Bluetooth: 1.Applications, Technology

And Performance

Bluetooth

A cable replacement technology 1 Mb/s symbol rate Range 10+ meters Single chip radio + baseband

at low power & low price point ($5)

Why not use Wireless LANs?- power- cost

802.11

Replacement for Ethernet Supported data rates

11, 5.5, 2, 1 Mbps; and recently up to 20+Mbps @ 2.4 GHz up to 54 Mbps in 5.7 GHz band (802.11 a)

Range Indoor 20 - 25 meters Outdoor: 50 – 100 meters

Transmit power up to 100 mW Cost:

Chipsets $ 35 – 50 AP $200 - $1000 PCMCIA cards $100 - $150

Cordlessheadset

Emerging Landscape

Which option is technically superior ? What market forces are at play ? What can be said about the future ?

802.11 Bluetooth

LAN AP

802.11b for PDAs Bluetooth for LAN

access

New developments areblurring the distinction

Bluetooth working group history

February 1998: The Bluetooth SIG is formed promoter company group: Ericsson, IBM, Intel, Nokia,

Toshiba

May 1998: Public announcement of the Bluetooth SIG

July 1999: 1.0A spec (>1,500 pages) is published December 1999: ver. 1.0B is released December 1999: The promoter group increases to 9

3Com, Lucent, Microsoft, Motorola

March 2001: ver. 1.1 is released Aug 2001: There are 2,491+ adopter companies

Bluetooth: Today and Tomorrow

Will Bluetooth become a household name?

New Applications

Synchronization

User benefits Automatic synchronization of

calendars, address books, business cards

Push button synchronization Proximity operation

Cordless Headset

User benefits Multiple device access Cordless phone benefits Hands free operation

Cordlessheadset

Usage scenarios examples

Data Access Points Synchronization Headset Conference Table Cordless Computer Business Card Exchange Instant Postcard Computer Speakerphone

BluetoothTechnical overview and

Protocol

Bluetooth Specifications

RF

Baseband

AudioLink Manager

L2CAP

Data

SDP RFCOMM

IP

Single chip with RS-232,USB, or PC card interface

A hardware/software/protocol description An application framework

HC

I

Applications

Interoperability & Profiles

ProfilesP

roto

cols

Applications

Represents default solution for a usage model

Vertical slice through the protocol stack

Basis for interoperability and logo requirements

Each Bluetooth device supports one or more profiles

Bluetooth Profiles (in version 1.2 release)

Generic Access (discovery of Bluetooth devices) Service Discovery (establish connection and Discover available services

and connects devices) Cordless Telephone Intercom Serial Port Headset Dial-up Networking Fax LAN Access Generic Object Exchange Object Push File Transfer Synchronization

Bluetooth Protocol Stack

Composed of protocols to allow Bluetooth devices to locate each other and to create, configure and manage both physical and logical links that allow higher layer protocols and applications to pass data through these transport protocols

RF

Baseband

AudioLink Manager

L2CAP

Data

SDP RFCOMM

IP

Con

trol

Applications

Transport Protocol Group

Bluetooth Radio Specification

RF

Baseband

AudioLink Manager

L2CAP

Data Con

trolSDP RFCOMM

IP

Applications Composed of protocols to allow

Bluetooth devices to locate each other and to create, configure and manage both physical and logical links that allow higher layer protocols and applications to pass data through these transport protocols

Radio Frequency (RF) Sending and receiving modulated bit streams

Baseband Defines the timing, framing Flow control on the link.

Link Manager Managing the connection states. Enforcing Fairness among slaves. Power Management

Logical Link Control &Adaptation Protocol Handles multiplexing of higher level protocols Segmentation & reassembly of large packets Device discovery & QoS

RF - Unlicensed Radio Spectrum

902 Mhz

928 Mhz

26 Mhz 83.5 Mhz 125 Mhz

2.4 Ghz

2.4835 Ghz5.725 Ghz

5.785 Ghz

cordless phonesbaby monitorsWireless LANs

802.11BluetoothMicrowave oven

802.11aHyperLan

33cm 12cm 5cm

RF - Bluetooth radio link

frequency hopping spread spectrum 2.402 GHz + k MHz, k=0, …, 78 1,600 hops per second

GFSK modulation 1 Mb/s symbol rate

transmit power 0 dbm (up to 20dbm with power control)

. . .

1Mhz

1 2 3 79

83.5 Mhz

GFSK Differences & Advantages over FSK Modulation   Q: What are the physical Differences between an FSK & GFSK

Modulator, and how do their results vary?  A1: An FSK Modulator is much the same as a GFSK Modulator,

but GFSK uses a Gaussian filter as well. In a GFSK modulator everything is the same as a FSK modulator except that before the baseband pulses (-1, 1) go into the FSK modulator, it is passed through a gaussian filter to make the pulse smoother so to limit its spectral width

A2: Gaussian filtering is one of the very standard ways for reducing the spectral width, it is called Pulse Shaping. If we use -1 for fc-fd and 1 for fc+fd, once when we jump from -1 to 1 or 1 to -1, the modulated waveform changes rapidly, which introduces large out-of-band spectrum. If we change the pulse going from -1 to 1 as -1, -.98, -.93 ..... .96, .99, 1, and we use this smoother pulse to modulate the carrier, the out-of-band spectrum will be reduced.

Middleware Protocol Group

Middleware Protocol Group

RF

Baseband

AudioLink Manager

L2CAP

Data

SDP RFCOMM

IP

Con

trol

Applications

Middleware Protocol Group

Additional transport protocols to allow existing and new applications to operate over Bluetooth. Packet based telephony control signaling protocol also present. Also includes Service Discovery Protocol.

Middleware Protocol Group (contd.)

Service Discovery Protocol (SDP)Means for applications to discover device info, services and its characteristics.

TCP/IP Network Protocols for packet data communication, routing

RFCOMM(Radio Frequency Communications) Cable replacement protocol, emulation of serial ports over wireless network

Application Group

Application Group

RF

Baseband

AudioLink Manager

L2CAP

Data

SDP RFCOMM

IP

Con

trol

Applications

Consists of Bluetooth aware as well as un-aware applications.

Review FormatAnd Power Mode

Master - Slave

MasterDevice in Piconet whose clock and hopping sequence are used to synchronize all other devices (slaves) in the Piconet.It also carries out Paging procedure and also Connection Establishment.

Slaves Units within the piconet that are syncronized to the master via its clock and hopping sequence.After connetion establishment, Slaves are assigned a temporary 3 bit member address to reduce the no. of addresing bits required

Piconets

Point to Point LinkMaster - slave relationshipBluetooth devices can function as masters or slaves

PiconetIt is the network formed by a Master and one or more slaves (max 7).Each piconet is defined by a different hopping channel to which users synchronize to.Each piconet has max capacity (1 Mbps).Hopping pattern is determined by the master.

m s

s s s

m

Piconet Structure

Master

Active Slave

Parked Slave

Standby

Physical Link Types

Synchronous Connection Oriented (SCO)Point to Point Full Duplex between Master & SlaveEstablished once by master & kept alive till released by MasterTypically used for Voice connection ( to guarantee continuity )Master reserves slots used for SCO link on the channel to preserve time sensitive information

Asynchronous Connection Link (ACL)It is a momentary link between master and slave.No slots are reserved.It is a Point to Multipoint connection.Symmetric & Asymmetric links possible

Packet Types

Controlpackets

Data/voicepackets

ID*NullPollFHSDM1

Voice data

HV1HV2HV3DV

DM1DM3DM5

DH1DH3DH5

Access Code

Header

Payload

Packet Structure

72 bits 54 bits 0 - 2744 bits

DataVoice CRC

No CRCNo retries

header

ARQ

FEC (optional) FEC (optional)

Access Code

Header Payload

Access Code

PurposeSynchronization DC offset compensation Identification Signaling

TypesChannel Access Code (CAC)

• Identifies a piconet.

Device Access Code (DAC) • Used for signalling procedures like paging and response paging.

Inquiry Access Code (IAC) • General IAC is common to all devices, Dedicated IAC is for a

dedicated group of Bluetooth devices that share a common characteristic.

Packet Header

Addressing ( 3 bits )

Packet type (4 bits )

Flow Control ( 1 bit )

1-bit ARQ

Sequencing ( 1 bit )

HEC ( 8 bit ) For filtering retransmitted packets

Verify header integrity

Connection State Machine

Standby

Inquiry Page

Connected

Transmit data

Park Hold Sniff

Connection State Machine (contd.)

Inquiry ScanA device that wants to be discovered will periodically enter this mode and listen for inquiry packets.

InquiryDevice sends an Inquiry packet addressed to GIAC or DIACTransmission is repeated on the inquiry hop sequence of frequencies.

Inquiry ResponseWhen an inquiry message is received in the inquiry scan state, a response packet (FHS) containing the responding device address must be sent after a random number of slots.

Connection State Machine (contd.)

Inquiry Response

Connection State Machine (contd.)

PageThe master uses the clock information, about the slave to be paged, to determine where in the hop sequence, the slave might be listening in the page scan mode. The master sends a page message

Page ScanThe page scan substate can be entered by the slave from the standby state or the connection state. It listens to packets addressed to its DAC.

Page ResponseOn receiving the page message, the slave enters the slave page response substate. It sends back a page response consisting of its ID packet which contains its DAC, at the frequency for the next slot from the one in which page message was received.

Security

Security MeasuresLimited/Restricted Access to authorized users.Both Link Level Encryption & Authentication.Personal Identification Numbers (PIN) for device access.Long encryption keys are used (128 bit keys).These keys are not transmitted over wireless. Other parameters are transmitted over wireless which in combination with certain information known to the device, can generate the keys.Further encryption can be done at the application layer.

Security valuesDevice Address-PublicAuthentication Key(128 bits)-PrivateEncryption Key(8-128 bits)-PrivateRandom Number

Frequency Hop Spread-Spectrum

Bluetooth channel is represented by a pseudo random hopping sequence through the entire 79 RF frequencies

Nominal hop rate of 1600 hops per second

Channel Spacing is 1 MHz

Time-Division Duplex Scheme

Bluetooth devices use a Time-Division Duplex (TDD) scheme Channel is divided into consecutive slots (each 625 s) One packet can be transmitted per slot Subsequent slots are alternatively used for transmitting and

receiving Strict alternation of slots b/t the master and the slaves Master can send packets to a slave only in EVEN slots Slave can send packets to the master only in the ODD slots

Review of basic concepts

RF

Baseband

AudioLink Manager

L2CAP

Data Con

trol

Baseband

RFCOMMSDPIP

Applications

RF

Baseband

AudioLink Manager

L2CAP

Data Con

trolSDP RFCOMM

IP

Applications

Bluetooth Physical link

Point to point link master - slave relationship radios can function as masters or slaves m s

ss

m

s

Piconet Master can connect to 7 slaves Each piconet has max capacity =1 Mbps hopping pattern is determined by the master

Connection Setup

Inquiry - scan protocol to learn about the clock offset

and device address of other nodes in proximity

Inquiry on time axis

Slave1

Slave2

Master

Inquiry hoppingsequence

f1 f2

Piconet formation

Master

Active Slave

Parked Slave

Standby

Page - scan protocol to establish links with

nodes in proximity

Addressing

Bluetooth device address (BD_ADDR) 48 bit IEEE MAC address

Active Member address (AM_ADDR) (see power mode) 3 bits active slave address all zero broadcast address

Parked Member address (PM_ADDR) (see power mode) 8 bit parked slave address

Piconet channel

m

s1

s2

625 sec

f1 f2 f3 f4

1600 hops/sec

f5 f6

FH/TDD

Multi slot packets

m

s1

s2

625 µsec

f1

FH/TDD

Data rate depends on type of packet

f4 f5 f6

Physical Link Types

m

s1

s2

SCO SCO SCO

Synchronous Connection Oriented (SCO) Link slot reservation at fixed intervals

Asynchronous Connection-less (ACL) Link Polling access method

SCO SCO SCOACL ACL ACLACL ACL ACL

Packet Types

Controlpackets

Data/voicepackets

ID*NullPollFHSDM1

Voice data

HV1HV2HV3DV

DM1DM3DM5

DH1DH3DH5

Packet Format

72 bits 54 bits 0 - 2744 bitsAccess code

Header Payload

DataVoice CRC

No CRCNo retries

625 µs

master

slave

header

ARQ

FEC (optional) FEC (optional)

Access Code

Synchronization DC offset compensation Identification Signaling

Access code

Header Payload

72 bits

Purpose

Channel Access Code (CAC) Device Access Code (DAC) Inquiry Access Code (IAC)

Types

X

Packet Header

Addressing (3) Packet type (4) Flow control (1) 1-bit ARQ (1) Sequencing (1) HEC (8)

Access code

Header Payload

54 bits

Purpose

Encode with 1/3 FEC to get 54 bits

Broadcast packets are not ACKed

For filtering retransmitted packets

18 bitstotal

ss

m

s

16 packet types (some unused)

Max 7 active slaves

Verify header integrity

Voice Packets (HV1, HV2, HV3)

Data Packet Types

DM1

DM3

DM5

DH1

DH3

DH5

2/3 FEC

No FEC

Symmetric Asymmetric

108.8 108.8 108.8

258.1 387.2 54.4

286.7 477.8 36.3

Symmetric Asymmetric

172.8 172.8 172.8

390.4 585.6 86.4

433.9 723.2 57.6

Inter piconet communication

Cell phone Cordlessheadset

Cordless

headset

Cell phone

Cordlessheadset

Cell phone

mouse

Scatternet

Scatternet, scenario 2

How to schedule presence in two piconets?

Forwarding delay ?

Missed traffic?

Baseband: Summary

TDD, frequency hopping physical layer Device inquiry and paging Two types of links: SCO and ACL links Multiple packet types (multiple data rates with

and without FEC)

Baseband Baseband

L2CAPL2CAPLMPLMP

Physical

Data link

Device 2Device 1

Link Manager Protocol

Setup and management of Baseband connections

• Piconet Management• Link Configuration• Security

LMP

RF

Baseband

AudioLink Manager

L2CAP

Data Con

trolSDP RFCOMM

IP

Applications

Piconet Management

Attach and detach slaves Master-slave switch Establishing SCO links Handling of low power modes ( Sniff, Hold, Park)

req

response

Paging

Master

Slaves

s

m

s

Low power mode (hold)

Slave

Hold duration

Hold offset

Master

Hold Mode

By this capacity can be made free to do other things like scanning, Slave temporarily (for Thold sec) does not support ACL packets on the channel (possible SCO links will still be supported).

paging, inquiring, or attending another piconet.

The slave unit keeps its active member address (AM_ADDR)

Low power mode (Sniff)

Master

Slave

Sniff period

Sniff offset

Sniff duration

Sniff Mode (Traffic reduced to periodic sniff slots)This is a low power mode in which the listening activity of the slave is reduced.

In the sniff mode, the slave listens for transmissions only at fixed intervals Tsniff, at the offset slot Dsniff for Nsniff times. These parameters are given by the

LMP in the master when it issues the SNIFF command to the slave.

Low power mode (Park)

Master

Slave

Beacon interval

Beacon instant

Park Mode (Power saving + keep more than 7 slaves in a piconet) This is a very low power mode with very little activity. The slave however, stays synchronized to the channel. The parked slaves regularly listen for beacon signals at intervals decided by the

beacon structure communicated to the slave during the start of parking. The parked slave has to be informed about a transmission in a beacon channel

which is supported by the master to keep parked slaves in synchronization and send them any other information.

Any message to be sent to a parked member are sent over the broadcast channel. Communication via broadcast LMP messages.

It also helps the master to have more than seven slaves

Connection establishment & Security

Goals Authenticated access

Only accept connections from trusted devices

Privacy of communication prevent eavesdropping

Constraints Processing and memory

limitations $10 headsets, joysticks

Cannot rely on PKI Simple user experience

LMP_host_conn_req

LMP Accepted

Security procedure

Paging

Master

Slave

LMP_setup_complete

LMP_setup_complete

Authentication

Authentication is based on link key (128 bit shared secret between two devices)

How can link keys be distributed securely ?Verifier

Claimant

challenge

response

accepted

Link key Link key

Pairing (key distribution)

Pairing is a process of establishing a trusted secret channel between two devices (construction of initialization key K init)

Kinit is then used to distribute unit keys or combination keys

Random number

Kinit

PIN + Claimant address

Randomnumber

PIN + Claimantaddress

Randomnumber

Verifier Claimant

Kinit

challenge

response

accepted

Link Manager Protocol Summary

Piconet management Link configuration

Low power modes QoS Packet type selection

Security: authentication and encryption

Baseband Baseband

L2CAPL2CAPLMPLMP

Physical

Data link

Device 2Device 1

L2CAP

Logical Link Control andAdaptation Protocol

L2CAP provides• Protocol multiplexing• Segmentation and Re-assembly• Quality of service negotiation

RF

Baseband

AudioLink Manager

L2CAP

Data

SDP RFCOMM

IP

Applications

Why baseband isn’t sufficient

Baseband

• Baseband packet size is very small (17min, 339 max) • No protocol-id field in the baseband header

IP RFCOMM IP RFCOMM

reliable*, flow controlled

MultiplexingdemultiplexingMTU

in-sequence, asynchronous link

IP RFCOMM

Need a multiprotocol encapsulation layer

IP RFCOMM

reliable*, in-order, flow controlled, ACL link

Desired features• Protocol multiplexing• Segmentation and re-assembly• Quality of service

What about• Reliability?• Connection oriented or connectionless?• integrity checks?

unreliable, no integrity

Segmentation and reassembly

Length Payload

Basebandpackets

start ofL2CAP

continuationof L2CAP

continuationof L2CAP

CRC CRC CRC

• cannot cope with re-ordering or loss• mixing of multiple L2CAP fragments not allowed• If the start of L2CAP packet is not acked, the rest should be discarded

min MTU = 48672 default

Serial Port Emulation using RFCOMM

Serial Port emulation on top of a packet oriented link• Similar to HDLC• For supporting legacy apps

RF

Baseband

AudioLink Manager

L2CAP

Data

SDP RFCOMM

IP

Applications

Serial line emulation over packet based MAC

L2CAP

Design considerations framing: assemble bit stream into

bytes and, subsequently, into packets transport: in-sequence, reliable

delivery of serial stream control signals: RTS, CTS, DTR

RFCOMM

L2CAP

RFCOMM

GOALS

IP over Bluetooth V 1.0

Internet access using cell phones Connect PDA devices & laptop

computers to the Internet via LAN access points

RF

Baseband

AudioLink Manager

L2CAP

Data

SDP RFCOMM

IP

Applications

LAN access point profile

SecurityAuthenticationAccess control

Efficiencyheader and data compression

Auto-configurationLower barrier for deployment

Why use PPP?

Access Point

Baseband

L2CAP

RFCOMM

PPP

IP

Inefficiency of layering

Emulation of RS-232 over the Bluetooth radio link could be eliminated

L2CAP

RFCOMM

rfc 1662

PPP

IP

L2CAP

RFCOMM

rfc 1662

PPP

IP

Palmtop LAN access point

packet oriented

packet oriented

byte oriented

Terminate PPP at LAN access point

PPP server function at each access point management of user name/password is an issue roaming is not seamless

Bluetooth

RFCOMM

PPP

IP

Bluetooth

RFCOMM

PPP

IP

ethernet

Palmtop Access Point

L2TP tunneling

Tunneling PPP traffic from access points to the PPP server 1) centralized management of user name/password 2) reduction of processing and state maintenance at each access

point 3) seamless roaming

Bluetooth

RFCOMM

PPP

IP

Palmtop Access Point

Bluetooth

RFCOMM

PPP

IP

ethernet

IP

UDP

ethernet

IP

UDP

PPP server

Seamless roaming with PPP

AP1

Server

AP2

MAC level registration MAC level handoff

REQ1

RPL2 REQ

3

RPL4

CLR5

palmtopPPP PPP

PPP

BluetoothCurrent Market

Outlook

Market Forcasts for year 2005

Units sold annually Revenue Chip price

1.4 bn

$ 5.4 bn

$ 3.6 995 m

$ 4.4 bn

$ 4.4

$ 2.02

$ 4.3 bn

$ 2.2 bn

2.1 bn

1.5 bn

Cahners In-stat (2000 forcast)

revised (2001 forcast)

Merrill Lynch (2000 forcast)

revised (2001 forcast)

Value to carriers: Synchronization and Push

More bits over the air Utilization of unused capacity

during non-busy periods Higher barrier for switching

service providers

Value to carriers: Cell phone as an IP gateway

More bits over the air Enhanced user experience

Palmpilot has a better UI than a cell phone

Growth into other vertical markets

Will Pilot and cell phone eventually merge?

Value to carriers: Call handoff

More attractive calling plans Alleviate system load during peak periods Serve more users with fewer resources

Threat or opportunity?

Cordless base

Biggest challenges facing Bluetooth

Interoperability Always a challenge for any new technology

Hyped up expectations Out of the box ease of use Cost target $5 Critical mass RF in silicon Conflicting interests – business and engineering

References

[1] IEEE 802.11, “Wireless LAN MAC and Physical Layer Specification,” June 1997.

[2] Hirt, W.; Hassner, M.; Heise, N. “IrDA–VFIr (16 Mb/s): modulation code and system design.” IEEE Personal Communications, vol.8, (no.1), IEEE, Feb. 2001.

[3] Lansford, J.; Bahl, P. “The design and implementation of HomeRF: a radio frequency wireless networking standard for the connected home.” Proceedings of the IEEE, IEEE, Oct. 2000.

[4] Specification of Bluetooth System, ver. 1.0, July 1999

References (cnt)

[5] Haartsen, J.C. “The Bluetooth radio system.”, IEEE Personal Communications, IEEE, Feb. 2000.

[6] Haartsen, J.C. ‘Bluetooth towards ubiquitous wireless connectivity.’, Revue HF, Soc. Belge Ing. Telecommun. & Electron, 2000. p.8–16.

[7] Rathi, S. “Bluetooth protocol architecture.” Dedicated Systems Magazine, Dedicated Systems Experts, Oct.–Dec. 2000.

[8] Haartsen, J.C.; Mattisson, S. “Bluetooth–a new low–power radio interface providing short–range connectivity.” Proceedings of the IEEE, IEEE, Oct. 2000.

[9] Gilb, J.P.K “Bluetooth radio architectures.” 2000 IEEE Radio Frequency Integrated Circuits (RFIC) Symposium Digest of Papers, Boston, MA, USA, 11–13 June 2000.

References (cnt)

[10] N. Benvenuto, G. Cherubini, “Algoritmi e circuiti per le telecomunicazioni”, Ed. Libreria Progetto.

[11] The Bluetooth Special Interest Group, Documentation available at http://www.bluetooth.com/

[12] IEEE 802.15 Working Group for WPANs™; http://www.manta.ieee.org/groups/802/15/

[13] Barker, P.; Boucouvalas, A.C.; Vitsas, V. “Performance modelling of the IrDA infrared wireless communications protocol.” International Journal of Communication Systems, vol.13, Wiley, Nov.–Dec. 2000.

[14] Tokarz, K.; Zielinski, B. “Performance evaluation of IrDA wireless transmission.” 7th Conference on Computer Networks, Zakopane, Poland, 14–16 June 2000.

[15] ETSI RES, “Digital European Cordless Telecommunications (DECT), Common interface Part 1: Overview,” ETS 300 175–1, 1996.

Synchronization using a Beacon (infrastructure)

beacon interval

tmedium

accesspoint

busy

B

busy busy busy

B B B

value of the timestamp B beacon frame

Synchronization using a Beacon (ad-hoc)

tmedium

station1

busy

B1

beacon interval

busy busy busy

B1

value of the timestamp B beacon frame

station2

B2 B2

random delay