First of all Microchip BM71 is the shittiest module I have ever seen in my life. The antenna gain is poor. Documentation is so bad that simple things are missing and maximum throughput is limited to 3KB/s with 10ms as minimum connection interval. You can find how I calculate the throughput by checking on this article about BLE specification. Here I assume you had the module. Already tried to communicate with it through UART and you failed to get any response back and now you are wondering why the module won’t reply.

The answer is quite simple, because the module is in the Transparent Mode. Transparent Mode is a state which all UART data sent to the module will simply sent out on bluetooth and no matter what you send in, the module wont respond you back. This state is sufficient if you want to send/receive data for simple tasks. But as soon as you need to change Device Name, TX Power or anything else you are stuck.

To get around this, In the Microchip way you have no way but to buy BM71 PICtail evaluation board. Although this should be simple and straightforward I don’t like how it sound. I mean  ّI hate this marketing method that “Buy our evaluation board or you can’t use the module”. So here is a workaround to overcome this problem without access to PICtail.

Program BM71 Without PICtail EVM

My module is BM71BLES1FC2-0002AA which according to datasheet must use the PC tools ending with 0002AA. BM71 Module use IS1871 chip inside. It is a little confusing but inside IS1871 page there exist a Firmware & Software Tools v1.06 (matched to my model) that have all necessary tools to configure and update BM71 module firmware.

Now here if your customized board have a high performance uController on it you just need to create a shadow CDC device that get all data coming from USB and send it to BM71. So the all fancy PICtail EVM is nothing more than a “usb to serial (UART)” converter. you need a high performance uColntroller as if the conversion speed is not fast enough isupdate Firmware updateTool through error into your face as it did happen to me. In the case you face the same error as me you need to get knowing IS1870 chip better so you can write your own firmware update tool.

IS1871 Memory Map

IS1871 have 256 Kbytes embedded Flash memory that have all firmware and module configuration. The firmware is the software that operate module during normal operation and configuration is a part of firmware that indicate Device Name, TX Power and anything else that specified as a option in the datasheet.

The firmware start from address 0x0000 and end in 0x40000. The configuration start from 0x35000 and end in 0x37000 with 0x2000 as length. The module use a firmware called BLEDK3. To change the setting for module you have to first generate the configuration header and then write the generated file to the mentioned memory address. For header generation there exist a tool with name IS187x_102_BLEDK3_UI v100.123 inside UserInterfaceTool_V100_123 folder of Firmware & Software Tools v1.06 that you downloaded earlier.

If you need more detail on how to do this please feel free to leave a comment below.

Preparing For Writing To BM71

There are 3 steps you need to do before you able to write any data on BM71.

Step 1: Enter EEPROM Mode

There is a special mode that called eeprom mode (or programming mode). The first step is to enter eeprom mode that clearly explained in the manual and BM71 datasheet. in a few words, you need to set a special pin and while holding the pin at specified level, reset the module

Step 2: Connect To Module

After entering eeprom mode, the module stop the LED blinking (if you had one on your board). then you need to send 0x01, 0x05, 0x04, 0x0D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 I don’t know why this and what data they represent but sending out this will get the state machine to “CONNECTED” state. If the operation is successful you should get something from module (If you need to know the exact response feel free to ask)

Step 3: Erase The Flash

This step seems optional but it’s not. If you don’t send erase command before writing, any attempt to change memory will result in fail writing and memory won’t change. Again I don’t know why is module working this way or if I using it in a wrong way but I can’t write any register if I don’t send Erase command before to do so.

Secondly I don’t know where the erase command does actually erase. On my simple check this command only erase configuration area that I specified before and firmware remained unchanged but I’m not sure if it’s always the case.

To erase flash send 0x02, 0xFF, 0x0F, 0x0E, 0x00, 0x12, 0x01, 0x0A, 0x00, 0x03, 0x00, 0x00, 0x40, 0x03, 0x00, 0x00, 0x20, 0x00, 0x00 any response should indicate the erase operation is successful. I highly recommend to wait 1 second before sending any further command.

I noticed that the flash operation have some inside timeout watch dog. If the writing command execute later than this timeout any write attempt result in failure.

Step ∞: Disconnect

The last step after all read/write operation is disconnection. This option seems to be optional but highly recommended to execute. The disconnect packet is 0x01, 0x06, 0x04, 0x03, 0xFF, 0x0F, 0x00

BM71 Writing

To write a register we start with a base command template then fill it with appropriate value.

Write Template: 0x02, 0xFF, 0x0F, 0x0E, 0x00, 0x11, 0x01, 0x0A, 0x00, 0x03, 0x00, 0x00, 0x46, 0x03,0x00, 0x20, 0x00, 0x00, 0x00

packet_size = data_size + 19;
address = 0x35000;

write_temp[3] = 14 + data_size;//ACL
write_temp[5] = 0x11; //COMMAND=WRITE
write_temp[7] = 10 + data_size;//ISDAP
write_temp[15] = block_size;//LENGTH
memcpy(&write_temp[11],(uint8_t*) &address, sizeof(address));//ADDRESS
memcpy(&write_temp[19],(uint8_t*) (eeprom_table), data_size);//Data

The data_size is in byte. In above example I used data_size=16. On a successful write, BM71 return 0x02, 0xFF, 0x0F, 0x0E, 0x00, 0x10, 0x01, 0x0A, 0x00, 0x03, 0x00, 0x00, 0x46, 0x03,0x00, 0x20, 0x00, 0x00, 0x00 on a failure due to requirement for flash, the second to last 0x00 will changes to 0x01.