How to get Cadense and speed information using gattool

Last post was a quick "Yay it worked" post. This explains the procedure in more detail.

First use hcitool to scan for your device (activate it in some way so that it powers on first)

Now you know the address, start gattool and connect

$ gatttool -b 00:18:31:E4:D7:89 -I
[   ][00:18:31:E4:D7:89][LE]> connect

Ask for the primary services:

[CON][00:18:31:E4:D7:89][LE]> primary
[CON][00:18:31:E4:D7:89][LE]> 
attr handle: 0x0001, end grp handle: 0x000b uuid: 00001800-0000-1000-8000-00805f9b34fb
attr handle: 0x000c, end grp handle: 0x000f uuid: 00001801-0000-1000-8000-00805f9b34fb
attr handle: 0x0010, end grp handle: 0x001a uuid: 00001816-0000-1000-8000-00805f9b34fb
attr handle: 0x001b, end grp handle: 0x0029 uuid: 0000180a-0000-1000-8000-00805f9b34fb
attr handle: 0x002a, end grp handle: 0xffff uuid: 0000180f-0000-1000-8000-00805f9b34fb

Ask for the characteristics of the handler for the CSCP service (uuid 1816)

[CON][00:18:31:E4:D7:89][LE]> characteristics 0x0010 0x001a
[CON][00:18:31:E4:D7:89][LE]> 
handle: 0x0011, char properties: 0x10, char value handle: 0x0012, uuid: 00002a5b-0000-1000-8000-00805f9b34fb
handle: 0x0014, char properties: 0x02, char value handle: 0x0015, uuid: 00002a5c-0000-1000-8000-00805f9b34fb
handle: 0x0016, char properties: 0x02, char value handle: 0x0017, uuid: 00002a5d-0000-1000-8000-00805f9b34fb
handle: 0x0018, char properties: 0x08, char value handle: 0x0019, uuid: 00002a55-0000-1000-8000-00805f9b34fb

Ask for the character descriptor for the cadence information (uuid 2a5b)

[CON][00:18:31:E4:D7:89][LE]> char-desc 0x0011 0x0013
[CON][00:18:31:E4:D7:89][LE]> 
handle: 0x0011, uuid: 2803
handle: 0x0012, uuid: 2a5b
handle: 0x0013, uuid: 2902

Enable notification by writing 0100 to handle 0x0013.

[CON][00:18:31:E4:D7:89][LE]> char-write-req 0x0013 0100
[CON][00:18:31:E4:D7:89][LE]> Characteristic value was written successfully

You should now start to get notifications from the device

...
Notification handle = 0x0012 value: 03 ce 00 00 00 82 20 ea 00 be d8 
[CON][00:18:31:E4:D7:89][LE]> 
Notification handle = 0x0012 value: 03 cf 00 00 00 aa dd ea 00 be d8 
...

See the previous post for an explanation of the data.

Playing with CSCP Cycling Speed and Cadence using gattool

Inspired by a BB demo app I got myself a PanoBike CSCP BLE dongle a while back. Never had the time to do more than test it with the BB demo application and then I more or less forgot about it (and had no proper bike to use it on).

Today, inspiration hit me and I started to look at it a bit, for now first with gattool only.

Took a while to figure it out, BLE is a bit of a mystery with UUIDs and handles and so on.

Result:

Notification handle = 0x0012 value: 03 c8 00 00 00 06 99 e1 00 45 99

Byte 1: What data is available, crank=1 and wheel=2
Bytes: 2,3,4,5: Wheel revolutions
Bytes: 6,7: Wheel event timestamp

Bytes: 8,9: Crank revolutions
Bytes: 10,11: Crank event timestamp

Some Sports Tracker ST HRM 2 protocol progress

I got inspired to play with the HRM belt again. The most important field was actually quite easy to find, but there are some fields that are still a mystery. Anyway, my findings for now are documented in a github repository, with some data dumps if you like to help out decoding the mystery fields.

I also made a simple J2ME application for testing, it even worked on the first try, damn I'm proud. I'll post that to github too after some minor cleanups.

J2ME ST HRM2 test application

Connecting to the SportTracker ST HRM2 bluetooth belt from the CLI

For quickly getting the raw data out from the ST HRM2 belt, the CLI is the fastest way. No need to code up anything.

Prepare the belt first, you should know how, it will turn on automatically when the device detects a heartbeat. You need to scan and connect to it inside a couple of minutes as otherwise it will turn off automatically, I don't remember exactly how long it stays on.

First, scan for the device:

$ hcitool scan
Scanning ...
    FF:0B:AE:1C:xx:yy    ST HRM2


The do a rfcomm bind:

$ sudo rfcomm connect  FF:0B:AE:1C:xx:yy
...
Connected /dev/rfcomm0 to FF:0B:AE:1C:xx:yy on channel 1
Press CTRL-C for hangup


Now you can access the raw data stream from /dev/rfcomm0 for example with plain old 'cat'.

Unfortunately the data is not in a nice NMEA style text format but binary so to make any sense of it, pipe it to something that can convert the output to a more human friendly format, I used hexdump, like this:

$ sudo cat /dev/rfcomm0 | hexdump
0000000 46fa 81b9 372c 2046 0000 0000 0000 4e00
0000010 425c a0ba 45fa 81ba 342c c448 004e 0000
0000020 0000 5e00 fa47 b946 2c81 4434 0010 0000
0000030 0000 0000 b635 47fa 81b8 352c 1043 0000
0000040 0000 0000 8000 f2c3 47fa 81b8 362c 6443
0000050 007e 0000 0000 5f00 faab bb44 2c81 4436
0000060 00a0 0000 0000 0000 180b 4c10 45fa 81ba
0000070 372c f045 0000 0000 0000 2200 fa43 b946
0000080 2c81 4337 5664 0000 0000 0000 50d8 6363
0000090 46fa 81b9 372c 103f 0000 0000 0000 c800
...

You can adjust the output of hexdump to suit your needs.

Or just get any Bluetooth Smart HRM belt that provides a standard interface that you can use :)

Making sense of the ST HRM2 protocol

Luckily it speaks standard BT SPP protocol so getting data out of it is easy. Making any sense of it then another thing. For starters, here is a dump of what the HRM sends out.

What I've found out for now, is this:

1. Start of data block: 0xFA
2. Next is a sequence number going up from 0x44 to 0x47
3. Another sequence number going down from 0xBB to 0xB8
4. 0x81
5. 0x36
6. ?
7. ?
8. ?
9. ?
10. Padding of 6,7,9 zeroes
11. Two bytes, most likely somekind of checksum

Below a dump of data if anyone is interested in trying to figure this thing out.

3714#    FA hex = -06 dec = 372 oct = _250__
3715#    44 hex = 068 dec = 104 oct = _68__
3716#    BB hex = -69 dec = 273 oct = _187__
3717#    81 hex = -127 dec = 201 oct = _129__
3718#    36 hex = 054 dec = 066 oct = _54__
3719#    45 hex = 069 dec = 105 oct = _69__
3720#    32 hex = 050 dec = 062 oct = _50__
3721#    84 hex = -124 dec = 204 oct = _132__
3722#    50 hex = 080 dec = 120 oct = _80__
3723#    00 hex = 000 dec = 000 oct = _0__
3724#    00 hex = 000 dec = 000 oct = _0__
3725#    00 hex = 000 dec = 000 oct = _0__
3726#    00 hex = 000 dec = 000 oct = _0__
3727#    00 hex = 000 dec = 000 oct = _0__
3728#    00 hex = 000 dec = 000 oct = _0__
3729#    BB hex = -69 dec = 273 oct = _187__
3730#    82 hex = -126 dec = 202 oct = _130__

3731#    FA hex = -06 dec = 372 oct = _250__
3732#    45 hex = 069 dec = 105 oct = _69__
3733#    BA hex = -70 dec = 272 oct = _186__
3734#    81 hex = -127 dec = 201 oct = _129__
3735#    36 hex = 054 dec = 066 oct = _54__
3736#    45 hex = 069 dec = 105 oct = _69__
3737#    00 hex = 000 dec = 000 oct = _0__
3738#    00 hex = 000 dec = 000 oct = _0__
3739#    00 hex = 000 dec = 000 oct = _0__
3740#    00 hex = 000 dec = 000 oct = _0__
3741#    00 hex = 000 dec = 000 oct = _0__
3742#    00 hex = 000 dec = 000 oct = _0__
3743#    00 hex = 000 dec = 000 oct = _0__
3744#    00 hex = 000 dec = 000 oct = _0__
3745#    00 hex = 000 dec = 000 oct = _0__
3746#    0C hex = 012 dec = 014 oct = _12__
3747#    94 hex = -108 dec = 224 oct = _148__

3748#    FA hex = -06 dec = 372 oct = _250__
3749#    46 hex = 070 dec = 106 oct = _70__
3750#    B9 hex = -71 dec = 271 oct = _185__
3751#    81 hex = -127 dec = 201 oct = _129__
3752#    36 hex = 054 dec = 066 oct = _54__
3753#    45 hex = 069 dec = 105 oct = _69__
3754#    48 hex = 072 dec = 110 oct = _72__
3755#    E1 hex = -31 dec = 341 oct = _225__
3756#    33 hex = 051 dec = 063 oct = _51__
3757#    00 hex = 000 dec = 000 oct = _0__
3758#    00 hex = 000 dec = 000 oct = _0__
3759#    00 hex = 000 dec = 000 oct = _0__
3760#    00 hex = 000 dec = 000 oct = _0__
3761#    00 hex = 000 dec = 000 oct = _0__
3762#    00 hex = 000 dec = 000 oct = _0__
3763#    48 hex = 072 dec = 110 oct = _72__
3764#    08 hex = 008 dec = 010 oct = _8__

3765#    FA hex = -06 dec = 372 oct = _250__
3766#    47 hex = 071 dec = 107 oct = _71__
3767#    B8 hex = -72 dec = 270 oct = _184__
3768#    81 hex = -127 dec = 201 oct = _129__
3769#    36 hex = 054 dec = 066 oct = _54__
3770#    45 hex = 069 dec = 105 oct = _69__
3771#    00 hex = 000 dec = 000 oct = _0__
3772#    00 hex = 000 dec = 000 oct = _0__
3773#    00 hex = 000 dec = 000 oct = _0__
3774#    00 hex = 000 dec = 000 oct = _0__
3775#    00 hex = 000 dec = 000 oct = _0__
3776#    00 hex = 000 dec = 000 oct = _0__
3777#    00 hex = 000 dec = 000 oct = _0__
3778#    00 hex = 000 dec = 000 oct = _0__
3779#    00 hex = 000 dec = 000 oct = _0__
3780#    8C hex = -116 dec = 214 oct = _140__
3781#    90 hex = -112 dec = 220 oct = _144__

3782#    FA hex = -06 dec = 372 oct = _250__
3783#    44 hex = 068 dec = 104 oct = _68__
3784#    BB hex = -69 dec = 273 oct = _187__
3785#    81 hex = -127 dec = 201 oct = _129__
3786#    36 hex = 054 dec = 066 oct = _54__
3787#    45 hex = 069 dec = 105 oct = _69__
3788#    7F hex = 127 dec = 177 oct = _127__
3789#    71 hex = 113 dec = 161 oct = _113__
3790#    68 hex = 104 dec = 150 oct = _104__
3791#    00 hex = 000 dec = 000 oct = _0__
3792#    00 hex = 000 dec = 000 oct = _0__
3793#    00 hex = 000 dec = 000 oct = _0__
3794#    00 hex = 000 dec = 000 oct = _0__
3795#    00 hex = 000 dec = 000 oct = _0__
3796#    00 hex = 000 dec = 000 oct = _0__
3797#    50 hex = 080 dec = 120 oct = _80__
3798#    9D hex = -99 dec = 235 oct = _157__

3799#    FA hex = -06 dec = 372 oct = _250__
3800#    45 hex = 069 dec = 105 oct = _69__
3801#    BA hex = -70 dec = 272 oct = _186__
3802#    81 hex = -127 dec = 201 oct = _129__
3803#    36 hex = 054 dec = 066 oct = _54__
3804#    45 hex = 069 dec = 105 oct = _69__
3805#    15 hex = 021 dec = 025 oct = _21__
3806#    50 hex = 080 dec = 120 oct = _80__
3807#    00 hex = 000 dec = 000 oct = _0__
3808#    00 hex = 000 dec = 000 oct = _0__
3809#    00 hex = 000 dec = 000 oct = _0__
3810#    00 hex = 000 dec = 000 oct = _0__
3811#    00 hex = 000 dec = 000 oct = _0__
3812#    00 hex = 000 dec = 000 oct = _0__
3813#    00 hex = 000 dec = 000 oct = _0__
3814#    A0 hex = -96 dec = 240 oct = _160__
3815#    63 hex = 099 dec = 143 oct = _99__

3816#    FA hex = -06 dec = 372 oct = _250__
3817#    46 hex = 070 dec = 106 oct = _70__
3818#    B9 hex = -71 dec = 271 oct = _185__
3819#    81 hex = -127 dec = 201 oct = _129__
3820#    36 hex = 054 dec = 066 oct = _54__
3821#    45 hex = 069 dec = 105 oct = _69__
3822#    7A hex = 122 dec = 172 oct = _122__
3823#    60 hex = 096 dec = 140 oct = _96__
3824#    00 hex = 000 dec = 000 oct = _0__
3825#    00 hex = 000 dec = 000 oct = _0__
3826#    00 hex = 000 dec = 000 oct = _0__
3827#    00 hex = 000 dec = 000 oct = _0__
3828#    00 hex = 000 dec = 000 oct = _0__
3829#    00 hex = 000 dec = 000 oct = _0__
3830#    00 hex = 000 dec = 000 oct = _0__
3831#    86 hex = -122 dec = 206 oct = _134__
3832#    8F hex = -113 dec = 217 oct = _143__

3833#    FA hex = -06 dec = 372 oct = _250__
3834#    47 hex = 071 dec = 107 oct = _71__
3835#    B8 hex = -72 dec = 270 oct = _184__
3836#    81 hex = -127 dec = 201 oct = _129__
3837#    36 hex = 054 dec = 066 oct = _54__
3838#    42 hex = 066 dec = 102 oct = _66__
3839#    2A hex = 042 dec = 052 oct = _42__
3840#    92 hex = -110 dec = 222 oct = _146__
3841#    94 hex = -108 dec = 224 oct = _148__
3842#    00 hex = 000 dec = 000 oct = _0__
3843#    00 hex = 000 dec = 000 oct = _0__
3844#    00 hex = 000 dec = 000 oct = _0__
3845#    00 hex = 000 dec = 000 oct = _0__
3846#    00 hex = 000 dec = 000 oct = _0__
3847#    00 hex = 000 dec = 000 oct = _0__
3848#    4B hex = 075 dec = 113 oct = _75__
3849#    9B hex = -101 dec = 233 oct = _155__

3850#    FA hex = -06 dec = 372 oct = _250__
3851#    44 hex = 068 dec = 104 oct = _68__
3852#    BB hex = -69 dec = 273 oct = _187__
3853#    81 hex = -127 dec = 201 oct = _129__
3854#    36 hex = 054 dec = 066 oct = _54__
3855#    42 hex = 066 dec = 102 oct = _66__
3856#    19 hex = 025 dec = 031 oct = _25__
3857#    13 hex = 019 dec = 023 oct = _19__
3858#    6E hex = 110 dec = 156 oct = _110__
3859#    00 hex = 000 dec = 000 oct = _0__
3860#    00 hex = 000 dec = 000 oct = _0__
3861#    00 hex = 000 dec = 000 oct = _0__
3862#    00 hex = 000 dec = 000 oct = _0__
3863#    00 hex = 000 dec = 000 oct = _0__
3864#    00 hex = 000 dec = 000 oct = _0__
3865#    D9 hex = -39 dec = 331 oct = _217__
3866#    4E hex = 078 dec = 116 oct = _78__

3867#    FA hex = -06 dec = 372 oct = _250__
3868#    45 hex = 069 dec = 105 oct = _69__
3869#    BA hex = -70 dec = 272 oct = _186__
3870#    81 hex = -127 dec = 201 oct = _129__
3871#    36 hex = 054 dec = 066 oct = _54__
3872#    41 hex = 065 dec = 101 oct = _65__
3873#    2C hex = 044 dec = 054 oct = _44__
3874#    D2 hex = -46 dec = 322 oct = _210__
3875#    E2 hex = -30 dec = 342 oct = _226__
3876#    00 hex = 000 dec = 000 oct = _0__
3877#    00 hex = 000 dec = 000 oct = _0__
3878#    00 hex = 000 dec = 000 oct = _0__
3879#    00 hex = 000 dec = 000 oct = _0__
3880#    00 hex = 000 dec = 000 oct = _0__
3881#    00 hex = 000 dec = 000 oct = _0__
3882#    93 hex = -109 dec = 223 oct = _147__
3883#    57 hex = 087 dec = 127 oct = _87__

Transfering contacts from N900 to Lumia

I don't know if it has been implemented in some resent update, but at the time of doing this video, sending vCard contacts to the Lumias over bluetooth was not supported. But fortunately the Lumias have an integrated QR Code reader, and I had made a QR Code contact exported plugin for the N900. So here it is, a how to on how to transfer contacts from your N900 to your Nokia Lumia device. I knew it would be useful for something :)

Upgrade your dx bluetooth module firmware

The cheap bluetooth modules available on dealextreme have a very limited firmware (Linvor HC06), fortunately it is possible to change it! Found this blog the other day that explains the procedure of changing the firmware to HC05.

I haven't tried it yet as the SPI lines need to be connected, an well, it's not easy to solder anything to that tiny thing.

My über soldering skilz aka Bluetooth module test rig

So I got a bunch these teenytiny bt modules, I didn't release that they where that small, so soldering was going to be a small challenge.

After some thinking i decided to try if even some of the solder points would match with the vero-board pitch, luckily they did so I first anchored the module on this points and added to extra connections that was needed. Luckly not that many, tx/rx, vcc and gnd.
Result:

Bluetooth module test rig

Ugly, but it works :)

More Arduino toys

I ordered some stuff from DealExtreme to play with. An Ethernet Shield and a very tiny bluetooth transceiver module. It's going to be a challenge to solder something to it :)

Ethernet Shield and Bluetooth module

It's the cheaper version of the network shield, so no TCP/IP stack included on any chip, just an Ethernet over SPI chip (the ENC28J60), but still an easy to use chip over SPI from the Arduino. And of course there exists a library for it so using it is very easy and there is nice example code available, I made a quick test just to check that the shield works using the DHCP example.

The bluetooth module should be extremely easy to use, after somehow soldering some wires to the tiny thing. I'll let you know how it goes.