Last modified: Wed Jun 10 13:57:08 2009
Obs! I'm not the author of RS400 tools (site down), but you can download the source code.
I have stopped working on this project, as I updated to RS400. The main reason was that I wanted to be able to record HR which isn't supported by the F55. Hopefully the already collected information will help someone wanting to make the F55 model work with linux.
The Polar F55 HRM watch communicates with a PC or a mobile phone using an infrared connection. Older models use a sonic connection. There are at least two different infrared connection types. Older models use a "raw" infrared serial connection. Newer model use the IrDA protocol, which should make the whole thing easier. The F55 works over a serial IrCOMM link using TinyTP flow control (similar to RS400). The problem with each model is finding out the protocol to communicate with the watch.
To test, I ran irdadump (as root), put the watch in "Connect" mode and placed it near the IrDA port. The watch showed "Infrared connect" and irdadump output was Polar F55 hint=8204, [ PDA/Palmtop IrCOMM ].
Here's code that can be used to send messages to the watch and read the response through /dev/ircomm0... (to appear)
Here's what I have been able to figure out of the F55 protocol so far. My initial assumptions are based on the work done in the RS400 Tools.
A command consists of one byte, with possible command data. A response consists of a repeated command byte and data payload. A single response data byte 0x02 seems to indicate an invalid command and 0x00 a valid command. Some commands are similar to the RS400 protocol. Setting variables in the watch without proper data will apply random data and may mess up the watch. Similary values outside accepted range mess up screen.
Here are some things that I haven't been able to figure out. The main problem seems to be getting to know the multiple byte commands to extract data from the watch. This has now been solved by finding how to access the memory of the watch (but not time/date). This gives access to settings, exercises and all other saved data. The problem is now finding out where things are located in memory.
Below are the single command bytes that I have found out and my guess of their function. After that is more detailed information about the commands and possible responses.
| Command | Purpose |
|---|---|
| 0x08 | Download watch memory (Some settings etc.) |
| 0x09 | Factory reset |
| 0x0a | Disconnect, go to watch mode |
| 0x15 | Unknown (Battery status? Overview in RS400) |
| 0x26 | Disconnect, reset time/date, go to sleep mode |
| 0x3b | Set general settings |
| 0x3c | Set user settings |
| 0x3e | Set watch settings |
| 0x42 | Unknown, adds reminders |
| 0x4a | Disconnect |
| 0x4b | Unknown, adds exercises |
| 0x61 | Unknown (Exercise download?) |
Below is the structure for downloading from watch memory. There seems to be 32 kB of memory, as it is replicated from that point on. This command can be used to access settings, if you know the memory address. Time and date seem not be not located in this memory.
| Byte | Size(bits) | Purpose | Values |
|---|---|---|---|
| 0 | 8 | Command byte | 0x08 |
| 1 | 8 | Address & 0x00ff | 0x00-0xff |
| 2 | 8 | Address >> 8 | 0x00-0x7f |
| 3 | 8 | Length | 0x00-0x2f |
| Byte | Size(bits) | Purpose | Values |
|---|---|---|---|
| 0 | 8 | Command byte | 0x08 |
| 1-2 | 16 | Address | |
| 3-(Length+3) | 8*Length | Data |
Below is the command structure for general settings. I haven't found out how keylock mode can be set. Response is 0x3b 0x00.
| Byte | Size (bits) | Purpose | Values | Memory address |
|---|---|---|---|---|
| 0 | 8 | Command byte | 0x3b | |
| 1 | 1 | Units | 0=kg/cm, 1=lb/ft | 0x0188 (bit 5) |
| 2 | Sound | 0=OFF, 1=VOL1, 2=VOL2 | 0x0189 (bits 0-1) | |
| 5 | Padding? | |||
| 2 | 3 | Language | 0=en, 1=de, 2=es, 3=fr, 4=it | |
| 5 | Padding? |
Below is the command structure for user settings. Response is 0x3c 0x00.
| Byte | Size (bits) | Purpose | Values | Memory address |
|---|---|---|---|---|
| 0 | 8 | Command byte | 0x3c | |
| 1-2 | 16 | Weight (in lb) | 0-65535 lb = 0-? kg | 0x018b-0x018c |
| 3 | 8 | Height (in cm) | 0-255 (cm) | 0x018d |
| 4 | 1 | Sex | 0=Male, 1=Female | 0x018a (bit 0) |
| 7 | Padding? | |||
| 5 | 8 | Padding? | ||
| 6 | 8 | HR Max | 0-255 | 0x0192 |
| 7 | 8 | VO2 Max | 0-255 | 0x0194 |
| 8 | 8 | HR Sit | 0-255 | 0x0193 |
| 9 | 8 | Day | 1-31 | 0x018e |
| 10 | 8 | Month | Jan=1-12=Dec | 0x018f |
| 11 | 8 | Year | 00-20=20XX, 21-99=19XX | 0x0190 |
| 12 | 2 | Activity | 0=low, 1=moderate, 2=high, 3=top | 0x0191 |
| 6 | Padding? |
Below is the command structure for setting time in the watch. Response is 0x3e 0x00.
| Byte | Size (bits) | Purpose | Values | Memory address |
|---|---|---|---|---|
| 0 | 8 | Command byte | 0x3e | |
| 1 | 8 | Day | 1-31 | |
| 2 | 8 | Month | Jan=1-31=Dec | |
| 3 | 8 | Year | 00-20=20XX, 21-99=19XX | |
| 4 | 8 | Padding? | ||
| 5 | 8 | Minutes | 0-59 (BCD) | |
| 6 | 8 | Hours | 0-23 (BCD) | |
| 7 | 8 | Alarm minutes | 0-59 (BCD) | 0x001a |
| 8 | 8 | Alarm hours | 0-23 (BCD) | 0x001b |
| 9 | 2 | Alarm status | 0=off, 1=daily, 2=mon-fri | 0x001c |
| 6 | Padding? | |||
| 10 | 1 | Watch mode | 0=24h, 1=12h | 0x001d (bit 0) |
| 1 | Timezone mode | 0=Time, 1=Time2 | ||
| 6 | Padding? | |||
| 11 | 8 | Timezone 2 difference | 30 minute multiples, with sign-magnitude format | 0x0019 |
Below is the memory contents that are known or guessed.
| Address | Purpose |
|---|---|
| 0x0019 | Time2 |
| 0x001a | Alarm minutes |
| 0x001b | Alarm hours |
| 0x001c | Alarm action |
| 0x001d | Watch mode 24h/12h (bit 0) |
| 0x0188 | Keylock (bit 0), Units (bit 5) |
| 0x0189 | Sound |
| 0x018a | Sex (bit 0) |
| 0x018b:c | Weight |
| 0x018d | Heigth |
| 0x018e | Birthday Day |
| 0x018f | Birthday Month |
| 0x0190 | Birthday Year |
| 0x0191 | Activity |
| 0x0192 | HR Max |
| 0x0193 | HR Sit |
| 0x0194 | VO2 Max |
|
|
URL:http://www.iki.fi/jjv/polar_f55_hrm.html Last modified: Wed Jun 10 13:57:08 2009 |