Tuesday, January 23, 2018

Start BSX without the app or internet using an Android device

One of the main issues with the BSX sensor is the need for an internet connection, a phone with their app and most importantly that their servers are online.  So when the company finally shuts down, the users are out of luck and the device is worthless.  BSX Insight has been formally discontinued already.  We got a taste of what will happen a couple of weeks ago when the servers mysteriously went dark for a few days and the sensor became a brick.  

Proposal: Simulate the Bluetooth packets that the BSX Insight app sends out to start the sensor transmitting O2 data.

The Android app is able to start the sensor (with the above requirements), so I asked myself-why can't we hack something together to do the same. I did have concerns that the protocol was very proprietary and/or encrypted.  But it turned out to be very simple after all.   Using the following method you will no longer need an intact BSX internet presence, will not need the BSX app, but will need an android phone or tablet.

Lets go over the requirements and procedure.  You will need an android device with low energy bluetooth which means pretty much anything produced these days.  Perhaps an Iphone/PC would work and if requested, I will give some tips for those interested.

Go to the Google play store and install NRF connect 
Make sure your Bluetooth is turned on.
Open NRF connect and you will be presented with:

Note all of the devices including my Assioma power meter.  Press the connect button next to Insight 

The next screen below shows the window after choosing Insight:

We want to modify "Unknown Service", so click on that.

The "Unknown Service" window is below:

The next step is the important one, we are going to write a value to the Insight that will turn it on, and the red leds will start flashing. Your ANT+ devices (Garmin watch, Ant+ phone, etc) will then start reading the sensor data.

You will need to click the up arrow on the "Characteristic" that is writable 

I looked at the Bluetooth logs between my android device and the Insight and the value that seems to be sent is "040100"

Enter it as the above photo shows, then press send

That should do it!
The led lights should be flashing and the sensor is putting out Ant+ data.
That's it.

A couple of notes.  This turns it on, not off.  I'm sure I could figure out the off, but it's easy to either put it in the cradle or just reboot the sensor with a magnet, which ultimately will leave it off.
It is possible to make a "macro" with the NRF app to start the sensor just after the connect step.

Addendum: I recently bought a spare unit on ebay.  The usual "code" mentioned above did not work for activation, but luckily the BSX app still was able to start the device.  After some bluetooth snooping, the code for starting this particular batch was a bit different:

As indicated, instead of 0401, it uses 0402 to start the leds.  The off code was the same.


Part 2 is next- Macros to speed up the process


  1. My use case with BSX was not so much in training, but the Threshold testing. In theory there no so much need for the App, but the math they use to analyze the data. Do you know if there is an open, reviewed method to do so? I wonder what one can do by throwing all the big data in to ML engine for such analysis.

  2. Take a look at this: https://scholarworks.sfasu.edu/etds/42/
    If not what you need let me know.

    1. That study describes the protocol that the BSX app generates, but the actual analysis of the BSX data is a black box - they are just using the values output by the app and then comparing those values to traditional lactate threshold tests to demonstrate the validity of NIRS and the BSX platform as a replacement for blood tests. The study makes no attempt to discuss or describe the algorithm behind the BSX values.

      Now that BSX has officially shut down, I'm also interested in deriving my own lactate threshold from the raw data (i.e., recreating BSX's algorithm). I haven't been able to find anything out there that helps to describe how to find the inflection point, though.

    2. Try this:

  3. Dear,
    I can not find the value Bluetooth logs between my android device and the Insight.
    Can you help me?

    1. What device and Android os version are you using?

  4. I'm in the same boat as Justin. Thanks BJRMD for this welcome post and for the reference above. Will be looking at that shortly.

  5. You are welcome.
    Also take a look at this:
    It's a step by step tutorial on doing a ramp with the sensor on the RF, 30 watts every 3 minutes, plotting your HHb to determine breakpoints.

  6. Thank you BJRMD! The information from the measurement reference will be incorporated in to my next Python3 script development phase. (I've written a script to do what nRF Connect does, i.e., no only to turn the BSX on/off, but to also collect the SmO2/tHb data streams for inclusion/analysis with the rest of my data.

    Question, have you thought about, or know anyone else who have worked on these hexadecimal streams? That is to say, the 2e4ee00d and 2e4ee00e characteristic UUIDs in the 'unknown service' UUID? Currently, I'm looking at the Garmin coding (ANT+ protocol) to get an idea of how these streams are translated into human-readable form. Thoughts?

  7. That sounds like a great project!
    I never got into the data streams (way out of my field). Wish I could help you more.

    1. I'm having fun with it :-D No worries on your answer...just trying to cover all known points of information! I do appreciate your work.

  8. Hey Morris,
    I'm collecting relevant ANT+ and BLE training and environmental data streams associated with training and recovery. My python script has a SQLite3 backend and uses PyQt5 for the GUI frontend and live-data graph.

    After an eventual correlation analysis is done, I'll assess which machine learning method(s) (or other method) may indicate which factors influence the specific training adaptations I'm interested in.

    I'm enjoying this work although there's been some wtf moments associated with the hardware/software or PyQt5 package.


  9. Hi Bruce, I put my BSX on charge, loaded NRF and did a scan but Insight does not show up. Any ideas?

    1. Did the blue light come on the charger base? It should blink blue until it's charged then go solid.

    2. Yes it's flashing blue as it's been sat idle for a long time. I did wonder if it was lack of charge. Should I wait until it's solid light and then re-scan?

    3. I'm sure it was totally drained. Give it 24 hours and see if nrf will at least see it

  10. I had a device that worked with 040100 but now it doesn't seem to charge now.

    I just picked up a new device (never opened before) on Ebay. I am able to connect to the device with Bluetooth but the device doesn't seem to blink red with either 040100 or 040200 hex codes. Any thoughts?

    1. Are you sure it's a BSX model 2, the "original" looks the same but has different internals and is not able to send muscle O2 data (or start up with these codes). On the old device, try cleaning the contacts with alcohol and reposition in the charger base - that works sometimes too

    2. It looks its the new device is the older model. I guess this means I am SOL? As for the other device, I tried alcohol to clean the base and the other device and no luck :(

    3. Yeah, but don't feel too bad - I made the same mistake (learned the hard way). I also started with 3 BSX units but 2 won't charge any longer either.

  11. Well I got it going and wore it during a session, it was still blinking when I finished but my laptop won't recognise it when I connect it. Any way of seeing if it has stored any data?

    1. I've never got it to store data - use a Garmin watch (with Ant+) to pick it up. An Ant+ dongle will work in ipbike for android as well