As it is likely to be a few months before I can post an update on my ABPM project, I've provided some tear down photos and some technical information about this device in case anyone else would like to modify it.
Opening the device:
At the bottom of the device two screws need to be removed. The top and bottom parts of the case can then be separated. There are 6 plastics clips (is that the right word?) located at the left center and right of the top and bottom.
Once the top is removed, the rubber button contacts can be lifted off. Next remove screws at the top of the LCD holder. Carefully remove the LCD from the white holder. Be careful not to damage the LCD or the cable which attaches it to the PCB. This will expose two more screws under the LCD. Removing those screws allows the white LCD holder to be removed. Now the top of the PCB is exposed. Unfortunately the LCD is permanently connected to the PCB. It will not be easy to reconnect if it is detached for any reason.
Test pads:
Test pads TP8 and TP10 are for power and ground respectively, so any such cable can dispense with the need for batteries. Perhaps the connector can be attached to the battery compartment cover. TP 1 to 4 are directly connected to the front panel buttons. Pulling these low is the same thing as depressing a button. TP15 and TP18 can be used to snoop on read/write traffic to the EEPROM (see earlier posts on how to do this).
| TP1 | "Mode" button. Pull to 0V to activate. |  |
| TP2 | "Set" button. Pull to 0V to activate. | |
| TP3 | "Memory" button. Pull to 0V to activate. | |
| TP4 | "Start" button. Pull to 0V to activate. | |
| TP5 | ? | |
| TP8 | +5V / battery | |
| TP10 | 0V | |
| TP15 | EEPROM I2C bus SCL | |
| TP18 | EEPROM I2C bus SDA |
The MCU:
The EEPROM:
The following is a description of the HL168Y (and presumably the HL868BA also) memory map:
Blood pressure records are 8 bytes long starting at address 0x0010 and are always 8 byte block aligned. First record is stored at 0x0010, next at 0x0018 etc.
| byte 0 | month 1 .. 12 |
| byte 1 | day of month 1 .. 31 |
| byte 2 bit 7 | Hour of day pm flag. am if clear. |
| byte 2 bits 3:0 | 12 hour clock time |
| byte 3 | minutes 0 .. 59 |
| byte 4 bits 7:4 | the hundreds decimal digit of systolic BP in mmHg |
| byte 4 bits 3:0 | the hundreds decimal digit of diastolic BP in mmHg |
| byte 5 bits 7:4 | the tens decimal digit of systolic BP in mmHg |
| byte 5 bits 3:0 | the least significant decimal digit of systolic BP in mmHg |
| byte 6 bits 7:4 | the tens digit of diastolic BP |
| byte 6 bits 3:0 | the least significant digit of diastolic BP in mmHg |
| byte 7 | heart rate in bpm (beats per minute) |
Locations 0x0000 to 0x000f are reserved for other things. I haven't figured out what they are all for yet.
Location 0x0007 is the number of BP records in memory.
The pneumatics:
The pneumatics comprises a pump, electrically activated release valve, a slow release valve and a pressure sensor (on the PCB). The configuration is identical to that of the HL168Y which I have documented here.
More tear down photos are here:
http://picasaweb.google.com/jdesbonnet/ABPMProject
If you have any questions or information to contribute, please do not hesitate to contact me by email: jdesbonnet at gmail dot com.
http://picasaweb.google.com/jdesbonnet/ABPMProject
If you have any questions or information to contribute, please do not hesitate to contact me by email: jdesbonnet at gmail dot com.
13 comments:
Hello,
I found out that this unit is available in the US at CVS stores. The unit says "Automatic Inflate" on the box, CVS item number 708884 (on bottom of box) and the UPC code is 050428794135. This item can only be found in CVS stores (not online).
Is it possible to calibrate this unit somehow?
Searching google, there are some papers (all that I've seen so far are behind paywalls) on calibration of oscillometric blood pressure measurement devices. The important thing from the device point of view is having a moderately accurate pressure sensor. The rest is about the signal processing algorithm to detect the pressure pulses. Given the notoriously imprecise nature of measuring blood pressure I suspect the accuracy of the pressure sensor doesn't have to be spectacular, and the limiting factor in a good reading is the quality of the software.
Just FYI, the Kingfield BP204 appears to be the OEM for the $15 wrist meter sold in Harbor Freight under the "Wristech" name. There's some info at the Kingyield site on its innards.
Also I believe the serial EEPROM IC is a k24c so your technique described here ought to work. Looks like the 64kbit (8K byte) chip is sized just right to hold 100 readings at 8 bytes per reading? I haven't extracted the data yet to confirm that it's like the one you've studied but I'ld bet that it is...
By the way, rather than saving the readings as they're being made, why not collect them directly to the target device by stepping through the displays with (simulated presses of) the 'next' button when the meter is returned after the experiment, ie extracting the data on read rather than on write?
By the way it's a very low-tech alternative, but I've had good results reading data back from the display with a camera and ocr software. You do need to use an ocr program customised for seven segment displays however. You can either build a rig to hold your device in the same place in the photo every time, or use OpenCV's square finder code to locate the display in a less precisely-framed image. Then just step through tapping the next button until all screens have been displayed and we loop back to the start.
@G It has been a while since I worked on that, but I think the motivation for grabbing the BP record when the measurement was taken was to not rely on the limited memory of the device. Instead, with any half decent MCU you could store the readings onboard or to a SD card (trivially small/cheap these days).
However the advantage of relying on the BP monitor's own memory is that the ABPM hack is reduced to essentially an intervalometer to trigger a reading every (approx) 15 minutes. You could do that with just a 555 and a capacitor. You then, as you say, use a separate device to suck the data from the memory after the user is finished with using the device.
hello,
i just want to ask can i use the same code for any other model of Sanitas,because i could find the SBM30
Thanks
I suspect they are all very similar from an electronics point of view, so it is likely any hacks will be transferable across models. But not certain about that.
Thanks again very much Joe,
i just want to ask you, is it possible to take the reading from the wires going to LCD screen, and display values in arduino
I looked at tapping off the connection to the LCD but on the Wristech at least, the connection is via a pressure-fit edge connector directly to the glass. I could see no way to insert something between the contacts and the glass, and the pitch was so fine that even if I left the screen off and tried to wire to the edge connector, it would require soldering skills beyond my level of ability. Tapping off the memory chip is a far easier proposition.
The information is on the LCD so it's theoretically possible. But I wouldn't take that approach myself. There are far too many parallel signal lines (if it was a serial protocol to the LCD it would be a different matter).
Hello .. the sanitas SMB30 is no longer available .. is this hack possible using a sbm50 or an sbm21 ? please do shed light on which sbm devices are capable of being hacked using ur steps ? Thanks in advance
I have a rossmax ak101f, can you help me how to connect it to arduino uno?
Post a Comment