Garmin BLE heart rate monitor -- cannot get HRM data via Bluetooth, what am I missing?

Question

With an unbranded Bluetooth/ANT+ heart rate monitor, I can get the HRM data easily using gatttool:

<MAC address>> connect
Attempting to connect to <MAC address>
Connection successful
<MAC address>> primary
(...)
<MAC address>> char-desc 0x000c 0x0011
(...)
<MAC address>> char-write-req 0x000f 0100
Characteristic value was written successfully
Notification handle = 0x000e value: 16 34 e4 04 
Notification handle = 0x000e value: 16 34 a5 04 
Notification handle = 0x000e value: 16 33 ea 04 
Notification handle = 0x000e value: 16 33 de 04

With this I am sending to handle 0x000f which is 00002902-0000-1000-8000-00805f9b34fb, which is where I need to send the request (doc for 0x2902), and I get responses from another handle (doc for 0x2a37).

I'm already a bit confused by the 0100 payload that we send. The spec for 0x2902 says that we should send 16 bits, and 0x0100 is 0b100000000. Does this result in 0b0000000100000000 or in 0b1000000000000000? Why are we sending 0x0100 and not 0x8000 (i.e. 1 with 15 0)?

Anyway, 01, 010, 0100, 01000 will work, but any more digits will fail. Shouldn't it fail with 5 digits already, since 4 hex chars is 16 bits? Anyway, 01 works (Notifications on, Indications off?), 02 will not result in updates (Notifications off, Indications on?), 03 works (Notifications on, Indications on?). Is my understanding sort of correct?

I now take my Garmin heart rate monitor (it's a Garmin HRM Dual). I can connect just fine via Bluetooth to it, I can find the correct handle for HRM interaction (the handle that corresponds to UUID 0x2902), but when I use gatttool to send a char-write-req to the handle just like previously, it says the value was written, but nothing ever happens. I've tried a number of values but nothing ever happens.

Am I missing something? Is there any extra step that needs to be taken before calling the HRM handle? Thank you.

Did you ever find out what that missing step is? – Martin Ueding Dec 19 '21 at 18:06 — Martin Ueding, Dec 19 '21 at 18:06

score 0 · Answer 1 · answered Nov 30 '20 at 07:32

The 0100 that you are sending is just 0001 in Little Endian. Because BlueZ is using Little Endian when writing values, the last byte comes first. For example, if you want to write 01 02 03, you will have to write it as 030201. This is why 01, 010, 0100, and 01000 all work, because in all of these cases you are writing 01. You are also correct about 02 enabling indications, and that 03 would enable both notifications and indications.

As for enabling notifications and reading HRM data, make sure that you are wearing your HRM Dual before you enable notifications. The reason for this is that the HRM Dual will not work unless it detects actual Heart Rate data. You can test this by connecting via the nRF Connect app on your Android/iOS device and trying to read the HRM data.

Garmin BLE heart rate monitor -- cannot get HRM data via Bluetooth, what am I missing?

1 Answers1