Bluetooth & BLE · Study deck
Bluetooth: Radio, Channels, and Piconets
Bluetooth shares 2.4 GHz with Wi-Fi and other radios.
Radio Remi is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- Explain: LE Coded uses redundancy for range, commonly described as S=2 around 500 kbit/s or S=8 around 125 kbit/s, while leaving the preamble and access-address handling visible as lower-layer evidence.
- Explain: The first coded block must be decodable before the receiver knows whether the later PDU uses S=2 or S=8, so the access-address-following control block uses the fixed, robust S=8 path.
- Explain: Each piconet still has its own clock, hop sequence, polling behavior, and active-member limit, so bridge behavior belongs in the capacity and latency evidence.
Major section
How Bluetooth Works: Radio, Channels, and Piconets
Behind the discovery-and-GATT behavior above sits a specific radio design.
- The title's promise — how Bluetooth actually works — comes down to three ideas: the 2.4 GHz band, frequency hopping, and the piconet.
- Adaptive Frequency Hopping strengthens that behavior by excluding channels observed as busy, provided enough usable spectrum remains.
Major section
How Bluetooth Works: Radio, Channels, and Piconets (continued)
Construction is easiest to remember as a coding pipeline.
- Classic Bluetooth divides the band into 79 channels of 1 MHz; BLE uses 40 channels of 2 MHz, but the picture makes the three advertising channels' deliberate spacing easier to reason about.
- BLE changes the link setup vocabulary.
- This derivation also explains the coding indicator.
Major section
How Bluetooth Works: Radio, Channels, and Piconets (continued)
Packet processing has a strict direction.
- Advertising uses the sparse trio to improve the chance that discovery avoids a busy Wi-Fi region; after connection, peers move across the data-channel set.
- A basic-rate packet also carries an access code and header before its payload.
- These stages protect different failure boundaries.
Major section
How Bluetooth Works: Radio, Channels, and Piconets (continued)
Its identity comes from a 24-bit Lower Address Part (LAP), but the transmitted access code also contains synchronization redundancy.
- That division sets up Figure: Classic Bluetooth frequency hops traced in time order: channels provide the available places, while the hopping sequence decides which place the link uses next.
- The alternation connects topology to throughput: framing, reply opportunities, polls, and slot boundaries all consume airtime.
- The pattern mapper then sets the final symbol expansion.
Major section
How Bluetooth Works: Radio, Channels, and Piconets (continued)
A four-bit alternating preamble is selected from the first sync-word bit so the transition into synchronization is unambiguous.
- Classic Bluetooth's physical layer uses Gaussian frequency-shift keying at the basic 1 Mbps rate, with enhanced data-rate modes using phase-shift keying for 2 and 3 Mbps payloads.
- That final overlay leaves the LAP/Barker information recoverable while scrambling the parity structure.
- The CRC detects residual accidental corruption.
Major section
How Bluetooth Works: Radio, Channels, and Piconets (continued)
The master opens the exchange, a slave replies in its scheduled direction, and a three- or five-slot packet holds one hop frequency for its full duration before the next transmission changes channel.
- Packet review must therefore count the access code, header, CRC, coding, and retransmissions before turning a nominal bit rate into an application transfer promise.
- ID packets used by inquiry and paging omit the following header and use the shorter access-code form appropriate to that packet.
- The LAP remains recoverable from the known construction, so the access code is a synchronizer and correlator, not a confidentiality mechanism.
Major section
How Bluetooth Works: Radio, Channels, and Piconets (continued)
The result is already twice as many coded bits as information bits.
- Confusing that acquisition code with authentication would let any radio that can synthesize the sequence masquerade as the expected piconet at the physical boundary.
- For ordinary connected packets, the Header Error Check is generated by an eight-bit linear-feedback shift register initialized from the central's Upper Address Part (UAP).
- Its coding indicator selects the mapper for the second block.
Major section
How Bluetooth Works: Radio, Channels, and Piconets (continued)
Defined FHS exceptions use the peripheral UAP or the Default Check Initialization during page/inquiry response.
- The resulting 18 bits are whitened with the Classic whitening sequence, whose LFSR seed is normally derived from the central clock for the current slot; inquiry/page-response exceptions use their specified hopping input.
- Band: every basic-rate packet carries 72 bits of access code and 54 bits of header before one byte of payload.
- Trade: slot boundaries and FEC redundancy are why a 1 Mb/s radio rarely delivers 1 Mb/s of payload -- 450 bytes landed at roughly 844 kb/s here.
Major section
How Bluetooth Works: Radio, Channels, and Piconets (continued)
For the example above, the first encoded pair 11 becomes 1100 1100 under S=8.
- Each piconet still has its own clock, hop sequence, polling behavior, and active-member limit, so bridge behavior belongs in the capacity and latency evidence.
- A peripheral advertises periodically, often somewhere between tens of milliseconds and several seconds depending on power and discovery needs.
- Encryption and the integrity code protect confidentiality and authenticity for the fields within their scope.
Major section
How Bluetooth Works: Radio, Channels, and Piconets (continued)
The common advertising packet types are ADV_IND for general connectable advertising, ADV_DIRECT_IND for a directed connection attempt, ADV_NONCONN_IND for broadcast-only information, and ADV_SCAN_IND when scan responses may add more data.
- Once connected, the peers agree on an access address, hop increment, channel map, and connection timing; private addressing and identity keys can keep the product from being tracked by a fixed radio address.
- Bluetooth 5 added PHY choices that should be named in design evidence: LE 1M, LE 2M, and LE Coded.
- The PDU and CRC are whitened so their transmitted symbols do not retain data-dependent DC patterns.
Major section
How Bluetooth Works: Radio, Channels, and Piconets (continued)
Stronger coding stretches airtime to improve weak-link robustness, so the choice must remain connected to throughput and battery evidence.
- LE Coded uses redundancy for range, commonly described as S=2 around 500 kbit/s or S=8 around 125 kbit/s, while leaving the preamble and access-address handling visible as lower-layer evidence.
- The trade is deliberate: coded packets can survive weaker links, but the extra symbols stretch airtime and can reduce throughput or battery life if the product only needed a short-range link.
- Band: advertising uses three of 40 channels, repeating between tens of milliseconds and several seconds.
Major section
How Bluetooth Works: Radio, Channels, and Piconets (continued)
Starting from an all-zero encoder state, the input bits 1 0 1 1 therefore produce pairs 11 10 00 10.
- The receiver's Viterbi decoder does not decide each pair independently; it searches the permitted state transitions for the most likely complete path, which is how redundancy repairs some symbol errors.
- With coding scheme S=2, each convolutional-encoder bit maps to one transmitted symbol, so one information bit becomes two symbols overall.
- With S=8, each encoder bit maps to four symbols (0 to 0011, 1 to 1100), so one information bit becomes eight symbols overall.
Major section
How Bluetooth Works: Radio, Channels, and Piconets (continued)
Trade: tiny packets and long sleeps keep the radio off — battery bought with discovery latency.
- The larger Hamming separation gives the receiver more evidence on a weak link, but it consumes four times the airtime of the S=2 mapping for the same convolutional output.
- The first coded block must be decodable before the receiver knows whether the later PDU uses S=2 or S=8, so the access-address-following control block uses the fixed, robust S=8 path.
- Whitening prevents long runs and persistent spectral patterns; it does not hide the data from an observer who knows the public procedure.
Major section
Figure Review: Classic Acquisition and Protected Bits
Classic Bluetooth acquisition begins with a synchronization identity before the receiver can interpret the protected header and payload.
- Encryption, integrity checking, coding, and RF mapping protect different failure boundaries and must remain in the correct order.
Deck summary
Key takeaways
Behind the discovery-and-GATT behavior above sits a specific radio design.
- Construction is easiest to remember as a coding pipeline.
- Packet processing has a strict direction.
- Its identity comes from a 24-bit Lower Address Part (LAP), but the transmitted access code also contains synchronization redundancy.
- A four-bit alternating preamble is selected from the first sync-word bit so the transition into synchronization is unambiguous.
Retrieval practice
Recall check
Radio Remi says: answer from memory, then check your reasoning.
Q1A receiver is correlating the access code of a normal Classic Bluetooth packet on an established piconet. Which description gets both the 72-bit structure and its security meaning right?
Show answer
Answer: A The Classic packet access code is 4 + 64 + 4 bits and provides synchronization and procedure or piconet correlation without authenticating the sender.
Print reference
Answers
Answer key.
- A · The Classic packet access code is 4 + 64 + 4 bits and provides synchronization and procedure or piconet correlation without authenticating the sender.