BLE GATT-Based Profiles

 

 

GATT-Based Profiles — IAS, FMP, LLS, TPS, PXP, Battery, Device Info

Chapter 15 · Part 1 of 2 · Sections 15.1–15.9 · Profile Architecture · Immediate Alert · Find Me · Link Loss · Tx Power · Proximity · Battery · Device Information

SEO Keywords

BLE GATT-Based Profiles Chapter 15 introduction BLE Immediate Alert Service IAS Alert Level Write Without Response BLE Find Me Profile FMP Locator Target key fob BLE Link Loss Service LLS Read Write connection lost alert BLE Transmit Power Service TPS Tx Power Level distance BLE Proximity Profile PXP Monitor Reporter path loss BLE Battery Service BAS Battery Level 0-100 notify BLE Device Information Service DIS manufacturer model revision

15.1 — Introduction

Why BLE Profiles Are Simpler Than Classic Bluetooth

LE profiles are dramatically simpler than their BR/EDR equivalents. The reason is the GATT-based profile concept: all the common machinery — discovering services, reading and writing characteristics, enabling notifications — is handled once inside the ATT protocol and GATT profile. Profiles on top only need to define what data to expose. They do not need to reinvent discovery, access, or notification mechanisms.

The simplicity shows in the specification documents themselves. Some GATT-based profile specs are only 10 pages. Several sit around 20 pages. Compare that to the HFP or A2DP specifications for BR/EDR which run to hundreds of pages and encode full protocol stacks of their own.

Figure 15.1 — GATT-Based Profiles in the LE Protocol Stack
FIND ME   PROXIMITY   BATTERY   HEART RATE  

GATT-based profiles
Generic Access Profile (GAP)
Generic Attribute Profile (GATT)
Attribute Protocol (ATT)
Security Manager (SM)
L2CAP
Link Layer  |  HCI  |  Physical Layer

15.2 — Profile, Services, and Characteristics

The Three-Level Data Model

The GATT-based profile architecture separates profiles and services into independent specifications. A profile defines how a complete feature works — for example, proximity monitoring. A service defines one aspect of a feature — for example, transmit power. Multiple profiles can share the same service: the Device Information Service is used by at least ten different profiles.

Figure 15.2 — Profiles, Services, and Characteristics Relationship
Device

Profile 1
Service 1
→ Characteristic 1
→ Characteristic 2
Profile 2
Service 2
→ Characteristic 3
Profile 3
(service reuse, shared with Profile 1)
  • A device may support one or more profiles
  • A profile may contain zero or more services (some profile roles have no services)
  • Each service contains one or more characteristics
  • Characteristics hold data values that can be read, written, indicated, or notified
  • LE profiles are data-centric — each exposes specific sensor or device data

This contrasts with BR/EDR profiles like HFP or A2DP which are not data-centric — they establish audio streams rather than exposing addressable data values.

15.3 — Immediate Alert Service (IAS) UUID 0x1802 Primary Service

A write-only service that triggers an immediate action on the device when the remote side writes to it. Pressing a button on a phone can cause a misplaced key fob to start buzzing. The service is intentionally minimal — the only intelligence is what the device chooses to do when the alert level changes.

0x2A06 Write Without Response

Alert Level — control point characteristic (write-only, cannot be read). Values: 0x00 No Alert, 0x01 Mild Alert, 0x02 High Alert.

Writing Mild or High Alert keeps the device alerting until: an implementation-specific timeout fires, the user presses a button to stop it, a new alert level is written, or the physical link disconnects.

/* Write High Alert to IAS (handle from service discovery):  */
gatttool -b AA:BB:CC:DD:EE:FF \
         --char-write --handle=0x0025 --value=02
/* 02 = High Alert | 01 = Mild Alert | 00 = No Alert         */
/* --char-write uses Write Command (opcode 0x52, no ACK)      */

/* Stop alerting:                                            */
gatttool -b AA:BB:CC:DD:EE:FF \
         --char-write --handle=0x0025 --value=00

15.4 — Find Me Profile (FMP) Uses IAS

Allows a user to locate a misplaced device by pressing a button that causes the missing device to sound an alert. A typical use case is finding a key fob using a mobile phone.

Find Me Locator (GATT Client)
The device where the user presses the button. Writes the Alert Level into the Find Me Target’s IAS. Usually a mobile phone.
Find Me Target (GATT Server)
The device that raises the alert. Exposes the Immediate Alert Service. Usually a key fob or wearable that buzzes or flashes.

Neither role is required to be GAP Central or Peripheral — either device can initiate the connection. The Locator uses GATT service discovery to find the IAS on the Target before writing the alert level.

15.5 — Link Loss Service (LLS) UUID 0x1803 Primary Service

Triggers an alert when the Bluetooth connection to a remote device is unexpectedly lost — moved out of range, device stolen, or walked away. Unlike IAS, the Alert Level here is configured before the connection is lost and activated by the disconnect event itself, not by a write from the remote side.

Real-world examples: a watch that alerts when the paired phone is left behind; a child-tracker wristband that alerts a parent when the child wanders out of range.

0x2A06 Read, Write

Alert Level — the alert level to activate when the link drops. Pre-set by the client while connected. Values: 0x00 No Alert, 0x01 Mild Alert on link loss, 0x02 High Alert on link loss.

Once the connection is lost, the device alerts at the configured level until: a timeout fires, the user acknowledges it, or the physical link is reconnected.

/* Pre-configure High Alert on link loss:                    */
gatttool -b AA:BB:CC:DD:EE:FF \
         --char-write-req --handle=0x0082 --value=02
/* Uses Write Request (opcode 0x12) — acknowledged           */
/* handle 0x0082 is the LLS Alert Level characteristic value */

/* Verify configuration was stored:                          */
gatttool -b AA:BB:CC:DD:EE:FF \
         --char-read --handle=0x0082
/* Response: 02 → High Alert configured                      */

15.6 — Transmit Power Service (TPS) UUID 0x1804 Primary Service

Exposes the device’s current transmit power level in dBm while the connection is active. The Client uses this to estimate path loss by comparing the TPS reading with the received signal strength at its own antenna. A larger path loss means greater physical distance between the devices.

Use cases: auto-locking a computer when the user’s watch moves beyond a threshold distance; proximity-based access control in offices; distance-aware alerts in a shopping mall child-tracking system.

0x2A07 Read

Tx Power Level — current transmit power in dBm. Signed 8-bit integer. Range: −100 to +20 dBm.
/* Read Tx Power Level from TPS:                             */
gatttool -b AA:BB:CC:DD:EE:FF \
         --char-read --handle=0x0088
/* Response: fc → 0xFC signed = -4 dBm                      */

/* Path loss calculation:                                    */
/* path_loss = Tx_Power_Level (from TPS) - RSSI (measured)   */
/* Higher path_loss = greater distance                       */
/* e.g.: Tx = -4 dBm, RSSI = -65 dBm → path_loss = 61 dBm  */

15.7 — Proximity Profile (PXP) Uses LLS + IAS + TPS

Monitors proximity between two devices and alerts when they move too far apart. Supports two alert triggers: a link-drop alert (when the connection drops because the devices are out of range) and a path-loss alert (when the calculated path loss exceeds a threshold, even before the connection drops).

Proximity Monitor (GATT Client)
Reads Tx Power from TPS to calculate path loss. Sets Alert Level in both LLS and IAS. Usually a phone or dual-mode device — acts as GAP Central.
Proximity Reporter (GATT Server)
Exposes LLS (mandatory), IAS (optional), and TPS (optional). Usually an LE-only device — acts as GAP Peripheral (key fob, tag, wristband).
Services summary: Link Loss Service is mandatory (connection-drop alert). Immediate Alert Service and Tx Power Service are both optional (path-loss alert system).
/* Read Tx Power, compute path loss, set alert if threshold: */
/* 1. Read Tx Power Level from TPS:                          */
gatttool -b AA:BB:CC:DD:EE:FF --char-read --handle=0x0088

/* 2. Read current RSSI of the connection:                   */
sudo hcitool rssi AA:BB:CC:DD:EE:FF

/* 3. path_loss = tx_power - rssi                            */
/* 4. If path_loss > threshold, write IAS Alert Level:       */
gatttool -b AA:BB:CC:DD:EE:FF \
         --char-write --handle=0x0085 --value=02

15.8 — Battery Service (BAS) UUID 0x180F Primary Service

Provides the battery charge level as a percentage to remote devices. The client can either poll the value periodically or configure a notification to receive updates only when the level changes. Notification-based monitoring is much more efficient — the server only sends data when the battery level actually drops.

0x2A19 Read, Notify (optional)

Battery Level — 0% (fully discharged) to 100% (fully charged). Single unsigned byte.
/* Read battery level:                                       */
gatttool -b AA:BB:CC:DD:EE:FF --char-read --uuid=0x2A19
/* Response: 4b → 0x4B = 75 (percent)                       */

/* Enable notification when battery level changes:           */
/* Find CCCD handle (descriptor 0x2902) after 0x2A19:        */
gatttool -b AA:BB:CC:DD:EE:FF --char-write-req \
         --handle=0x --value=0100
/* Server will now push updates when level drops             */

15.9 — Device Information Service (DIS) UUID 0x180A Primary Service

Provides manufacturer and device identification information. At least one characteristic must be supported — implementations choose which are relevant to their product.

0x2A29 Read

Manufacturer Name String — company name
0x2A24 Read

Model Number String — product model
0x2A25 Read

Serial Number String — unit serial number
0x2A27 Read

Hardware Revision String — hardware revision
0x2A26 Read

Firmware Revision String — firmware version
0x2A28 Read

Software Revision String — software version
0x2A23 Read

System ID — 8-byte structure: OUI (3 bytes) + manufacturer-defined identifier (5 bytes)
0x2A2A Read

IEEE 11073-20601 Regulatory Certification Data List — regulatory and certification data. Used by health and medical devices.
/* Read all DIS characteristics:                             */
gatttool -b AA:BB:CC:DD:EE:FF --char-read --uuid=0x2A29
/* Response: "Acme Corp" (Manufacturer Name)                 */

gatttool -b AA:BB:CC:DD:EE:FF --char-read --uuid=0x2A24
/* Response: "HR-3000" (Model Number)                        */

gatttool -b AA:BB:CC:DD:EE:FF --char-read --uuid=0x2A26
/* Response: "1.2.0" (Firmware Revision)                     */

/* In bluetoothctl after connect:                            */
[AA:BB:CC:DD:EE:FF]# menu gatt
[AA:BB:CC:DD:EE:FF]# list-attributes
/* Device Information (0x180a)                               */
/*   Manufacturer Name String (0x2a29)                       */
/*   Model Number String (0x2a24)                            */
/*   ...                                                     */

Leave a Reply

Your email address will not be published. Required fields are marked *