IKB LM506

Using Broadcom BlueTool – LM506

Broadcom BlueTool is a testing and diagnostic program for Windows PCs that allows a friendly point-and-click method of issuing firmware updates and Bluetooth HCI commands to any Broadcom-based Bluetooth HCI module or adapter. This is also a facility for scripted automation via PERL for production testing.

Installation Notes

Please follow the on-screen instructions. Unless the intention is to provide scripted automation for production or repeated test purposes, please do not select the default installation type, instead disable the PERL module to simplify the set-up of BlueTool.

  • We have noticed some issues when using this software on a 64-bit OS with USB-based Bluetooth devices. In this instance, we recommend the use of BlueTool on a 32-bit OS only.

Issuing a HCI Command

HCI commands are used by a Bluetooth stack to communicate with a Bluetooth Radio Device, as such, HCI commands in their raw form can be difficult to read and understand from a human perspective. BlueTool allows you to issue these commands by double-clicking friendly names and by using windows forms as a simple way to enter parameter data, via drop-down lists, check boxes etc., allowing the user to take direct control of a Bluetooth Radio’s behaviour.

To issue HCI commands via BlueTool, please follow the steps outlined below:

1/ Open the HCI Control Window from the Transport drop-down menu.

LM506_using_bluetool_1

2/ Select the location of the Bluetooth Device on the PC, for PCs with a single USB-based device, this is usually ‘usb0’.
If this is not the case, please refer to the information provided by the Windows Device Manager.

LM506_using_bluetool_2

3/ Check the ‘HCI Protocol Active’ box. If a tick appears and items in the list turn from grey to black, then a HCI connection was successfully established. If not, please check the adapter’s connection and configuration details and try again.

LM506_using_bluetool_3

4/ Each name in the list that you are now presented with represents a Bluetooth HCI Command, simply double-click a command of your choice, fill in any parameters and click ‘OK’ to issue the command.
Commands are categorised by the drop-down list in the top-right corner of the window, with the exception of ‘0: Vendor Specific Commands’, each category and command directly relates to a command published in the Bluetooth SIG adopted specification.

LM506_using_bluetool_4

Downloading Firmware

Firmware files issued by LM Technologies for its Broadcom-based Bluetooth devices are typically in ‘*.HCD’ format, with the exception of production Windows drivers, which are in the ‘*.HEX’ format. HCD files contain many lines of HCI commands in raw byte format. This allows for the file to not only contain the firmware data, but also the instructions for configuring the device and loading the firmware, allowing simple integration into a Bluetooth Stack or driver.

To download a HCD firmware file via BlueTool, please follow the above steps in ‘Issuing a HCI Command’.

1/ To ensure the device is in the correct state, issue the command ‘7.3: Reset’, followed by the command ‘0: Download_Minidriver’.

2/ Open the Download Firmware/Config Window from the Transport drop-down menu.

LM506_using_bluetool_5

3/ Configure the window as pictured below, adjusting ‘Device configuration’ according to the Broadcom IC type and selecting the appropriate HCD file in the ‘Download Configuration Record’ box.

LM506_using_bluetool_6

4/ Click ‘Execute’ and observe for errors.

 

RF Certification – LM506

Many countries require products to be RF certified, as a module, the LM506-0518 may require additional certifications beyond those provided by LM Technologies, this may be the case for the following reasons:

  • LM Technologies does not currently hold a certification for its module/adapter in the specified country and that country does not recognise any of the existing certifications.
  • Please see LM Product Certifications for a list of all current certifications that LM Technologies holds for its modules and adapters.
  • Some countries do not support module-level certifications, in this case, full product certification must be performed.
  • The LM506-0518 has no metal RF shield.In this case certification standards such as FCC only support certification as an entire product or ‘Limited Certification’ where the module must be demonstrated to work in a sub-set of specified products.

To perform certifications, depending on the type of testing performed and the capabilities of the test hardware, the LM506-0518 can be placed into various test modes to aid in this process.

Device Under Test (DUT) Mode

Device Under Test Mode allows a Bluetooth-aware test unit to issue synchronised test commands remotely over a wireless link. This test mode is useful for Bluetooth SIG compliance testing and other RF testing where hardware capable of issuing Bluetooth DUT commands wirelessly.

To place the device into DUT mode, please take the following steps:

1/ Connect the device to a PC or microcontroller capable of issuing Bluetooth HCI commands and provide power.
2/ Follow the Firmware Patch Guide to provide PatchRAM optimisations of the RF parameters required for RF testing.
3/ Issue the following HCI command to reset the device:

Opcode: 0xC03 Length: 0x00 (Reset)

4/ Issue the following HCI command to enable device discovery:

Opcode: 0xC1A Length: 0x01 Parameters: 0x03 (Write_Scan_Enable: Inquiry and Page Scan Enabled)

5/ Issue the following HCI command to enable device role-switching:

Opcode: 0xC05 Length: 0x03 Parameters: 0x02 0x00 0x03 (Set_Event_Filter: (Filter_Type: Connection Setup (Connection_Setup_Filter_Condition_Type: Allow Connections from all devices, Auto_Accept_Flag: Do Auto accept the connection with role switch enabled))

6/ Issue the following HCI command to enter Device Under Test (DUT) Mode:

Opcode: 0x1803 Length: 0x00 (Enable_Device_Under_Test_Mode)

TX Test Mode

TX Test Mode allows the device to transmit fixed or pseudo-random packets on either a single-frequency, fixed-pattern or 79-channel Bluetooth frequency-hopping mode.

To place the device into TX Test mode, please take the following steps:

1/ Connect the device to a PC or microcontroller capable of issuing Bluetooth HCI commands and provide power.
2/ Follow the Firmware Patch Guide to provide PatchRAM optimisations of the RF parameters required for RF testing.
3/ Issue the following HCI command to reset the device:

Opcode: 0xC03 Length: 0x00 (Reset)

4/ Issue the following HCI command to enable TX Test mode:

Opcode: 0xFC51 Length: 0x10 Parameters:
 
Local_Device_BD_ADDR: 0x00 0x02 0x72 0xC9 0x14 0x9D (Example Local Device Bluetooth Address)
 
Hopping_Mode: 0x00 (79 Channel) / 0x01 (Single Frequency) / 0x02 (Fixed Pattern)
 
(IF Hopping_Mode == 0x01) Frequency: 0x00 to 0x4E (Channel 1 2402MHz to 79 2480MHz)
 
Modulation_Type: 0x00 (0x00 8-bit pattern) / 0x01 (0xFF 8-bit pattern) / 0x02 (0xAA 8-bit pattern) / 0x03 (0xF0 8-bit pattern) / 0x04 (PRBS9 pattern)
 
Logical_Channel: 0x00 (ACL EDR) / 0x01 (ACL Basic) / 0x02 (eSCO EDR) / 0x03 (eSCO Basic) / 0x04 (SCO Basic)
 
BB_Packet_Type: 0x00 (NULL) / 0x01 (POLL) / 0x02 (FHS) / 0x03 (DM1) / 0X04 (DH1/2-DH1) / 0X05 (HV1) / 0X06 (HV2/2-EV3) / 0X07 (HV3/EV3/3-EV3) / 0X08 (AUX1/PS) / 0X09 (DM3/2-DH3) / 0X0A (EV4/2-EV5) / 0X0B (EV5/3-EV5) / 0X0C (DM5 / 2-DH5) / 0X0D (DH5/3-DH5)
 
BB_Packet_Length: 0x00 (Any Length up to allowed Packet Type Length)
 
Tx_Power_Level: 0x00 (0dBm) / 0x01 (-4dBm) / 0x02 (-8dBm) / 0x03 (-12dBm) / 0x04 (-16dBm) / 0x05 (-20dBm) / 0x06 (-24dBm) / 0x07 (-28dBm) / 0x09 (Specify Power Table Index - Use this for 10dBm)
 
(IF Tx_Power_Level == 0x09) Transmit_Power_Table_Index: 0x00 (10dBm)

RX Test Mode

RX Test Mode allows the device to receive only fixed or pseudo-random packets on either a single-frequency or a fixed-pattern.

To place the device into RX Test mode, please take the following steps:

1/ Connect the device to a PC or microcontroller capable of issuing Bluetooth HCI commands and provide power.
2/ Follow the Firmware Patch Guide to provide PatchRAM optimisations of the RF parameters required for RF testing.
3/ Issue the following HCI command to reset the device:

Opcode: 0xC03 Length: 0x00 (Reset)

4/ Issue the following HCI command to enable RX Test mode:

Opcode: 0xFC52 Length: 0x0E Parameters:
 
Remote_Device_BD_ADDR: 0x00 0x02 0x72 0xC9 0x14 0x9D (Example Remote Device Bluetooth Address)
 
Report_Period: 0xFA to 0x7D0 (Report Period in Milliseconds from 250ms to 2000ms)
 
Frequency: 0x00 to 0x4E or 0xF0 (Channel 1 2402MHz to 79 2480MHz or Fixed Pattern)
 
Modulation_Type: 0x00 (0x00 8-bit pattern) / 0x01 (0xFF 8-bit pattern) / 0x02 (0xAA 8-bit pattern) / 0x03 (0xF0 8-bit pattern) / 0x04 (PRBS9 pattern)
 
Logical_Channel: 0x00 (ACL EDR) / 0x01 (ACL Basic) / 0x02 (eSCO EDR) / 0x03 (eSCO Basic) / 0x04 (SCO Basic)
 
BB_Packet_Type: 0x00 (NULL) / 0x01 (POLL) / 0x02 (FHS) / 0x03 (DM1) / 0X04 (DH1/2-DH1) / 0X05 (HV1) / 0X06 (HV2/2-EV3) / 0X07 (HV3/EV3/3-EV3) / 0X08 (AUX1/PS) / 0X09 (DM3/2-DH3) / 0X0A (EV4/2-EV5) / 0X0B (EV5/3-EV5) / 0X0C (DM5 / 2-DH5) / 0X0D (DH5/3-DH5)
 
BB_Packet_Length: 0x00 (Any Length up to allowed Packet Type Length)

 

Firmware Patch Guide – LM506

The LM506-0518 features at its core a Broadcom BCM20702 Bluetooth 4.0 HCI USB IC.

The BCM20702 is shipped from the factory with a generic firmware that will allow for communication between the IC and the host via HCI commands, however, this firmware does not include design-specific RF optimisations, the latest bug fixes or additional functionality. It’s therefore important for the sake of RF testing and production that the host load on to the module a ‘PatchRAM’ firmware file.

  • It’s important to note that this patch is applied in volatile RAM memory and as such, must be re-applied each time the device is power-cycled. Needless to say the below routine should be integrated into the host solution that is to be deployed on the end-product.

This guide assumes that the user knows how and has the capability to issue a HCI command and to read a HCI event on their platform.

Overview

  • Open HCI command socket over USB or otherwise.
  • Issue the HCI reset command (OGF 0x03, OCF 0x003 or 0x0C03 together), wait for the command complete event and check that the return status code is zero.
  • Issue the vendor specific HCI command ‘Download_Minidriver’ (OGF 0x3F, OCF 0x02E or 0xFC2E together) and wait for the command complete event.
  • Wait for 50ms for the device to enter Download Mode.
  • Parse each HCI command from the HCD firmware file and send it over the HCI command socket, checking that each command is run successfully.
  • Wait 250ms for flashing to complete.

Issuing commands & command complete event

In all cases, the user should wait for the corresponding Command_Complete event when issuing a command and check the command’s return status parameter for errors.

On some platforms, there may be a convenience function which waits for the Command_Complete event, as a wait is often required with most HCI commands.

HCD file format

The HCD file consists of a set of HCI commands in the following format:

OpcodeUnsigned 16-bit integer in little endian byte orderBluetooth HCI command identifier
Parameter lengthUnsigned 8-bit integerLength of the parameter data for this command in bytes
Parameter dataByte arrayZero or more bytes as specified by parameter length

All the data is tightly packed, so each field begins directly after another as does each command.

HCD file

BCM20702A0-0a5c-21e8.hcd

References

BlueZ; the Bluetooth stack used by the Linux kernel contains a working example of the patchram procedure:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/drivers/bluetooth/btusb.c

There is also a patch ram utility for Linux/Android which can be found at the following link:
https://code.google.com/p/broadcom-bluetooth/source/browse/

 

Reflow – LM506

The LM506-0518 module is produced using standard temperature lead-free solder. For this reason, we recommend the use of a low-temperature solder (< ~217°C) to avoid causing a second reflow of the module components, increasing the likelihood of a higher yield.

We understand that some applications and manufacturer limitations prevent the use of a low-temperature solder, in this instance, please follow the below guidelines to form your own custom reflow profile:

Reference Reflow Profile (standard-temperature lead-free)

LM506_0518_reference_temperature_reflow_chart

  • If the host PCBA is double-sided and passes through reflow twice, reflow the module on the final pass only.
  • Do not exceed a reflow temperature of 250°C and refer to your solder paste vendor’s guidelines.
  • Temperature Ramp-up and Ramp-down times should be within the range of 1 to 4°C/s, attempt to not exceed 3°C/s.
  • This chart is for reference only, results will vary from manufacturer to manufacturer and machine to machine.

Customising the Reference Reflow Profile

The reflow profile shown in the above section is for reference only. It is expected that refinements and customisations to this profile will be needed during trial sampling to achieve an acceptable yield.

Moisture Sensitivity and Pre-Baking

The LM506-0518 is rated at moisture sensitivity level 3 (MSL-3). It is recommended to pre-bake the module before SMT placement.

Please see the following IPC/JEDEC J-STD-033B.1 guidelines, which offer recommended bake times dependant on the time the module packaging has been unsealed for and the baking temperature that will be applied:

Bake @ 125°CBake @ 90°CBake @ 40°C
Exceeding
Floor Life
By > 72 hours
Exceeding
Floor Life
By <= 72 hours
Exceeding
Floor Life
By > 72 hours
Exceeding
Floor Life
By <= 72 hours
Exceeding
Floor Life
By > 72 hours
Exceeding
Floor Life
By <= 72 hours
9 hours7 hours33 hours23 hours13 days9 days

 

SMD/SMT Placement – LM506

The LM506-0518 is a double-sided USB module that finds its design origins as a PCBA suitable for fitting into an adapter housing.

Despite this non-SMT origin, many of our customers find the cost savings of combined adapter and modules sales, paired with the simplistic development pipeline of moving from the LM506 Adapter for initial work to the LM506 Module for production a worthwhile prospect. This has driven LM to work with its customers to find effective ways to treat the LM506-0518 as a surface-mount-device for cost-effective automated placement. Some of these solutions are detailed below.

Recommended Placement Solution

Through a process of trial-and-error in mass-production, LM has identified with its clients, the following placement solution as one that provides good yield:

LM506_smd_1 LM506_smd_2

  • The host PCBA features a cut-out that allows for bottom-side components to avoid interaction during placement and for minimal antenna interference.
  • The cut-out features a small resting area for the antenna end of the module to add stability during the placement process.
  • The cut-out is sized and placed to minimise impact on the antenna and to allow model and production date details to be clearly visible.
  • Copper tracks are run along the host PCBA (highlighted in pink) from the edge of the module all the way to the cut-out, at which point they meet plated half-vias.
  • The plated half-vias allow for superior solder strength and offer a route for additional solder to flow, reducing the likelihood of uneven placement.

Mechanical Specification

The below to-scale mechanical specification of the LM506-0518 can be used to aid in PCB mounting and positioning. Also included are maximum height dimensions and tolerances.

LM506_smd_3