Channel Sounding Not Working with nRF Toolbox App and nRF54L15-DK

[cwhit]

I'm trying to experiment with Bluetooth Channel Sounding using the nRF Toolbox App with an nRF54L15-DK. The app is running on a Google Pixel 10 running Android 16 QPR3 Beta 2. On the DK, I'm using the channel_sounding_ras_reflector app from NCS v3.1.1. These are the only modifications I've made:

• CONFIG_BT_BONDABLE=y
• CONFIG_BT_CTLR_SDC_CS_MAX_ANTENNA_PATHS=2

I have not made any modifications to the nRF Toolbox app.

The app fails to show any ranging data and gets stuck at "Initiating ranging..."

I have an RFCreations airtrace and can see nRF DK is rejecting the Channel Sounding Start command from the Pixel:

I also see some cases where the Channel Sounding Start appears to succeed:

Here is the CS Configuration being used:

Devices:
Central : 44:A2:8F:A0:48:76, Resolvable private
Peripheral : D2:42:A2:F3:A6:39, Static (Nordic CS Reflector)

"C2P, decrypted, #160509, LE-C: LL_CS_CONFIG_REQ":
Opcode : 0x30 (LL_CS_CONFIG_REQ)
LL_CS_CONFIG_REQ payload:
Config ID : 0x00 (0)
State : 0x1 (Configuration is enabled)
ChM : "0x15555555555554555554 (Used: 2, 4, 6, 8, 10, 12, 14, 16, 18, 20, 22, 26, 28, 30, 32, 34, 36, 38, 40, 42, 44, 46, 48, 50, 52, 54, 56, 58, 60, 62, 64, 66, 68, 70, 72, 74, 76, Unused: 0-1, 3, 5, 7, 9, 11, 13, 15, 17, 19, 21, 23-25, 27, 29, 31, 33, 35, 37, 39, 41, 43, 45, 47, 49, 51, 53, 55, 57, 59, 61, 63, 65, 67, 69, 71, 73, 75, 77-79)"
Channel Map Repetition : 0x01 (1)
Main Mode : 0x02 (Mode-2)
Sub Mode : 0xFF (Mode None)
Main Mode Min Steps : 0x00 (0)
Main Mode Max Steps : 0x00 (0)
Main Mode Repetition : 0x00 (0)
Mode 0 Steps : 0x03 (3)
CS SYNC PHY:
LE 1M PHY : 0x1 (Used)
LE 2M PHY : 0x0 (Not Used)
LE Coded PHY : 0x0 (Not Used)
RFU (2M 2BT or S=2 Coded in other PDUs) : 0x0 (Not Used)
RFU : 0x0 (0)

RTT Type : 0x0 (Sync AA only)
Role : 0x0 (Initiator)
IPT : 0x0 (Not Required)
RFU : 0x0 (Not Required)
ChSel : 0x0 (Channel Selection Algorithm 3b)
Ch3c Shape : 0x0 (Hat shape)
Ch3c Jump : 0x03 (Jump 3)
T IP1 : 0x05 (60 µs)
T IP2 : 0x01 (20 µs)
T FCS : 0x06 (80 µs)
T PM : 0x00 (10 µs)
RFU : 0x00 (0)


"P2C, decrypted, #160577, LE-C: LL_CS_CONFIG_RSP":
Opcode : 0x31 (LL_CS_CONFIG_RSP)
LL_CS_CONFIG_RSP payload:
Config ID : 0x00 (0)
RFU : 0x0 (0)

This Reflector DK works fine with another nRF54L15 DK programmed as the Initiator. Here is a diff between the failing config and the succeeding config (using the command "diff CS_Config--nRF54_Succeed CS_Config--Pixel_Fail > CS_Config_Diff.txt"):

1,2c1,2
<  "C2P then P2C, decrypted, Channel Sounding Configuration, 2 packets (#2588, #2616)":
<     "C2P then P2C, decrypted, Channel Sounding Configuration, 2 packets (#2588, #2616)"   : 
---
>  "C2P then P2C, decrypted, Channel Sounding Configuration, 2 packets (#160509, #160577)":
>     "C2P then P2C, decrypted, Channel Sounding Configuration, 2 packets (#160509, #160577)": 
4,5c4,5
<         Central                                                                           : D2:42:A2:F3:A6:39, Static
<         Peripheral                                                                        : CE:E9:DF:96:7C:F8, Static (CS RFLCT 1)
---
>         Central                                                                           : 44:A2:8F:A0:48:76, Resolvable private
>         Peripheral                                                                        : D2:42:A2:F3:A6:39, Static (Nordic CS Reflector)
7c7
<     "C2P, decrypted, #2588, LE-C: LL_CS_CONFIG_REQ":
---
>     "C2P, decrypted, #160509, LE-C: LL_CS_CONFIG_REQ":
12,13c12,13
<             ChM                                                                           : "0x1FFFFFFFFFFFFC7FFFFC (Used: 2-22, 26-76, Unused: 0-1, 23-25, 77-79)"
<             Channel Map Repetition                                                        : 0x03 (3)
---
>             ChM                                                                           : "0x15555555555554555554 (Used: 2, 4, 6, 8, 10, 12, 14, 16, 18, 20, 22, 26, 28, 30, 32, 34, 36, 38, 40, 42, 44, 46, 48, 50, 52, 54, 56, 58, 60, 62, 64, 66, 68, 70, 72, 74, 76, Unused: 0-1, 3, 5, 7, 9, 11, 13, 15, 17, 19, 21, 23-25, 27, 29, 31, 33, 35, 37, 39, 41, 43, 45, 47, 49, 51, 53, 55, 57, 59, 61, 63, 65, 67, 69, 71, 73, 75, 77-79)"
>             Channel Map Repetition                                                        : 0x01 (1)
15,17c15,17
<             Sub Mode                                                                      : 0x01 (Mode-1)
<             Main Mode Min Steps                                                           : 0x02 (2)
<             Main Mode Max Steps                                                           : 0x05 (5)
---
>             Sub Mode                                                                      : 0xFF (Mode None)
>             Main Mode Min Steps                                                           : 0x00 (0)
>             Main Mode Max Steps                                                           : 0x00 (0)
33c33
<             Ch3c Jump                                                                     : 0x00 (Unknown)
---
>             Ch3c Jump                                                                     : 0x03 (Jump 3)
36c36
<             T FCS                                                                         : 0x05 (60 µs)
---
>             T FCS                                                                         : 0x06 (80 µs)
41c41
<     "P2C, decrypted, #2616, LE-C: LL_CS_CONFIG_RSP":
---
>     "P2C, decrypted, #160577, LE-C: LL_CS_CONFIG_RSP":

Can you help explain what is going on here?

Thanks,
Chris

[Simonr]

Hi

I just tested again on my end, with an nRF54L15 DK on NCS v3.1.1 with the Channel Sounding reflector sample, and I'm able to get ranging as expected. Here is my prj.conf file:

#
# Copyright (c) 2024 Nordic Semiconductor ASA
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#

CONFIG_NCS_SAMPLES_DEFAULTS=y
CONFIG_DK_LIBRARY=y

CONFIG_BT=y
CONFIG_BT_PERIPHERAL=y
CONFIG_BT_SMP=y
CONFIG_BT_DEVICE_NAME="Nordic CS Reflector 1ANT"
CONFIG_BT_MAX_CONN=1
CONFIG_BT_GAP_AUTO_UPDATE_CONN_PARAMS=n
CONFIG_BT_BONDABLE=y

# The Ranging Profile recommends a MTU of at least 247 octets.
CONFIG_BT_L2CAP_TX_MTU=498
CONFIG_BT_BUF_ACL_TX_SIZE=502
CONFIG_BT_BUF_ACL_RX_SIZE=502
CONFIG_BT_CTLR_DATA_LENGTH_MAX=251
CONFIG_BT_CTLR_PHY_2M=y

# This reduces RAM usage. Additional RAM is needed to support optional
# features such as mode 3 or multiantenna. Change or remove these if
# using those features
CONFIG_BT_RAS_MODE_3_SUPPORTED=n
CONFIG_BT_RAS_MAX_ANTENNA_PATHS=2
CONFIG_BT_CTLR_SDC_CS_MAX_ANTENNA_PATHS=2
CONFIG_BT_CTLR_SDC_CS_NUM_ANTENNAS=1
CONFIG_BT_CTLR_SDC_CS_STEP_MODE3=n
CONFIG_BT_CTLR_SDC_CS_ROLE_REFLECTOR_ONLY=y

# Disabling the CS Test command reduces flash usage
CONFIG_BT_CTLR_CHANNEL_SOUNDING_TEST=n

# This allows CS and ACL to use different PHYs
CONFIG_BT_TRANSMIT_POWER_CONTROL=y

CONFIG_BT_CHANNEL_SOUNDING=y
CONFIG_BT_RAS=y
CONFIG_BT_RAS_RRSP=y

What version do you have of the development kit, NCS, nRF Toolbox, Android, etc.

Can you confirm that you have bonded the DK to the phone when connecting to it for it to correctly initiate ranging? I have seen the "initiating ranging" getting stuck if:

1. The devices aren't bonded correctly. Try erasing bond information on the phone side and erase and flash the nRF54L15 DK, to make sure there is no stale bonding information on either side.
2. The number of antenna paths or antennas are incorrectly configured.

Best regards,

Simon

[cwhit]

Hi Simon,

Thanks a bunch for your support on this. I have tried updating my DK to have all the configurations you showed here and still have an error. There failure mode is a little different than I originally experienced, but I've actually seen this (newer) failure mode since before updating my configs to match your latest. I get a "session disappeared" error after the "Initiating ranging..." bit.

Please see the attached video to see my failure. You'll see this video also shows how I'm ensuring the bond is flushed, using "Forget Device." Note that, when I cleared the bond on the phone and retried CS, I also reflashed the DK to clear it's bond info as you suggested.

I'm using:
NCS v3.1.1
Pixel 9 Pro running Android 16 QPR3 Beta 2
nRF Toolbox v4.2.0
DK info: PCA10156, 0.9.3, 2025.26 (2nd board: 2025.27)

[Simonr]

Hmm, so the differences between our setups is 

• Pixel 9 Pro vs. Pixel 10
• Android version. I have the regular latest Android 16 version, as the Beta isn't required anymore.
• DK version. I only have PCA10156 DK v1.0.0 on my side. I'll ask around to see if I can get my hands on an older version to confirm.

I will also try to find someone with a Pixel 9 to confirm they have gotten it up and running there. And as I said earlier, this issue is what I have seen when either having the DK too close to the phone when initiating ranging, the antenna paths/number is set incorrectly, or if the bonding information not up-to-date.

Do you have any logging information from the nRF54L15 DK if you open a terminal to get log info from the nRF54L15. Unfortunately the nRF Toolbox doesn't have too much useful logging by default.

Best regards,

Simon

[cwhit]

Thanks, Simon.

I also have a Pixel 10 and have so far seen the same behavior with it. I will try removing it from the Beta program to see if it will revert to regular Android 16, and then try again and get back to you.

Here is an example log from the DK (In this instance, the app was stuck on "Initiating ranging..."):

*** Booting nRF Connect SDK v3.1.1-e2a97fe2578a ***
*** Using Zephyr OS v4.1.99-ff8f0c579eeb ***
I: Starting Channel Sounding Reflector Sample
I: SoftDevice Controller build revision: 
I: fc de 41 eb a2 d1 42 24 |..A...B$
I: 00 b5 f8 57 9f ac 9d 9e |...W....
I: aa c9 b4 34             |...4    
I: HW Platform: Nordic Semiconductor (0x0002)
I: HW Variant: nRF54Lx (0x0005)
I: Firmware: Standard Bluetooth controller (0x00) Version 252.16862 Build 1121034987
I: HCI transport: SDC
I: Identity: D2:42:A2:F3:A6:39 (random)
I: HCI: version 6.1 (0x0f) revision 0x3069, manufacturer 0x0059
I: LMP: version 6.1 (0x0f) subver 0x3069
I: Connected to 46:54:CC:6B:3B:60 (random) (err 0x00)
I: SC LTK: 0x0b67696dfd0177707293b66b3179b556
I: CS capability exchange completed.
I: CS config creation complete. ID: 0
I: CS security enabled.
I: CS procedures enabled.
I: CS procedures enabled.
I: CS procedures enabled.
I: CS procedures enabled.
I: CS procedures enabled.
I: CS procedures enabled.
I: CS procedures enabled.
I: CS procedures enabled.
I: CS procedures enabled.
I: CS procedures enabled.
I: CS procedures enabled.
I: CS procedures enabled.
I: CS procedures enabled.
I: CS procedures enabled.
I: CS procedures enabled.
I: CS procedures enabled.
I: CS procedures enabled.
I: CS procedures enabled.

Cheers,
Chris

[Simonr]

I still haven't had any luck getting my hands on the v0.9.3 DK, and haven't reproduced this on my end. One more thing you can try is to set the tone_antenna_config_selection = BT_LE_CS_TONE_ANTENNA_CONFIGURATION_A1_B2 in your reflector main.c file.

I was also told there were some connection issues to Android that have been addressed in the latest nRF Connect SDK main branch: https://github.com/nrfconnect/sdk-nrf 

I tested that on my end on Friday and that also works fine on my end.

Best regards,

Simon