Question 1 of 5: WiFi and Bluetooth wireless protocols

Question 1: WiFi and Bluetooth wireless protocols (25 marks)

Question text not reproduced: the examination questions are © Engineers and Geoscientists BC. Open the official past paper (linked at the top of this page) to read the question, then follow the worked solution below.

(a) Structure of a Bluetooth piconet, and how many of each device type

The piconet is the elementary Bluetooth cell. It contains exactly one master and up to seven active slaves, every one of them locked to the master’s native clock and to the pseudo-random hopping sequence derived from the master’s 48-bit device address. The master is simply whichever unit initiated the connection: the role is not a hardware property, and a master/slave switch may be negotiated later if, say, a headset needs to take over scheduling. The master owns the schedule, and everything else in the piconet follows from that single fact.

Membership is expressed as an address, and the width of that address fixes the counts the question asks for. An active slave is given a three-bit active member address; the all-zero code is reserved for broadcast, so only seven distinct active slaves can be addressed at once. A unit that must remain in the piconet but has nothing to carry may be parked: it surrenders its active member address, is issued an eight-bit parked member address instead, and stays synchronised by waking at beacon instants to re-read the master’s clock. Eight bits give 255 parked members. A parked unit can be brought back to active duty in a few slots, which is far faster than the inquiry-and-page procedure needed to admit a stranger, so parking is the mechanism that lets a piconet serve far more than seven devices as long as no more than seven are talking at any instant.

Two intermediate low-power states sit between active and parked and are worth naming because examiners ask for them. In hold mode the slave keeps its active member address but agrees to be silent for a negotiated interval; in sniff mode it keeps the address but listens only in every $N^{\text{th}}$ slot pair, trading responsiveness for battery life. A device that is not a member at all is in standby. Finally, a unit may hold membership in two piconets at once — slave in both, or master of one and slave of another — time-slicing between their hop sequences; the resulting structure is a scatternet, and it is how Bluetooth escapes the seven-slave ceiling without ever making one piconet larger.

(b) How the spectrum is shared inside a piconet

Two multiplexing mechanisms are stacked. In frequency, the piconet uses frequency-hopping spread spectrum over 79 carriers of 1 MHz spanning 2402–2480 MHz, hopping 1600 times per second; the reciprocal of that hop rate defines the fundamental unit of Bluetooth time:

Every member computes the identical hop sequence from the master’s address and clock, so the whole piconet sits on one 1 MHz channel at a time and moves together. Hopping is therefore not how slaves are separated from one another — it is how this piconet is separated from every other piconet and from the WiFi networks sharing the same band, since two uncoordinated hoppers collide only in the slots where their sequences happen to coincide.

In time, the slaves are separated by time-division duplex polling. The master transmits only in even-numbered slots, and a slave may transmit only in the odd slot immediately following a packet addressed to it. There is no contention and therefore no collision inside a piconet: a slave that has not been polled is forbidden to speak, so the master’s polling pattern is the bandwidth allocation.

Detailed example. Take a master with three slaves — a keyboard (S1), a mouse (S2) and a file-transfer peer (S3). In slot 0, on carrier $f_0$, the master sends a one-slot packet addressed to S1; in slot 1, on $f_1$, S1 returns its keystrokes. In slot 2, on $f_2$, the master addresses S2, and in slot 3, on $f_3$, S2 replies. If the master has nothing to send it still transmits a POLL packet, because the poll is the only thing that authorises the reply. When S3 asks for bulk throughput the master grants it a five-slot DH5 packet: the transmission occupies slots 4 to 8 on a single held carrier, and the hop sequence then resumes at the carrier the clock would have reached anyway, so a long packet costs hop diversity rather than synchronisation. The consequence for sharing is arithmetic: if the master polls the three slaves in strict rotation each receives about one third of the roughly 1 Mbit/s gross channel; if instead it favours S3, the DH5 exchange carries 339 bytes in each direction over ten slots, giving the symmetric maximum

in each direction, while a DH5 answered by a one-slot DH1 over six slots gives the asymmetric pair 723.2 kbit/s downstream against 57.6 kbit/s upstream. From version 1.2 onwards adaptive frequency hopping also lets the master delete carriers occupied by a WiFi network from the hop set, which is the practical answer to 2.4 GHz congestion.

(c) Services provided by a BSS and by an ESS

A basic service set is the set of stations coordinated by one access point (or, in the independent case, by nothing at all), and it is identified by the access point’s MAC address used as a BSSID. What a BSS provides are the station services, implemented in every 802.11 station including the access point: authentication and deauthentication, which establish and revoke a station’s identity; privacy (confidentiality), which protects frame bodies on the air; MSDU delivery, the actual carriage of a data unit between stations in the cell; and, in later amendments, QoS traffic scheduling. An independent BSS — the ad hoc mode — provides only these, so stations can exchange frames directly but there is no path off the cell and no support for movement.

An extended service set is two or more infrastructure BSSs joined by a distribution system and presented to the logical link control layer as a single 802-style LAN with one SSID. It adds the distribution system services that a single cell cannot offer: association, which tells the distribution system which access point currently owns a station; reassociation, which moves that ownership to a new access point; disassociation; distribution, the act of delivering a frame to the BSS where the destination actually is; and integration, which translates frames to and from a non-802.11 LAN through a portal. The user-visible payoff is mobility. Within an ESS a station may perform a BSS-transition — reassociate to a different access point — while keeping its MAC address, its IP address and its open transport connections, because the distribution system simply re-points at it. Only an ESS-transition, moving between extended service sets, is allowed to break upper-layer sessions.

(d) Medium access sharing in WiFi, and inter-frame spacing

A radio cannot hear a collision while it is transmitting, because its own signal is many orders of magnitude stronger at its antenna than any distant one. 802.11 therefore cannot use the collision detection of Ethernet and instead uses collision avoidance with positive acknowledgement: the distributed coordination function senses the medium, waits a defined idle period, waits a further random backoff, transmits, and infers a collision from the absence of an acknowledgement. Sensing is done twice over — physically at the antenna, and virtually through the network allocation vector, a countdown loaded from the duration field of any frame overheard, which keeps a station quiet for an exchange it can hear the start of but not the end of.

Inter-frame spacing is how priority is granted without any central arbiter: the shorter the idle period a station is entitled to wait, the sooner it may start, and therefore the more surely it wins. The ranking is SIFS, then PIFS, then DIFS, then EIFS.

• SIFS (short inter-frame space) is the shortest and covers only receive-to-transmit turnaround, propagation and physical-layer processing. It is used by every frame that continues an exchange already won: the acknowledgement, the clear-to-send answering a request-to-send, the next fragment of a burst, and the reply to a poll. Because nothing else may start that soon, an exchange in progress is never interrupted.
• PIFS (point coordination inter-frame space) equals SIFS plus one slot and is used by the point coordinator in the access point to seize the medium at the start of a contention-free period. Being shorter than DIFS, it always beats an ordinary station.
• DIFS (distributed inter-frame space) equals SIFS plus two slots and is the idle period an ordinary station must observe before it may begin a new transmission.
• EIFS (extended inter-frame space) replaces DIFS after a frame is received in error, on the assumption that an exchange is under way whose duration could not be read.

The two arithmetic identities behind the table are $\text{PIFS} = \text{SIFS} + T_{\text{slot}}$ and $\text{DIFS} = \text{SIFS} + 2\,T_{\text{slot}}$, and they hold for both physical layers in service in 2013: the 802.11b direct-sequence layer with a 20 $\mu$s slot and a 10 $\mu$s SIFS gives PIFS 30 $\mu$s and DIFS 50 $\mu$s, while the 802.11a/g OFDM layer with a 9 $\mu$s slot and a 16 $\mu$s SIFS gives PIFS 25 $\mu$s and DIFS 34 $\mu$s.

After the DIFS the station draws a backoff counter uniformly from $[0,\ CW-1]$ slots and decrements it once per idle slot, freezing whenever the medium goes busy and resuming after the next idle DIFS. It transmits when the counter reaches zero. A missing acknowledgement doubles $CW$ from $CW_{\min}$ (15 or 31, depending on the physical layer) towards $CW_{\max}=1023$ and the frame is retried. Freezing rather than redrawing the counter is what makes the scheme fair: a station that has already deferred once carries a shorter residual backoff than a newcomer and so gets served sooner. Where hidden terminals are a problem, an optional RTS/CTS handshake above a length threshold reserves the medium through the network allocation vector before the data frame is committed.