號呆鵝的操盤室

我開始研究BLE沒多久，我就意識到藍芽低功率的真正戰場是裝置的開發(比如心跳表)。如果要真的搞懂BLE技術，我勢必得自己做BLE裝置。研究過後，有兩個平台可以選： TI CC2541 8051 , 8KB-RAM, 128/256KB-FLASH Nordic nRF51822 Cortex-M0 , 16KB-SRAM, 128/256KB-FLASH 兩個方案都是BLE SoC。我特別喜歡TI的文件和範例程式。TI的 SensorTag 就是一個已經會動的產品，上面裝了六種sensors，附上firmware的程式碼，以及Android/ iOS的程式碼。用這些範例來學，速度比起從無到有打造快多了。身為假日工程師，我一定得找這種方案。不過 我實在很討厭8051 ，這大概是TI方案最嚴重的弱點。 Nordic的網站根本不給人下載資料(笑)，比起來TI真的是大方許多。我得先買開發工具，上網註冊，Nordic才給看資料。我花了一些功夫確定Nordic也提供像TI那樣的範例程式，算是可用了。我比較熟悉ARM的CPU，而且也買了J-Link EDU這顆JTAG。如果沒有特別原因，我傾向用nRF51822。 兩個平台的開發工具都不貴：3000，所以就挑一個吧。不過我發現掏寶網上有一堆便宜的開發板，打nRF51822或CC2541，就有一卡車的板子可以選。這些"加強"過的版子通常會有USB轉RS232的IC (PL2303)，甚至上頭也有(盜版)J-Link，真的超好用。 關於J-Link我有些話要說。Segger的 J-Link EDU 只賣台幣2400左右，除了不能做商業用途，和標準版沒有任何差異。考慮到他這麼便宜，而且品質精良，J-Link EDU真的值得投資。就別再買謎版的J-Link了... 因為價格實在太便宜了，最後我也懶得選，乾脆兩個平台都買，只花了2400 nRF51822 development board CC2541 development board CC debugger for TI's CC2541 CC2541 based BLE sniffer 接下來幾個禮拜大概可以跟這些玩具玩得很開心~~~

When I started to survey BLE technology, I am well aware that the battlefield of BLE development is device. To fully understand BLE technology, I shall develop my own BLE devices. After some surveying, I had 2 candidates: TI CC2541 8051 , 8KB-RAM, 128/256KB-FLASH Nordic nRF51822 Cortex-M0 , 16KB-SRAM, 128/256KB-FLASH Both solutions BLE SoC. I like TI's great documentation and sample codes. TI's SensorTag  is an excellent sample BLE device with firmware source code and Android/ iOS application source code which could accelerate studying. Being a holiday engineer, starting from an example is much better than from scratch. However, I personally don't like 8051. That's the weakest point of TI's solution.  In Nordic's website, they didn't allow users to download documents freely as TI. I probably need to buy their development kit then I can gain access to these data. I spent some time to find its documents & examples to ensure that they also provid

我一直很好奇手機是怎麼和心跳表溝通。如果想自己寫個APP做實驗，要搞定三個麻煩： 我不會寫Java 我不會寫Android的GUI程式 我不會寫Android的藍芽程式 寫了幾個禮拜，每次搞定一點。這個主題太大，也不可能寫下所有東西。這篇文章記下學習過程的重要關鍵點。 Android開發環境 幾乎所有Android程式書都有一章在講怎麼安裝開發環境。我選Google包裝好得Eclipse ADT Bundle，抓回來裝好就可以在Windows/MAC上都可以寫程式。用這個環境寫出第一個Android APP非常容易，點一點就可以在手機上跑起來。 書上也有講怎麼用模擬器開發，但我的目標是開發藍芽程式，直接在手機上跑比較實在。 JAVA 我大概10年前有嘗試學Java，接著馬上放棄，大概算99%的新手吧。我的記憶只剩怎麼寫Hello World的程式：     // hello.java     public class hello {         public static void main(String[] args) {             System.out.println("Hello World");         }     } 編譯指令     javac hello.java 執行指令     java hello 第一個Java程式會跑之後，就用它測試If-Else，For-Loop，Function-call，FILE-IO，String-processing，很快可以抓到一些Java的感覺。感謝世界上眾多的Java開發者，幾乎什麼問題都找得到答案。用類似這樣的關鍵字"java open file"，就找得到資訊了。 Android GUI Programming Android GUI框架在幕後定義某種流程，在事件發生時呼叫一些callback函數回應事件。使用者的工作就是了解這個框架是怎麼回事，然後提供callback函數回應事件。GUI本身很複雜，在上頭寫程式也很複雜也就不會很意外了。 比如按下畫面上某個按鈕，Android會呼叫onClickListener()。使用者

I'm always curious how the smart phone interacts with BLE device. I would like to write own APP to interact with my BLE heart rate sensor. To do this, I have to overcome 3 difficulties: I don't know Java I don't know Android GUI programming I don't know Android Bluetooth programming I spent several weeks to overcome these difficulties. Topic is too large to describe everything clearly. I just can describe some landmark when I was studying. Android Development Environment Almost all Android development book has a chapter illustrating how to setup environment. I installed Eclipse ADT Bundle for both WIN/MAC. With the aid of Eclipse, I had my 1st Android application running on the phone easily.  The books also illustrated how to use Android simulator. But Bluetooth is not possible to simulate over that. I always run the program directly on the phne. JAVA I'm not 100% Java newbie. I learned Java about 10 years ago and gave up very soon. The only

假日工程師這次要介紹GATT protocol，這東西定義了兩個術語 Service (服務) Characteristics (特徵 ?!) 其實就是上面這張圖，每個服務裡，會包含多個特徵。每個特徵會有 一個property/value 以及幾個descriptor。 Service 所有的Service會用UUID =  0x2800 定義服務的起點。在之前的 ATT protocol 裡，滿足的handle是0x1/ 0x8/ 0x9/ 0x11/ 0x15。     handle: 0x0001, uuid: 2800          1800, Generic access     handle: 0x0008, uuid: 2800          1801, Generic attributes     handle: 0x0009, uuid: 2800          180D, Heart Rate     handle: 0x0011, uuid: 2800          180F, Battery Service     handle: 0x0015, uuid: 2800          180A, Device Information 這些handle的數值是服務的UUID，代表這個服務是什麼。以handle[0x9]為例， 0x180D 正是心跳感應器。因為下一個UUID = 0x2800位在handle[0x11]，所以心跳感應器所屬的handle[0x9~ 0x10]。 所以每個BLE裝置，只要找UUID = 0x2800就可以找到所有的services，而且同步可以確定所屬的handle區間。 Characteristic 在每個Service理，有另外一個分隔線UUID =  0x2803 定義characteristics (特徵?)。聰明機知道Heart rate service位在handle[0x9 ~ 0x10]，接下來在這個區間搜尋UUID = 0x2803就可以定位所有的Characteristics。在我們的心跳表範例，會找到三枚handle[0xA/ 0xD/ 0xF]。     handle:

The GATT is built over ATT protocol, which defines 2 terms Service Characteristics Each service contains several characteristics. Each characteristic has single property/value and several descriptor. Service In ATT table, the entry with UUID =  0x2800  defines service, which is the start-of-service. The content within is service UUID. In previous  post , handle = 1/8/9/11/15 are of such type.     handle: 0x0001, uuid: 2800          1800, Generic access     handle: 0x0008, uuid: 2800          1801, Generic attributes     handle: 0x0009, uuid: 2800          180D, Heart Rate     handle: 0x0011, uuid: 2800          180F, Battery Service     handle: 0x0015, uuid: 2800          180A, Device Information Take handle[0x9] as example, the value is  0x180D , heart rate service. The heart rate monitor handle region is between 0x9 to 0x10 because the next UUID = 0x2800 is located in handle[0x11]. Therefore, by searching UUID = 0x2800, we can find al

前言 搞定從Raspberry Pi讀心跳之後(by notification)， 下一步就是弄清楚BLE通信協定。這篇文章希望可以提供一些範例，解釋GATT/ATT是怎麼運作的。希望他能幫助社會大眾了解BLE是怎麼玩的。 ATT (Attribute) 所有BLE裝置都要支援ATT (Attribute, 屬性)協定。看起來很厲害，其實只是一個資料結構：     struct {         u16 uuid; // Universally Unique Identifier         u8 *data; // variable length data     } att[65536]; 這個通訊協定就是一張表格，一個陣列。陣列允許random access，只要給個index就可以了。在BLE的術語理，這個index叫 handle 。表格每個單元還包括16bit的UUID作為metadata，解釋這筆資料是什麼。另外資料並不是直接嵌在表格，而是放一個指標，允許可變長度的資料。 在 上篇文章 ，我用了gatttool和心跳表打交道。這個工具就是透過RPi的藍芽dongle和心跳表的ATT layer打交道。參考gatttool的說明功能表就可以看出ATT protocol的功能： 在工具裡，執行"char-desc"可以把藍芽裝置所有的handle和對應的UUID讀出。對應的pseudo code看起來很像這樣：     for handle in range(1, 65535):         if att[handle] is effective:             print "handler=%d, uuid=%d", i, att[i].uuid 我實際上在RPi執行的結果如下： 要在8051/ARM實作ATT protocol不會很難，就是一個存資料的資料結構而已。這邊有兩點值得再注意： UUID代表Universal Unique IDentifier，這個ID和資料放在一起，功能是描述這筆資料是什麼，也就是俗稱的metadata。一般去google找"Bluetooth BLE NNNN"就找得到UUI

Foreword After getting notification from my heart rate sensor through RPi, the next step is to figure out the BLE protocol.  I would like to provide some examples illustrating how GATT/ATT works. Hope that this article can help people who want to understand BLE. ATT (Attribute) All BLE devices support ATT protocol. ATT stands for attribute. It looks like an table with following data structure:     struct {         u16 uuid; // Universally Unique Identifier         u8 *data; // variable length data     } att[65536]; The ATT protocol is a table under the hood. The data structure enables us doing random access through array-index. In BLE terminology, the array index is "handle". Each entry in the table has an 16bit UUID field describing what's the data is (metadata). Another interesting point is that data is just a pointer, which enables variable length data structure. In  last post , I used the gatttool to communicate with the BLE device. The tool is actually ta

前言 在Internet上找了又找 ，用這幾個關鍵字"Raspberry Pi, BLE"或著"BLE Linux"之類的，最後我找到兩篇文章很好用。只要著做，我的心跳感應器就會動了。只是我完全不懂藍牙的協定， 這讓人有點不舒服。 Get started with Bluetooth Low Energy Bluetooth Low Energy: listening for notifications/indications in linux 身為一枚假日藍牙工程師，有時候我就是得在弄清楚一切之前，就先讓東西動起來。所以我決定先把發現的事寫下來，之後再找答案。 gatttool 這個tool是Bluez套件的其中一部份。在找資料的過程中，GATT/ATT這兩個關鍵字反覆出現。之後再搞清楚他們的意思吧。 在前一篇文章 提到怎麼用"hcitool lescan"找出裝置的MAC address，然後就可以用gatttool和心跳帶建立連線： 在tool的視窗裡，打help就可以看它提供的功能。身為一個好奇的假日工程師，我每個都有試玩過。 Primary這道命令很有趣，他會列出裝置支援的所有服務。我檢查所有UUID之後，在 藍牙開發者網站 找到一份資料，解析每個服務的意思。底下標紅字的是心跳服務，證明我的裝置真的是藍牙心跳感應器。 0x1800, Generic Access 0x1801, Generic Attribute 0x180D, Heart Rate 0x180F, Battery Service 0x180A, Device information "attr handle"這個字串看起來很像是某個表格的index。 下一道command是"char-desc"，他會產生一張表格， 列出所有的handles。交叉比對上下兩張圖，Primary指令裡列出的handle 0/8/9/11/15，在下面的表格裡，UUID正好都是0x2800。 藍牙規格網站 裡面說0x2800是"Primary Service"，好像這些東西互相有些關聯。 我找了一堆網頁，似乎

Foreword I searched the Internet over and over, with keyword "Raspberry Pi, BLE" or "BLE Linux". Eventually, I found two articles are useful. Following instructions, I soon get my heart rate sensor up. However, I don't know the Bluetooth completely. This makes me feel uncomfortable. Get started with Bluetooth Low Energy Bluetooth Low Energy: listening for notifications/indications in linux As a holiday Bluetooth engineer, sometimes I must bring up things earlier than understanding it. So I decide to write down what I've learned here, then find answer later. gatttool The gatttool is part of Bluez package. The keyword "GATT/ATT" appeared so frequently that this must be an important keyword. I will figure out them later. Use the MAC address with "hcitool lescan" showed in previous post , I can start gatt connection with the tool. See following screenshot. In the tool's command line interface, typing "help" to

Because of exercise, I became a fan of Bluetooth low energy (BLE). I bought the heart rate monitor to tract my heart rate, but I found it's not precise counting. I wanted to know why BLE is working. I used the recently bought toy "Raspberry Pi" as research platform. So... this thing is interesting & funny, or just torturing me, I will know soon... ----  Establish environment Linux Bluetooth protocol stack is Bluez, which is a project sponsored by Qualcomm. Even more, Bluez is also formal Linux kernel Bluetooth driver. But the interesting thing is, bluedroid is replacing Bluez since Android 4.2 which is cooperated by Google and Broadcom. As a holiday Bluetooth engineer, I choose mature solution, Bluez. The formal Bluez in Raspbian is very old in 2014/9/28. I followed the instruction  to get the latest bluez . So I got version 5.23. Although RPi running gcc make me surprise, it is very slow when compiling something large (lol). Anyway, I let Bluez run, and prepa