RF Wireless World

Browse articles, tutorials, tools, and vendors.

Guide to Bluetooth Channel Selection & RF Testing Modes

By RF Wireless Expert Team

In traditional Bluetooth Low Energy (LE), channel selection (hopping) is used to avoid interference. Channel Sounding (CS) concept in BLE uses this highly advanced hopping mechanism.

Channel Sounding is a feature used for high accuracy, secure distance measurement between two devices (an Initiator and a Reflector) using Round Trip Time (RTT) and Phase Based Ranging.

The Role of the DRBG (Deterministic Random Bit Generator)

To prevent “Man in the Middle” (MITM) attacks where a bad actor might guess the next channel and spoof distance measurements, CS uses a cryptographic “DRBG”.

  • Both the Initiator and Reflector use a shared secret key and a sequence of counters to seed their internal DRBGs.
  • This ensures both devices independently calculate the exact same highly randomized channel hopping sequence without ever having to transmit the next channel over the air.

Channel Selection Algorithm #3 Variations

Algorithm #3 restricts hopping to the 79 available 2.4 GHz ISM channels (excluding prohibited ones) and is broken down into three sub algorithms depending on the type of CS step being executed as described below.

  • Algorithm #3a (For Mode 0 Steps): Mode-0 steps are used by devices to measure and synchronize frequency and clock offsets. Algorithm #3a takes the available channel map and uses the DRBG to randomly shuffle them into a uniform distribution.
  • Algorithm #3b (For Non Mode-0 Steps - Uniform): Used for actual distance measurement steps (Mode-1 for RTT, Mode-2 for Phase, Mode-3 for both). Like #3a, it provides a uniform, randomized shuffle of the available channels.
  • Algorithm #3c (For Non Mode-0 Steps - Shaped/Ramped): This is a highly specialized algorithm used for Phase-based distance measurements. To accurately measure phase differences and calculate distance, the devices need to measure across a wide swath of frequencies in a structured way, while still remaining unpredictable to attackers.
    • It generates frequency hopping “shapes,” specifically a “Hat” pattern (frequencies ramp up, then ramp down) or an “X” pattern (interleaved rising and falling frequencies).
    • These ramps help the devices mathematically compensate for local clock drift and physical movement (Doppler effect) during the measurement.
    • To keep the pattern secure, the algorithm injects random “Salt” channels into the Hat or X patterns, obscuring the mathematical shape from eavesdroppers.

RF/PHY Testing and Unified Test Protocol (UTP)

To ensure that Bluetooth devices can accurately perform these complex communications (e.g. sending Phase measurement tones or standard data), manufacturers must rigorously test the radio hardware. Bluetooth specification mentions “RFPHY Test Modes” driven by “Unified Test Protocol (UTP)”.

The Test Architecture

Testing involves an “Upper Tester” (i.e. computer/software controlling the test) and “Implementation Under Test (IUT)” (the Bluetooth device). They communicate via following interfaces.

  • 2-Wire UART: A physical serial cable connection.
  • HCI (Host Controller Interface): Internal commands.
  • OTA (Over The Air): The Upper Tester connects to a “Lower Tester” (a reference radio instrument), which then wirelessly commands the IUT into test modes.

Core RF & PHY Tests

The UTP defines specific configuration and control messages to run two primary types of tests:

  • Transmitter Test: The Upper Tester commands the IUT to transmit a specific number of packets at a specific power level, frequency and PHY rate (1M, 2M, or LE Coded).

  • Receiver Test: The Lower Tester transmits a known number of packets to the IUT. The IUT counts how many it successfully received versus how many had CRC (Cyclic Redundancy Check) errors or payload errors. This allows the tester to calculate the “Packet Error Rate (PER)” and “Bit Error Rate (BER)”, ensuring the device meets receiver sensitivity standards.

Test Packet Payloads

To properly stress the radio’s modulator and filters, the tests do not use normal data. Instead, they use standardized payloads.

  • PRBS9 / PRBS15 (Pseudo Random Binary Sequences): Mathematically generated random bit streams used to test overall radio fidelity.
  • Alternating Patterns (10101010 or 11110000): Used to test frequency deviation and the Gaussian filters of the radio transmitter.

Advanced Testing (Direction Finding and Channel Sounding)

The RFPHY test specifications have been updated to test modern Bluetooth features as follows.

  • Constant Tone Extension (CTE): The UTP can command the IUT to append a continuous, unwhitened tone to the end of a test packet. This is used to test Direction Finding (Angle of Arrival/Angle of Departure) by allowing the tester to sample the In-Phase and Quadrature (IQ) data of the radio wave.

  • Channel Sounding Tests: The Upper Tester can force the IUT to act as an Initiator or Reflector and exchange specific CS_SYNC packets and CS Tones. The tester will evaluate if the IUT can successfully identify “Attacker Signals” (signals artificially injected with phase glitches or amplitude shifts designed to mimic a spoofing attack). The IUT must generate a “Normalized Attack Detector Metric (NADM)” indicating how likely it thinks an attack is occurring (ranging from “Extremely Unlikely” to “Extremely Likely”).

References & Further Reading

  1. Bluetooth SIG : Bluetooth Core Specification Version 6.3, May 5, 2026.
  2. Bluetooth SIG : Bluetooth Core Specification change history
  3. Bluetooth SIG : Bluetooth Technology Overview

Continue Learning Bluetooth Basic Concepts

Continue Learning Bluetooth Technology

Compare Bluetooth With Other Technologies

Explore Deep Insight Bluetooth Technology

Keep Reading

Related Posts