A Lecture Note on Bluetooth v5.3 in TTA Education Program(2021)

Date : Dec 1, 2021
Place : Zoom link via TTA
Topic : Bluetooth Low Energy v5.3, Bluetooth Channel Sounding, a.k.a. High Accuracy Distance Measurement(HADM)

1. GCT Research, Inc.
Bluetooth Core v5.3 표준의개요및
차기표준화동향
이일완
GCTResearch
Date : 2021-12-01
Time : 14:30 ~ 15:20

2. 1/29 GCT Research, Inc.
❑Bluetooth Core v5.3
◆SubratingAdded to LE
◆AdvDataInfoin Periodic Advertising
◆Enhanced LE channel classification
◆Terminology Changes
❑Changes in Standard Spec. Maintenance Program
❑Bluetooth Core vDenver
◆High Accuracy Distance Measurement
✓Phase-based ranging
✓Comparison/Co-existence with other technologies.
❑Standardization activities expected in 2022.
◆Member Summit/UPF/IOP
❑Summary
◆References
Table of Contents
[ pp. 2 ~ 5 ]
[ pp. 6 ~ 9 ]
[ pp. 10 ~ 11 ]
[ p. 12 ]
[ pp. 13 ~ 16 ]
[ pp. 17 ~ 24 ]
[ pp. 25 ~ 26 ]
[ p. 27 ]
[ pp. 28 ~ 29 ]

3. 2/29 GCT Research, Inc.
❑Subrating
◆Using fractional connection event for low power operation in Connection State.
◆Subrating feature has already been available to Bluetooth Classic(BR/EDR) for years.
✓For quick connection parameter update from low to high duty rate connection.
Only the subrating factor is updated while keeping the basic connection interval.
✓Reduction of the Rx power carried out so far
by simple change/update of connection interval itself takes long time.
https://www.bluetooth.com/bluetooth-resources/bluetooth-core-specification-version-5-3-feature-enhancements/
❑Link layer procedures in detail
◆BaseEvent info is kept synchronized between the link layer controller.
BaseEvent can be arbitrarily chosen to align the two slew factors as early as possible.
Subrating feature added to LE connection
Example-2 : (Factor = 5, Base = 32) => (Factor = 3, Base = 38)Example-1 : (Factor = 5) Static

4. 3/29 GCT Research, Inc.
❑Necessary condition : To be in connection state
❑Subrate base event is neither controllable nor observable through HCI
❑Parameters of HCI
◆To specify a single unique subrate factor, set {Subrate min = Subrate max }
Usage of the Subrating feature : View from the Host(Central)
HCI
LL(Link Layer) Control PDU
Central Peripheral

5. 4/29 GCT Research, Inc.
❑No change in connection update LL_CTRL PDU itself.
◆Automatically send LL_SUBRATE_IND PDU after
✓connection and checking the features on both sides(subrate_factor = 1)
✓if the default parameter of Subrate set by HCI_LE_Set_Default_Subrate does not include 1.
Check the current status of subrating
subrate
_factor
central
peripheral

6. 5/29 GCT Research, Inc.
❑LL_SUBRATE_IND is sent only by the Central
◆Peripheral can only request by sending LL_SUBRATE_REQ PDU to Central
◆No BaseEvent parameter in LL_SUBRATE_REQ PDU.
✓It can be set only by the central link controller.
❑Same HCI function, HCI_LE_Subrate_Request, is used for both cases.
Usage of the Subrating feature : View from the Host(Peripheral)
HCI
LL(Link Layer) Control PDU
Central Peripheral

7. 6/29 GCT Research, Inc.
❑Periodic Advertising
◆Introduced in Core v5.0 as a form of Advertisement Extension
✓Carried over AUX_SYNC_IND PDU
✓AUX_CHAIN_IND follows if a single AUX_SYNC_INC PDU cannot carry all the advertising data.
❑AdvDataInfo(ADI)
◆Adv Set ID(4b) + Adv Data ID(12-bit)
✓DID is updated with a random number different from the previous one if a new data is given.
◆To reduce the repetitive receiver processing of the same data.
✓Skip the AUX_SYNC_IND PDU if the ADI is the same as the last received one.
◆Compatibility Issues : v5.3(Tx) -> v5.2(Rx)
✓v5.2 device cannot receive the AUX_SYNC_IND.
✓A bit to enable/disable the inclusion of ADI has been added.
AdvDataInfo in Periodic Advertising

8. 7/29 GCT Research, Inc.
❑If ADI field is not present in the header( v5.2 Tx or v5.3 Tx in compatibility mode),
◆The receiver should assume that the ADI has been updated always.
◆No skipping of events.
Compatibility issues : v5.2(Tx) -> v5.3(Rx)
AdvDID
=0x123
AdvDID
=0x123
AdvDID
=0x456
No ADI No ADI No ADI
v5.2
v5.3

9. 8/29 GCT Research, Inc.
❑HCI :
◆Fragmented data transfer between host and ctrl
◆The total amount of Host Advertising Data before fragmentation <= 1650 octets.
◆DID in the ADI of AUX_SYNC_IND shall be changed for new Advertising Data
✓Backward compatibility
❑PDU :
◆Fragmented data transfer between peer devices : max = 255 octets.
◆PDU for the first fragment : AUX_SYNC_IND
✓Remaining fragments : AUX_CHAIN_IND
The length of Adv Data since Core v5.0

10. 9/29 GCT Research, Inc.
❑A single periodic advertising event
◆consists of a single AUX_SYNC_IND PDU followed by multiple AUX_CHAIN_INDs if required.
◆indicated/triggered using SYNC Info field in AUX_ADC_IND PDU.
◆The data queue of Periodic Advertising is separated from the Extended Advertising.
❑All the ADI in a single event is constant.
◆AUX_CHAIN_IND can be skipped if the ADI of the leading AUX_SYNC_IND is not updated.
Periodic Advertising with the Data length > 256
AUX_
ADV_IND
AUX_
SYNC_IND
AUX_
CHAIN_IND
AUX_
CHAIN_IND
Periodic Advertising Interval
AUX_
SYNC_IND
AUX_
CHAIN_IND
AUX_
CHAIN_IND
Sync Info field
AUX_PTR field
AUX_
ADV_IND
AUX_
CHAIN_IND
AUX_
CHAIN_IND
HCI_LE_Set_
Extended_
Advertising_Data
HCI_LE_Set_
Extended_
Periodic_Data
Periodic Advertising Event
not specified
by Sync info field
1/22/2
300B300B
1/3200B
2/3200B 2/3200B
Skip the
payload only
Skip the
entire PDU
Skip the
entire PDU

11. 10/29 GCT Research, Inc.
❑Channel Classification in LE was done only on the central side before Core v5.3.
◆Hidden interferer information from the central may cause poor link performance.
◆Interference info near the peripheral side is now incorporated.
❑Standard defined not for measuring the channel status bur for its exchange.
Enhanced LE channel classification
central peripheral
Allowed only to central
before v5.3

12. 11/29 GCT Research, Inc.
❑LL Ctrl PDU for 37 data channel maps
◆Central-to-Peripheral : LL_CHANNEL_MAP_IND(1-bit per channel)
◆Peripheral-to-Central : LL_CHANNEL_STATUS_IND(2-bits per channel)
Location of Channel Status Measurement block
Status Value Meaning
2’b00 unknown
2’b01 good
2’b10 r.f.u
2’b11 bad
Map Value Meaning
1’b0 bad
1’b1 unknown
Map Value Meaning
1’b0 unused
1’b1 used
37 < 5 * 8

13. 12/29 GCT Research, Inc.
❑No more use of the inappropriate terms below are allowed.
◆Master/Slave -> Central/Peripheral
◆whitelist -> Accept list
◆blacklist (inMesh) -> Reject list
Global Terminology Changes

14. 13/29 GCT Research, Inc.
❑Main reason for the program delay
◆Adoption of the Bluetooth Low Energy(not Classic) in the non-IT industry
✓Field : Automotive industry, Medical & Health(Getting FDA approval)
✓Slow compared with personal IT devices.
✓Aggressive deprecation program of the standard in the development means
no way to get the Bluetooth qualification of the product.
◆Well-made and no need for the upgrade to new version for typical use.
❑Changes in program policies
◆A minimum deprecation notice period of 3 years.
◆A minimum of 10 years for which the specification remains active.
◆Gap between deprecation and withdrawal as large as possible (5 to 10 years).
Delayed deprecation & withdrawal of Bluetooth Core v4.2
Feb 2025
Adjusted Program
Feb 2030

15. 14/29 GCT Research, Inc.
❑Where to find obsolete standard spec ?
◆https://www.bluetooth.com/specifications/specs/
List of Current Bluetooth Core Specs.
Uncheck this button

16. 15/29 GCT Research, Inc.
❑No more use of Core Spec Addendum(CSA).
◆Core v5.0 : Dec 2016
✓CSA v6 : Last, Jul 2017
◆Core v5.1 : Jan 2019
❑Version numbering style has been changed from x.y to x.y.z
◆But, not have been applied to vSydney.
◆v5.2.1. rather than v5.3 seemed to be appropriate.
❑Still no significant change in PHY specification.
◆v4.x : Bluetooth LE added.
◆v5.x : 2Mbps, Long Range added.
◆v6.x : HADM, High Throughput (in preparation)
✓https://www.bluetooth.com/specifications/in-development/
❑Complaint about the no easy way of maintenance has been raised.
✓CSA may be brought back in other forms if needed.
Why Bluetooth version number reached v5.3 so fast ?

17. 16/29 GCT Research, Inc.
❑[Test] Most of the innovative features since v5.0 is optional.
◆v4.2 device can claim its qualification of the latest TCRL with minimum ICS checked for qual.
❑[Practical Use] Backward compatibility with v4.2 is always
◆Example : newly added feature sets for v5.3 are negotiable right after the connection.
◆F/W in the commercial IP is mostly configurable for the small footprint if not required.
✓Recent feature can be reconfigured during the operation with the recently added HCI function.
What if after the deprecation of v4.2 : ICS and Feature Set

18. 17/29 GCT Research, Inc.
❑Basic concepts
◆Next-generation position technology after the direction finding
◆Back to a single-antenna solution for accurate distance measurement.
❑Measurement Components
◆ToF(RTT)
◆2-Way Phase Ranging
❑Progress
◆Proposed as a long-term core feature of vSydney in the mid of 2018.
◆Migrated from vSydney to vDenver in 2019.
✓2-way ranging only ~ comparable to the connected AoA feature of Core v5.1
◆Missed to be included as the distance measurement technology in Digital Key 3.0 spec.
✓(July 2021)
❑Demo of early HADM prototype
◆Phase ranging based prototype : June 2020
✓https://www.bluetooth.com/bluetooth-resources/high-accuracy-distance-measurement-hadm-demo-for-ke
yless-entry-systems/
High Accuracy Distance Measurement

19. 18/29 GCT Research, Inc.
❑Introduced in v5.1 as of Jan, 2019.
◆Multiple antennas are required.
◆The antenna spacing for 2.4 GHz is larger than the typical size of current Bluetooth devices.
✓/4 = 3 cm for 2.5 GHz.
❑Operation near human body makes the problem difficult.
◆Widely accepted in LOS channel environment, i.e. air and deep space.
❑Opportunity and Evolution
◆LE is better than Classic for positioning application.
✓Default : broadcast
✓Fast connection
✓Raised to non-zero market share in indoor positioning.
Proximity, Presence
◆RTT may be affected by the receiver filter characteristic
✓The spatial resolution of the BLE 2Mbps(still narrow-band) based on ToF is approximately 150m(~500 ns).
◆Phase info in narrow band system is better than
✓Received signal strength indicator(RSSI)
✓RTT info : immune to the variation of filter characteristics (single tone at center frequency)
✓Mixture of BLE standard and Proprietary RTLS.
Tags attached to assets are single-antenna devices while tracking systems have 6+ antenna.
Why Direction Finding is not widely accepted as expected?

20. 19/29 GCT Research, Inc.
❑Role of the active reflector : Keep the phase continuity at its antenna port.
❑min f = 2 MHz => 2d = 75m
◆Phase shift folds with the periodicity of d = 37.5m.
◆Is 37.5 m enough for indoor positioning?
✓Typical range of BLE ~ 10 m : seems to be enough for LOS channel but marginal for multi-path channel.
✓Finally, 1 MHz frequency sweeping has been chosen against multi-path channel.
ActiveReflection & Phase Shift Measurement
Initiator
(Tx)
Reflector
(Rx)
Initiator
(Rx)
Reflector
(Tx)
Initiator
(Tx)
Reflector
(Rx)
Initiator
(Rx)
Reflector
(Tx)
f
1
f
2=
f
1+f

1

2=

1+
??????⋅&#3627408517;=
&#3627408516;
????????????
∙
∆∅
∆??????

1

2=
1+

21. 20/29 GCT Research, Inc.
❑No more enforcement of the phase continuity at the reflector antenna.
◆The phase between the Rx and Tx should be characterized(controlled or observed).
❑Pros
◆Overhead in implementation of active reflector is slightly relieved.
◆Security problem caused by predictability of the reflected wave can be handled.
❑Cons
◆Neither initiator nor reflector cannot estimate the distance by its own local measurement result.
◆Exchange/Compilation of the measurement data(PCT) should be performed.
Generalized Active Reflection : Phase Correction Term
∅
1=(∅
??????,??????−∅
??????,??????)−(∅
??????,??????−∅
??????,??????)
1
Initiator Reflector
Δ∅=−0.3??????
pre-defined or post-measured
phase correction term

1
∅
??????,??????
∅
??????,??????
∅
??????,??????
∅
??????,??????

22. 21/29 GCT Research, Inc.
❑Vernier Scale
◆A visual aid for accurate measurement reading between two graduation markings
◆https://en.wikipedia.org/wiki/Vernier_scale
◆Devices : Vernier Caliper
❑Moiré pattern/effect
◆Aliasing caused by similar patterns(including frequencies)
✓Can be seen in 2D and 1D
✓https://en.wikipedia.org/wiki/Moir%C3%A9_pattern#Geometrical_approach
◆Hold your smartphone camera near(not too close) the notebook screen.
✓If the resolution of camera and display gets comparable, Moiré pattern will appear.
Analogy : In case of only two frequencies
main
Vernier
Read-out : 10.02 mm
Vernier Constant : 0.01 mm = 1 - 9/10 mm
&#3627408517;=
??????
??????
∙
??????
????????????
Moiré effect in photos

23. 22/29 GCT Research, Inc.-40 -30 -20 -10 0 10 20 30 40
-1
-0.8
-0.6
-0.4
-0.2
0
0.2
0.4
0.6
0.8
1
Frquency offset from 2.45 GHz (MHz)
Phase(rad/

)
❑Only two frequency case has been shown for simplicity
❑Multiple frequency ranging is required
◆To mitigate the interference.
✓3 primary advertising channel are excluded.
◆To be robust against the multi-path channel.
❑Distance Estimation Method - Filter Characterization
◆Freq domain analysis
◆Time domain analysis after the IDFT
Multiple Frequency Phase Ranging
distance * slope = const
Estimation in frequency domain
I R I
&#3627408442;(&#3627408467;)=
&#3627408443;(&#3627408467;)
2
&#3627408443;(&#3627408467;)
IDFT
* =>
ℎ??????=(0+??????
−1
+0.75∙&#3627408466;
??????
??????
4∙??????
−2
)
LOS-dominated
affected by multi-path
Option :
(1) earliest
(2) peak
(3) center of momentum

24. 23/29 GCT Research, Inc.
❑Phase ranging is also vulnerable to the Man-in-the-Middle(MITM) attack.
◆Enough time for the attacker to manipulate the phase in the air.
◆Vulnerability to attack
✓RSSI >> AoA/AoD > Phase ranging > RTT ranging
❑Simple active reflector type has been proven to be faked by MITM attack (2017).
◆https://link.springer.com/chapter/10.1007/978-3-319-66787-4_24
◆One of the suggested solution
✓5.3 Phase-Shifted Response Signal
❑Why security issue is so important ?
◆To be fully trusted by CCC(Car Connectivity Consortium)in the future.
Security Issues
In the white paper open to public, not in the recently released spec 3.0

25. 24/29 GCT Research, Inc.
❑Upper layer for HADM measurement data exchange/compilation is required.
◆Specification of HADMs are focused on
✓Link layer procedure (LL_PDUs between peer devices)
✓HCI(host and controller)
◆The exchange of the measurement may not be standardized in the Core spec.
✓The quality of the distance estimation on either side is implementation specific.
✓Same policy as that of direction finding(AoA, Aod) in Core v5.1
Scope : only up to the acquisition of I/Q samples on the CTE part through HCI.
✓GATT service and profiles are under development in Direction Finding Working Group.
◆Data exchange/collection time can be another bottleneck for high measurement update rate.
✓Trade-off with the security issues.
❑RF-PHY layer issues in Calibration/Compensation of the RF component impairment
◆Non-zero and time varying residual RF-PLL frequency offset.
✓Frequency offset between the devices is non-zero and not static.
◆Dependency of the RF receiver group delay on the gain, i.e. RSSI.
✓The group delay of the RF receiver chain depends on the distance.
long distance -> low RSSI -> high gain -> change in group delay.
Implementation Issues : Why taking so long than expected?

26. 25/29 GCT Research, Inc.
❑UWB : Ultra Wide Band
◆Latest UWB based on IEEE 802.15.4z (Approved 4 Jun, 2020)
◆Distance Measurement based on Round-Trip-Time(RTT) or Time-of-Flight(ToF)
◆Recently adopted by major smartphones
✓Apple, Samsung
✓Air(Apple), Smart(Samsung) tags were also released.
❑WiFi Location
◆FTIM(Fine Timing Measurement) is already incorporated into 802.11-2021.
✓Double-side 2-way ranging.
◆IEEE 802.11az is restructured on the recently adopted 802.11ax
◆Band-width
✓between BLE and UWB.
Comparison with other technologies : Competition
T R
pre-defined
delay
Narrow-band/Tone wave
Wide-band/Pulse wave
T R
time
freq
time
freq
T
T
T
T
R
R
R
R
T R
pre-defined
delay
OFDM(DMT) wave
T
time
freq
T
T
T
T
R
R
R
R
R

27. 26/29 GCT Research, Inc.
❑iBeacon, the first Bluetooth beacon, came from Apple
◆Initially only BLE is operative as a beacon.
◆After scan and connection,
✓UWB mode is turned on for accurate positioning.
◆HADM, the late comer, may replace UWB someday.
✓Slow and Steady, but can it win the competition?
✓The precursory work failed in IEEE 802.15.4 in 2009.
❑Examples
◆Recently announced most smart tags using UWB
◆Passive Keyless Entry : Automotive
✓https://developer.apple.com/videos/play/wwdc2021/10084/
◆CCC Digital Key Release 3.0 announced as of July, 2021.
✓https://carconnectivity.org/press-release/car-connectivity-consortium-publishes-digital-key-release-3-0
Co-existence with other technologies : Collaboration
UWB chip
BLE chip

28. 27/29 GCT Research, Inc.
❑Recently updated.
◆Last UPF & Meetings in Seoul : June in {2018, 2019}.
◆Can be held as virtual meeting in worst case.
◆In case of face-to-face meeting,
✓Informal IOP for HADM might be held.
❑No next long-term project name decided yet.
◆Typically two projects (one for near-to-release and the other for long-term) are maintained.
✓vShanghai(5.0) -> vMadrid(5.1) -> vMilan(5.2) -> vSydney(5.3) -> vDenver(?) -> v?
Meeting event and Project version schedule in 2022

29. 28/29 GCT Research, Inc.
❑Brief review of Bluetooth Core v5.3
◆AdvDataInfo in Periodic Advertising
✓Periodic Advertising introduced in Core v5.0
✓AoD introduced in Core v5.1
◆Extension of the concepts in Classic to LE
✓Subrating for fast connection update
✓LE channel classification
◆Terminology : No more discriminative words.
❑Extended Specification Maintenance Program of Core v4.2
◆Location of the archives
❑High Accuracy Distance Measurement in vDenver
◆Phase-based ranging for narrow-band communication system
◆Multi-frequency phase difference measurement.
❑Update of Meeting and Project schedule in coming 2002
◆What is next after vDenver ?
Summary

30. 29/29 GCT Research, Inc.
❑Bluetooth Core v5.3
◆https://www.bluetooth.com/specifications/specs/core-specification
◆https://www.bluetooth.com/language-mapping/Appropriate-Language-Mapping-Table
◆https://www.bluetooth.com/bluetooth-resources/bluetooth-core-specification-version-5-3-feature-en
hancements/
❑vDenver
◆High Accuracy Distance Measurement
✓https://www.bluetooth.com/specifications/in-development/
✓NWP(New Work Proposal) approved around May 2018 : accessible by even adopter members.
https://www.bluetooth.org/DocMan/DocInfo.aspx?doc_id=444506
◆Phase Ranging
✓Precursory work begun at IEEE 802.15.4 (2009)
https://mentor.ieee.org/802.15/dcn/09/15-09-0613-01-004f-ranging-with-ieee-802-15-4-narrow-band-phy.ppt
https://patents.google.com/patent/US8644768B2/en?oq=8644768
✓Resurrection in Bluetooth-SIG
https://community.nxp.com/pwmxy87654/attachments/pwmxy87654/tech-days/303/1/AMF-AUT-T3470.pdf
✓On the security of phase ranging
https://link.springer.com/chapter/10.1007/978-3-319-66787-4_24
Reference