Texas Instruments CC2540 User manual

Bluetooth® Low Energy
CC2540 Development Kit
CC2541 Evaluation Module Kit
User’s Guide
Document Number: SWRU301A
Development Kit Part Number: CC2540DK, CC2541EMK

SWRU301
Page 2 of 32
TABLE OF CONTENTS
1. REFERENCES...................................................................................................................................... 4
1.1 PRINTED COPY INCLUDED IN THE BOX WITH CC2540DK ............................................................................. 4
1.2 PRINTED COPY INCLUDED IN THE BOX WITH CC2541EMK .......................................................................... 4
1.3 INCLUDED WITH TEXAS INSTRUMENTS BLUETOOTH LOW ENERGY SOFTWARE INSTALLER ................................... 4
1.4 AVAILABLE FROM BLUETOOTH SPECIAL INTEREST GROUP (SIG) .................................................................... 4
2. INTRODUCTION ................................................................................................................................ 5
2.1 CC2540DK CONTENTS OVERVIEW ......................................................................................................... 5
2.2 CC2541EMK CONTENTS OVERVIEW ...................................................................................................... 5
2.3 SYSTEM REQUIREMENTS........................................................................................................................ 6
3. GETTING STARTED WITH THE SIMPLEBLE DEMO ............................................................................... 7
3.1 HARDWARE SETUP ............................................................................................................................... 7
3.2 POWER OPTIONS ................................................................................................................................. 7
3.3 POWER THE BOARDS ............................................................................................................................ 7
3.4 START-UP SCREEN ................................................................................................................................ 7
3.5 USING THE JOYSTICK ............................................................................................................................. 7
3.6DEVICE DISCOVERY............................................................................................................................... 8
3.7 ESTABLISH CONNECTION........................................................................................................................ 8
3.8 CONNECTED OPERATIONS...................................................................................................................... 8
3.9 READ /WRITE DATA ............................................................................................................................ 8
3.10 MONITOR RSSI ................................................................................................................................... 9
3.11 CONNECTION PARAMETER UPDATE ......................................................................................................... 9
3.12 TERMINATE LINK.................................................................................................................................. 9
3.13 SIMPLEBLE DEMO SOURCE CODE ........................................................................................................... 9
4. USING BTOOL ................................................................................................................................. 10
4.1 USING SMARTRF05EB +CC2540EM/CC2541EM AS HOST BOARD ........................................................ 10
4.1.1 Load HostTestRelease Project on EM using SmartRF05EB .................................................... 10
4.1.2 Connect SmartRF05EB to PC.................................................................................................. 10
4.2 DETERMINING THE COM PORT ............................................................................................................ 11
4.3 STARTING THE APPLICATION................................................................................................................. 12
4.4 CREATING A BLE CONNECTION BETWEEN CENTRAL AND PERIPHERAL DEVICES............................................... 13
4.4.1 Scanning for Devices ............................................................................................................. 13
4.4.2 Selecting Connection Parameters.......................................................................................... 14
4.4.3 Establishing a Connection ..................................................................................................... 14
4.5 USING THE SIMPLE GATT PROFILE ........................................................................................................ 15
4.5.1 Reading a Characteristic Value by UUID ............................................................................... 17
4.5.2 Writing a Characteristic Value .............................................................................................. 18
4.5.3 Reading a Characteristic Value by Handle ............................................................................ 19
4.5.4 Discovering a Characteristic by UUID .................................................................................... 19
4.5.5 Reading Multiple Characteristic Values................................................................................. 20
4.5.6 Enabling Notifications ........................................................................................................... 21
4.6 USING BLE SECURITY.......................................................................................................................... 23
4.6.1 Encrypting the Connection .................................................................................................... 23
4.6.2 Using Bonding and Long-Term Keys ...................................................................................... 24
4.7 ADDITIONAL SAMPLE APPLICATIONS ...................................................................................................... 26
5. PROGRAM / DEBUG THE CC254X .................................................................................................... 27
5.1 HARDWARE SETUP ............................................................................................................................. 27
5.2 USING SMARTRF FLASH PROGRAMMER SOFTWARE.................................................................................. 27
5.2.1 Reading or Writing a Hex File to the CC254x......................................................................... 27
5.2.2 Reading or Writing the CC254X Device Address .................................................................... 28
6. SMARTRF™ PACKET SNIFFER........................................................................................................... 30
7. GENERAL INFORMATION ................................................................................................................ 31

SWRU301
Page 3 of 32
7.1 DOCUMENT HISTORY .......................................................................................................................... 31

SWRU301
Page 4 of 32
1. References
The following references provide additional information on the CC2540/41, the Texas Instruments
Bluetooth® low energy (BLE) stack and the BLE specification in general. (All path and file references in this
document assume that the BLE development kit software has been installed to the default path C:\Texas
Instruments\BLE-CC254X-1.1B\)
1.1 Printed Copy Included in the Box with CC2540DK
[1] CC2540 Development Kit Quick Start Guide (SWRU300)
1.2 Printed Copy Included in the Box with CC2541EMK
[2] CC2541 Evaluation Module Kit Quick Start Guide (SWRU311)
1.3 Included with Texas Instruments Bluetooth Low Energy Software Installer
(The software installer is available for download at http://www.ti.com/blestack)
[3] Texas Instruments Bluetooth® Low Energy Software Developer’s Guide (SWRU271A)
C:\Texas Instruments\BLE-CC254X-1.1b\Documents\TI_BLE_Software_Developer's_Guide.pdf
[4] TI BLE Vendor Specific HCI Reference Guide
C:\Texas Instruments\BLE-CC254X-1.1b\Documents\TI_BLE_Vendor_Specific_HCI_Guide.pdf
[5] Texas Instruments BLE Sample Applications Guide (SWRU297)
C:\Texas Instruments\BLE-CC254X-1.1b\Documents\TI_BLE_Sample_Applications_Guide.pdf
1.4 Available from Bluetooth Special Interest Group (SIG)
[6] Specification of the Bluetooth System, Covered Core Package version: 4.0 (30-June-2010)
https://www.bluetooth.org/technical/specifications/adopted.htm

SWRU301
Page 5 of 32
2. Introduction
Thank you for purchasing a Texas Instruments (TI) Bluetooth® low energy (BLE) Kit. The purpose of this
document is to give an overview of the hardware and software included in the CC2540 Development Kit
(CC2540DK) and the add-on CC2541 Evaluation Module Kit (CC2541EMK).
The information in this guide will get you up and running with the kit; however for more detailed
information on BLE technology and the TI BLE protocol stack, please consult the Texas Instruments
Bluetooth® Low Energy Software Developer’s Guide [3].
2.1 CC2540DK Contents Overview
The CC2540DK contains the following hardware components:
2 x SmartRF05 Evaluation Boards (SmartRF05EB)
2 x CC2540 Evaluation Modules (CC2540EM)
2 x Pulse Antennas
1 x CC2540 USB Dongle
Cables
Figure 1 –CC2540DK
2.2 CC2541EMK Contents Overview
The CC2541EMK contains the following hardware components:
2 x CC2541 Evaluation Modules (CC2541EM)
2 x Pulse W1010 Antennas
Cables
The kit is FCC and IC certified and tested/complies with
ETSI/R&TTE over temperature from 0 to +35°C. The antenna,
W1010 from Pulse, is a ¼ wave dipole antenna with 2 dBi gain.
Figure 2 - CC2541EMK
Caution! The kit contains ESD sensitive components. Handle with care to prevent
permanent damage. To minimize risk of injury, avoid touching components during
operation if symbolized as hot.

SWRU301
Page 6 of 32
2.3 System Requirements
To use the TI BLE software, a PC running Microsoft Windows (XP or later; 32-bit support only) is required,
as well as Microsoft .NET Framework 3.5 Service Pack 1 (SP1) or greater.
In order to check whether your system has the appropriate .NET Framework, open up the Windows
Control Panel, and select “Add or Remove Programs”. Amongst the list of currently installed programs,
you should see “Microsoft .NET Framework 3.5 SP1”, as shown in Figure 3.
Figure 3 System Requirements, .NET Framework 3.5 SP1
If you do not see it in the list, you can download the framework from Microsoft.
From a hardware standpoint, the Windows PC must contain at least one, and up to three, free USB ports.
With one free port, a single CC2540/41 device can be flashed or debugged, or the BLE sniffer can be used.
In order to simultaneously flash or debug both evaluation modules (EMs) while running the BLE sniffer
software, three USB ports are required.
IAR Embedded Workbench for 8051 development environment is required in order to make changes to
the BLE software. More information on IAR can be found in the Texas Instruments Bluetooth® Low Energy
Software Developer’s Guide [3].
For the CC2541EMK, it is required to use SmartRF05 Boards Rev. 1.8.1 or later. More information about
the SmartRF05EB can be found in www.ti.com/lit/swru210. The CC2541EM boards can also be plugged
into a battery board (see www.ti.com/tool/soc-bb) for standalone operation.

SWRU301
Page 7 of 32
3. Getting Started with the SimpleBLE Demo
3.1 Hardware Setup
Connect the antennas to the SMA connectors on the EMs.
Tighten the antenna’s screw firmly on to the SMA connector.
If not properly connected, you might see reduced RF
performance. Next, mount the EMs firmly on to connectors
P5 and P6 on the SmartRF05EB.
3.2 Power Options
There are several ways of applying power to the SmartRF05EB.
2 x 1.5 V AA Batteries
USB
External Power Supply
For the batteries and USB, there are voltage regulators on the SmartRF05EB that will set the on-board
voltage to 3.3 V. The external power supply should set a voltage that does not exceed 3.3 V.
Note that there should only be one active power source at any time. To minimize risk of personal injury or
property damage, never use rechargeable batteries to power the board.
3.3 Power the Boards
Find jumper P11 on the top side of each SmartRF05EB. This jumper is used to set
the power source for the board. Set P11 to “1-2” if you are using battery power. Set
P11 to “2-3” if you are using USB or an external power supply.
Once you have set P11, find switch P8 on the top side of each SmartRF05EB. To
power up the boards, flip the switch from the “OFF” to “ON”.
3.4 Start-up Screen
One of the EMs will be pre-loaded with the SimpleBLECentral application, while the other will be pre-
loaded with the SimpleBLEPeripheral application. The LCD screens on the two SmartRF05EBs should
display messages similar to those below:
The “0x…” value displayed on each board is the device address. Every CC2540/41 device has a unique
address.
3.5 Using the Joystick
The SimpleBLEPeripheral application runs autonomously and does not
require any user interaction. The SimpleBLECentral application, however,
requires user interaction by means of joystick U1. Find joystick U1 on the
top side of the SmartRF05EB, immediately below the LCD. The joystick
has five different movements: it can be moved up, down, left, right, and
it can be pressed in, just like a button. Each movement performs
different actions depending on the state of the device.

SWRU301
Page 8 of 32
3.6 Device Discovery
Before the two devices can connect, the central device must first discover the
peripheral device. To perform device discovery, press up on joystick U1 once. The
LCD on the central device should display “Discovering…”.
After a few seconds, it should display “Devices Found 1 / <- To Select”. This means
that the central device successfully discovered the peripheral. Press left on joystick
U1 to view the address of the peripheral device. This address should match the
address seen on the peripheral’s LCD.
3.7 Establish Connection
To establish a connection with the peripheral, press joystick U1 in towards the
board (push it inwards, like it is a button). Once the connection is established,
the central device will automatically perform service discovery on the peripheral
using the BLE GATT protocol. This should complete within a few seconds.
The two LCD screens should appear as in the images below, with the central still
displaying the peripheral’s address and the peripheral having changed from
“Advertising” to “Connected”:
Be careful that you don’t “double tap”U1 which would terminate the connection immediately, giving
Disconnected Reason: 22.
3.8 Connected Operations
Once the connection has been established and service discovery is complete, you can perform the
following operations using joystick U1 on the central device:
UP: Read / Write Data
RIGHT: Connection Parameter Update
DOWN: RSSI Monitoring
IN: Terminate Link
3.9 Read / Write Data
Pressing up on U1 will send a read request to the peripheral device. One byte of data will be read, and the
value will be displayed. Pressing up again will send a write request, and one byte of data will be written to
the peripheral. The peripheral’s LCD should display the written value each time this is done.
Bluetooth low energy is an ideal technology for transmission of small amounts of data between two
devices while consuming very little power, as is demonstrated here.
Continuing to press up on the joystick will alternate between reads and writes, with the value
incrementing each time.

SWRU301
Page 9 of 32
3.10 Monitor RSSI
Pressing down on U1 will turn on RSSI (received signal strength indication) monitoring. The RSSI will be
displayed on the LCD in units of negative dBm.
If the boards are moved farther apart from each other, the RSSI will drop (since the value is negative, a
higher number means lower RSSI). If they are moved closer together, the RSSI should rise.
Pressing down on U1 again will turn off RSSI monitoring.
3.11 Connection Parameter Update
Pressing right on U1 will send a connection parameter update request to the peripheral to use a longer
connection interval. This will result in much longer latency when performing data reads and writes;
however the power consumed by both devices is significantly reduced.
3.12 Terminate Link
Pressing U1 in towards the board will terminate the link. The peripheral will return to an advertising state.
The central device will display a “Reason” code, which indicates why the disconnection occurred (values
are defined in the BLE stack API).
In this case, the reason code of 22 indicates that the link termination was initiated by the central device.
In the event that the peripheral device goes out of range or has power disconnected from it, you will see a
reason code of 8 which indicates that a link timeout has occurred.
You can now perform device discovery and re-connect to the peripheral if desired.
3.13 SimpleBLE Demo Source Code
The project and source code files for these applications (as well as many others) are included with the
Bluetooth low energy (BLE) stack from Texas Instruments, which can be downloaded at
www.ti.com/blestack.
The two projects implementing this demo are called SimpleBLECentral (Master configuration) and
SimpleBLEPeripheral (Slave configuration). These can be modified as desired, and should provide a good
framework for developing your own custom BLE applications.
More details on these projects can be found within the BLE Software Developer’s Guide [3], which is
included with the stack.

SWRU301
Page 10 of 32
4. Using BTool
BTool is a PC Application that allows a user to form a connection between two BLE devices. BTool works
by communicating with a CC2540/41 acting as a network processor by means of HCI vendor specific
commands. You will be able to perform the same functions very similar to those in the SimpleBLE demo;
however with BTool you will have much broader control of the central device.
More information on the network processor configuration and the HostTestRelease project can be found
in the Texas Instruments Bluetooth® Low Energy Software Developer’s Guide [3]. More information on the
HCI interface, as well as details on the HCI vendor specific commands that are used by the CC2540/41, can
be found in the TI BLE Vendor Specific HCI Reference Guide [4].
For this section, a PC running windows 7 has been used, but the procedures are essentially the same for
other windows version, such as XP.
Host Board in the following context refers to the hardware platform consisting of a SmartRF05+EM setup
or a CC2540USB Dongle, since either can be used.
4.1 Using SmartRF05EB + CC2540EM/CC2541EM as Host Board
4.1.1 Load HostTestRelease Project on EM using SmartRF05EB
Before using BTool, the HostTestRelease (network processor) application must be loaded onto the central
device. A hex file containing the HostTestRelease application can be found at the following location:
C:\...\BLE-CC254X-1.1b\Accessories\Hex_Files\CC254X_ble_SmartRF_HostTestRelease_Master.hex
For instructions on loading a hex file, please see section 5. It is recommended that you load this firmware
on the SmartRF05EB/EM boards that were previously running the SimpleBLECentral application, and leave
the SimpleBLEPeripheral application on the other set of boards.
4.1.2 Connect SmartRF05EB to PC
BTool, running on a Windows PC, communicates with the EM by means of the serial port (RS-232)
interface on the SmartRF05EB. With a standard DB-9 serial cable, connect the SmartRF05EB to your PC’s
serial port. If the PC does not have a serial port, a USB-to-serial converter will be required.

SWRU301
Page 11 of 32
4.2 Determining the COM Port
You will need to know which COM port Windows has assigned to the serial port. To find out, right-click on
the “Computer” icon on your Start and select “Properties”, shown in Figure 4.
Figure 4 Win7 PC, Finding Computer Properties
The “System” window should open up. Click “Device Manager”:
Figure 5 Win7 PC, Finding Device Manager
A list of all hardware devices should appear. Under the section “Ports (COM & LPT)”, the port should
appear. Next to the name should be the port number (for example, the CC2540USB Dongle uses COM10
in Figure 6):
Figure 6 Win7 PC, Connected Ports List
Take note of this port number, as it will be needed in order to use BTool. You may close the device
manager at this point.

SWRU301
Page 12 of 32
4.3 Starting the Application
To start the application go into your programs by choosing Start > All Programs > Texas Instruments >
Bluetooth-LE-1.1b > BTool. On Start-up you should be able to set the Serial Port Settings. Set the “Port”
value to the COM port earlier noted in Section 4.2. For the other settings, use the default values as shown
in Figure 7. Press “OK” to connect to the Host Board.
Figure 7 BTool, Serial Port settings
When connected you should see the screen presented in Figure 8. The screen indicates that you now have
a serial port connection to the Host Board. The screen is divided up into a few sections: the left sidebar
contains information on the Host Board status. The left side of the sub-window contains a log of all
messages sent from the PC to the Host Board and received by the PC from the Host Board. The right side
of the sub-window contains a GUI for control of the Host Board.
Figure 8 BTool, Overview
Device Information
Message Log
Device Control

SWRU301
Page 13 of 32
4.4 Creating a BLE Connection between Central and Peripheral Devices
At this point the central device (connected to the PC) is ready to discover other BLE devices that are
advertising. If you have left the SimpleBLEPeripheral application running on one SmartRF05EB, you should
be ready to use BTool. As long as the SmartRF05EB running the SimpleBLEPeripheral is powered up and
un-connected, it should be in discoverable (advertising) mode.
4.4.1 Scanning for Devices
Press the “Scan” button under the “Discover / Connect” tab as shown in Figure 9.
Figure 9 BTool, Scan for Devices
The central device will begin search for other BLE devices. As devices are found, the log on the left side of
the screen will display the devices discovered. After 10 seconds, the device discovery process will
complete, and the central device will stop scanning. A summary of all the scanned devices will be
displayed in the log window. In the example in Figure 10, one peripheral device was discovered while
scanning. If you do not want to wait through the full 10 seconds of scanning, the “Cancel” button can be
pressed alternatively, which will stop the device discovery process. The address of any scanned devices
will appear in the “Slave BDA” section of the “Link Control” section in the bottom right corner of the sub-
window.
Figure 10 BTool, Slave Address

SWRU301
Page 14 of 32
4.4.2 Selecting Connection Parameters
Before establishing a connection, you will want to set up the desired connection parameters. The default
values of 100ms connection interval, 0 slave latency, and 20000ms supervision timeout should serve as a
good starting point; however for different applications you may want to experiment with these values.
Once the desired values have been set, be sure to click the “Set” button; otherwise the settings will not be
saved. Note that the connection parameters must be set before a connection is established; changing the
values and clicking the “Set” button while a connection is active will not change the settings of an active
connection. The connection must be terminated and re-established to use the new parameters. (The
Bluetooth specification does support connection parameter updates while a connection is active; however
this must be done using either an L2CAP connection parameter update request, or using a direct HCI
command. More information can be found in the Specification of the Bluetooth System [6])
Figure 11 BTool, Connection Settings
4.4.3 Establishing a Connection
To establish a connection with the peripheral device, select the address of the device to connect with, and
click the “Establish” button as shown in Figure 12.
Figure 12 BTool, Establish Connection
If the set of connection parameters are invalid (for example, if the combination of connection parameters
violates the specification), the message window will return a “GAP_EstablishLink” event message with a
“Status” value of “0x12 (Not setup properly to perform that task)”, as shown in Figure 13. The parameters
will have to be corrected before a connection can be established.
Figure 13, BTool, Invalid Connection Parameters
As long as the peripheral is powered-up and still in discoverable mode, a connection should be
established immediately. Once a connection is established, the message window will return a
“GAP_EstablishLink” event message with a “Status” value of “0x00 (Success)”:

SWRU301
Page 15 of 32
Figure 14 BTool, Link Established
The LCD screen on the peripheral SmartRF05EB should display “Connected”. In BTool, you can see your
connected peripheral device in the Device Information field, as shown in Figure 15.
Figure 15 BTool, Device Information
4.5 Using the Simple GATT Profile
The SimpleBLEPeripheral software contains one sample GATT service profile (More information on the
SimpleGATTProfile can be found in the Texas Instruments Bluetooth® Low Energy Software Developer’s
Guide [3]). GATT services contain data values known as “characteristic values”. All application data that is
being sent or received in BLE must be contained within characteristic value. This section details a step-by-
step process that demonstrates several processes for reading, writing, discovering, and notifying GATT
characteristic values using BTool.
Note that the types (UUIDs) of the five characteristic values (0xFFF1, 0xFFF2, 0xFFF3, 0xFFF4, and
0xFFF5), as well as the simple profile primary service UUID value (0xFFF0), do not conform to any
specifications in the Bluetooth SIG. They are simply used as a demonstration.
The tables in Figure 16 and Figure 17 below show the SimpleBLEPeripheral complete attribute table, and
can be used as a reference. Services are shown in yellow, characteristics are shown in blue, and
characteristic values / descriptors are shown in grey. When working with the SimpleBLEPeripheral
application, it might be useful to print out the table as a reference.

SWRU301
Page 16 of 32
Figure 16, SimpleBLEPeripheral Attribute Table

SWRU301
Page 17 of 32
Figure 17 SimpleBLEPeripheral Attribute Table
4.5.1 Reading a Characteristic Value by UUID
The first characteristic of the SimpleGATTProfile service has both read and write permissions, and has a
UUID of 0xFFF1. The simplest way to read its value is to use the “Read Characteristic by UUID” sub-
procedure. To do this, you will first need to click the “Read / Write” tab in BTool. Select the option “Read
Using Characteristic UUID” under the “Sub-Procedure” option in the “Characteristic Read” section at the
top of the screen. Enter “F1:FF” (note that the LSB is entered first, and the MSB is entered last) in the
“Characteristic UUID” box, and click the “Read” button as shown in Figure 18.
An attribute protocol Read by Type Request packet gets sent over the air from the central device to the
peripheral device, and an attribute protocol Read by Type Response packet gets sent back from the
peripheral device to the central device. The value “01” is displayed in the “Value” box, and “Success” is
displayed in the “Status” box. In addition, the message window will display information on the Read by
Type Response packet that was received by the central device. The message includes not only the
characteristic’s data value, but also the handle of the characteristic value (0x0022 in this case).

SWRU301
Page 18 of 32
Figure 18 BTool, Read a Characteristic Value by UUID
4.5.2 Writing a Characteristic Value
In the previous section, the handle of the first characteristic in the SimpleGATTProfile was found to be
0x0022. Knowing this, and based on the fact that the characteristic has both read and write permissions,
it is possible for us to write a new value. Enter “0x0022” into the “Characteristic Value Handle” box in the
“Characteristic Write” section, and enter any 1-byte value in the “Value” section (the format can be set to
either “Decimal” or “Hex”). Click the “Write” button as shown in Figure 19.
An attribute protocol Write Request packet gets sent over the air from the central device to the peripheral
device, and an attribute protocol Write Response packet gets sent back from the peripheral device to the
central device. The status box will display “Success”, indicating that the write was successful.
Figure 19 BTool, Write a Characteristic Value

SWRU301
Page 19 of 32
The LCD screen on the peripheral SmartRF05EB should display “Char 1:”, and the value written in decimal
format.
4.5.3 Reading a Characteristic Value by Handle
After writing a new value to the first characteristic in the profile, we can read the value back to verify the
write. This time, instead of reading the value by its UUID, the value will be read by its handle. Select the
option “Read Characteristic Value / Descriptor” under the “Sub-Procedure” option in the “Characteristic
Read” section. Enter “0x0022” in the “Characteristic Value Handle” box, and click the “Read” button as
shown in Figure 20.
An attribute protocol Read Request packet gets sent over the air from the central device to the peripheral
device, and an attribute protocol Read Response packet gets sent back from the peripheral device to the
central device. The new value is displayed in the “Value” box, and “Success” is displayed in the “Status”
box. This value should match the value that was written in the previous step.
Figure 20 BTool, Read a Characteristic Value by Handle
4.5.4 Discovering a Characteristic by UUID
The next thing to do is to discover a characteristic by its UUID. By doing this, we will not only get the
handle of the UUID, but we will also get the properties of the characteristic. The UUID of the second
characteristic in the SimpleGATTProfile is 0xFFF2. Select the option “Discover Characteristic by UUID”
under the “Sub-Procedure” option in the “Characteristic Read” section at the top of the screen. Enter
“F2:FF” in the “Characteristic UUID” box, and click the “Read” button as shown in Figure 21.
A series of attribute protocol Read by Type Request packets get sent over the air from the central device
to the peripheral device, and for each request an attribute protocol Read by Type Response packet gets
sent back from the peripheral device to the central device. Essentially, the central device is reading every
attribute on the peripheral device with a UUID of 0x2803 (this is the UUID for a characteristic declaration
as defined in Specification of the Bluetooth System [6]), and checking the “Characteristic Value UUID”
portion of each declaration to see if it matches type 0xFFF2. The procedure is complete once every
characteristic declaration has been read.
The procedure will find one instance of the characteristic with type 0xFFF2, and display “02 25 00 F2 FF”
(the value of the declaration) in the “Value” box, with “Success” displayed in the “Status” box. As per the
Bluetooth specification, the first byte “02” tells us that the properties of the characteristic are read-only.
The second and third bytes “25 00” tell us that the handle of the characteristic value is 0x0025. The fourth
and fifth bytes tell the UUID of the characteristic, 0xFFF2.

SWRU301
Page 20 of 32
Figure 21 BTool, Discover a Characteristic by UUID
4.5.5 Reading Multiple Characteristic Values
It is also possible to read multiple characteristic values with one request, as long as the handle of each
value is known. To read the values of both of the characteristics that we previously read, select the option
“Read Multiple Characteristic Values” under the “Sub-Procedure” option in the “Characteristic Read”
section at the top of the screen. Enter “0x0022;0x0025” in the “Characteristic Value Handle” box, and
click the “Read” button as shown in Figure 22.
An attribute protocol Read Multiple Request packet gets sent over the air from the central device to the
peripheral device, and an attribute protocol Read Multiple Response packet gets sent back from the
peripheral device to the central device. The values of the two characteristics are displayed in the “Value”
box, and “Success” is displayed in the “Status” box. This first byte should match the value that was written
in the previous step, and the second byte should be “02”.
One important note about reading multiple characteristic values in a single request is that the response
will not parse the separate values. This means that the size of each value being read must be fixed, and
must be known by the client. In the example here, this is not an issue since there are only two bytes in the
response; however care must be taken when using this command.