Why Downlink Matters
Most BLE Tag deployments are uplink-only: the tag broadcasts telemetry and a gateway listens. But real asset-tracking and sensor systems need the gateway to talk back — push configuration, trigger a buzzer, request an immediate location ping, or revoke a key. A Bluetooth Beacon / BLE Tag that only shouts is half a system. This article covers the three downlink paths and how to do them safely.
Path 1: Connected GATT Write
The gateway (or a maintenance phone) opens a connection and writes a control characteristic.
- Connection interval 7.5-100 ms; for sporadic commands a 100-200 ms interval keeps the tag’s average current low.
- Use a single `Control` characteristic (write-without-response for fire-and-forget, write for ACK).
- Payload: `[Cmd:1B][Len:1B][Payload:N][CRC:2B]`.
- Power cost: a connection event costs ~3-8 mA for 1-5 ms; batch commands to amortize.
Path 2: Connectionless Broadcast Command
For one-to-many control, broadcast a signed command on a dedicated ADV channel.
ADV: 0x16 (Service Data) custom UUID
Bytes: [Cmd][Seq][TargetMask][Sig:8B]- Tags in scan mode pick it up without connecting — scales to thousands.
- Risk: replay. Always include a monotonic `Seq` and a short TTL.
Path 3: Periodic Fetch (Tag Pulls)
The tag wakes, scans for a gateway beacon carrying a config URL, then fetches via HTTP or CoAP. Lowest tag power but highest latency.
ACK and Retransmission
| Mode | Latency | Power | Scale |
|---|---|---|---|
| GATT write + ACK | low | medium | 1:1 |
| Broadcast cmd | very low | low | 1:N |
| Pull fetch | high | lowest | N:1 |
Retry with exponential backoff (e.g. 1s, 2s, 4s); cap at 3 tries.
Security
- Sign every command with ECDSA (P-256) using a gateway key; the tag verifies before acting.
- Use per-tag key derivation `K_i = HKDF(master, tag_id)` so a leaked tag cannot forge others.
- Reject any `Seq` <= last seen.
- Rate-limit: ignore more than 1 command per 500 ms per source.
Power Budget for Downlink
A tag that must listen for broadcast commands pays a scan cost: 3 channels at 100% scan ~ 5-8 mA. To stay on a CR2032 for years, scan in windows (e.g. 200 ms every 10 s) -> ~0.1 mA average. Balance responsiveness against battery.
Practical Checklist
- Pick GATT write for 1:1 maintenance, broadcast for fleet-wide updates.
- Always sign and sequence commands.
- Use windowed scanning; never 100% scan on a coin cell.
- Test replay by re-sending an old captured command — it must be dropped.
The right BLE Tag downlink is invisible to the end user but decides whether your fleet is controllable or just watchable.