Fluke Electronics FBLE Radio Module User Manual Module Manual

Fluke Electronics Radio Module Module Manual

Module Manual

Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
Fluke FBLE Radio Module
Developers Guide
Fluke Mfg Co.
Oct 8, 2013
V1.0
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
Table of Contents
Table of Contents .......................................................................................................................................... 2
Introduction .................................................................................................................................................. 3
Comprehensive Integration Instructions for Fluke FBLE radio module ........................................................ 3
Interface to external Microprocessor ........................................................................................................... 3
Physical Interface ...................................................................................................................................... 3
Software Interface .................................................................................................................................... 3
Network Command Communication .................................................................................................... 4
Device Command Communication ....................................................................................................... 4
Device Notification Communication ..................................................................................................... 5
SPI Data Packets .................................................................................................................................... 5
SPI Packet Formats ................................................................................................................................ 6
SPI Packet Field Definitions ................................................................................................................... 7
SPI Packets are Big-Endian .................................................................................................................... 8
Network Control Commands ................................................................................................................ 8
Network Control Commands .............................................................................................................. 10
Device Control Command Payloads .................................................................................................... 11
Device Control Command Responses ................................................................................................. 12
Interrupt Status Word ......................................................................................................................... 14
Network Control Commands and Responses are Big-Endian ............................................................. 15
BLE Custom UUID .................................................................................................................................... 15
1. Introduction .................................................................................................................................... 15
Custom UUID Ranges .......................................................................................................................... 15
Firmware Upgrade over BLE ................................................................................................................... 22
Required Items .................................................................................................................................... 22
Upgrade Process ................................................................................................................................. 23
Reference material .............................................................................................................................. 24
External processor upgrade over BLE ..................................................................................................... 24
Overview ............................................................................................................................................. 24
Required Items .................................................................................................................................... 25
Upgrade Process ................................................................................................................................. 25
Reference material .............................................................................................................................. 26
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
Introduction
This document is intended to allow developers to work with the CC2540 based BLE Slave Module.
Comprehensive Integration Instructions for Fluke FBLE radio module
LABELING REQUIREMENTS FOR END-PRODUCT
The Original Equipment Manufacturer (OEM) must ensure that FCC labeling requirements are met. The
FBLE module is labeled with its own FCC ID and IC Certification Number. The FCC ID and IC certification
numbers are not visible when the module is installed inside another device. The final end product must
be labeled in a visible area with the following:
“Contains Transmitter Module FCC ID: T68-FBLE”
“Contains Transmitter Module IC: 6627A-FBLE”
The Fluke FBLE Module has been certified with its own on-board antenna and must not be used with
other antenna(s).
Interface to external Microprocessor
Physical Interface
The CC254x based Slave module uses a modified SPI interface to communicate as a SPI Slave
device. The Interface needs to be configured as described below.
• The SPI interface is implemented in the 4-wire configuration consisting of signals RFEN (i.e., chip
select line), SIMO, SOMI and SCK.
• The BUSY line must go low before the master begins to clock data. The BUSY line must be
checked between each byte transaction as well.
• A Interrupt line is provided to allow the radio to notify the SPI master when there is data
pending. The line is level triggered. When the line is high, the Interrupt Status word should be
read. When the line is low, no data is pending.
• SPI port speed is controlled by the master or slave application up to a maximum speed of 4
MHz.
• Positive clock polarity, non-delayed clock phase, MSB sent first.
Software Interface
The BLE Radio uses a propriety packet format. This format allows the radio to be configured via
network control commands, and allows data to be passed via device control commands. In order to
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
support a number of BLE based service, the host processor can also generate a number of event items in
a response style pack as well.
Network Command Communication
Unless otherwise noted in the detailed command description, all communications use the following
process. The following abbreviations are used in the description:
• MA: Master Application
• MRA: Master Radio Application
Step
#
Master Application
Master Radio
1
MA formats a command
2
MA clocks the command over the SPI
to the MRA
3
MRA sets Busy high
4
MRA process the command
7
MRA formats a command response to be transmitted
over the SPI to the MR
8
MRA sets Busy low
9
MA clocks the response over the SPI
from the MRA
10
MA processes the response
Device Command Communication
In the BLE radio setup, the device commands are used to get legacy data out of the host processor into
the BLE radio for use by the TI BLE Stack.
Unless otherwise noted in the detailed command description, all communications use the following
process. The following abbreviations are used in the description:
• MA: Master Application
• MRA: Master Radio Application
Master Application
Master Radio
Command received from BLE, or timer expires. Command is generated
to be sent to MA. Once command is ready, INT line is set high.
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
MA clocks out new command
from MRA
MA processes command from
MRA
MA Clocks data back to MRA
once BUSY line is low.
Return data is processed. Data is either stored in BLE stack for BLE
Master, or sent back to BLE master via Notification command.
Device Notification Communication
The Notification style of data consists of a number of small data packets of variable length. This format
allows common data that is grouped together to be sent over to the BLE radio as it is available.
Unless otherwise noted in the detailed command description, all communications use the following
process. The following abbreviations are used in the description:
• MA: Master Application
• MRA: Master Radio Application
Master Application
Timer expires, or local data is updated,
triggering a notification event. New
Notification packet is created.
MA clocks out new command from MRA
MA processes command from MRA
MA Clocks data back to MRA once BUSY line is
low.
stack for BLE Master, or sent back to BLE master via
ACK sent back from MRA
SPI Data Packets
SPI Packet Types and Enumeration
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
Packet Type
Description
Enumeration
Payload
Command
ACK
(C_ACK)
Response from the radio to the
application upon receipt of a
Control Command.
0x01
None
Application
ACK
(A_ACK)
Response from a slave to the
master upon receipt of a Device
Control Command which
requires no data returned.
0x02
None
Network
Control
Network Control Command.
0x03
See
NetworkControlCommands
Device
Control
Device Control Command.
0x04
See
DeviceControlCommands
Single Data
Transfer
Data sent from a slave to a
master.
0x06
Command
Data Transfer
Data returned after reading the
Interrupt status word or a
Network Control command data
request.
0x07
SPI Packet Formats
C_ACK Packet
Packet Field
Length
Fluke Preamble
Packet Type
C_ACK Error
CRC
Size in Bytes
1
4
1
1
2
A_ACK Packet
Packet Field
Length
Packet Type
RF Signal Strength
A_ACK error
CR
C
Size in Bytes
1
1
1
1
2
Network Control Packet
Packet Field
Length
Packet Type
Command
Enumeration
Payload
CRC
Size in
Bytes
1
1
1
0-89
2
Device Control Packet
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
Packet
Field
Length
Packet
Type
Slave
Device
Number
Time to Next
Transmission
Device
Command
Enumeration
Payload
CR
C
Size in
Bytes
1
1
1
1
1
0-87
2
Single Data Transfer Packet
Packet Field
Length
Packet Type
RF Signal Strength
Payload
CR
C
Size in Bytes
1
1
1
0-89
2
Command Data Transfer Packet
Packet Field
Length
Packet Type
Payload
CRC
Size in Bytes
1
1
0-90
2
SPI Packet Field Definitions
• Length
o Number of bytes following the length field.
• Packet Type
o See SPI Packet Types
• RF Signal Strength
o A number indicating the RF signal strength measured at the radio. The BLE radio
adds these values in, all the application has to do is leave a blank byte to be filled.
• Slave Device Number
o The numerical identity of a slave as determined by the discovery process.
• Time to Next Transmission
o The time until the next transmission from the master to the slave. This
information is used by the slave radio module to schedule when its radio needs to
be in receive mode. The minimum time allowed is 160ms, the maximum is 5.120
seconds and the resolution is 120ms. To calculate the value to be entered into this
field, N, from a desired time to next transmission, T (in seconds), use one of the
two formulas.
N = integer(T / 160)
For example, for a time to next transmission of 480ms, N = 3.
• Device Command Enumeration
o A number identifying the Device Control Command being sent. See BLE Device
Control Commands
• Payload
o Any data being transmitted.
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
• C_ACK or A_ACK Error
o 0 = No error, 1 = Invalid Command, 2 = Invalid Device Number, 3 = CRC error.
• CRC
o a 16-bit CRC. The CRC is calculated using a initial value of 0xffff, and a poly
value of 0x8408. This is based on the CRC-16-CCITT algorithm.
SPI Packets are Big-Endian
Unless specified otherwise in this documentation, multi-byte numeric fields in BLE SPI packets
are big-endian.
Network Control Commands
Command
Description
Enumeration
Command
Payload
Response
to
Command
Notes
Set Channel
Use specified
channel for all
following
transmissions.
Intended for use in
certification.
0x01
Channel #, 1
byte unsigned
value between
11 and 26
C_ACK
Used by
FCC Testing
and
Developer
packet
sniffing
Only.
Set Power
Use specified
power for all
following
communication.
0x02
Power - see
PowerLevels
C_ACK
Used by
FCC Testing
Only.
Turn On
Transmitter
Transmit
continuously. Used
for certification of
the radio module.
0x03
None
C_ACK
Used by
FCC Testing
Only.
Get
Interrupt
Status
Get the status
word from the
radio module
which indicates
the cause of the
interrupt.
0x05
None
Command Data Packet with the
Interrupt Status word
Used by
low level
interrupt
service
code.
Power
On
Power up the
radio in the
specified mode.
0x06
Mode (0 =
slave, 1 =
master)
C_ACK
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
Also perform a
checksum test.
Power
Off
Power off the
radio.
0x07
None
C_ACK
Get Data
Get a
information
from the radio
based on the
interrupt.
0x08
Interrupt
Status
received
from a Get
Interrupt
Status
command.
Depends on interrupt status
(See Network Control
Command Interrupts)
Used by
low level
interrupt
service
code.
Get
Version
Get the
software
version from
the radio
module.
0x09
None
Radio software version in a
Command Data Transfer
Packet. The version number is
encoded in a ASCII string, the
format of the version number
will be 'BLE xx.yy.zzbd' xx =
BLE APP Major version, yy =
BLE APP Minor Version zz =
BLE APP sub-Minor Version b
= 'b' for beta (e.g non release), '
' for release, ‘d’ = Development
version
Flash
Erase
Erase the flash.
0x0f
Slave device
number, if 0,
the local
radio.
C_ACK
Firmware
update only
command
Flash
Write
Write a new
program
fragment to
flash.
0x10
Slave device
number, if 0,
the local
radio.
C_ACK
Firmware
update only
command
Flash
Verify
Verify the
newly loaded
code.
0x11
Slave device
number, if 0,
the local
radio.
C_ACK
Firmware
update only
command
Flash
Swap
Send C_ACK,
swap to the
newly loaded
code and reset.
0x12
Slave device
number, if 0,
the local
radio.
C_ACK
Firmware
update only
command
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
When the radio module needs to communicate with the application it requests service via the
IRQ interrupt line. In response to this interrupt, the application will send the Get Interrupt Status
command to the radio module. The radio will respond with a two byte interrupt status word
detailed below. Depending on the interrupt cause, the application may then send the Get Data
network control command, with the interrupt status word as a payload, to get further information
from the radio. Only one bit in the payload should be set. If more than one bit is set, only the
least significant set bit will be processed. The interrupt status word is cleared after the Get
Interrupt Status command has been serviced.
Network Control Commands
Command
Description
Enumeration
Command
Payload
Response to
Command
Query Device
Info
Get device ID string.
0x01
None
C_ACK or A_ACK
or Device ID string
contained in a Single
Transfer Data Packet
Query user
String
Get user programmed
string.
0x04
None
C_ACK or A_ACK
or user string
contained in a Single
Transfer Data Packet
Set user
String
Set device user string.
0x05
User String
C_ACK or A_ACK
Activate
Locator
Activate the visual
location indicator.
0x09
Locator
C_ACK or A_ACK
Query
measurement
Get measurement
data.
0x0a
None
C_ACK or A_ACK
or Measurement
value contained in a
Single Transfer Data
Packet
Clear Stored
Data
Clear logged data.
0x0b
None
C_ACK or A_ACK
Get System
Status
Get a data containing
status for Logging,
power and firmware
0x0c
None
C_ACK or A_ACK
or System Status data
in in a Single
Transfer Data Packet
Set logging
mode
Start or stop logging
0x0d
Logging Mode
C_ACK or A_ACK
Set Time
Set the real time
clock.
0x10
Time
C_ACK or A_ACK
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
Query Time
Get the real time
clock value.
0x11
None
C_ACK or A_ACK
or Time value
contained in a Single
Transfer Data Packet
Erase
Program
Memory
Erase the memory
used to store the new
program.
0x13
None
C_ACK or A_ACK
Store Program
Fragment
Store a fragment of
the new program.
0x14
Code Fragment
C_ACK or A_ACK
Verify
Program
Verify the stored new
program, see system
data to get status
0x15
None
C_ACK or A_ACK
Load Program
Load the new
program and reset.
0x16
None
C_ACK or A_ACK
Execute
Command
This is a pass thru
function telling the
remote application to
execute the command
in the payload.
0x17
Command to
be executed.
C_ACK or A_ACK
or Response in a
Single Transfer Data
Packet
Configure
Logging
Set the logging
interval and duration
in seconds.
0x018
Logging
Configuration
data
C_ACK or A_ACK
Device Control Command Payloads
• User String
• A User defined string of up to 86 bytes in UTF8 format (86 - 21 characters depending on
the characters).
• The string should not be NULL-terminated. The payload length is used to determine the
length of the string.
• Locator
• 1 byte value, unsigned integer, 0: Deactivate Locator, 1: Start Locator . Note that this
behavior is device family specific. A Locator beacon may turn off automatically after
several seconds.
• Logging Mode
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
• 1 byte value, unsigned integer, 0: Stop Logging, 1: start logging.
• Logging Configuration data
•
Interval
Duration
4 byte unsigned integer, log interval in
seconds
4 byte unsigned integer, log duration in
seconds
• Time
• A time value used to set a real time clock, 64 bit signed int, POSIX format.
• Code Fragment
• A fragment of the new code intended to replace the software in the remote device. A code
fragment is defined to be one line of an Intel format hex file minus the beginning colon
and the two byte checksum at the end of the line. The maximum fragment length is 40
bytes. All hex file lines are considered code fragments independent of the record type and
should be sent to the remote device.
Device Control Command Responses
• Device Info
o A comma separated string containing the manufacture name and model, firmware
rev, and serial number. For example: FLUKE 289,V1.01,78080001 .
• User String
o A User defined string of up to 86 bytes in UTF8 format (86 - 21 characters
depending on the characters).
o The string is not NULL-terminated. Use the payload length to determine the
length of the string.
• Measurement
o A multi-byte value containing the measured value and any annunciators required.
The most significant byte defines the format of the measurement data and the
following bytes contain the measurement data.
Format
byte
Measurement Data Description
0 = Meter
style
Field
reading
unit
multiplier
unit
ac
or
bolt
inrush
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
measuremen
t data.
All data is
ASCII
characters.
d
c
Size in
bytes
6
1
4
2
1
2
Descriptio
n
Allows
for 4
digits, a
decimal
and a
minus.
Right
justified
.
n, u, k, m,
M, or
space for
no
multiplier
.
V, A,
OHMS,
H,
VHZ, F,
DEGC,
DEGF,
R
Left
justified
.
ac
or
d
c
* if
the
bolt
is on
or
spac
e if
not.
The
word
'in' or
two
spaces
.
1 = TBD
• System Status data
o A multi-byte value containing the Logging state and settings, the system power
information, and the firmware information.
For
mat
byt
e
System Status Data Description
0 =
Arg
enta
Syst
em
data
.
All
data
is
Bin
ary
Field
Pow
er
Batt
ery
level
Power State
Firmwa
re State
Logg
ing
State
Log
-
Tota
l
Byte
s
Log
-
Use
d
Byte
s
Log
-
Inter
val
Log
-
Dur
atio
n
Size
in
bytes
1
1
1
1
4
4
4
4
Descr
iption
Unsi
gned
Int -
Batt
ery
perc
ent
Battery State
Enum:
0:Good,1:Lo
w,2:Locked
down,3:No
Battery ,4:
External
Firmwa
re
Enum:
0:Idle,
1:Erasin
g Flash,
2:Progr
Logg
ing
state
enum
:
0:Idle
,
unsi
gne
d
inte
ger,
total
num
unsi
gne
d
inte
ger,
used
byte
unsi
gne
d
inte
ger,
logg
ing
unsi
gne
d
inte
ger,
logg
ing
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
from
0 to
100
Power,
5:Charging
amming
Flash,
3:Verif
y in
progres
s,
4:Verif
y
passed,
5:Verif
y failed
1:Lo
gging
,
2:Not
Supp
orted
ber
of
byte
s for
logg
ing
in
byte
s.
s for
logg
ing
in
byte
s
inter
val
in
seco
nds
dura
tion
in
seco
nds
1 =
TB
D
• Time
o A time value from the real time clock, 64 bit signed int POSIX format.
Interrupt Status Word
Command Bit
(0 = LSB)
Description
Response to Get Data command
with this payload
0
Discovery complete
Command Data Packet containing the
number of slaves discovered.
1
Packet Received
Single Transfer Data Packet, A_ACK
or C_ACK packet received from
slave
2
Loss of Communication (Used to tell
a master it has lost a particular slave.)
Command Data Transfer packet
containing the slave device number
which has been lost.
3
Bound State Initiated (Used to tell a
slave application it has become
bound.)
None
4
Bound State Terminated (Used to tell
a slave application it has become
unbound.)
None
5
Checksum of radio software failed
None
6
Talk to Slave
Command Data Packet with the slave
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
number who is ready to be talked
with.
7-15
Reserved
Network Control Commands and Responses are Big-Endian
Unless specified otherwise in this documentation, multi-byte numeric fields in Network Control
Commands, their payloads and their responses are
BLE Custom UUID
1. Introduction
In order to create non-standard Bluetooth Low Energy field, we needed to create a custom set of
UUID values. The 'base' 128-bit UUID that we are using for all of these services is B698XXXX-
7562-11E2-B50D-00163E46F8FE, where the XXXX will be replaced with the number listed
below.
For now, our 16-bit ranges are following the range rules laid out for the BLE standard range.
• 0x1800 - 0x26FF : Service UUID
• 0x2700 - 0x27FF : Units
• 0x2800 - 0x28FF : Attribute Types
These are pulled from "Bluetooth Low Energy The Developer's Handbook" by Robin Heydon,
1st publishing, page 191 (Section 10.2.3). You'll note that we didn't do a range for the
Characteristic Descriptors or the Characteristic Types, that is because these do not need to be
customized.
Custom UUID Ranges
Services
2.2. 0x1800 : FWCS Display reading
• CC254x Module: Active as of 00.00.03
• FWCS Display reading service. Has a 16 Byte ASCII string representing the display
value.
2.3. 0x1801 : CNX Services
• CC254x Module: Active as of 00.00.05
• CNX Services (Module ID, Name settings?, Serial pass-thru?, etc..)
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
2.4. 0x1802 : IG Log Data Services
• CC254x Module: Active as of 00.00.06
• IG Log Data Services (Get Logging status, Setup Logging parameters)
2.5. 0x1803 : IG Debug Services
• CC254x Module: Active as of 00.00.07
• IG Debug Services (Send / RX data - additional debug items as needed -- MSP430
asserts?)
2.6. 0x1804 : TI OAD Service
• CC254x Module: Active as of 00.00.15
• TI OAD Service (Firmware Update for the radio), moved to new number so TI devices
don't try to update our devices.
Characteristics
3.1. 0x2900 : SPI Transaction Count
• CC254x Module: Deprecated in 00.00.03
• SPI Transaction Count. uint8, rolling counter of SPI transaction.
3.2. 0x2901 : Module Display value
• CC254x Module: Active as of 00.00.03
• Module Display value, 16-byte ASCII string. See FWCS documentation for decoding.
3.3. 0x2902 : Model ID Number
• CC254x Module: Active as of 00.00.03
• Model ID Number. uint8, read/write, displayed ID Number on slave unit UI.
3.4. 0x2903 : Module User String
• CC254x Module: Active as of 00.00.05
• Module User String, UTF-8 data, up to 98 bytes. This is the same as modifying the
<<Device Name>> BLE Characteristic. However, this additional item is created in order
to allow Apple products to modify this (they lockout modifying <<Device Name>>
directly).
3.5. 0x2904 : Force Drop
• CC254x Module: Active as of 00.00.05
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
• Force Drop - Writing anything to this item causes the BLE module to drop. This is a
work around for Apple related issues, per Brady H.
3.6. 0x2905 : Set Locator State
• CC254x Module: Active as of 00.00.05
• Set Locator State - write only uint8, 0 to turn off locator, 1 to turn on locator.
3.7. 0x2906 : IG Logging Status
• CC254x Module: Active as of 00.00.06
• IG Logging Status - read only uint8 array, 9 bytes.
•
o
Logging Status Data Description
Field
Logging State
Log - Total Bytes
Log - Used Bytes
Size in
bytes
1
4
4
Description
Logging state enum:
0:Idle, 1:Logging,
2:Not Supported
unsigned integer,
total number of bytes
for logging in bytes.
unsigned integer,
used bytes for
logging in bytes
3.8. 0x2907 : IG Logging Settings
• CC254x Module: Active as of 00.00.06
• IG Logging Settings - read / write uint8 array, 9 bytes.
•
o
Logging Settings Data Description
Field
Log - Interval
Log - Duration
Size in
bytes
4
4
Description
unsigned integer, logging
interval in seconds
unsigned integer, logging
duration in seconds
3.9. 0x2908 : IG Logging Control point
• CC254x Module: Active as of 00.00.07
• IG Logging Control point.
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
o Write a Enum to to this point ask the logging state machine to change. Changes
can be seen via notification of the logging Status characteristic.
o
Enum Value
Meaning
0x00
Stop logging
0x01
Start logging
0x02
Erase logged Data
3.10. 0x2909 : IG Debugging - Read
• CC254x Module: Active as of 00.00.07
• IG Debugging - Read point. ASCII data, up to 87 bytes (see FWCS DCC payload size --
this is matched to that.). No NULL needed.
3.11. 0x290A : IG Debugging - Write
• CC254x Module: Active as of 00.00.07
• IG Debugging - Write point. ASCII data, up to 89 bytes (see FWCS Single Data payload
size -- this is matched to that.). No NULL included.
3.12. 0x290B : Sync / Pass-Thru calls
• CC254x Module: Active as of 00.00.07
• IG Debugging - Number of time a sync / pass thru was called. Temporary, used to
determine how TI stack behaved with blog write.
3.13. 0x290C : BLE Disconnect Code
• CC254x Module: Active as of 00.00.07
• IG Debugging - Code from the last BLE disconnect. values are from ll.h, (The status
values map directly to the HCI Error Codes. Per the Bluetooth Core Specification,
V4.0.0, Vol. 2, Part D.)
3.14. 0x290D : Logging Memory Size
• CC254x Module: Active as of 00.00.12
• LOGGING_MEMSIZE - 4 byte unsigned values representing the size in bytes of the
logging memory.
3.15. 0x290E : POSIX Time
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
• CC254x Module: Active as of 00.00.12
• POSIX_TIME - Read / Nofity back point. Used to set or get the device time in POSIX
format. See FWCS documentation for more info on how we use this value, 8 byte
unsigned integer value.
3.16. 0x290F : Binary Reading
• CC254x Module: Active as of 00.00.12
• READING - Binary format for passing a display reading, see
wiki:Elektra:TechnicalInvestigation/BleServicesMapping/service_flukeReading for more
information, and formatting details (Still under development at this point --
ThomasAnderson 2013-06-25)
3.17. 0x2910 : Reading Nomenclature
• CC254x Module: Active as of 00.00.12
• READING_NOMENCLATURE - ?? Marked, but not yet implimented, need to talk to
John L. -- ThomasAnderson2013-06-25
3.18. 0x2911 : CNX FW Update Control Point
• CC254x Module: Active as of 00.00.14
• FW_UPDATE_CP - CNX Style MSP430 Firmware Update Control point. Write in
"Commands", and it sets the item back to a state. used to update firmware in MSP430.
o
Valu
e
State
0x00
CNX_FW_CP_STATE_IDLE
0x01
CNX_FW_CP_STATE_ERASING
0x02
CNX_FW_CP_STATE_ERASED
0x03
CNX_FW_CP_STATE_BUFFER_CLEARED
0x04
CNX_FW_CP_STATE_BUFFER_WRITING
0x05
CNX_FW_CP_STATE_VERIFYING
0x06
CNX_FW_CP_STATE_VERIFY_PASS
0x07
CNX_FW_CP_STATE_VERIFY_FAIL
0x08
CNX_FW_CP_STATE_SWAPPING
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
0x09
CNX_FW_CP_STATE_ERROR
0x0a
CNX_FW_CP_STATE_BUFFER_FILLING
0x0b
CNX_FW_CP_STATE_SWAP_FAIL
0x0c
CNX_FW_CP_STATE_RADIO_INIT_QUERY
0x0d
CNX_FW_CP_STATE_RADIO_INIT_OFF
0x0e
CNX_FW_CP_STATE_RADIO_INIT_ON
0x0f
CNX_FW_CP_STATE_RADIO_INIT_CHANGING
Valu
e
Command
Note
0x80
CNX_FW_CP_CMD_ERASE_MEM
Erase the Flash
Memory on the
MSP430
0x81
CNX_FW_CP_CMD_CLEAR_BUF
Clear the
FW_UPDATE_BUF in
the radio
0x82
CNX_FW_CP_CMD_WRITE_AND_CLEAR_
BUF
Write the contents of
the
FW_UPDATE_BUF to
the MSP430, then clear
the
FW_UPDATE_BUF
0x83
CNX_FW_CP_CMD_DO_VERIFY
Cause the MSP430 to
verify the local copy of
the new firmware
0x84
CNX_FW_CP_CMD_DO_SWAP
Load the new
Firmware into the
MSP430 (requires a
verify to pass first)
0x85
CNX_FW_CP_CMD_RADIO_INIT_ON
Change device settings
to turn on the radio at
power up.
0x86
CNX_FW_CP_CMD_RADIO_INIT_OFF
Change device settings
to keep the radio off at
power up.
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
0x87
CNX_FW_CP_CMD_RADIO_INIT_CHECK
Query the initial radio
state setting.
3.19. 0x2912 : CNX FW Update Buffer
• CC254x Module: Active as of 00.00.14
• FW_UPDATE_BUF - CNX Style MSP430 Firmware Update Buffer. Used to allow the
master to write up a buffer in chunks, and then write that using the Control point. This is
done so we can use "write no response" in order to maximize the write speed. Clearing
this buffer, and writing this buffer to the MSP430 is done via the FW_UPDATE_CP
characteristic.
3.20. 0x2913 : TI OAD Image Identify
• CC254x Module: Active as of 00.00.15
• TI OAD, Image Identify Characteristics. Works the same as TI, only moved here so other
devices don't try to update us.
3.21. 0x2914 : TI OAD Image Block
• CC254x Module: Active as of 00.00.15
• TI OAD, Image Block Characteristic. Works the same as TI, only moved here so other
devices don't try to update us.
3.22. 0x2915 : User String Buffer
• F3000 BLE DMM: Active as of 00.00.08
• Module User String buffer, UTF-8 data, up to 98 bytes. This is the same as modifying the
<<Device Name>> BLE Characteristic. However, this additional item is created in order
to allow Apple products to modify this (they lockout modifying <<Device Name>>
directly).
3.23. 0x2916 : User String Control Point
• F3000 BLE DMM: Active as of 00.00.08
• Module User String Control Point, allows for clearing, or writing data in the user string
buffer. See 0x2915.
3.24. 0x2917 : Bulk Data Download Interface
• CC254x Module: Active as of 00.00.xx (expcted is 00.00.18 )
• Control point for doing Bulk Data download. Master writes in a block number, and get
back a bunch of notify packets with data.
o Write in :
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
Cmd
State
00
Return total Number of Bytes
01<state[1 byte unsigned int]>
Lock the unit for bulk download, or unlock it. <state>
should be 0x00 for unlock, and 0x01 for lock
02<startByte[4 byte, unsigned
int]><endByte[4 byte, unsigned int]>
System will notify back data in MTU packet sized
from start byte to end byte.
03
Cancel download. If data is comming in and the
master wants to stope the transfer, send this command
• Notify Back: Bytes, in 1 to 18 bytes notify Chunks.
Firmware Upgrade over BLE
• The TI CC254x style upgrade is based on the idea of three sections in code. First off is a
Boot Manager, which decided which image to run. This manager is never updated. The
other two sections are labeled Image A, and Image B. On Power up the Boot manger
decides which image to run. When it is time to update the device, the code in running
image allows for the other image to be erased (in other words, if Image A is running, then
you can only update Image B). Once Image B is updated and verified as good, Image A
will be tweaked so it no longer passes the CRC check. Now the boot manger will run the
newly updated Image B. On the next update, Image A will be erased, updated, and once
verified.. run.
Required Items
• A Over the Air Upgrade File.
o A Image A and Image B File, can be compiled with scons via
"scons rf_module_imgA" or "scons rf_module_imgB"
• System Hardware
o A CNX Style slave unit, which can put the radio into a discoverable state.
o A BLE Master device, capable to driving the process outlined below.
• Firmware
o RF Module with boot loader code present.
o RF Module BLE Services.
BLE Device Information Service ( UUID16 0x180A ).
Firmware Characteristic (Which Identifies the running RF Module
Code).
TI OAD ( UUID128 f000180304514000b000000000000000 )
TI - OAD Img Id Characteristic (UUID128
f000ffc104514000b000000000000000 )
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
TI - OAD Img Block Characteristic (UUID128
f000ffc204514000b000000000000000 )
Upgrade Process
1. Establish Connection between Slave and master.
2. Verify and configure connection.
1. Ensure connection rate is as fast as the master and slave will allow for.
2. Ensure that the slave has all the required services and characteristics.
1. Enable Notify on the <<TI - OAD Img Id>> characteristic.
2. Enable Notification on the <<OAD Img Block>> characteristic.
3. Check the running version in order to see which image to download.
1. Write 0x00 to <<TI - OAD Img Id>>. If we get "0x00" back, then Write
0x01 to <<TI - OAD Img Id>>.
2. <<TI - OAD Img Id>> Now has the block identification information in it.
Size
4 Bytes
2 Bytes
2 Bytes
Name
Image ID
Image Size
Version
Image ID is 4 copies of either a ASCII 'A' (for Image A), or
ASCII 'B" (for Image B). This is the currently running
image on the RF Module.
Size is the size in bytes divided by 4 for the running image.
Version is the image version.
Example: "424242427C000001", Image is A
(0x42,0x42,0x42,0x42), Size is 0x2700 * 4 = 126976
Bytes, ID = 0x0001
If Image A is running, then we can update Image B. If Image B is running,
we can update Image A.
3. Start the download.
1. Get the OAD Summary line (see the line read above from <<TI - OAD Img Id>>)
for the new Image from the raw binary file, and send this to the <<TI - OAD Img
Id>> characteristic.
Open the Raw Binary file, skip the first 4 bytes, and then read out the next
8 bytes. These 8 bytes are the Image Block Identification for this file.
Doing this write starts the upgrade process on the Radio, when the radio is
read to get data it will notify to <<OAD Img Block>>
4. Write each block to the slave.
1. Take the entire Binary file (including the skipped first 4 bytes, and 8 bytes of
Image Block Identification), and break it into 16 byte blocks.
2. Number each block sequentially, starting at 0x0000.
3. When the Slave notifies us with a 16-bit number, that is the ID of the next block
that it wants. (so when we get 0x0000, we should send block 0x0000).
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
Multiple blocks can be written at once using the BLE "Write, No
Response" command. For TI's BLE Stack (V1.3.x), we can write up to 4
blocks at one time.
4. Continue this process until all blocks are written. If a block isn't delivered (due to
being sent with write, no response), the Radio will re-request it when the next
block is written.
5. Loop though this process until all the blocks are written.
5. Wait for the disconnect.
1. After the last block is written, wait for the BLE Slave device to disconnect, the
radio is settings up to use the new firmware image.
6. Re-connect, and verify that the new image loaded by writing a 0x00 or 0x01 to <<TI -
OAD Img Id>> (Don't forget to enable Notifications before doing the write).
Reference material
• Implementation notes at
wiki:Self:TechnicalInvestigation/BleServicesMapping/service_fwDownload
• TI OAD Documentation, located at http://processors.wiki.ti.com/index.php/OAD
• pyFwUpdate.py script in tools/pyBleDongle/pyFwUpdate.py of the Elektra cc2540
GIT repository. (Uses TI CC2540 Development USB Dongle to do a FW upgrade).
External processor upgrade over BLE
This page outlines the process for doing a Firmware update to a CNX style MSP430 based
device over the air, using BLE.
Note that this process is heavily based on the CNX Firmware update process.
Note: For a example implementation, see the pyFwUpdate.py script in
tools/pyBleDongle/pyFwUpdate.py of the Elektra cc2540 GIT repository.
Overview
• The basic sequence of events is a duplicate of the CNX Firmware Update process.
However, due to differences between FWCS and BLE, I had to make some minor
changes. In the BLE style upgrade, the packet size is much smaller (18 bytes instead of
89 bytes). In order to get around this, the BLE radio provides a 'register', which can be
filled with data. This allows us to use the 'write no response' BLE command to send
multiple packets in a single connection event. The Radio then caches these items up, until
they are the same size as the FWCS packet size. This is only needed for the command
uses to write data. The commands to erase the flash, verify the flash, and do the swap
remain as a single action.
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
In this model a 'swap' area is erased, filled with data, and then verified. If it passes the
verify, the data is copied back into the proper program space of the MSP430, and the
device re-boots.
Required Items
• A Firmware File
o a .HEX file, post-processed to ensure longer line length. (Shorter lines work too,
but take much longer).
o File must comply with CNX Verification needs (CRC at minimum, some unit
type checking in some modules too.)
• System Hardware
o A CNX style slave unit, with a BLE radio. Note that some units (Such as the
modules) need to have their swapper built and included to support firmware
update.
o A BLE master device, capable of following the process outlined below.
• Firmware
o a BLE radio which supports CNX style Firmware Updates.
BLE Sevice <<Fluke CNX Services>> (UUID
b6981801756211e2b50d00163e46f8fe) containing:
<<Fluke - FW Update Control Point>> (UUID
b6982911756211e2b50d00163e46f8fe)
<<Fluke - FW Update Buffer>> , (UUID
b6982912756211e2b50d00163e46f8fe)
o MSP430 code which supports Firmware Updates.
o BLE Master capable of binding to the slave, and following the procedure listed
below.
Upgrade Process
1. Establish Connection between Slave and Master.
2. Verify and configure connection.
1. Ensure connection rate is as fast as the master and slave will allow for.
2. Ensure that the slave has all the required services and characteristics.
3. Enable Notifications for <<Fluke - FW Update Control Point>>.
4. Write "CNX_FW_CP_CMD_ERASE_MEM" command to <<Fluke - FW Update
Control Point>>
5. Wait for the state to be notified as "CNX_FW_CP_STATE_ERASED".
6. Write "CNX_FW_CP_CMD_CLEAR_BUF" command to <<Fluke - FW Update
Control Point>>
3. Download new Firmware.
1. use BLE "Write No Response" to write 18 byte chunks of data to <<Fluke - FW
Update Buffer>>, do this until all the data is written out. Note that you may need
to limite the write no response to 4 per connection cycle in order to keep from
overloading TI's BLE Stack.
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
These are the lines from the .hex file, with the leading ':' removed, and the
line checksum (last byte) removed, converted into binary.
2. Once a complete line is written send the
"CNX_FW_CP_CMD_WRITE_AND_CLEAR_BUF" command to <<Fluke -
FW Update Control Point>>
3. Wait for the state to be notified as
"CNX_FW_CP_STATE_BUFFER_CLEARED".
4. Repeat these steps until the entire hex file has been written out.
4. Verify download / Swap in new Firmware.
1. Send the "CNX_FW_CP_CMD_DO_VERIFY" command to <<Fluke - FW
Update Control Point>>.
2. Wait for "CNX_FW_CP_STATE_VERIFY_PASS" or
"CNX_FW_CP_STATE_VERIFY_FAIL" to notify back.
3. if "CNX_FW_CP_STATE_VERIFY_PASS"
1. Send "CNX_FW_CP_CMD_DO_SWAP" command to <<Fluke - FW Update Control
Point>>
2. Wait for master to drop connection.
4. If "CNX_FW_CP_STATE_VERIFY_FAIL"
0. Repeat process from the start, re-erasing the flash and sending the data down again.
Reference material
• <<Fluke - FW Update Control Point>> States :
o 0x00 : "CNX_FW_CP_STATE_IDLE"
o 0x01 : "CNX_FW_CP_STATE_ERASING"
o 0x02 : "CNX_FW_CP_STATE_ERASED"
o 0x03 : "CNX_FW_CP_STATE_BUFFER_CLEARED"
o 0x04 : "CNX_FW_CP_STATE_BUFFER_WRITING"
o 0x05 : "CNX_FW_CP_STATE_VERIFYING"
o 0x06 : "CNX_FW_CP_STATE_VERIFY_PASS"
o 0x07 : "CNX_FW_CP_STATE_VERIFY_FAIL"
o 0x08 : "CNX_FW_CP_STATE_SWAPPING"
• <<Fluke - FW Update Control Point>> Commands :
o 0x80 : "CNX_FW_CP_CMD_ERASE_MEM"
o 0x81 : "CNX_FW_CP_CMD_CLEAR_BUF"
o 0x82 : "CNX_FW_CP_CMD_WRITE_AND_CLEAR_BUF"
o 0x83 : "CNX_FW_CP_CMD_DO_VERIFY"
o 0x84 : "CNX_FW_CP_CMD_DO_SWAP"
• Implementation notes at
wiki:Self:TechnicalInvestigation/BleServicesMapping/service_fwDownload
• Using the dongle to do a Firmware Update
wiki:Argenta:SoftwareGuide/ScriptedFirmwareUpdate
• See commands on v1.00.00 USB Dongle Commands (Interactive)
o Erase Firmware Swap Area
o Store Firmware Fragment in Swap Area
o Verify Firmware in Swap Area
Fluke Corporation Telephone Facsimile Email
PO Box 9090 Everett WA 98206.9090 USA 425.347.6100 425.356.5108 http//www.fluke.com
o Load New Firmware from Swap Area
• See command on FWCS SPI Network Control Commands.
o Flash Erase
o Flash Write
o Flash Verify
o Flash Swap

Navigation menu