Service Discovery Failed using pc-ble-driver

[mmercier]

I am using an nRF52840 Dongle to try and connect to a product over Bluetooth and communicate with it. I have been able to open this dongle using nRF Connect Bluetooth Low Energy, and can successfully find my product, connect to it, and write to its characteristics. I am now needing to use a C program to do this same thing.

I have downloaded the pc-ble-driver, created a project in my C IDE, and copied the code from the heart rate collector example to be the project's source file. I got the project to build without issue, and following the instructions in the examples github page, have flashed the dongle with the correct firmware to allow the c program to connect to it. I am able to successfully connect to the dongle's COM port and scan for devices.

I did have to make some modifications to the source file. My product I want to connect to doesn't advertise its name, so I was unable to connect to it even when finding it. This product does, however, advertise the Manufacturer Specific Data field, and after some trial and error, I was able to modify the find_adv_name routine to instead check for Manufacturer Specific Data, and I was able to connect to the device this way.

After this, I get output strings that read: "Connection Established", "Discovering Primary Services", and "Received Service Discovery Response". However, I then get an error message saying "Service Discovery Failed. Error Code 0x10A". Stepping through the code, this error is getting set after the "on_connected" routine is finished, but before starting the on_service_discovery_response routine.

I have changed the value of BLE_UUID_HEART_RATE_SERVICE to match the UUID of my product's service, but there was no effect. I had also been told in the past to try changing the srvc_uuid.type from BLE_UUID_TYPE_BLE to BLE_UUID_TYPE_VENDOR_BEGIN, but when doing this, I get a failure returned from the function "sd_ble_gattc_primary_services_discover", with the error code 0x8005, which seemingly corresponds to NRF_ERROR_SD_RPC_NO_RESPONSE. 

Could anyone give me any pointers for where to look for what all to change in the source code in order to connect to my product rather than whatever heart rate monitor it is expecting? Thanks!

[mmercier]

Ok, so I think I may have been getting the 0x8005 error due to stopping the program with a breakpoint, and the BLE device losing connectivity when stepping through slowly. I moved the breakpoint to right at the printing of the error message, and now my error code is consistently 0x7, which (according to nrf_error.h) should be an invalid parameter error.

Considering this does not result in an error when I have srvc_uuid.type set to BLE_UUID_TYPE_BLE, I am assuming the invalid parameter is my srvc_uuid struct. I have been trying to figure out how exactly to set the "uuid" parameter of this struct properly. According to the struct definition, it should be either the 16bit uuid, or "octets 12-13" of the 128bit uuid. Considering I'm using BLE_UUID_TYPE_VENDOR_BEGIN, I'm guessing it will need to be the 2nd option.

How do I determine what "octets 12-13" are though? Is this a little endian value? Big endian? Does it begin at octet 0, or 1? My full 128bit uuid is 17C30001EB0747848BF33212453B0D32. Thanks!

[Edvin]

mmercier said:

Is this a little endian value? Big endian?

It is probably reversed, but I see it listed a bit different in different places. Let us say that the long UUID is "17C30001-EB07-4784-8BF3-3212453B0D32", then the UUID would be something like:

"0100C317-07EB-8447-F38B-320D3B451232" in the source code.

What you should do is to look at the examples. If you have an 128-bit UUID, you should look at the examples that use a 128-bit UUID, such as the ble_app_uart example. Try to flash it, and compare the UUID you get in nRF Connect to the one that is listed in ble_nus.c on line 64 in the SDK16.0.0:

#define NUS_BASE_UUID                  {{0x9E, 0xCA, 0xDC, 0x24, 0x0E, 0xE5, 0xA9, 0xE0, 0x93, 0xF3, 0xA3, 0xB5, 0x00, 0x00, 0x40, 0x6E}} /**< Used vendor specific UUID. */

When I connect to it in nRF Connect, it says:

(you have to hover the mouse over the service to see the UUID when it is one of the standards in nRF Connect)

So it translates to:

6E400001B5A3F393E0A9E50E24DCCA9E

While the raw UUID from ble_nus.c:

9ECADC240EE5A9E093F3A3B50000406E

Or:

6E400001-B5A3-F393-E0A9-E50E24DCCA9E

9ECADC24-0EE5-A9E0-93F3-A3B50000406E

So it is basically reversed, but notice that one of the 0000 are replaced with 0001, which is the service UUID. You will note that the characteristic UUIDs are identical, but the 0001 are switched to 0002 and 0003 for each of the characteristics.

BR,

Edvin

[Edvin]

I do not mean that you should use the SDK's example in the end, but that this example shows you how to try to discover a 128bit UUID. I guess if you ask 4 different people how to develop your application, you will get 4 different answers. What I wanted you to check in the central ble_app_uart_c example was what octets that are being used in the service discovery. This has nothing to do with your scanning or find_adv_name() function. Do you know what service discovery is, in the first place?

The reason I started listing the UUID of the ble_app_uart peripheral is because it is a 128bit UUID. 

 

mmercier said:

I've also changed the value of BLE_UUID_HEART_RATE_SERVICE to 0x0100, to match with octets 12-13 of my service UUID.

 Can you try to set it to 0x0001 as well? This is why I tried to point you to the ble_app_uart example, to show a bit of how the UUID is represented in different applications. I am sorry if it was confusing.

If that doesn't work, what happens if you set the uuid.type to 0x00 in start_discovery()? Do you get a on_service_discovery_response() callback in that case? If so, what does the log say from this part?

[mmercier]

Changing the 16-bit UUID to 0x0001 worked! I can now move past the service discovery response. So it seems that the 128-bit UUID needs to be defined in little endian format, but the 16-bit service UUID section must be big endian.

I am now able to move past into the characteristic discovery. This has given me a lot more to experiment with. I just have a few questions that I am curious about.

1: I am able to discover a characteristic from my service and read back its UUID. The program also responds with the handle value of the characteristic (it is 0xF, one up from the service handle of 0xE). However, I noticed that, when connecting to the peripheral in nRF Connect, the handle assigned to the characteristic is not 0xF, but 0x10 (service handle is still 0xE, I couldn't find where 0xF was). I just wanted to ask if these handles need to match, or if they are just assigned sequentially and it doesn't particularly matter the exact value.

2: My peripheral's service has 3 characteristics, but the call to "sd_ble_gattc_characteristics_discover" is only returning a value of 1 for the count of characteristics found (only the first, with the 0xF handle, is being found). I experimented by changing the value of handle_range.start_handle to be equal to the service handle + 2 (so that it would skip the first characteristic), and it still returned a count value of 1, but this time, it was the service's second characteristic that had been found (since I made it skip the first). So it seems like something is causing the function to only consider the first characteristic it finds. This seems to make sense, due to the expected HRM only having the one characteristic, but I couldn't find anywhere that specifically told the function to only look for up to 1 characteristic. Is there some setting I can modify to have this function discover all three?

Thanks for the suggestions!

[mmercier]

One more thing I noticed about the handles, when I discover the characteristic with handle 0xF, and the event handler moves into the descriptor discovery, the returned value of the CCCD handle is also 0xF. On the other hand, in nRF Connect, the characteristic's handle is 0x10, and the CCCD handle is 0x11. It seems strange to me that the program would read the same handle for the characteristic and its CCCD. Is this normal? Thanks.

[Edvin]

mmercier said:

Changing the 16-bit UUID to 0x0001 worked!

 Great! That is good to hear. This is why I wanted you to check the ble_nus_c example, because I wanted you to compare the UUID with the part of the UUID that the central looked for in the service discovery.

 

mmercier said:

I just wanted to ask if these handles need to match, or if they are just assigned sequentially and it doesn't particularly matter the exact value.

 They do not need to match exactly, no. They are just used internally in your application, and are assigned during runtime. 

 

mmercier said:

My peripheral's service has 3 characteristics, but the call to "sd_ble_gattc_characteristics_discover" is only returning a value of 1 for the count of characteristics found

 Can you try to set the uuid.type to 0x00 in start_discovery()? What does things look like in the on_service_discovery_response() then?

[mmercier]

Changing the uuid.type to 0x00 had no change to the behavior with it defined as BLU_UUID_TYPE_VENDOR_BEGIN. So, I am still discovering the service properly, and I'm able to get a characteristic and its descriptor.

By looking through other cases here on the help website, I found suggestions that users simply call the "sd_ble_gattc_characteristics_discover" routine multiple times in order to discover more than one characteristic, just increasing the lower boundary of the handle range each time. I thought this was strange, since the params.char_disc_rsp object has a count parameter, it seems like it should be able to return multiple characteristics. Either way, by using multiple calls, I've been able to assign all 3 characteristics to different handles. For now, though, since I am still trying to figure out the read/write commands, I'm only assigning one characteristic at a time.

So, my next concern is with the write command. Currently, I have my code begin the "sd_ble_gattc_characteristics_discover" routine using an increased lower handle, so that the characteristic it returns has a UUID that matches my peripheral's "write" characteristic. I am wanting to know what code to use to write from this characteristic, mimicking the behavior of the nRF Connect program, where I can type data into the characteristic's string field and click the "write" button.

I've started by looking at the HRM code in the pc-ble-driver example. I've added a function based on this example, here's what it looks like so far:

static uint32_t writeble()
{
    uint32_t error_code;
	uint8_t enc_data[13];
	uint16_t data_len;
	ble_gatts_hvx_params_t hvx_params;
	
	data_len = (uint16_t)13;
	
	enc_data[0] = 0x01;
	enc_data[1] = 0x00;
	enc_data[2] = 0xFF;
	enc_data[3] = 0x20;
	enc_data[4] = 0x08;
	enc_data[5] = 0x01;
	enc_data[6] = 0x02;
	enc_data[7] = 0x03;
	enc_data[8] = 0x04;
	enc_data[9] = 0x05;
	enc_data[0] = 0x06;
	enc_data[11] = 0x07;
	enc_data[12] = 0x08;
	
	hvx_params.handle = m_hrm_char_handle2;
	hvx_params.type = BLE_GATT_HVX_NOTIFICATION;
	hvx_params.offset = 0;
	hvx_params.p_len = &data_len;
	hvx_params.p_data = enc_data;
	
	error_code = sd_ble_gatts_hvx(m_adapter, m_connection_handle, &hvx_params);
	
	if(error_code != NRF_SUCCESS){
		printf("Failed to send. Error code 0x%02X\n", error_code);
		fflush(stdout);
		return error_code;
	}
	return NRF_SUCCESS;
}

This is based on the HRM example. The data is a 13-byte packet, it is the same data that I type into the characteristic's field in the nRF Connect program. The value "m_hrm_char_handle_2" is the handle that this characteristic is being assigned to by "sd_ble_gattc_characteristics_discover".

I've modified the main loop of the example, which waits for a character input into the terminal, then calls the HRC notification toggle. I've commented out this function call, and replaced it with a call to this new function. So after the peripheral is connected, and the service, characteristic, and descriptor are all discovered, pressing a key will call this function.

As it is now, doing so gives me an error code of 0x05, which seems to correspond to NRF_ERROR_NOT_FOUND. So something is not being set up correctly. Is there any other code I need to add to ensure that I can carry out this write command? Or am I going about this the wrong way? For reference, this characteristic only has the "WriteWithoutResponse" property enabled. So if this is doing something other than a write (without response) type of command, maybe that's where the error is from. But since this is the only "write" type command I could find in the examples, I'm not sure where to go from here.

Please let me know if you've got any pointers for me, thanks!

[mmercier]

Okay, so I did some digging and I found a function that I think is right for what I need. It is called "sd_ble_gattc_write". I modified my new "writeble" routine like this:

static uint32_t writeble()
{
    uint32_t error_code;
	uint8_t enc_data[13];
	ble_gattc_write_params_t write_params;
	
	enc_data[0] = 0x01;
	enc_data[1] = 0x00;
	enc_data[2] = 0xFF;
	enc_data[3] = 0x20;
	enc_data[4] = 0x08;
	enc_data[5] = 0x01;
	enc_data[6] = 0x02;
	enc_data[7] = 0x03;
	enc_data[8] = 0x04;
	enc_data[9] = 0x05;
	enc_data[0] = 0x06;
	enc_data[11] = 0x07;
	enc_data[12] = 0x08;
	
	write_params.write_op = BLE_GATT_OP_WRITE_CMD;
	write_params.flags = BLE_GATT_EXEC_WRITE_FLAG_PREPARED_WRITE;
	write_params.handle = m_hrm_char_handle2;
	write_params.offset = 0;
	write_params.len = 0xD;
	write_params.p_value = enc_data;
	
	error_code = sd_ble_gattc_write(m_adapter, m_connection_handle, &write_params);
	
	if(error_code != NRF_SUCCESS){
		printf("Failed to send. Error code 0x%02X\n", error_code);
		fflush(stdout);
		return error_code;
	}
	return NRF_SUCCESS;
}

Now, I don't get any error when I run this code, and the event handler enters the case for BLE_GATTC_EVT_WRITE_CMD_TX_COMPLETE, which should mean that the Write Without Response command completed successfully.

However, I am not seeing the proper response from my peripheral. For reference, I am monitoring a parallel bus on my peripheral, and when this characteristic is written to (using the specified 13-byte packet layout), I will see a response. If I use nRF Connect, I can type these 13 bytes into the characteristic, click "write", and I will see the response on the bus I'm monitoring. However, when using this write command in the program, nothing appears on the bus.

I know the peripheral is behaving properly, since it works in nRF Connect, and it seems that the write command is executing correctly, so there must just be something configured differently in how the program is setting up the command vs how the nRF Connect is setting up the command. I have already tried reversing the byte order in the enc_data array, to no avail. As with the previous code I posted, the handle used here is the one that was assigned to my "write" characteristic (the UUID is matched correctly). I am only discovering this one characteristic for right now, so as to simplify the process. This characteristic does not have any descriptors defined, so I am not calling the "descr_discovery_start" function for now.

[Edvin]

A Shot in the dark:

You set enc_data[0] twice, and you do not set enc_data[10]. Just in case you are not checking for the event, but only a specific packet. Since you mention that you tried to reverse the packet here as well. The content of the payload shouldn't really matter for the BLE stack. 

Do you check whether or not the callback event is triggered on the peripheral?

[mmercier]

I did end up fixing that, it didn't have an effect.

I'm not sure what you mean about the callback event, I don't have access to the code that is running on the peripheral. I am just connecting to it and monitoring its parallel bus.

I did some experimenting, and I tried setting the write_params.handle value to m_hrm_char_handle1 instead of m_hrm_char_handle2. This is a variable I intend to use for one of the other characteristics, but for now, I'm only discovering the "write" characteristic, which is being stored in m_hrm_char_handle2.

So basically, I tried calling the same command with a non-assigned, zero-value handle as the write_params.handle value, and I got the same response. As in, there was no error code, and the event handler went into the state for BLE_GATTC_EVT_WRITE_CMD_TX_COMPLETE. I was surprised to not see some error. This makes me wonder if my command is actually doing anything with the actual handle being used. For what it's worth, I did pause the code to check and ensure my m_hrm_char_handle2 value is set to the characteristic's handle that was discovered, and that the discovered characteristic's UUID is the "write" characteristic I'm wanting to use.

[mmercier]

I think there may be an issue...

I changed my discovery routines to search instead for the first characteristic, which is notify only. I discovered it correctly, and then had my function write to its handle, and I got no error messages, and the handler went into the BLE_GATTC_EVT_WRITE_CMD_TX_COMPLETE state. This characteristic does not have write privileges, it is notify only, so I think I should see some failure somewhere. So something is not writing correctly.

[mmercier]

I finally figured it out!

So when I had searched for descriptors after getting my characteristics, I was getting a couple of different values, some with UUIDs that were different from what I expected to see, based on the values in nRF Connect. For each characteristic, one of the descriptors I could receive would have the same UUID as the characteristic, but with a different handle.

Turns out, I needed to pass THIS handle to the write_params, not the handle of the characteristic. Now, my write command is working, and I can see the data on the peripheral's bus!

I also verified my other questions for myself, I was able to figure out how to toggle notifications, and get back the notification data read on a characteristic.

I think I've finally got everything I need for this project! Thanks for the help!