Channel sounding android nRFtools, only works when frequency set to infrequent.

[MattLightwave]

HW: nRF54L15DK

Phone: Pixel 10Pro Android 17

When trying to use nRF tools to test channel sounding i am only able to get the infreqent mode to work, both normal and frequent give me "unknown error occured try reconnecting" when looking at the phone debug information it returns an incorrect parameter error but this should be set properly by the app. (full logs bellow)

2026-08-04 08:48:04.618 23935-23964 bluetooth com.google.android.bluetooth I system/gd/hci/distance_measurement_manager_impl.cc:1467 on_cs_set_procedure_parameters: cs set up succeed
2026-08-04 08:48:04.618 23935-23964 bluetooth com.google.android.bluetooth D system/gd/hci/distance_measurement_manager_impl.cc:1068 send_le_cs_procedure_enable: cmd 1
2026-08-04 08:48:04.657 23935-23964 bluetooth com.google.android.bluetooth D system/gd/hci/distance_measurement_manager_impl.cc:1537 on_cs_procedure_enable_complete: Procedure enabled, LeCsProcedureEnableComplete { status = INVALID_LMP_OR_LL_PARAMETERS(0x1e), connection_handle = 0x41, config_id = 0, state = DISABLED(0x00), tone_antenna_config_selection = 0x1, selected_tx_power = 0x7f, subevent_len = 0x5302, subevents_per_event = 0x1, subevent_interval = 0, event_interval = 0x1, procedure_interval = 0x7, procedure_count = 0x1, max_procedure_len = 0x14f }
2026-08-04 08:48:04.657 23935-23964 bluetooth com.google.android.bluetooth W system/gd/hci/distance_measurement_manager_impl.cc:1668 on_cs_procedure_enable_complete: Received DISABLED procedure with error code INVALID_LMP_OR_LL_PARAMETERS(0x1e)

On the firmware side i never get any error logs it just hangs at cs security enabled, i never see a print after that. 

*** Booting nRF Connect SDK v3.4.0-99553055607b ***
*** Using Zephyr OS v4.4.0-bf801e4e3d19 ***
I: Starting Channel Sounding Reflector Sample
I: 8 Sectors of 4096 bytes
I: alloc wra: 0, ee0
I: data wra: 0, 150
I: SoftDevice Controller build revision:
I: c8 da 30 98 f9 f0 34 a4 |..0...4.
I: 4b 6e ba d3 08 19 cc 0c |Kn......
I: ea 51 da 47 |.Q.G
I: HW Platform: Nordic Semiconductor (0x0002)
I: HW Variant: nRF54Lx (0x0005)
I: Firmware: Standard Bluetooth controller (0x00) Version 200.12506 Build 888207768
I: No ID address. App must call settings_load()
I: HCI transport: SDC
I: Identity: DB:A2:85:E9:EB:90 (random)
I: HCI: version 6.3 (0x11) revision 0x3039, manufacturer 0x0059
I: LMP: version 6.3 (0x11) subver 0x3039
I: Connected to B0:D5:FB:AF:D1:FF (public) (err 0x00)
I: CS capability exchange completed.
I: CS config creation complete.
- id: 0
- mode: 2 (PBR)
- min_main_mode_steps: 0
- max_main_mode_steps: 0
- main_mode_repetition: 0
- mode_0_steps: 3
- role: Reflector
- rtt_type: AA only
- cs_sync_phy: LE 1M PHY
- channel_map_repetition: 1
- channel_selection_type: Algorithm #3b
- ch3c_shape: Hat shape
- ch3c_jump: 3
- t_ip1_time_us: 30
- t_ip2_time_us: 20
- t_fcs_time_us: 80
- t_pm_time_us: 10
- channel_map: 0x15555555555554555554

I: CS security enabled.


FULL BLE LOGS

2026-08-04 08:48:04.603 23935-23959 bluetooth com.google.android.bluetooth I system/bta/ras/ras_client.cc:185 Connect: address xx:xx:xx:xx:eb:90, resolve xx:xx:xx:xx:eb:90
2026-08-04 08:48:04.603 23935-23959 bluetooth com.google.android.bluetooth I system/bta/ras/ras_client.cc:191 Connect: Already connected
2026-08-04 08:48:04.603 23935-23964 bluetooth com.google.android.bluetooth I system/gd/hci/distance_measurement_manager_impl.cc:414 start_distance_measurement: app_uid: 1000, Address:xx:xx:xx:xx:eb:90, method:2
2026-08-04 08:48:04.603 23935-23964 bluetooth com.google.android.bluetooth I system/gd/hci/distance_measurement_manager_impl.cc:513 init_cs_requester_tracker: Update interval to 200
2026-08-04 08:48:04.603 23935-23964 bluetooth com.google.android.bluetooth I system/gd/hci/distance_measurement_manager_impl.cc:539 start_distance_measurement_with_cs: connection_handle: 65, address: xx:xx:xx:xx:eb:90, is_hal_v2: true
2026-08-04 08:48:04.603 23935-23964 bluetooth com.google.android.bluetooth I system/gd/hci/distance_measurement_manager_impl.cc:1004 send_le_cs_set_procedure_parameters: num_antennas_supported:2, remote_num_antennas_supported:1, max_antenna_paths_supported:2,tone_antenna_config_selection:1, preferred_peer_antenna:1
2026-08-04 08:48:04.603 23935-23964 bluetooth com.google.android.bluetooth I system/gd/hci/distance_measurement_manager_impl.cc:1029 send_le_cs_set_procedure_parameters: min_procedure_interval:7, conn_interval:24
2026-08-04 08:48:04.603 23935-23964 bluetooth com.google.android.bluetooth I system/gd/hci/distance_measurement_manager_impl.cc:631 handle_ras_client_connected_event: address:xx:xx:xx:xx:eb:90, connection_handle 0x0041, att_handle 0x0017, size of vendor_specific_data 0, conn_interval 24
2026-08-04 08:48:04.603 23935-23964 bluetooth com.google.android.bluetooth D system/gd/hci/distance_measurement_manager_impl.cc:642 handle_ras_client_connected_event: Already connected
2026-08-04 08:48:04.618 23935-23964 bluetooth com.google.android.bluetooth I system/gd/hci/distance_measurement_manager_impl.cc:1467 on_cs_set_procedure_parameters: cs set up succeed
2026-08-04 08:48:04.618 23935-23964 bluetooth com.google.android.bluetooth D system/gd/hci/distance_measurement_manager_impl.cc:1068 send_le_cs_procedure_enable: cmd 1
2026-08-04 08:48:04.657 23935-23964 bluetooth com.google.android.bluetooth D system/gd/hci/distance_measurement_manager_impl.cc:1537 on_cs_procedure_enable_complete: Procedure enabled, LeCsProcedureEnableComplete { status = INVALID_LMP_OR_LL_PARAMETERS(0x1e), connection_handle = 0x41, config_id = 0, state = DISABLED(0x00), tone_antenna_config_selection = 0x1, selected_tx_power = 0x7f, subevent_len = 0x5302, subevents_per_event = 0x1, subevent_interval = 0, event_interval = 0x1, procedure_interval = 0x7, procedure_count = 0x1, max_procedure_len = 0x14f }
2026-08-04 08:48:04.657 23935-23964 bluetooth com.google.android.bluetooth W system/gd/hci/distance_measurement_manager_impl.cc:1668 on_cs_procedure_enable_complete: Received DISABLED procedure with error code INVALID_LMP_OR_LL_PARAMETERS(0x1e). Retry counter 0
2026-08-04 08:48:04.657 23935-23964 bluetooth com.google.android.bluetooth I system/gd/hci/distance_measurement_manager_impl.cc:1677 on_cs_procedure_enable_complete: schedule next procedure enable after 200 ms
2026-08-04 08:48:04.857 23935-23964 bluetooth com.google.android.bluetooth D system/gd/hci/distance_measurement_manager_impl.cc:1068 send_le_cs_procedure_enable: cmd 1
2026-08-04 08:48:04.926 23935-23964 bluetooth com.google.android.bluetooth D system/gd/hci/distance_measurement_manager_impl.cc:1537 on_cs_procedure_enable_complete: Procedure enabled, LeCsProcedureEnableComplete { status = INVALID_LMP_OR_LL_PARAMETERS(0x1e), connection_handle = 0x41, config_id = 0, state = DISABLED(0x00), tone_antenna_config_selection = 0x1, selected_tx_power = 0x7f, subevent_len = 0x5302, subevents_per_event = 0x1, subevent_interval = 0, event_interval = 0x1, procedure_interval = 0x7, procedure_count = 0x1, max_procedure_len = 0x14f }
2026-08-04 08:48:04.926 23935-23964 bluetooth com.google.android.bluetooth W system/gd/hci/distance_measurement_manager_impl.cc:1668 on_cs_procedure_enable_complete: Received DISABLED procedure with error code INVALID_LMP_OR_LL_PARAMETERS(0x1e). Retry counter 1
2026-08-04 08:48:04.926 23935-23964 bluetooth com.google.android.bluetooth I system/gd/hci/distance_measurement_manager_impl.cc:1677 on_cs_procedure_enable_complete: schedule next procedure enable after 200 ms
2026-08-04 08:48:05.126 23935-23964 bluetooth com.google.android.bluetooth D system/gd/hci/distance_measurement_manager_impl.cc:1068 send_le_cs_procedure_enable: cmd 1
2026-08-04 08:48:05.197 23935-23964 bluetooth com.google.android.bluetooth D system/gd/hci/distance_measurement_manager_impl.cc:1537 on_cs_procedure_enable_complete: Procedure enabled, LeCsProcedureEnableComplete { status = INVALID_LMP_OR_LL_PARAMETERS(0x1e), connection_handle = 0x41, config_id = 0, state = DISABLED(0x00), tone_antenna_config_selection = 0x1, selected_tx_power = 0x7f, subevent_len = 0x5302, subevents_per_event = 0x1, subevent_interval = 0, event_interval = 0x1, procedure_interval = 0x7, procedure_count = 0x1, max_procedure_len = 0x14f }
2026-08-04 08:48:05.197 23935-23964 bluetooth com.google.android.bluetooth W system/gd/hci/distance_measurement_manager_impl.cc:1668 on_cs_procedure_enable_complete: Received DISABLED procedure with error code INVALID_LMP_OR_LL_PARAMETERS(0x1e). Retry counter 2
2026-08-04 08:48:05.197 23935-23964 bluetooth com.google.android.bluetooth I system/gd/hci/distance_measurement_manager_impl.cc:1677 on_cs_procedure_enable_complete: schedule next procedure enable after 200 ms
2026-08-04 08:48:05.397 23935-23964 bluetooth com.google.android.bluetooth D system/gd/hci/distance_measurement_manager_impl.cc:1068 send_le_cs_procedure_enable: cmd 1
2026-08-04 08:48:05.467 23935-23964 bluetooth com.google.android.bluetooth D system/gd/hci/distance_measurement_manager_impl.cc:1537 on_cs_procedure_enable_complete: Procedure enabled, LeCsProcedureEnableComplete { status = INVALID_LMP_OR_LL_PARAMETERS(0x1e), connection_handle = 0x41, config_id = 0, state = DISABLED(0x00), tone_antenna_config_selection = 0x1, selected_tx_power = 0x7f, subevent_len = 0x5302, subevents_per_event = 0x1, subevent_interval = 0, event_interval = 0x1, procedure_interval = 0x7, procedure_count = 0x1, max_procedure_len = 0x14f }
2026-08-04 08:48:05.467 23935-23964 bluetooth com.google.android.bluetooth W system/gd/hci/distance_measurement_manager_impl.cc:1668 on_cs_procedure_enable_complete: Received DISABLED procedure with error code INVALID_LMP_OR_LL_PARAMETERS(0x1e). Retry counter 3

[Amanda Hsieh]

Hi Matthew, 

What is your nRF tools version number?

Regards,
Amanda H.

[MattLightwave]

Hi Amanda,

I am on version 4.4.0 which i believe is the latest.

Thank you,

Matthew

[Amanda Hsieh]

Hi, 

The current NCS v3.4.0 contains a validation check due to a SIG errata (on the Procedure_Interval field of the Initiator's (Pixel) CS_REQ). This was added in the 6.3 Core Spec release. It really is the Pixel that sends parameters that are just out of what the spec defines, resulting in the reflector rejecting the CS request.

Adding the check resulted in interoperability issues (as observed here), so it was recently reverted. We will add a backport for 3.4.1!

If you want to temporarily play around with nRF ras_reflector on nRF54L15DK and the nRF Toolbox on the Pixel 10, you can use NCS v3.3.1. Sorry for the inconvenience. 

-Amanda H.

[MattLightwave]

Thank you that worked