nRF51822 based fitness trackers

posted in: Arduino, BLE, Bluetooth | 26

As regular readers of my blog will know I’m an ardent fan of the Nordic nRF51 (and nRF52) series of Bluetooth Low Energy MCU’s.

So when I found out that a number of fitness tracker / smart watches, used the nRF51822 and could be easily opened and reprogrammed I was very interested and ordered 2 of them to try.

Unfortunately soon after I ordered them, it became clear that the model I had ordered would probably not be powered by an nRF51822, and hence started my quest to understand what models of smart watch do, really, use the nRF51.


Firstly, the model number of the watch I ordered was a TW64 – which is where the confusion starts.

A number of completely different watches are sold as a TW64 but contain completely different processors.

The ones I ordered, from eBay, had the Quintic QN9021 (  listed as the main processor, however when I opened mine up, it actually contains a Dialog DA 14850 processor  (

Either way my watch unfortunately didn’t contain an nRF51


However searching for “TW64 nRF51822” does find some watches marketed as a TW64 which do contain the nRF51822, which lead me to Shenzhen DO Intelligent Technology Co., Ltd. on Alibaba.

I contacted them to find out more details and found that all of their smart watch/ fitness trackers use the nRF51822

Their product numbers are P101,P102,ID100HR,ID105,ID105HR,ID107,ID107HR,ID101HR,ID110HR,ID111HR and ID115HR

So if you are looking for an nRF51 based smart watch, your best bet is to search using one of those model numbers, and double check the details in the eBay / AliExpress / Gearbest etc listing to confirm it does mention the nRF51822


In the end I decided to buy an ID100HR and a ID107HR, via AliExpres.


When my ID100HR arrived, and I unscrewed the back of the case on the watch, I was pleasantly surprised to find that the watch contained an nRF51822QFAC, which is the 32k RAM version (top of the range for this MCU), and also that the watch has both the 16Mhz main crystal and also the 32kHz low power mode crystal.


With the help of Goran Mahovlic, I can now reprogram this watch using the Arduino IDE and can read from the accelerometer sensor, and write to the display, as well as get input from the button and turn on and off the vibration motor.

I have yet to investigate how the Silicon labs Si1142, Heart Rate sensor is interfaced to the MCU, but as its I2C, its possible its wired onto the same bus as the Kionix kx022-1020 accelerometer.

So it should be possible to use this feature of the watch as well.


If anyone wants to give this a try for themselves, please also read my previous postings about programming the nRF51822 using the Arduino IDE and also refer to my latest Arduino for nRF51822  repo on github.



26 Responses

  1. rsyoung

    Thanks for posting, I am very interested in following your progress with this device. Hoping you will share your code used to access the peripherals.


  2. Michael

    Great! Which resolution (in pixels) does the OLED have?
    Do you plan to publish your source code?


  3. Roger Clark

    The code for the smart watch is in the repo I linked to

    Goran has submitted some examples, of the basic functions including the motion sensor and the display.

    (Actually there is a bug in the motion sensor which I need to fix, but its only a typo, so I will try to remember to update the repo today)

  4. Roger Clark

    Code is in the repo I linked to.

    Display size on most of these watches is only 64×32 pixels, as the display is 0.49 inch.

    But I think one or two of the models may have a slightly larger display as the orientation is at 90 deg to a regular watch.
    However I dont have any of those models.

    I have an ID100HR, which is currently in pieces on the bench, and I cant take the ID107HR apart until I get some tiny torx style screwdrivers.
    The ID100HR was easy to take apart, as it just had small crosshead screws.

    I will post a followup article on the ID100HR including pictures

  5. Roger Clark

    The code is here

    Examples for the smartwatch are here

    (Examples are by Goran, but updated by me)

    There is a bug in the motion sensor example that I need to fix

    Libraries were also submitted by Goran and bug fixed by me.

    I will try to do a followup post today

  6. Dash

    Thanks a lot to put up this article. I had ordered an opta sw006 but received id100hr. The best part is this has a heart rate monitor and the one I ordered didn’t had any. I was thinking of writing a complaint on Amazon for this wrong order delivery. But now I rather keep this for my self.
    Yes I would like to learn how to fix the bug. If you have a video or any articles that can help me learn about it please post it here.

  7. Roger Clark

    I’m not sure what a SW006 is. It looks very much like a TW64 but all the codes are fairly meaningless, as the main manufacturer of these types of fitness trackers has made the same model with various different MCU’s in the past, e.g. Dilog and TI, and only recently seems to have switched to using the nRF51822 series.

    Your best source of information is on gitter where Goran has setup a “lobby”

    However I don’t think anyone has time to work out how the Heart Rate sensor is connected to the MCU. It doesnt seem to be connected via I2C, or at least not on the same pins as the motion sensor, as we have run an I2C scanner and it only found the motion sensor.

    When I get time I was planning to investigate which pins the Heart Rate monitor is connected to, but my work schedule has not allowed me to do this.

  8. Goran Mahovlić

    Just for info here: on gitter Dan has provide pinout for HRM, I have tried it with old Softcore and I can get some info from ID107, I can turn on LED and get some values from registers, but I did not have time to do anything else. I have also solved OLED working while using wire library, but I did not test two I2C(HRM KX). KX is working and you can get some info but I do not have time to write complete library

  9. Roger Clark


  10. James

    Hi Roger,

    Is there a way within the Arduino IDE to set the advertisement interval for the nrf51822 to below 100ms? Specifically I’m hoping to have the advertisements come out every 20ms or 50Hz. I do not need it to be connectable.

    Let me know what you think!

  11. Calorie Counter

    are you trying to interface with the watch or actually code against it?

  12. Roger Clark

    I’m totally reprogramming the watch and replacing its internal software (firmware), so it can do other things e.g. pair up with other similar watches to share data, give notifications if its in range of iBeacons etc etc

    It is possible to interface with the exiting firmware in these watches with your own app (not the “VeriFit” app that is supplied with the watch ), however you would need to either pay the manufacturer for the Bluetooth interface specification documents (or they give them free if you order 1000 watches) – or somehow reverse engineer the BLE comms between the watch and the App – which could be difficult.

  13. Roger Clark

    You can change the advertising interval. Just look in the beacon code, its defined somewhere near the top and is defined as 100mS , as this is the norm for iBeacons.

    // 100ms; in multiples of 0.625ms

    However the advertising period can’t be set to the nearest millisecond. Its in steps of 0.625mS

    Actually, there is a bug in the beacon example, I think that the value needs to be set to 100 instead of 160 for 100mS, I think the core bluetooth library has been changed and the example code didnt get updated (by RedBear Labs)

    Anyway, 20mS should be possible, as 20mS is divisible by 0.625 mS

    Also bear in mind, that the BLE hardware automatically adds jitter to the advertising period, so that multiple beacons don’t interfere with each other (if they happened to be started at precisely the same time and hence would constantly broadcast advertisements at the same time)

    You will also get increased power consumption as you decrease the advertising period, as when the MCU is transmitting, it takes several milliamps for about 1mS

  14. Jani Kocsis

    Hi Roger!

    My ID107HR gone wrong. It looks like it wants to upgrade its firmware. But nothing happens. There is only an up arrow on the display. I think, it’s not totally dead. Maybe the bootloader working yet. I will become a working one. Is there a way to backup the firmware from the working device, and flash into the faulty? Do I need the IDE, if I don’t want to modify the firmware?

  15. Roger Clark

    You would need to contact the manufacturer of vendor about the built in firmware.

    The firmware is read protected, so its not supposed to be possible to read it.

    There are some complicated hacks which can sometimes read the firmware even though it is read protected, (as there is a bug in the SWD debugger implementation in the nRF51). But it requires special hardware and special software.

    But as far as I’m aware no one has successfully been able to back up the firmware on an ID107HR and transfer it to another ID107HR and make it work.

  16. Jani Kocsis

    Thank you Roger. I will give it a try. Perhaps there is some support, or hope at least.

  17. Serkan Aykut

    Roger Hi. Thank very much for all information.I have a responsibility. Is it possible to use a static memory in ID107HR? So I can store some dynamic data myself and then I can read and write from device.

  18. Roger Clark

    As its an ARM device, you should just be able to declare your data variable as const, and that should put the data into program memory

  19. Serkan Aykut

    thank you for information. my aim is communicate to many bluetooth device and transfer to data from wristband. is it possible? when wristband handle some beacon signal after take beacon id and send to raspberry pi 3. this fllow is posible or not?

  20. Roger Clark


    This is possible. The nRF51822 can operate as either a Peripheral or Central in its Bluetooth Low Energy operation.
    I think it can be bother central and peripheral at the same time, but I’ve not looked at the example code from Nordic which explains how to do this.

    However the main problem you will have is battery drain. If you want to scan for beacons, you will need to run the CPU for all the time you are scanning, and this would reduced the battery life to perhaps 1 or 2 hours at the most.

    Scanning normally takes a few seconds, so even if you only “wake” the watch up to scan every 10 seconds, its still going to need to run for several seconds scanning, then switch from central to peripheral mode, and wait for the RPi to connect, which will take several more seconds

    So you may find its impractical due to battery limitations.

  21. Jasper

    Hi Roger,
    I have tried to follow your (and your friend Gorans) feed as far back as I possibly can. I have seen some photos that Goran has posted on Facebook also about this project.
    I’m trying to also interface with a smartband. A different one than yours but internally it looks kinda similar.
    … long story short …
    It has a nRF51822 xxAC in. I’m using a SEGGER J-Link device and connected DIO, SCLK and GND. Also connected the VTref pin of the programmer to VDD on the smartband.
    The problem that I have is that the J-Link refuse to connect to the smartband. It looks like the SCLK line goes up and down but swings around ~1.5V instead of 3V (VDD = 3.0V)
    I have even tried to pull it up to VDD with an external resistor ~1K but no-go. btw. the DIO and SCLK lines isnt anyware else connected on the PCB.
    It doesnt look like you guys used an J-link programmer. What did you use? Do you have any photos of your setup?
    Can you remember if your SCLK line swinged around 3V when you programmed.
    … end lastly, IS there anything that I should do before I try the program it or could it be a mode that the unit is in that makes it not want to go into programming mode?

  22. Roger Clark

    You should be able to use a JLink.

    If you don’t connect VTRef to 3.3V JFlash will show an error saying your board does not have any power voltage.


    It should just connect, you should not need any external resistors

  23. Alexander

    Based on what I see in firmwares found on the Russian site 4pda, they are flashed at position 0x18000, which makes me think that range 0 – 0x18000 is occupied by Nordic SoftDevice S110 v8 ( Thus, no sense in reading that area (as it seems to me), it can be downloaded from Nordic site. But starting from 0x18000 actual application code begin, and that area is very likely not read-protected (it would be hard to implement, assuming that this code is updatable from time to time. This is a well known pattern in nrf51822 development: you flash the SoftDevice (or it is pre-flashed by a manufacturer) and make it read-protected, whereas the application using this SoftDevice is not read protected. Looking for my set of devices coming, perhaps make an update on that.

  24. Roger Clark

    I’m not sure if V8 has DFU does it ?

    The MCU is going to be read protected, but there is a known bug where you can read it even if it is read protected, by using some detective work and an OpenOCD script

  25. Alexander

    SoftDevice does not have DFU. Application developers provide DFU, and it may use SoftDevice (to use radio). DFU is typically a separate module flashed at the pretty top of ROM (~0x3C000), and configured as a startup in one of Nordic registers. See an example here: (or at the Nordic documentation),

    Yes, I have read about reading read-protected areas, pretty impressive. But I really hope it is not required here.

  26. Roger Clark


    I’d not noticed the DFU stuff until V10