4 Bluetooth: Radio, Channels, and Piconets

4.5.1 Classic access codes and synchronisation

Every Classic baseband packet begins by answering two questions: “is this a Bluetooth waveform?” and “does it belong to the procedure or piconet I am following?” The access code provides that acquisition boundary before the receiver attempts to decode the header. Its identity comes from a 24-bit Lower Address Part (LAP), but the transmitted access code also contains synchronization redundancy.

Construction is easiest to remember as a coding pipeline. Start with the 24 LAP bits and append one of two six-bit patterns; together with the LAP’s most-significant bit, that choice forms a seven-bit Barker sequence that improves autocorrelation. XOR the resulting 30 information bits with the information-covering part of the fixed PN overlay, generate the parity of the BCH code — an expurgated binary $(64,30)$ block code — assemble the 64-bit codeword, and then XOR the complete codeword with the full PN overlay. That final overlay leaves the LAP/Barker information recoverable while scrambling the parity structure. A four-bit alternating preamble is selected from the first sync-word bit so the transition into synchronization is unambiguous. When a packet header follows, a four-bit trailer continues the alternating pattern at the far edge. This produces the familiar 72-bit packet access code: 4-bit preamble, 64-bit sync word, and 4-bit trailer. ID packets used by inquiry and paging omit the following header and use the shorter access-code form appropriate to that packet.

The LAP remains recoverable from the known construction, so the access code is a synchronizer and correlator, not a confidentiality mechanism. A receiver correlates incoming symbols against the expected CAC, DAC, or IAC, obtains packet timing, and only then attempts the whitened and error-protected header. Confusing that acquisition code with authentication would let any radio that can synthesize the sequence masquerade as the expected piconet at the physical boundary.

4.5.2 Access-Code Knowledge Check

4.5.3 Classic header encoding pipeline

The logical Classic packet header is only 18 bits, but each bit has a distinct link-control job:

For ordinary connected packets, the Header Error Check is generated by an eight-bit linear-feedback shift register initialized from the central’s Upper Address Part (UAP). Defined FHS exceptions use the peripheral UAP or the Default Check Initialization during page/inquiry response. That initialization supplies the right header-check context while still providing error detection rather than cryptographic integrity. The resulting 18 bits are whitened with the Classic whitening sequence, whose LFSR seed is normally derived from the central clock for the current slot; inquiry/page-response exceptions use their specified hopping input. Whitening prevents long runs and persistent spectral patterns; it does not hide the data from an observer who knows the public procedure.

Finally, 1/3-rate repetition coding sends each whitened header bit three times:

At the receiver, majority decoding happens before dewhitening and HEC evaluation. That order matters during diagnosis: a correlation failure points toward the access code or timing, an HEC failure points toward a header that could not be recovered, and a later CRC failure points toward the payload path.

The piconet. A Bluetooth connection is organized as a piconet: one device is the master (BLE calls it the central) and owns the clock and hopping sequence; up to seven active slaves (BLE: peripherals) synchronize to it and hop in lockstep. In BLE, a peripheral first advertises on the three advertising channels; a scanning central hears it and opens the connection, after which both follow the shared data-channel hop sequence.

In Classic scatternets, a bridge device can participate in more than one piconet by taking different roles at different times, such as slave in one piconet and master in another. That does not create arbitrary peer-to-peer traffic. Each piconet still has its own clock, hop sequence, polling behavior, and active-member limit, so bridge behavior belongs in the capacity and latency evidence.

Stack and version landmarks. Baseband handles physical channels, hop selection, packets, paging, inquiry, and synchronous or asynchronous links. L2CAP sits above it for logical-channel multiplexing, segmentation and reassembly, and group abstractions — with a default 672-byte MTU and a 48-byte minimum every implementation must support — while RFCOMM builds a reliable virtual serial stream over that stack for Classic serial-style profiles. Historically, Bluetooth v1.2 established the stable early Classic baseline, v2.1 + EDR added Secure Simple Pairing and higher practical rates, v3.0 + HS used Bluetooth for setup while routing high-speed data over 802.11 when the +HS feature was actually present, and v4.0 separated Classic, high-speed, and Bluetooth Low Energy behavior.

BLE changes the link setup vocabulary. A peripheral advertises periodically, often somewhere between tens of milliseconds and several seconds depending on power and discovery needs. The common advertising packet types are ADV_IND for general connectable advertising, ADV_DIRECT_IND for a directed connection attempt, ADV_NONCONN_IND for broadcast-only information, and ADV_SCAN_IND when scan responses may add more data. Once connected, the peers agree on an access address, hop increment, channel map, and connection timing; private addressing and identity keys can keep the product from being tracked by a fixed radio address.

Bluetooth 5 added PHY choices that should be named in design evidence: LE 1M, LE 2M, and LE Coded. LE Coded uses redundancy for range, commonly described as S=2 around 500 kbit/s or S=8 around 125 kbit/s, while leaving the preamble and access-address handling visible as lower-layer evidence. The trade is deliberate: coded packets can survive weaker links, but the extra symbols stretch airtime and can reduce throughput or battery life if the product only needed a short-range link.

4.5.4 LE Coded encoder derivation

LE Coded begins with a rate-$1/2$, constraint-length-four convolutional encoder. Let $u_k$ be the current input bit and take all additions modulo two (XOR). The generator polynomials

give the two encoder outputs

Transmit $v_{0,k}$ first and $v_{1,k}$ second. Starting from an all-zero encoder state, the input bits 1 0 1 1 therefore produce pairs 11 10 00 10. The result is already twice as many coded bits as information bits. The receiver’s Viterbi decoder does not decide each pair independently; it searches the permitted state transitions for the most likely complete path, which is how redundancy repairs some symbol errors.

The pattern mapper then sets the final symbol expansion. With coding scheme S=2, each convolutional-encoder bit maps to one transmitted symbol, so one information bit becomes two symbols overall. With S=8, each encoder bit maps to four symbols (0 to 0011, 1 to 1100), so one information bit becomes eight symbols overall. For the example above, the first encoded pair 11 becomes 1100 1100 under S=8. The larger Hamming separation gives the receiver more evidence on a weak link, but it consumes four times the airtime of the S=2 mapping for the same convolutional output.

This derivation also explains the coding indicator. The first coded block must be decodable before the receiver knows whether the later PDU uses S=2 or S=8, so the access-address-following control block uses the fixed, robust S=8 path. Its coding indicator selects the mapper for the second block.

LE Coded packets still start with ordinary synchronization evidence, but their coded portion adds fields that tell the receiver how to decode what follows. Inspect Figure 4.4 to locate that boundary before comparing S=2 and S=8; otherwise “coded PHY” hides which symbols receive which protection and how much airtime the choice adds.

Read Figure 4.4 from preamble and access address into FEC block 1, where the coding indicator and TERM1 are always protected with S=8. The indicator then selects S=2 or S=8 for the PDU and CRC in block 2 before TERM2 closes it. Stronger coding stretches airtime to improve weak-link robustness, so the choice must remain connected to throughput and battery evidence. Bluetooth direction finding adds a different extension after the CRC; its phase measurements still require antenna calibration, interference review, and link-layer trust rather than being accepted as self-authenticating position proof.

4.5.5 LE protected-bitstream pipeline

Packet processing has a strict direction. For a protected data-channel PDU, the transmitter first applies the link-layer encryption and message-integrity procedure to the protected payload, then calculates the packet CRC over the resulting PDU. The PDU and CRC are whitened so their transmitted symbols do not retain data-dependent DC patterns. On LE Coded PHY, the coded blocks then pass through the rate-$1/2$ convolutional encoder and the selected pattern mapper before GFSK modulation.

The receiver must undo those operations in reverse:

1. Recover symbols and apply S=2 or S=8 pattern demapping.
2. Viterbi-decode the convolutional code and use the terminators to return the trellis to its known state.
3. Dewhiten the recovered PDU and CRC with the channel/clock-derived whitening state.
4. Check the CRC before handing a corrupted PDU farther up the link layer.
5. For an encrypted PDU, decrypt and verify its message-integrity code before releasing plaintext.

These stages protect different failure boundaries. FEC spends airtime to correct some channel errors. The CRC detects residual accidental corruption. Whitening shapes the transmitted spectrum. Encryption and the integrity code protect confidentiality and authenticity for the fields within their scope. None substitutes for the others, and not every field is covered: preamble, access address, and coding-control information must remain available early enough for acquisition and decoding.

Why BLE is low-power. The advertise-then-connect model, tiny packets, and long sleep intervals mean the radio is off most of the time — the battery-life evidence the review sections above check is a direct consequence of this radio design.

The worked encoder in Figure 4.5 makes the redundancy-to-airtime trade visible below the packet-field view.

Follow Figure 4.5 from INPUT · 1 0 1 through D¹ and D² to the g₀ = 1+D+D² and g₁ = 1+D² taps. The paired stream then reaches S = 2 or S = 8: both preserve the same information, but the larger symbol expansion spends more airtime to give the receiver more evidence on a weak link.