CODED PHY enabled device is unscannable

[jabroni]

Hi,

I am currently developing a long range bluetooth module with the U-Blox NINA-B31 BLE module, based off the Nordic nRF52840 chip. I have come across an issue which I have been trying to resolve which I am running out of things to try.

Basically we have a software application that can scan over bluetooth for devices designed to connect to it (done via prefix in device name) which is designed using the QT Framework. These devices are filtered and added to the program and displayed in a list. The user can then select a device and connect to it. If I disable CODED PHY and set the Extended Advertising and Scanning settings to: Scan and Advertising on 1Mbps, Extended advertising disabled , then the device is able to be identified and added to the list in the program.

Further, sniffing via WireShark and using the Windows Bluetooth Virtual Sniffer, I am able to scan with our application and see the following in WireShark (marked as scannable:

However, enabling CODED PHY results in the device becoming unscannable. Explicitly, I have set the CODED implementation to: Scan and advertising on 1Mbps, CODED secondary. Enabling this, the software is not able to identify the device.  I have confirmed this with a series of debug prints that just prints all the devices it is able to identify. Further checking WireShark, it seems that the "scannable" status is set to false:

I've been reading the AT command manual for the NINA-B3 but have not been able to find anything related to scanning while CODED PHY is active.

But, if I attempt to scan via the nRF Connect app on my phone, I am able to identify the device and its connection parameters.

I am not really sure what else to do at this moment. I have been digging extensively through QT documentation (which is what our software is based off), but I am unable to find information that can help me here so I am unsure if the issue lies in our software, or if this is a limitation of nRF chips. To add, I have also modified the scan and connection intervals and windows where interval = 2*window.

I have an nRF52840 DK on my desk and can sniff via wireshark with it as well, but I wanted to check the bluetooth on my PC first before I scanned with that. The result of the nRF sniffer:

Frame 5919: 76 bytes on wire (608 bits), 76 bytes captured (608 bits) on interface COM31-4.2, id 0
    Section number: 1
    Interface id: 0 (COM31-4.2)
        Interface name: COM31-4.2
        Interface description: nRF Sniffer for Bluetooth LE COM31
    Encapsulation type: nRF Sniffer for Bluetooth LE (186)
    Arrival Time: Sep 10, 2024 15:37:13.907336000 AUS Eastern Standard Time
    UTC Arrival Time: Sep 10, 2024 05:37:13.907336000 UTC
    Epoch Arrival Time: 1725946633.907336000
    [Time shift for this packet: 0.000000000 seconds]
    [Time delta from previous captured frame: 0.004999000 seconds]
    [Time delta from previous displayed frame: 1.006609000 seconds]
    [Time since reference or first frame: 16.324203000 seconds]
    Frame Number: 5919
    Frame Length: 76 bytes (608 bits)
    Capture Length: 76 bytes (608 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: nordic_ble:btle:btcommon]
nRF Sniffer for Bluetooth LE
    Board: 31
    Header Version: 3, Packet counter: 10278
        Length of payload: 69
        Protocol version: 3
        Packet counter: 10278
        Packet ID: 2
    Length of packet: 10
    Flags: 0x21
        .... ...1 = CRC: Ok
        .... .00. = Aux Type: AUX_ADV_IND (0)
        .... 0... = Address Resolved: No
        .010 .... = PHY: LE Coded (2)
        0... .... = Reserved: 0
    Channel Index: 9
    RSSI: -41 dBm
    Event counter: 0
    Timestamp: 505482242µs
    [Packet time (start to end): 3856µs]
    [Delta time (end to start): 292µs]
    [Delta time (start to start): 428µs]
Bluetooth Low Energy Link Layer
    Access Address: 0x8e89bed6
    .... ..00 = Coding Indicator: FEC Block 2 coded using S=8 (0)
    Packet Header: 0x3107 (PDU Type: AUX_ADV_IND, TxAdd: Public)
        .... 0111 = PDU Type: 0x7 AUX_ADV_IND
        ...0 .... = Reserved: 0
        ..0. .... = Reserved: 0
        .0.. .... = Tx Address: Public
        0... .... = Reserved: 0
        Length: 49
    Extended Advertising Header
        ..00 1001 = Extended Header Length: 9
        01.. .... = Advertising Mode: Connectable Non-scannable (0x1)
        Extended Header Flags: 0x09
            .... ...1 = Advertiser Address: Present
            .... ..0. = Target Address: Not Present
            .... .0.. = CTE Info: Not Present
            .... 1... = Advertiser Data Info: Present
            ...0 .... = Aux pointer: Not Present
            ..0. .... = Sync Info: Not Present
            .0.. .... = TX Power: Not Present
            0... .... = Reserved: Not Present
        Advertising Address: ublox_8b:a5:a4 (cc:f9:57:8b:a5:a4)
        Advertiser Data Info: 0x089d
            .... 1000 1001 1101 = Advertiser Data Identifier: 0x89d
            0000 .... .... .... = Advertiser Set Identifier: 0x0
    Advertising Data
        Flags
            Length: 2
            Type: Flags (0x01)
            000. .... = Reserved: 0x0
            ...0 .... = Simultaneous LE and BR/EDR to Same Device Capable (Host): false (0x0)
            .... 0... = Simultaneous LE and BR/EDR to Same Device Capable (Controller): false (0x0)
            .... .1.. = BR/EDR Not Supported: true (0x1)
            .... ..1. = LE General Discoverable Mode: true (0x1)
            .... ...0 = LE Limited Discoverable Mode: false (0x0)
        Tx Power Level
            Length: 2
            Type: Tx Power Level (0x0a)
            Power Level (dBm): 6
        Peripheral Connection Interval Range: 30 - 50 msec
            Length: 5
            Type: Peripheral Connection Interval Range (0x12)
        Connection Interval Min: 24 (30 msec)
        Connection Interval Max: 40 (50 msec)
        128-bit Service Class UUIDs
            Length: 17
            Type: 128-bit Service Class UUIDs (0x07)
            Custom UUID: 2456e1b9-26e2-8f83-e744-f34f01e9d701 (Unknown)
        Device Name: NINA-DEV-KIT
            Length: 8
            Type: Device Name (0x09)
            Device Name: NINA-DEV-KIT
    CRC: 0xfa4ffe

\

 

Computer Platform:

Hardware: NINA-B311-01BDKR-ND based on nRF52840

[Sigurd]

Hi!

Could you upload the nrf sniffer trace? 

Note that you can't have extended, connectable and scannable. All extended connectable, are non-scannable. ref

https://infocenter.nordicsemi.com/topic/com.nordic.infocenter.s140.api.v7.3.0/group___b_l_e___g_a_p___a_d_v___t_y_p_e_s.html

[jabroni]

Hi Sigurd ,

Thank you for the response and the info on extended connectable devices. I was not aware of this, but it is also defined in the core specification guide in section 2.3.1.5. It seems you are correct about what I expect vs what actually happens, and this case what actually happens is that with extended advertising enabled the device is not scannable, but is connectable. 

I can see in the trace that with extended advertising enabled, the PDU type is set to AUX_ADV_IND which from the documentation states:

ADV_EXT_IND is over primary advertising channels and is used to indicate that an advertisement will be sent on a secondary advertisement channel. The information in ADV_EXT_IND will inform the scanner:

• Which secondary advertising channel will be used by AUX_ADV_IND
• Which PHY will be used by AUX_ADV_IND, 1M PHY, 2M PHY, or 1M Coded PHY  
• When AUX_ADV_IND will be presented on that specified secondary advertising channel

So basically the device is connectable, but just cannot be scanned. So how can I initiate a connection with an unscannable device?

I've attached the trace below and you can filter the device with: `btle.advertising_address == cc:f9:57:8b:a5:a4`

wireshark_00001_20240911110007.pcapng

Looking at section 2.3.1.6 of the core specification, and the Extended Advertising Header in the trace, the Advertising Mode is set to "Connectable Non-scannable" with "Connectable Undirected" as the event type (if I have read this correctly):

I can't find anything in QT documentation so far in regards to passive/active scanning and this I will have to look into further.

This makes me wonder something - if the QT central application does not support switching between active and passive scanning, would a dongle configured for CODED PHY solve this? Still trying to understand how to actually connect to a non-scannable but connectable device.

[Sigurd]

Hi!

Scannable means that the scanner can send a scan request.

Connectable means that the scanner can send a connect request.

Are you using U-Blox NINA-B31 BLE for both the advertiser and scanner?

I'm not familiar with QT, but maybe it does not support CODED PHY and Extended Advertising PDUs. These was introduced in Bluetooth 5.0

[jabroni]

Hi Sigurd ,

Thank you for the clarification. 

I am only using the B31 module as an advertiser, and my desktop pc as a scanner. My PC uses a standard microsoft bluetooth module and I can at least scan for devices and have the scan response show the B31 dev kit with CODED PHY enabled:

This could very well be a limitation of QT, and maybe a way around it would be to make an adaptor with a NINA B3 module that scan scan for CODED PHY enabled devices.