Main Links Work Studies Other  

Obs! I'm not the author of RS400 tools (site down), but you can download the source code.

Polar F55 HRM on Linux

I have stopped working on this project, as I updated to RS400. The main reason was that I wanted to be able to record HR which isn't supported by the F55. Hopefully the already collected information will help someone wanting to make the F55 model work with linux.

Related links


The Polar F55 HRM watch communicates with a PC or a mobile phone using an infrared connection. Older models use a sonic connection. There are at least two different infrared connection types. Older models use a "raw" infrared serial connection. Newer model use the IrDA protocol, which should make the whole thing easier. The F55 works over a serial IrCOMM link using TinyTP flow control (similar to RS400). The problem with each model is finding out the protocol to communicate with the watch.

IrDA on Linux

These are the steps I performed on my laptop to make IrDA run on Debian GNU/Linux.

To test, I ran irdadump (as root), put the watch in "Connect" mode and placed it near the IrDA port. The watch showed "Infrared connect" and irdadump output was Polar F55 hint=8204, [ PDA/Palmtop IrCOMM ].

Here's code that can be used to send messages to the watch and read the response through /dev/ircomm0... (to appear)


Here's what I have been able to figure out of the F55 protocol so far. My initial assumptions are based on the work done in the RS400 Tools.

Commands and responses

A command consists of one byte, with possible command data. A response consists of a repeated command byte and data payload. A single response data byte 0x02 seems to indicate an invalid command and 0x00 a valid command. Some commands are similar to the RS400 protocol. Setting variables in the watch without proper data will apply random data and may mess up the watch. Similary values outside accepted range mess up screen.

Here are some things that I haven't been able to figure out. The main problem seems to be getting to know the multiple byte commands to extract data from the watch. This has now been solved by finding how to access the memory of the watch (but not time/date). This gives access to settings, exercises and all other saved data. The problem is now finding out where things are located in memory.

Below are the single command bytes that I have found out and my guess of their function. After that is more detailed information about the commands and possible responses.

0x08 Download watch memory (Some settings etc.)
0x09 Factory reset
0x0a Disconnect, go to watch mode
0x15 Unknown (Battery status? Overview in RS400)
0x26 Disconnect, reset time/date, go to sleep mode
0x3b Set general settings
0x3c Set user settings
0x3e Set watch settings
0x42 Unknown, adds reminders
0x4a Disconnect
0x4b Unknown, adds exercises
0x61 Unknown (Exercise download?)

Below is the structure for downloading from watch memory. There seems to be 32 kB of memory, as it is replicated from that point on. This command can be used to access settings, if you know the memory address. Time and date seem not be not located in this memory.

Command for download a number of bytes from given address.
0 8 Command byte 0x08
1 8 Address & 0x00ff 0x00-0xff
2 8 Address >> 8 0x00-0x7f
3 8 Length 0x00-0x2f
Response for download command
0 8 Command byte 0x08
1-2 16 Address
3-(Length+3) 8*Length Data

Below is the command structure for general settings. I haven't found out how keylock mode can be set. Response is 0x3b 0x00.

Set general settings
Byte Size (bits) Purpose Values Memory address
0 8 Command byte 0x3b
1 1 Units 0=kg/cm, 1=lb/ft 0x0188 (bit 5)
2 Sound 0=OFF, 1=VOL1, 2=VOL2 0x0189 (bits 0-1)
5 Padding?
2 3 Language 0=en, 1=de, 2=es, 3=fr, 4=it
5 Padding?

Below is the command structure for user settings. Response is 0x3c 0x00.

Set user settings
Byte Size (bits) Purpose Values Memory address
0 8 Command byte 0x3c
1-2 16 Weight (in lb) 0-65535 lb = 0-? kg 0x018b-0x018c
3 8 Height (in cm) 0-255 (cm) 0x018d
4 1 Sex 0=Male, 1=Female 0x018a (bit 0)
7 Padding?
5 8 Padding?
6 8 HR Max 0-255 0x0192
7 8 VO2 Max 0-255 0x0194
8 8 HR Sit 0-255 0x0193
9 8 Day 1-31 0x018e
10 8 Month Jan=1-12=Dec 0x018f
11 8 Year 00-20=20XX, 21-99=19XX 0x0190
12 2 Activity 0=low, 1=moderate, 2=high, 3=top 0x0191
6 Padding?

Below is the command structure for setting time in the watch. Response is 0x3e 0x00.

Set watch settings
Byte Size (bits) Purpose Values Memory address
0 8 Command byte 0x3e
1 8 Day 1-31
2 8 Month Jan=1-31=Dec
3 8 Year 00-20=20XX, 21-99=19XX
4 8 Padding?
5 8 Minutes 0-59 (BCD)
6 8 Hours 0-23 (BCD)
7 8 Alarm minutes 0-59 (BCD) 0x001a
8 8 Alarm hours 0-23 (BCD) 0x001b
9 2 Alarm status 0=off, 1=daily, 2=mon-fri 0x001c
6 Padding?
10 1 Watch mode 0=24h, 1=12h 0x001d (bit 0)
1 Timezone mode 0=Time, 1=Time2
6 Padding?
11 8 Timezone 2 difference 30 minute multiples, with sign-magnitude format 0x0019

Below is the memory contents that are known or guessed.

Known memory contents.
0x0019 Time2
0x001a Alarm minutes
0x001b Alarm hours
0x001c Alarm action
0x001d Watch mode 24h/12h (bit 0)
0x0188 Keylock (bit 0), Units (bit 5)
0x0189 Sound
0x018a Sex (bit 0)
0x018b:c Weight
0x018d Heigth
0x018e Birthday Day
0x018f Birthday Month
0x0190 Birthday Year
0x0191 Activity
0x0192 HR Max
0x0193 HR Sit
0x0194 VO2 Max


I can be reached from jaakko <dot> vayrynen <at> gmail <dot> com.
Valid XHTML 1.0! Valid CSS! URL:
Last modified: Wed Jun 10 13:57:08 2009