Bluetooth Architecture
Bluetooth Architecture
➢ Let us start our study of the Bluetooth system with a quick overview of what it
➢ The basic unit of a Bluetooth system is a piconet , which consists of a controller node
➢ Multiple piconets can exist in the same (large) room and can even be connected via
➢ In addition to the seven active worker nodes in a piconet, there can be up to 255
➢ These are devices that the controller has switched to a low-power state to reduce
➢ Two minor intermediate power states, hold and sniff, also exist
➢ The reason for the controller/worker design is that the designers intended to
➢ The consequence of this decision is that the workers are fairly dumb, basically just
➢ At its heart, a piconet is a centralized TDM system, with the controller controlling the
lock and determining which device gets to communicate in which time slot.
Bluetooth Applications
➢ Most network protocols just provide channels between communicating entities and
let application designers figure out what they want to use them for.
➢ For example, 802.11 does not specify whether users should use their laptop
➢ At the time of this writing, there are more than two dozen applications, which are
called profiles .
➢ We will omit the complexity here but will briefly look at the profiles to see more
➢ For example, the intercom profile allows two telephones to connect as walkie-
talkies.
➢ The headset and hands-free profiles both provide voice communication between a
headset and its base station, as might be used for hands-free telephony while driving
a car.
➢ Other profiles are for streaming stereo-quality audio and video, say, from a portable
➢ The human interface device profile is for connecting keyboards and mice to
computers.
➢ Other profiles let a mobile phone or other computer receive images from a camera
➢ Perhaps of more interest is a profile to use a mobile phone as a remote control for a
(Bluetooth-enabled) TV.
➢ The personal area network profile lets Bluetooth devices form an ad hoc network or
remotely access another network, such as an 802.11 LAN, via an access point.
➢ The dial-up networking profile was actually the original motivation for the whole
project.
➢ We will skip the rest of the profiles, except to mention that some profiles serve as
➢ The generic access profile, on which all of the other profiles are built, provides a way
to establish and maintain secure links (channels) between the controller and the
workers.
➢ The other generic profiles define the basics of object exchange and audio and video
transport.
➢ Utility profiles are used widely for functions such as emulating a serial line, which is
➢ Was it really necessary to spell out all these applications in detail and provide
different protocol stacks for each one? Probably not, but there were a number of
different working groups that devised different parts of the standard, and each one
just focused on its specific problem and generated its own profile.
➢ It would probably have been possible to get away with two protocol stacks instead
of 25, one for file transfer and one for streaming real-time communication.
➢ The Bluetooth standard has many protocols grouped loosely into the layers shown
in Fig. 4-31.
➢ The first observation to make is that the structure does not follow the OSI model,
➢ Many of the concerns here have to do with the goal of making the system
➢ The link control (or baseband) layer is somewhat analogous to the MAC sublayer but
➢ It deals with how the controller controls time slots and how these slots are grouped
into frames.
➢ Next come two protocols that use the link control protocol.
➢ The link manager handles the establishment of logical channels between devices,
the line will be implemented on a Bluetooth chip, and the protocols above the line
➢ The link protocol above the line is L2CAP (Logical Link Control Adaptation Protocol ).
➢ Many protocols use L2CAP, such as the two utility protocols that are shown.
➢ The service discovery protocol is used to locate services within the network.
serial port found on PCs for connecting the keyboard, mouse, and modem, among
other devices.
➢ The profiles are represented by vertical boxes because they each define a slice of the
➢ Specific profiles, such as the headset profile, usually contain only those protocols
➢ For example, profiles may include L2CAP if they have packets to send but skip L2CAP
➢ In the following sections, we will examine the Bluetooth radio layer and various link
protocols, since these roughly correspond to the physical and MAC sublayers in the
➢ The radio layer moves the bits from controller to worker, or vice versa.
➢ To coexist with other networks using the ISM band, frequency hopping spread
spectrum is used.
➢ There can be up to 1600 hops/sec over slots with a dwell time of 625-µsec.
➢ All the nodes in a piconet hop frequencies simultaneously, following the slot timing
➢ Unfortunately, it turned out that early versions of Bluetooth and 802.11 interfered
➢ The solution is for Bluetooth to adapt its hop sequence to exclude channels on which
➢ The basic scheme is to use frequency shift keying to send a 1-bit symbol every
➢ The enhanced rates are only used in the data portion of frames.
➢ The link control (or baseband) layer is the closest thing Bluetooth has to a MAC
sublayer.
➢ It turns the raw bit stream into frames and defines some key formats.
➢ In the simplest form, the controller in each piconet defines a series of 625-µsec time
slots, with the controller’s transmissions starting in the even slots and the workers’
➢ This scheme is traditional time division multiplexing, with the controller getting half
the slots and the workers sharing the other half. Frames can be 1, 3, or 5 slots long.
➢ Each frame has an overhead of 126 bits for an access code and header, plus a settling
time of 250–260 µsec per hop to allow the inexpensive radio circuits to become
stable.
➢ The payload of the frame can be encrypted for confidentiality with a key that is
➢ The result is that a 5-slot frame is much more efficient than a 1-slot frame because
➢ The link manager protocol sets up logical channels, called links, to carry frames
between the controller and a worker device that have discovered each other.
➢ The old pairing method is that both devices must be configured with the same four-
➢ The matching PIN is how each device would know that it was connecting to the right
remote device.
➢ However, unimaginative users and devices default to PINs such as ‘‘0000’’ and
‘‘1234’’ meant that this method provided very little security in practice.
➢ The new secure simple pairing method enables users to confirm that both devices
are displaying the same passkey, or to observe the passkey on one device and enter
➢ This method is more secure because users do not have to choose or set a PIN.
➢ Once pairing is complete, the link manager protocol sets up the links.
➢ Two main kinds of links exist to carry the payload (user data).
➢ Each SCO link can transmit one 64,000-bps PCM audio channel.
➢ Due to the time-critical nature of SCO links, frames sent over them are never
retransmitted.
➢ This type of link is used for packet-switched data that is available irregularly.
➢ The data sent over ACL links come from the L2CAP layer.
➢ First, it accepts packets of up to 64 KB from the upper layers and breaks them into
➢ When a packet has been reassembled, the L2CAP layer determines which upper-
➢ Bluetooth defines several frame formats, the most important of which is shown in
➢ It begins with an access code that usually identifies the controller so that workers
within radio range of two controllers can tell which traffic is for them.
➢ Next comes a 54-bit header containing typical MAC sublayer fields. If the frame is
➢ For a single time slot, the format is the same except that the data field is 240 bits.
➢ If the frame is sent at the enhanced rate, the data portion may have up to two or
three times as many bits because each symbol carries 2 or 3 bits instead of 1 bit.
➢ These data are preceded by a guard field and a synchronization pattern that is used
➢ That is, the access code and header are carried at the basic rate and only the data
➢ The Address field identifies which of the eight active devices the frame is intended
for.
➢ The Type field identifies the frame type (ACL, SCO, poll, or null), the type of error
correction used in the data field, and how many slots long the frame is.
➢ The Flow bit is asserted by a worker when its buffer is full and cannot receive any
more data.
➢ The entire 18-bit header is repeated three times to form the 54-bit header shown in
Fig. 4-32.
➢ On the receiving side, a simple circuit examines all three copies of each bit.
➢ The reason is that to reliably send data in a noisy environment using cheap, low-
powered (2.5 mW) devices with little computing capacity, a great deal of redundancy
is needed.
➢ Various formats are used for the data field for ACL and SCO frames.
bits.
➢ Three variants are defined, permitting 80, 160, or 240 bits of actual payload, with
➢ In the most reliable version (80-bit payload), the contents are just repeated three
➢ Since the worker may use only the odd slots, it gets 800 slots/sec, just as the
controller does.
➢ With an 80-bit payload, the channel capacity from the worker is 64,000 bps as is the
➢ This capacity is exactly enough for a single full-duplex PCM voice channel (which is
➢ That is, despite a raw bandwidth of 1 Mbps, a single full-duplex uncompressed voice
➢ The efficiency of 13% is the result of spending 41% of the capacity on settling time,
➢ This shortcoming highlights the value of the enhanced rates and frames of more than
a single slot.