Bluetooth Low Energy 4.x

Understanding BLE is much easier if you speak the lingo.

Each device can have one of the following roles:

  • Central (master); Will scan for advertising packets
  • Peripheral (slave); Sends advertising packets
  • Client; Device that wants the data
  • Server; Device that has the data

To make it interesting:

  • Every BLE device can be either central or peripheral or both.
  • Every BLE device can be either client or server or both.
  • Every BLE central can be connected to multiple peripherals.
  • Every BLE peripheral can be connected to multiple centrals.

Confused? I was... So I started with the most used configuration.

Basic Bluetooth Low Energy configuration

Basic Bluetooth Low Energy configuration

The trick is that each role, a device can have, is defined on different layers in the protocol stack.

Protocol Stack

Bluetooth Low Energy protocol stack

Bluetooth Low Energy Protocol Stack

The Physical Layer (PHY) is the 1Mbps adaptive frequency-hopping Gaussian Frequency-Shift Keying (GFSK) radio that is operating in the unlicensed 2.4 GHz Industrial, Scientific, and Medical (ISM) band.

Link Layer (LL) handles the transfer of L2CAP Packets while ensuring guaranteed delivery and integrity of data.

Logical Link Control and Adaptation Protocol (L2CAP) is responsible for Quality of Service (QoS), routing, fragmentation and reassembly of packets for higher layer protocols such as ATT, Security Management Protocol (SMP) and etc.


  • At Link layer level there is the master - slave relationship
  • At GAP layer level there is the central - peripheral relationship
  • At GATT layer level there is the client - server relationship

Then, you have the roles of a GATT Server and a GATT Client. Normally, the Server is the device that contains data, that the Client can read.
However, there is no connection between these roles. Even though it is most common for a Peripheral to be a Server and a Central to be a Client, it is perfectly possible to have a Peripheral that is only a Client, or a Central that is both a Server and a Client.

So, a wareable or sensor is a peripheral (GAP) and a server (GATT), a phone or tablet is a central (GAP) and a client (GATT).

Network Modes

BLE devices use two distinct communication methods:

  • Broadcasting and
  • Connecting.

Both methods follow certain procedures established by the Generic Access Profile (GAP).


When using connectionless broadcasting, a BLE device sends data out to any scanning device or receiver that is within acceptable listening range. Essentially, this mechanism allows a BLE device to send data out one-way to anyone or anything that is capable of picking up the transmission.
Broadcasting defines two separate roles:

  • Broadcaster: Sends non-connectable advertising packets periodically to anyone willing to receive them.
  • Observer: Repeatedly scans the pre-set frequencies to receive any non-connectable advertising packets.

Broadcasting is the only way for a device to transmit data to more than one peer at a time. These broadcasted data are sent out by using the advertising features of BLE. It is possible to advertise sensor data using this communication methode, so to read e.g. a temperature sensor it is not necessary to connect to that sensor.


For bi-directional data transmission in BLE a connection needs to be present. A connection in BLE is nothing more than an established, periodical exchange of data at certain specific points in time (connection events) between the two BLE peers involved in it. Typically, the data are exchanged only between the two BLE connection peers, and no other device is involved. Connections define two separate roles:

  • Central (master): Repeatedly scans the pre-set BLE frequencies for connectable advertising packets and, when suitable, initiates a connection. Once the connection is established, the central manages the timing and initiates the periodical data exchanges.
  • Peripheral (slave): A device that sends connectable advertising packets periodically and accepts incoming connections. Once in an active connection, the peripheral follows the central’s timing and exchanges data regularly with it.

Connections provide the ability to organize the data with much finer-grained control over each field or property through the use of additional protocol layers and, more specifically, the Generic Attribute Profile (GATT). Data are organized around units called services and characteristics.


The Bluetooth specification clearly separates the concept of Protocol and Profile. This distinction is made due to the different purposes each concept serves and the overall specifications are divided into:

  • Protocols: They are the building blocks used by all devices conformant to the Bluetooth specification; protocols are essentially forming the layers that implement the different packet formats, routing, multiplexing, encoding, and decoding that allow data to be sent effectively between peers.
  • Profiles: which are vertical slices of functionality defining either basic modes of operation required by all devices (such as the Generic Access Profile and the Generic Attribute Profile) or specific use cases (Proximity Profile, Glucose Profile); profiles essentially specify how protocols should be used to achieve a particular objective, whether generic or specific.

Generic Profiles

Generic profiles are defined by the Bluetooth specification and two of them are fundamental as they ensure the interoperability between BLE devices from different vendors:

  • Generic Access Profile (GAP): Specifies the usage model of the lower-level radio protocols to define roles, procedures, and modes that allow devices to broadcast data, discover devices, establish connections, manage connections, and negotiate security levels; GAP is essentially, the uppermost control layer of BLE. This profile is mandatory for all BLE devices, and all must comply with it.
  • Generic Attribute Profile (GATT): Addresses data exchanges in BLE and specifies the basic data model and procedures to allow devices to discover, read, write, and push data elements between them. It is basically, the topmost data layer of BLE.

GAP and GATT are so fundamental to BLE that they are often used as the base for the provision of application programming interfaces (APIs) that act as the entry point for the application to interact with the protocol stack.

GATT side of the stack

Attribute Protocol (ATT) defines the protocol of transferring the attribute data. This includes GATT related functionality such as Write Request, Write Response, Notification, Read Response. In short, GATT defines and creates appropriate attributes for a given application and ATT creates outgoing and parses incoming packets that defines the action in the GATT layer.

Generic Attribute Profile (GATT) is the layer developers will often interface with the most and accustomed to. GATT defines the protocol of transferring data between two Bluetooth Low Energy devices. Application data is uniquely identified through a small entity known as an Attribute. Group of Attributes form Characteristics which adds additional properties such as permission and rules of interaction for a unique set of data. A group of Characteristics form a Large entity known as Service which adds a larger blueprint for a given feature or functionality. For Example, Battery Service includes a Battery Level Characteristic which includes the battery level of a given device. [1]

The Generic Attribute Profile (GATT)

The Bluetooth Core Specification defines the GATT like this:

The GATT Profile specifies the structure in which profile data is exchanged. This structure defines basic elements such as services and characteristics, used in a profile.

In other words, it is a set of rules describing how to bundle, present and transfer data using BLE. Read the Bluetooth Core Specification v4.2 for more information [8]. It is only 2772 pages.


The Bluetooth Core Specification defines a service like this:

A service is a collection of data and associated behaviors to accomplish a particular function or feature. [...] A service definition may contain referenced services, mandatory characteristics and optional characteristics.

In other words, a service is a collection of information, like e.g. values of sensors. Bluetooth Special Interest Group (Bluetooth SIG) has predefined certain services. For example they have defined a service called Heart Rate service. The reason why they have done this is to make it easier for developers to make apps and firmware compatible with the standard Heart Rate service. However, this does not mean that you can’t make your own heart rate sensor based on your own ideas and service structures. Sometimes people mistakenly assumes that since Bluetooth SIG has predefined some services they can only make applications sticking by these definitions. This is not the case. It is no problem to make custom services for your custom applications. [4] [8]


The Bluetooth Core Specification defines a characteristic like this:

A characteristic is a value used in a service along with properties and configuration information about how the value is accessed and information about how the value is displayed or represented.

In other words, the characteristic is where the actual values and information is presented. Security parameters, units and other metadata concerning the information are also encapsulated in the characteristics. [4]

Universally Unique ID (UUID)

A UUID is an abbreviation you will see a lot in the BLE world. It is a unique number used to identify services, characteristics and descriptors, also known as attributes. These IDs are transmitted over the air so that e.g. a peripheral can inform a central what services it provides. [4]

Unique ID ?

There is no database ensuring that no one in the world is sharing the same UUID, but if you generate two random 128-bit UUIDs there is only a ~3e-39 chance that you will end up with two identical IDs. [4]

Descriptor Declaration

After the Characteristic Value Declaration follows either

  1. a new Characteristic Declaration (there can be many characteristics grouped in a service).
  2. a new Service Declaration (there can be many services in a table).
  3. a Descriptor Declaration.

The descriptor is an attribute with additional information about the characteristic. There are several kinds of descriptors [5]

Defining Descriptors

Depending on the characteristics, you may add descriptors. These descriptors provide information to the user about characteristics. They can also be used by the GATT client device to enable or disable notifications and indications.

A descriptor, termed Client Characteristic Configuration, is used by the GATT client to enable and disable notifications or indications. This is under the characteristic that supports notification or indication. Another example descriptor is the Characteristic User Description, which provides a string through which the characteristic can be recognized in a human-readable format. [6]

Use-Case-Specific Profiles

Use-case-specific profiles are usually limited to GATT-based profiles. Largely all of these profiles use the procedures and operating models of the GATT profile as a base building block for all further extensions. However, in version 4.1 of the specification, Logical Link Control and Adaptation Protocol (L2CAP) connection-oriented channels have been introduced, which indicates that GATT-less profiles are also possible.

On top of the GATT profile we have pre-defined GATT-based profiles.
GATT-based profiles:
Adopted Bluetooth Profiles, Services, Protocols and Transports [2]

  • BAS = Battery Service
  • HID = HID Service
  • FMP = Find Me Profile
  • HTP = Health Thermometer Profile
  • UDS = User Data Service

Vendor-Specific Profiles

Vendors are allowed by the Bluetooth specification to define their own profiles for use cases that are not covered by the SIG-defined profiles. Those profiles can be kept private to the two peers involved in a particular use case (for example, a new sensor accessory and a Smartphone application), or they can also be published by the vendor so that other parties can provide implementations of the profile based on the vendor-supplied specification. An example of a published vendor-specific profile is Apple’s iBeacon.

On-air operations and properties

Most on-air operations happen by using the handle, since this uniquely identifies each attribute.
Use of the characteristic is dependent on its properties. [3]

Characteristic properties include:
- Write
- Write without response
- Read
- Notify
- Indicate

More properties are defined in the Bluetooth specification, but these are the most commonly used.

  • Write and Write without response

Write and Write without response allow the GATT Client to write a value to a characteristic in a GATT Server.
The difference between them is that Write without response happens without any application level acknowledgment or response.

  • Read

The Read property makes it possible for the GATT Client to read the value of a characteristic in a GATT Server.

  • Notify and Indicate

Notify and Indicate allow a GATT Server to make the GATT Client aware of changes to a characteristic. The difference between Notify and Indicate is that Indicate has application level acknowledgment, while Notify does not.

  • Notification don’t need acknowledged, so they are faster. Hence, server does not know if the message reach to the client. [9]
  • Indication need acknowledged to communicated. The client sent a confirmation message back to the server, this way server knows that message reached the client. One interesting thing defined by the ATT protocol is that a Server can’t send two consecutive indications if the confirmation was not received. In other words, you have to wait for the confirmation of each indication in order to send the next indication.

GAP side of the stack

The Generic Access Profile (GAP) layer is responsible for the overall connection functionality
GAP specifies four roles that a device can adopt in a BLE network:

  • Broadcaster: The device is advertising with specific data, letting any initiating devices know for example that it is a connectable device. This advertisement contains the device address and optionally additional data such as the device name.
  • Observer: The scanning device, upon receiving the advertisement, sends a “scan request” to the advertiser. The advertiser responds with a “scan response”. This is the process of device discovery, after which the scanning device is aware of the presence of the advertising device, and knows that it is possible to establish a connection with it.
  • Central: when initiating a connection, the central must specify a peer device address to connect to. If an Advertisement is received matching the peer device’s address, the central device will then send out a request to establish a connection (link) with the advertising device having the particular connection parameters.
  • Peripheral: once a connection is established, the device will function as a slave if it was the advertiser and as master if it was the initiator.


[4] (1, 2, 3, 4)
[8] (1, 2)