Tuesday, January 23, 2018

Start BSX without the app or internet using an Android device

One of the main issues with the BSX sensor is the need for an internet connection, a phone with their app and most importantly that their servers are online.  So when the company finally shuts down, the users are out of luck and the device is worthless.  BSX Insight has been formally discontinued already.  We got a taste of what will happen a couple of weeks ago when the servers mysteriously went dark for a few days and the sensor became a brick.  

Proposal: Simulate the Bluetooth packets that the BSX Insight app sends out to start the sensor transmitting O2 data.

The Android app is able to start the sensor (with the above requirements), so I asked myself-why can't we hack something together to do the same. I did have concerns that the protocol was very proprietary and/or encrypted.  But it turned out to be very simple after all.   Using the following method you will no longer need an intact BSX internet presence, will not need the BSX app, but will need an android phone or tablet.

Lets go over the requirements and procedure.  You will need an android device with low energy bluetooth which means pretty much anything produced these days.  Perhaps an Iphone/PC would work and if requested, I will give some tips for those interested.

Go to the Google play store and install NRF connect 
Make sure your Bluetooth is turned on.
Open NRF connect and you will be presented with:

Note all of the devices including my Assioma power meter.  Press the connect button next to Insight 

The next screen below shows the window after choosing Insight:

We want to modify "Unknown Service", so click on that.

The "Unknown Service" window is below:

The next step is the important one, we are going to write a value to the Insight that will turn it on, and the red leds will start flashing. Your ANT+ devices (Garmin watch, Ant+ phone, etc) will then start reading the sensor data.

You will need to click the up arrow on the "Characteristic" that is writable 

I looked at the Bluetooth logs between my android device and the Insight and the value that seems to be sent is "040100"

Enter it as the above photo shows, then press send

That should do it!
The led lights should be flashing and the sensor is putting out Ant+ data.
That's it.

A couple of notes.  This turns it on, not off.  I'm sure I could figure out the off, but it's easy to either put it in the cradle or just reboot the sensor with a magnet, which ultimately will leave it off.
It is possible to make a "macro" with the NRF app to start the sensor just after the connect step.

Addendum: I recently bought a spare unit on ebay.  The usual "code" mentioned above did not work for activation, but luckily the BSX app still was able to start the device.  After some bluetooth snooping, the code for starting this particular batch was a bit different:

As indicated, instead of 0401, it uses 0402 to start the leds.  The off code was the same.


Part 2 is next- Macros to speed up the process


  1. My use case with BSX was not so much in training, but the Threshold testing. In theory there no so much need for the App, but the math they use to analyze the data. Do you know if there is an open, reviewed method to do so? I wonder what one can do by throwing all the big data in to ML engine for such analysis.

  2. Take a look at this: https://scholarworks.sfasu.edu/etds/42/
    If not what you need let me know.

    1. That study describes the protocol that the BSX app generates, but the actual analysis of the BSX data is a black box - they are just using the values output by the app and then comparing those values to traditional lactate threshold tests to demonstrate the validity of NIRS and the BSX platform as a replacement for blood tests. The study makes no attempt to discuss or describe the algorithm behind the BSX values.

      Now that BSX has officially shut down, I'm also interested in deriving my own lactate threshold from the raw data (i.e., recreating BSX's algorithm). I haven't been able to find anything out there that helps to describe how to find the inflection point, though.

    2. Try this:

  3. Dear,
    I can not find the value Bluetooth logs between my android device and the Insight.
    Can you help me?

    1. What device and Android os version are you using?

  4. I'm in the same boat as Justin. Thanks BJRMD for this welcome post and for the reference above. Will be looking at that shortly.

  5. You are welcome.
    Also take a look at this:
    It's a step by step tutorial on doing a ramp with the sensor on the RF, 30 watts every 3 minutes, plotting your HHb to determine breakpoints.

  6. Thank you BJRMD! The information from the measurement reference will be incorporated in to my next Python3 script development phase. (I've written a script to do what nRF Connect does, i.e., no only to turn the BSX on/off, but to also collect the SmO2/tHb data streams for inclusion/analysis with the rest of my data.

    Question, have you thought about, or know anyone else who have worked on these hexadecimal streams? That is to say, the 2e4ee00d and 2e4ee00e characteristic UUIDs in the 'unknown service' UUID? Currently, I'm looking at the Garmin coding (ANT+ protocol) to get an idea of how these streams are translated into human-readable form. Thoughts?

  7. That sounds like a great project!
    I never got into the data streams (way out of my field). Wish I could help you more.

    1. I'm having fun with it :-D No worries on your answer...just trying to cover all known points of information! I do appreciate your work.