Any kind of wireless communication,the first step to understand the underlying mechanism is to understand physical layer frame structure and the modulation scheme. I will do the same approach for bluetooth as well.

This page covers the classic BR/EDR radio. It moves from frequency, to time, to the signal itself: first the hopping over the band, then the packet inside a slot, and finally the three modulations that carry the bits.

• Frequency Hopping in Real Communication
• Frame Structure
• Modulation
• Reference

Frequency Hopping in Real Communication

Bluetooth physical data occupies 1 Mhz RF bandwidth, but realy frequency range required for bluetooth communication is over 80 Mhz. This matters for anyone who has to measure the signal, because an instrument tuned to one 1 MHz channel sees only a small part of the traffic.

Why ?

It is because the sender and reciever changes its communication channel (frequency) for every frame within the range of around 80 Mhz. This way of changing frequency for each transmission is called "frequency hopping".

Overall frequency allocation of each channel is as follows.

Figure 1. BR/EDR channel plan. 79 channels of 1 MHz fill the ISM band, with a guard band at each edge.

• Channel numbers 0 to 78 : channel k is at 2402 + k MHz, so channel 0 is at 2402 Mhz and channel 78 is at 2480 Mhz.
• Guard bands : 2 MHz at the lower edge and 3.5 MHz at the upper edge. With the 79 MHz of channels, the total is 2 + 79 + 3.5 = 83.5 MHz.
• Band edges : the ISM band runs from 2400 Mhz to 2483,5 Mhz, as the labels at the top show.

To give you some realistic view of how the frequency hopping goes, I captured the real bluetooth communication signal with signal analyzer. (It is hard to capture this kind of picture with normal analog spectrum analyzer, you have to use vector spectrum analyzer. But even with vector spectrum analyzer, it would not be easy to get the equipment to capture the full hopping range. You would need vector spectrum analyzer with at least 80 Mhz bandwidth)

In the capture below, the lower part is a spectrogram of 500 ms over 79 Mhz, with the spectrum trace on its left. The upper part zooms into 10 ms of the same signal, and the arrows follow the packets from one frequency to the next.

Figure 2. A real Bluetooth link hopping over the band. In any short window the packets land on scattered frequencies, and over a long window they cover the whole 79 MHz.

• 10 ms window : at the maximum rate of 1600 hops per second, 10 ms holds up to 10 / 0.625 = 16 hops. The zoom shows a number of hops of that order.
• 500 ms spectrogram : the diagonal streaks are packets on many channels, and the spectrum on the left shows energy across the band rather than on one channel.
• Gaps : some channels stay dark in parts of the capture. A link may leave channels unused, for example with Adaptive Frequency Hopping, where each link still has to use at least 20 channels.

The hop timing follows the slot. The basic piconet channel is divided into slots of 625 microseconds, and 1600 hops per second is exactly one hop per slot. A packet that occupies 3 or 5 slots stays on one frequency for its whole length, so long packets hop less often. The next section shows what a packet inside those slots looks like.

• 1 MHz per packet, 79 MHz per link : each packet is narrow, but the link uses the whole band over time.
• Measure with a wide capture : a vector signal analyzer needs about 80 MHz of bandwidth to see every hop.
• One hop per slot at most : 625 microseconds x 1600 = 1 second.

Frame Structure

Now let's look into the basic transmission unit in time domain (Slot or Frame structure). A Bluetooth slot is made up of three major components (Access Code, Header and Payload) as shown below. The fundamental length of the packet is 366 us and depending on the length of Payload, it can extend to 1.622 ms or 2.87 ms.

Access Code and Header is modulated always in GFSK and Payload part is modulated in one of three different methods (GFSK, 1/4pi DQPSK, 8DPSK) depending on packet type.

Following is the frame structure for the most conventional bluetooth slot structure. Maximum data rate you can achieve with this structure is 1 Mbps and this stuctures uses GFSK modulation scheme across the whole slot.

Figure 3. Basic Rate packet. The access code and header have a fixed size, and only the payload length changes with the packet type.

• Access Code, 72 bits : used for synchronization and to identify the physical channel. Inquiry and paging use access codes too.
• Header, 54 bits : 18 bits of link control information, repeated with a rate 1/3 FEC, so 18 x 3 = 54.
• Payload : the length depends on the packet type, as the table below works out.

The payload numbers in the picture need a careful reading. A DH1 packet carries a 1 byte payload header and up to 27 bytes of user data, and (1 + 27) x 8 = 224 bits, as drawn. Basic Rate has no DH2 packet, though. The 1480 bits labelled DH2 are the DH3 value, (2 + 183) x 8 = 1480. For DH5 the same count gives (2 + 339) x 8 = 2728 bits, so the 1278 bits labelled DH3 do not match any DH packet. The table below adds the 16 bit CRC, and the resulting packet lengths match the 366 microseconds, 1.622 ms and 2.87 ms above. At 1 bit per microsecond, the number of bits equals the duration in microseconds.

The last column shows why 1 Mbps is only the gross rate. A DH5 packet fills at most 2870 of the 3125 microseconds of its five slots. Then the reverse direction needs at least one slot. So one DH5 packet carries 339 x 8 bits every 6 x 625 microseconds, which is 723.2 kb/s. The remaining time goes to the access code, the header, the CRC, the turnaround gap and the return slot.

Following is the frame structure for high data rate bluetooth slot structure. With this stucture, you can achieve max 2 Mbps or 3 Mbps depending on the modulation scheme of payload. The Access Code and Header part is still using GFSK modulation scheme and the payload part is using 1/4pi DQPSK for 2 Mbps data rate and 8 DPSK for 3 Mbps. You would see two additional portions in this structure comparing to previous one.

First additional component is 'Guardtime'. In this structure, Access Code and Header part is using GFSK but Payload part is using DQPSK/8DPSK. It means that modulation scheme changes within a slot. This guardtime is for giving the transmitter some time to switch the modulation scheme.

Another additional component is 'Sync' portion. In any I/Q based modulation, sampling timing is very imporant. 'Sync' is the portion of reference signal so that the reciever can get proper timing reference.

Figure 4. Enhanced Data Rate packet. The start of the packet is identical to Basic Rate, and the modulation changes only after the guard time.

• Guard Time, 5 microseconds : the Core Specification allows 4.75 to 5.25 microseconds, from the last GFSK symbol of the header to the reference symbol of the sync.
• Sync, 11 microseconds : a reference symbol with arbitrary phase and ten DPSK symbols, with a fixed pattern of phase changes of +3pi/4 and -3pi/4.
• Payload : pi/4-DQPSK for 2 Mbps or 8DPSK for 3 Mbps, still at 1 M symbols per second.
• Trailer : two trailer symbols follow the payload. The picture does not draw them.

The same slot arithmetic applies to EDR. A 2-DH5 packet carries up to 679 bytes of user data, and a 3-DH5 packet up to 1021 bytes. With the 2 byte payload header, the 2 byte CRC, the guard, the sync and the trailer, a full 2-DH5 packet lasts about 2876 microseconds and a full 3-DH5 packet about 2877 microseconds. Both fit the 3125 microseconds of five slots, like the DH5 packet. So EDR triples the bits per packet without changing the slot timing.

• A slot is 625 microseconds, a packet is shorter : the packet lengths of 366 microseconds, 1.622 ms and 2.87 ms leave a gap for the radio to turn around and hop.
• The header is always GFSK : a Basic Rate device can read the access code and header of any packet, including EDR.
• User rates are below the gross rates : 723.2 kb/s for DH5, and 1448.5 and 2178.1 kb/s for 2-DH5 and 3-DH5 in the asymmetric case.

Modulation

As you read previous section about slot structure, you may noticed three different modulation schemes being used in bluetooth slot. I will give a snapshot of these three different modulation scheme in this section. I think just typical constellation for each case would be good enough for the big picture.

First one is for GFSK modulation and in I/Q coordinate you would see a lot of dots sitting around the perimetor of a circle.

Figure 5. GFSK in the I/Q plane. The information is in the frequency, so every point sits on the same circle.

• Left, trajectory : the signal moves along the circle and never leaves it, so the envelope is constant.
• Right, sampled points : the points spread around the circle, because the phase keeps rotating with the frequency deviation.
• Parameters : BT = 0.5 and a modulation index between 0.28 and 0.35. A binary one is a positive frequency deviation, and a binary zero is a negative one.

Following is a sample constellation for 1/4pi DQPSK. If you see the constellation on right right side, it looks exactly same as 8 PSK, but if you display the trajectory of the dots you would notice, none of the path goes through (0,0) points. This is good for amplifier effieciency and battery consumption as well. In normal QPSK case, the absolute coordinate of each dot carries the information, but in DQPSK the phase difference (angle difference) between two consecutive dots are carrying the information.

Figure 6. pi/4-DQPSK. The constellation shows eight points, but each symbol carries only 2 bits.

The table below lists the phase change for each pair of bits. It matches Table 3.3 of the Core Specification radio part. Every phase change is an odd multiple of pi/4, so the signal alternates between two sets of four points. That is why the right plot shows eight points. The phase change is never pi, so the trajectory on the left never passes through the centre.

Following is a sample constellation for 8DPSK. If you see the constellation on right right side, it looks exactly same as 8 PSK and also same as 1/4 DQPSK, but if you display the trajectory of the dots you would notice different pattern from 1/4 DQPSK. But in this case, it would be almost impossible to find the difference between 8PSK and 8 DPSK just by looking at the constellation.

Figure 7. 8DPSK. The eight points look the same as pi/4-DQPSK, but each symbol now carries 3 bits.

The table below matches Table 3.4 of the Core Specification radio part. The mapping is Gray coded, so two neighbouring phase changes differ in one bit only. A phase change of pi is now allowed, for the bits 110. So some paths in the left plot cross the centre, and the trajectory looks denser than the pi/4-DQPSK one.

Both PSK modes use a square-root raised cosine pulse with a roll-off factor of 0.4 and a symbol period of 1 microsecond. So the EDR payload fits the same 1 MHz channel as GFSK. Being differential, both modes need no absolute phase reference. The receiver compares each symbol with the one before it, and the reference symbol at the start of the sync gives the first comparison point.

• GFSK has a constant envelope : it lets the power amplifier run efficiently. Every device supports it, and the access code and header always use it.
• pi/4-DQPSK avoids the origin : phase changes of odd multiples of pi/4 keep the envelope away from zero.
• 8DPSK adds one bit per symbol : it allows a phase change of pi, and it needs a cleaner signal as a result.

Reference

• Bluetooth Core Specification v6.2, Vol 2 Part A : BR/EDR Radio Specification - channel plan, GFSK parameters, pi/4-DQPSK and 8DPSK mapping
• Bluetooth Core Specification v6.2, Vol 2 Part B : Baseband Specification - slots, hop rate, packet formats and ACL packet table