nRF52805 eddystone beacon issue

[matt-lionembedded]

Hello,

I am looking for some help solving a peculiar issue with eddystone beacons, the nRF52805, and some cheaper Samsung android phones. 

System Description:

- I am using a custom board with a nRF52805 (not an OTS module).

- The control I am testing against is another custom board (previous product revision) using an OTS nRF52832 module.

- For both boards, we are using nRF5 SDK v17.0.2 and softdevice 7.2.0 (s112 for the *805 and s132 for the *832)

- I've modified the SDK v17.0.2 to support the nRF52805 using the instructions found in this support article (see "Patching nRF5 SDK v17.0.0 to support the nRF52805" section. The only SDK modifications I've made are the ones from that patch. 

- Our firmware project is based off of the eddystone example in sdk/examples/ble_app_eddystone. We arent adhering strictly to the eddystone full packet format, but are at least mantaining the 3 packets (UUID/URL/TLM) with the appropriate service data "headers" - i.e. the frame type. We have some other custom data in the service data, but are otherwise using the cyclic eddystone packet transmission format. 

- During "fast" eddystone advertising, we are advertising all 3 packets over a 450ms interval, with 150ms between packets.

- During "slow" eddystone advertising, we are advertising all 3 packets over a 2700ms interval, with 900ms between packets.

- We are not allowing connections, only outgoing advertising packets. 

Issue Description: 

- For nearly all android phones + using Nordic's nRFConnect app, we are able to see that the nrf52805 and nrf52832 devices are advertising (i.e. packets are detectable and parseable) 

- When using the nRF52 DK + wireshark, we are able to see that the nrf52805 and nrf52832 devices are advertising (i.e. packets are detectable and parseable) 

- For a small subset of cheaper Samsung phones (e.g. the A10S) using Nordic's nRFConnect App (and our custom application), we are not able to detect advertising only on the nrf52805 boards. That is, while the same Samsung A10S can detect the eddystone packets using identical firmware (Minus the difference in softdevice for *832 and *805) on the *832, it cannot detect advertising packets from the same on *805. 

I can't for the life of me figure out what is different between the two hardware versions. For almost all receiving hardware, the packets show up and appear to be functionally identical (except for whats in the service data for each packet after the frame type). I've attached two files showing a Wireshark log of one each UUID/URL/TLM frames (+ packet analysis), but I am unable to determine a difference between the two in any of the packet header/flags/etc.

Does anyone have an idea why some of these cheaper Samsung phones are essentially filtering out the advertising packets from the *805 but not the *832? I realize this is very hardware specific and not necessarily easily reproducible by others.

 

Fullscreen NRF52805 Eddystone Packets.txt Download

NRF52805: Eddystone Packets

----------
UUID FRAME
----------

0000   2a 38 00 02 dd 7d 06 0a 01 26 1d 00 00 2c 01 00   *8...}...&...,..
0010   00 d6 be 89 8e 42 25 4d 2b 7f b8 95 d7 02 01 06   .....B%M+.......
0020   03 03 aa fe 17 16 aa fe 00 f7 00 00 00 00 00 00   ................
0030   00 00 00 00 00 00 d7 95 b8 7f 2b 4d c5 5f 20      ..........+M._

Frame 22455: 63 bytes on wire (504 bits), 63 bytes captured (504 bits) on interface /var/folders/z6/_wz9dlqs0sjgtwn1j33w_xvc0000gn/T/wireshark_extcap_-dev-cu.usbmodem0006829620681DPL310, id 0
Nordic BLE Sniffer
    Board: 42
    Header Version: 2, Packet counter: 32221
        Length of payload: 56
        Protocol version: 2
        Packet counter: 32221
        Packet ID: 6
    Length of packet: 10
    Flags: 0x01
        .... ...1 = CRC: OK
        .... ..0. = Reserved: 0
        .... .0.. = Reserved: 0
        .... 0... = Reserved: 0
        .000 .... = PHY: LE 1M (0)
        0... .... = Reserved: 0
    Channel: 38
    RSSI: -29 dBm
    Event counter: 0
    Delta time (end to start): 300µs
    [Delta time (start to start): 676µs]
    [Packet time (start to end): 376µs]
Bluetooth Low Energy Link Layer
    Access Address: 0x8e89bed6
    Packet Header: 0x2542 (PDU Type: ADV_NONCONN_IND, TxAdd: Random)
        .... 0010 = PDU Type: 0x2 ADV_NONCONN_IND
        ...0 .... = Reserved: 0
        ..0. .... = Reserved: 0
        .1.. .... = Tx Address: Random
        0... .... = Reserved: 0
        Length: 37
    Advertising Address: d7:95:b8:7f:2b:4d (d7:95:b8:7f:2b:4d)
    Advertising Data
        Flags
            Length: 2
            Type: Flags (0x01)
            000. .... = Reserved: 0x0
            ...0 .... = Simultaneous LE and BR/EDR to Same Device Capable (Host): false (0x0)
            .... 0... = Simultaneous LE and BR/EDR to Same Device Capable (Controller): false (0x0)
            .... .1.. = BR/EDR Not Supported: true (0x1)
            .... ..1. = LE General Discoverable Mode: true (0x1)
            .... ...0 = LE Limited Discoverable Mode: false (0x0)
        16-bit Service Class UUIDs
            Length: 3
            Type: 16-bit Service Class UUIDs (0x03)
            UUID 16: Google (0xfeaa)
        Service Data - 16 bit UUID
            Length: 23
            Type: Service Data - 16 bit UUID (0x16)
            UUID 16: Google (0xfeaa)
            Service Data: 00f7000000000000000000000000d795b87f2b4d
    CRC: 0xa3fa04


---------
URL FRAME
---------

0000   2a 38 00 02 29 76 06 0a 01 25 1b 00 00 2e b2 0d   *8..)v...%......
0010   00 d6 be 89 8e 42 25 4d 2b 7f b8 95 d7 02 01 06   .....B%M+.......
0020   03 03 aa fe 17 16 aa fe 10 f7 00 16 00 06 8a 15   ................
0030   04 8f 31 00 00 00 00 00 00 00 00 00 92 e9 fb      ..1............

Frame 20483: 63 bytes on wire (504 bits), 63 bytes captured (504 bits) on interface /var/folders/z6/_wz9dlqs0sjgtwn1j33w_xvc0000gn/T/wireshark_extcap_-dev-cu.usbmodem0006829620681DPL310, id 0
Nordic BLE Sniffer
    Board: 42
    Header Version: 2, Packet counter: 30249
        Length of payload: 56
        Protocol version: 2
        Packet counter: 30249
        Packet ID: 6
    Length of packet: 10
    Flags: 0x01
        .... ...1 = CRC: OK
        .... ..0. = Reserved: 0
        .... .0.. = Reserved: 0
        .... 0... = Reserved: 0
        .000 .... = PHY: LE 1M (0)
        0... .... = Reserved: 0
    Channel: 37
    RSSI: -27 dBm
    Event counter: 0
    Delta time (end to start): 897582µs
    [Delta time (start to start): 897910µs]
    [Packet time (start to end): 376µs]
Bluetooth Low Energy Link Layer
    Access Address: 0x8e89bed6
    Packet Header: 0x2542 (PDU Type: ADV_NONCONN_IND, TxAdd: Random)
        .... 0010 = PDU Type: 0x2 ADV_NONCONN_IND
        ...0 .... = Reserved: 0
        ..0. .... = Reserved: 0
        .1.. .... = Tx Address: Random
        0... .... = Reserved: 0
        Length: 37
    Advertising Address: d7:95:b8:7f:2b:4d (d7:95:b8:7f:2b:4d)
    Advertising Data
        Flags
            Length: 2
            Type: Flags (0x01)
            000. .... = Reserved: 0x0
            ...0 .... = Simultaneous LE and BR/EDR to Same Device Capable (Host): false (0x0)
            .... 0... = Simultaneous LE and BR/EDR to Same Device Capable (Controller): false (0x0)
            .... .1.. = BR/EDR Not Supported: true (0x1)
            .... ..1. = LE General Discoverable Mode: true (0x1)
            .... ...0 = LE Limited Discoverable Mode: false (0x0)
        16-bit Service Class UUIDs
            Length: 3
            Type: 16-bit Service Class UUIDs (0x03)
            UUID 16: Google (0xfeaa)
        Service Data - 16 bit UUID
            Length: 23
            Type: Service Data - 16 bit UUID (0x16)
            UUID 16: Google (0xfeaa)
            Service Data: 10f7001600068a15048f31000000000000000000
    CRC: 0x4997df

---------
TLM FRAME
---------

0000   2a 32 00 02 a9 7c 06 0a 01 27 24 00 00 2c 01 00   *2...|...'$..,..
0010   00 d6 be 89 8e 42 1f 4d 2b 7f b8 95 d7 02 01 06   .....B.M+.......
0020   03 03 aa fe 11 16 aa fe 20 02 14 04 00 66 00 01   ........ ....f..
0030   35 b9 00 42 f6 29 20 c9 d8                        5..B.) ..

Frame 22147: 57 bytes on wire (456 bits), 57 bytes captured (456 bits) on interface /var/folders/z6/_wz9dlqs0sjgtwn1j33w_xvc0000gn/T/wireshark_extcap_-dev-cu.usbmodem0006829620681DPL310, id 0
Nordic BLE Sniffer
    Board: 42
    Header Version: 2, Packet counter: 31913
        Length of payload: 50
        Protocol version: 2
        Packet counter: 31913
        Packet ID: 6
    Length of packet: 10
    Flags: 0x01
        .... ...1 = CRC: OK
        .... ..0. = Reserved: 0
        .... .0.. = Reserved: 0
        .... 0... = Reserved: 0
        .000 .... = PHY: LE 1M (0)
        0... .... = Reserved: 0
    Channel: 39
    RSSI: -36 dBm
    Event counter: 0
    Delta time (end to start): 300µs
    [Delta time (start to start): 628µs]
    [Packet time (start to end): 328µs]
Bluetooth Low Energy Link Layer
    Access Address: 0x8e89bed6
    Packet Header: 0x1f42 (PDU Type: ADV_NONCONN_IND, TxAdd: Random)
        .... 0010 = PDU Type: 0x2 ADV_NONCONN_IND
        ...0 .... = Reserved: 0
        ..0. .... = Reserved: 0
        .1.. .... = Tx Address: Random
        0... .... = Reserved: 0
        Length: 31
    Advertising Address: d7:95:b8:7f:2b:4d (d7:95:b8:7f:2b:4d)
    Advertising Data
        Flags
            Length: 2
            Type: Flags (0x01)
            000. .... = Reserved: 0x0
            ...0 .... = Simultaneous LE and BR/EDR to Same Device Capable (Host): false (0x0)
            .... 0... = Simultaneous LE and BR/EDR to Same Device Capable (Controller): false (0x0)
            .... .1.. = BR/EDR Not Supported: true (0x1)
            .... ..1. = LE General Discoverable Mode: true (0x1)
            .... ...0 = LE Limited Discoverable Mode: false (0x0)
        16-bit Service Class UUIDs
            Length: 3
            Type: 16-bit Service Class UUIDs (0x03)
            UUID 16: Google (0xfeaa)
        Service Data - 16 bit UUID
            Length: 17
            Type: Service Data - 16 bit UUID (0x16)
            UUID 16: Google (0xfeaa)
            Service Data: 200214040066000135b90042f629
    CRC: 0x04931b

Fullscreen NRF52832 Eddystone Packets.txt Download

NRF52832: Eddystone Packets

----------
UUID FRAME
----------

0000   2a 38 00 02 af 7e 06 0a 01 26 2a 00 00 2c 01 00   *8...~...&*..,..
0010   00 d6 be 89 8e 42 25 57 80 26 b1 4c ed 02 01 06   .....B%W.&.L....
0020   03 03 aa fe 17 16 aa fe 00 f7 00 00 00 00 00 00   ................
0030   00 00 00 00 00 00 ed 4c b1 26 80 57 b5 3e 04      .......L.&.W.>.

Frame 22665: 63 bytes on wire (504 bits), 63 bytes captured (504 bits) on interface /var/folders/z6/_wz9dlqs0sjgtwn1j33w_xvc0000gn/T/wireshark_extcap_-dev-cu.usbmodem0006829620681DPL310, id 0
Nordic BLE Sniffer
    Board: 42
    Header Version: 2, Packet counter: 32431
        Length of payload: 56
        Protocol version: 2
        Packet counter: 32431
        Packet ID: 6
    Length of packet: 10
    Flags: 0x01
        .... ...1 = CRC: OK
        .... ..0. = Reserved: 0
        .... .0.. = Reserved: 0
        .... 0... = Reserved: 0
        .000 .... = PHY: LE 1M (0)
        0... .... = Reserved: 0
    Channel: 38
    RSSI: -42 dBm
    Event counter: 0
    Delta time (end to start): 300µs
    [Delta time (start to start): 676µs]
    [Packet time (start to end): 376µs]
Bluetooth Low Energy Link Layer
    Access Address: 0x8e89bed6
    Packet Header: 0x2542 (PDU Type: ADV_NONCONN_IND, TxAdd: Random)
        .... 0010 = PDU Type: 0x2 ADV_NONCONN_IND
        ...0 .... = Reserved: 0
        ..0. .... = Reserved: 0
        .1.. .... = Tx Address: Random
        0... .... = Reserved: 0
        Length: 37
    Advertising Address: ed:4c:b1:26:80:57 (ed:4c:b1:26:80:57)
    Advertising Data
        Flags
            Length: 2
            Type: Flags (0x01)
            000. .... = Reserved: 0x0
            ...0 .... = Simultaneous LE and BR/EDR to Same Device Capable (Host): false (0x0)
            .... 0... = Simultaneous LE and BR/EDR to Same Device Capable (Controller): false (0x0)
            .... .1.. = BR/EDR Not Supported: true (0x1)
            .... ..1. = LE General Discoverable Mode: true (0x1)
            .... ...0 = LE Limited Discoverable Mode: false (0x0)
        16-bit Service Class UUIDs
            Length: 3
            Type: 16-bit Service Class UUIDs (0x03)
            UUID 16: Google (0xfeaa)
        Service Data - 16 bit UUID
            Length: 23
            Type: Service Data - 16 bit UUID (0x16)
            UUID 16: Google (0xfeaa)
            Service Data: 00f7000000000000000000000000ed4cb1268057
    CRC: 0xad7c20


---------
URL FRAME
---------

0000   2a 38 00 02 09 78 06 0a 01 25 26 00 00 61 b4 0d   *8...x...%&..a..
0010   00 d6 be 89 8e 42 25 57 80 26 b1 4c ed 02 01 06   .....B%W.&.L....
0020   03 03 aa fe 17 16 aa fe 10 f7 00 03 00 00 bf 33   ...............3
0030   00 2f 86 00 0e 1d 00 00 00 00 00 00 b4 47 22      ./...........G"

Frame 20963: 63 bytes on wire (504 bits), 63 bytes captured (504 bits) on interface /var/folders/z6/_wz9dlqs0sjgtwn1j33w_xvc0000gn/T/wireshark_extcap_-dev-cu.usbmodem0006829620681DPL310, id 0
Nordic BLE Sniffer
    Board: 42
    Header Version: 2, Packet counter: 30729
        Length of payload: 56
        Protocol version: 2
        Packet counter: 30729
        Packet ID: 6
    Length of packet: 10
    Flags: 0x01
        .... ...1 = CRC: OK
        .... ..0. = Reserved: 0
        .... .0.. = Reserved: 0
        .... 0... = Reserved: 0
        .000 .... = PHY: LE 1M (0)
        0... .... = Reserved: 0
    Channel: 37
    RSSI: -38 dBm
    Event counter: 0
    Delta time (end to start): 898145µs
    [Delta time (start to start): 898473µs]
    [Packet time (start to end): 376µs]
Bluetooth Low Energy Link Layer
    Access Address: 0x8e89bed6
    Packet Header: 0x2542 (PDU Type: ADV_NONCONN_IND, TxAdd: Random)
        .... 0010 = PDU Type: 0x2 ADV_NONCONN_IND
        ...0 .... = Reserved: 0
        ..0. .... = Reserved: 0
        .1.. .... = Tx Address: Random
        0... .... = Reserved: 0
        Length: 37
    Advertising Address: ed:4c:b1:26:80:57 (ed:4c:b1:26:80:57)
    Advertising Data
        Flags
            Length: 2
            Type: Flags (0x01)
            000. .... = Reserved: 0x0
            ...0 .... = Simultaneous LE and BR/EDR to Same Device Capable (Host): false (0x0)
            .... 0... = Simultaneous LE and BR/EDR to Same Device Capable (Controller): false (0x0)
            .... .1.. = BR/EDR Not Supported: true (0x1)
            .... ..1. = LE General Discoverable Mode: true (0x1)
            .... ...0 = LE Limited Discoverable Mode: false (0x0)
        16-bit Service Class UUIDs
            Length: 3
            Type: 16-bit Service Class UUIDs (0x03)
            UUID 16: Google (0xfeaa)
        Service Data - 16 bit UUID
            Length: 23
            Type: Service Data - 16 bit UUID (0x16)
            UUID 16: Google (0xfeaa)
            Service Data: 10f700030000bf33002f86000e1d000000000000
    CRC: 0x2de244


---------
TLM FRAME
---------

0000   2a 32 00 02 25 7b 06 0a 01 26 2d 00 00 2c 01 00   *2..%{...&-..,..
0010   00 d6 be 89 8e 42 1f 57 80 26 b1 4c ed 02 01 06   .....B.W.&.L....
0020   03 03 aa fe 11 16 aa fe 20 02 10 04 00 15 00 01   ........ .......
0030   3b 7f 00 16 92 3d 88 e9 af                        ;....=...

Frame 21759: 57 bytes on wire (456 bits), 57 bytes captured (456 bits) on interface /var/folders/z6/_wz9dlqs0sjgtwn1j33w_xvc0000gn/T/wireshark_extcap_-dev-cu.usbmodem0006829620681DPL310, id 0
Nordic BLE Sniffer
    Board: 42
    Header Version: 2, Packet counter: 31525
        Length of payload: 50
        Protocol version: 2
        Packet counter: 31525
        Packet ID: 6
    Length of packet: 10
    Flags: 0x01
        .... ...1 = CRC: OK
        .... ..0. = Reserved: 0
        .... .0.. = Reserved: 0
        .... 0... = Reserved: 0
        .000 .... = PHY: LE 1M (0)
        0... .... = Reserved: 0
    Channel: 38
    RSSI: -45 dBm
    Event counter: 0
    Delta time (end to start): 300µs
    [Delta time (start to start): 628µs]
    [Packet time (start to end): 328µs]
Bluetooth Low Energy Link Layer
    Access Address: 0x8e89bed6
    Packet Header: 0x1f42 (PDU Type: ADV_NONCONN_IND, TxAdd: Random)
        .... 0010 = PDU Type: 0x2 ADV_NONCONN_IND
        ...0 .... = Reserved: 0
        ..0. .... = Reserved: 0
        .1.. .... = Tx Address: Random
        0... .... = Reserved: 0
        Length: 31
    Advertising Address: ed:4c:b1:26:80:57 (ed:4c:b1:26:80:57)
    Advertising Data
        Flags
            Length: 2
            Type: Flags (0x01)
            000. .... = Reserved: 0x0
            ...0 .... = Simultaneous LE and BR/EDR to Same Device Capable (Host): false (0x0)
            .... 0... = Simultaneous LE and BR/EDR to Same Device Capable (Controller): false (0x0)
            .... .1.. = BR/EDR Not Supported: true (0x1)
            .... ..1. = LE General Discoverable Mode: true (0x1)
            .... ...0 = LE Limited Discoverable Mode: false (0x0)
        16-bit Service Class UUIDs
            Length: 3
            Type: 16-bit Service Class UUIDs (0x03)
            UUID 16: Google (0xfeaa)
        Service Data - 16 bit UUID
            Length: 17
            Type: Service Data - 16 bit UUID (0x16)
            UUID 16: Google (0xfeaa)
            Service Data: 20021004001500013b7f0016923d
    CRC: 0x1197f5

 

[JONATHAN LL]

Hi,

What crystal and load capacitors are you using.
Can you share the schematic for the 805 HW you have and include the datasheet for the crystals? 

Regards,
Jonathan

[matt-lionembedded]

Hi Jonathan,

See below the 805 chip-down design schematic (proprietary content obfuscated).

805_chipdown_schematic_20210414.pdf

For X1 (32MHz crystal):

X1: 403C11E32M00000
C1/C2: Murata GRM1555C1H120JA01D

For X2 (32kHz crystal):

X2: FC-135 32.7680KA-A3
C9/C10: Murata GRM1555C1H120JA01D

Thank you for your help,

Matt

[JONATHAN LL]

Can you confirm what Load capaticant you have for X1 and X2 ?

This issue is most likely a offset caused by the crystal loading not being good enough. So one way to test this is to go up or down on the load capacitors and see of the devices(cheep phones) are able to see the 805 HW. You can test by going up first, try phones then if it doesn't work go down and se again. 

If you are able to measure the the frequency you can check if not you can send a device to us and we can test.
We do also have a blog on the 52 devices that has a section on Crystals and load capacitors. 

Regards,
Jonathan

[matt-lionembedded]

For X1: Load capacitance for the 403C11E32M00000 is 20pF
For X2: Load capacitance for the FC-135 32.7680KA-A3 is 12.5pF

In both cases, I can see in the reference design that the X1 CL recommendation is 8pF and for X2 CL recommendation is 9pF (w/ 12pF external caps for both).

Is your recommendation to test the load caps on X1, X2, or both? Is one more likely to cause BT related issues? I would think the 32 KHz (X2) would be the more likely culprit, but am unsure.

Furthermore, if i understand the link you posted about crystals and load caps correctly, give the following:

C1 = C2 = 2Cl - C_pcb - C_pin

Cl: Load capacitance of the crystal (found in the crystal datasheet)

C_pcb + C_pin is approximately 4 pF.

For X1, with a Cl of 20pF, C1 = C2 = 2*20 - 4 = 36pF. Does this mean C1/C2 should be closer to 36pF for the crystal we are using for X1?

For X2, with a Cl of 12.5pF, C9 = C10 = 2*12.5 - 4 = 21pF. Does this mean C9/C10 should be closer to 21pF for the crystal we are using for X2?

I will work with our hardware team to address some of these.

Thank you for all your help,

Matt

[JONATHAN LL]

Sorry for late reply,

X2 is fine, X1 is a bit high, we recommend 12pF as CL. Have you been able to test with those values, 21pF and 36pF?

matt-lionembedded said:

Is your recommendation to test the load caps on X1, X2, or both?

Both, The LF(X2) is used to time when to turn on and of the radio so using a X2 you will have better accuracy on the timing. The HF(X1) is used for the transmitting frequency so if this is off then it also effects the result, but it is the CW that is effects instead of transmitting at the intended frequency there will be a offset. So X1 is probably the culprit in this case. 

Regards,
Jonathan