Category: Bluetooth / Channel Sounding
---
Hardware:
- Board: nRF54L15DK (nrf54l15dk/nrf54l15/cpuapp)
- nRF Connect SDK: v3.1.0
- Sample: nrf/samples/bluetooth/channel_sounding_ras_reflector
- Build command: west build -p -b nrf54l15dk/nrf54l15/cpuapp -- -DEXTRA_CONF_FILE=android_ranging.conf
Mobile device:
- Device: Google Pixel 10
- Android version: 17
- nRF Toolbox version: 4.3.2
---
Issue Description:
When connecting the channel_sounding_ras_reflector sample (built with android_ranging.conf) to a Pixel 10 running Android 17 via nRF
Toolbox v4.3.2, the CS setup phase completes successfully up to and including CS security enable. After that, no CS procedures ever start
and no ranging data is produced. The app appears stuck — no distance measurements are shown and there is no further activity.
---
Steps to Reproduce:
1. Build and flash channel_sounding_ras_reflector with android_ranging.conf on nRF54L15DK
2. Open nRF Toolbox v4.3.2 on Pixel 10 (Android 17)
3. Navigate to the Channel Sounding / Ranging tile
4. Connect to "Nordic CS Reflector"
5. Complete BLE pairing/bonding when prompted
6. Observe UART logs on nRF54L15DK and nRF Toolbox UI
---
Expected Behavior:
After CS security enable, the Android initiator sends LE CS Procedure Enable, CS subevents begin, ranging data flows through the RAS GATT
service (RRSP), and nRF Toolbox displays distance measurements.
---
Actual Behavior:
CS setup completes up to security enable and then stalls. UART log on nRF54L15DK:
I: Connected to XX:XX:XX:XX:XX:XX (random) (err 0x00)
I: CS capability exchange completed.
I: CS config creation complete. ID: 0
I: CS security enabled.
← stuck here, no further CS activity
No LE CS Procedure Enable appears to be sent by Android. No CS subevent results are generated. nRF Toolbox shows no ranging output. The
connection remains alive but idle indefinitely.
---
What Has Been Tried:
1. Full flash erase and fresh pairing — same result every time
2. Killing and restarting nRF Toolbox app — same result
3. Forgetting device on Android and reconnecting — same result
4. Added CONFIG_BT_GATT_SERVICE_CHANGED=y to android_ranging.conf — no change
5. Confirmed android_ranging.conf is applied correctly (bonding and CS security succeed, so base config is working)
---
Configuration:
prj.conf (relevant entries):
CONFIG_BT_PERIPHERAL=y
CONFIG_BT_SMP=y
CONFIG_BT_BONDABLE=n
CONFIG_BT_MAX_CONN=1
CONFIG_BT_L2CAP_TX_MTU=498
CONFIG_BT_BUF_ACL_TX_SIZE=502
CONFIG_BT_BUF_ACL_RX_SIZE=502
CONFIG_BT_CTLR_DATA_LENGTH_MAX=251
CONFIG_BT_CTLR_PHY_2M=y
CONFIG_BT_RAS_MODE_3_SUPPORTED=n
CONFIG_BT_RAS_MAX_ANTENNA_PATHS=1
CONFIG_BT_CTLR_SDC_CS_MAX_ANTENNA_PATHS=1
CONFIG_BT_CTLR_SDC_CS_NUM_ANTENNAS=1
CONFIG_BT_CTLR_SDC_CS_STEP_MODE3=n
CONFIG_BT_CTLR_SDC_CS_ROLE_REFLECTOR_ONLY=y
CONFIG_BT_CHANNEL_SOUNDING=y
CONFIG_BT_RAS=y
CONFIG_BT_RAS_RRSP=y
android_ranging.conf:
CONFIG_BT_BONDABLE=y
CONFIG_BT_SETTINGS=y
CONFIG_SETTINGS=y
CONFIG_FLASH=y
CONFIG_FLASH_PAGE_LAYOUT=y
CONFIG_FLASH_MAP=y
CONFIG_NVS=y
CONFIG_BT_GATT_SERVICE_CHANGED=y
CONFIG_BT_RAS_MAX_ANTENNA_PATHS=2
CONFIG_BT_CTLR_SDC_CS_MAX_ANTENNA_PATHS=2
---
Questions:
1. Is nCS v3.1.0 channel_sounding_ras_reflector validated against Android 17? The android_ranging.conf header explicitly states "settings
required to run CS Ranging with Android 16 phones" — is there a known gap with Android 17?
2. After CS security enable completes on the reflector side, what is expected to trigger LE CS Procedure Enable from Android? Is there a
GATT operation (e.g., CCCD subscription to RAS characteristics) that must succeed first before Android sends the procedure enable?
3. Is there an additional Kconfig or code change needed for Android 17 support?
4. Is this a known issue with a fix in an upcoming nCS release?
