A Lecture Note on Bluetooth v5.2 in TTA Education Program(2020)

Date : Nov 27, 2020
Place : Zoom link via. TTA education program
Topic : BLE v5.1, BLE v5.2, Exposure Notification Service

2. 2
Introduction
–Scope of the Seminar
–Terminology
Core Spec. v5.1 : 2019년 1월
–Direction Finding : 위상차 측정(Phase Difference Measurement)
•High Accuracy Distance Measurement
Core Spec. v5.2 : 2019년 12월
–Isochronous Channel : 등시(等時) 채널
•LC3(Low Complexity Communication Codec)
Exposure Notification Service : 2020년 4월
–Digital Contact Tracing Based on Bluetooth
목차

3. 3
Radio version : Classic (x), Low Energy (o)
–LE-1Mbps(o), LE-2Mbps(x), LE-coded(x)
–Comparison
»https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/radio-versions/
Device-to-Device Link (o) -> Mesh Network (x)
Direction Finding
–Connectionless (x), Connection-oriented (o)
–Angle-of-arrival(o), Angle-of-Departure(x)
LE Audio : Generic Audio
–Profile/Service/Codec(x), Link layer/Isochronous channel(o)
–Isochronous channel
•Connected (o), Connectionless/Broadcast (x)
ENS : Profile/Service by Google & Apple.
–Connectionless (o), Profile/Service (o)
Scope of the seminar : Focused topics

4. 4
Pre-requisite + Terminology
Packet format
–Protocol Data Unit(PDU)
•Header+ Payload + MIC
–Link layer control/datapacket
Host Controller interface
–Command/Events
–data
•ISO added
Message Sequence Chart
–Two devices
•Host + Controller
–Mixed flow of
•Link layer control/datapacket between controller
•HCI between controller and host in each side.
–command/event/data
Packet/airHCI/wire HCI/wire

6. 6
Concept of Direction Finding in Bluetooth
Phase Difference Measurement
–Use of tone signal
•“Constant Tone Extension”
•Narrow-band signal compared with wide-band signal using correlation.
Deployment Type
–Connectionless vs. Connection-Oriented
–Angle-of-Arrivalvs. Angle-of-Departure.
Multi-antenna in Rx
Fix Rx(locator)
Locate Tx(tag)
Multi-antenna in Tx
Fix Tx(beacon)
Locate Rx(phone)

7. 7
Position : After the CRC
–Does not affect the legacy/main part of the packet (RF switching matters.)
Connection-Oriented Operation Mode
–In most cases, it is used for AoAmeasurement.
Packet format : Constant Tone Extension
LL Ctrl PDU(o)
LL Data PDU(x)

8. 8
Newly introduced LL Ctrl Packets
–LL_CTE_REQ
–LL_CTE_RSP
Message Sequence Chart : Connection-Oriented
Packet/airHCI/wire HCI/wire
HCI command
HCI event
HCI command
HCI event
HCI event
HCI command
HCI event
HCI command
HCI event
Quiz : Which side is a device with a tag role ?
No CTE in CTE_REQ
Length
Switching info

9. 9
Generally, high layer services or profiles are used to determine
whether remote device has the required feature.
–e.g. Feature Map, Service/ATT
Message Sequence Chart : Fool-proof in Link Layer
Packet/airHCI/wire HCI/wire
HCI command
HCI event
HCI command
HCI event
HCI event
What if not received ?

10. 10
LE Meta Event is transferred via HCI.
–LE Connection IQ Report event(subevent code = 0x16)
LE MetaEvent in case of Success
Valid range
-127 ~ + 127
Amplitude
info can be used if desired.
9 ~ 82

11. 11
Does it cover all the cases ?
LE MetaEvent in case of Failure
The case only the
S/W stack supports
direction finding
(No H/W support)
0x17

12. 12
Transmit of all 1’s sequence in the RF-PHY layer
–No whitening(scrambling) operation applied.
Processing of Constant Tone Extension(CTE) -AoA
No antenna switching

13. 13
1 I/Q(complex) sample per us : max effective0.5 Msps
–50% is allocated for switching time.
–Not implementation specific : Typically 8 Mspsor 16 Mspsis used for Rx.
–Independent of the Rx architecture
•Direct conversion or (digital) low IF(+ IF offset).
CTE is a tone with +250 kHz offset from the carrier (1Mbps).
–GFSK(GMSK) with modulation index(m) of 0.5
I/Q Sampling Data Format
Caused by frequency offset
8 us = Reference Period
= Preamble Period
Missed
due to switching !

14. 14
Phase Difference Measurement
Any Bluetooth spec(Core or Profile/Service) does not tell how to
measure the phase difference or Angle.
–Reporting the I/Q sample is the role of the Core Spec.
Pre-requisite in upper layer
–Frequency offset should be estimated and compensated.
Conversion from phase difference to Angle of (Arrival/Departure)
–Assumption of long distance.
–Dependency on the carrier frequency need to be characterized/calibrated.
•Phase Measurement Method of narrow-band is weak to multi-path.
1us sampling case
Same
Antenna
Other
Antenna
2us sampling case
Other
Antenna
Same
Antenna

15. 15
RF Switching is carried out by the transmitter.
–(Large and bulky?) Beacon specially built for Indoor Positioning(Way Finding)
–half of the signal is invalid.
Processing of CTE -AoD
Quiz : What will happen if both sides do RF switching ?

16. 16
Back to a single antenna solution
How to achieve fine resolution with a narrow-band signal
–Narrow-band => multiple measurement varying tone frequency.
•Also robust against Multi-path.
–Interferometry : 간섭측정
•Measurement of
Phase Difference
from delayed
active reflector.
History
–Started first in IEEE 802.15.4 (~15 years before)
–Not attracted the interest of the industries at that time.
•802.15.4 has a freedom in adopting radio bands.
–900 MHz, 2.4 GHz, 6~8 GHz.
–Zigbee, Thread uses 802.15.4g
–802.15.4z(a.k.a. UWB ranging) has been adopted by Apple and Samsung.
•+ Fast follower : Xiaomi
High Accuracy Distance Measurement
Patent : US8644768B2
active reflector

17. 17
Core Spec
–v5.1 is much easier to find Direction Finding than v5.2 : Archived now
–Archives including v5.1
•https://www.bluetooth.com/specifications/archived-specifications/
CSA: Core Specification Addendum
–Publication of CSA is now ceased.
•CSS(Core Specification Supplement) is still maintained(v9).
–More frequent release of Core Specification recently.
Code Name for future release can be found in Spec Work Space
–https://specworkspace.bluetooth.com/SitePages/Home.aspx#/spec/summary/group
•vSydney: Near future (v5.3? or v5.2.1?)
•vDenver: Long-term features
–e.g. HADM has been tossed from vSydneyto vDenver.
HADM : Bluetooth tech docs can be shared with only WG members.
•Associate members at least can join the WG.
–https://patents.google.com/patent/US8644768B2
Direction Finding 참고문헌

19. 19
Isochronous Channel
Generalized Synchronous Channel for Low Energy(BLE)
–SCO, eSCOin Bluetooth Classic(BR/EDR)
Key features
–Time synchronization between multiple sinks(from a single source)
–Time-out in retransmission.
Use of isochronous channel is not mandatory for TWS ear set.
–Between the air set : Proprietary
–Between the air set and smartphone
•Not easy to replace the A2DP(Bluetooth Classic) in a short time period.
–Actually developed for the use case in mind but missed time-to-market.

20. 20
Packet format : PDU header
Connectionless/Broadcast
–Periodic Advertising Packet
•not covered here
Connected
–Data Packet

21. 21
Use 32-bit Access-Address
–Unique AA per link/connection.
How to differentiate ACLand ISO PDU
Op
code
LL_CTRL PDU
Name
0x1F LL_CIS_REQ
0x20 LL_CIS_RSP
0x21 LL_CIS_IND
LE-C, LE-U LE-F, LE-S

22. 22
Features added to Bluetooth Core for ISO Channel
Matrix of Bearers
Connected Broadcast
Framed
Data
LE-F LE-F
Unframed
Data
LE-S LE-S
Control LE-C LEB-C

23. 23
Changes in Host Controller Interface(HCI)
HCI
–Between Host(PC) and Controller(e.g. USB dongle)
–One of the most well-established interface in the Bluetooth specification(Vol. 4).
•Spec re-arranged for HCI to be aggregated into Vol.4 at Core v5.2
–Significant difference compared with previous versions.
Transport layer of HCI
–UART, USB, SDIO
–non-standard : IPC(Embedded), SPI
ISO data packet added. OGF Group
0x01 Link Control
0x02 Link Policy
0x03 Controller/Baseband
0x04 Info parameters
0x05 Status
0x06 Test
0x08 LE command

24. 24
Changes in HCI (cont’d)
Fragmentation of ISO data between Host and Controller
–bi-directional (Packet Status Flag)
PB_Flag Description
00 1st of Fragmented SDU
01 Continuation of Fragmented SDU
10 Complete SDU
11 last of Fragmented SDU.
PS_Flag Description
0b00 Valid
0b01 Possible invalid
0b10 Lost

25. 25
CIS/CIG can be considered as a nested connection inside ACL.
–But with different AA
Message Sequence Chart : CIS Creation
-> HCI command
<-HCI event
-> HCI command
<-HCI event
<-> HCIISO data
LE-C
LE-S/F

26. 26
LL_CIS_TERMINTATE_IND can be sent at any time.
LL_Datacan also be sent at any time.
MSC : CIS Termination
LE-C

27. 27
ISO path direction is set after the creation of CIS.
–No bidirectional ISO data path for each isochronous channel.
LC3/ISO channel : LE_Setup_ISO_Data_Path
I2S can be used
like PCM_IF in SCO
OGF=0x08
BR/EDR
OGF=0x03

28. 28
Event
–consists of multiple subevents
–A subevent consists of a pair of M-to-S and S-to-M.
CIG : Connected ISO-ChannelGroup
–consists of multiple CISs.
Concepts of Connected ISO channels
CIG
2x CIS
Example of application to TWS ear-set

29. 29
Sequence and set of HCI commands and LL-C for the example.
–CIG
Control/Management of CIS & CIG.
Left Out Right Out Mic In
Aligned and
Played at
anchor point
3x LE_Create_Connection
1x LE_Set_CIG_Parameters
3x LE_Create_CIS
LL_CIS_REQ
LL_CIS_IND
LL_CIS_REQ
LL_CIS_IND
LL_CIS_REQ
LL_CIS_IND
Master’s view
Concurrent Tx
to many slaves
is unavailable.

30. 30
HCI ISO data
–Fragmentation/Recombination using PB_Flag
–Timestamp (4B)
SDU (Service Data Unit)
–Variable length
Framed PDU (LE-F)
–Fixed Length, SDU/PDU >= 1
–Time-offset
–Segmentation/Reassembly of SDU.
•Segmentation header(2B)
•Time Offset (3B)
Unframed PDU(LE-S)
–SDU/PDU = 1
–Fragmentation/Recombination of SDU.
ISOAL : ISO Adaptation Layer
PB_Flag
LLID
TimeStamp
~ 400 bytes

31. 31
Audio Codec for Generic Audio(BLE)
–Announced on Sep 2020.
–A2DP and HFP may adopt it.
Features
–Low Complexity(?)
–Low Delay
•Frame = 10(=8 * 1.25) ms, 7.5(=6 * 1.25) ms
–Isolated Channel
LC3 : Low Complexity Communication Codec
< 320kbps/CH
Typical subevent duration
(M->S, S->M)

32. 32
Core Spec
–v5.2
»https://www.bluetooth.org/docman/handlers/downloaddoc.ashx?doc_id=478726
»https://www.bluetooth.com/wp-content/uploads/2020/01/Bluetooth_5.2_Feature_Overview.pdf
Profiles : Audio Codec + Profiles
–LC3 in GAM(Generic Audio Middleware)
•LC3
»https://www.bluetooth.org/DocMan/handlers/DownloadDoc.ashx?doc_id=502107
•Sets of Profiles and Services.
–Still under development and partially available.
–mSBCin HFP(A single document)
•Latest : v1.8
»https://www.bluetooth.org/DocMan/handlers/DownloadDoc.ashx?doc_id=489628
–SBC in A2DP(A single document)
•Latest :v1.3.2
»https://www.bluetooth.org/docman/handlers/downloaddoc.ashx?doc_id=457083
Isochronous Channel 참고문헌

34. 34
Apple | Google
–Already in service : not populated in Korea (QR code in use)
ROBERT, DP
3
T
Bluetooth-SIG
–Focus on blue ocean not covered by ENS yet : wearables.
–Transfer of the collected record via smartphones to the ENS server.
ENS : Social contribution against COVID-19

35. 35
Only authorized organization can publish the app using the ENS API.
Examples of ENS/Android OS
Google Play Store

36. 36
PDU Type : ADV_NONCONN_IND
–Non-connectable Indirect
–No activescan, No connection is allowed.
Device Address type : Random Non-resolvable
31 bytes are used up.
–= 3(Flags) + 4(Complete 16-bit Service UUID) + 24(Service Data)
Format of the ENS advertising packet
Ephemeral ID, TCN

37. 37
Packets
–Preamble(1B) + Access address(4B) + PDU(Variable : 2B ~ ) + CRC (3B)
NON_CONN_IND PDU
–PDU header(2B) + AdvA(6B) + Payload(0B ~ )
Format of the ENS advertising packet (cont’d)
TxAdd= 1
TxAdd= 0 => Public
LSB-to-MSB
Fixed to 0x8E89BED6 (advertising)
Period : 10 ~ 20 min

38. 38
AD Types :
Sections
–Flags (3 B)
•0x1A : Bluetooth Low Energy general discoverable mode (bit 1) shall be
set to 1
–Complete16-bit Service UUID (4 B)
•0xFD6F : 0xF~ is for reserved/temporary service.
–Service Data (24 B)
•RPI : Rolling Proximity Identifier (16 B)
•Associated Encrypted Meta data ( 4B)
–Version (1B)
–Power Level (1B)
–RFU (2B)
Format of the ENS advertising packet (cont’d)

39. 39
About generating RPI and Encrypting the meta data
–No use of Security Module(Encryption) of the Bluetooth Core Spec.
Cryptography/Security/Privacy in ENS
Period of RPI, AEM
~ 15 min
Period of TEK
~ 24 hrs
Key Derivation Function

40. 40
Fast track for Bluetooth-SIG compliant service development.
Level of Bluetooth-SIG memberships
–Adopter < Associate < Promoter(+Apple)
Region reserved typically development : 0x7Fxx, 0xFFxx
ENS Identifier(16-bit Service UUID)

41. 41
Main Difference from Beacon Services
Every ENS device should scan other ENS devices.
–Energy(not power) of advertising << Energy of scanning
•Recommended scan interval : ~ 5 min
–Recommended advertising interval (always on) : 200 ~ 270 ms
–duration of advertising event (3 advertising packets) : ~ 3 ms(1% awake)
What ENS does not use
–RF-PHY is fully backward compatible with Core v4.x
–No advertising extension(AE) introduced in v5.0
•Payload length of advertising packet is limited to 31 bytes.
–Similar category
•Beacon, Mesh profile
ENS is not Location Based Service (LBS)
–ENS only stores nearby ENS devices for contact tracing.
–Direction Finding introduced in v5.1 is not used.
–Only RSSI and Tx power level are used for checking the proximity.
(~ 5% awake)

42. 42
Bluetooth Specifications for your own services.
•AD-types
–https://www.bluetooth.com/specifications/assigned-numbers/generic-access-profile/
•16-bit UUIDs
–https://www.bluetooth.com/specifications/assigned-numbers/
–https://btprodspecificationrefs.blob.core.windows.net/assigned-values/16-
bit%20UUID%20Numbers%20Document.pdf
ENS
•By Apple & Google
–https://covid19-static.cdn-apple.com/applications/covid19/current/static/
»contact-tracing/pdf/ExposureNotification-BluetoothSpecificationv1.2.pdf
»contact-tracing/pdf/ExposureNotification-CryptographySpecificationv1.2.pdf
•DP-3T : DP
3
T : Decentralized Privacy-Preserving Proximity Tracing
–By ETH Zurich and more
»https://github.com/DP-3T
•ROBERT (ROBustand privacy-presERvingproximity Tracing) for PEPP-PT
–By INRIA & Fraunhofer/AISEC
»https://www.inria.fr/en/publication-robert-protocol
»https://github.com/ROBERT-proximity-tracing/documents
ENS 참고문헌

43. 43