Hacking the Timex Bodylink - Part 2
Here’s some sample data, and an example of how to read the heart rate data from the binary dump file eeprom.bin, continuing from part 1 of my notes on the Timex Bodylink.
This is what we don’t want to see when using the Timex Trainer software to download from the data recorder.
In my case, this happened in the middle of a long (4+ hour HRM and GPS) data download. I suspect, but can’t confirm, that this was related to leaving the “speed smoothing” function on and tripping over an unhandled exception related to a missing point or something along those lines. I didn’t seem to have problems after disabling the smoothing option.
When retrying the download, the Timex software would complain:
Timex Trainer shut down unexpectedly during the last data transfer. This may indicate a problem with the way the data was stored in the memory of the Data Recorder. Check all the connections to the Data Recorder and make sure Recorder’s battery is notl exhausted, then try the transfer again. If the transfer is still unsuccessful, you may have to erase the data in the Data Recorder (refer to Help for the procedure). Unfortunately, this means that any data currently stored in the Data Recorder will behat the ue to a loose cable or low battery. If you continue to have problems after the Data Recorder memory has been erased, contact Timex Customer Service.
In my case, I had a fresh set of batteries in the GPS pod, the HRM strap, and in the data recorder, so that wasn’t the problem. The Timex software provides a raw data dump utility, which I used to save a copy of the bits with. This takes the binary data directly from the data recorder memory without attempting any processing, and always seems to work uneventfully, even when the software otherwise complains.
I spent an evening searching online for a fix with no luck, and also spoke with Timex service on the phone, also with no luck, so I’m left with the data and some curiosity.
Here’s are some bits for anyone who wants to play along at home:
Data dump from the 2004 Big Sur Marathon: eeprom-timex-040425.bin (46KB) and eeprom-timex-040425.txt 143KB)
This is around 5 hours of HRM plus GPS data, with the time stamp probably incorrect because I don’t recall resetting it after changing the data recorder battery.
Here’s another data dump of a 75 minute HRM + GPS run: eeprom-timex-040516.bin (12KB) and eeprom-timex-040516.txt (37KB)
This run was around 75 minutes, 7.5 miles, and came after giving up on a useful response from Timex Customer Support, and resetting the data recorder using the recessed silver button on the back of the unit. This time I remembered to set the time after resetting the unit.
Here’s a data dump of a HRM-only run: eeprom-timex-040517.bin (3KB), eeprom-timex-040517.txt (9KB)
This run was a 70 minute treadmill hill interval session. There’s only one session in the recorder, as the previous session was cleared.
Now let’s have a look at the data. Here’s the top of the HRM-only session:
80 01 00 94 0B 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 03 0C 10 04 04 63 65 65 65 68 6A 6A 68 69 69 68 6B 6C 6B 6A 68 67 66 6B 68 69 69 6B 6C 6E 6F 6E 6E 6E 6E 6F 70 70 6F 70 6F 6F 6F 6C 6D 6D 6C 6D 6D 6C 6B 68 66 66 67 68 68 68 68 67 68 67 66 67 68 68 68 68 6A 6B 68 68 68 68 67 68 68 68 69 68 67 67 65 66 66 67 67 64 64 64 65 64 64 64 66 6B 6B 6B 68 68 68 67 67 64 64 64 65 65 65 66 66 63 63 63 67 68 65 67 67 65 65 65 64 64 64 65 64 62 62 62 63 62 62 63 63 62 63 62 63 63 63 66 65 64 63 63 63 63 63 62 64 64 6B 6C 6D 6E 70 72 72 72 72 72 72 72 72 73 74 75 75 76 76 76 76 77 77 77 79 79 7A 79 77 77 77 78 79 79 79 79 79 77 77 79 79 79 7A 7A 7A 7C 7C 7C 7C 7C 7D 7D 7D 7E 7D 7E 7E 7E 7F 7F 7E 7E 7E 80 7F 7F 7F 7F 80 7E 7E 7D 7E 7D 7D 7D 7E 7F 7F 7F 7F 80 7F 7F 7F 7E 7F 7D 7D 7B 7C 7D 7E 7E 80 81 81 83 83 83 83 82
Here’s how to read the heart rate data dump:
The first 240 bytes contains directory header info for all sessions in the recorder memory.
The first 2 bytes contain the magic number
80 01
Each subsequent 3 bytes contain the offset in bytes to the end of the Nth data session.
In this case we have
00 94 0b
After byteswapping to
00 0b 94
this works out to 2964, which is the length of the binary dump. If there were a second data session logged, it would start at offset 2964 from the top of memory.
Now let’s look at the actual session data. The first 240 bytes appear to be reserved for storing the session offsets. The beginning of interesting data looks like this:
00 11 03 0C 10 04 04 63 65 65 65 68 6A 6A 68 69
The first few heart rate entries that turn up in Timex Trainer for this session are
99,101,101,101,104,106,106,104,105,105,104
In hex, this would be
63,65,65,65,68,6A,6A,68,69,69,68
So it looks like there’s a 7 byte session header. This is probably just a serialized internal data structure from the Timex Trainer software, which appears to be built with Visual Basic for the GUI, and a DLL to handle device functions, probably written in C.
From looking at various headers, here’s how to read the session header:
00 11 03 0C 10 04 04
00 = heart rate data only
11 hex = 17 decimal = seconds
03 hex = 03 decimal = minutes
0C hex = 12 decimal = hours
10 hex = 16 decimal = day
04 hex = 04 decimal = month (0 = January)
04 hex = 04 decimal = year (0 = 2000)
So this session starts at 12:03:17 on May 16, 2004.
After the heart rate data starts, there’s not much else going on here, since there’s no GPS records mixed in. Occasionally, we see something like this in the middle of the data:
59 59 59 59 60 60 60 61 00 00 00 00 00 00 54 00 00 00 00 00 00 04 66 65 66 69 68 68 67 68 00 6B
I think the recorder just fills in zeros when it doesn’t have a valid input.
At the end of the heart rate data session, we again see a 7 byte trailing record.
00 31 1C 0D 10 04 04
Not so sure about this part, but the
04 04seems to turn up at the end of other data sessions.
At this point, you should now be able to reliably extract heart rate data from the raw data dump provided by the Timex Bodylink data recorder.
The next post in this series will look at the GPS-based speed and distance data.
See also: Hacking the Timex Bodylink - Part 1
Tags: running, timex, hrm, bodylink, hacking
October 25th, 2005 at 7:09 am
Hello, great to see someone else trying their hand at getting data from the timex bodylink system. I’m currently working with the Timex API provided at sourceforge.net (http://sourceforge.net/projects/tmx-dr-api). I am having problems understanding the structure and getting their unmanaged dll to work with C#, and it is being a real pain. Mind if we have open talks in developing a solution to get the raw data in a manner that is better than using the Timex ‘dump’ methods. I was thinking XML or something along those lines directly from the device with a C# based program.
I look forward to hearing from you.
October 27th, 2005 at 10:16 am
I haven’t had a chance to try the Timex code at sourceforge.net yet, but I would be interested to hear if anyone has been able to make use of it. I got one of the first units of the data recorder, and had asked if there was any documentation available, but got no response after several different queries.
Feel free to post or pingback here with any updates or comments about the Timex data recorder interface code.
January 14th, 2006 at 6:10 pm
[…] Hacking the Timex Bodylink, Part 2 Technorati Tags: bodylink fitness gadgets gps hrm running timex training […]
March 29th, 2007 at 3:50 pm
Wow, that’s complex. I’m extremely happy to see someone who seems to know what they are doing, try to figure this piece of junk out for the rest of the fitness community…or should I say, help us ‘consumers’ make it work like it’s supposed to. Sorry I’m so bitter, but I’m thoroughly disappointed in this product. I’ve tried to work with Timex and they give me a standard response of “We’re sorry that our product isn’t meeting up to your expectations, but because it’s out of warranty, we can’t help you.” In boiled down terms, they’re really saying, “Too bad you just lit a match to $375.00. Go pound sand and have a nice day!”.
I have the hardest time getting the “Data 2 Rec” to sync up with the GPS and HR Monitor, even though the watch syncs almost instantaneously with the GPS and HR monitor. I sit there on my bike and spend about 15 minutes trying to get the green light to try and blink once, then twice quickly to show it’s capturing HR and GPS data. Also, the HR monitor piece bounces clear up to 240 quite frequently and then drops back down to where my HR is really at. I’ve tried new batteries, cleaning the connections each time, moving the chest strap around on my chest, tightening it, loosening it, and moistening the HR contacts, etc. I don’t get it. If I can’t seem to get it figured out relatively soon, I’m going to have to dump it and go with Polar…They have a new product that allows cyclists to monitor cadence and has an add-on to capture Watts to determine power per revolution. Now that’s cool for the cyclist enthusiasts out there. Geesh, buying a Polar, that’s something I thought I’d never say. I’ll keep looking here to see if anyone can figure the Timex out, but I’m not holding my breath. It’s difficult to make something better if it started out as junk to begin with. Best of luck to you all.
April 10th, 2007 at 12:58 pm
It’s been awhile but I suppose for those Google fanatics I’ll give an update as I managed to get it working, just ported it to .NET 2.0 recently hence this comment. If you’d like a managed version of this which returns simple data tables from .NET drop me a line, it’s free. I’ll be working on posting it on my blog shortly.
August 3rd, 2007 at 7:32 pm
Has anyone look into the hardware aspects of the system? The GPS module probably send out NEMA format data. The communication between the GPS receiver and the watch/recorder is likely to use near field signal. Does anyone has specific information on these? Or has hack into these? I just bought a used (and non-functioning) GPS receive and plan to take it apart to investigate.