Before diving into the data structures, the spec sets two ground rules that everything else follows.

4.1.1 Endianness — Little Endian

All multi-byte numbers in the Foundation layer are stored little endian — the least significant byte comes first. For example, the value 0x1234 is stored as 0x34 0x12 on the wire.

4.1.2 Log Field Transformation — Compressing 2 bytes into 1

The mesh spec often needs to store a value that could be up to 65535 (2 bytes) into a single byte field. It does this using a logarithmic trick: instead of storing the exact value, it stores a log field value n where 2^(n-1) is the largest power of 2 that fits in the real value.

Simple rule: Log field value = the number of bits needed to represent the value. Log 0x01 → value is exactly 1. Log 0x08 → value is somewhere between 128 and 255.

💡 Why is this useful? Saving 1 byte per field matters a lot in BLE mesh where access payload size is limited. The tradeoff is that you lose precision — you only know the range, not the exact value.

Every node in a mesh network carries a Composition Data state. Think of it as a structured data packet that answers: “Who made me? What am I? What can I do? What models do I run?”

The data is split into pages. Page 0 is mandatory. Others are optional. The full state must not exceed the maximum BLE access payload size.

Composition Data Page 0 Fields

Features Bitmask — What the node can do

💡 Example: A node with Features = 0x0003 means bits 0 and 1 are set — it supports both Relay and Proxy. A simple sensor with no relay capability would have Features = 0x0000.

Elements — The building blocks inside a node

A node contains one or more elements. Each element is like a separate logical device inside the node. A smart power strip, for example, might have one element per socket. Each element runs its own set of models.

Visual: A Node with 2 Elements

BlueZ Example — Reading Composition Data via meshctl

In BlueZ’s meshctl tool, after provisioning a node you can retrieve its Composition Data Page 0:

# Launch meshctl and join the network
$ sudo meshctl

# Inside meshctl: provision a nearby unprovisioned device
[meshctl]# discover-unprovisioned on
[meshctl]# provision <UUID>

# After provisioning, send a Config Composition Data Get message
# This is opcode 0x8008, targeting page 0
[meshctl]# menu config
[meshctl - config]# target <unicast_address>
[meshctl - config]# composition-get 0

# The node responds with its Page 0 data.
# BlueZ prints: CID, PID, VID, CRPL, Features, and each element's models

If you are reading raw HCI data, the Composition Data response comes back as a little-endian byte stream. Here is how you would parse the Features field in C:

#include <stdio.h>
#include <stdint.h>

typedef struct {
    uint16_t cid;
    uint16_t pid;
    uint16_t vid;
    uint16_t crpl;
    uint16_t features;
} comp_data_page0_header_t;

void print_features(uint16_t features) {
    printf("Node Features:\n");
    printf("  Relay:     %s\n", (features & (1 << 0)) ? "Yes" : "No");
    printf("  Proxy:     %s\n", (features & (1 << 1)) ? "Yes" : "No");
    printf("  Friend:    %s\n", (features & (1 << 2)) ? "Yes" : "No");
    printf("  Low Power: %s\n", (features & (1 << 3)) ? "Yes" : "No");
}

int main() {
    /* Example: features = 0x0003 means Relay + Proxy supported */
    uint16_t features = 0x0003;
    print_features(features);
    return 0;
}

Once a node is provisioned and its composition is known, the next question is: how does a model know where to send messages, how often, and with what settings? That is controlled by the Model Publication state.

Each model in each element has its own independent Model Publication state instance. The state holds:

4.2.2.1 Publish Address

This is the destination address for messages the model publishes. It can be:

• Unassigned address (0x0000) — model is inactive, sends nothing unsolicited
• Unicast address — messages go to one specific node
• Group address — messages go to all subscribers in a group (e.g. all lights in a room)
• Label UUID — a virtual address derived from a 128-bit UUID

💡 If a model’s publish address is set to 0x0000 (unassigned), it will only reply to acknowledged messages — it never sends anything on its own.

4.2.2.2 Publish Period

The Publish Period is a 1-byte value packed with two fields using a simple bit layout:

The Step Resolution (2 bits) sets the unit of time:

Actual Period = Number of Steps × Step Unit

💡 Example: Byte = 0x26 → binary 0010 0110 → Step Resolution = 00 (100 ms), Number of Steps = 100110 = 38. Publish Period = 38 × 100 ms = 3800 ms = 3.8 seconds.

BlueZ Example — Setting Model Publication via meshctl

# Inside meshctl config menu, target the provisioned node
[meshctl - config]# target 0x0005

# Set publication for a Generic OnOff Server model (SIG Model ID 0x1000)
# Syntax: pub-set <element_address> <pub_address> <appkey_index> <ttl> <period> <retransmit> <model_id>
#
# pub_address  : 0xC000 (a group address — all lights in the room)
# appkey_index : 0      (use AppKey 0)
# ttl          : 5      (message lives for 5 hops)
# period       : 0x26   (38 steps × 100ms = 3.8 seconds)
# retransmit   : 0x05   (5 retransmissions, default interval)
# model_id     : 0x1000 (Generic OnOff Server)

[meshctl - config]# pub-set 0x0005 0xC000 0 5 0x26 0x05 0x1000

# A successful Config Model Publication Status response confirms the change.

Here is how you would build the Publish Period byte in C before passing it to your mesh stack:

#include <stdint.h>
#include <stdio.h>

/* Step Resolution values */
#define STEP_RES_100MS   0x00
#define STEP_RES_1S      0x01
#define STEP_RES_10S     0x02
#define STEP_RES_10MIN   0x03

uint8_t build_publish_period(uint8_t steps, uint8_t resolution) {
    /* steps       : 0-63  (6 bits)
       resolution  : 0-3   (2 bits, goes into bits 7:6) */
    return (uint8_t)((resolution << 6) | (steps & 0x3F));
}

int main() {
    /* Publish every 1 second: 1 step × 1s resolution */
    uint8_t period = build_publish_period(1, STEP_RES_1S);
    printf("Publish Period byte for 1s: 0x%02X\n", period);  /* 0x41 */

    /* Publish every 10 minutes */
    uint8_t period2 = build_publish_period(1, STEP_RES_10MIN);
    printf("Publish Period byte for 10min: 0x%02X\n", period2);  /* 0xC1 */

    return 0;
}