Bluetooth Tutorial

Radio, Baseband,
L2CAP and LMP
Specifications

Apurva Kumar
(www.research.ibm.com/people/k/kapurva)
Research Staff Member
IBM India Research Lab
Bluetooth Physical Layer:
Radio Specifications

 Transmitter
 Operates in the 2.4 GHz unlicensed ISM band.
 79 hop frequencies: f = 2402+k MHz, k= 0,..78.
 Nominal output power = 0 dBm (1 mW).
 GFSK modulation: BT=0.5, 0.28 < m < 0.35.
Bluetooth Radio Specification

 Receiver
 BER < 10-3 for:
 –70dBm input power level.
 11 dB carrier to co-channel interference ratio.
Bluetooth Baseband: General

 Symbol rate = 1 Ms/s.

 Slotted channel with slot time = 625 µs.
 Time-division duplex (TDD) for full-duplex.
 Supports synchronous (voice) channel of 64
kbps in each direction.
 Supports asynchronous channels of upto 721
kb/s (asymmetric) or 432.6 kb/s (symmetric)
Baseband: Physical Channel
 Pseudo-random hopping sequence hopping
through 79 frequencies.
 Hopping sequence determined by address of
the piconet master.
 Master starts transmission in even slot while
slaves start in odd slots.
 Packet transmissions can extend to 5 slots.
 Single hop frequency for each transmission.
Baseband: Physical Links
 Two types of links between master and slaves:
 Synchronous connection oriented (SCO)
 Asynchronous connection less (ACL)
 SCO is a point to point link.
 SCO link reserves slots at regular intervals.
 ACL is a packet switched link between master and all
slaves in the piconet.
 Slaves return packets on ACL link if they are
addressed by the master in the preceding slot.
Baseband: Packets

 Access code identifies a piconet.

 Access code used for piconet communication
derived from the master’s address.
 Access codes used in inquiry, paging.
Baseband: Packet Header

 AM_ADDR: 3 bits: address of slave in piconet.

 TYPE: One of 16 possible packet types
 FLOW: Used to stop flow on ACL link.
 ARQN: Positive or negative acknowlegement.
 SEQN: Inverted for each new transmitted packet.
 HEC: Header-error check.
 The entire header is protected by 1/3 rate FEC.
Baseband: Packet type summary

Type Payload User FEC Symmetric Asymmetric max.

header payload max. rate rate (kbps)
(bytes) (bytes) (kbps) Forward Reverse
DM1 1 0-17 2/3 108.8 108.8 108.8

DH1 1 0-27 no 172.8 172.8 172.8

DM3 2 0-121 2/3 258.1 387.2 54.4

DH3 2 0-183 no 390.4 585.6 86.4

DM5 2 0-224 2/3 286.7 477.8 36.3

DH5 2 0-339 no 433.9 723.2 57.6

ACL packet types

Baseband: Error Correction

 Both forward and backward error correction.

 1/3 rate FEC: used for headers and voice.
 2/3 rate FEC: used for DM packets.
 Stop and wait ARQ.
 CRC is used to detect error in payload.
 Broadcast packets are not acked.
Baseband: Overview of states

 Major states:
– Standby
– Connection

 7 sub-states: used
in device discovery
procedures.
Baseband: Inquiry procedure
 To discover other units in range.
 ID packets containing GIAC are transmitted by inquiring device.
 ID packets sent on inquiry hopping sequence derived from GIAC.
 Inquirer sends 2 ID packets at different frequencies in even slots
and waits for response(s) in the odd slots.
 32 inquiry hop frequencies are split in two 16 hop parts (trains) A
and B. Each train lasts 10msec (16 slots).
 A scanning device listens at one of 32 inquiry frequencies for
11.25 msec at least once every 2.56 sec.
 A/B trains of ID packets are repeated 256 times each.
Baseband: Inquiry and inquiry scan
Freq: 0-15 18-31, 0-1 4-19 22-31, 0-5
A B B Inquiring
A Time
7.68 10.24 (sec) device
0.00 2.56 5.12

Freq: X X+2 X+4 X+6

Time Scanning
: δ δ +2.56 δ + 5.12 δ + 7.68 (sec) device

 On receiving an ID packet, scanning unit backs off for

a random time (max 0.64 sec).
 On receiving another ID packet after waking up, the
scanning unit returns an FHS packet.
Baseband: Paging procedure

 To connect to already known units.

 The 32 hop page sequence is derived from
address of the paged device.
 A/B trains are transmitted once, 128 or 256
times depending upon the paging mode.
 The paged device does scanning continuously,
or once every 1.28 sec or 2.56 sec.
Baseband: Paging and page scan
Baseband: Connection state

 Active mode:
– Bluetooth unit listens for each master transmission.
– Slaves not addressed can sleep through a
transmission.
– Periodic master transmissions used for sync.
 Sniff mode:
– Unit does not listen to every master transmission.
– Master polls such slaves in specified sniff slots.
Baseband: Connection state
 Hold mode
– Master and slave agree on a time duration for which the slave
is not polled.
– Typically used for scanning, paging, inquiry or by bridge slaves
to attend to other piconets.
 Park mode
– Slave gives up AM_ADDR.
– Listens periodically for a beacon transmission to synchronize
and uses PM_ADDR/AR_ADDR for unparking.
Baseband: Payload header

L_CH FLOW LENGTH L_CH FLOW LENGTH Undefined

2 1 5 2 1 9 4
Single slot packet Multi-slot packet
 L_CH field: type of logical channel.
– 00 reserved.
– 01/10 L2CAP.
– 11 LMP.
 Flow bit: used to restrict L2CAP traffic on the ACL link.
 Length: number of bytes in the payload body.
Link Manager Protocol (LMP)

 Used for link set-up, security and control.

 All LMP messages are single slot packets.
 Priority higher than user data (L2CAP).
 Payload body for LM PDUs:
LMP: General PDUs

 LMP_accepted PDU
– Opcode = 3
– Content = Opcode accepted.
 LMP_not_accepted PDU
– Opcode = 4
– Content
 Opcode rejected
 Reason
LMP: Connection Establishment
Paging Paged
unit unit
Baseband page procedures
LMP procedures requiring no
interaction between LM and
higher layers

LMP_host_connection_request

LMP_accepted/LMP_not_accepted
Other LMP procedures
LMP_setup_complete
LMP_setup_complete
LMP: Other procedures

 LMP exchanges are also used for:

 Authentication, pairing, encryption.
 Exchanging clock/slot offset information.
 Switching of master/slave roles.
 Changing power modes.
 QoS negotiation.
Logical Link Control and
Adaptation Protocol (L2CAP)
 Defined for only ACL links.
 L2CAP layer provides protocol multiplexing,
segmentation & reassembly, QoS control.
 L_CH field in the payload header:
 10, start of L2CAP packet.
 01, continuation of L2CAP packet.
 Provides connection-oriented and connection-
less service.
L2CAP: Functional requirements
 Protocol multiplexing: Distinguishes between
upper-layer protocols like SDP, RFCOMM.
 Segmentation of larger packets from higher
layers into smaller baseband packets.
 Allows QoS parameters to be exchanged
during connection establishment.
 Allows efficient mapping of protocol groups to
piconets.
L2CAP: General Operation

 L2CAP channel end-points are represented by

channel identifiers (CIDs).
 An L2CAP channel is uniquely defined by 2
CIDs and device addresses.
 Reserved CIDs
– 0x0001: Signaling channel
– 0x0002: Connection-less reception
– 0x0003-0x003F: Reserved for future use
L2CA layer: Operation between
layers

 Transfers data between higher layer protocols

and lower layer protocols.
 Signaling with peer L2CAP implementation.
 L2CA layer should be able to accept events
from lower/upper layers.
 L2CA layer should be able to take appropriate
actions in response to these events.
L2CA layer: Events and Actions
L2CA layer: Events
 Types of events:
– LP to L2CA events, e.g.
 LP_ConnectCfm: confirms connection at the baseband.
 LP_ConnectInd: informs of a new baseband connection.

– L2CAP to L2CAP signaling events, e.g.

 L2CAP_ConnectReq: Received a connection request pkt.
 L2CAP_ConnectRsp: Positive response received.

– L2CAP to L2CAP data event: data packet received.

– Upper layer to L2CAP events, e.g.
 L2CA_ConnectReq: Request for L2CAP channel.
L2CA layer: Actions
 Types of actions:
– L2CA to LP actions, e.g.
 LP_ConnectReq: Request lower layer for a connection.
 LP_ConnectRsp: Accepting previous connection indication.
– L2CAP to L2CAP signaling actions, e.g.
L2CAP_ConnectReq: Transmitted a connection request pkt.

 L2CAP_ConnectRsp: Positive response transmitted.
– L2CAP to L2CAP data action: data packet transmitted.
– Upper layer to L2CAP actions, e.g.
 L2CA_ConnectInd: Indicates to upper layer that a connection
request has been received.
L2CAP: Signaling

 Signaling
command are sent on CID=0x0001.
 L2CAP signaling is used for:
– L2CAP channel establishment.
– Configuring parameters related to
 Qualityof service.
 Specifying MTU.

– Closing an L2CAP channel.

 Exchanging application specific information.
Other Bluetooth protocols

 RFCOMM: Provides emulation of serial ports

over L2CAP.
 Service Discovery Protocol (SDP):
– Provides attribute based searching of services.
– Provides for browsing through available services.
– Provides means of discovering new services.
– Provides removal of unavailable services.
Bluetooth profiles

 Describe configuration of the Bluetooth stack

for different types of applications.
 Specify minimum requirements from Bluetooth
layers for each profile.
 Generic access profile give recommendations
and common requirements for access
procedures.
Bluetooth profiles