced
§ in this case the ACK is sent by setting
the ARQN bit to 1
Link Control26/04/23
• Standby:
§ The node is not connected to anyone through a
traffic link
§ However it listens to the channel checking every
1.28s (or 2.56s) over 32 frequency hops if there
are msgs from the master sent to him
• Page/Inquiry-scan
• Connected:
§ The node is connected to another node through a
traffic link
Node Operational State26/04/23
standby
Device State Transition
page
page
scan inquiry scan inquiry
master
response
slave
response
inquiry
response
detach/reset
connetd
unconnected state,
only the native
clock is running @
the LPO26/04/23
Inquiry
• Used to discover other devices and exchange
synchronization information (HW address and clock)
§ Asymmetric procedure
• Listener and sender hop using the same sequence but
the sender hops faster than the listener26/04/23
• The interval between two consecutive inquiry
procedures is a random variable so that
synchronization between two or more entities
performing the procedure is avoided
• The sender stops repeating the procedure when it
has contacted a sufficient number of nodes
• The sender can specify the class of devices to contact
by using a dedicated instead of a general inquiry
access code (IAC)
• The sender uses a known-to-all inquiry hopping
sequence
Inquiry Procedure:
The Sender26/04/23
f(k) f(k+1) f’(k) f’(k+1) f(k+2) f(k+3)
625 µs
• The sender:
§ Keeps transmitting the IAC on different frequencies
§ Every 1.25ms transmits on two hops and listens
whether there is a response from neighboring units
Inquiry Timing26/04/23
Inquiry Scan:
A Listener
• Listeners:
§ when more than one listener is present, their
replies may collide
§ to avoid collisions, listeners defer their replies
until expiration of a random backoff timer
§ an FHS packet (including the listener’s MAC
address and clock) is retransmitted at other times
and frequencies as long as the master is probing
with inquiry messages26/04/23
Inquiry Message Exchange
f(k) f(k+1) f’(k)
625 µs
FHS
ID ID
625 µs
Received packet
inquiring
unit
inquiry
responding
unit26/04/23
Example (1)
• B,C,D are in Inquiry Scan
A
B
D
C
IDb
IDa IDd
IDc
INQ26/04/23
Example (2)
• B,C,D are in Inquiry Scan
A
B
D
C
IDb
IDa IDd
IDc
FHS
IDb26/04/23
Example (3)
• C and D respond simultaneously: their FHSs are lost
A
B
D
C
IDb
IDa IDd
IDc
IDb
FHS
FHS26/04/23
Example (4)
• A issues an inquiry again
A
B
D
C
IDb
IDa IDd
IDc
INQ
IDb26/04/23
Example (5)
• C responds with an FHS
A
B
D
C
IDb
IDa IDd
IDc
IDb
FHS
IDc26/04/23
Example (6)
• A issues an inquiry again and D responds
A
B
D
C
IDb
IDa IDd
IDc
FHS
IDb
IDc
IDd26/04/23
Inquiry: Conclusion
• Inquires obtains MAC address and clock of its neighbors
• Neighbors retain nothing26/04/23
Paging
• Used to establish connections and define roles
• Steps similar to Inquiry, BUT
§ Paging message is unicast to a selected listener
§ The sender has also an estimate of the
listener’s clock Þ it is enabled to communicate
with the listener almost istantaneously26/04/23
§ Knows the address (DAC) of the unit to page (X)
§ Derives the hopping frequency to be used for
paging from X’s address
§ However, usually the pager and X are not
perfectly sync. Thus, the pager does not know
exactly:
w when X will listen to the channel
w on which frequency (i.e., X’s phase)
Paging Transmission
The paging unit:26/04/23
1. When X receives the paging msg, it replies back
acknowledging the reception (with an ID packet using the
paging response sequence, derived from its address)
2. The pager replies by sending its own address and clock
information through the FHS packet (using the same
hopping frequency and access code employed by X)
3. X sends an acknowledgment (still using the same hopping
frequency and access code)
4. The paging unit (i.e., the master) starts the data exchange
by using the piconet hopping sequence, derived from its
own address and clock
Connection Establishment26/04/23
Example (1)
• A knows C’s ID and has an idea of its clock
A B
D
C
IDa
IDc
IDc
IDc26/04/23
Example (2)
A B
D
C
IDa
IDc
IDc
IDc26/04/23
Example (3)
A B
D
C
IDa
IDc
IDc
• A replies with its ID and clock (FHS packet)
IDa26/04/23
Example (4)
A B
D
C
IDa
IDc
IDc
IDa
IDc26/04/23
Example (5)
A B
D
C
IDa
IDc
IDc
• Then, A connects as a master to C
IDa26/04/23
Paging conclusion
• Upon receiving a response for the paging message,
the sender becomes the master and the listener the
slave of a newly formed piconet
• Both nodes switch to the piconet channel-hopping
sequence26/04/23
• Typically, masters have a much higher
computational and communication load, thus
experiencing higher energy consumption than
slaves do
• Master and slave can switch role within the
piconet through an appropriate procedure
Master and Slave26/04/23
standby
inquiry
page
connetd
active
sniff
hold
park
2ms
2ms
connecting
states (7)
active
states
low-power
states
Link Controller
State Transitions26/04/23
§ The node transmits and/or receives traffic
Connected States: Active26/04/23
Sniff Mode
Master
Slave
Sniff period
Sniff offset
Sniff slots
• Traffic reduced to periodic sniff slots26/04/23
Hold Mode
Slave
Hold duration
Hold offset
Master26/04/23
Park Mode
Master
Slave
Beacon interval
Beacon instant
• Power saving + keep more than 7 slaves in a piconet
• Give up active member address, yet maintain synchronization
• Communication via broadcast LMP messages26/04/23
Battery Life
• Low power consumption*
§ Standby current < 0.3 mA ð 3 months
§ Voice mode 8-30 mA ð 75 hours
§ Data mode average 5 mA (0.3-30mA, 20 kbit/s, 25%)
ð 120 hours
• Low Power Architecture
§ Programmable data length (else radio sleeps)
§ Hold and Park modes: 60 µA
w Devices connected but not participating
w Device can participate within 2 ms
*Estimates calculated with 0.6 Ah battery26/04/23
Bluetooth
Low Energy (4.x)How much energy does traditional
Bluetooth use?
• Traditional Bluetooth is connection oriented. When a device is
connected, a link is maintained, even if there is no data
flowing
• Sniff/Hold modes allow devices to sleep, reducing power
consumption to give months of battery life
• Peak transmit current is typically around 25mA
• Even though it has been independently shown to be lower
power than other radio standards, it is still not low enough for
coin cells and energy harvesting applications
165What is Bluetooth Low Energy?
• Bluetooth low energy is a NEW, short range radio technology
§ Different from Bluetooth classic
§ Optimized for ultra low power
§ Enable coin cell battery use cases
w < 20mA peak current
w < 5 µA average current
166USE CASES planned for BT 4.0
167
• Proximity
• Time
• Emergency
• Network availability
• Personal User Interface
• Simple remote control
• Browse over Bluetooth
• Temperature Sensor
• Humidity Sensor
• Generic I/O (automation)
• Battery status
• Heart rate monitor
• Physical activity monitor
• Blood glucose monitor
• Pulse Oximeter
• Body thermometerExample use case: proximity
• It can enable proximity detection
§ I’m in the car
§ I’m in the office
§ I’m in the meeting room
§ I’m in the movie theater
• It can enable presence detection
§ Turn the lights on when I walk around the house
§ Automatically locks the door when I leave home
§ Turn the alarm off if I’m already awake
168Basic Concepts of Bluetooth 4.0
Everything is optimized for lowest power consumption
§ Short packets reduce TX peak current
§ Short packets reduce RX time
§ Less RF channels to reduce discovery and connection time
§ Simple state machine
§ Single protocol
§ Etc.
169Bluetooth low energy factsheet
Range: ~ 150 meters open field
Max Output Power: ~ 10 mW (10dBm)
Max Current: ~ 15 mA
Latency: 3 ms
Topology: Star
Data rate: 1 Mbps (no streaming, small chunks of data)
Modulation: GFSK @ 2.4 GHz
Robustness: Adaptive Frequency Hopping, 24 bit CRC
Security: 128bit AES CCM
Sleep current: ~ 1μA
Modes: Broadcast, Connection, Event Data Models, Reads, Writes
170Device Modes
• Dual Mode
§ Bluetooth Basic Rate/EDR and LE
§ Used anywhere Basic Rate/EDR
is used today
• Single Mode
§ Implements only Bluetooth low energy
§ Will be used in
new devices / applications
174Physical Channels
• 40 Channels on 2 MHz spacing
• Two types of channels
177Physical Channels
• Advertising channels avoid 802.11
178Link Layer
• Link Layer state machine
179
slave masterAdvertising and Scanning
• Devices can advertise for a variety of reasons:
§ To advertise their presence to a device wanting to connect
§ To broadcast promiscuously
§ To transmit signed data to a previously bonded device
§ To reconnect asynchronously due to a local event 180
Active scanning
passive scanningPassive scanning
For reducing the chance of multiple consecutive
collisions, a random delay of up to 10 milliseconds is
added to each advertising interval.
26/04/23Active Scanning
The scanner listens to the channel for a duration
called the scan window, which is periodically repeated
every scan interval -> much faster procedure than BLData transactions
§ Master informs slave of hopping sequence and when to wake
via CONNECT_REQ
§ All subsequent transactions are performed in the 37 data
channels
§ Transactions can be encrypted
§ Both devices can go into deep sleep between transactions 183Link Layer
• Link Layer state machine
184
slave masterLink Layer Connection
• Very low latency connection
185Security
• Very low, and in many cases broken security
• The encryption of any BLE link easily can be rendered useless. This flaw
in security can allow any device nearby to eavesdrop on BLE
conversations. This includes packets being intercepted and reassembled
into connection streams, as well as injection attacks.
• BLE suggested for apps to trace people’s contacts during COVID-19,
silently tracking other phones which come within BLE range of a
person's phone, allowing who have been in proximity with a possibly
infected person to be notified without identifying the infected person.
• However, a government memo said that ministers might be given the
ability to identify people from their mobile phones (potential security
breach)
26/04/23How low can the energy get?
• From the previous slide, calculate energy per transaction
§ Assume an upper bound of 3 ms per minimal transaction
§ Estimated TX power is 15mW (mostly TX power amp for 65 nm chips)
§ For 1.5v battery, this is 10mA. 0.015W * 0.003 sec = 45 micro Joule
• How long could a sensor last on a battery?
§ An example battery: Lenmar WC357, 1.55v, 180mAh, $2-5
§ 180mAh/10mA = 18Hr = 64,800 seconds = 21.6M transactions
§ Suppose this sensor sends a report every minute = 1440/day
§ For just BLE transactions, this is 15,000 days, or > 40 years
§ This far exceeds the life of the battery and/or the product
• This sensor could run on scavenged power, e.g., ambient light
188