systemview bluetooth library -...

®

A Guide

to the

Wireless Network Library Bluetooth

Conforming to Bluetooth Standard v1.1

Blu

etoo

th

SystemView by ELANIX® Copyright © 1994-2005, Eagleware Corporation All rights reserved. Eagleware-Elanix Corporation 3585 Engineering Drive, Suite 150 Norcross, GA 30092 USA Phone: +1 (678) 291-0995, Fax: +1 (678) 291-0971 Support e-mail: [email protected] Web: www.eagleware.com Unpublished work. All rights reserved under the U.S. Copyright Act. Restricted Rights Apply. This document may not, in whole or in part, be copied, photocopied, reproduced, translated, or reduced to any electronic medium or machine-readable form without the prior written consent of Eagleware Corporation. This document and the associated software are proprietary to Eagleware Corporation. SystemView by ELANIX, and ELANIX are registered trademarks of Eagleware Corporation. MetaSystem is a trademark of Eagleware Corporation. Windows is a trademark of Microsoft Corporation. Other trademarks or registered trademarks used in this document are the property of their respective owners. Document created by Elanix, Inc and: Ryan Menezes Manoj Ananthapadmanabhan Electrical and Computer Engineering University of Wisconsin-Madison Document Number SVU-BLU1001 Printed in the United States of America.

ii

Table of Contents INTRODUCTION ........................................................................................................... V TRANSMITTER ..............................................................................................................1

TRANS.............................................................................................................................1 RECEIVER.......................................................................................................................7

RECV...............................................................................................................................7 BLUETOOTH CLOCK...................................................................................................9

CLOCK_N........................................................................................................................9 FREQUENCY HOP SELECTOR ................................................................................10

FH..................................................................................................................................10 ACCESS CODE CORRELATOR ................................................................................12

ACC_CORR ..................................................................................................................12 1/3 FEC ENCODER.......................................................................................................13

R1/3 E...........................................................................................................................13 1/3 FEC DECODER.......................................................................................................14

R1/3 D ..........................................................................................................................14 2/3 FEC ENCODER.......................................................................................................15

R2/3E............................................................................................................................15 2/3 FEC DECODER.......................................................................................................16

R2/3D ...........................................................................................................................16 HEC ENCODER ............................................................................................................17

HEC_ENC .....................................................................................................................17 HEC DECODER ............................................................................................................18

HEC_DEC.....................................................................................................................18 CRC ENCODER ............................................................................................................19

CRC_ENC .....................................................................................................................19 CRC DECODER ............................................................................................................20

CRC_DEC.....................................................................................................................20 DATA WHITENER .......................................................................................................21

WHITENER ....................................................................................................................21

Blu

etoo

th

iii

LIST OF ACRONYMS AM_ADDR Active Member Address ARQ Automatic Repeat reQuest BD_ADDR Bluetooth Device Address CAC Channel Access Code CRC Cyclic Redundancy Check DAC Device Access Code DIAC Dedicated Inquiry Access Code DV Data Voice FEC Forward Error Correction code FH Frequency Hopping FHS Frequency Hop Synchronization GIAC General Inquiry Access Code HEC Header-Error-Check HV High-quality Voice IAC Inquiry Access Code ISM Industrial, Scientific, Medical L_CH Logical Channel L2CAP Logical Link Control & Adaption Protocol LAP Lower Address Part NAP Non-significant Address Part PM_ADDR Parked Member Address SAP Service Access Points SAR Segmentation and Reassembly SEQN Sequential Numbering Scheme TDD Time-Division Duplex UAP Upper Address Part

iv

Introduction Bluetooth is a Wireless Personal Area Network (WPAN) protocol designed as a cable-replacement technology - low cost, modest speed, and short range (<10 meters). It operates in the 2.4GHz ISM band and facilitates ad-hoc connections for stationary and mobile communication environments. Bluetooth makes a clear distinction between voice and data communications. Voice packets can be transmitted with less overhead and limited reliability while data packets are transmitted with high reliability and have error detecting/correcting mechanisms. The Bluetooth physical (or PHY) layer uses the frequency-hopping spread spectrum (FHSS) technique. Spectrum spreading is accomplished by frequency hopping, with 79 hops spaced by 1 MHz, between 2.402 GHz and 2.480 GHz. Bluetooth hops at a rate of 1600 hops/sec. It uses Gaussian frequency shift keying (GFSK) modulation with modulation index 0.28 to 0.35 i.e. frequency deviation of 140KHz to 175KHz. The channel is divided into time slots, each 625 µsecs in length where each slot corresponds to an RF hop frequency. Bluetooth thus uses frequency hopping and Time Division Duplex scheme to combat interference and fading for full duplex transmissions. Owing to tradeoff between hardware complexity and receiver performance the existing Bluetooth system does not use channel distortion compensation Bluetooth uses Forward Error Correction (FEC) with 2/3 shortened Hamming code and rate 1/3 bit repeat. A low-power radio interface was chosen, operating on the globally available 2.45 GHz band. The radio air interface features nominal antenna power of 0 dBm and complies with FCC rules for the ISM band, and the nominal radio link range is upto 10 meters, although range can be extended up to 100 meters by increasing the transmission power to 20dBm. B

luet

ooth

Bluetooth can support a maximum of three synchronous-connection-oriented (SCO) links. SCO links are voice-oriented and designed to

v

support real-time, isochronous applications such as cordless telephony or headsets. Bluetooth also supports asynchronous connection links (ACLs) used to exchange data in non-time-critical applications. Each voice channel supports a 64Kbps synchronous channel in each direction. The maximum user rate that can be obtained over asynchronous link is 732.2 Kbps and a return link of 57.6 Kbps is supported. Bluetooth system supports both point-to-point connections and point-to-multipoint connections. In point-to-multipoint connection, the channel is shared among several Bluetooth devices. Two or more devices sharing the same channel form a piconet. There is one master device and up to seven active slave devices in a piconet. These devices can be in any of the states: active, sniff, hold and park. The latter three are low-power states with park being the lowest power state. Multiple piconets with overlapping coverage areas form a scatternet.

vi

Token Name: Transmitter

Abbreviation: Trans

Synopsis: The Bluetooth Transmitter block performs the following functions

• Error Correcting and detecting at rate 1/3. • Error Correcting and detecting at rate 2/3. Encodes a 10 bit block from a

serial bit stream into 15 bits for each input block LSB first. Encoding scheme is a (15, 10) shortened Hamming code.

• Error Checking using CRC by appending parity bits to output. • Error Checking is performed on all packet headers and ACL payloads to

validate integrity of received data. • (Scrambling) – mixing a PN sequence with data to reduce dc bias. • Access Code Generator generates the access code that is placed at the

beginning of a packet. The access code is either 68 or 72 bits long. It is used for synchronization, identification, paging and inquiry procedures

• The packet Header consists of 10 bits before HEC. The packet is then passed through a 1/3 FEC to get 54 bits

• Multiplexes the access code, header and payload to generate the packet Specification References: Part B 5.1, 5.2, 4.3, 5.4, 7, 4.2, 13.2, 4.5, 4.4 See Also: Receiver Parameters:

Parameter Symbol Definition LAP 24 bit Lower Address Part of device address UAP 8 bit Upper Address Part of device address NAP 16 bit Non-significant Part of device address State master/slave State of operation Hop System 23/79 hop system Pkt Type Packet Type AM_ADDR 3 bit Active member address

Blu

etoo

th

Flow Bit specifying flow ARQN Bit specifying Automatic Repeat Request SEQN Bit specifying Sequence Number Payload Length Payload length L_CH Logical Channel Flow (L2CAP) Flow at L2CAP layer SR 2 bit Scan Repetition field SP 2 bit Scan Period field Device Class 24 bit device class Scan Mode 3 bit field indicating page scan mode Page Substate A or B Train

Token Inputs:

• Clock N. Token Outputs:

• Packet • Header • Payload

Discussion: HEC The generator polynomial is D8+D7+D5+D2+D+1. For each block, the initial state of the generator is taken from the UAP/DCI parameter. The D7 position for the UAP/DCI is weighted at 128; D6 is half that and so on. CRC encodes bits of information by appending 16 parity bits to output.

CRC The generator polynomial is D16+D12+D5+1. For each block, the initial state of the generator is taken from the UAP/DCI parameter. The D7 position for the UAP/DCI is weighted at 128; D6 is half that and so on.

Whitener Bluetooth data whitener uses polynomial D7+D4+1. Initial value for bits 0-5 of the generator comes from bits 1-6 of the input CLK arriving at the first input bit with bit 6 of the generator set to 1.

Access Code Generator If Packet Header follows, length is 72 bits, otherwise access code is 68 bits long. The CAC is 72 bits long. DAC, GIAC and DIAC are 72 bits long if used in conjunction with FHS packets, otherwise they are of length 68 bits.

2

Pseudo random noise (PN) sequence is generated using 1 + D + D3 + D4 + D6

Structure of Access Code (68/72) Preamble(4) Sync Word(64) Trailer (4)

• Preamble-to detect the edges of received data, either 0101 or 1010 depending on 1st bit of sync word being 0 or 1

• Sync Word- formed from LAP using a predefined algorithm. Receiver does 64 point correlation with sync word

• Trailer- If a payload is following, the trailer is similar to preamble. If last bit of Sync word is 0 it is 1010 else 0101

Structure of Sync Word (64)

BCH Parity(34) LAP(24) Barker(6)

• BCH Parity Word- has key part of sync word • LAP-lower address part of 48 bit device MAC address • Barker- 6 bits attached to make the last 7 bits a Barker code

Header

Structure of Header (18*3=54) AM_ADDR(3) Pkt Type(4) Flow(1) ARQN (1) SEQN(1) HEC(8)

• AM_ADDR – active member address of upto 7 active slaves • Packet Type- SCO,ACL,NULL or POLL and type of error correction for

payload , number of slots for payload • Flow- flag indicating device unable to receive data due to buffer field • ARQN-for ARQ scheme • SEQN- toggled each time a new packet is sent. Remains unchanged for

retransmissions so that receiver can differentiate between packet copies

Blu

etoo

th • HEC- CRC function performed on header and represented by a Generator

Polynomial 647 in Octal. Initialized by Master or Slave UAP or DCI (Default Check Initialization= all zeros). If HEC fails, rest of Packet is ignored

3

Packet Types Supported Segment Packet

Type Code

No of Slots covered

SCO link

ACL link

Payload Header (bytes)

User Payload(bytes)

FEC CRC

- - 1 or 2 ID 0 0 No No 0000 1 NULL No No No No 0001 1 POLL No No No No 0010 1 FHS No 18 2/3 No

Control Packets

0011 1 DM1 1 0-17 2/3 Yes 0100 1 - DH1 1 0-27 No Yes 0101 1 HV1 - No 10 1/3 No 0110 1 HV2 - No 20 2/3 No 0111 1 HV3 - No 30 No No 1000 1 DV - (1) 10(0-9) (2/3) (Yes)

Single Slot data packets

1001 1 - AUX1 1 0-29 No No 1010 3 - DM3 2 0-121 2/3 Yes 1011 3 - DH3 2 0-183 No Yes 1100 3 - - - - - -

3 slot data packets

1101 3 - - - - - - 1110 5 - DM5 2 0-224 2/3 Yes 5 slot

data packets 1111 5 - DH5 2 0-339 No Yes

Payload Generator

• Input/ Parameters: Packet Type,Data, PN Sequence for whitening, information bits

• ACL Packets

Structure of ACL Payload (0-2774) Payload Header(8/16) Data(0-2712) CRC(16)

4

Payload Header

Structure of ACL Payload Header (8/16) L_CH(3) Flow(1) Length(8) undefined(4)

L_CH (Logical Channel field) –indicates whether this packet is start or continuation of an L2CAPmessage (several ACL packets) or an LMP message Flow- controls data transfer at L2CAP level Length- length of payload in bytes

• SCO Packets

Payload(240)

Same access code as ACL, no ARQ,CRC and SEQ Fixed payload 30 bytes=240 bits representing source data of 10,20 or 30 bytes depending on FEC rate

• Mixed SCO/ACL (DV Packet)

Structure of DV packet (0-)

Voice Payload(80)

Payload Header(8)

Data Payload(0-72)

Data CRC(16)

Pad(4)

DV Packets are special SCO packets. Voice field is HV1 10byte and not protected. Data field is protected by 2/3 rate FEC. Retransmission of data field is possible

• Special Packets

ID only access code, used in pre-connection NUL access code + pkt header, used for ARQ POLL same structure as NULL, but has to be acknowledged FHS Frequency Hop synchronization Packet. Sent during

enquiry process,page procedure and when a master takes over. It provides all information required by recipient to address sender in terms of timing, device address code

Blu

etoo

th

5

Structure of FHS packet (0-) BCH Parity (34)

LAP (24)

Undef (2)

SR (2)

SP (2)

UAP (2)

NAP (2)

Class (16)

AM_ADDR (3)

CLK[27:2] (26)

Page Mode (3)

BCH Parity Word- has key part of sync word LAP-lower address part of 48 bit device MAC address UAP - upper address part of 48 bit device MAC address NAP-non significant address part of 48 bit device MAC address SR- page scan repetition SP- page scan period Page Mode-senders default page mode Class- class of device e.g printer, PDA,cell phone AM_ADDR- for slave if being sent by master. Equals 0 for enquiry scan CLK- native clock of sender

Structure of Packet (122-2871)

Access code(68/72) header(54) payload(0-2745)

Header- control information associated with packet and link Payload- message information

Example: bt_trn.svu

6

Token Name: Receiver

Abbreviation: Recv Synopsis: The Bluetooth Receiver block does the following functions

• Error Correcting and detecting at rate 1/3. Decodes a 3 bit block from a serial soft bit stream by averaging the 3 input bits, then comparing the average with the threshold to output 1 hard bit

• Error Correcting and detecting at rate 2/3. Decodes a 15 bit block from a serial bit stream with lsb in first and serially outputs 10 bits for each input block. An error flag is output for each block indicating 2 or more errors were detected. FEC scheme is a (15, 10) shortened Hamming code.

• Error Checking by decoding 18 bits of header message and parity bits • Decodes bits of header message and parity bits. • (Unscrambling) • Demultiplexes the packet

Specification References: Part B 5.1, 5.2, 4.3.6, 5.4, 4.2 See Also: Transmitter Parameters:

Parameter Symbol Definition Logic 0 Output value representing logical 0 Logic 1 Output value representing logical 1 Threshold The value that separates a logical 1 from

a logical 0 State master/slave State of operation of device FEC decode soft/hard

Whether soft or hard decoding is used for the 2/3 hamming code

UapDci Upper Address Part or Default Check Initialization

Payload Len Length of payload Hop System 23/79 Hop system KOffset Either 8 or 24 depending on control word.

Blu

etoo

th

7

Token Inputs: • Clock N • Encoded bit stream from Access code correlator • Access code flag

Token Outputs:

• Header • Error flag (HEC) • Payload • Error flag (CRC)

Discussion: HEC The generator polynomial is D8+D7+D5+D2+D+1. For each block, the initial state of the generator is taken from the UAP/DCI parameter. The D7 position for the UAP/DCI is weighted at 128, D6 is half that and so on.

CRC decodes bits of header message and parity bits. The generator polynomial is D16+D12+D5+1. For each block, the initial state of the generator is taken from the UAP/DCI parameter. The D7 position for the UAP/DCI is weighted at 128, D6 is half that and so on.

Whitener Bluetooth data whitener uses polynomial D7+D4+1. Initial value for bits 0-5 of the generator comes from bits 1-6 of the input CLK arriving at the first input bit with bit 6 of the generator set to 1.

Example: bt.svu

8

Token Name: Bluetooth Clock

Abbreviation: Clock_N Synopsis: Bluetooth native clock (counter) is nominally driven by a 3200 Hz pulse train. This clock runs open loop and is never adjusted. Specification References: Part B 10.3 See Also: Frequency Hop Generator Parameters:

Parameter Symbol Definition Threshold The value that separates a logical 1 from a logical 0 CLK Offset Offset from base clock

Token Inputs:

• Pulse train at 3200Hz Token Outputs:

• CLKN • CLK0 • CLK1 • CLK2

Blu

etoo

th • CLK12

Discussion: Example: bt_clock.svu

9

Token Name: Frequency Hop Selector

Abbreviation: fh Synopsis: Bluetooth frequency hop generator. Specification References: Part B 11 See Also: Bluetooth Clock Parameters:

Parameter Symbol Definition Hop System 79/23 hop systems State Page/Inquiry; Page Scan/Inquiry Scan; Master Page

Response; Slave Page Response; Connection UAP/LAP Upper Address Part consists of an 8 bit field

whereas Lower Address part is a 24 bit field of the device address.

K Offset Either 8 or 24 depending on control word. Token Inputs:

• Bluetooth Clock Token Outputs:

• X • A • Add1 • B • XOR1 • C • Y1 • XOR2 • D • PERM5 • E • F • Y2 • ADDR2 • FHop

10

Discussion: Substates determine hopping sequence 1. Page scan – 32 unique frequencies, period length = 32 2. Page response – 32 frequencies, one-one correspondence with page scan 3. Inquiry scan – 32 unique frequencies, period length = 32 4. Inquiry response – 32 frequencies, one-one correspondence with page

scan 5. Connection – 79 frequencies, very long period length

Example: bt_fh.svu

Blu

etoo

th

11

Token Name: Access Code Correlator Abbreviation: ACC_Corr

Synopsis: Bluetooth Access code correlator Specification References: Part B 4.2 See Also: Parameters: Parameter Symbol Definition Threshold The value that separates a logical 1 from a logical 0 LAP 24 bit lower address part of device address Access code size Size of code 68/72 depending on packet type/ Logic1 Output value representing logical 1 Logic0 Output value representing logical 0 Acc Code threshold

Threshold for firing of Access code correlator in number of bits < 64.

Token Inputs:

• Demodulated Signal -Packet Token Outputs:

• Packet • Access code flag

Discussion: Performs a sliding correlation of an input signal with an oversampled sequence and outputs a 1 on the control bit if the threshold is crossed. If the number of errors in correlation is below the threshold, the packet is assumed intended/addressed for this device.

Example: bt_acc_corr.svu

12

Token Name: 1/3 FEC Encoder Abbreviation: R1/3 E

Synopsis: Error Correcting and detecting. Rate 1/3 -(repetition thrice). Encodes 1 bit by copying itself three times Specification References: Part B 5.1 See Also: 1/3 FEC Decoder Parameters:

Parameter Symbol Definition Logic 0 (v) Output logic zero Logic 1 (v) Output logic one Threshold (v) Input logic threshold

level Token Inputs:

• Bit stream Token Outputs:

• Encoded bit stream Discussion:

Blu

etoo

th

Example: bt_r1o3.svu

13

Token Name: 1/3 FEC Decoder Abbreviation: R1/3 D

Synopsis: Error Correcting and detecting. Rate 1/3 -(repetition thrice). Decodes a 3 bit block from a serial soft bit stream by averaging the 3 input bits, then comparing the average with the threshold to output 1 hard bit. Specification References: Part B 5.1 See Also: 1/3 FEC Encoder Parameters:

Parameter Symbol Definition Logic 0(v) Output logic zero Logic 1(v) Output logic one Threshold (v) Input logic threshold level Soft(0/1)

Token Inputs:


• Decoded bit stream Discussion: Example: bt_r1o3.svu

14

Token Name: 2/3 FEC Encoder Abbreviation: R2/3E

Synopsis: The token encodes a 10 bit block from a serial bit stream with LSB in first and serially outputs 15 bits for each input block. LSB is output first. Error correcting scheme is a (15,10) shortened Hamming code. Specification References: Part B 5.2 See Also: 2/3 FEC Decoder Parameters:

Parameter Symbol Definition Logic 0(v) Output logic zero Logic 1(v) Output logic one Threshold (v) Input logic threshold level

Token Inputs:



Blu

etoo

th

Example: bt_r2o3.svu

15

Token Name: 2/3 FEC Decoder Abbreviation: R2/3D

Synopsis: This token decodes a 15 bit block from a serial bit stream with LSB in first and serially outputs 10 bits for each input block LSB first on output 0. An error flag is output for each block on output 1 indicating 2 or more errors were detected. FEC scheme is a (15,10) shortened Hamming code. Specification References: Part B 5.2 See Also: 2/3 FEC Encoder Parameters:


Token Inputs:


• Decoded bit stream Discussion: Example: bt_r2o3.svu

16

Token Name: HEC Encoder Abbreviation: HEC_Enc

Synopsis: Error Checking. Encodes 10 bits of header information by appending 8 parity bits to output Specification References: Part B 4.3.6, 5.4 See Also: HEC Decoder Parameters:

Parameter Symbol Definition Logic 0(v) Output logic zero Logic 1(v) Output logic one Threshold (v) Input logic threshold level UAP/DCI(0-255)

Token Inputs:



Blu

etoo

th The generator polynomial is D8+D7+D5+D2+D+1. For each block, the initial

state of the generator is taken from the UAP/DCI parameter. The D7 position for the UAP/DCI is weighted at 128, D6 is half that and so on. Example: bt_hec.svu

17

Token Name: HEC Decoder Abbreviation: HEC_Dec

Synopsis: Error Checking. Decodes 18 bits of header message and parity bits Specification References: Part B 4.3.6, 5.4 See Also: HEC Encoder Parameters:


Token Inputs:


• Decoded bit stream Discussion: The generator polynomial is D8+D7+D5+D2+D+1. For each block, the initial state of the generator is taken from the UAP/DCI parameter. The D7 position for the UAP/DCI is weighted at 128, D6 is half that and so on. Example: bt_hec.svu

18

Token Name: CRC Encoder Abbreviation: CRC_Enc

Synopsis: Error Checking performed on all packet headers and ACL payloads to validate integrity of received data. Specification References: Part B 5.4 See Also: CRC Decoder Parameters:


Token Inputs:



Blu

etoo

th Encodes bits of information by appending 16 parity bits to output. The generator

polynomial is D16+D12+D5+1. For each block, the initial state of the generator is taken from the UAP/DCI parameter. The D7 position for the UAP/DCI is weighted at 128, D6 is half that and so on. Example: bt_crc.svu

19

Token Name: CRC Decoder Abbreviation: CRC_Dec

Synopsis: Decodes bits of header message and parity bits. Specification References: Part B 5.4 See Also: CRC Encoder Parameters:


Token Inputs:


• Encoded bit stream Discussion: Decodes bits of header message and parity bits. The generator polynomial is D16+D12+D5+1. For each block, the initial state of the generator is taken from the UAP/DCI parameter. The D7 position for the UAP/DCI is weighted at 128, D6 is half that and so on. Example: bt_crc.svu

20

Token Name: Data Whitener Abbreviation: Whitener

Synopsis: (Scrambling) – mixing a PN sequence with data to reduce dc bias Specification References: Part B 7 See Also: Parameters:


Token Inputs:


• Whitened bit stream Discussion: Bluetooth data whitener uses polynomial D7+D4+1. Initial value for bits 0-5 of the generator comes from bits 1-6 of the input CLK arriving at the first input bit with bit 6 of the generator set to 1.

Blu

etoo

th

Example: bt_whitener.svu

21

systemview bluetooth library -...

Documents