Service Discovery Failed using pc-ble-driver

[mmercier]

I am using an nRF52840 Dongle to try and connect to a product over Bluetooth and communicate with it. I have been able to open this dongle using nRF Connect Bluetooth Low Energy, and can successfully find my product, connect to it, and write to its characteristics. I am now needing to use a C program to do this same thing.

I have downloaded the pc-ble-driver, created a project in my C IDE, and copied the code from the heart rate collector example to be the project's source file. I got the project to build without issue, and following the instructions in the examples github page, have flashed the dongle with the correct firmware to allow the c program to connect to it. I am able to successfully connect to the dongle's COM port and scan for devices.

I did have to make some modifications to the source file. My product I want to connect to doesn't advertise its name, so I was unable to connect to it even when finding it. This product does, however, advertise the Manufacturer Specific Data field, and after some trial and error, I was able to modify the find_adv_name routine to instead check for Manufacturer Specific Data, and I was able to connect to the device this way.

After this, I get output strings that read: "Connection Established", "Discovering Primary Services", and "Received Service Discovery Response". However, I then get an error message saying "Service Discovery Failed. Error Code 0x10A". Stepping through the code, this error is getting set after the "on_connected" routine is finished, but before starting the on_service_discovery_response routine.

I have changed the value of BLE_UUID_HEART_RATE_SERVICE to match the UUID of my product's service, but there was no effect. I had also been told in the past to try changing the srvc_uuid.type from BLE_UUID_TYPE_BLE to BLE_UUID_TYPE_VENDOR_BEGIN, but when doing this, I get a failure returned from the function "sd_ble_gattc_primary_services_discover", with the error code 0x8005, which seemingly corresponds to NRF_ERROR_SD_RPC_NO_RESPONSE. 

Could anyone give me any pointers for where to look for what all to change in the source code in order to connect to my product rather than whatever heart rate monitor it is expecting? Thanks!

[mmercier]

As I'd mentioned, after adding the call to "sd_ble_uuid_vs_add", I do not get error messages in the "service_discovery_start" or "on_connected" functions. I do not get any errors until after the event handler finishes the pass in which it called this function. When the event handler enters its next pass, with the p_ble_evt->header.evt_id set to BLE_GATTC_EVT_PRIM_SRVC_DISC_RSP, this is when the value of p_ble_evt->evt.gattc_evt.gatt_status becomes 0x10A. This is the error I am trying to solve. Thanks.

[mmercier]

I have been looking at that example code you mention, and I don't think it will work in this project. It seems to be using an entirely different set of library functions than what I have. I am currently using the libraries/headers/dlls from the pc-ble-driver.

Is there some other set of libraries/headers/dlls that I could use in order to build a project using these other example files you sent? I want to know the simplest way to build a C program which will allow me to connect to my peripheral, and read/write to its characteristics through my dongle, which will be attached to the PC running the C program.

I keep getting conflicting information about how to go about making this program, and I want to ensure I am going down the right path for what I'm trying to accomplish.

[mmercier]

Okay, so I've gotten into contact with a Nordic rep to try and figure out what kind of software I should be using for the project I need. He has informed me that, in order to do what I need, I will need to use the pc-ble-driver, and modify the HRC example to search for my peripheral rather than the HRM it's set up to look for. So that UART example will not work. This is what I'd thought at first, but I wanted to make sure I wasn't just making things more difficult for myself.

So now that I know I'm on the right path, I need to figure out how to modify this code in order to search for my specific peripheral rather than the HRM it's normally expecting. So far, I have made 2 major modifications to the original HRC code. The first is in the "find_adv_name" routine, called in the "on_adv_report" routine. Here is the original version of this routine:

static bool find_adv_name(const ble_gap_evt_adv_report_t *p_adv_report, const char * name_to_find)
{
    uint32_t err_code;
    data_t   adv_data;
    data_t   dev_name;

    // Initialize advertisement report for parsing
#if NRF_SD_BLE_API >= 6
    adv_data.p_data     = (uint8_t *)p_adv_report->data.p_data;
    adv_data.data_len   = p_adv_report->data.len;
#else
    adv_data.p_data     = (uint8_t *)p_adv_report->data;
    adv_data.data_len   = p_adv_report->dlen;
#endif

    //search for advertising names
    err_code = adv_report_parse(BLE_GAP_AD_TYPE_COMPLETE_LOCAL_NAME,
                                &adv_data,
                                &dev_name);
    if (err_code == NRF_SUCCESS)
    {
        if (memcmp(name_to_find, dev_name.p_data, dev_name.data_len )== 0)
        {
            return true;
        }
    }
    else
    {
        // Look for the short local name if it was not found as complete
        err_code = adv_report_parse(BLE_GAP_AD_TYPE_SHORT_LOCAL_NAME,
                                    &adv_data,
                                    &dev_name);
        if (err_code != NRF_SUCCESS)
        {
            return false;
        }
        if (memcmp(name_to_find, dev_name.p_data, dev_name.data_len )== 0)
        {
            return true;
        }
    }
    return false;
}

And here is my modified code:

static bool find_adv_name(const ble_gap_evt_adv_report_t *p_adv_report, uint8_t name_to_find)
{
    uint32_t err_code;
    data_t   adv_data;
    data_t   dev_name;

    // Initialize advertisement report for parsing
//#if NRF_SD_BLE_API >= 6
    adv_data.p_data     = (uint8_t *)p_adv_report->data.p_data;
    adv_data.data_len   = p_adv_report->data.len;
//#else
    //adv_data.p_data     = (uint8_t *)p_adv_report->data;
    //adv_data.data_len   = p_adv_report->dlen;
//#endif
	
    //search for advertising names
    /*err_code = adv_report_parse(BLE_GAP_AD_TYPE_COMPLETE_LOCAL_NAME,
                                &adv_data,
                                &dev_name);*/
    err_code = adv_report_parse(BLE_GAP_AD_TYPE_MANUFACTURER_SPECIFIC_DATA,
                                &adv_data,
                                &dev_name);
	
    if (err_code == NRF_SUCCESS)
    {
        //if (memcmp(name_to_find, dev_name.p_data, dev_name.data_len )== 0)
        if (memcmp(&name_to_find, dev_name.p_data, 1 )== 0)
        {
            return true;
        }
    }
    else
    {
        // Look for the short local name if it was not found as complete
        err_code = adv_report_parse(BLE_GAP_AD_TYPE_SHORT_LOCAL_NAME,
                                    &adv_data,
                                    &dev_name);
        if (err_code != NRF_SUCCESS)
        {
            return false;
        }
        if (memcmp(name_to_find, dev_name.p_data, dev_name.data_len )== 0)
        {
            return true;
        }
    }
    return false;
}

As you can see, I've changed the final argument of this function to be a uint8_t rather than a const char*. This is because my peripheral does not advertise its Name data (which is a const char*), but it does advertise its Manufacturer Specific data, which is a uint8_t. The "on_adv_report" function calls "find_adv_name", and passes TARGET_DEV_NAME as its final argument. I've changed this #define statement from a string to the uint8_t value of the Manufacturer Specific Data I intend to find.

I am fairly confident that this change works, as the program seems to find and connect to my peripheral properly. The remainder of the "on_adv_report" function carries on without any error flags returned.

The other change I've made is what I'd described above, in the "service_discovery_start" routine, called by "on_connected". The full text is pasted above, but basically, I've changed the uuid type value from BLE_UUID_TYPE_BLE to BLE_UUID_TYPE_VENDOR_BEGIN, changed the value of the 16-bit UUID field to 0x0100 (octets 12-13 of my peripheral's service UUID), and defined a struct for a 128-bit UUID, populated it with the bytes of my peripheral's UUID, and passed it with a call to "sd_ble_uuid_vs_add".

Notably, before I had added this call to "sd_ble_uuid_vs_add", I was getting an error returned by the "sd_ble_gattc_primary_services_discover" call. After adding this 128-bit UUID, I no longer get an error here, and I am able to move on to the next event. This leads me to believe that the UUID is being passed properly.

Now, my issue is with the next pass through the event handler, which goes to the routine "on_service_discovery_response". The very first thing done in this routine is to check the value of the "gatt_service" parameter of the struct passed by the event handler (called p_ble_evt->evt.gattc_evt). This is resulting in an error, as the value is not 0x0, but 0x10A.

By stepping through the code following the completion of the "on_connected" routine, I discovered that this "gatt_service" value stays 0 until the end of that pass through the event handler. Then, on the next pass (when the "on_service_discovery_response" will be called), the value of "gatt_service" changes to 0x10A. This seems to correspond to the error message for BLE_GATT_STATUS_ATTERR_ATTRIBUTE_NOT_FOUND.

I need to know how to continue on from here. I am not getting any error messages in any of the fields that I've modified, so I do not know where this error could be coming from.

[Edvin]

I do not mean that you should use the SDK's example in the end, but that this example shows you how to try to discover a 128bit UUID. I guess if you ask 4 different people how to develop your application, you will get 4 different answers. What I wanted you to check in the central ble_app_uart_c example was what octets that are being used in the service discovery. This has nothing to do with your scanning or find_adv_name() function. Do you know what service discovery is, in the first place?

The reason I started listing the UUID of the ble_app_uart peripheral is because it is a 128bit UUID. 

 

mmercier said:

I've also changed the value of BLE_UUID_HEART_RATE_SERVICE to 0x0100, to match with octets 12-13 of my service UUID.

 Can you try to set it to 0x0001 as well? This is why I tried to point you to the ble_app_uart example, to show a bit of how the UUID is represented in different applications. I am sorry if it was confusing.

If that doesn't work, what happens if you set the uuid.type to 0x00 in start_discovery()? Do you get a on_service_discovery_response() callback in that case? If so, what does the log say from this part?

[mmercier]

Changing the 16-bit UUID to 0x0001 worked! I can now move past the service discovery response. So it seems that the 128-bit UUID needs to be defined in little endian format, but the 16-bit service UUID section must be big endian.

I am now able to move past into the characteristic discovery. This has given me a lot more to experiment with. I just have a few questions that I am curious about.

1: I am able to discover a characteristic from my service and read back its UUID. The program also responds with the handle value of the characteristic (it is 0xF, one up from the service handle of 0xE). However, I noticed that, when connecting to the peripheral in nRF Connect, the handle assigned to the characteristic is not 0xF, but 0x10 (service handle is still 0xE, I couldn't find where 0xF was). I just wanted to ask if these handles need to match, or if they are just assigned sequentially and it doesn't particularly matter the exact value.

2: My peripheral's service has 3 characteristics, but the call to "sd_ble_gattc_characteristics_discover" is only returning a value of 1 for the count of characteristics found (only the first, with the 0xF handle, is being found). I experimented by changing the value of handle_range.start_handle to be equal to the service handle + 2 (so that it would skip the first characteristic), and it still returned a count value of 1, but this time, it was the service's second characteristic that had been found (since I made it skip the first). So it seems like something is causing the function to only consider the first characteristic it finds. This seems to make sense, due to the expected HRM only having the one characteristic, but I couldn't find anywhere that specifically told the function to only look for up to 1 characteristic. Is there some setting I can modify to have this function discover all three?

Thanks for the suggestions!