I own a 2005 BMW 325i which I love. The car was built before bluetooth connectivity in cars was commonplace, and I wanted the ability to connect my phone to the vehicle's audio system to listen to music and accept telephone calls hands-free. There are obviously a lot of off-the-shelf solutions for this, such as devices that are powered off a cigarette lighter that connect to your phone over bluetooth and then broadcast the audio on an FM radio frequency which you can tune into on the car radio. However, these devices tend to have very poor quality, poor bluetooth control functions, and just look plain ugly in the console area.
My car's steering wheel is equipped with some buttons that can change the radio station and control a hands-free cell phone module that was an optional feature (not installed on my car, but you get the buttons on the steering wheel either way). I thought it would be really neat if there was a way utilize those steering wheel buttons to control bluetooth audio on a phone, utilizing the radio station tuning buttons as "skip" and "back", and using the hands-free cell phone module buttons as "play/pause/answer/hang up". I pulled the radio out of the car and began reverse engineering it. The radio has two MCUs, one on the main PCB to handle all the main radio functionality, and another on the front panel PCB to scan the buttons and control the LCD display. There is a SPI bus between off-the-shelf MCUs, which is mainly used to send button event pressed from the front panel MCU to the main MCU, and text to be displayed from the main MCU to the front panel one. My initial approach was to tap into this SPI bus with a third MCU to intercept certain button press messages and generate corresponding bluetooth commands. However, I discovered pretty quickly that the radio was connected to the vehicle's 'I-BUS' main communication bus, and that every button press on the radio front panel generates an I-BUS message. This is a pre-cursor to the CAN bus system that all vehicles use today to transmit information between the various electronic modules in the vehicle. Once I realized this, I determined that the best approach would be to make a module that connects to the I-BUS so that I can intercept not only button press events from the radio, but button press events from any other electronic module in the vehicle, which includes the steering wheel. I used a Saleae logic analyzer to monitor the I-BUS inside the radio, and recorded all the button press events I was interested in utilizing. I also wanted a way to override the LCD display on the radio with my own custom messages while the bluetooth module was on. Luckily for me, there happened to be an I-BUS command for doing just that. The reason that the radio has this ability is for that hands-free cellphone option I mentioned earlier. When that module is installed, anytime you receive a call the module sends an I-BUS message to the radio to display the number that is calling on the screen. The only thing left to do at this point was figure out to actually get the audio from bluetooth to the radio's amplifier. To do this, I was able to utilize functionality in the radio for another optional feature that my car did not have. The radio is equipped with a CD player, however there was an option to add an external 6 CD changer module which would reside in the trunk of the car. When this module is present, the radio adds an additional input source menu option that you can access with the 'MODE' key (if it is not installed the only options you get are 'FM', 'AM', and 'CD' if there is a CD in the built-in player). All I needed to do is make the MCU on my module 'pretend' to be the 6 CD changer module by sending the correct I-BUS messages, and them connect the analog output of my bluetooth receiver to the designated connections at the back of the radio that would be connected to the 6-CD changer module. The resulting functionality is just what I wanted - the radio still works in all the default modes of operation, such as AM and FM, but now I can press the 'MODE' key to activate the bluetooth module that I added.
As far as how I actually went about building the module, the basic architecture is this: There is an attiny4313 MCU which handles the sending and receiving of I-BUS messages. The bluetooth side of things is implemented with a CSR8675 SoC from Qualcomm. I purchased the bare BGA package and made the breakout board for it myself since I needed some features that I could not get from an off-the-shelf bluetooth module, namely the ability to interface the SoC with an MCU in some way (yes, soldering this was a challenge). Getting the CSR8675 up and running was quite a task since Qualcomm is not very forthcoming with their documentation and software tools unless you are a big customer. I was able to find the source code for the CSR8675's firmware online, and then I modified it significantly to utilize an I2C peripheral that the chip has in hardware. The attiny could then send I2C commands to the CSR8675, which would in turn generate bluetooth control messages for the mobile device to do things like play, pause, skip, answer call, etc. All of this development was done using the spaghetti bread board that is shown in one of the pictures below. Once I was confident that I had the ability to get all the features I wanted out of the CSR8675 and attiny combo, I designed the main module PCB.
The main PCB had all the boiler plate electronics necessary for the module such as power supplies, an audio amplifier, and hardware for interfacing to the I-BUS. I also added a USB-C charge controller so that I could also use this module to charge my phone inside the car with a cable that connects to the back of the radio. Finally, I added some microphone inputs which are piped to the CSR8675 for bluetooth hands-free calling. I also had to make some PCBs for connecting programming hardware to the module. All of the pcbs for this project were assembled by me, by hand. The results were great! The only ways in which you can tell the radio was modified, when it is fully assembled, is by the small plastic rivet in one of the vent holes that partially holds the board in place, and the bluetooth patch antenna that is stuck to the bottom. When the radio is installed in the vehicle, there is absolutely no way to tell that anything was modified! I currently use this in my car every day.
