Sunday, January 9, 2011

Sanitas SBM30 (aka HL868BA) teardown

The next step of my Ambulatory Blood Pressure Monitor (ABPM) project is to move from a wrist cuff monitor to an upper arm cuff which is far more practical for ABPM. My local Lidl store just had a Sanitas SBM30 upper arm cuff BP monitor on special offer. So I bought one. I was pleasantly surprised to find that it is almost identical to the HL168Y which my previous modification was based on. (Indeed the fine print on the box states that it is identical to the HL868BA).

As it is likely to be a few months before I can post an update on my ABPM project, I've provided some tear down photos and some technical information about this device in case anyone else would like to modify it.

Opening the device:

Before proceeding to open, be aware that this is likely to void your warranty. It may also comprise the reliable operation of the device. So if you require this for medical reasons I would advise you get a separate device for experimentation and clearly label which is which.

At the bottom of the device two screws need to be removed. The top and bottom parts of the case can then be separated. There are 6 plastics clips (is that the right word?) located at the left center and right of the top and bottom.

Once the top is removed, the rubber button contacts can be lifted off. Next remove screws at the top of the LCD holder. Carefully remove the LCD from the white holder. Be careful not to damage the LCD or the cable which attaches it to the PCB. This will expose two more screws under the LCD. Removing those screws allows the white LCD holder to be removed. Now the top of the PCB is exposed. Unfortunately the LCD is permanently connected to the PCB. It will not be easy to reconnect if it is detached for any reason.

Test pads:

Unlike the HL168Y where the test pads are scattered around the PCB, the test pads on this device are conveniently brought together exposed through a slot in the battery compartment. The pitch is 2.54mm. In theory this should facilitate the construction of a cable to mate with these test pads. Any suggestions on how to accomplish this would be greatly appreciated. Please email jdesbonnet at gmail dot com if you have any suggestions.

Test pads TP8 and TP10 are for power and ground respectively, so any such cable can dispense with the need for batteries. Perhaps the connector can be attached to the battery compartment cover. TP 1 to 4 are directly connected to the front panel buttons. Pulling these low is the same thing as depressing a button. TP15 and TP18 can be used to snoop on read/write traffic to the EEPROM (see earlier posts on how to do this).

TP1"Mode" button. Pull to 0V to activate.
TP2"Set" button. Pull to 0V to activate.
TP3"Memory" button. Pull to 0V to activate.
TP4"Start" button. Pull to 0V to activate.
TP8+5V / battery

The MCU:

This is similar or identical to the MCU in the HL168Y. The chip marking first line reads 86CX23, the second line HLEEF7. It seems to be a custom chip made by the Health and Life Co (the "HL"). I have no doubt it's based on some standard core. But beyond that I have no clue what's going on inside... nor is it necessary to know for my application.


The device uses the EEPROM chip to store blood pressure records and a few configuration variables. This chip is a ST Microelectronics 24C08WP. This is the same 8 kbit (1 kbyte) chip used in the HL168Y. I didn't get a chance to verify if the memory map is the same as that documented for the HL168Y. I would be surprised if it differed. The data can be accessed by passively snooping on the bus SCL and SDA lines (TP15 and TP18). I've documented a way of doing this in this blog post.

The following is a description of the HL168Y (and presumably the HL868BA also) memory map:

Blood pressure records  are 8 bytes long starting at address 0x0010 and are always 8 byte block aligned. First record is stored at 0x0010, next at 0x0018 etc.

byte 0month 1 .. 12
byte 1day of month 1 .. 31
byte 2 bit 7Hour of day pm flag. am if clear.
byte 2 bits 3:012 hour clock time
byte 3minutes 0 .. 59
byte 4 bits 7:4the hundreds decimal digit of systolic BP in mmHg
byte 4 bits 3:0the hundreds decimal digit of diastolic BP in mmHg
byte 5 bits 7:4the tens decimal digit of systolic BP in mmHg
byte 5 bits 3:0the least significant decimal digit of systolic BP in mmHg
byte 6 bits 7:4the tens digit of diastolic BP
byte 6 bits 3:0the least significant digit of diastolic BP in mmHg
byte 7heart rate in bpm (beats per minute)

Locations 0x0000 to 0x000f are reserved for other things. I haven't figured out what they are all for yet.
Location 0x0007 is the number of BP records in memory.

The pneumatics:

The pneumatics comprises a pump, electrically activated release valve, a slow release valve and a pressure sensor (on the PCB). The configuration is identical to that of the HL168Y which I have documented here.

More tear down photos are here:

If you have any questions or information to contribute, please do not hesitate to contact me by email: jdesbonnet at gmail dot com.


Andrew Luxner said...


I found out that this unit is available in the US at CVS stores. The unit says "Automatic Inflate" on the box, CVS item number 708884 (on bottom of box) and the UPC code is 050428794135. This item can only be found in CVS stores (not online).

Justas -------------- said...

Is it possible to calibrate this unit somehow?

jdesbonnet said...

Searching google, there are some papers (all that I've seen so far are behind paywalls) on calibration of oscillometric blood pressure measurement devices. The important thing from the device point of view is having a moderately accurate pressure sensor. The rest is about the signal processing algorithm to detect the pressure pulses. Given the notoriously imprecise nature of measuring blood pressure I suspect the accuracy of the pressure sensor doesn't have to be spectacular, and the limiting factor in a good reading is the quality of the software.

G said...

Just FYI, the Kingfield BP204 appears to be the OEM for the $15 wrist meter sold in Harbor Freight under the "Wristech" name. There's some info at the Kingyield site on its innards.

Also I believe the serial EEPROM IC is a k24c so your technique described here ought to work. Looks like the 64kbit (8K byte) chip is sized just right to hold 100 readings at 8 bytes per reading? I haven't extracted the data yet to confirm that it's like the one you've studied but I'ld bet that it is...

By the way, rather than saving the readings as they're being made, why not collect them directly to the target device by stepping through the displays with (simulated presses of) the 'next' button when the meter is returned after the experiment, ie extracting the data on read rather than on write?

G said...

By the way it's a very low-tech alternative, but I've had good results reading data back from the display with a camera and ocr software. You do need to use an ocr program customised for seven segment displays however. You can either build a rig to hold your device in the same place in the photo every time, or use OpenCV's square finder code to locate the display in a less precisely-framed image. Then just step through tapping the next button until all screens have been displayed and we loop back to the start.

Joe Desbonnet said...

@G It has been a while since I worked on that, but I think the motivation for grabbing the BP record when the measurement was taken was to not rely on the limited memory of the device. Instead, with any half decent MCU you could store the readings onboard or to a SD card (trivially small/cheap these days).

However the advantage of relying on the BP monitor's own memory is that the ABPM hack is reduced to essentially an intervalometer to trigger a reading every (approx) 15 minutes. You could do that with just a 555 and a capacitor. You then, as you say, use a separate device to suck the data from the memory after the user is finished with using the device.

Mohamed Alzwei said...


i just want to ask can i use the same code for any other model of Sanitas,because i could find the SBM30

Joe Desbonnet said...

I suspect they are all very similar from an electronics point of view, so it is likely any hacks will be transferable across models. But not certain about that.

Mohamed Alzwei said...

Thanks again very much Joe,
i just want to ask you, is it possible to take the reading from the wires going to LCD screen, and display values in arduino

G said...

I looked at tapping off the connection to the LCD but on the Wristech at least, the connection is via a pressure-fit edge connector directly to the glass. I could see no way to insert something between the contacts and the glass, and the pitch was so fine that even if I left the screen off and tried to wire to the edge connector, it would require soldering skills beyond my level of ability. Tapping off the memory chip is a far easier proposition.

Joe Desbonnet said...

The information is on the LCD so it's theoretically possible. But I wouldn't take that approach myself. There are far too many parallel signal lines (if it was a serial protocol to the LCD it would be a different matter).

Sudarshan Venkataraman said...

Hello .. the sanitas SMB30 is no longer available .. is this hack possible using a sbm50 or an sbm21 ? please do shed light on which sbm devices are capable of being hacked using ur steps ? Thanks in advance

pro-cash's thoughts...... said...

I have a rossmax ak101f, can you help me how to connect it to arduino uno?