Patent ID: 12245109

DETAILED DESCRIPTION

This Application incorporates U.S. Pat. No. 10,771,927 B1 by reference in its entirety. Method and devices are disclosed that simultaneously geo-locate a number of BR Bluetooth devices using a single measuring station.

A more complete understanding of the present embodiments, and the attendant advantages and features thereof, will be more readily understood by first describing a basic method for geo-locating a Bluetooth device without the need for any user interaction.

The default state of a Bluetooth device is the Standby state. In this state, the device may be in a low-power mode. A device may leave the Standby state to scan for page or inquiry messages or to page or inquire itself. In order to establish new connections, the paging procedure or the synchronization scan procedure is used. Only the Bluetooth device address, BD_ADDR300, as discussed above with reference toFIG.3, is required to set up a connection using the paging procedure. A device that establishes a connection using a page procedure will automatically become the master of the connection.

Once the connection has been established, packets may be sent back and forth, and each device uses the basic or adapted channel hopping sequence. A device can transition to the Connection state from the page/page scan substates and starts with a Poll packet, sent by the master that verifies the switch to the master's timing and channel frequency hopping.

A device can scan for page messages from the Standby state or the Connection state. When a device leaves the Standby mode to scan for page messages it selects the scan frequency according to the page hopping sequence determined by the device's BD_ADDR.

Referring again to the drawing figures, in which like reference designators refer to like elements,FIG.6is a table600of the initial messaging between a master and a slave during start up for the paging substates. In step1,601, the master device is in the “page” substate and the slave device is in the “page scan” substate. It is assumed that in this step601that the page message sent by the master is received correctly by the slave. On receiving the page message, in step2,602, the slave device transmits a slave page response message (the slave's device access code) and enters the “slave response” substate. The master waits for a reply from the slave and when this arrives in step2,602, the master enters the “master response” substate in step3,603. In step3,603, the slave awaits the arrival of a Frequency Hopping Sequence (FHS) packet from the master and if it is received, in step4,604, then the slave responds with a slave page response message to acknowledge the reception of the FHS packet. During the initial message exchange, steps1to4,601to604, all parameters are derived from the slave's device address, BD_ADDR, and only the page hopping and page response hopping sequences are used (derived from the slave's device address, BD_ADDR).

Finally, in step5,605, the slave device enters the Connection state and the slave device uses the master's clock and the master's BD_ADDR to determine the basic channel hopping sequence and channel access code. The FHS packet in step3,603, contains all the information for the slave to construct the channel access code, CAC, and the Access Code410in each packet is then derived from the LAP310of the master. The connection mode starts with a Poll packet transmitted by the master in step5,605, and the slave, in step6,606, may reply with any type of packet but a Null packet is generally used for this response.

FIG.7is a timing diagram that describes the ranging method of the present disclosure that may be used to determine the distance between two Bluetooth devices, a Master device710(also referred to herein as “Master710”) and a Slave device750(also referred to herein as “Slave750”). The Master710has a TX Slot715followed by an RX Slot716, each nominally 625 μs in duration. The TX Slot715starts at time t1771and the RX Slot716starts at time t5775. Conversely the Slave750has an RX Slot755followed by a TX Slot756, each nominally 625 μs in duration. The RX Slot755starts at time t2772and the TX slot starts at time t6776. At time t1771, the Master710may transmit a packet720to the Slave750. This transmission packet720may be received at the Slave750at time t2772. The time (t2-t1) is the propagation time of the packet720in travelling the distance between the Master710and the Slave750. The Slave750may then respond to packet720with packet761in its next TX slot756at time t6776. This packet761may be received by the Master710at time t7777in the corresponding RX Slot716of the Master710. The time (t7-t6) is also the propagation time of the packet761in travelling the distance between the Slave750and the Master710. The time t1771is the TOD of packet720and the TOA of the response packet761is t7777. The turnaround time is (t6-t2), the slot time of the Slave750, nominally 625 μs. Hence, the time delay, td, which is equal to (t2-t1) and (t7-t6), between the Master710and the Slave750may be determined from the calculations:
td=[t7−t1−(t6-t2)]/2 or td=(TOA−TOD−Slot Time)/2  (1) and
the distance between the Master710and the Slave750is then td×c, where c is the speed of light. The delta time (t7−t1) or (TOA−TOD) corresponds to the time that the Master710receives packet761minus the time that the Master710transmitted packet720.

At time t8778, at the start of the Master's next TX slot717, another packet721may be transmitted by the Master710to the Slave750. This packet may be received by the Slave750at time t9779and at the start of the Slave's next TX slot758, at time t10780, the Slave750may transmit the response packet762to the Master710, which may be received by the Master710at time t11781. For this packet exchange721and762, the time delay, td', which is equal to (t9-t8) and (t11-t10), between the Master710and the Slave750may be determined from the calculation
td'=[t11−t8−(t10-t9)]/2,  (2)
where t11 is the TOA of packet762, t8 is the TOD of packet721and (t10-t9) is the Slot time of the Slave750. The delta time (t11−t8) corresponds to the time that the Master710receives packet762minus the time that the Master710transmitted packet721.

If the position of the Master is known, then by deriving values for td that result from the exchange of a number of packets between the Master710and the Slave750, the distance from the Master710to the Slave750may be calculated. If the Master710moves in relation to the Slave750, such that the distance from the Master710to the Slave750is calculated for varying angles between the two, e.g., the Master is in a vehicle or is airborne, then the location of the Slave may be calculated. Such methods for calculating a location based on a series of time delay measurements taken at varying angles between a master and slave are known in the art and are therefore not described herein.

The more packets that are exchanged between the Master710and the Slave750, the better the accuracy of the calculated distance td×c. Basically, if the measuring error of td in each packet is Δt, then if there are N packet exchanges, the error is reduced by the square root of N. For example, if td is measured in microseconds, the maximum measurement error is ±1 μs. If td is measure over 100 packets, then the measurement error is reduced by 10, i.e., ±0.1 μs

As described above with reference toFIG.6, a targeted Bluetooth device may be paged by another Bluetooth device. The targeted Bluetooth device will act as the Slave750and the Bluetooth device that initiates the page acts as the Master710. Once the sequence of exchanges as described above with reference toFIG.6has completed, i.e., once the master transmits the Poll packet in step5605, then a brief temporary connection, a piconet, may occur.

As discussed above with reference toFIG.7, in order to measure the distance between two Bluetooth devices, a sufficient number of packets may be required to be exchanged in order to produce a required accuracy.

FIG.8is a diagram describing the sequence800of packet exchanges between a Master710and a Slave750when the Master710uses a Link Manager Protocol (LMP) Name Request connection. The sequence800starts810when the Master710pages the Slave750as discussed above with reference toFIG.6. Upon receipt of a packet, step606, from the Slave750, the Master710may transmit an LMP_features_req request packet,811, to the Slave750. The Slave750may then respond with an LMP_features_res response packet812. If extended features are supported, then an exchange of LMP_feature_req_ext813and LMP_feature_res_ext814request and response packets may take place. The Master710may then transmit an LMP_name_req request packet815and the Slave750may respond with an LMP_name_res response packet816. After receiving the LMP_name_res response packet816, the Master710may transmit an LMP_detach packet817to disconnect.

During the exchange of packets described above with reference toFIG.8, in order to maintain the channel hopping sequence and synchronization, in addition to the packets811to817, the Master710and the Slave750may transmit Poll packets and Null packets respectively. A Bluetooth protocol analyzer may be used to capture the Bluetooth packets. In practice, such a protocol analyzer cannot be relied upon to capture every packet and allowance may be made accordingly. During this exchange of packets described above with reference toFIG.8, the Access Code410of each packet is derived from the lower address part (LAP)310of the Master710.

FIG.9is an example table900of the protocol capture of the packet exchanges described above with reference toFIG.8where the protocol analyzer is located in the same general proximity, e.g., at the same location as the Master710. Column910displays the channel number. Column911displays the packet type. Column912displays the device, Master710or Slave750that transmitted the packet. Column913displays the packet description of the transmitted packet. Column914displays the time that the packet was received, TOA. Column915displays the delta time, which is the time that the present packet was detected after the time of the previously detected packet. The shift time column916is the time that the present packet was received after the first received packet. At line920, the FHS packet is displayed that corresponds to the Step3603of the paging sequence discussed above with reference toFIG.6. At line921, the Poll packet is displayed that corresponds to Step5,605, of the paging sequence described above with reference toFIG.6. At line922, the Slave750responds with a Null packet. At lines925,930,935/945,940/950,955,960, and965, the LMP packet descriptions corresponding to packets811,812,813,814,815,816, and817, are displayed. As discussed above with reference toFIG.8, several Poll packets transmitted by the Master710, and Null packets transmitted by the Slave750, are also displayed. For example, at lines951and952, a Poll packet transmitted by the master on channel64is followed by a Null packet transmitted by the slave, respectively. The corresponding delta time, column915at line952, is 627 μs. As discussed above with reference toFIGS.1and2, this delta time relates to the nominal 625 μs slot times110and220. At lines936,937,938, and939, Poll packets transmitted by the master were detected and displayed. The corresponding delta times at column915lines936,937,938and939, are each 1250 μs. As discussed above with reference toFIG.1, the delta time of 1250 μs relates to the 1250 μs time between TX slots110and130. It may be noted that no corresponding Null packets to Poll packets from the slave at lines936,937,938, and939were transmitted or detected.

As discussed above with reference toFIG.7andFIG.9, the delta time readings will be in accordance with the time slots and the distance of the Slave750from the Master710. All the packet types leading up to an LMP_name_req request packet815and the LMP_name_res response packet816are all single slot packets. Hence, the time deltas ideally would be the slot time, nominally 625 μs, plus twice the propagation time, as discussed above with reference toFIG.7.

FIG.10is a table1000derived from the example table900inFIG.9. The columns, Role912, Shift Time column916and Delta Time column915, in μs, are as shown inFIG.9. Lines1020and1021both refer to packets transmitted by the Master710. The delta time for line1020is 624 μs whereas the delta time for line1021is 1250 μs. Line1030refers to a packet transmitted by the Master710and line1031refers to a packet transmitted by the Slave750. In line1030the delta time is 623 μs and in line1031the delta time is 626 μs. It is not possible to distinguish between packets transmitted by the Master710or the Slave750by reference to the delta time. In order to distinguish between packets that were transmitted by the Master710or the Slave750, the shift time modulus (MOD1250), is calculated. The shift time modulus1250, is shown in column1010. In column1010, lines1020,1021, and1030, the value is 0, indicating that the packet was transmitted by the Master710, whereas in column1010lines1025,1027, and1031the value is nominally the slot time plus twice the propagation time, indicating that the packet was transmitted by the Slave750. Hence, the propagation time, td, may be calculated from the values as given in column1010:
td=(Shift Time MOD (1250)−slot time)/2  (3)
where Shift Time MOD (1250)>slot time

As discussed above with reference toFIG.6, the Master710first pages the Slave750. The Master710then sends an FHS packet to the Slave750, which effectively sets up a piconet between the Master710and the Slave750. Then, as discussed above with reference toFIG.8, the Master710initiates an exchange of packets using LMP_features and LMP_name requests. As discussed above with reference toFIG.9, this causes a number of NULL packets to be transmitted by the Slave750to the Master710in response to Polls from the Master710. Then, as discussed above with reference toFIGS.7and10, the individual RTTs for each of the received NULL packets can be measured for that exchange of Polls and Nulls for that particular slave.

The above description describes the measurement of the propagation time td between a Master710and a Slave750. The Slave750may also be referred to as a “target device” herein, and in the following descriptions a “target device” is a Slave750. Thus, reference to target devices is understood to mean that geo-location is being performed for multiple Slave750devices.

If more than one target device, i.e., Slave750, is to be geo-located, then the sequence of paging, LMS_features and LMS_name, may be repeated for each of the target devices, i.e., for each Slave750, and individual td or RTTs measured for each target device, for each sequence. In each case, the access code410of each Null packet transmitted by the target device will include the Sync Word520, which is derived from the LAP310of the Master710. Hence, all Null packets from any target device will use the LAP of the Master710for the Access Code, and in the case that the BD_ADDR of the Master710is unchanged, there is no difference between the formats of the Nulls from different target devices that identifies that Null with a particular target device.

As discussed below with reference toFIG.12, if the BD_ADDR and in particular, the LAP310of the Master710is changed such that a particular LAP is used for a particular target device, then it is possible to distinguish the td or RTTs between different target devices.

FIG.11illustrates a block diagram of an example wireless communication system1100which, according to an embodiment of the disclosure, may be configured to perform the functions described herein. In some embodiments described herein, a wireless communication system1100includes the Master710that operates as a wireless transmitter/receiver, and a wireless receiver1150that performs the functions of a Bluetooth protocol analyzer as discussed above with reference toFIGS.7,8and9. Master710may be any device configured to wirelessly receive signals and transmit signals, and may be configured to execute any of the methods of the Bluetooth Specification. Wireless receiver1150may be any device configured to wirelessly receive signals, and may be configured to execute any of the methods of the Bluetooth Standard. The wireless communication system1100may also include a general purpose processor1190and a time clock1195which are interconnected to the Master710and wireless receiver1150by a data bus1185.

In some embodiments, the Master710includes an RF front end1120that includes an RF transmitter1122and an RF receiver1121, a baseband processor1125, and processing circuitry1130that includes processor1131and memory module1132. The Master710also includes one or more wireless antennas such as antenna1140. The RF receiver1121may perform the functions of low noise amplification, filtering and frequency down conversion for the reception of Bluetooth packets via the antenna1140. The RF transmitter1122may perform the functions of up conversion and amplification for the transmission of Bluetooth packets via the antenna1140. The baseband processor1125may perform the functions of modulation, de-modulation, coding and de-coding, as described in the Bluetooth Specification. In some embodiments, the processing circuitry1130and/or the processor1131may comprise integrated circuitry for processing and/or control, e.g., one or more processors and/or processor cores and/or Field Programmable Gate Arrays (FPGAs) and/or Application Specific Integrated Circuitry (ASICs) configured to execute programmatic software instructions. In some embodiments the some or all of the functions of the RF front end1120may be performed by the processing circuitry1130. The processing circuitry1130may be configured to control any of the methods and/or processes described herein and/or to cause such methods, and/or processes to be performed, e.g., by the baseband processor1125and the RF front end1120. The memory module1132may be configured to store data, programmatic software code and/or other information described herein. In some embodiments, the software may include instructions that, when executed by the processing circuitry1130, causes the processing circuitry1130to perform the processes described herein with respect to the wireless transmitter/receiver, Master710.

In some embodiments, more than one Master710may be present such that more than one target device may be located at a time by more than one Master710.

In some embodiments, the wireless receiver1150includes an RF front end1160that includes an RF receiver1161, a baseband processor1165and processing circuitry1170that includes a processor1171and a memory module1172, and one or more wireless antennas such as wireless antenna1141. The RF front end1160and RF receiver1161may perform the usual functions of an RF receiver front end such as low noise amplification, filtering and frequency down conversion so as to condition the received signal suitable for inputting to the baseband processor1165. The baseband processor1165may perform the functions of demodulation and decoding so as to condition the received signal suitable for inputting to the processing circuitry1170. In some embodiments the RF front end1160and/or the processing circuitry1170may comprise integrated circuitry for processing and/or control, e.g., one or more processors and/or processor cores and/or FPGAs and/or ASICs configured to execute programmatic software instructions. In some embodiments the functions of the RF receiver1161may be performed by the processing circuitry1170. The processing circuitry1170may be configured to control any of the methods and/or processes described herein and/or to cause such methods, and/or processes to be performed, e.g., by the wireless receiver1150. The memory module1172is configured to store data, programmatic software code and/or other information described herein. In some embodiments, the software may include instructions that, when executed by the processing circuitry1170, causes the processing circuitry1170to perform the processes described herein with respect to the wireless receiver1150.

In some embodiments, the wireless receiver1150may be configured to measure and monitor an input signal's attribute, such as may include one or more packets transmitted by Master710for the purpose of paging another device, such as slave750, as discussed above with reference toFIG.6. Further, the packets may include packets transmitted for the purpose of soliciting a remote name request, as discussed above with reference toFIGS.8and9. Such packets may include Poll packets. Also, the wireless receiver1150may be configured to measure and monitor an input signal's attribute, such as may include one or more packets transmitted by another Bluetooth device, such as a Slave750, that has been paged by the Master710, as discussed above with reference toFIG.6. Further, the packets may include packets transmitted by that other Bluetooth device in responding to the soliciting of a remote name request by the wireless transmitter/receiver of Master710, as discussed above with reference toFIGS.8and9. Such packets may include Null packets. The memory module1172may store instructions for executing any method mentioned in the Bluetooth Specification, input signals, and results of processing of the processor1171signals to be outputted and the like.

Wireless receiver1150may perform the functions of a protocol analyzer such as a Bluetooth protocol analyzer. In some embodiments, wireless receiver1150, acting as a Bluetooth protocol analyzer, monitors, receives and decodes all Bluetooth packets on every channel. In some embodiments, wireless receiver1150may change channels in alignment with the Master710, and only monitor, receive and decode packets on one communication channel or a subset of communication channels. In the cases where the wireless communication system1100includes more than one Master710, and the system is used to simultaneously locate more than one target device, then the wireless receiver1150may monitor, receive and decode all Bluetooth packets on every channel.

According to an embodiment of the disclosure the RF transmitter/receiver master710may be configured to transmit and receive signals and the processing circuitry1130may be configured to prepare the transmitted and received signal attributes based upon the Bluetooth Specification. Such packets may include Null, Poll, FHS and DM1 packets that are to be transmitted and received by a wireless station that is based upon the Bluetooth Specification. The memory module1132may store instructions for executing any method mentioned in the specification, input signals, and results of processing of the processor1131, signals to be outputted and the like.

To aid understanding of the present embodiments a Slave750is also shown inFIG.11. Slave750is not an element of the example wireless communication system1100. Slave750may receive transmissions from the Master710, and transmissions from the Slave750may be received by the Master710and by the wireless receiver1150.

According to another embodiment of the disclosure, the wireless receiver1150may be configured to receive the transmissions of another wireless communication device, and in particular a target device, i.e., Slave750, and the processing circuitry1170may be configured to monitor an attribute of the Slave750, and determine the value of the time of arrival of packets from the Slave750. In addition, according to an embodiment of the disclosure the wireless receiver1150may be configured to measure the times of departure of the transmissions from the Master710. These times may be accomplished by outputting a trigger that is timed to coincide with the reception packet from the other wireless device or the Master710. This trigger may then be used to read the time from the time clock1195. Time clock1195may have a precision that is higher than the internal timer that is part of the wireless receiver1150.

According to an embodiment of the disclosure, a general purpose processor1190may be used to control the operations of the wireless communication system1100and in particular, the Master710and wireless receiver1150. The general purpose processor1190may also carry out the various calculations as described in this disclosure and may also prepare the measurement results for disclosure to an operator or user. The general purpose processor1190may also be used by an operator or user to input one or more attributes of the packets transmitted by Master710. For example, an operator may use the general purpose processor1190to set a particular BD_ADDR300for the Master710, as described above with reference toFIG.3. In some embodiments, the general purpose processor1190can be a computing device such as a tablet computer, desktop computer, laptop computer, or distributed computing, e.g. cloud computing. In some embodiments, the general purpose processor1190can be a processor/CPU in the tablet, laptop computer, desktop computer, or distributed computing environment, etc. In some embodiments the general purpose processor1190may comprise integrated circuitry for processing and/or control, e.g., one or more processors and/or processor cores and/or FPGAs and/or ASICs configured to execute programmatic software instructions and may include a memory module to execute programmatic code stored in the general purpose processor or another device. It is also noted that the elements of the general purpose processor1190can be included in a single physical device/housing or can be distributed among several different physical devices/housings. General purpose processor1190may be used to perform the various calculations as described in this disclosure and may also prepare the measurement results for disclosure to an operator or user.

According to an embodiment of the disclosure, a platform location module1180may be used to input, via the data bus1185, to the general purpose processor1190and/or the processing circuitry1170, the location of the platform that is carrying the wireless communication system1100. The platform location module1180may comprise navigation equipment such as a GPS receiver.

FIGS.12and13is a flow diagram of an example process1200of one embodiment of the disclosure for determining the locations of a number of Bluetooth devices. Process1200may start with step1201where a list of S target (Bluetooth) devices may be created. The target devices, i.e., Slaves750, are identified by their respective BD_ADDR; hence the first target in the list is BD_ADDR (1), and the Nth target in the list is BD_ADDR (N). In step1202the BD_ADDR300, and in particular the LAP310for the Master710, is assigned for each of the S targets. The Master's LAP310is used in the Access Code410of all packets transmitted between the Master710and the Slave750on the piconet channel which is formed at step5605inFIG.6. For a Slave750with BD_ADDR(N), the Master710is assigned LAP(M), where M=N. At step1210, N and M are initialized, i.e., N=1 and M=1. The list of S targets and their respective addresses, BD_ADDR(N), where N=1 to S, may be entered by an operator via the general purpose processor1190and stored in the processing circuitry1130and1170. For the Master710, the UAP320and NAP330values may be constant and then the Master LAP(M) addresses, may be set to correspond to each of the target BD_ADDRs. For example, if there are 5 target devices, S=5, with 5 different addresses, BD_ADDR(1) to BD_ADDR(5), then the LAP310of the Master710is set to LAP(1) to LAP(5) respectively. These LAP addresses may be set sequentially so as to identify the position of the target station in the list created in step1201. For example, LAP(1) may be set to 00:00:01, LAP(2) to 00:00:02, LAP(3) to 00:00:03, LAP(3) to 00:00:04, and LAP(5) to 00:00:05. Hence, by noting the LAP associated with a packet (e.g., NULL) received by the wireless receiver1150, that is used to calculate a td or RTT, a positive check may be made that that result is for that particular target device.

At step1205the values of N and M are initialized. With reference to the list created in step1201, the Master710(acting as a wireless receiver/transmitter), via processing circuitry1130can select the BD_ADDR(1) for the first intended target device. In step1210the Master710(acting as a wireless receiver/transmitter), via processing circuitry1130, can set the LAP(1) for transmissions from the Master710(acting as a wireless receiver/transmitter) via RF front end1120. The values of BD_ADDR(1) and LAP(1) can be transferred to the processing circuitry1170in wireless receiver1150, via the data bus1185.

At step1215, the Master710(acting as a wireless receiver/transmitter), may initiate the paging sequence, as discussed above with reference toFIG.6, with the first target device, with BD_ADDR(1). Step1215may be followed by step1220where the wireless receiver1150, performing the functions of a Bluetooth protocol analyzer, is waiting until the reception of the FHS packet, as discussed above with reference toFIG.6step603. When the FHS packet is received, step1220may be followed by step1325inFIG.13, where the reception time is recorded as time t0, together with the location of the wireless communication system1100which is provided by the platform location module1192, step1322. Also at step1325a variable n is initialized. Step1325may be followed by step1330where the Master710, may initiate the sequence of packet exchanges for the remote name request with the target device, as discussed above with reference toFIG.8andFIG.9. In step1335the wireless receiver1150, performing the functions of a Bluetooth protocol analyzer, receives packets transmitted by the Master710and responding packets transmitted by the target device, as discussed above with reference toFIG.9. If a packet is received, then step1335may be followed by step1345where a check is carried out to determine if the received packet is a Poll or a Null. If the received packet is a Poll or a Null, then the reception time, TOD or TOA respectively, is recorded as time tn, together with the LAP used in the Access Code of the received packet. Further, the location of the wireless communication system1100, which is provided by the platform location module1192, step1322, is also recorded. Step1345, which records the times of only Poll and Null packets, is an optional step. As discussed above with reference toFIGS.8and9, all the packets exchanged during a remote name request sequence are single slot packets, with the Access Code based on the Master LAP. Hence, the reception times, tn, of all the received packets may be recorded. Polls and Nulls, however, are very common and a Null tends to always follow a Poll, and hence, the (relative) timing of the two packets is reliable. Step1350may be followed by step1355where the value of n is incremented and the process returns to step1335. The sequence of steps1335,1345,1350, and1355may result in a record of packet reception times, t1 to tn at step1350together with their corresponding LAP; the record continuing until the name request sequence, as discussed above with reference toFIG.8, completes. The sequence may be terminated by the Master710(acting as a wireless receiver/transmitter) transmitting an LMP_detach packet817. If the packet received at step1335is not a Poll or a Null, as determined at step1345, then at step1348it may be determined if the packet is an LMP_detach packet. If step1348is true, then at step1360the time delays td, for that target station may be calculated based upon the recorded packet times, to to tn, from steps1325and1350, as discussed above with reference toFIG.7andFIG.10. When calculating the time delays tn, the LAP for each time, tn, may be checked to ensure that the times correspond to the same target station. The sequence of steps1335,1345,1350, and1355together with step1348may be carried out by processing circuitry1170in wireless receiver1150. The calculations as carried out in step1360may be performed by either in the processing circuitry1170in wireless receiver1150or by the general purpose processor1190. In this latter case, the time and LAP data may be sent to the general purpose processor via data bus1185.

A timeout value, Ttimeout, may be set and at step1340, if a packet is not detected at step1335within a value of Ttimeout or greater, then it may be assumed that the remote name sequence has completed, and step1340may be followed by step1360. In some embodiments, a data message from the processing circuitry1130, indicating that the LMP_Detach packet has been transmitted, may be sent directly to the processing circuitry1170in the wireless receiver1150, via data bus1185and used at step1348.

The process may then return to step1265,FIG.12, where the values for N and M are incremented. A check may then be made at step1270if the new values for N and M are greater than S. If step1270is false, then the process returns to step1210where a new target device with address BD_ADDR(N) may be selected together with a new corresponding LAP(M) for the Master710. If step1270is true, then the process returns to step1205, where the values for N and M are reset to 1.

In order for the wireless receiver1150that is performing the functions of a protocol analyzer to follow the hopping sequence, the FHS packet at step1220needs to be detected. In the embodiment described above with reference toFIG.13, at step1325, the time of the detection of the FHS packet is recorded as the first packet time, t0. As discussed above with reference toFIG.10and equation (3), the first packet time, t0 may refer to a packet transmitted by the Master710(acting as a wireless receiver/transmitter). Poll packets are transmitted by the Master710and Null packets are transmitted by the target device and hence, the reception times of Polls and Nulls only, may be recorded, where the time of the detection of the first Poll packet of the sequence is recorded as the first packet time, t0.

As discussed above with reference toFIG.8, the remote name request sequence ends with an LMP_detach packet817. A series of several Polls and Nulls may continue before the connection is terminated as shown inFIG.9. Step1348determines when the connection is terminated and if so determined, by returning the process to step1210, a new Page and remote name request sequence is started for a new target device and a new corresponding LAP is selected for the Master710, as discussed above with reference to step1202. In each sequence, starting and returning to step1210, the number of packets, mostly Polls and Nulls that are transmitted, may be in the order of200. The corresponding times are recorded together with the LAP associated with each received Poll and Null at step1350, and this list is used in step1360for the calculation of the time delays as discussed above with reference toFIG.10.

The geo-location calculations may be performed by the general purpose processor1190and the transfer of the lists of times and LAPs between the processing circuitry1170and the general purpose processor1190may be subject to delays across the data bus1185as well as processing delays. If a constant BD_ADDR is used for the Master710, then there is no distinction between the sets of time delays and, indeed, the hopping sequences. This may result in time delays being wrongly attributed to a target device, and errors in the geo-location may result. By selecting a unique LAP for the Master710to correspond to each target device, the time delays, together with the LAP form a unique dataset for each target device.

In another embodiment, as discussed above, a number of Masters710may be used such that more than one target device, slave750, may be located simultaneously. With reference to process1200, at step1205, the values of N and M are initialized for each of the Masters710. For example, if there are 3 Masters710present, and, for example, 6 target devices, i.e., N=M=6, then Master A may be used to locate target devices1and2, Master B may be used to locate target devices3and4, and Master C may be used to locate target devices5and6. Hence, target devices1,3, and4may be simultaneously located, followed by target devices2,4, and6being simultaneously located as described above with reference toFIGS.12and13, with the appropriate values of N, M and S being used for each Master710.

FIG.14is a flow diagram of an example process in in a master Bluetooth mobile device configured to communicate with a plurality of target Bluetooth devices. The process may be performed by the processing circuitry1130and the RF front end1120and base band processor1125, (referred to herein collectively as a radio interface) of a Bluetooth mobile device acting as a master Bluetooth mobile device710. The process includes transmitting via the radio interface (RF front end1120and baseband processor1125), for each of a plurality of target Bluetooth devices in turn step1410: establishing communications with the target Bluetooth device by transmitting at least one paging packet, each paging packet including an Access Code derived from a lower address part (LAP) of the target Bluetooth device, at step1415; transmitting a plurality of packets to the target Bluetooth device, each packet including an Access Code derived from an LAP of the master Bluetooth device, the LAP being unique to the target Bluetooth device, at step1420; and receiving a plurality of response packets from the target Bluetooth device, each received response packet having an Access Code derived from the LAP of the master Bluetooth device, at step1425. The process also includes distinguishing between time delays associated with received response packets from the different target Bluetooth devices based at least in part on Access Codes derived from the unique LAPs of the received response packets, at step1430; and determining a location for each of the plurality of target Bluetooth devices based at least in part on the time delay associated with the response packet received from the target Bluetooth device, at step1435.

In some embodiments, the lower address part of the plurality of paging packets are determined by a counter. In some embodiments, a time delay associated with a response packet received from a target Bluetooth device is determined based at least in part on a shift time, the shift time being a time of detection of the response packet relative to a time of detection of a first received response packet of the plurality of received response packets. In some embodiments, the time delay associated with the response packet received from the target Bluetooth device is determined according to: td=(shift time, MOD (2×slot time)−slot time)/2, wherein (shift time, MOD (2×slot time))>slot time, and slot time is a Bluetooth time division multiplex (TDM) slot duration. In some embodiments, a received response packet is a NULL packet. In some embodiments, determining a location for at least one of the plurality of target Bluetooth devices includes simultaneously determining locations of a plurality of target Bluetooth devices from which response packets are received. In some embodiments, only received response packets having an upper address part with an address of the master Bluetooth mobile device are included in distinguishing between time delays. In some embodiments, distinguishing between time delays includes sorting the time delays in order of time of detection. In some embodiments, only time delays associated with response packets received within a time window are sorted. In some embodiments, the method includes transmitting a data message to a target Bluetooth device indicating that a Link Management Protocol (LMP)_Detach packet has been transmitted.

Some embodiments may include one or more of the following:

Embodiment 1

A method for a wireless receiver, the wireless receiver being in communication with a first wireless transmitter/receiver and establishing a communication between the first wireless transmitter/receiver and each of a plurality of wireless transmitter/receiver targets, to identify the wireless transmitter/receiver target that transmits the packets, and the method comprising:creating a set of unique addresses for the first wireless transmitter/receiver for communication with each of the wireless transmitter/receiver targets, such that transmissions to each wireless transmitter/receiver target are sent using a different corresponding unique address;establishing communications, in turn, between the first wireless transmitter and each of a plurality of wireless transmitter/receiver targets using the corresponding unique address; inspecting the addresses in the received packets from the first wireless transmitter/receiver and the wireless transmitter/receiver targets; andmatching the addresses in the received packets to the set of unique addresses to positively identify the transmitter of that packet.
Embodiment 1A.

A method for a wireless receiver for determining the geo-location of a plurality of wireless transmitter/receivers (wireless transmitter/receiver targets), the wireless receiver being in communication with a first wireless transmitter/receiver and establishing a communication between the first wireless transmitter/receiver and each of the wireless transmitter/receiver targets, the wireless receiver and the first wireless transmitter/receiver being movable to a plurality of different locations, the method comprising:creating a set of unique addresses for the first wireless transmitter/receiver for communication with each of the wireless transmitter/receiver targets, such that transmissions to each wireless transmitter/receiver target are sent using a different unique address;at each of the plurality of different locations of the wireless receiver, and for each establishment of a communication between the first wireless transmitter/receiver and a wireless transmitter/receiver target:determining the location of the wireless receiver and the first wireless transmitter/receiver;paging a wireless transmitter/receiver target to establish a communication;for each establishment of a communication between the first wireless transmitter/receiver and a wireless transmitter/receiver target:receiving a plurality of packets transmitted by the first wireless transmitter/receiver;receiving a plurality of packets transmitted by the wireless transmitter/receiver target in response to the packets transmitted by the first wireless transmitter/receiver;determining a reception time of each of the plurality of packets transmitted by the first wireless transmitter/receiver and the wireless transmitter/receiver target, the reception time of each of the plurality of packets having a corresponding time delay, td; andevaluating the address in each of the plurality of received packets and sorting the reception times of each of the plurality of received packets to correspond to a one of the wireless transmitter/receiver targets; anddetermining a location of each wireless transmitter/receiver target identified by the corresponding unique packet address and corresponding calculated time delay delays.
Embodiment 2.

The method of any one of Embodiments 1 and 1A, wherein the wireless receiver, the first wireless transmitter/receiver and the wireless transmitter/receiver targets are Classic Bluetooth Basic Rate devices.

Embodiment 3.

The method of any one of Embodiments 1 and 1A, wherein the set of unique addresses, BD_ADDR for the first wireless transmitter/receiver for communication with each of the wireless transmitter/receiver targets, is such that the upper address part (UAP) and non-significant address part (NAP), are kept constant and only the lower address part (LAP) is unique.

Embodiment 4.

The method of Embodiment 3, wherein the values of the LAP are incremented to correspond with each of the wireless transmitter/receiver targets.

Embodiment 5.

The method of any one of Embodiments 1 and 1A, wherein the establishment of a communication between the first wireless transmitter/receiver and the second wireless transmitter/receiver is initiated by the sending of a Page message from the first wireless transmitter/receiver to the second wireless transmitter/receiver, and wherein the plurality of packets transmitted by the first wireless transmitter/receiver and transmitted by the second wireless transmitter/receiver is increased by the transmission of a Link Management Protocol (LMP) name request from the first wireless transmitter/receiver to the second wireless transmitter/receiver.

Embodiment 6.

The method of Embodiment 1A, wherein the time delay, td, is determined as:
td=(Shift Time, MOD (2×slot time)−slot time)/2,
wherein Shift Time, MOD (2×slot time)>slot time; andwhere “Shift Time” is a recorded reception time of a packet referenced to the recorded reception time of a first received packet by the wireless receiver, and“slot time” is a time division multiplex (TDM) slot duration of a wireless system comprising the wireless receiver, the first wireless transmitter/receiver and the second wireless transmitter/receiver.
Embodiment 7.

The method of any one of Embodiments 1 and 1A, wherein the method further comprises, for each of the received plurality of packets:identifying a packet type; andif the identified packet type is one of a first packet type and a second packet type, recording the reception time of the identified packet.
Embodiment 8.

The method of Embodiment 7, wherein the first packet type is a POLL and the second packet type is a NULL.

Embodiment 9.

The method of any one of Embodiments 1 and 1A, wherein the method further comprises the simultaneous location of a plurality of target devices, the method comprising:deploying a plurality of Master transmitter receivers;deploying a Bluetooth protocol receiver that monitors all channels;evaluating the address in each of the plurality of received packets and sorting the reception times of each of the plurality of received packets to correspond to each one of the wireless transmitter/receiver targets; anddetermining a location of each wireless transmitter/receiver target identified by the corresponding unique packet address and corresponding calculated time delay delays.

As will be appreciated by one of skill in the art, the concepts described herein may be embodied as a method, data processing system, and/or computer program product. Accordingly, the concepts described herein may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects all generally referred to herein as a “circuit” or “module.” Furthermore, the disclosure may take the form of a computer program product on a tangible computer usable storage medium having computer program code embodied in the medium that can be executed by a computer. Any suitable tangible computer readable medium may be utilized including hard disks, CD ROMs, optical storage devices, or magnetic storage devices.

Some embodiments are described herein with reference to flowchart illustrations and/or block diagrams of methods, systems and computer program products. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instruction means which implement the function/act specified in the flowchart and/or block diagram block or blocks.

The computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.

It is to be understood that the functions/acts noted in the blocks may occur out of the order noted in the operational illustrations. For example, two blocks shown in succession may in fact be executed substantially concurrently or the blocks may sometimes be executed in the reverse order, depending upon the functionality/acts involved. Although some of the diagrams include arrows on communication paths to show a primary direction of communication, it is to be understood that communication may occur in the opposite direction to the depicted arrows.

Computer program code for carrying out operations of the concepts described herein may be written in an object oriented programming language such as Java® or C++. However, the computer program code for carrying out operations of the disclosure may also be written in conventional procedural programming languages, such as the “C” programming language. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer. In the latter scenario, the remote computer may be connected to the user's computer through a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).

While the above description contains many specifics, these should not be construed as limitations on the scope, but rather as an exemplification of several embodiments thereof. Many other variants are possible including, for examples: the method used to allocate the BD_ADDR and/or the LAP, the details of the Bluetooth protocol analyzer, the time recording of different packet types, the value of Ttimeout, variations in the details of the wireless communications system. Accordingly, the scope should be determined not by the embodiments illustrated, but by the below-listed claims and their equivalents.

It will be appreciated by persons skilled in the art that the present invention is not limited to what has been particularly shown and described herein above. In addition, unless mention was made above to the contrary, it should be noted that all of the accompanying drawings are not to scale. A variety of modifications and variations are possible in light of the above teachings without departing from the scope of the following claims.