nRF52840 random disconnection

[Dani]

Good morning,

We have a new equipment based on the nRF52840 and s140.

                Just now, a new problem has appeared and it is very strange, as it seems to be a ‘random’ error:

 

                We have already assembled tens of equipment, and most of them are perfectly working with any smartphone (using both your ‘nRF Connect’ application or our own application).

                But, we have a few smartphones that show a strange behavior: they are able to perfectly connect to some of our nRF52840-based equipment, and in a few ones, they are able to connect but they get disconnected after a few seconds. Same equipment is connecting to other smartphones without problems (without disconnecting).

                This is (step by step) what it is happening a few times:

• Equipment (nRF52840) is advertising.
• Smartphone stablish connection with equipment using pin number
• First time, the connection is perfectly working.
• If smartphone is disconnected and connected back again with same equipment (Already bonded), then connection is stablished but smartphone disconnects after 30”, approximately. Same behavior is happening with both nRF connect application and our own application. Looking at log in nRF application we see: ‘Connection terminated by peer (status 19)’or ‘GATT_CONN_TIMEOUT’

 

Why is it happening?

Which is the reason?

How can we solve this?

 

 Could you help us? (For your information, we have set MIN_CONN_INTERVAL to 7.5m and MAX_CONN_INTERVAL to 100ms)

Thank you

[Hung Bui]

Hi Daniel, 

I got the update from Brian Kim about your email discussion. I agree with Brian that the sniffer trace would play a very important role here to solve the issue. I have some comments: 

- Regarding the sniffer trace, I could see the communication because the link was encrypted. What you need to do is to either do Legacy pairing and use the sniffer to follow the initial bonding. Or use LESC but in debug mode. 

- Another option you can try is to turn off bonding and encryption requirement to see if the issue is related to bonding or not. If the issue remain, please capture a sniffer trace. 

- The disconnection happened at second 26th into the connection so it may not related to the 30seconds GAP/GATT timeout.

- Please try to do a chip erase on the defected board and test again.

- Please try to test using one of our example in the SDK, ble_app_proximity for example. 

[Dani]

Hi again,

I have programmed one equipment turning bonding off, and then it is imposssible to connect (please, look at the attached screenshot with nRF Connect).

In order to set it off, I set my variable 'BONDING_WITH_NO_CODE' to 1, and I have implement this in 'peer_manager_init' function:

static void peer_manager_init(void)
{
    ble_gap_sec_params_t sec_param;
    ret_code_t           err_code;

    err_code = pm_init();
    APP_ERROR_CHECK(err_code);

    memset(&sec_param, 0, sizeof(ble_gap_sec_params_t));

    // Security parameters to be used for all security procedures.
		if(BONDING_WITH_NO_CODE)
		{
			sec_param.bond         = 0;    
			sec_param.oob          = 0;
			sec_param.mitm         = 0; 
			sec_param.io_caps      = BLE_GAP_IO_CAPS_NONE;
			sec_param.kdist_own.enc  = 0;
			sec_param.kdist_own.id   = 0;
			sec_param.kdist_peer.enc = 0;
			sec_param.kdist_peer.id  = 0;
		}
		else
		{
			sec_param.bond           = SEC_PARAM_BOND;
			sec_param.oob            = SEC_PARAM_OOB;
			sec_param.mitm           = SEC_PARAM_MITM; //Static Key
			sec_param.io_caps        = SEC_PARAM_IO_CAPABILITIES;    
			sec_param.kdist_own.enc  = 1;
			sec_param.kdist_own.id   = 1;
			sec_param.kdist_peer.enc = 1;
			sec_param.kdist_peer.id  = 1;
		}
		
        
    sec_param.lesc           = SEC_PARAM_LESC;
    sec_param.keypress       = SEC_PARAM_KEYPRESS;    
    sec_param.min_key_size   = SEC_PARAM_MIN_KEY_SIZE;
    sec_param.max_key_size   = SEC_PARAM_MAX_KEY_SIZE;
    

    err_code = pm_sec_params_set(&sec_param);
    APP_ERROR_CHECK(err_code);

    err_code = pm_register(pm_evt_handler);
    APP_ERROR_CHECK(err_code);
}

Furthermore, in this case, in all services, I proceed in the following way:

if(BONDING_WITH_NO_CODE)
{
	BLE_GAP_CONN_SEC_MODE_SET_OPEN(&attr_md.read_perm);
	BLE_GAP_CONN_SEC_MODE_SET_OPEN(&attr_md.write_perm);			
}		
else
{
	BLE_GAP_CONN_SEC_MODE_SET_ENC_WITH_MITM(&attr_md.read_perm);
	BLE_GAP_CONN_SEC_MODE_SET_ENC_WITH_MITM(&attr_md.write_perm);
}

Hope to go ahead with the solution.

Best regards,

Dani.

[Dani]

Hi Hung,

Indeed, this was the problem. I have already updated it, and now interface is as expected.

Now I have done the following procedure, as you have described:

- Smartphone has been paired with my device

- I have disconnected the device from smartphone

- I have connected the device again. And being connected, in Wireshark, I have introduced the SC-LTK value: from that moment, only 'Empty PDU' messages appear, up to the moment the device disconnects (after around 30")

Please, find trace here attached

Dani.3755.Android_pairing_with_disconnection_bonded_LTK_23_05_22.pcapng

[Hung Bui]

Hi Dani, 

No it still couldn't decrypt the connection correctly. 
Please see here: 

When the sniffer says "encrypted packet decrypted incorrectly" that mean the key was missing or the key was wrong. 
Please make sure you reverse the order of the bytes as I showed in my screenshot. And make sure you click the arrow button . And all of this must be done before the re-connection taking place. 

Please look for the way to print the log out, you can either use UART or RTT logging if you don't have UART(doesn't require extra pin, just the debugger).

[Dani]

Hi Hung,

I think now I got it: but I have seen that when I click the arrow button, I do not see incoming information in the log window: please, look at the screenshot here attached, where a time gap without info is noticed. And the information is received after this gap is related to advertising, as device has disconnected.

Please, find also attached this trace

DaniAndroid_Disconnection_24_05_22.pcapng

[Hung Bui]

Hi again Daniel, 

It still can't decode the connection. Note that the empty packet is not encrypted. 

Please click the arrow button before starting the connection, basically the sniffer need to have the keys before the LL_START_ENC_REQ (0x05) packet. And the key need to be correct key (reversed byte order). 

[Dani]

Hi Hung,

I've tried many times, and no good results.

Look at the attached screenshot: it shows debug values (LTK is seen) and Wireshark tool (LTK is introduced).

I have proceeded in the way you have told me:

- Device already bonded to my smartphone

- I disconnect device from smartphone

- I set Wireshark to save trace, introduce LTK and push the right arrow

- I connect device to smartphone

But not expected results are seen: "bad MIC" is also shown. I have also tried with LTK upside down, but same result...

Maybe we can talk and meet using remote connection with my computer? Any other idea?

Dani

[Hung Bui]

Hi Daniel, 

I tested again here and facing the same problem as you. I couldn't decrypt the connection even with the LTK. It's really strange that just a few days ago it worked for me. 

I'm checking with the team if I'm missing something. 
In the mean time I would suggest to try testing with the nRF Connect app on the phone, make sure it's only re-bonding happens and no other activity just to check if the disconnection still happen. 

Also please try to print out in the log any BLE event when you connect.

Do you store any information in flash ? If you do I would suggest to skip them, just in case they cause issue with the bond information. 

One approach to debug is to step by step removing the functionalities of the application. Until it's get very similar to one of our example in the SDK.  I assume that when you test with the example in the SDK with LESC you didn't have the issue ? Have you tried with the ble_app_gls example ? 

[Dani]

Hi Hung,

I have already checked with nRF Connect: as I told you at the beginning, the same is happening --> I get '‘Connection terminated by peer (status 19)’' after about 30". I have proceed as follows: having the device bonded, I go to bonded tab, and I select my device to connect again. I have even tried to reset the device, but once bonded, it is always happening same situation when reconnecting (only the first time -when introducing pin number- the device remains connected). Please, look at attached screenshot.

I store application information in flash (many time ago I managed it with your support in order to be sure it was correctly set: https://devzone.nordicsemi.com/f/nordic-q-a/56766/buttonless-dfu-with-bonding).

I have following setup:

- FDS_VIRTUAL_PAGES 6 (For bondings & garbage)

#define FLASH_ADR_FINAL_FLASH (u32) 0x000f2000 //Bootloader initial adress
#define FLASH_ADR_INI_PAGE_1 (u32)(FLASH_ADR_FINAL_FLASH-0x1000) //Page1(app)
#define FLASH_ADR_INI_PAGE_2 (u32)(FLASH_ADR_INI_PAGE_1-0x1000) //Page2(app)
#define FLASH_ADR_INI_PAGE_3 (u32)(FLASH_ADR_INI_PAGE_2-0x1000) //Page3(app)
#define FLASH_ADR_INI_PAGE_4 (u32)(FLASH_ADR_INI_PAGE_3-0x1000) //Page4(app=
#define FLASH_ADR_INICI_FLASH FLASH_ADR_INI_PAGE_4 //To use for NRF_FSTORAGE_DEF

NRF_FSTORAGE_DEF(nrf_fstorage_t fstorage) =
{
    /* Set a handler for fstorage events. */
    .evt_handler = fstorage_evt_handler,

    /* These below are the boundaries of the flash space assigned to this instance of fstorage.
     * You must set these manually, even at runtime, before nrf_fstorage_init() is called.
     * The function nrf5_flash_end_addr_get() can be used to retrieve the last address on the
     * last page of flash available to write data. */
    .start_addr = FLASH_ADR_INICI_FLASH,
    .end_addr   = FLASH_ADR_FINAL_FLASH,
};

Also note than in Bootloader I set :

NRF_DFU_APP_DATA_AREA_SIZE   40960 (10 pages: 6 VIRTUAL + 4 data)

I will try with other applications: But as I said, it is very strange, as with the same smartphone, some of my devices are correctly working. Some other, as described here, disconnect after 30".

Thank you again for your efficient and fast support: it is very important for us. But, do you think we could get with the solution soon? This equipment is in production, and similar problem is appearing in some customers!!

Dani.

[Hung Bui]

Hi Dani, 

It's hard to say how long it would take to get a solution. I think it's the best if we can narrow down the issue. 

You mentioned earlier that if you comment out the sd_ble_gap_disconnect() inside BLE_GATTC_EVT_TIMEOUT and BLE_GATTS_EVT_TIMEOUT you don't experience the disconnection. 

Please try to narrow down if it's BLE_GATTS_EVT_TIMEOUT  or BLE_GATTC_EVT_TIMEOUT event causing the issue ? The GATT timeout happens when a write/read request or indication doesn't get a reply form the peer. 

I think the approach to debug this is : 

- Make sure you can print out log from the nRF52 either by UART or by RTT 

- Try to strip down the functionality of the application until you don't see the error 

- If you test with legacy pairing just work the issue never happen ? It's pretty strange that the bonding process would be related to the GATT timeout.

- How many phones have you experienced the issue ?  Could you give the model number of the phones ? 

[Dani]

Hi Hung,

It's always BLE_GATTS_EVT_TIMEOUT the event that causes the issue --> In my application, we send a notification (we never send indication) once every 62.5ms. Which reply must it receive from the peer when sending notifications?? Which can be the reason to not receive that reply?

Furthermore, does it has sens to implement a counter in this event, and just disconnect when it is received a few times? In this case, which will be the most suitable event to implement the reset of this counter?

To print out log by RTT (I guess this is info to be observed using nRFConnect), I guess I should use NRF_LOG_DEBUG calls, right?

And yes, without bonding, the problem does not appear.

I'm working on it, trying to find out the solution. We will also test example applications.

In what regards phones experiencing this issue:

- Xiaomi Mi8

- Huawei 20 Pro

- Oppo A74

- Tablet Galaxy Tab A SM-T580

Dani

PD: The problem with the BLE_GATTS_EVT_TIMEOUT event seems to be related to anything set to the limit. Now, I'm debugging my application (Without having modified nothing) being connected to a Xiaomi Mi8, and now is working fine most of the times (no disconnections): still disconnects some of them. 

[Dani]

Hi Hung,

I have implemented an event counter to count BLE_GATTS_EVT_TIMEOUT, and now I'm not disconnecting the device when this event is given.

What I have observed:

- The event is received only once

- But after being received:

                  - If the application (smartphone) wants to write into a characteristic, it is not possible and then the device is disconnected (an other event is given, but I do not know still which one)

                  - The device is able to continue sending notifications to the smartphone without problems

Hope it helps a bit more

Dani