Thanks for this work — the OTA writer and the protocol notes are the reason any of this is possible.
I have a question, plus a measurement from a model that isn't in Known_BLE_OEM_Ring_Names.txt.
Data point: R09 on stock firmware (RY09_3.10.21_251107)
The known-names list has R01–R08 and R10, but not R09, so here is what stock does. 30-second 0xA1 capture, started with subcommand 0x04:
- ppg: 30 samples / 30 s → ~1 Hz, median inter-sample interval 989 ms
- accel: 30, spo2: 30, hr: 29 in the same window
- ppg amplitude 2783–13908 (good contact, signal alive)
- unknown-subtype packets: 0 · non-
0xA1 packets: 1
So it emits one 16-byte packet per second carrying one sample of each subtype. That lines up with the Edge Impulse sample log (~240 ms between packets, three subtypes rotating → ~1.3 Hz per signal), i.e. the R09 behaves like a stock R02 here rather than worse.
What I'm after
Beat-to-beat intervals (RR), to compute frequency-domain HRV (VLF/LF/HF) and run resonance-frequency breathing biofeedback.
1 Hz can't do it: the heart beats at ~1 Hz, so by Nyquist there's no room to resolve beat-to-beat variation, and host-side resampling doesn't add information.
The other routes are closed on stock firmware, on my ring:
- no standard Heart Rate Service in the GATT table, so no RR characteristic
0x39 returns a firmware-computed HRV integer, aggregated into 30-minute blocks- real-time HR mode returns BPM, already averaged
That leaves firmware.
Questions
1. Does R02_3.00.06_FasterRawValuesMOD.bin raise the PPG rate, or only the accelerometer?
The Gadgetbridge thread quotes you as having "only changed the raw accelerometer refresh timeout to something lower", and #7 asks the same thing without an answer. I have a spare R02, so I can flash it and measure — but if you already know it's accel-only, that saves everyone the round trip.
2. If it is accel-only: is there a separate rate/timeout governing the PPG path that could be patched the same way? If you can point at roughly where it lives, I'm glad to do the work and report back with numbers.
3. Has anyone dumped or flashed anything on the RY09 branch? Mine is 3.10.21, so the MOD would be a cross-model downgrade from a newer branch. I won't flash my daily driver blind — if R09 is untested, I'll keep the experiments on the spare R02.
What I can offer back
I have a working 0xA1 decoder and a 30-second probe that reports effective Hz per subtype, plus amplitude and packet-type counts. Happy to run it on stock and modded firmware and post results here — including on the R09, which nobody seems to have characterised yet.
Thanks for this work — the OTA writer and the protocol notes are the reason any of this is possible.
I have a question, plus a measurement from a model that isn't in
Known_BLE_OEM_Ring_Names.txt.Data point: R09 on stock firmware (
RY09_3.10.21_251107)The known-names list has R01–R08 and R10, but not R09, so here is what stock does. 30-second
0xA1capture, started with subcommand0x04:0xA1packets: 1So it emits one 16-byte packet per second carrying one sample of each subtype. That lines up with the Edge Impulse sample log (~240 ms between packets, three subtypes rotating → ~1.3 Hz per signal), i.e. the R09 behaves like a stock R02 here rather than worse.
What I'm after
Beat-to-beat intervals (RR), to compute frequency-domain HRV (VLF/LF/HF) and run resonance-frequency breathing biofeedback.
1 Hz can't do it: the heart beats at ~1 Hz, so by Nyquist there's no room to resolve beat-to-beat variation, and host-side resampling doesn't add information.
The other routes are closed on stock firmware, on my ring:
0x39returns a firmware-computed HRV integer, aggregated into 30-minute blocksThat leaves firmware.
Questions
1. Does
R02_3.00.06_FasterRawValuesMOD.binraise the PPG rate, or only the accelerometer?The Gadgetbridge thread quotes you as having "only changed the raw accelerometer refresh timeout to something lower", and #7 asks the same thing without an answer. I have a spare R02, so I can flash it and measure — but if you already know it's accel-only, that saves everyone the round trip.
2. If it is accel-only: is there a separate rate/timeout governing the PPG path that could be patched the same way? If you can point at roughly where it lives, I'm glad to do the work and report back with numbers.
3. Has anyone dumped or flashed anything on the RY09 branch? Mine is 3.10.21, so the MOD would be a cross-model downgrade from a newer branch. I won't flash my daily driver blind — if R09 is untested, I'll keep the experiments on the spare R02.
What I can offer back
I have a working
0xA1decoder and a 30-second probe that reports effective Hz per subtype, plus amplitude and packet-type counts. Happy to run it on stock and modded firmware and post results here — including on the R09, which nobody seems to have characterised yet.