The Wireless Protocol of a Sports Wrist Watch

The “Crivit Sports” wrist watch HRM (Heart Rate Monitor)

---

 

This is a wrist watch that can also display the heart rate BPM (Beats Per Minute).

 

The complete specs and the user manual can be found at http://www.lidl-service.com/cps/rde/xchg/SID-648946E8-5F850FDD/lsp/hs.xsl/product.html?id=47039228

 

The heart beats are detected by a chest strap included with the watch.

The chest strap have two conductive rubber pads that senses the electrical signals produced by the heart beats. No contact gel is required for the rubber pads.

The link between the chest strap and the wrist watch is wireless, by an RF (Radio Frequency) signal.

 

Missing features

---

Being a very cheap item, it does not have any kind of connectivity, it can not log data, and it can not make charts. It would have been way more interesting to be able to see a ECG (ElectroCardioGram) or a BPM chart for the whole day. Could it be possible?

Couldn’t find any online technical documentation about this ‘Crivit Sports’ model.

 

Reverse engineering the RF signal

---

 

To receive the RF, a one loop coil was wrapped around the chest strap, by simply clipping the oscilloscope GND (GrouND) wire alligator to the tip of the probe, and around the chest strap transmitter.

 

This is the signal received from the chest belt HRM for a constant heart rate of 100 BPM. The RF carrier is at 110 kHz, 100% AM (Amplitude Modulated) by a digital signal.

By looking at the received signal for various heart rates, it turns out that the BPM rate is computed by the chest wrap by averaging the last few heart beats, then the resulting number is used to modulate the RF signal like this:

• chest strap monitor’s RF carrier is at 110 kHz, 100% AM modulated
• a bit of 1 is made by a 3 ms ON (100% RF) followed by a 4.8 ms OFF (0% RF)
• a bit of 0 is made by a 7.8 ms OFF (0% RF)

The BPM data is constantly sent about 0.5 to 2 times per second. The delay between two data packets is unrelated with the heart beat. The structure of a packet is:

• one start sync bit with 5ms ON (100% RF) and 4.8ms OFF (0% RF)
• next 6 bits encode the chest strap ID (IDentification). The ID changes randomly each time the battery is disconnected. The observed IDs were all bigger then 48 (first two bits 11)
• the remaining 13 bits encodes the BPM.

This stream of data is received and decoded by the wrist watch, which then display one number, the BPM. Observed BPM displayed range was between 30 and 233. The watch displays the BPM no matter what ID the chest belt randomly picked.

 

I tried to look at the carrier waveform corresponding to a couple of different BPM numbers, by doing push-ups in order to accelerate the heart beat. My intention was to understand the correspondence between the last 13 bits sent by the chest strap and the BPM number displayed by the wrist watch.

Counting bits after making push-ups is not easy. I couldn’t figure out the encoding scheme.

 

Another more rigorous testing way was necessary. Instead of using real heart signals, a signal generator (RIGOL DG4102) was used to simulate the electrical signals coming from the heart. By contrast with a real heart, the generator can produce any BPM number with high accuracy.

The output from the signal generator was connected to the two conductive rubber pads of the chest strap. An one wire loop antenna was wrapped around the chest belt, and the received RF signal was displayed on the oscilloscope (RIGOL DS1054Z).

 

Also, another signal was generated by the second channel of the generator, and was added as a grid (the magenta signal), to ease the task of counting consecutive bits of zero. Each magenta spike is now pointing to a zero or a one bit. The yellow signal in this capture is:

S  111001  0101000100011

Where ‘S’ is the Sync bit, ‘111001’ is the chest strap ID and ‘0101000100011’ is the BPM. For this particular signal, the wrist watch will display one hundred BPM.

 

By varying the period of the fake heart beat generated signal, all possible heart rates were browsed.

The following table contains the encoding bits sent by the chest strap for each possible BPM number displayed by the wrist watch.

If someone recognizes this encoding scheme, then please let me know, because I still can not figure out the formula between the last 13 RF bits and the displayed BPM number.
(LATER EDIT: Thank you all for the proposed encoding algorithm, it is described and tested in The Wireless Protocol of a Sports Wrist Watch (Part 2))

 

Oscilloscope last 13 pulses (BPM)	Number displayed by Wrist Watch	Number displayed (binary)
0010101110010	30	00011110
0010101111100	31	00011111
0011000010011	32	00100000
0011000010101	33	00100001
0011000011001	34	00100010
0011000011110	35	00100011
0011000100011	36	00100100
0011000100101	37	00100101
0011000101001	38	00100110
0011000101110	39	00100111
0011001000011	40	00101000
0011001000101	41	00101001
0011001001001	42	00101010
0011001001110	43	00101011
0011001100110	44	00101100
0011001101010	45	00101101
0011001110010	46	00101110
0011001111100	47	00101111
0011100100110	48	00110000
0011100101010	49	00110001
0011100110010	50	00110010
0011100111100	51	00110011
0011101000110	52	00110100
0011101001010	53	00110101
0011101010010	54	00110110
0011101011100	55	00110111
0011110000110	56	00111000
0011110001010	57	00111001
0011110010010	58	00111010
0011110011100	59	00111011
0011111001100	60	00111100
0011111010100	61	00111101
0011111100100	62	00111110
0011111111000	63	00111111
0100010010011	64	01000000
0100010010101	65	01000001
0100010011001	66	01000010
0100010011110	67	01000011
0100010100011	68	01000100
0100010100101	69	01000101
0100010101001	70	01000110
0100010101110	71	01000111
0100011000011	72	01001000
0100011000101	73	01001001
0100011001001	74	01001010
0100011001110	75	01001011
0100011100110	76	01001100
0100011101010	77	01001101
0100011110010	78	01001110
0100011111100	79	01001111
0100100010011	80	01010000
0100100010101	81	01010001
0100100011001	82	01010010
0100100011110	83	01010011
0100100100011	84	01010100
0100100100101	85	01010101
0100100101001	86	01010110
0100100101110	87	01010111
0100101000011	88	01011000
0100101000101	89	01011001
0100101001001	90	01011010
0100101001110	91	01011011
0100101100110	92	01011100
0100101101010	93	01011101
0100101110010	94	01011110
0100101111100	95	01011111
0101000010011	96	01100000
0101000010101	97	01100001
0101000011001	98	01100010
0101000011110	99	01100011
0101000100011	100	01100100
0101000100101	101	01100101
0101000101001	102	01100110
0101000101110	103	01100111
0101001000011	104	01101000
0101001000101	105	01101001
0101001001001	106	01101010
0101001001110	107	01101011
0101001100110	108	01101100
0101001101010	109	01101101
0101001110010	110	01101110
0101001111100	111	01101111
0101100100110	112	01110000
0101100101010	113	01110001
0101100110010	114	01110010
0101100111100	115	01110011
0101101000110	116	01110100
0101101001010	117	01110101
0101101010010	118	01110110
0101101011100	119	01110111
0101110000110	120	01111000
0101110001010	121	01111001
0101110010010	122	01111010
0101110011100	123	01111011
0101111001100	124	01111100
0101111010100	125	01111101
0101111100100	126	01111110
0101111111000	127	01111111
1000010010011	128	10000000
1000010010101	129	10000001
1000010011001	130	10000010
1000010011110	131	10000011
1000010100011	132	10000100
1000010100101	133	10000101
1000010101001	134	10000110
1000010101110	135	10000111
1000011000011	136	10001000
1000011000101	137	10001001
1000011001001	138	10001010
1000011001110	139	10001011
1000011100110	140	10001100
1000011101010	141	10001101
1000011110010	142	10001110
1000011111100	143	10001111
1000100010011	144	10010000
1000100010101	145	10010001
1000100011001	146	10010010
1000100011110	147	10010011
1000100100011	148	10010100
1000100100101	149	10010101
1000100101001	150	10010110
1000100101110	151	10010111
1000101000011	152	10011000
1000101000101	153	10011001
1000101001001	154	10011010
1000101001110	155	10011011
1000101100110	156	10011100
1000101101010	157	10011101
1000101110010	158	10011110
1000101111100	159	10011111
1001000010011	160	10100000
1001000010101	161	10100001
1001000011001	162	10100010
1001000011110	163	10100011
1001000100011	164	10100100
1001000100101	165	10100101
1001000101001	166	10100110
1001000101110	167	10100111
1001001000011	168	10101000
1001001000101	169	10101001
1001001001001	170	10101010
1001001001110	171	10101011
1001001100110	172	10101100
1001001101010	173	10101101
1001001110010	174	10101110
1001001111100	175	10101111
1001100100110	176	10110000
1001100101010	177	10110001
1001100110010	178	10110010
1001100111100	179	10110011
1001101000110	180	10110100
1001101001010	181	10110101
1001101010010	182	10110110
1001101011100	183	10110111
1001110000110	184	10111000
1001110001010	185	10111001
1001110010010	186	10111010
1001110011100	187	10111011
1001111001100	188	10111100
1001111010100	189	10111101
1001111100100	190	10111110
1001111111000	191	10111111
1100100100110	192	11000000
1100100101010	193	11000001
1100100110010	194	11000010
1100100111100	195	11000011
1100101000110	196	11000100
1100101001010	197	11000101
1100101010010	198	11000110
1100101011100	199	11000111
1100110000110	200	11001000
1100110001010	201	11001001
1100110010010	202	11001010
1100110011100	203	11001011
1100111001100	204	11001100
1100111010100	205	11001101
1100111100100	206	11001110
1100111111000	207	11001111
1101000100110	208	11010000
1101000101010	209	11010001
1101000110010	210	11010010
1101000111100	211	11010011
1101001000110	212	11010100
1101001001010	213	11010101
1101001010010	214	11010110
1101001011100	215	11010111
1101010000110	216	11011000
1101010001010	217	11011001
1101010010010	218	11011010
1101010011100	219	11011011
1101011001100	220	11011100
1101011010100	221	11011101
1101011100100	222	11011110
1101011111000	223	11011111
1110000100110	224	11100000
1110000101010	225	11100001
1110000110010	226	11100010
1110000111100	227	11100011
1110001000110	228	11100100
1110001001010	229	11100101
1110001010010	230	11100110
1110010000110	231	11100111
1110001011100	232	11101000
1110010001010	233	11101001

 

---

---

---