Electronics notes/Various wireless notes
- 1 License-Free and ISM bands and such
- 2 Contact, or maybe a meter
- 2.1 RFID, NFC, contactless smart cards
- 2.1.1 On power
- 2.1.2 Frequency use
- 2.1.3 Security criticism
- 2.1.4 Communication breakdown; RFID/NFC blocking wallet
- 2.1.5 Notes on cards and protocols
- 18.104.22.168 Proximity card
- 22.214.171.124 NFC
- 126.96.36.199 Contactless smart card
- 188.8.131.52 UHF
- 184.108.40.206 Animal chipping
- 2.1.6 See also
- 2.1 RFID, NFC, contactless smart cards
- 3 order of meters
- 3.1 IrDA
- 3.2 Bluetooth
- 3.2.1 Versions and speed
- 3.2.2 Bluetooth range
- 3.2.3 Latency
- 3.2.4 Audio
- 3.2.5 Beacons
- 3.2.6 On estimating distance
- 3.2.7 Some lower level details
- 3.2.8 Serial module notes
- 3.2.9 HC-05, HC-06
- 3.3 UWB
- 4 order of dozens of or a hundred meters
- 4.1 WiFi
- 4.2 License-free sub-gigahertz
- 4.3 RC aircraft and such
- 4.4 On range, walls, and antennae
- 4.5 802.15
- 4.5.1 802.15.4 ("Low Rate WPAN")
- 4.6 ANT
- 5 Kilometers or more
- 6 Not yet sorted
- 7 RC
- 8 Unsorted
License-Free and ISM bands and such
ISM bands were reserved partly to avoid RF communication in these bands, so that certain industrial, scientific and medical ('ISM') devices could use these frequencies without having to worry about causing interference.
The sub-GHz part of these are associated with some basic remotes, older garage remotes, wireless weather stations, home automation, that sort of low-data-rate use (that often deal with interference just by repeating their message a bunch) though there are newer things, like 802.15.4 (e.g. ZigBee) and LoRa using it for more complex communication.
The largest reason is probably that manufacturers do not need to buy licenses to put out products that use these ranges.
In particular 2.4GHz, where the recognizable names include WiFi and bluetooth.
There are a few other bands that are not strictly ISM but are similar in legal practice.
The best known bands seem to be:
- 13.56 MHz (center of 13.553 MHz ~ 13.567 MHz)
- 315MHz (a.k.a. 310MHz?)
- 418MHz (verify)
- 433Mhz, a.k.a. 434MHz
- Usually refers to 433.05–434.79MHz, the center of which is 433.92Mhz
- ISM band used in ITU region 1 (Europe, Africa, part of the middle east, former Soviet Union)
- there are be local variations of how large this range is (e.g. in the UK(verify))
- not usable in other regions
- various devices use ~5mW-50mW of transmitted power(verify) with various antennae to reach 100m, 200m, sometimes over 1km of line-of-sight range(verify)
- Users: various short-range household remote devices
- LPD433 defines 69 channels (25kHz spacing) with at most 10mW
- There are some license-free bands used largely for walkie talkies
- refers to an unlicensed band in Europe (not ISM, but usable under similar terms (verify))
- The extend varies. You may see references like 868.0-868.6MHz or 863-870MHz or 868-870MHz, 869MHz, 868.35, etc.
- Split into sub-bands, each with their own typical sort of use, limitations on transmit power and duty cycle. Some have channels, some don't. (see e.g. ), SRD860
- Documents seem to contradict each other on detauls, so this probably varies per region and probably has over time as well.
- People seem to like 869.4..869.65 MHz sub-range - it's one of the wider ones, allows the strongest transmission (500mW) and a decent duty cycle (up to 10%), if you meet certain conditions
- Not usable in the US because of 824–894MHz mobile bands(verify)
- One of the RFID ranges (865–868) is in/near this, though since it too is short-range it ought not to cause too many interference problems.
- I have seen mention of 860.48–879.51 - what's this?(verify)
- Users: various short-range household remote devices (e.g. remote controlled switches, wireless thermometers, some home automation), a few wireless mice, one variant of ZigBee, (check more (verify))
- 915MHz (center of 902..928 MHz)
- the common name for, and center of, the 902-928MHz band
- ISM band in ITU region 2(meaning America)
- Note this is close to the 935-960 MHz (or is that 872-960 MHz?) mobile band (verify)
- not usable in Europe because of that mobile band (verify)
- Users: various short-range household remote devices and some computer peripherals, IEEE 802.15.4 (Zigbee), (check more (verify))
- 2.400–2.500 GHz, also referred to by its center, 2450MHz
- Note: Microwave ovens are also right in the middle of this. Little makes it out of them, but if well-placed it may still interfere(verify)
- Users: IEEE 802.11 (WiFi), Bluetooth, IEEE 802.15.4 (Zigbee), some short-range household remote devices and some computer peripherals, some cordless phones (verify)
- 27.12 MHz (center of 26.957 MHz .. 27.283 MH)
- 5.8 GHz (center of 5.725 GHz .. 5.875 GHz)
- 24.125 GHz (center of 24 GHz .. 24.25 GHz)
- 61.25 GHz (center of 61 GHz .. 61.5 GHz)
Contact, or maybe a meter
RFID, NFC, contactless smart cards
|This article/section is a stub — probably a pile of half-sorted notes, is not well-checked so may have incorrect bits. (Feel free to ignore, or tell me)|
In RFID (Radio-frequency identification), the "identificaton" points at that this started as little more than "I am tag with this number" (very basic, and not particularly secure).
We've built a lot on top of that since, making it more general communication.
RFID often refers to a few specific designs, most of which are small - and fairly easily hidden, particularly in/on/as small surfaces, relatively hidden devices.
It's used in things like:
- In supply management ('what shipment is this', etc.)
- As a high-tech dogtag of expensive items, or items in general (books, clothes, sometimes everything sold in a store)
- because they can be fairly small and hidden
- (note that there are simpler and cheaper tech for anti-theft in stores, e.g. 8.2MHZ EAS and 58 kHz acoustomagnetic)
- Access control (often used purely as tokens, i.e. one-factor security)
- Chipping your pets
- passive tags
- which use an external source of power - often the communication itself (the reason for the large coiled antennae?)
- can be very small and thin, and therefore almost invisibly embedded in many things.
- common, because not having to care about power at all is very convenient
- active tags
- battery-powered (...so limited lifespan and more expensive)
- can signal autonomously
- can be used over considerably larger distances
- can often communicate faster
- battery assisted passive (BAP)
- active tags that take negligible power from their batteries until triggered by communication
- cannot signal autonomously
|This article/section is a stub — probably a pile of half-sorted notes, is not well-checked so may have incorrect bits. (Feel free to ignore, or tell me)|
Sorted approximately by common use:
- Low-frequency - 120kHz .. 150kHz range (sometimes even more broadly mentioned as 100kHz .. 150kHz range)
- for many countries often specifically ~125 or ~134.2 kHz
- these are more or less interchangeable
- You can fairly easily get readers (and writers) for this.
- High-frequency - 13.56 MHz (worldwide ISM(verify))
- Used in access badges, bank cards, library cards, loyalty cards, etc.
- Example: Mifare (which is sometimes known for )
- 868MHz (EU unlicensed) and ~915MHz (US unlicensed) (think ISM)
- 2.4Hz and 5GHz - expensive tags
In term of 'what's in your wallet', it's probably mostly ~125 / ~134 kHz, and 13.56 MHz (verify)
Communication breakdown; RFID/NFC blocking wallet
Notes on cards and protocols
|This article/section is a stub — probably a pile of half-sorted notes, is not well-checked so may have incorrect bits. (Feel free to ignore, or tell me)|
Range-wise 'proximity cards' are contrasted with vicinity cards. Orders of magnitude,
- Vicinity roughly means 'should work at 1m'
- proximity is 'may work up to 50cm', but usually <10cm meaning 'basically touching'.
Early proximity cards (proxcards) may hold just a few dozen buts (about as little as a magnetic stripe card), some designs maybe a kilobyte.
Depending on purpose, you may opt for read-only ones or read-write ones.
They were originally passive cards, and often still are. Powered by the reader so must be held close.
Active proxcards have a battery (lifetime generally on the order of a few years), and may be contacted at 2 meters or so, and a few more, useful for things like automated toll collection, gate opening, and such.
Typically around 125kHz.
Many are ISO 7810 ID-1 sized cards, but they can come in any shape.
There are dozens of subtle variations, varied on-the-air modulations, some standards that settle implementation and and size and protocol and various cards that speak multiple things, so it's not easy to summarize well
T5557 is a Atmel read-write IC at 125kHz with 330 bits of EEPROM.
Has a 330-bit EEPROM, organized as ten 33-bit blocks. You write a block at a time.
- Block 0 is reserved for operation modes
- Block 7 may contain a password
The first bit is a lock bit. Once set, the IC refuses to alter that block.
64 bits of ROM (of which only 40 are usable, the other 9+10+4+1 are settled via header, parity, and stop)
TK4100 seems to just be a manufacturer difference(verify)
128 bits of ROM (of which only 40 are usable, the other 9+10+4+1 are settled via header, parity, and stop)
EM4205 / EM4305
512 bit read/write
(difference between EM4205 / EM4305 is purely in capacitance?)
125 / 134.2 kHz
125 / 134.2 kHz
Unsorted proximity cards
For context, 'near field' is a generic term around EM that points out (roughly) that closeby, the wave behaviour works out a bit differently than at a distance.
...so near-Field-Communication (NFC) could have been general term for any shortish range communication (because of wavelength and/or transmit power),
...but it became a bit of a brand name for something more specific, usually:
- based on inductive coupling between two antennas (simple, cheap, easy to miniaturize)
- using ISM band (no licensing)
- something that communicates with HF RFID (at 13.56 MHz, see ISO 14443)
- ...often conforming to to ISO 14443 (proximity, ~10cm max range) or ISO 15693 (vicinity),
- in the same context, RFID usually refers to quite varied systems mostly described by the older ISO 18000.
NFC (Near Field Communication) is often thought of as an extension to RFID.
Which is a little fuzzy.
- often, people use RFID to mean older simpler identitying (and often 125kHz) implementations,
- often, people use NFC to mean mean newer, fancier, communicating (and often 13.56MHz) implementations.
...but sometimes, people mix the terms, so the best way to be sure is to figure out the specific use.
Physics-wise, the above-described RFID / NFC can be designed to work up to a meter, but any specific antenna design may reduce that, to something like 20cm, <10cm, and other 'basically touching' numbers.
This is sometimes by design - e.g.
- someone shipping boxes boxes will be a lot happier if it just scans the thing they're bumping their scanner into, not everything on the closet ten pallets.
- Similar arguments go for security of entry cards
- Similar arguments go for security of biometric passports
Anything designed for range like ~1 meter tends to be called vicinity cards .
"So what's the difference between RFID and NFC?"
While NFC protocols are based on ISO 14443 and (parts of) ISO 18092, in particular covering the physical communication, but the specific cards ICs are not(verify)
In the real world, you could say that NFC is a specific subset of HF RFID, and also that it's its own refined thing.
For example, looking at the Android NFC docs it lists:
- NFC-A (ISO 14443-3A)
- NFC-B (ISO 14443-3B)
- NFC-F (JIS 6319-4), a.k.a. FeliCa a.k.a. Felicity Card (e.g. used in Hong Kong's Octopus card). Was proposed to be ISO 14443 type C, but rejected as such
- NFC-V (ISO 15693) - vicinity cards
A vaguer answer is that yeah, you can see them as roughly the same, but with NFC often points at the newer bits - because RFID by nature was only designed to identify things, not to e.g. do secure communication.
...for context: in RFID terminology
- 125..134 kHz is Low Frequency (LF), and most classical RFID did this
- 13.56 MHz is High Frequency (HF)
- 856 MHz to 960 MHz is Ultra High Frequency (UHF)
At the same time, NFC seems be the term people see most often, so it might become the popular name? In particular, phones with NFC tend to have
- Reader/writer mode - interact with NFC(/RFID) tags, in practice often contactless smart cards
- P2P mode - use it as a network link. Used e.g. by Android Beam.
- e.g. phone at pay terminal, phone negotiating that it can get onto WiFi by proving it is physically at the modem i.e. inside, phone talking to a printer
- Card emulation mode - pretend you're an NFC/RFID tag
NDEF (NFC Data Exchange Format) is mostly a protocol that lets you do certificate-based signing (asymmetric cryptography), so you can verify the origin's authenticity.
As it's intended to also work with NFC tags, the message and a signature record tends to be pretty compact, and may store little more than URLs or basic media (in MIME messages).
In practice, you'ld also think of the NDEF API in phones to actually send these. It'll read NFC tags data, try to figure out the type, and tell you
Android Beam and similar
Contactless smart card
Seems to refer to cards with
- a read-only CSN/UID
- a read-write IC
- some basic security
- usually in a ISO 7810 sized card (but also in keyfobs, etc.)
...which makes them a little more complex than classic proxcards.
Typically at 13.56 MHz ('RFID HF')
Protocols vary, but MiFare is one of the largest.
- ISO 14443 - proximity cards at 13.56MHz
- Type A and Type B, same protocol but varying modulation, coding, init
- ISO 15693 - vicinity cards (~1meter) at 13.56MHz
- ISO 18000 - varied systems at different frequencies
- below 135kHz
- at 13.56MHz
- at 2.45GHz
- within 860MHz .. 960MHz
- at 433MHz
The acronym originally stood for its creators, "Europay, Mastercard, and Visa" https://en.wikipedia.org/wiki/EMV
EU identity cards
order of meters
Old IrDA could do dozens of kbit/s, much like serial port of the time.
New variants can do multiple Mbits (fastest variant 1Gbit/s in theory), and are recently seeing some different applications (e.g. fast photo transfer).
Line of sight signalling, so in many uses fell out of style in favour of things like WiFi and Bluetooth.
- ~1m max, half that is typically best for speed(verify)
- For lower power devices it's ~20cm.
- ((verify)whether high-speed devices are shorter-range)
Bluetooth works in 2.4 - 2.4835 GHz, in 79 separate 1Mhz channels
Bluetooth continuously hops channels, to lessen the probability of consistent interference with other devices (other bluetooth, and in particular also 2.4GHz WiFi).
Busy areas still have congestion problems, though.
Versions and speed
- Bluetooth 1.x (1999, 2001, 2003) is 1mbit in theory, ~700Kbit/s in practice
- its mode/rate can be referred to as BR
- Bluetooth 2 (2004,2007)
- introduced EDR, which can reach maybe 2Mbit in practice
- (2.1 added Secure Simple Pairing, which sped that up)
- Bluetooth 3 (2009) plain is still that ~2MBit
- Bluetooth 3 HS can do ~24Mbit -- by basically handing over to 802.11 (roughly WiFi)(verify).
- HS is not a mandatory part of the spec, and I'm not sure a lot of devices support it(verify)
- Bluetooth 4.x (2010, 2013, 2014)
- Bluetooth Low Energy (once marketed as Bluetooth Smart) has lower power consumption that 1..3
- ...alongside the classic ones
- 4.1 added ability for devices to talk to each other
- 4.2 increased payload size
- Bluetooth 5 (2016)
- mostly didn't change rates
- Added BLE modes:
- a 2 Mbit/s when at short range
- a 125kBit/s which can carry a little further (useful e.g. for sensors)
The first three are their own thing, which we now call 'bluetooth classic'.
The modes defined in them (BR and EDR) still exist in the 4 and 5 spec, so we also refer to it by that.
Versions 4 and 5's BLE is a different and incompatible stack from bluetooth classic (different modulation mode, different link layer packet format), but was adopted into the bluetooth standard, and both stacks can coexist.
Bluetooth 4 and 5 allows (but does not require) hardware to support both BLE and classic. It seems a lot of modules do both(verify).
Bluetooth defined classes which correspond to transmit power.
- Class 3: 0dBm
- Class 2: 4dBm (probably most common in mobile devices)
- Class 1: 20dBm
More were added over time, e.g. Class 4 (-3dBm), Class 1.5 (10dBm).
In Bluetooth classic, range correlated largely with transmit power, so basically we said class 2 is 10m, class 1 = 100m, class 3 is 1m, class 4 is 0.5m, class 1.5 is 20m.
This got more interesting around BLE, because it can get noticeably more range out of the same power (you might get 100m out of +4dB, and a few hundred meters out of +10ish though this requires some specific hardware design and good conditions), so now equating the classes with range is now fuzzier.
- various devices make a choice in the range/battery life tradeoff.
- because connection is two-way, you're effectively getting the shortest range between two connected devices
- range is significantly lowered by walls. (like with WiFi)
- If many devices choose to be shorter-ranged bluetooth, this may mean less collision/congestion with your neighbour's devices
- but you don't really control this
Bluetooth has inherent latency, varying with things like
- packet size - larger packets may mean slightly more throughput (because less overhead), but take more time to send so mean slightly higher latency (basic network theory stuff)
- congestion - it's in the same band as all other Bluetooth devices, WiFi, and some other things
- Bluetooth version, as recent versions introduced some congestion avoidance (verify)
- some packets may arrive in maybe 3ms
- but that's roughly the best case you can barely even guarantee under lab conditions, and you will not consistently get that when there are other devices in the band.
- so don't count on that
- jitter - the variation in latency due to low level details, will almost always add a few ms
- may rise to perhaps 15ms or so with moderate congestion(verify)
- it is fairly likely that the communication layer can move a packet to another device in perhaps 8ms.
- you can be happy if you get a fairly-consistent average of ~5 to 10ms.
- bandwidth lowers and latency and jitter rise with more devices in the band
Which for most uses is plenty fast.
And for a few (e.g. music production) can be annoying or even prohibitive.
Bluetooth latency around audio
- don't expect lower than maybe 20ms to work outside of lab conditions
- don't expect lower than 40-50ms in real hardware
- for designs that choose not to care so much, expect on the order of 200ms
- Bluetooth is a pretty bad choice for low latency audio.
- classical analog RF was basically instantaneous (...more as a side effect than a design choice)
- if you need digital, then things specifically made for it can do much better (e.g. ULX-D is ~3ms).
- when you care about latency, just grab wired headphones, or maybe digital RF
Audio isn't the smallest packets, so transmitting audio is going to imply a little latency.
But the larger issue is the jitter - regularity is important, because if audio data is later than scheduled, it's an audible gap, i.e. choppiness / stutter.
The easiest workaround is to buffer more than the jitter will introduce, play from that buffer. As long as that buffer doesn't empty, you're fine.
Bluetooth and a bunch of devices around (and/or moderate WiFi use) easily means 15ms of jitter, and probably more at busy times.
A buffer of at least 25ms would be a good idea, but it'd still fail under heavier congestion, so many headphones add a more comfortable amount of buffering, and may dynamically increase the amount of buffering when it still runs into problems (which is why turning it off and on sometimes helps latency).
Because people are going to mind stuttering a lot more than a little delay, a lot of devices err on the side of larger rather than smaller buffers. This has nothing to do with price, it's a tradeoff involving with something you cannot control. .
Both transmitter and receiver might add buffers, and since neither side knows or controls what the other does, things can add up quickly, to rarely be lower than 50ms, and easily be in the 200-300ms range. Even 500ms isn't crazy to see.
Also, smartphones may buffer a little more than general transmitters, so that they can sleep their CPU more of the time, saving battery.
The codec side of this is a little confusing.
People associate aptX with low latency, but note that aptX in the broad sense may only aim for 50-150ms, which is only barely better than bluetooth itself (aptX is non-standard).
Only aptX LL aims for 35-50ms.
...and there are some cases without aptX LL that are actually just as low latency(verify).
How much do you need?
In most uses, people don't really care.
Say, when listening to music, what's it going to be late to?
For movie watching, you probably won't notice when audio is 30ms later than the video, that's one or two frames. You may unconsciously adjust up to to 100ms. More than 100 or 200ms starts to look wrong. (I've measured my transmitter+headphone setup at around 300ms, which is certainly visible when you look for it, though I can mostly ignore it)
One practical way to adjust for this is to delay the video by the same amount. Various video players can do this (e.g. press j and k in VLC). Various TVs can be told to do this. Often manually, and sometimes there's a feature to detect the delay automatically (e.g. iOS Wireless Audio Sync and many things like it).
When gamers consider themselves pro, they become millisecond freaks and will almost always use wired headphones. You're not moving around anyway, so why care about a wire?
Music production and recording is a more complex matter.
For some things it's doesn't matter at all - e.g. listening to the result of a song you're making.
Live-ish things are fine when delay is under 5-10ms, and note you'll get that much in a moderately large practice space anyway just for speed-of-sound reasons and have learned to adjust for that.
Yet some tasks in music recording and audio engineering absolutely stand and fall with latency, and for those those you will grab your wired headphones (or analog RF wireless if you have them. They seem to not be made anymore?). Because no bluetooth wireless audio can be pushed to <5ms reliably.
MIDI is a little different.
For one, the packets are tiny, and in theory you could send data send as soon as possible and get under 10ms for most notes.
However, if congestion means that some notes may come in maybe 20ms late, that messes up regularity and timing.
You can, like with audio, get more regularity with some more buffering, but that means bluetooth MIDI may aim lower, but just not be able to guarantee it.
It's also why you probably never want a bluetooth drumkit.
Headphones (and speakers)
When looking for wireless headphones, look at the audio profiles.
These are low sample rate (8 kHz or 16 kHz), mono things, and sound like it.
Headphones meant for music may (and bluetooth speakers and such usually will) support A2DP instead to get music-quality sound (not audiophile guaranteed, but good enough for the bulk of us). (Note that A2DP supports various codecs, including lower-quality ones, and the devices may separately support HFP and/or HSP for compatibility, so configuration can matter, but you can often assume a setup picks the best it's capable of)
A2DP devices tend to also support remote volume control via AVRCP.
When considering bluetooth sound (e.g. music around the house), keep in mind that many transmitters are class 2 and so do at most 10 meters (...both ends matter, since both are transceivers), and that limited bandwidth may may degrade quality (instead of cutting out. In particular some headsets seem to do this).
There are some Class 1 headphones out there. They (almost per definition) use more power, so tend to have shorter battery life.
If you like your own headphones, you can buy a battery-powered A2DP-capable receiver and plug your own favourite headphones into those. These are usually class 2 devices. Class 1 variants are regularly mains powered (their point apparently being less cable clutter).
On estimating distance
- It might be great to e.g. locate a device, but will never be a way of accurate measurement.
- error increases with distance. Don't expect much at over 10 or 20m.
Since most Bluetooth stacks give you the RSSI of at least advertisement/scan response packets, it's possible to estimate distance to anything that actively gives you Tx power, including at least everything that advertises.
If you assume a lack of obstacles and free space, then then signal loss mainly just follows inverse square law due to distance.
So if you have previously measure RSSI at a known distance, then the distance to the device later, given RSSI later, is (proportional to)
pow(10, (reference_db - received_rssi)/(10*n))
- it's handy if you measure that reference db is at 1m, because that basically means the above gives meters (rather than some proportional thing)
- n describes how easily the signal passes, and is a bit of a fudge factor.
- accuracy decreases with distance
- this is rough at best, for various reasons - see below.
However, there are many complicating factors, which together can easily contribute 10, 20dB of variation, and according inaccuracies in the calculated distance.
Some of them can be controlled for, e.g.
- tx power - is actively reported by bluetooth (which means you won't estimate stronger senders as being closer and weaker as further away, as just RSSI would imply.
Some of them are unknowns but fixed enough that you can calibrate them away for specific sending hardware
- antenna and other losses
- For most devices you do not know the RSSI at 1 meter, even though you know the Tx power
- for beacons you do, because they have been characterized and actively advertise a "RSSI at 1 meter" calibration-like thing
- e.g. ESPresence says that if you use your phone, you probably want to do a "RSSI at 1 meter" calibration once.
- ...but that is manual work that you can only do when you control all hardware.
Some of them are unknowns but can be improved with a little data filtering or fitting
- tx power granularity and amount of samples - if reported in 1dB resolution it's still somewhat sort of rough. Also, the variation
- you can make this slightly better with some lowpassing
Some are unknowns with unknown variations you cannot really know, e.g.
- jitter in dB of devices that are not moving may already be 5dB - that's sort of an upper limit
- orientation (antennas are somewhat directional)
- your hand around a phone, or your body between the devices, blocking a decent amount of signal
- multipath effects
- radio / channel specifics
Some lower level details
Advertisements and scans
Advertisement are unsolicited packets that say "I am device X and I exist"
Devices do not need to do this all the time, or at all.
Advertisement interval consists of
- fixed set interval between 20ms to 10.24 seconds in (16K) steps of 0.625ms
- plus an automatic random 0ms to 10ms.
Because a device will receive see a subset of advertisement packets(verify), devices that want to be discovered reasonably quickly will stick under intervals of few hundred ms at most.
I see iPhones mentioned a bunch - presumably they look less often(verify), so aggressive 20ms interval is more useful if you want to be discovered quickly?  It will notice devices with longer intervals eventually.
You can save power
- if your use case lets you be discoverable for a relatively short time - particularly convenient in cases you want specific-device pairing anyway.
- ...and possibly still send out advertisemet, but much slower, when not in that mode
e.g. a checkout system with bluetooth PIN device not currently in use might still care to alert you when that device is out of range or off (and doing it from the device's side lets it sleep more), and it's perfectly fine at whatever the slowest interval is.
A passive scan refers to listening to above-mentioned advertisements.
An active scan sends SCAN_REQUEST packets, and expects SCAN_RESPONSE in response.
Such a response also tends to contain more information than advertisement packets(verify)
Some terminology you'll find
Serial module notes
(Note that classic bluetooth had a serial profile, BLE does not and relies on some custom-but-well-known extensions)
TI CC254x based
BlueSMIRF (RN-42, RN-41)
order of dozens of or a hundred meters
Note that some of these can be pushed to hundreds or perhaps a thousand meters -- in specifically designed setups.
Radio frequency communication used for things like home automation, car remotes, some wireless mice and presenters, RF-triggered flashes in photography, and more - many of which need only one-way communication.
The frequency that devices sill / you can use in your area varies.
Internationally these ranges are defined by many local standards, but for ease these are sometimes referred to as ISM bands, a US-centric term because it comes from its ITU Radio Regulations, for frequencies that were once reserved for industrial, scientific, and medical use.
Device designers may well separate a radio module from the rest of a device, to easily make different versions for different regions.
The sub-GHz bands uses are mainly a new MHz around...
- 315MHz or 915MHz in the US
- see e.g. FCC Part 15.231, 15.205; 15.247, 15.249
- 433MHz or 868MHz in Europe
- see e.g. ETSI EN 300 220
- 433MHz in Africa (verify)
- 315MHz or 433MHz in most of Asia (verify)
- 315MHz or 426MHz in Japan (verify)
- see e.g. ARIB STD-T67
- 433MHz or 915MHz in Australia (verify)
...because these are license-free bands (given you stick to some basic restrictions - mostly power output (range) and duty cycle, largely to make sure products will play nice enough with each other around).
Many of these bands have multiple distinct frequencies/channels defined in them. This may mean devices may be tuned to a specific sub-ranges/channel, may well use different modulation.
Regulations may also limits lowish transmission power.
This is often more or less by design, to limit range and thereby significantly reduce interference from lots of dumb
Range for is limited by the lowish transmission power, and the often very small and simple antenna.
Simple devices are very short range (order of 20m).
Some specific designs may be defined for order of 100m, 200m, 1km.
Signal modulation is often either ASK or FSK, or sometimes PSK, which are three fairly basic ways of modulating data - via amplitude, frequency, and phase:
- ASK, Amplitude shift keying , often specifically:
- OOK (the simplest and probably most common form of ASK)
- FSK, Frequency shift keying , including:
- BFSK, a.k.a. 2-FSK, is probably its most basic form
- GFSK applies a Gaussian filter to pulses, to control its (out-of-band) bandwidth, and for more power efficiency, at the cost of some smearing between symbols (verify)
- MSK is a type of continuous-phase frequency-shift keying, which makes more efficient use of the aether
- GMSK adds the Gaussian filter details to MSK
- PSK, Phase-shift keying , not used much
When buying devices, the common acronyms are ASK, FSK, GFSK, MSK, and OOK.
- 868 band and duty cycle  
Speed in sub-GHZ ISM is typically low, in part because of a specific channel's bandwidth (which sometimes helps meet certification requirement). in part to make it more robust around noise, with simpler (and therefore cheaper) hardware.
The simplest devices may use bit lengths of on the order of 1ms, for an effective data rates of a few hundred bits per second.
Slightly fancier designs may be listed as 4800bits/s or 19200bits/s or so, in some cases up to perhaps 256kbps or 500kbps .
...in relatively ideal conditions. A speed like 100kbits/s is already hard to do reliably.
In theory you can do more, but in practice you have to consider distance, noise, interfering senders in the same band and thereby retransmission.
Since there is no exact reference timer, line codes often use things like Manchester coding or something else where bit trains are unambiguous without strict timing.
Line code, protocol
Line code specifies how exactly user data is coded on the channel. This is often designed with the physical medium in mind.
The most basic radios do not apply a line code, just mirror the state of an input pin on the aether (with whatever modulation they do), and receivers mirror that on their output pin again, maybe sending their command a few times in a row, but otherwise leave it up to simple encoder/decoder chips to fix noise issues, collission issues, or other robustness/cleverness.
Fancier radios may act more like serial ports/modems with a small FIFO buffer, and may use a coding that tries to avoid noise and timing issues.
There are many device-specific protocols - often somewhat proprietary, but often easy enough to interpret and imitate if you wish.
A good number of such applications will use a matching pair of ICs (one encoding on the sending side, one decoding on the receiver side), to encode/decode the data to whatever function they have and with specific protocol/function assumptions hardcoded.
You often see protocols use a preamble, so that the receiver can have automatic gain adjustment, without missing the start of basically all packets (since such receivers often end up adjusting to maximum gain when they hear no transmissions).
You pretty much have to be able to deal with other senders in the same band.
There are duty cycle limitations on devices (via certification, anything you bought will adhere). This often means yours probably gets through soon enough. Things like remotes (which rarely send) may well send something a few times in with some short interval, just to increase the chance one gets through.
If you want to avoid erronously acting on someone else's data, you'll probably want to make your protocol include protocol-specific and/or product/project-specific values.
In things like home automation there are typically also per-device addresses (which you can often physically set on each device) to make devices specific to a house, or even a room or so.
Some protocol names
Within home automation, protocols / device implementations include (very very roughly from wider to more specific use):
You can often find specific details in some general-purpose DIY home automation projects.
- Domia lite / Bye Bye Standby (BBSB)
- there's a simple and an advanced variant of the protocol
- KlikOn-KlikOff (a.k.a. KlikAan KlikUit (kaku) and other translations)
- Seems to often use PT2262 (encoder) and PT2272 (decoder) ICs 
- Home Easy 
- X10 - see also Localish communication notes#X10
- W800RF32 (X-10 RF wireless?)
- Conrad FS20 (868.35 AM (/915?))
- based on house codes (8 digits?) (meant for isolation from your neighbours) and addresses (256 of them)
- addresses are subdivided into 225 unique addresses, 15 function group addresses, 15 local master adresses, and 1 global master address -- mostly for the ability of independent and/or grouped addressing of any device
- RFXCOM RFXSensor, RFXPower
- Oregon Scientific
- protocol version 1.0
- protocol version 2.1
- protocol version 3.0
- Ikea Koppla (434 MHz)
- Xanura (X10 plus additions)
- Skytronic Homelink
- Harrison (Curtain Motors)
- Intertechno (434 MHz)
- ATI Remote Wonder / Medion
- other devices such as thermostats, wireless doorbells, weather stations, toys, utility
- Elro AB600 (433MHz) (dimmer?)
- La Crosse TX3 / TX4 (weather station)
See also (unsorted)
RC aircraft and such
On the airplane control-protocol side, we have
- length of pulse sets position - in milliseconds
- the oldest, most standard, and often a default
- each channel has a wire on the receiving end, which is a bit chunky
- PPM means position of pulse sets position
- the C basically means it's defined to let you send all channels over a single wire (timesliced, 20ms frames)
- not sure why they didn't use PWM in such a framing, it might've been less work?(verify)
- S.BUS (developed by Futaba)
- Spektrum sattelite (verify)
Note that PWM and PPM in this context actually refer using these modulation types in a somewhat more specific standard. This is why elsewhere you'll find them called "RC PWM", "RC PPM"
On range, walls, and antennae
802.15 in general describes wireless personal area network (WPAN), which induces a handful of distinct things. See http://en.wikipedia.org/wiki/802.15
You're likely looking specifically for 802.15.4, "Low Rate WPAN"
And possibly specifically zigbee.
802.15.4 ("Low Rate WPAN")
Useful for sensor networks, usually more so than other options (such as Bluetooth), because of things like meshing, reasonable distance, the option to use little power.
The most basic protocol attempts to ensure proper delivery (checksum, ACKs, retransmission), which is a whole bunch of work you don't have to do yourself.
Range is ~100m in theory, some variants more, though in general you shouldn't count on more than two or three dozen meters - much like WiFi.
On names, protocols, (xbee) series, firmware, and other variations
Some of the basic terms:
- 802.15.4 (protocol)
- There are currently two revisions, IEEE 802.15.4-2003 and IEEE 802.15.4-2006
- mostly specifies the physical communication layers (PHY, MAC), which allows basic point-to-point and broadcast communication. The module being sent to must be in sight (no relaying of messages). Anything more complex than that has to happen by additional protocols provided on top, such as ZigBee, MiWi, WirelessHART.
- ZigBee (protocol)
- A protocol specification defined by the ZigBee Alliance
- There are currently four versions, ZigBee 1.0 (2004), ZigBee 2006, ZigBee 2007, and ZigBee 2007/Pro
- a mesh network; nodes can relay messages. That is, end devices talk only to routers, routers can relay, and and a network must have one coordinator. All nodes could be set up as routers (though that takes more power)
- Compared to basic 802.15.4, ZigBee adds that mesh routing, some extra encryption, node association (and can require authentication to do so)
- XBee is a brand name from Digi International (formerly MaxStream), mainly referring to a line of products with a shared pinout (but not all of which are compatible on-air)
- XBee Series (mostly seen: 1 and 2) basically refers to products with different chipsets
- terminology specific to Digi. Mostly seen on 2.4GHz Xbees, and seem more rarely used on other modules.(verify))
- Firmware is made for a specific chipset. As a result
- Series 1 (freescale chipset) can run 802.15.4-compliant firmware and Digimesh, and is often sold with a name including 'Series 1' or '802.15.4'
- Series 2 (ember chipset) can run ZNet 2.5 and ZB (ZigBee implementations) and maybe sold with names including ZNet 2.5, ZB, and S2B.
- Series 2B seems to be a physical redesign of series 2 (its pro variants) to squeeze out a little more power. Otherwise equivalent to Series 2.
- Series 2C - (verify)
- Series 3 seems to refer to XSC (verify) (the reference is not seen much)
- Series 4 seems to refer to to 900MHz devices. (verify) (the reference is not seen much)
- Series 5 seems to refer to to 868MHz devices. (verify) (the reference is not seen much)
- You cannot communicate between series 1 and 2 xbees (but apparently almost entirely because of because of protocol differences. (verify))
- XBee Pro versus plain XBee
- most of the difference lies in transmit power and range
- Not to be confused with Zigbee Pro
- ZigBee Pro
- is about ZigBee 'stack profiles': Plain zigbee (ZigBee stack profile 1) is simpler and enough for most home and many commercial uses. ZigBee Pro (ZigBee stack profile 2) adds multi-casting, many-to-one routing and has some more security options. (verify)
- Both non-pro and pro can do mesh networking, but Pro seems to be a little better at it larger-scale networks (verify)
- It seems you can mostly mix Pro with non-Pro (unless you use Pro's high security mode) (verify)
Some of the most confusing details come from the fact that chipset, Xbee series, usable firmware and resulting protocols are all entangled.
Also, even within the same protocol you can use firmware to make nodes take different roles
(note also that Digi XBees are not the only devices that speak 802.15.4 or ZigBee, though if this summary focuses on them)
Protocol-wise, a device can speak speak bare 802.15.4, ZigBee, or something else. For example, XBee also sees use of DigiMesh. These are distinct protocols, and most are incompatible on the air.
- 'raw' 802.15.4 protocol
- Talks to (all) neighbouring devices.
- sleeps most of the time. Does time synchronization so that everything talks in bursts (which saves power, particularly when there is little to communicate)
- The easier option for point to point (and broadcast, a.k.a. point to multi-point) communication, but it doesn't do all the things ZigBee can, particularly meshing
- for Xbee: firmware that speaks this is made only for Series 1 (freescale), not for Series 2 (Ember) chipset.
- Digimesh protocol
- A meshing protocol, functionally much like ZigBee, but not compatible with ZigBee
- Originally only available for 900MHz devices.
- Now also usable by Series 1 XBee, but not with series 2 Xbees (you want ZigBee instead)
- Allows sleeping routers, saving power.
- (some extra notes about digimesh and versions of series 1: )
- ZNet protocol - an implementation of Zigbee by Ember
- Can be considered an interim implementation; you probably want ZB instead
- XBee: usable by series 2, not by series 1. Series 2 (which use Ember chipsets) seems shipped with Znet 2.5 (perhaps more recently shipped with ZB?)
- ZB protocol - an implementation of ZigBee, coded to the 2007/Pro version of ZigBee - a better feature set than ZNet
- Xbee: Usable by series 2, not series 1.
- (based on Ember ZNet 3?)
- There was a beta version of a freescale ZigBee stack (i.e. ZigBee for Series 1) but it was discontinued. 
You can load various types of firmware into the modules. This defines both what protocol it speaks. In ZigBee meshing it also defines what role it takes (and note that a ZigBee network must have one coordinator) The rest of the devices can be routers, or endpoints (which can use less power).
For XBees, the series represent different chipsets:
- Series 1 can run basic 802.15.4 or Digimesh
- Series 2 can run Znet 2.5 or ZB (implementations of earlier and later spec of ZigBee)
What you can do is restricted by
- the hardware chipset (when keeping to Digi's XBees, series 1 and series 2 refers to different chipsets)
- the implementation details of the firmware you can load on specific devices/chipsets (e.g. digimesh was originally available only on 900Mhz modules, now also on series 1 Xbees (2.4GHz))
...which mean you can get meshing on Series 1 - but only by using DigiMesh, so which won't talk to ZigBee meshes.
From the perspective of XBee hardware:
- XBee Series 1
- comes with 802.15.4 compliant firmware. Can be configured to interact with different-brand 812.15.4
- can use DigiMesh
- cannot use ZigBee(verify)
- XBee Series 2
802.15.4 specific notes
- 2.4GHz band, or 915MHz / 868MHz bands (see #ISM_bands_and_such).
- 2.4GHz is faster and works worldwide, but has shorter range (50mW for up to 1.6 km. best case 7km?). Speed ~250kbps on air, a few dozen kbps of throughput you can use, 16 channels
- 915MHz (US): slower, more range (best case 24km?). Only in pro variant?(verify), ~40kbps, 10 channels
- 868MHz (Europe), slower, more range (best case 40km?(verify))though ISM regulation limit transmit power. ~20kbps, 1 channel.
- 802.15.4 defines FFD (Full function device) and RFD (Reduced functionality device). FFD can talk to everything and can be coordinators, RFDs can only talk to coordinators, and are end devices (which, because of this, can be lower power and cheaper).
- Coordinators remember network details, and handle routing. Needs more memory and RAM. (XBee firmwares choice: coordinator, or router/endpoint)
- Association with PAN coordinator (basically to avoid overloading the coordinator)
- Discover devices listening to beacons
- Addressing can be 16-bit (local - within PAN associated nodes?(verify)), or their full 64-bit address
ZigBee specific notes
- Node types:
- ZigBee coordinator - FFD acting as a PAN coordinator in the network
- ZigBee router - FFD that is not the PAN coordinator, but acts as a local coordinator (routing between devices, supporting associations)
- ZigBee end device - RFD / FFD that is neither coordinator or router. Talks only to coordinator or router, not to other end devices (Can be lower power since the interesting routing is done elsewhere)
- Cluster Tree - sort of like spanning-tree, subnet-style routing. Seems deprecated, not part of Pro
- Mesh - (FFDs) can talk to everything in sight, algorithm figures out paths. Part of ZigBee and ZigBee Pro
- Many to one routing, source routing
On (Not) Talking to other modules
A protocol will only understand itself.
You can only talk to the same channel.
- The 2.4GHz band has 16 channels defined (within 2400-2480MHz. Each ~2MHz wide), numbered 0x0B through 0x1A (Default is 0x0C). A number are reserved, and it seems Xbee Pro uses fewer(verify). 
- The 915 MHz band has 10 channels (0x01 through 0x0A)(verify)
- The 868 MHz band has 1 channel (0x00) (verify)
In XCTU: Networking → CH
(There is also the concept of channel pages. This basically means the same frequency bands, with different sorts of modulation. Usually fixed in a product, and for the 2450 MHz band there is only one choice. It's likely you don't really need to worry or know about it)
XBees will ignore packets not from the same PAN ID. It is a quick and dirty way to avoid confusion between distinct networks/projects without having to keep track of members, or have an in-protocol ID you would always check.
XBees all default to 0x3332.
In XCTU: Networking → ID
- A device has a SL and SH, which are unique and cannot be changed. They are each a 32-bit int, so combine to be a 64-bit hardware identifier (think MAC)
- You can
- send only to a known node by unique 64-bit ID (set a DL,DH, which must a known node's SL,SH (respectively) in communication). Useful to locally focus traffic to (only) a specific known node.
- send to a group (with a particular MY; must match a value set in SL)
- DigiMesh does not use this (no MY)
DL and DH default to 0, which uses matching by DL=MY. MY us 0 by default, which means that everything listens to everything
In general, for transmitted packets:
- If DH=0x00000000, DL=0x0000FFFF: Broadcast (received by everything)
- If DH=0x00000000, DL<0x0000FFFF: Received for modules whose MY matches the DL
- If DH>0x00000000 or DL>0x0000FFFF: Received for modules whose SH=DH and whose SL=DL
On range and power
'Power use notes:
- Power use is not directly related to transmit power - because of sleeping and such
- Assume something like 40mA to 50mA for transmits and receives.
- Pro and longer-range variants may use 200 or 300mA to transmit. Varies with hardware design.
- Idle communication module will use a small amount of power, varying per design; ~10mA for some, down to something like ~10uA for others.
- ZigBee sleeps less than bare 802.15.4; Meshing will mean more power use for routers (...than its endpoints)(verify)
'Up to' figures are misleading as they count on ideal setups, high gain antennae, clear line of sight (preferably good fresnel zone clearance). They are achievable, but don't expect them in urban or indoor settings.
The factors you can most easily choose or influence:
- obstructions (...as always) - line of sight and ground clearance will give you more range. Obstructions, reflections and no clearance will give you less.
- band (~900MHz variants could do 20-30km with good antenna, the basic 2.4GHz ones in the 30m-1500m range), and possibly 100 mW (20 dBm) (verify)
- transmit power. Vary per design, but the approximate Range / mW correlation for 2.4GHz XBees (Slight difference between Series 1 and Series 2):
- 1mW (0dBm): ~30m indoor, ~90m outdoor
- 2mW (3dBm): ~40m indoor, ~120m outdoor
- 10mW (10dBm) (XBee Pro, International ISM limitation): 90m indoor, 1000m outdoor (verify)
- 50mW (17dBm) (Series 2 XBee Pro, North American version): ~120m indoor, ~1500m outdoor
- 63mW (18dBm) (Series 1 XBee Pro, North American version): ~120m indoor, ~1500m outdoor
- Note that in Europe and other places, ISM compliance means you cannot transmit with more than 10mW (10 dBm)
- Count on somewhat less than this when using a wire/chip antenna
- antenna (simple variants have either a chip antenna or a wire antenna; wire often a little better)
- Chip - perhaps -1.5dBi(verify) Don't suck as much as you may think, but still the simplest, least-range option
- Wire - perhaps 0dBi to 2dBi(verify). Somewhat better range than chip, though indoor the difference is often less pronounced
- Antenna connector, usually U.FL or RP-SMA on XBee Pro. Make sure the antenna you buy is for the frequency the module uses.
XCTU is a little finicky with COM ports, in that it doesn't refresh ports while running. Matters when plugging USB-to-serial devices, such as the arduino's.
Remember that XBee radios need a few seconds to start up.
Default baud rate is 9600. You can program an XBee to default to something else.
- Bee refers to the 20-pin, 20mm pitch attachment
- ...a socket used by XBee, but also by the GPS Bee, Bluetooth Bee, RFBee, and others (the common feature seems to be devices that do serial communication)
- XBee Pinout: http://code.google.com/p/xbee-api/wiki/XBeePins
- You can communicate using just just four pins (ground, 3.3V power, RX and TX), though also using and respecting RTS is a good idea that can avoid some headaches. The rest are optional, convenient for specific applications, seeing activity, specific features/designs, and such.
Basic pragmatic usage notes:
- Usually have a serial interface (think AT commands), and can be used to pass through IO
- Xbees are 3.3V devices - power and IO too (IO doesn't seem 5V tolerant). There are adapter boards that do regulation and level shifting. You could do this yourself (possibly cheaper), but they are are convenient.
Boards you can use to interface with XBees (and that are often sold by the DIY-style stores that sell XBees):
- 250mA regulator, level shifted IO. Seems to be the cheapest (and arguably better than the sparkfun ones). (Not made to plug directly into an Arduino shield-style, but not much work to hook up to one. Will hook directly to a FTDI cable)
- regulator (used to be 150mA, now 500mA(verify)), drops RX line via diode, receiving serial should be able to deal with 3.3V TX from module. You can solder in headers to get to all Xbee pins.
- Sparkfun XBee Explorer USB - adds USB-serial interface (USB mini-B socket, will need cable)
- Sparkfun XBee Explorer Dongle - adds USB-A plug instead, useful to stick into computer USB port directly
- Sparkfun XBee Explorer Serial - 9-pin D-sub serial port, separate DC jack for power.
- Parallax XBee Adapter Board - just adapts the pitch
- Parallax XBee 5V/3.3V Adapter Board - regulator and 5V-3.3V IO conversion
- Parallax XBee USB Adapter Board - adds USB Mini-B socket
- Parallax XBee SIP Adapter - like the 5V/3.3V Adapter Board, but with two two rots of five 0.1" pitch (two rows for sturdiness; there are only five lines)
- arduino XBee shields - there are a few variants
- Some specific arduino derivatives, such as the Seeeduino Stalker, have Xbee sockets (may be wired a little differently, so e.g. programming may be different/harder)
- (could you use an AVRless arduino's FTDI at 3.3V?)
Regulator max current is relevant as Pros at full power use 200 to (worst case) around 340mA (...but less if you may only use 10mW, perhaps 170 mA?(verify)). If they do so in bursts you can get away with lower specced regulators (perhaps with a capacitor), but if they draw continuously then a 150mA regulator won't cut it.
Digi RF device offering
Kilometers or more
Low-Power Wide Area Networks (LPWAN) groups things that are low-power and long range, mainly:
LoRa / LoRaWAN
Speed: up to ~50kbps, may be under 1kbit in some cases
Range: ~5 km in urban settings, ~20km in rural settings
LoRa refers to a radio protocol
LoRa PHY is a physical layer, and proprietary.
If you have a predetermined set of devices, you can have them communicate directly, without needing anything else.
LoRaWAN is a network layer on top of physical that allows routing.
If you want to a connect a set of devices in an area, you could use one or a few LoRaWAN gateways there.
If you don't want to think about that at all, you probably want to sign up for an existing LoRaWAN network.
Example uses include tracking animals against poaching, tracking loan-out vehicles, utility meters, and the like
- this is a good read
Uses 868 MHz (Europe) or 902 MHz (US)
Speed: ~100 bits per second
Range: ~10 km in urban settings, ~40km in rural settings
Band: mobile LTE (licensed)
End devices require(verify) a base station, unlike LoRa and Sigfox
Speed: dozens to hundreds of kilobits/s
Range: ~1 km in urban settings, ~10km in rural settings
VSAT refers to one of many specific types of two-way ground stations communicating via satellite.
Many have dishes on the order of 0.6 ~ 1 meter (mobile applications prefer more omnidirectinal antenna types but have similar size)
Band: ~6GHz, ~4 GHz, ~13GHz
Speed: 4 kbit/s up to 16 Mbit/s depending on type
Used in things like
- Maritime communications.
- Internet access, in remote places where putting in cable is less feasible
- Things like SCADA where no other networks are available
Not yet sorted
ANT is a proprietary ISM-band system, lower-power than e.g. 802.15.4 (ZigBee),