Universal wireless connectivity Ubiquitous computing

Wireless CommunicationBluetooth1

Dr. Martin LandHadassah CollegeSpring 2010

Bluetooth



The Bluetooth VisionUniversal wireless connectivity

Replace existing cables with radioConnect systems that have been separate

Ubiquitous computing environmentIntelligent devices performing distributed servicesRedesign hardware as object-oriented

Unconscious connectivity paradigmDevices interconnect automaticallyMinimal user intervention

Wireless Personal Area Network (wPAN)Small networks formed dynamicallyWireless internetworking among wPANs



Universal Wireless ConnectivityReplace existing cables with radio



Universal Wireless ConnectivityConnect systems that have been separate



Ubiquitous Computing EnvironmentIntelligence is local and communication is universalBluetooth devices

Search for other compatible devicesShare information about services they provideExchange commonly defined data objects

Service provision is distributed over wPANIntegrated automation of

Central serversInformation repositoriesSensors Actuators



Example of Ubiquitous Computing EnvironmentAutomated integration of:

PCPDATelephoneStereo Systemmp3 deviceGlobal Positioning System (GPS) Coffee PotToaster Oven



Unconscious Connectivity ParadigmConnectivity is a problem for the user

Inconvenient to establish connections manuallyAvailable devices change frequently Users may not remember how to connect

Devices connect automatically and dynamically Devices discover one anotherDevices determine when and why to connectUsers do not need to remember how to connect



Wireless Personal Area Network (WPAN)Small network ⎯ Piconet ⎯ formed dynamicallyShort-range, Ad Hoc networks Device can belong to several Piconets simultaneouslyEach Piconet has

One “Master” device (Primary)1 to 7 “Slave” devices (Secondary)



Example of The VisionUser

Enters hotel lobbyPDA in user's pocket

Connects to hotel reservations system for check inReceives key code for doorDisplays room number Alerts laptop in suitcase to log onto hotel email server

User's Laptop Downloads messages while user waits for elevator

User's PDA Unlocks door of hotel room

User's laptop Uploads music to audio system

User's PDA Orders room service from menu user prepared on airplane



Example of a Real ProductThree-in-One TelephoneAutomatic network selection by environment:

Intercom at home or in office PSTN phone when a PSTN access point is availableCellular mobile phone otherwise



How is Bluetooth Different?In cellular and wLAN systems:

Base Stations and Mobile Stations are clearly distinctBase Stations handle services

Channel accessChannel allocationTraffic controlInterference problems

Mobile Stations are relatively simple clients

In Ad Hoc Bluetooth networks:Communication is peer to peer

No central controllerDevices in area self-organize in a shared channel

May be many Bluetooth devices in regionOnly a few need to communicate Mutual coordination is complex



Bluetooth Standards and InformationBluetooth Special Interest Group (SIG)

Commercial consortium founded by: Ericsson, IBM, Intel, Nokia and Toshiba

Issued Bluetooth Specification 1.1Basic protocol specification (1,084 pages)Generic application specification (452 pages)

Standardized by IEEE 802 CommitteeIEEE Std 802.15.1™-2002 Specification for

Wireless Personal Area Networks (wPANs) Covers only Infrastructure Layers

Physical and Data Link IssuesDoes not address service provision



Problems with Bluetooth Specification1536 pages with no system overview chapter

Each protocol layer is described in isolationPoor definition of states and events

States and state transitions given identical namesStates are named after their default activity

IEEE 802.15 Standard is better writtenProvides overviewIncludes a formal description, written in Specification and

Description Language (SDL)



Bluetooth HistoryDesigned in 1994 by Ericsson of SwedenStandard is named after Harald Blaatand "Bluetooth" II

King of Denmark 940-981 C.E.United Denmark and Norway

Bluetooth Special Interest Group (SIG)Founded by Ericsson, IBM, Intel, Nokia and ToshibaIncludes 3Com, Microsoft, Lucent and Motorola Over 2000 other companies



Bluetooth Standard StructuresServices and functionality

Device discoveryFormation of wPANsService discoverywPAN management

Protocol structure and functionsApplication functionsSession/Transport functionsData Link functionsPhysical transmission functions

Generic application profilesSerial data transferTelephony Packet servicesDevice specific services



Protocol Layers

Application

Application Profiles

L2CAP

HCI

LMP

Baseband

RadioPhysical Functions

Data Link(LLC + MAC)

Functions

Session/Transport Functions

Application Functions

Physical Layer

MAC Sublayer

Application Layer

BluetoothProtocols

Mapping toOSI

ActualFunctionality



Protocol Overview

Application Layer User application programs

Application Profiles User application support protocols: FTP, TCP, WAP, PPP, telephony, USB, Serial Port, etc

Logical Link Control and Adaptation Protocol (L2CAP)

Channel management (socket-type interface), Segmentation and Reassembly, QoS (speed, reliability, delay)

Host Controller Interface (HCI)

Supports standard I/O hardware standards (when Bluetooth device is external to PC)

Link Manager Protocol (LMP)

Manages Piconet membership and link activity

Baseband Layer Manages point-to-point links, handles security, and interfaces user data to the radio links

Radio Layer Physical data transmission (FHSS in ISM band, at 10 or 100 meter broadcast range)



Frequency Hopping Bluetooth transmits using Frequency Hopping (FHSS)

Group of RF frequencies = 2401 + k MHz, for k = 0, 1, … , 78

Specific Hop Sequence depends onBluetooth Service Bluetooth ClockBluetooth Device

Data transmission Pseudorandom hop sequence

Connection control Deterministic hop sequences

Frequency Hop SequenceTrain = sequence of integers {k0, k1, k2, …, kN} 0 ≤ ki ≤ 78, for i = 0, 1, …, N N = 16 or 32



Time SlotsBluetooth Clock is a 28-bit counter

Upper 27 bits define Bluetooth Time Slot2 Clock Cycles per Time SlotCounter creates 227 = 134,271,728 numbered Time SlotsCounts from 0 to 227 – 1 (then returns to 0)

Each Time Slot is 625 µs in length (1600 slots/second)Time slot number returns to 0 every 23.3 hours



Frequency HoppingPacket transmission begins on a Time Slot boundaryPackets may be up to 5 Time Slots in length

Frequency hop on each Time SlotUnless packet is longer than 1 SlotNo frequency hop during a multi-slot packet

t0 t1 t2 t3 t4 t5 t6 t7

f0 f1 f2 f3 f5 f6 f7



Piconet TopologiesPiconets (from pico = 10-12)

Physical Channel Specific Frequency Hop Sequence

Point-to-Point PiconetTwo devices on a common Physical ChannelFHS is unique to a given PiconetMaster device acts as clientSlave device acts as server

Master Slave



Wireless Personal Area Networks (WPAN)Point-To-Multipoint Piconet

One device is Master 1 to 7 Slaves in active connection to master1 to 256 Slaves in passive connection to master

Passive connection called "parked" state

Master

SlaveSlave

Slave



Wireless Personal Area Networks (WPAN)Combination of PiconetsSome devices act as

Master in one Piconet Slave in another Piconet

Master

Slave

Slave

Slave

Master

Slave

SlaveSlave

Master

Master

Slave

Master

Slave

Master

Slave



Synchronous Connection Oriented (SCO) LinksPoint-to-Point link between Master and SlaveCircuit-mode connection based on reserved slots

Symmetric transmission rateSupports isochronous information like voice

Master can support 1 to 3 SCO links to one or more Slaves

Slave can support 1 to 3 SCO links with one Master1 or 2 SCO links from different Masters



Asynchronous Connectionless Link (ACL)Point-to-Multipoint link

Connects Master and all active Slaves in PiconetPacket-mode connection

Based on statistical multiplexingUses available slots not reserved for SCO links

Asynchronous and Isochronous services supportedOnly one ACL link between a Master and a Slave



Bluetooth Connection Layers

radio radioConnection: synchronized frequency hop sequence

circuitswitch SCO: synchronous connection-oriented link

ACL: asynchronous connectionless link

SCO ACL SCO ACL SCO ACL packets over radio connection

circuitmodeservice circuit mode channel

circuitmodeservice

packetmodeservice

packetmodeservice packet mode channel

packetmodeservice

packet mode channel

C B A

A A A

B B B

packetmodeservice packet mode channel

packetmodeservice

C C C

packetswitch

circuitswitch

packetswitch

packetmodeservice

channelmultiplexing



Overview of Services and FunctionalityLow Level Connection

Standby ⎯ Bluetooth communication is not activeInquiry ⎯ Bluetooth device identifies other devicesPaging ⎯ Devices synchronize a physical radio linkLink Establishment ⎯ Devices establish digital data links

High Level ConnectionService Discovery ⎯ Devices exchange capability informationService ⎯ Applications open service channels over the link

Power ManagementOperational Modes ⎯ Active, Sniff, Hold, and Parked



State Relationships



Device Standby ConditionLow power state

Bluetooth transmission system inactiveBluetooth Internal System Clock is running

Clock must run to maintain synchronization

Clock synchronization methodDevices have independently running internal clocksClock Offset = difference between 2 clock valuesStandby device

Stores offset for device discovered by InquiryEstimate device synchronization using stored offset

Slave device stores offset for Master deviceSynchronizes to Master using stored offsetMaintains offset and internal clock in low power modes



Inquiry ProceduresBluetooth device searches for other devices

InquiryInquiry

Device inInquiry State

Device inInquiry Scan

State

InquiryResponse

Inquiry

Response

Device entersInquiry Response

State

Device inInquiry Scan

State

Device entersInquiry Response

State



Inquiry Inquiring device enters Inquiry State

Transmits Inquiry message Contains code for Inquiry Type

General Inquiry Addressed to all devices

Dedicated Inquiry Addressed to a particular class of devices Printers, telephones, etc



Inquiry Hop Sequence (Train)Inquiry message repeated 16 times during 32 Time Slots

Each transmission at a different frequencyListens for Responses in alternate Time Slots

Two defined frequency Inquiry Trains ⎯ A and BEach Train repeated 256 times

Enough time to collect all Inquiry Responses Total time required for Inquiry is

t0 t1 t2 t3 t28 t29 t30 t31

f0 f1 f14 f15...

Inquiryseconds 10.24

slot timeμsec 625

Inquiryattempts 256

attemptTrains 2

Trainslots time 32

=×××



Inquiry Scan Devices periodically enter Inquiry Scan State

Enter from Standby State or Connected StateActive SCO links are maintained Active ACL links are suspended

Device listens for Inquiry message packets Listens at just one frequencyChosen from Inquiry Train A or BParticular frequency depends on device address

Listens in Inquiry Scan State for at least 32 Time SlotsCovers both A and B frequency trains



Inquiry Response — 1Responding device

Leaves Inquiry Scan State Enters Inquiry Response State Sends Inquiry Response

Response contains FHS PacketLower Address Portion (LAP)

Lower 24 bits of 48-bit full hardware addressFrequency Hop Synchronization (FHS)

Value of internal clock in responding device



Inquiry Response — 2Inquiring Device

Receives FHS Packet from responding deviceCalculates clock offset

Clock Offset = master clock - received FHS clock“Virtual Clock” = Master clock + offset

Stores device address and clock offset Builds database of devices and “virtual clocks”

Uses database information when connecting to device



Paging ProceduresDevices use stored FSH

packet from other devices

Devices synchronize on a physical radio link

Paging device becomes Piconet Master

PageDevice entersPaging State

Device inPage Scan

State

Page

Response

Device entersSlave PageResponse

State

FHS

ACK

Device entersMaster Page

ResponseState

Poll

NullConnected

SlaveConnectedMaster



PagingDevice has database of stored FHS Packets

Received and Stored during Inquiry StateDatabase includes

24-bit Lower Address Portion (LAP) Clock Offset for each device

Device initiates connection as MasterChooses device from database to be SlaveCalculates Slave Device Access Code (DAC)

Long code derived from LAP68 bits (for short ID packet) or 72 bits (if followed by a header)Used for addressing, timing synchronization, DC-offset compensation

Estimates when Slave enters Page Scan StateBased on stored Clock Offset for deviceMay be totally wrong Master and Slave not yet synchronized

Page

PageResponse

FHS

ACK

Poll

Null



PagingMaster transmits Page message

Page message length is 1 time slotPage repeated on all Slave Scan frequencies

Page Hop Frequency TrainsTwo 16-frequency Trains (A and B)Calculated from stored Device Address

Transmission starts at estimated Slave listening frequency

Each Page Train is repeated up to 128 timesMaster waits for Page Response between Page TrainsPage Train stopped if response is received

t0 t1 t2 t3 t14 t15

f0 f1 f14 f15...f2

Page

PageResponse

FHS

ACK

Poll

Null



Page ScanDevice periodically enters Page Scan State

Enters from Standby State or Connection StateResponds as Slave deviceSlave listens for Page Messages

Addressed to its Device Access Code (DAC)Listens at unique Scan frequency fk

One frequency from Page TrainCalculated from Device Address

Listens to entire Page TrainDoes not respond in Page Scan StateMust not interrupt Page Train

Slave receives Page Message

Page

PageResponse

FHS

ACK

Poll

Null



Page Response ⎯ 1Device leaves Slave Page Scan StateEnters Slave Page Response StateSends Page Response Message

On unique Response frequencyfk = Scan frequency ⇒ fk+1 = Response frequency Transmitted in time slot k+1

Response provides Master with Slave’s unique Scan frequency

Page Response is short packet ID packet containing 68-bit DAC

t0 t1 t2 t3 tk t15

f0 f1 fk f15...

f2

Slave listens forPaging on fk

Slave sendsPage Response

on fk+1

...

tk+1

fk+1

t0 t1 t2 t3 tk t15tk+1

fk+1

Page

PageResponse

FHS

ACK

Poll

Null



Page Response ⎯ 2Master receives Page Response Message

Synchronizes to Slave listening frequency Received Slave Page Response on frequency fk+1

Transmits next packet to Slave on frequency fk+2

Enters Master Page Response State

Master sends FHS packet to Slave on frequency fk+2

Provides Slave with Master Lower Address Portion (LAP)Slave stores clock offset for Master

Slave now synchronized to Master

Assigns Slave Active Member Address 3-bit AM_ADDR7 active slaves per Piconet

Slave acknowledges FHS with ACK (ID packet)

Page

PageResponse

FHS

ACK

Poll

Null



Page Response ⎯ 3Master responds to ACK (ID packet) with Poll Packet

Addressed to Slave’s Active Member Address Slave responds with Null Packet (header only)

If Response Procedure is successfulPaging is finishedMaster and Slave are in Connected State

Synchronized on a radio link

Otherwise, Paging has failed Error procedures are followed

Page

PageResponse

FHS

ACK

Poll

Null



Connection Modes Connected devices may establish digital links

Synchronous Connection Oriented (SCO) LinkPoint-to-Point circuit-mode connection

Asynchronous Connectionless Link (ACL)Point-to-Multipoint Packet-mode connection



Digital Link EstablishmentMaster sends Link Manager

Protocol (LMP) Request to set up ACL

Slave Accepts or Rejects link

Slave may request to exchange roles (become Master)

Master may Accept or Reject

LMPConnectRequest

LMPAccept

ConnectedSlave

ConnectedMaster

LinkedSlave

LinkedMaster



Service DiscoveryService Discovery Protocol (SDP)

Invoked when Connection State establishedOpens Channel on ACL link

Master SDP (client) Queries Slave SDP (server) about available services Maintains database of services available from slaves

Slave SDP (server) Provides service information

SPD specifies Database structure Service codes



ServiceApplications identify service providers using SDP

Packet-oriented applications Open channels on ACL linkChannels use a source/destination port session structure

One connection-oriented application Can open a channel on SCO linkSCO channel transfers raw data

Channels are a time division sharing of ACL link



Predefined ServicesDefined through the Application Profiles

Service Discovery Protocol (SDP)Telephony Control Protocol Specification (TCS)Serial Data communicationWAPObject ExchangeProtocol Support (TCP/IP, PPP, email, … )



Active Mode Full power modeUnits actively communicate

Master and Slaves transmit in alternate slotsMaster transmits in every even numbered slotThe addressed Slave transmits in the next odd numbered slot

Transmissions from Master keep all Slaves synchronized



Sniff Mode A low power mode for Slave

Listening activity of the Slave is reduced

Slave listens for transmissions Only at fixed intervals Tsniff

At the offset Slot Dsniff

For Nsniff Time Slots



Hold Mode SCO links may remain activeACL link is put on hold

Slave may enter sleep modeDevice keeps its Active Member Address

Extra capacity can be used for ScanningPagingInquiringCommunicating in another Piconet

Master and Slave agree on hold intervalAfter hold interval Slave returns to Active Mode



Park Mode Very low power Slave mode

Slave gives up its 3-bit Active Member Address

Slave gets 8-bit Parked Member Address

Used by Master to Unpark a slave

8-bit Access Request Address Used by Slave to ask Master to Unpark it

Slave stays synchronized to the channel



Protocol Layers

Application


L2CAP

HCI

LMP

Baseband

RadioPhysical Functions

Data Link(LLC + MAC)

Functions

Session/Transport Functions

Application Functions

Physical Layer

MAC Sublayer

Application Layer

BluetoothProtocols

Mapping toOSI

ActualFunctionality



Application LayerUser programsNetworking clients

InterfacesMay invoke Application Profile for protocol supportMay request channel in ACL link from L2CAPMay request SCO channel from Baseband

Application


L2CAP

HCI

LMP

Baseband

Radio

BluetoothProtocols



Application ProfilesService Discovery Protocol (SDP)

Client/Server architectureServer maintains database of provided servicesClient may query specific service or all services

Telephony Control Protocol Specification (TCS)

RFCOMM parallel and serial port emulation

Network Protocol EmulationTCP/IP, PPP, FTP, WAP, …

OBEXTransaction oriented Object ExchangeSimilar to HTTP

Request channel in ACL link from L2CAP

Application


L2CAP

HCI

LMP

Baseband

Radio

BluetoothProtocols



L2CAP ⎯ 1Logical Link Control and Adaptation Protocol

Protocol Multiplexing Divides ACL links into channelsOne channel per service between two devicesL2CAP packet header contains the service’s channel number

Segmentation and Reassembly (SAR)L2CAP accepts Application packets

0 to 64 KB Baseband packet SDU is 0 to 2745 bits

QoS ManagementPeak bandwidthLatency Delay variation

Application


L2CAP

HCI

LMP

Baseband

Radio

BluetoothProtocols



L2CAP ⎯ 2Unreliable session-type service

No error checking Relies on Baseband for error control, security and packet ordering

Establishes a separate Signaling Channel Connection requestConfigurationDisconnection Echo (for testing)

Transaction OrientedReceives request from upper layerPerforms actionsReturns responses to upper layer

L2CAP usually invokes service from LMP

Application


L2CAP

HCI

LMP

Baseband

Radio

BluetoothProtocols



Link Manager Protocol (LMP)Manages ACL link establishment state

Transaction process with basebandHandles Link configuration (hopping sequence for each Piconet)Juggles participation in multiple Piconets

(and their hop sequences)Manages Inquiry and Paging

Transaction process with basebandAttaches/detaches Slaves (by Master)Exchanges Master/Slave roles

Manages low power modes: Hold, Sniff, ParkManages Security functions

Authentication of devicesLMP Packet Header contains

Addresses (Device, Active Member, Access Code)Reliability Parameters (SEQ, ACK, HEC, Flow Control)

LMP invokes services from Baseband Layer

Application


L2CAP

HCI

LMP

Baseband

Radio

BluetoothProtocols



BasebandPerforms frequency hopping (one Piconet at a time)Lower level encryption (generates encryption keys)Performs services for LMP

Inquiry and PagingLink establishment Connection establishment (SCO/ACL)

Clock synchronizationAddress discovery Error correction Data whitening

Forwards data to Radio Layer (one Piconet at a time)

Application


L2CAP

HCI

LMP

Baseband

Radio

BluetoothProtocols



RadioPerforms physical transmission/reception

Transmission Frequencies2402 + k MHz, where k= 0,1,...,78Actual k value is determined by Baseband

Deterministic Frequency Hopping Trains for ManagementPseudo-random Frequency Hopping Trains for data transmission

Transmitter Power 0 dBm (1 mW) for 10 m transmission range 20 dBm (100 mW) for 100 m range

Application


L2CAP

HCI

LMP

Baseband

Radio

BluetoothProtocols



Host Controller Interface For external Bluetooth transmitter modules

Host data sent to via I/O port Serial port, parallel port, or USB

High level stackApplication, Profiles, L2CAPRuns under host OS

Low level stackRadio, Baseband, LMPRuns in external hardware

Host Controller Interface (HCI) Interfaces I/O port driver to L2CAPStandard software driver operates I/O port for the OS

Application


L2CAP

LMP

Baseband

Radio

BluetoothProtocols

HCI



Host Controller Interface Operation



Review of the Connection Process ⎯ 1Low Level Connection ⎯ Initiated and managed by LMP layer

Device DiscoveryInquiry ⎯ Device A initiates InquiryInquiry Scan ⎯ Device B listens for Inquiry packetsInquiry Response ⎯ Device B receives Inquiry and sends Inquiry

Response packet

ConnectionPaging ⎯ Master device Pages Slave device Page Scan ⎯ Slave device listens for PagingPaging Responses ⎯ Master synchronizes Slave clock and hopping

sequence

Devices are now Connected in a PiconetLink Establishment

LMP opens an ACL link over the Piconet ConnectionLMP informs SDP of the ACL link



Review of the Connection Process ⎯ 2High Level Connection

SDP (in Application Layer) requests a Channel (in the ACL link) from L2CAP

L2CAP maps a Channel over the ACL link for SDPSDP client formulates Service QueryQuery is Fragmented by L2CAP and sent to LMPLMP addresses query to device and sends to BasebandBaseband formulates transmission frame and sends to Radio LayerRadio Layer broadcasts

Applications open Channels over the ACL link Telephony Applications use TCS (based on Q.921) to request

SCO directly from Baseband



Bluetooth Security FeaturesFast frequency hopping Low transmit power (range <= 10m)Authentication of remote device

based on link key (128 Bit)May be performed in both directions

Encryption of payload dataStream cipher algorithm (≤ 128 Bit)Affects all traffic on a link

InitializationPIN entry by user



RFCOMM

ACL SCOBluetooth Baseband

LMP

L2CAP

IrOBEX

IrMC

Synchronization Profile



RFCOMM


LMP

L2CAPAudioStream

AT Commands

Headset Profile



RFCOMM


LMP

L2CAP

PPP

LAN Access Point Profile



Bluetooth EarpiecePhilips Semiconductor VWS26003 3 Integrated Circuits

Baseband processor (VWS26002)Ceramic Multi-chip RF module (PBA 31301)External Flash memory

NiMh or Lithium ion batteryTalk time ~4 hours Size weight 75g, 15cc



Philips Semiconductor VWS26003VWS26002 Baseband processor

ARM7 TDMI 32-bit embedded RISC processor72 kbytes internal SRAM4 kbytes internal ROM4 kbytes internal SRAM instruction cacheTimers and watchdog.8 general purpose PIO pins.Voice Codec

PBA 31301 Radio Frequency ModuleSoftware

Point to Point Protocol stackSystems

or NiMh or Li Ion battery



Philips Semiconductor VWS26003



Single Chip Bluetooth Device Controller

Philips PCD87750E

MTP = Multiple TimeProgrammable ROM

EBC = Ericsson Bluetooth Core

CVSD = Continuously Variable Slope Delta modulation

SPI = Security Parameter Index



Typical Earpiece Organization

Documents

Universal wireless connectivity Ubiquitous computing