Interfacing with a BCM2042/BP20422 Bluetooth HID Module

The CE Compass WKB-1500 Bluetooth Keyboard I ordered arrived in the mail a while back, and I took to testing and dismantling it immediately.

Now, I decided to buy an actual device instead of just a Bluetooth module for two reasons: first, and most importantly, the only source I know of for the HID-profile module I was looking at has been out of stock for quite some time. There is currently no place I’ve been able to find, even internationally, where you can buy a single HID-enabled module. There are many places to buy SPP-enabled modules, and in many cases these can be adapted to providing keyboard and mouse support. All they require is a driver on the host device to translate the serial data into input control signals. However, my goal is to have the Keyglove be detected natively as an input device, so that no special driver is required. The HID Bluetooth profile specification is basically just a hardware Bluetooth wrapper around the standard HID profile used with USB keyboards and mice, as far as I know, which makes it perfect. The only problem is that nobody sells those modules by themselves, so I decided to try taking one out of another device.

The second reason is I bought one now is that with all of the progress I’ve been making recently, I am very eager to get some kind of wireless communication developed and tested. Progress certainly does foster enthusiasm, which creates the desire for more progress. It’s a wonderful upward emotional spiral—as long as you keep making progress, anyway.

The reason I decided on the CE Compass keyboard is that it has both mouse and keyboard control built into the same device. I was not able to determine via research online whether the Broadcom BCM2042 chip (and corresponding Bluepacket BP20422 module) support both of these simultaneously. The info suggested that it did, but I couldn’t find any definitive documentation saying so. I knew that the CE Compass device did support it though, whatever Bluetooth module it used. And now that it’s here, I am pleased to report that it does in fact use the BCM2042 chip as the core of the module, so I can say with confidence that it does support the functionality I need.

The keyboard interface inside is a standard 8×11 matrix setup using two ribbon connectors, an 8-pin and an 11-pin. These come from the key contacts and go straight to the module. The mouse portion of the device also makes use of a Holtek BS804B chip for X/Y control and capacitive vertical scrolling detection (done via the black/white line visible on the top right corner of the keyboard). This chip appears to have traces to pins 7, 36, 37, and 45 of the module.

Since all I had at my disposal was a soldering iron, I did my best to remove the 47-pin SMD module from the main CE Compass board after disassembling the device. Of course, it’s hard enough to melt three or four pins simultaneously with a soldering iron, let alone 47 on three sides, so as you might imagine, it didn’t go very well. I eventually ended up using my pen knife on the soft solder and then pried the module off the main board. Again, as you might imagine, this resulted in a rather messy break (not to mention a shallow stab wound), and it actually damaged the traces on the bottom of the module (though I didn’t realize that at first).

I did finally get the module removed, and it looked pretty much like what the BP20422 was supposed to look like—though it didn’t have any BluePacket markings or logos as far as I could tell:

To make a long story short, that module didn’t work right at all, and I subsequently decided to try again with a different keyboard after obtaining a desktop hot-air rework station. The new keyboard was the ITON PA-BK03 (from Geeks.com, Buy.com, or OutletPC for ~$20, or eBay). I chose this keyboard because I came across a DealExtreme forum post that said it had a Bluetooth module that was similar or identical to the BP20422, and it was about $15 cheaper than the CE Compass device. However, it doesn’t have any mouse functionality. I figured if the BT module is the same, it wouldn’t really be a problem since I’d be able to discover how to implement it by copying the circuit from the CE Compass keyboard or reading documentation.

This keyboard comes in a no-frills plain white box and includes only the keyboard, manual, and driver CD (which was unnecessary for me). It has a distinctive rounded construction, and the back is made of classic fingerprint-magnet shiny black plastic. The keys feel pretty good, and I believe if you’re actually in the market for a regular mini Bluetooth keyboard, this is probably not a terrible option. I don’t really know though.

…since, after testing it successfully with my laptop’s built-in Bluetooth radio and typing some gibberish, the next thing I did was to pull the whole thing apart:

It doesn’t have any screws for simple disassembly, but all you need to do is take a very small flat-head screwdriver (or a knife) and pry open the side of the case anywhere you can manage. I found the easiest place to be right near the power switch on one side. Once you get it started, it’s just a matter of popping open the rest of the case all the way around. The main board, keypad, and casing all come apart without difficulty, leaving you with individual pieces as shown above.

Apart from the fact that there is no built-in mouse in this keyboard, I found it to be a much better investment all around for cannibalizing the Bluetooth module when compared with the CE Compass keyboard:

• It’s only ~$20 instead of ~$35.
• It’s easier to take apart.
• The circuitry and build style is less complicated.
• It includes a 310mAh lithium polymer battery instead of two AAs.

The next order of business was to remove the module from the board. The hot-air rework station had arrived by this time, so it was just a matter of reading the poorly translated manual for it and giving it my best shot. I’d never used such a device before—only a soldering iron—but it proved to be pretty intuitive, and it worked beautifully.

The basic concept is to keep hot air (~400 degrees) flowing evenly over all of the SMD contact points so that they are all gradually heated to the point of melting the solder at the same time. Then you use pliers, an “IC popper,” a small knife, or other tool to simply lift the loosened module from the board. The cheap IC popper that came with the rework station was too large to fit under such a tightly mounted module, so I used my little trusty pen knife—this time for leverage though, not to try to cut through solder.

It only takes a minute or less of applying heat, and the solder melts nicely. The only difficulty is to remove the module all at once (more easily done with pliers than a small knife), since if you’re not very careful, some of the solder can solidify again, leaving you with a partially detached module. This isn’t an enormous problem since you can just reheat the solidified solder, but it is a bit of an annoyance if it happens.

One person I talked to questioned whether using the rework station on a relatively large module with many more small SMD components on it created a problem with shifting those “subcomponents” around unintentionally. I also worried about this before I attempted it, but found that it really isn’t an issue at all. Perhaps it might have been if I’d turned the temperature up much higher, or used a smaller nozzle (and therefore created a stronger, more focused air flow), but there were no problems. I did notice that some of the solder joints on the module’s components did melt briefly here and there, but nothing moved around. In the end, I had a good, clean, detached Bluetooth module.

The more astute or well-informed of you might notice that there is nothing on the module that says “BluePacket” or “BP20422.” In the process of scouring the internet for data on how to use one of these modules, I came across something quite interesting. There are four unique modules I’ve found so far that are almost identical, the BP20422 from BluePacket being one of them:

• BluePacket BP20422 (PDF datasheet)
• Wenshing TRW-24BUF (PDF datasheet), also referred to as YF_BT01
• ITON PA-48-V3 (PDF datasheet)
• ZBA BT22K-2042 (PDF datasheet)

These appear to be all the same size and have the same component layout, though there is something curious about the last two: they actually have 48 pins instead of 47. The physical positioning of each pin (except the extra one) is the same among all of them. The pin configuration starts with pin 1 at the top right end of the “U” shape of the board and increases in a clockwise direction until it gets to 47, or 48 as the case may be. On the modules that have 48 pins, the extra is at the bottom left corner of the “U” shape. This extra location is pin 30, and pins normally 30-47 are instead pins 31-48. As far as I can tell, this extra pin is not actually used for anything. The BT22K-2042 datasheet labels it as “WP”, and the PA-48-V3 datasheet doesn’t label it at all. I believe the CE Compass keyboard’s module (which I scrapped) was a TRW-24BUF, and the ITON keyboard’s module pictured above was undoubtedly a PA-48-V3 of ITON’s design.

Here is a table of each of these four boards’ pinouts. Oddly, the PA-48-V3 and BT22K-2042 (the 48-pin ones) show pin 9 with the label “P1_9” on on the graphical diagram, but the pin tables still show the same “P1_3” that the other two boards have. I believe that must be a typo, so I’ve labeled them all “P1_3” for consistency.

table.kgtable tr.pin_core, table.kgtable tr.pin_core td, table.kgtable tr.pin_core th { font-weight: bold; }
table.kgtable tr.pin_odd, table.kgtable tr.pin_odd td, table.kgtable tr.pin_odd th { background-color: #FFB; font-weight: bold; }
table.kgtable tr.pin_odd th { color: #000; }

Once I got the module separated, I needed some way to use it in a prototyping environment, ideally on a solderless breadboard. That meant I needed a breakout board. Enter the stupendous, wonderful guys from Wayne and Layne. They’ve worked with the BP20422 module before as part of a Bluetooth arcade controller project, so I contacted them to see if they had any leftover breakout boards I could use, or at least learn from. My needs were specific though, in that I wanted a board with two single rows of pins that could be mounted right on a solderless breadboard much the same way that the Teensy++ board is. They had designed two breakout boards for their project, both of which were built as stand-alone devices.

After some brief back-and-forth conversation about it, they ended up offering to create a brand-new custom board for me for a very reasonable cost. This was excellent news to me, since I’ve never done any PCB design, and it would have taken me probably ten times longer to come up with something even half as good. Additionally, since they had already worked with the board, they knew what the circuit design and external parts needed to be—something that I would have had no clue about. A short time later, I had three copies of the new board in hand:

Beautiful. Just beautiful.

They even sent along the external components required, which saved me the time and effort of ordering them from Mouser. I got the BT module soldered (carefully) onto one of the breakout boards, and added the rest of the components, resulting in the following prototype-friendly unit:

The board is very full, but it makes a great use of space and is just narrow enough that on a typical 2-row 5-pin solderless breadboard, it leaves one accessible pin hole uncovered along both sides of the board. It isn’t a ton of room, but it’s enough to work with, and that’s the important part. Given my requirements, I don’t think it could have been done any better. Plus, having all necessary external components right on the board (including a pair button and LED and a power header) is extremely convenient.

A note about pairing the module with your computer for testing: Bluetooth devices usually require a pairing passkey in order to connect to a host device. Bluetooth headsets usually use “0000” or “1234”, but more complicated devices (like keyboards) have custom or random codes every time you have to pair them. In the case of both the CE Compass keyboard and the ITON keyboard, the normal procedure during pairing is to actually type in the pairing code provided by the host computer using the number keys on the keyboard, followed by the Enter key on the keyboard. Obviously, if you are prototyping a simple Bluetooth connection and you don’t have any way to send those number key codes, that doesn’t work. Fortunately, the guys at Wayne and Layne have detailed a method of pairing this module without entering the code.

Another note about pairing: the ITON PA-48-V3 module does not use the same two pins for pairing that the BluePacket BP20422 does, at least according to the Wayne and Layne guys. They built their board as I asked, according to the BP20422 design (since I didn’t know at the time that my module was not 100% compatible with the BP20422). That meant that the pair button connected pins P3_1 (#24) and P0_7 (#32). However, after I mounted my module on, I found that the pair button did absolutely nothing. It took a few hours of debugging and eventually visually tracing the circuit on the ITON board to discover the solution: the ITON module uses pins P1_5 (#26) and P0_7 (#33) to initiate pairing. Physically, P0_7 is in the same place on both, but the 48-pin ITON module has an extra pin at position #30, so the pin number is incremented. I don’t know why the modules are different, but they are. This means that although the ITON module works on the custom breakout board, the pair button is only useful if you have a real BP20422. How sad.

Here are the pair pins for each of the four modules mentioned above, according to the documentation or circuits I could find:

Keep in mind that the BP20422 and TRW-24BUF are 47-pin boards, while the PA-48-V3 and BT22K-2042 are 48-pin boards. I haven’t been able to determine the required pairing pins for the TRW-24BUF yet, but I have another CE Compass keyboard on its way, and if I’m right about the module in that device, I’ll be able to trace the circuit and note it here. I already tossed the host board from the first one I bought, or I would do it now.

One thing about all of these boards is that the publicly available datasheets are heavy on functional description and light on implementation details. In fact, it is nearly impossible to find any schematic information at all. The Wayne and Layne guys got the necessary documentation from Russ Nelson (where they originally got their BP20422 module) to work with their board and build the breakout board for me, but apparently that’s not something that is supposed to be freely distributed. I have no idea why, since it would simply increase demand for that board, but whatever. That isn’t my decision.

However, the public ZBA BT22K-2042 datasheet has a complete schematic included in the documentation:

While the GPIO pins are not used exactly the same across all four boards, it is definitely a good starting point for a circuit to work with any of the modules, if you are at a complete loss otherwise. The important bits like power connections and such are the same for all boards, so you can probably get a basic connection working even if the GPIO usage is still undetermined.

As for my current prototype unit, let me say that the one in the picture above is actually my third attempt. The first one used the CE Compass module, and I couldn’t get it to work for anything. The voltages on the 3P0V_1 and 1P8V_1 pins were not what they were supposed to be, and the pair LED never did anything remotely like I thought it was supposed to. I believe my hack ‘n’ slash approach at removing the module with a knife probably damaged the board. My second attempt again used a soldering iron and knife (I still didn’t have the rework station then), and left me with another physically damaged board and the aforementioned stab wound. I thought it was going rather well, actually, until I noticed some of the circuit traces being peeled off the bottom of the BT module as I removed it. Oops. That’s what finally prompted me to get the rework station. The third attempt worked, and I managed to pair it and even send a few key codes.

The breakout board has one single LED on it, which is the pair LED. During normal operation, this is usually off. Upon applying power to the board (or bringing the RESET_N pin low), it will light up for about two seconds, then go off again. It remains off unless you connect the pairing pins together, at which time it will start slowly blinking, perhaps a little less than once per second. It continues like this (until/unless you pair it with a host device or reset the board) for precisely 10 minutes before automatically exiting pair mode. Once paired, the module will automatically reconnect to the paired host if possible after a reset. I believe this module will only pair with a single host at a time, though I’m not 100% sure.

Once I paired the device using Wayne and Layne’s keyless method, the pair LED turned off again, and the board was ready for keypresses. Of course, having no actual keys connected, making this happen involved connecting two GPIO pins together using a wire. My test pins, P1_2 (#6) and P0_3 (#40) produced a lowercase ‘e’ on my laptop.

You cannot imagine how exciting this was.

Well, maybe you can, if you’re actually interested enough to read this far down this very detailed post. Anyway, that was the proof of concept I was looking for. The rest will certainly take some effort, but it will be possible. The GPIO key matrix reference that the Wayne and Layne guys described does not match what I observed with that ‘e’, as far as I can tell, so that indicates that the rest of the matrix is likely different also. There will be a discovery process to figure out what connections trigger what keycodes. If I’m lucky, there will be a pattern.

Actually, if I’m really lucky, there will be a way that I can take advantage of the UART connection to avoid needing to use all of the bzillion GPIO pins. I have not yet been able to discover the correct port settings (baud rate, data/parity/stop bits), or special characters to send, or specific timing required to gather or send any useful data over the serial port, but I know there has to be a way. I’ve sent emails to as many of the relevant manufacturers as I could find to ask for the connection and protocol info, but so far, I haven’t got anything back. I hope I will soon though, and if I do, I’ll definitely elaborate here.

Until I hear back from somebody, I think the next thing on the Keyglove to-do list is finish up the conductive thread sensors. I’m also working on the possibility of getting Keyglove on Kickstarter. Any recommendations for rewards?