Two-Way Communication Protocol using BluetoothLow Energy Advertisement Frames

Giorgio CorbelliniDisney Research Zurich

Switzerlandgiorgio

@disneyresearch.com

Stefan SchmidDisney Research & ETH

Zurich, Switzerlandstefan.schmid

@disneyresearch.com

Stefan MangoldDisney Research Zurich

Switzerlandstefan.mangold

@disneyresearch.com

ABSTRACTBluetooth Low Energy (BLE) is a wireless personal areanetwork technology designed to provide low-power con-nectivity to smartphones and wearable devices. To trans-mit bidirectional data, devices must first discover eachother and then start a pairing process. Usually, the pair-ing process requires manual intervention that might re-sult in undesirable user experiences. If security and pri-vacy requirements allow, communication sessions couldbe limited to the advertisement channels only, withoutpairing the devices. Further, the use of only advertise-ment channels without pairing devices enables scenar-ios in which different radio systems can also join thecommunication. For example, the nRF24L01+ radiosystem can be programmed to communicate using theadvertisement channels defined by BLE. This is rele-vant because the nRF24L01+ radio system is a populartechnology for the Internet- of-Things and for location-based services with wearable devices in smart cities.This paper evaluates a two-way communication proto-col between the nRF24L01+ and BLE devices, usingonly advertisement frames. We show a practical proto-col implementation and use an experimental testbed toevaluate its performance. The evaluation shows that itis possible to build a simple and reliable communicationprotocol that works in both directions.

Categories and Subject DescriptorsC.2.1 [Computer-Communication Networks]: Net-work Architecture and Design—Wireless Communica-tion

KeywordsBluetooth Low Energy; Advertisement Channels; nRF24.

Permission to make digital or hard copies of all or part of this work for personal orclassroom use is granted without fee provided that copies are not made or distributedfor profit or commercial advantage and that copies bear this notice and the full citationon the first page. Copyrights for components of this work owned by others than theauthor(s) must be honored. Abstracting with credit is permitted. To copy otherwise, orrepublish, to post on servers or to redistribute to lists, requires prior specific permissionand/or a fee. Request permissions from Permissions@acm.org.SmartObjects’15, September 07-11 2015, Paris, FranceCopyright is held by the owner/author(s). Publication rights licensed to ACM.ACM 978-1-4503-3535-5/15/09 ...$15.00.DOI: http://dx.doi.org/10.1145/2797044.2797049.

Figure 1: Concept art ( c©Disney): Wearable de-vices that are used in controlled environmentssuch as entertainment theme parks enrich thestory telling and experience design.

1. INTRODUCTIONThe nRF24LE1 radio System on a Chip (SoC) enables

low-complexity and low-power transmission for wirelessnetworking of consumer devices such as computer pe-ripherals or embedded systems for wearable electronics.The SoC (identified as nRF24 in this paper) belongs tothe chip series nRF24 and operates in the 2.4GHz In-dustrial, Scientific and Medical (ISM) band. Its basicphysical layer is known for its efficiency and often usedin the context of the Internet-of- Things (IoT) [7], [9]in low-complex and resource- constraint applications.Its main application is low-latency and low- through-put communication in consumer electronics. For exam-ple, wearable devices, step counters, wireless keyboardsand other computer accessories, or toys, can benefitfrom the connectivity provided by the nRF24 [13]. An-other popular usage scenario is related to wearable de-vices (bracelets) that are used in entertainment themeparks to enable personalized location-based services [1].Theme parks are controlled environments comparablein size and complexity to a city, and can serve as modelenvironments [4].

Another popular short- range radio technology is Blue-tooth Low Energy (BLE) [12], [5], also known as Blue-tooth Smart. BLE is available in many smart- and fea-ture phones. BLE devices must be paired to communi-cate among each other. Usually, the pairing process isneeded only the first time that two devices communi-cate.

1

1.1 MotivationBecause of the popularity of BLE and the nRF24 for

the IoT, it is interesting to enable interworking betweenthem. To interoperate with each other, the two tech-nologies need a communication protocol that managesthe coordination of medium access and maintains reli-able and spectrum efficient data exchange. BLE usesfrequency hopping and the nRF24 does not, thus, toprovide a reliable communication channel, the proposedprotocol is based on opportunistic communication win-dows and relies on frame retransmissions, acknowledg-ments, and timeout patterns.

There are various other possible use cases for sucha communication protocol: The interworking enabledby the proposed communication protocol can be usedto manage spectrum coexistence between nomadic BLEdevices and nRF24-based IoT systems.

1.2 ContributionAn nRF24LE1 chip can be programmed to transmit

and receive data in a way that can be decoded and pro-cessed by BLE devices. The required frame format ofthe nRF24-to-BLE communication are known from [6]and adopted here. This paper describes the completetwo-way communication protocol, which is designed byextending the existing frame formats. The communica-tion in both directions is based on BLE advertisementframes.

The contributions of this paper are: (1) A proto-col to establish reliable communication between nRF24and BLE devices by using advertisement frames and(2) an experimental testbed validation to evaluate theefficiency of the proposed communication.

2. RELATED WORK & STATE OF ARTBLE and the basic communication protocol used by

the nRF24 family chips are both largely adopted tech-nologies [2,5,8,9,12,13]. BLE is supported by most op-erating systems for mobile and wearable devices, mainlybecause of its low power consumption [11] when smallamounts of data are transmitted.

BLE is a low-power extension for Bluetooth. Similarto Bluetooth, BLE operates in the 2.4 GHz ISM radioband. It uses Gaussian Frequency Shift Keying (GFSK)as modulation and coding scheme and achieves a maxi-mum data rate of 1 Mb/s. BLE operates on 40 channelsspaced 2 MHz apart, with center frequencies rangingfrom 2402 MHz to 2480 MHz. Channels are organizedas three advertisement channels and 37 data channels.BLE uses frequency hopping to avoid interference andto coexist with other devices operating in the ISM band.The three advertisement channels are indexed as 37, 38and 39 and indicated in Figure 2.

The acronym nRF24LE1 refers to a commercially avail-able low-power SoC [9]. The product is today oftenconsidered for IoT use cases with a variety of appli-cations of low-power short-range communication andwas recently used in a large roll-out of wearable de-vices in a theme park [1]. The nRF24LE1 board in-cludes a 2.4 GHz transceiver (model nRF24L01+), an8051 compatible Micro Controller Unit, and a 16 kBembedded flash memory. The nRF24L01+ offers data

rates of 250 kb/s, 1 Mb/s, and 2 Mb/s; just like BLE,nRF24L01+ uses the GFSK modulation. The nRF24operates at 2.4 GHz with 80 orthogonal frequency chan-nels.

BLE and nRF24 are different technologies used inscenarios with similar requirements. Therefore, theremight be hybrid scenarios that require full interopera-tion. An existing multi-protocol radio chip addressesthe problem of bridging the two radio technologies [10].Nevertheless, there are scenarios in which it is interest-ing to be able to achieve multi-protocol communicationusing only software updates. In fact, avoiding hardwaremodifications allows hardware reuse that is favorable inscenarios with large amount of devices already rolled-out.

3. PROTOCOL DESIGNWith the nRF24 and BLE, it is not possible to pair

two devices following the standard BLE pairing process.It is however possible to transmit data using the adver-tisement channels that are normally used by BLE pe-ripherals to advertise their services.

Without pairing, transceivers are not coordinated onwhat advertisement channel use to communicate or whento start a transmission. Furthermore, BLE devices suchas smartphones dynamically tune the radio front- end sothat BLE hops among the three advertisement channelsin such a way that is unknown to the nRF24 device. Asresult, without a reliable protocol, a receiver might missdata frames.

The proposed protocol uses acknowledged unicast traf-fic, as opposed to unacknowledged broadcast (advertise-ment) traffic. Every frame carries a header with threefields, each one byte long, and the payload (16 bytesbecause of a nRF24 limitation [6]). The first and thesecond fields represent the destination and the sourceaddress. The third field holds the frame sequence num-ber. The destination allows directed communicationsusing the advertisement frames, which are broadcastmessages. The source address indicates to the receiverwhere to send the subsequent acknowledgment frame.The sequence number is used to sort received frames, torecognize missing frames, and to enable multicast trans-missions.

The communication system and the protocol describedin this paper are designed to support an applicationlayer that transmits sporadic and short sequences ofdata frames.

All devices duty cycle the use of the radio: Whena device has no messages to deliver it spends most ofthe time in sleep mode and periodically wakes up tolisten to all the three advertisement channels for incom-ing discovery frames. The radio duty cycle approachfollows the preamble sampling principle used in wire-less sensor networks protocols such as X-MAC wherepreamble messages (in this case, the discovery frames)are repeated for a duration of at least equal to the sleepperiod of every other device [3].

3.1 TopologiesTwo communication topologies (or, scenarios) are con-

sidered: (1) Peer-to-peer (P2P), in which a pair of de-

2

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 24 26 28 3037 0 23 25 27 2938

WLAN channel 6WLAN channel 1 WLAN channel 11

2400 MHz BLE channel index 2480 MHz32 34 3631 33 35 39

power40 BLE channels with

3 advertisement channels

80 (or more) nRF24 1MHz

channels

Figure 2: BLE channels with highlighted BLE advertisement channels together with Wi-Fi channelsand the eighty channels of the nRF24 system.

vices exchanges data directly and (2) one-to-many, whereone device delivers frames to a number of devices in itsvicinity. In P2P scenarios with uncoordinated devices,the transmitter discovers the receiver by sending pream-bles on all advertisement channels. Upon reception ofa valid preamble frame, the receiver sends an acknowl-edgment (ACK) and the communication can start.

In one-to-many scenarios, the transmitter always broad-casts the same number of preamble frames (the numberis known by all devices). After the transmission of thelast preamble, the data frame is transmitted. Everyreceiver that intercepts one of the preambles sends anACK and remains awake until the reception of the dataframe.

3.2 Discovery, Data, ACK FramesThere are three different kinds of frames: discovery,

data, and ACK frames described as follows.The discovery frame contains the protocol header and

does not carry any payload. The destination addressfield is set to 0xFF, which is the broadcast address. Thesource address field contains the sender address and thesequence number is set to zero. Upon reception of adiscovery frame, a device sends an ACK. To mitigateACK collisions, each device waits a random time be-fore responding transmitting. The approach of randomstart of ACK transmissions is taken from short rangeRFID, like (slotted) ALOHA. Upon collection of multi-ple ACKs, the transmitter of the discovery frame knowsthe identity of its neighbors. Since ACKs can still col-lide, the initial sender of discovery frames might needseveral transmission rounds before collecting the IDs ofall neighbors.

Data frames can be unicast or multicast frames, thus,both source and destination address must be set ac-cordingly. The sequence number starts at zero and isincreased by one with every new frame. Upon recep-tion of a unicast data frame, if the destination addressmatches the internal address, an ACK that echoes thesequence number is sent back. Else, if the data frameis a multicast frame, no ACK is sent. If the originaltransmitter of the unicast data frame receives a validACK frame (same sequence number, matching sourceaddress), it can proceed to the next data frame. If noACK is received within a timeout, the data frame will

be retransmitted. The maximum number of retransmis-sions is a configuration parameter.

Like a discovery frame, an ACK frame contains onlythe protocol header. The source address of the ACKframe is set to the sender address and the destinationfield is set to the source address of the received frame(that can be a discovery or a data frame). The sequencenumber is echoed in case of data frames.

4. EVALUATIONThe performance of the proposed two-way communi-

cation protocol is evaluated with the help of the testbedimplementation shown in Figure 3.

4.1 Testbed DescriptionThe nRF24LE1 SoC is plugged into an nRFGo eval-

uation board for chips of the nRF24L- Series. The BLEdevice is an iPhone 5s that is set to alternate betweencentral coordinator and peripheral role. A central coor-dinator periodically listens to the advertisement chan-nels whereas a peripheral device uses the advertisementchannels to transmit connection requests. Tuning theBLE radio front-end to a specific advertisement channelis not supported.

All measurements are performed inside an electro-magnetic shielded box to avoid external interference.Figure 3 shows the evaluation setup. All measurementsfocus on the data transmission part of the protocol andthey always involve one transmitter and one receiver.We show measurements of the P2P scenario to show theeffects of having one device, the iPhone, which automat-ically hops among the three advertisement channels andthe other device, the nRF24, whose radio front-end canbe manually tuned. If the transmitter requests an ACK,the ACK timeout immediately starts after the end of theframe’s transmission. The ACK timeout is set to 30 ms,a value large enough to compensate both hardware andsoftware constraints.

Since nRF24 and BLE devices can initiate a discoveryprocess or a data transmission, there are two differentcommunication directions (1) from nRF24 to BLE de-vice (hopping) and (2) from BLE device to nRF24.

The key performance criteria used to evaluate theprotocol approach are the frame delivery ratio, whichexpresses the fraction of correctly received frames, and

3

Figure 3: Setup used for the measurements.

the achievable throughput in bit per second (b/s), whichshows the data rate that the communication link is ableto provide.

Every measurement is repeated 5 times and all fig-ures show the average results with the correspondingconfidence intervals at 95 % confidence level.

4.2 ACK TimeoutWhen the nRF24 is the transmitter, the ACK timeout

duration only depends on the radio front-end turnaroundtime of the iPhone that we measured to around 11 ms.

When the iPhone is the transmitter, every frame issent to all the three advertisement channels because theBLE device does not know which channel the nRF24chip is tuned to. The nRF24 chip needs some time totransmit the ACK on the same channel used for recep-tion. For these reasons, the ACK timeout is set to 30 msin both devices.

The ACK timeout should also take into account thefact that when the ACK is sent by the nRF24 the BLEdevice might be already tuned to another advertisementfrequency and miss the ACK. This fact opens several de-sign choices such as introducing some randomness be-tween two consecutive frames (the approach followed inthis paper) or repeating the ACK multiple times.

One protocol choice might be to have the nRF24 chiprepeating the ACK multiple times. However, since theadvertisement channel hopping sequence is not definedin the BLE standard and not published by Apple, wediscarded this option. Instead, to limit the effect ofmissing ACKs because of channel hopping, the senderintroduces some randomness between two consecutiveframes.

4.3 nRF24 to BLEThe nRF24 chip transmits unicast data frames to the

BLE device. Hardware constraints impose a constantdelay of 10.8 ms to the transmission of every frame. De-pending on the scenario, we use repetitions in case ofmissed ACK within the timeout. During a measure-ment, the transmitter is always tuned to one advertise-ment channel. Measurement results are provided forall three channels. Since the iPhone continuously hopsover the three channels, the probability that the iPhonereceives a frame is limited. In fact, assuming that aBLE device listens to every advertisement channel thesame amount of time, one frame out of three is likelyto be delivered successfully. When the iPhone receives

Mean inter-frame interval [ms]10.8 20.8 30.8 40.8 50.8 60.8 70.8 80.8 90.8

Del

iver

y ra

tio

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1ch37ch38ch39

Figure 4: Periodic nRF24 to iPhone communica-tion without retransmissions. The channel hop-ping procedure leads to lost frames.

Mean inter-frame interval [ms]60.8 70.8 80.8 90.8 100.8 110.8 120.8 130.8 140.8 150.8

Del

iver

y ra

tio

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1ch37ch38ch39

Figure 5: Delivery ratio of the nRF24 to iPhonecommunication with random interval betweenframes and no retransmissions.

the unicast frame, it immediately sends back an ACKover all the three advertisement channels echoing thereceived sequence number.

Delivery Ratio for Periodic and Random Frames.Figure 4 shows the delivery ratio of 1000 unicast frames

sent to an iPhone over the three channels. Every mea-surement is repeated 5 times. In this scenario with-out ACK frames or retransmissions, the delivery ratiois evaluated at the iPhone side. All frames are sent withconstant period; the x-axis of the figure already takesinto account the hardware delay of the nRF24 radiofront-end. The figure gives a hint about the repetitionperiod of the BLE device used for the measurements.The figure shows that the lack of channel coordinationand the channel hopping procedure of the iPhone can seta severe limitation to the performance. In fact, if framesare sent every 30.8 ms, most of them are not received bythe iPhone. When comparing Figure 5 (randomizationof consecutive frames) with Figure 4, we understandthat adding a random delay helps even without ACK

4

Max number of retransmissions0 1 2 3 4 5

Del

iver

y ra

tio

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

ch37ch38ch39

Figure 6: Effect of increasing the number of re-transmissions for the nRF24 to iPhone commu-nication direction. Frames are sent with randominter-frame intervals.

Mean inter-frame interval [ms]60.8 70.8 80.8 90.8 100.8 110.8 120.8 130.8 140.8 150.8

Thro

ughp

ut [b

/s]

0

100

200

300

400

500

600

700

800ch37ch38ch39

Figure 7: Throughput of nRF24 to iPhone com-munication for no retransmissions and randominter-frame intervals.

frames. Thus, all the following results use random in-tervals between frames.

Figure 5 shows the delivery ratio of 1000 unicast framesover the three advertisement channels without retrans-missions. The offered traffic changes with the mean in-terval between two frames, but the interval between twoframes is not constant. Instead, the nRF24 transmitterwaits for a random time of up to 100 ms (uniformly dis-tributed) before initiating the subsequent frame trans-mission. In the scenario without retransmissions (cf.Figure 5), this helps to smooth the delivery ratio. Fig-ure 6 illustrates the performance improvement whenmissed frames are retransmitted. In Figure 6, everyfirst attempt is separated by a period of 60.8±50 ms(that translates to a fixed minimum-inter-frame delayof around 10 ms, which is the shortest delay the nRF24can handle, plus a random delay of up to 100 ms). Everyretransmission is sent immediately after the ACK time-out fires. Since there is no coordination between trans-mitter and receiver on channel usage, the transmittertries to reach the receiver with multiple consecutive re-

Mean inter-frame interval [ms]50 60 70 80 90 100 110 120 130 140

Thro

ughp

ut [b

/s]

0

100

200

300

400

500

600

700

800ch37ch38ch39

Figure 8: Throughput of iPhone to nRF24 com-munication without retransmissions.

Max number of retransmissions0 1 2 3 4 5 6

Del

iver

y ra

tio

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

ch37ch38ch39

Figure 9: Delivery ratio versus increasing num-ber of retransmissions for the iPhone to nRF24communication.

transmissions as early as possible. Figure 6 shows thatincreasing the number of retransmissions improves thereliability of the channel, guaranteeing higher deliveryratio at the expense of increased overhead and latency.

Achievable Throughput.Figures 7 shows the achieved throughput as function

of the inter-frame interval without retransmissions. Thefigure shows a decreasing trend with increasing intervalbecause incrementing the interval reduces the offeredtraffic.

4.4 BLE to nRF24The evaluation shows the results for 1000 unicast frames

sent by the iPhone to the nRF24 over all the threeadvertisement channels. The values are the result of5 independent measurements. Each data frame is ac-knowledged. Since the receiver is tuned to one adver-tisement channel (there is no frequency hopping for thenRF24 chip), it always receives frames and respondswith ACKs. IN fact, inside the shielded box there are nocollisions because there are only one transmitter and onereceiver; when a data frame is sent by the iPhone, thenRF24 chip always replies with an ACK. However, be-

5

cause of the BLE channel hopping process, ACKs mightbe missed jeopardizing the delivery ratio. Retransmis-sions are used to limit this effect.

Delivery Ratio and Achievable Throughput.Figure 8 shows the throughput versus (random) inter-

frame transmission interval. Increasing the mean inter-frame interval reduces the offer and therefore, the through-put decreases. The figure shows that all advertisementchannels provide similar performance. Figure 9 illus-trates the impact of retransmissions with randomizedinter-frame interval of 50±50 ms for all the three adver-tisement channels. If no ACK is received, a new frameis sent after the timeout expires whereas if an ACK isreceived, then the new frame is sent immediately afterits reception. As expected, increasing the number ofretransmissions improves the reliability of the commu-nication while decreasing the throughput (cf. Figure 8).

4.5 Collision AvoidanceThe random time added before each initiation of a

frame exchange can be used to minimize the undesir-able effect of multiple devices operating on the samechannel. The nRF24 supports a rudimentary carriersensing on its operating frequencies, and hence a simplecollision avoidance protocol is possible. The randomiza-tion is therefore not only needed to mitigate the corre-lation between BLE advertisement channel access andthe nRF24, but also helps avoiding collisions, which isalready a first step towards a complete MAC protocol.

5. CONCLUSION AND FUTURE WORKA two-way communication protocol between BLE and

nRF24 systems without using multi-protocol chips isdemonstrated. The protocol can be used for applica-tions with the low-complex nRF24 (IoT sensors, toys),as well as BLE (smartphones). The interworking pro-tocol is tested using experimental lab experiments. Theevaluation shows that it is possible to build a simpleand sufficiently reliable data exchange that works inboth directions. The results shown this in paper area first step towards testing additional scenarios insideand outside a shield box and on the design of a MACprotocol based on random medium access and collisionavoidance. Such MAC protocol must handle the com-munication of a combination of BLE and nRF24 devicesusing only the advertisement radio channels.

AcknowledgmentWe thank Jani Saloranta, Lorenzo Bergamini, and Adri-ano Galati for their contributions.

6. REFERENCES

[1] B. Barnes. At Disney Parks, a Bracelet Meant toBuild Loyalty. Available athttp://www.nytimes.com, 7-January-2014.

[2] Bluetooth SIG. Bluetooth Core Specification 4.2.Available at https://www.bluetooth.org/en-us/specification/adopted-specifications,2-Dec-2014.

[3] M. Buettner, G. V. Yee, E. Anderson, and R. Han.X-MAC: A Short Preamble MAC Protocol forDuty-cycled Wireless Sensor Networks. SenSys’06, pages 307–320, New York, NY, USA. ACM.

[4] K. Collins, S. Mangold, and G. Muntean.Supporting Mobile Devices with WirelessLAN/MAN in Large Controlled Environments.Communications Magazine, IEEE, 48(12):36–43,December 2010.

[5] J. DeCuir. Introducing Bluetooth Smart: Part 1:A look at Both Classic and New Technologies.Consumer Electronics Magazine, IEEE,3(1):12–18, Jan 2014.

[6] Dimitry Grinberg. Bit-Banging Bluetooth LowEnergy. Available at http://dmitry.gr,31-July-2012.

[7] I. Glaropoulos, S. Mangold, and V. Vukadinovic.Enhanced IEEE 802.11 Power Saving forMulti-hop Toy-to-Toy Communication. InGreenCom, IEEE Internet of Things(iThings/CPSCom), pages 603–610, Aug 2013.

[8] J.-S. Lee, Y.-W. Su, and C.-C. Shen. AComparative Study of Wireless Protocols:Bluetooth, UWB, ZigBee, and Wi-Fi. In IECON2007, pages 46–51, Nov 2007.

[9] Nordic Semiconductor. nRF24LE1: Ultra-lowPower Wireless System On-Chip Solution -Product Specification v1.6, 2014.

[10] Nordic Semiconductors. nRF51822 BluetoothSmart and 2.4GHz proprietary SoC.

[11] M. Siekkinen, M. Hiienkari, J. Nurminen, andJ. Nieminen. How Low Energy is Bluetooth LowEnergy? Comparative Measurements withZigBee/802.15.4. In WCNCW, IEEE, pages232–237, April 2012.

[12] R. Want, B. Schilit, and D. Laskowski. BluetoothLE Finds Its Niche. Pervasive Computing, IEEE,12(4):12–16, Oct 2013.

[13] N. Zhu and I. O’Connor. Performance Evaluationsof Unslotted CSMA/CA Algorithm at High DataRate WSNs Scenario. In IWCMC, pages 406–411,July 2013.

6