Hello everyone. In this blog post I will show Maxim’s fitness watch which I won for asking best question in Maxim’s How to Design Low-Power Sensor Solutions and Interfaces webinar. I originally plan to write short blog about it but at the end I realised that it has 23 pages in Word, so I decided to assign this blog post in RoadTest section because it is more like review rather than simple thank you blog.

Unboxing

Fitness watch was packed in white box which at first look looks like box which maxim use for any other evaluation kits . In comparison with other evaluation kits this box has sticker describing content.

After opening box, first thing which you see is welcome letter. Because I already have worked with some maxim evaluation kit this letter is nothing new to me and I already have some these letters in my cabinet:

After removing first layer of antistatic foam, you will see inner white box which contains USB cable and fitness watch.

Now let’s look to the main part, fitness watch:

From the bottom we can see some sensors, LEDs and labels including FCC ID which I will use later:

Very soon I found that main core of fitness watch is detachable from rubber bracelet.

USB connector is at the side which is covered by rubber bracelet:

Maybe watches satisfy some level of basic IP protection but I never read anywhere about it.

Then I tried power up the watches, but nothing happened. I guessed than maybe battery is discharged so I tried to connect watch to power supply and yes it worked. Maxim logo and hBAND appeared:

After some time, I disconnected watches from charger and started using them. They show heart rate, burned calories and steps. When synced they can also show clock. Device can work in two modes – sampled mode and continuous mode. In continuous mode it consumes more energy but sample data more frequently.

Mobile app

Mobile app is only for Android. Because I do not have any Android device, I have currently limited options to use them in standard way, but I of course find alternative way.

Bluetooth Low Energy Interface

Watches communicates with mobile phone using Bluetooth Low Energy. Since I did some BLE applications I know how GATT interface looks like and for this reason I tried to see what the device offers. First of all, I tried Raspberry Pi CLI tool bluetoothctl for connecting to device and enumerating its features. At beginning I enabled scan mode:

As you can see, I successfully find the device under hBAND name very soon. I connected to device and device very soon announced all services which it supports.

If you are interested, here is full output from bluetoothctl command:

[bluetooth]# connect CE:A3:DD:XX:XX:XX
Attempting to connect to CE:A3:DD:XX:XX:XX
[CHG] Device CE:A3:DD:XX:XX:XX Connected: yes
Connection successful
[NEW] Primary Service
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service000a
        00001801-0000-1000-8000-00805f9b34fb
        Generic Attribute Profile
[NEW] Primary Service
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service000b
        0000180d-0000-1000-8000-00805f9b34fb
        Heart Rate
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service000b/char000c
        00002a37-0000-1000-8000-00805f9b34fb
        Heart Rate Measurement
[NEW] Descriptor
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service000b/char000c/desc000e
        00002902-0000-1000-8000-00805f9b34fb
        Client Characteristic Configuration
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service000b/char000f
        00002a38-0000-1000-8000-00805f9b34fb
        Body Sensor Location
[NEW] Primary Service
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service0015
        0000180a-0000-1000-8000-00805f9b34fb
        Device Information
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service0015/char0016
        00002a29-0000-1000-8000-00805f9b34fb
        Manufacturer Name String
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service0015/char0018
        00002a24-0000-1000-8000-00805f9b34fb
        Model Number String
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service0015/char001a
        00002a27-0000-1000-8000-00805f9b34fb
        Hardware Revision String
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service0015/char001c
        00002a28-0000-1000-8000-00805f9b34fb
        Software Revision String
[NEW] Primary Service
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e
        feca57d0-7aee-fbbd-a144-3c695a4baaeb
        Vendor specific
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char001f
        feca57d6-7aee-fbbd-a144-3c695a4baaeb
        Vendor specific
[NEW] Descriptor
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char001f/desc0021
        00002902-0000-1000-8000-00805f9b34fb
        Client Characteristic Configuration
[NEW] Descriptor
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char001f/desc0022
        00002901-0000-1000-8000-00805f9b34fb
        Characteristic User Description
[NEW] Descriptor
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char001f/desc0023
        00002904-0000-1000-8000-00805f9b34fb
        Characteristic Format
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char0024
        feca57d7-7aee-fbbd-a144-3c695a4baaeb
        Vendor specific
[NEW] Descriptor
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char0024/desc0026
        00002902-0000-1000-8000-00805f9b34fb
        Client Characteristic Configuration
[NEW] Descriptor
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char0024/desc0027
        00002901-0000-1000-8000-00805f9b34fb
        Characteristic User Description
[NEW] Descriptor
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char0024/desc0028
        00002904-0000-1000-8000-00805f9b34fb
        Characteristic Format
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char0029
        feca57d8-7aee-fbbd-a144-3c695a4baaeb
        Vendor specific
[NEW] Descriptor
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char0029/desc002b
        00002902-0000-1000-8000-00805f9b34fb
        Client Characteristic Configuration
[NEW] Descriptor
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char0029/desc002c
        00002901-0000-1000-8000-00805f9b34fb
        Characteristic User Description
[NEW] Descriptor
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char0029/desc002d
        00002904-0000-1000-8000-00805f9b34fb
        Characteristic Format
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char002e
        feca57d9-7aee-fbbd-a144-3c695a4baaeb
        Vendor specific
[NEW] Descriptor
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char002e/desc0030
        00002902-0000-1000-8000-00805f9b34fb
        Client Characteristic Configuration
[NEW] Descriptor
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char002e/desc0031
        00002901-0000-1000-8000-00805f9b34fb
        Characteristic User Description
[NEW] Descriptor
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char002e/desc0032
        00002904-0000-1000-8000-00805f9b34fb
        Characteristic Format
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char0033
        feca57da-7aee-fbbd-a144-3c695a4baaeb
        Vendor specific
[NEW] Descriptor
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char0033/desc0035
        00002902-0000-1000-8000-00805f9b34fb
        Client Characteristic Configuration
[NEW] Descriptor
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char0033/desc0036
        00002901-0000-1000-8000-00805f9b34fb
        Characteristic User Description
[NEW] Descriptor
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char0033/desc0037
        00002904-0000-1000-8000-00805f9b34fb
        Characteristic Format
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char0038
        feca57db-7aee-fbbd-a144-3c695a4baaeb
        Vendor specific
[NEW] Descriptor
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char0038/desc003a
        00002902-0000-1000-8000-00805f9b34fb
        Client Characteristic Configuration
[NEW] Descriptor
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char0038/desc003b
        00002901-0000-1000-8000-00805f9b34fb
        Characteristic User Description
[NEW] Descriptor
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service001e/char0038/desc003c
        00002904-0000-1000-8000-00805f9b34fb
        Characteristic Format
[NEW] Primary Service
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service003d
        00001825-0000-1000-8000-00805f9b34fb
        Object Transfer
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service003d/char003e
        00002abd-0000-1000-8000-00805f9b34fb
        OTS Feature
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service003d/char0040
        00002ac5-0000-1000-8000-00805f9b34fb
        Object Action Control Point
[NEW] Descriptor
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service003d/char0040/desc0042
        00002902-0000-1000-8000-00805f9b34fb
        Client Characteristic Configuration
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service003d/char0043
        00002abe-0000-1000-8000-00805f9b34fb
        Object Name
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service003d/char0045
        00002abf-0000-1000-8000-00805f9b34fb
        Object Type
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service003d/char0047
        00002ac0-0000-1000-8000-00805f9b34fb
        Object Size
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service003d/char0049
        00002ac1-0000-1000-8000-00805f9b34fb
        Object First-Created
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service003d/char004b
        00002ac2-0000-1000-8000-00805f9b34fb
        Object Last-Modified
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service003d/char004d
        00002ac3-0000-1000-8000-00805f9b34fb
        Object ID
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service003d/char004f
        00002ac4-0000-1000-8000-00805f9b34fb
        Object Properties
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service003d/char0051
        00002ac7-0000-1000-8000-00805f9b34fb
        Object List Filter
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service003d/char0053
        00002ac8-0000-1000-8000-00805f9b34fb
        Object Changed
[NEW] Descriptor
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service003d/char0053/desc0055
        00002902-0000-1000-8000-00805f9b34fb
        Client Characteristic Configuration
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service003d/char0056
        00002ac6-0000-1000-8000-00805f9b34fb
        Object List Control Point
[NEW] Descriptor
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service003d/char0056/desc0058
        00002902-0000-1000-8000-00805f9b34fb
        Client Characteristic Configuration
[NEW] Characteristic
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service003d/char0059
        00002aff-0000-1000-8000-00805f9b34fb
        Unknown
[NEW] Descriptor
        /org/bluez/hci0/dev_CE_A3_DD_XX_XX_XX/service003d/char0059/desc005b
        00002902-0000-1000-8000-00805f9b34fb
        Client Characteristic Configuration
[CHG] Device CE:A3:DD:XX:XX:XX UUIDs: 00001800-0000-1000-8000-00805f9b34fb
[CHG] Device CE:A3:DD:XX:XX:XX UUIDs: 00001801-0000-1000-8000-00805f9b34fb
[CHG] Device CE:A3:DD:XX:XX:XX UUIDs: 0000180a-0000-1000-8000-00805f9b34fb
[CHG] Device CE:A3:DD:XX:XX:XX UUIDs: 0000180d-0000-1000-8000-00805f9b34fb
[CHG] Device CE:A3:DD:XX:XX:XX UUIDs: 0000180f-0000-1000-8000-00805f9b34fb
[CHG] Device CE:A3:DD:XX:XX:XX UUIDs: 00001825-0000-1000-8000-00805f9b34fb
[CHG] Device CE:A3:DD:XX:XX:XX UUIDs: feca57d0-7aee-fbbd-a144-3c695a4baaeb
[CHG] Device CE:A3:DD:XX:XX:XX ServicesResolved: yes

From listings we can see many services provided but they are better visible from device info command:

As you can see device support 6 standard services and one vendor specific service. Standard service can provide you for example battery level status. Providing Health Rate is implemented using standard service so most probably this may work with alternative mobile apps. Another interesting service is object transfer service. I guess it is used for transferring SQLite database which can be exported from the device according to manual. Vendor specific service is designed for exposing values from another sensor, I think.

Because accessing metric from this CLI tools is quite painful and it looks that it does not allow accessing all information because some of them are “consumed” by kernel API and/or dbus. For this reason, I switched to Nordic nRF Connect BLE suite which has better GUI tool. I used it on iPad (which I won in Maxim sponsored contest :)) and also on computer using nRF52840 dongle (which I won in Project14 competition).

Reading Heart Rate

nRF Connect find the same services. So, I clicked Heart Rate Service and try read data. I was able to successfully read the same value which was shown on display. So, this work well even without Android.

I currently do not know how to read data from other services or how to transfer SQLite database, but I hope I reverse android app or firmware and find this information.

Interesting is Device Info service which provides some information about device.

Surprisingly device manufacturer string is not Maxim Integrated but PulseOn and Module Number String is not hBAND or MAX-HEALTHBAND, but it is SP-2D-M. Note that the same model name is also printed from bottom of fitness watch.

Who did develop Maxim hBAND?

More interesting to me is Manufacturer Name. PulseOn is company which makes not only fitness watches, but they specialize in professional monitoring devices used by doctors most probably for monitoring patients. After some investigations I think that PulseOn developed whole watch without any intervention from Maxim but because they used some chips from Maxim, Maxim licensed their design and sells it under their own brand as an “evaluation kit” for their chips. Later I will show some other indices about this theory. I think evaluation kit here is not a correct word because it is hard to evaluate Maxim’s chip in this sealed compact device. It is not standard EVKIT which we know from Maxim. Rather is complete product for end-users and it has required certifications (CE, FCC, …). Alternative point of view is that Maxim offers this device to the public (you can buy it for example at Farnell) while PulseOn do not offer their products (at least SP-2D-M) to the public.

What chips are inside?

I did not disassembly my watches because it is hard. I do not have so small hex screwdriver and I do not want to break them. Instead, I checked for firmware. Firmware is available as binary and you can flash it to the device over air. But I received device with latest firmware, so I used firmware only for investigations what is behind cover.

For checking what chips are inside device I used my favourite binary editor: Windows notepad. Note that there are better choices like Linux strings utility, but Notepad also works well.

As you can see binary data does not make sense very much at the first look. But firmwares sometimes (frequently) contains interesting strings which we can use for identifying details about firmware and related device. After scrolling you for example can see references to pulseon:

Next, you can see very interesting reference to something referred as actana-api:

After googling I found very interesting to company Aktana (note C vs K) which develop AI algorithms with reference to life. Most probably they develop some algorithm used in this watches.

Next you can find reference to Flash SPI which is most probably memory used for storing database and log-term logs:

Later you can see additional interesting references to Nordic Semiconductor nRF52:

Even more you can see some strings used in debugging messages. If you google for some of them. They will indicate that PulseOn most probably used Nordic MCU with BLE connectivity:

After next scrolling I very soon find references to MAX20303 PMIC (note that this is nothing new. Maxim mention that hBAND evaluates this chip).

Later you can find reference to I2C display driver:

One line later we can find reference to MAX17048 fuel gauge. This is interesting because Maxim do not say that this chip is used in hBAND. Maybe it is or maybe it is artefact of later unused code in firmware. Who cares? Let’s go next.

Next reference disclose what sensor is used for detecting steps. It is Accelerometer LIS2DS from ST:

Next reference indicates what I already known. Optical sensor is MAX86140 sensor from Maxim. Maxim mention that hBAND is used for evaluating this sensor. Firmware of course contains references to it:

Next line contains reference to SX9310 proximity sensor.

This chip is not form Maxim, so Maxim do not mention it but most probably this sensor is here. But it is vey interesting sensor! It look that it is proximity sensor which is here used for presence of hand. It is invisible and does not detect hand directly. It is completely hidden after plastic cover and works in a interesting way for detecting human while not interfering with non-life parts. Datasheet also mentions some ideas for what is this sensor used for.

And this is all. No next interesting reference is here.

To summarize based on firmware opened in Notepad we most probably know most of the onboard chips. To summarize they are:

• nRF52 MCU
• Some SPI Flash
• MAX86140 Optical sensor
• MAX20303 PMIC
• MAX17048 Fuel Gauge
• SX9310 proximity sensor
• LIS2DS accelerometer

PCB

I did not open my watches for reasons mentioned above but I searched for FCC ID and found photos of PCB in FCC certification documents. I am not sure If I can publish screenshots from this document, so I give you only link instead: https://fccid.io/O4GPU426 here you can download Internal Photos document which contains photos of PCB. Most probably it is the same PCB which is in hBAND.

On first photo we can see MAX86140 optical sensor and some other large chip. From detailed photo at second page, we can read that second chip is MX25R6435F and this is 64 Mb (8MB) SPI Flash from Macronix which was only chip which we do not identified from firmware at all.

At photo of opposite side, we can see 5 additional chips, but we can see labels only of one of them: N52832 is Nordic MCU which matches our expectation. Now we know exact model of MCU. It is nRF52832. Other chips we can identify only by size but note that at least number of sensors (5 + 2 on other side) matches my expectation based on firmware analysis.

NRND

My last note is about status of this product. On Maxim website it is marked as Not Recommended for New Design. I was originally currios why do Maxim offers NRND product as reward but now I think it is not an issue. I think it is related to the fact that while it is referred as “evaluation kit” it is hard to use it for some full evaluation of chips since it is enclosed device and both evaluated sensor and PMIC are almost invisible. But NRND status change nothing on usability as end-device. It works well. While it is marked as NRND it Is still offered and there are still large quantities in stock. I think that Maxim marked this product as NRND because it is not good for design but design != usage and for using it is still well suitable (and available).

Summary

My first impressions from this fitness watch are positive. I thank Maxim and Element14 for this reward. I will use them more intensively next summer. By summer I want to better investigate how to get full data from device and possibly make some (opensource software) for gathering data from them independent on Android. In this blog post I described my first investigations on hardware inside watch and described some my first findings. Thank you for your time when reading this blog and if you have any feedback, then feel free to comment below.