11 Replies Latest reply on Feb 14, 2018 2:04 PM by scjac_351501

    CYW20706 - Activation of BR/EDR Test Mode

      How do we activate BR/EDR test mode on the CYW20706?  I'm trying to connect an Anritsu MT8852B Bluetooth Test Set to the CYW20706.


      BLE testing is easy via the HCI interface.

        • 1. Re: CYW20706 - Activation of BR/EDR Test Mode

          Further to this, it appears as though we want to issue the HCI_Enable_Device_Under_Test_Mode command.   Whenever we do this, though, we get a response from the controller as though it has been reset:





          • 2. Re: CYW20706 - Activation of BR/EDR Test Mode



            I think you are using wrong opcode.

            The opcode for Enable_Device_Under_Test_Mode is 0x1803

            So the command send should be [01 03 18 00] . Could you please test it with same?



            • 3. Re: CYW20706 - Activation of BR/EDR Test Mode

              Good catch. Still results in a reset, though:



              • 4. Re: CYW20706 - Activation of BR/EDR Test Mode



                Could you please load the device with any of the application from WICED studio and then try sending HCI HCI_Enable_Device_Under_Test_Mode command

                Also please make sure you are not putting the device into recovery mode.

                Now you should be able to see the correct response.


                Thanks & Regards,

                1 of 1 people found this helpful
                • 5. Re: CYW20706 - Activation of BR/EDR Test Mode

                  Thank you Anjana for you continuing support.  Appreciate it.


                  I loaded the headset app, and other apps, and this didn't work.  There was no response to the reset command.


                  I often have to use the recovery mode in order to download code, but after that have not been using recovery mode apart from trying to get a reset response.


                  I then thought I would see why download from the Wiced studio worked, but reset from a terminal didn't.  With a logic analyzer, I was able to see that Wiced studio tries to reset the device at 115200, but gets no response.  It then resets the device twice at 3000000, both times receiving the proper reset response from the device.


                  After this, I went back to a serial terminal, changing the baud to 3000000 and was successfully able to get a reset response from the Headset app, but also a HCI_Enable_Device_Under_Test_Mode response:



                  The headset project must have discoverability and connectibility enabled as I was able to inquire for address and connect the Anritsu test box to the evaluation board. I believe this comes via the STANDALONE_HEADSET_APP flag in the make file, and when hci_control_management_callback receives a BTM_ENABLED_EVT event through this snip:


                  #ifdef STANDALONE_HEADSET_APP


                              wiced_bt_device_address_t bda;

                              /* to work with stand alone */

                              wiced_bt_dev_set_local_name((char *)wiced_bt_cfg_settings.device_name);

                              wiced_bt_dev_set_discoverability(BTM_GENERAL_DISCOVERABLE, wiced_bt_cfg_settings.br_edr_scan_cfg.inquiry_scan_window, wiced_bt_cfg_settings.br_edr_scan_cfg.inquiry_scan_interval);

                              wiced_bt_dev_set_connectability(BTM_CONNECTABLE, wiced_bt_cfg_settings.br_edr_scan_cfg.page_scan_window, wiced_bt_cfg_settings.br_edr_scan_cfg.page_scan_interval);



                              /* maintain local application state */

                              app_state_cb.state = IDLE;

                              app_state_cb.audio_stream_state = APP_STREAM_STATE_STOPPED;

                              app_state_cb.call_state = HFP_STATE_IDLE;









                              if (headset_get_paired_host_info(bda))


                                  app_state_cb.is_originator = WICED_TRUE;







                  When I start tests on the Anritsu box, and after sending the HCI_Enable_Device_Under_Test_Mode response, the Anritsu test box says that test mode has been refused and Wiced HCI gives this response via my serial terminal:



                  What does 19 18 00 02 00 01 00 mean?  I can't find any reference to 0x18 in the Wiced HCI UART Control Protocol doc.

                  • 6. Re: CYW20706 - Activation of BR/EDR Test Mode

                    I think the problem may lie in the original response:


                    04 0e 04 01 03 18 0c


                    What does 0c mean?

                    • 7. Re: CYW20706 - Activation of BR/EDR Test Mode

                      Sorry, confusing BT HCI with Wiced HCI as there are two packet types in that serial debug snippet.  The 19 18 00 02 00 01 00 is Wiced, the 04 0e 04 01 03 18 0c is BT.  According to the Core_v5.0 BT spec:


                      04 - HCI Event Packet

                      0e - Command Complete

                      04 - number of parameters (i.e. Bytes) = 4

                      01 -

                      03 -

                      18 -

                      0c - Command disallowed


                      Why would test mode be disallowed?  It didn't seem to be disallowed in your (Anjana) serial terminal log

                      • 8. Re: CYW20706 - Activation of BR/EDR Test Mode

                        If I issue an HCI reset, the command is allowed:


                        But the BT stack is no longer in a discoverable nor connectable state.

                        • 9. Re: CYW20706 - Activation of BR/EDR Test Mode

                          I've tried using the Wiced HCI commands, but it seems as though the WICED HCI port is one directional:


                          Those 0x05 codes are for the NVRAM loads after I press reset on the Headset App


                          19 08 00 01 01 should be Set Visibility

                          19 01 00 should be reset


                          What mode is the UART port in, where it will receive and respond to BT HCI commands, send Wiced HCI packets, but not receive Wiced HCI packets?

                          • 10. Re: CYW20706 - Activation of BR/EDR Test Mode

                            With regards to the 19 18 00 02 00 01 00 message:


                            from hci_control_api.h:


                            #define HCI_CONTROL_EVENT_CONNECTION_STATUS                 ( ( HCI_CONTROL_GROUP_DEVICE << 8 ) | 0x18 )    /* Connection Status */


                            Guess the PDF and *.h are not synchronized.  I'm not sure what the payload is

                            • 11. Re: CYW20706 - Activation of BR/EDR Test Mode

                              Okay, I finally got this working, with the Anritsu MT8852B putting the 20706 through its BR/EDR paces.


                              1. Reset Command:

                              01 03 0c 00


                              2. Scan Enable (for discoverability and connectibility):

                              01 1a 0c 01 03


                              3. Enable Device Under Test Mode Command:

                              01 03 18 00


                              4. Run test on Anritsu command after address of UUT has been returned from inquiry. Anritsu will send a Connection Request and the UUT host has a finite amount of time (timeout) to accept the request with:


                              5. Accept Connection Request Command:

                              01 09 04 07 9d 5d e1 91 00 00 01


                              The payload in that message includes the 6-byte BD_ADDR of the Anritsu box and a master/slave role flag


                              The link layer manager in the Anritsu box can now force the 20706 controller to transmit, frequency hop, etc.

                              1 of 1 people found this helpful