BLE Command Format#
This section explains the general command format, commands should be sent to the module in the specified format.
Format is same for both Classic and LE modes.
Commands are sent to the module and responses are read from the module using frame write/ frame read (as mentioned in the preceding sections), these commands are called as command frames.
The format of the command frames are divided into two parts:
Frame descriptor (16 bytes)
Frame Body / Payload (multiples of 4 bytes)
The Command frame format is shown below. This description is for a Little Endian System.
The following table provides the general description of the frame descriptor.
Frame Descriptor#
Word | Frame Descriptor |
|---|---|
Word0 W0[15:0] | Bits [11:0] – Length of the frame Bits [15:12] – 2 (indicates Bluetooth packet). |
Word1 W1[15:0] | Bits [15:0] – Packet type |
Word2 W2[15:0] | Reserved |
Word3 W3[15:0] | Reserved |
Word4 W4[15:0] | Reserved |
Word5 W5 [15:0] | Reserved |
Word6 W6 [15:0] |
|
Word7 W7 [15:0] | Reserved |
Three types of frames will get exchanged between the module and the host.
Request/Command Frames - These are sent from Host to Module. Each Request/ Command has an associated response with it.
Response Frames – These are sent from Module to Host. These are given in response to the previous Request/Command from the Host. Each command has a single response.
Event Frames – These are sent from Module to Host. These are given when there are multiple responses for a particular Request/Command frame. There is an Asynchronous message to be sent to host.
The following are the types of frame requests and responses and the corresponding codes. The commands are different for both Classic and LE modes. The below Table lists the Command, Response and Event frames in LE mode.
In both the modes, the corresponding code is to be filled in W1 [15:0] mentioned in the Table above.
Frame Request Types and Responses together with corresponding Codes#
Command | Command ID |
|---|---|
Set Local Name | 0x0001 |
Get Local Name | 0x0002 |
Get RSSI | 0x0005 |
Get Local BD Address | 0x0007 |
Advertise | 0x0075 |
scan | 0x0076 |
connect | 0x0077 |
disconnect | 0x0078 |
Query Device State | 0x0079 |
connection parameter update | 0x007A |
Start Encryption | 0x007B |
SMP Pair Request | 0x007C |
SMP Response | 0x007D |
SMP Passkey | 0x007E |
Query Profiles list | 0x007F |
Query Profile | 0x0080 |
Query Characteristic Services | 0x0081 |
Query Include Services | 0x0082 |
Read Characteristic Value by UUID | 0x0083 |
Query Attribute Descriptor | 0x0084 |
Query Attribute Value | 0x0085 |
Query Multiple Attribute Values | 0x0086 |
Query Long Attribute Values | 0x0087 |
Set Attribute Value | 0x0088 |
Set Attribute Value No Ack | 0x0089 |
Set Long Attribute Value | 0x008A |
Set Prepare Long Attribute Value | 0x008B |
Execute Long Attribute Value Write | 0x008C |
Initialize BLE module | 0x008D |
De-initialize BLE module | 0x008E |
Antenna Select | 0x008F |
Add New Service | 0x0092 |
Add New Attribute | 0x0093 |
Set local attribute value | 0x0094 |
Get local attribute value | 0x0095 |
Notify request | 0x0096 |
Set advertise data | 0x009C |
Get LE ping timeout | 0x00A1 |
Set LE ping timeout | 0x00A2 |
Set Random Address | 0x00A3 |
Data Encrypt | 0x00A4 |
GATT Read | 0x00A5 |
scan Response | 0X00A8 |
White List | 0X00AA |
Remove Service | 0X00AB |
Remove Attribute | 0X00AC |
Resolvlist | 0X00AD |
Get Resolvlist Size | 0X00AE |
Set Resolution Enable | 0X00AF |
Read Phy | 0X00B0 |
Set Phy | 0X00B1 |
Set Data Length | 0x00B2 |
Read Data Length | 0x00B3 |
Set Privacy Mode | 0x00B4 |
CBFC connection Request | 0x00B5 |
CBFC connection Response | 0x00B6 |
CBFC Tx Data | 0x00B7 |
CBFC disconnect | 0x00B8 |
LE LTK Request Reply | 0x00BA |
Rx Test Mode | 0x00BB |
Tx Test Mode | 0x00BC |
End Test Mode | 0x00BD |
Vendor Specific | 0x00BE |
PER Tx Mode | 0x00BF |
PER Rx Mode | 0x00C0 |
Profiles Async Request | 0x00F2 |
Profile Async Request | 0x00F3 |
Get char services Async | 0x00F4 |
Get Include services Aync | 0x00F5 |
Read char value by UUID Async | 0x00F6 |
Get attribute Async | 0x00F7 |
Get Descriptor value async | 0x00F8 |
Get multiple values Async | 0x00F9 |
Get Long desc values Async | 0x00FA |
Set desc value Async | 0x00FB |
Set prepare write Async | 0x00FC |
Execute Long desc write Async | 0x00FD |
Response IDs in BLE Mode#
Response | Response ID |
|---|---|
Card Ready | 0x0505 |
Set Local Name | 0x0001 |
Get Local Name | 0x0002 |
Get RSSI | 0x0005 |
Get Local BD Address | 0x0007 |
Advertise | 0x0075 |
scan | 0x0076 |
connect | 0x0077 |
disconnect | 0x0078 |
Query Device State | 0x0079 |
connection parameter update | 0x007A |
Start Encryption | 0x007B |
SMP Pair Request | 0x007C |
SMP Response | 0x007D |
SMP Passkey | 0x007E |
Query Profiles list | 0x007F |
Query Profile | 0x0080 |
Query Characteristic Services | 0x0081 |
Query Include Services | 0x0082 |
Read Characteristic Value by UUID | 0x0083 |
Query Attribute Descriptor | 0x0084 |
Query Attribute Value | 0x0085 |
Query Multiple Attribute Values | 0x0086 |
Query Long Attribute Values | 0x0087 |
Set Attribute Value | 0x0088 |
Set Attribute Value No Ack | 0x0089 |
Set Long Attribute Value | 0x008A |
Set Prepare Long Attribute Value | 0x008B |
Execute Long Attribute Value Write | 0x008C |
Initialize BLE module | 0x008D |
Deinitialize BLE module | 0x008E |
Antenna Select | 0x008F |
Add New Service | 0x0092 |
Add New Attribute | 0x0093 |
Set local attribute value | 0x0094 |
Get local attribute value | 0x0095 |
Notify Response | 0x0096 |
Indicate value | 0x0097 |
Set advertise data | 0x009C |
Get le ping timeout | 0x00A1 |
Set le ping timeout | 0x00A2 |
Set Random Address | 0x00A3 |
Data Encrypt | 0x00A4 |
GATT Read | 0x00A5 |
scan Response | 0X00A8 |
White List | 0X00AA |
Remove Service | 0X00AB |
Remove Attribute | 0X00AC |
Resolvlist | 0X00AD |
Get Resolvlist Size | 0X00AE |
Set Resolution Enable | 0X00AF |
Read Phy | 0X00B0 |
Set Phy | 0X00B1 |
Set Data Length | 0x00B2 |
Read Data Length | 0x00B3 |
Set Privacy Mode | 0x00B4 |
CBFC connect Request | 0x00B5 |
CBFC connect Response | 0x00B6 |
CBFC Tx Data | 0x00B7 |
CBFC disconnect | 0x00B8 |
LE LTK Request Reply | 0x00BA |
Rx Test Mode | 0x00BB |
Tx Test Mode | 0x00BC |
End Test Mode | 0x00BD |
Vendor Specific | 0x00BE |
PER Tx Mode | 0x00BF |
PER Rx Mode | 0x00C0 |
Profiles Async Request | 0x00F2 |
Profile Async Request | 0x00F3 |
Get char services Async | 0x00F4 |
Get Include services Aync | 0x00F5 |
Read char value by UUID Async | 0x00F6 |
Get attribute Async | 0x00F7 |
Get Descriptor value async | 0x00F8 |
Get multiple values Async | 0x00F9 |
Get Long desc values Async | 0x00FA |
Set desc value Async | 0x00FB |
Set prepare write Async | 0x00FC |
Execute Long desc write Async | 0x00FD |
Event IDs in BLE Mode#
Event | Event ID |
|---|---|
disconnected | 0x1006 |
GATT Error Response | 0x1500 |
GATT Desc Val Response | 0x1501 |
GATT Primary Service by UUID | 0x1502 |
GATT Read Char Services | 0x1503 |
GATT Read Include Services | 0x1504 |
GATT Read Val by UUID | 0x1505 |
GATT Read Response | 0x1506 |
GATT Read Blob Response | 0x1507 |
GATT Read Multiple Response | 0x1508 |
GATT Primary Service list | 0x1509 |
GATT Write Response | 0x150A |
GATT Prepare Write Response | 0x150B |
GATT Execute Write Response | 0x150C |
scan Response | 0x150E |
connection Status | 0x150F |
SMP Request | 0x1510 |
SMP Response | 0x1511 |
SMP Passkey | 0x1512 |
SMP Failed | 0x1513 |
GATT Notification | 0x1514 |
GATT Indication | 0x1515 |
Encrypt Status | 0x1516 |
GATT Write | 0x1517 |
LE ping timeout expired | 0x1518 |
Prepare Write | 0x1519 |
Execute Write | 0x151A |
GATT Read | 0x151B |
MTU size | 0x151C |
SMP passkey display | 0x151D |
Phy Update Complete | 0x151E |
Data length change event | 0x151F |
SMP SC Passkey | 0x1520 |
Enhanced connection Event | 0x1521 |
Directed Advertising Report | 0x1522 |
Security Keys | 0x1523 |
PSM connection Request | 0x1524 |
PSM connection Complete | 0x1525 |
PSM Rx Data | 0x1526 |
PSM disconnect | 0x1527 |
LE LTK Request | 0x152A |
connection Update Complete | 0x152B |
Remote Features | 0x152C |
BLE More Data Request | 0x152D |