1. Introduction to Bluetooth Device Discovery and Synchronization:

Before establishing a connection, Bluetooth devices quickly exchange handshake information, including time and address, by selecting hopping frequencies within a fixed frequency band or based on the address of the device being queried. This allows the devices to quickly achieve time and frequency synchronization. After the connection is established, both devices change frequencies according to a channel hopping sequence, giving the hopping frequencies a random characteristic.

The Bluetooth system defines the frequency hopping sequences for various operating states, including paging, paging response, inquiry, inquiry response, and channel hopping sequences. The strategies for generating frequency hopping sequences vary depending on the state.

Bluetooth is defined as32 frequency points make up one frequency band, which is divided into 79 sub-bands.The working frequency band and hopping sequence depend on the clock (CLK) of the input Bluetooth master device and the lowest 28 bits of the master device address, i.e., BD_ADDR[0…27], or the 28-bit General Inquiry Access Code (GIAC).

1) Query/Check Scan Status:

Bluetooth devices search for nearby devices in their vicinity through inquiry, and the inquiring device does so at regular intervals.312.5 microsecondsSelect a new frequency to send queries to the queried device.Every 1.28 secondsSelect a new listening frequency. The querying and queried devices use it.Universal Query Access Code(GIAC, General Inquiry Access Code) LAP (Low Address Part) is used as the inquiry address, and the GIAP LAP is 0x9E8B33. The Bluetooth standard specifies that no Bluetooth device is allowed to use the same address as the GIAP LAP. The resulting 32 inquiry hopping sequences are evenly distributed across 79 frequency channels.

2) Paging/Paging Scan Status:

Bluetooth devices use paging to invite other devices to join their piconet.The paging device selects a new frequency every 312.5 microseconds to send a page.During paging scanning, the paged device selects a new listening frequency every 1.28 seconds. The paging and paged devices use the lower 28 bits of the paged device's address (BT_ADDR) to generate the paging hopping sequence, which is a well-defined periodic sequence. Its frequency points are evenly distributed across the 79 frequency channels in the 2.4 GHz band.

3) Connection status:

In the current state, both sides of the Bluetooth communication device change frequency every 625 microseconds, using the lowest 28 valid bits of the master device address. The generated channel hopping sequence has a very long period, and the 79-hop sequence is nearly uniformly distributed over any short period of time.
 

2. Bluetooth State Transition Diagram:

The image above is a Bluetooth state transition diagram. From the diagram, it can be seen that the STANDBY state is the default state of the Bluetooth device. In this mode, the device operates in a low-power state.

Page:This substate is what we usually refer to as connection (paging). The operation of connecting/activating the corresponding slave is called paging. It means that the device initiating the connection (master device) knows the address of the device it wants to connect to. Therefore, it can directly page it. (Think of a pager—you need to know the number to use it.)

Page scan:This substate corresponds to the page, and it represents the state of waiting to be paged by the slave of the page. In other words, if we want to be paged, we need to be in the page scan state.

inquiry:This is what we usually refer to as the scanning state, where the device scans for nearby devices. It doesn't know what devices are around, so it needs to query (investigate), similar to broadcasting (shouting out). Devices in the Inquiry Scan state can respond to this query. After the necessary negotiation, they can establish a connection.

It should be noted here that after the inquiry, you can connect to the device without entering the page.

inquiry scanThis is what we usually refer to as discoverable devices. On the upper layer, it is reflected in the Android system when we enable the option for the device to be discoverable by nearby devices, putting the device in such a state.

slave response:This occurs during the paging process, where the slave receives the master's page message. It will respond with the corresponding page response message, and at the same time, it transitions into the slave response state.

master response:After the master receives the response message from the slave, it will transition to the master response state and simultaneously send an FHS packet.

inquiry response:When the inquiry scan device receives the inquiry message, it will send an inquiry response message. After that, it will enter the inquiry response state.

The various states mentioned above can be summarized in the following paging process: the paging process proceeds as follows:

1) A device (source) pages another device (destination), and at this moment, it is in the paging state. (Page state)

2) The target device receives the paging request and is currently in the Page Scan state.

3) The target device sends a reply to the source device, and it is now in the Slave Response state.

4) The source device sends an FHS packet to the destination device, which is in the Master Response state at this time.

5) The destination device sends a second reply to the source device, at this point it is in the Slave Response state.

6) The purpose and source device switch while adopting the parameters of the source channel. At this point, it is in the master device response state and the sub-device response state.

3. Transitions between various states:

standby->inquiryWhen a device needs to scan its surroundings to check for other devices, it transitions from standby to the inquiry state. Once in this state, it repeatedly sends inquiry messages. These inquiry messages do not contain any information related to the source, but they may specify which type of devices should respond to the message. Devices in the inquiry scan state can respond to the inquiry messages, but the spec states that not all devices in the inquiry scan state are required to respond to the inquiry messages. Therefore, there is still a certain degree of autonomy.

Devices in the inquiry state will receive responses sent back by the devices that are discovered. It is important to note that devices in the inquiry state do not need to respond to these responses in any form. This is because the frequency range used for inquiry during a certain period is limited.If you want to search for devices across all frequency points, you need to ensure that the minimum inquiry time is 10.24 seconds. This is particularly important.This is also why we usually see some devices, such as Android, set their search time to 10.24 seconds—this is the reason.

inquiry->connection:After discovering a device, you can connect to it based on the information obtained during the search, thereby entering the connection state.

inquiry->standby:If no connection is made or no devices are found, it will return to standby mode after a certain period of time.

connection->inquiry:The comparison between standby and inquiry is quite similar, with the only difference being that standby to inquiry can focus all its resources on performing the inquiry. On the other hand, connection to inquiry requires handling other tasks, such as performing cleanup work like setting the ACL link to sniff mode. If there is an SCO or eSCO connection, it will take higher priority over the inquiry, ensuring the transmission of SCO or eSCO first. Inquiry can only be performed during the idle time in between.

standby->inquiry scan:If a device wants to be discovered, it will enter the inquiry scan state. In this state, if it receives an inquiry message, it can respond.

inquiry scan -> inquiry responseAfter receiving the inquiry message, you can respond to the corresponding inquiry message, thereby entering the inquiry response state.There are two types of inquiry responses.One type is simply responding to the corresponding FHS packet, while the other includes EIR (Extended Inquiry Result) data. Whether there is EIR data is determined by a flag in the FHS.

inquiry response -> inquiry scan:There are two scenarios here. One is that we need to establish a connection with the master to enter the connection state, which must go through the inquiry scan state first, rather than directly entering the connection state. The other scenario is returning to the original standby state, and similarly, we still need to go through the inquiry scan state.

inquiry scan->connection:This is similar to the state transition from inquiry to connection, so there's no need to elaborate further.

connection->inquiry scan:The change in this state is similar to standby->inquiry scan, so there's no need to elaborate further.

standby -> page scan:If a device wants to be paged, it needs to enter the page scan state.

Page scan -> slave response:After receiving the message from the page, the device performing the page scan will send the corresponding response message and then transition to the slave response state.

slave response->connection:After the first response, the interaction between the master and the slave is not completely finished. They still have other message exchanges. Once the master receives the slave's response, it will send the corresponding FHS packet. At this point, the slave device in the response state needs to reply with another response. When the master receives this second response, it will send a poll packet. From this moment on, the slave officially enters the connection state (step 5). For more details, please refer to the diagram below.
 

Slave response -> Page scan:This is where the process mentioned above encounters an issue, which will result in reverting to the pagescan state.

Page scan -> connection:It is important to note that this is not a normal process. It occurs after connection->pagescan when the page fails, and it returns to the connection state instead of going from standby->page scan->connection. This is similar to the transition from page scan to standby.

Page scan -> Standby:The page failed and returned to the previous standby state.

connection->page scan:Similar to standby to page scan.

standby/connection->page:If you want to page a device, you need to enter the paging state.

page->standby/connection:The same page failure response corresponds to the initial state.

page->master response:After receiving the slave's response, respond with the corresponding FHS packet, thereby transitioning into the master response state.

master response -> connection:The slave response to the connection is similar to synchronization, without going into details.

master response->page:Similarly, when an issue occurs above, it reverts back to the state of the page.

connection->standby: ThisDisconnecting is much simpler compared to establishing a connection, which requires going through many intermediate steps. Disconnecting, on the other hand, can be done directly without much hassle. Of course, in theory, it still needs to be done through a reset or detach command.