Document Lelo F1s Protocol

[blackspherefollower]

BLE Name (v1): F1s
BLE Name (v2): F1SV2X or F1SV2A

Pairing (kinda):

• V1:
  • On start the device will advertise itself
  • After connect the power button must be pressed again before BLE control will be effective (subscribing to 0x0aa4 will prevent this from immediately turning the device off)
  • On Disconnect the device will power off (no chance of clean reconnect if your connection drops)
• V2:
  • On start the device will advertise itself
  • Read from 0x0a10 - if we get a 1 we're already paired and can control the device
  • If we already have a passphrase, we can write it to 0x0a10, if we read back a 1 we're already paired and can control the device
  • If we're getting 0, we need to "pair", which means we need to subscribe to 0x0a10 and then the user needs to press the power button (subscribing to 0x0aa4 will prevent this from immediately turning the device off)
  • On power button press, we should get a passphrase sent to 0x0a10 which we need to write back and should start reading 1.
  • The passphrase should be cacheable, so we don't have to require the button push each connection, and in fact the V2 seems to not require repairing after connection drops

Service UUID: 0000fff0-0000-1000-8000-00805f9b34fb

• Tx Motor: 0000fff1-0000-1000-8000-00805f9b34fb
  Format 0x01 0xXX 0xYY
  XX = Oscillator (0x00-0x64) - The device will ramp up or down to this value.
  YY = Vibrator (0x00-0x64) - The device will immediately apply this value.

• Rx Battery Voltage: 00000a00-0000-1000-8000-00805f9b34fb

• Rx Serial Number: 00000a05-0000-1000-8000-00805f9b34fb

• Rx Chip ID: 00000a07-0000-1000-8000-00805f9b34fb

• Rx Thrust Count: 00000a04-0000-1000-8000-00805f9b34fb
  Value: 0xXX 0xYY (16-bit int?). A count of the number of detected insertions into the device since restart.

• Tx OTA (upgrade?): 00000a08-0000-1000-8000-00805f9b34fb

• Rx Length: 00000a0b-0000-1000-8000-00805f9b34fb
  Value: 0xXX 0xYY (16-bit int?). Values 00-08 on YY for capacitive sensors insertion length reading.

• Rx Accelerometer: 00000a0c-0000-1000-8000-00805f9b34fb

• Tx Vibrator Setting: 00000a0d-0000-1000-8000-00805f9b34fb

• Tx "Activate": 00000a0e-0000-1000-8000-00805f9b34fb

• Rx "Key State": 00000a0f-0000-1000-8000-00805f9b34fb

• Tx/Rx "Security" (V2 only): 00000a10-0000-1000-8000-00805f9b34fb
  See the pairing section at the top of the issue

• Tx Accelerometer Control: 00000aa0-0000-1000-8000-00805f9b34fb

• Tx "Wake Up": 00000aa1-0000-1000-8000-00805f9b34fb

• Tx Hall Sensor Control: 00000aa2-0000-1000-8000-00805f9b34fb

• Rx Hall Sensor: 00000aa3-0000-1000-8000-00805f9b34fb

• Rx Buttons: 00000aa4-0000-1000-8000-00805f9b34fb
  Value: 0xXX:

  • 00 = Power button pressed
  • 01 = Plus button pressed
  • 02 = Minus button pressed
  • 03 = no button pressed

  If multiple buttons are pressed, the most recent one to be pressed overwrites the prior.

• Tx "Motor Work On Touch": 00000aa4-0000-1000-8000-00805f9b34fb

[blackspherefollower]

Updated the pairing dance with the V2 instructions (see: https://github.com/LELO-Devs/F1S-SDK/blob/master/F1S-V2-SPEC.md#security)