NordicTrack Commercial 1750 Treadmill

My wife has convinced me to purchase on a treadmill. Since I am quite picky when it comes to purchasing anything that contains some kind of technology, so I went into a rabbit hole of researching on the state of modern treadmills. After reading a lot of articles, watching reviews on YouTube, and looking into the issues people are encountering with their treadmills, I chose to go ahead and order NordicTrack Commercial 1750.

What I found in my research is that no matter how much a treadmill costs, it basically consists of the following components:

• A motor (we are only discussing the electric treadmills here). There is a variety of motors used in treadmills, but basically the industry standard seems to be a brushless motor with two to four horse power with more powerful being used on more premium models;

• A deck that supports the user and on top of which the belt is running. Surprisingly, it turned out to be the cheapest and weakest part of even the most premium treadmill models. For example, the $4,000 treadmill such as NordicTrack Commercial 1750 uses an Medium Density Fibreboard (MDF) deck, which is basically compressed paper. For this reason, NordicTrack refuses to provide warranty for outdoor use: MDF absorbs water as a sponge;

• A belt that is the primary working surface of the treadmill. This is where the user is running on. It seems that all existing treadmills settled on a layered vinyl-based belts with some fabric underneath that absorbs lubrication agent. The idea is that the belt is slides on top of the deck, so the lubrication in the fabric layer reduces the friction when there is user’s step that presses the belt against the deck;

• A controller which is the “brain” of the machine. Usually, located next to the motor, it is quite a simple piece of electronics and usually controls the speed of the motor (or motors, if the model supports changing the treadmill inclination);

• And finally, the control interface which allows the user to operate the machine. In low-end models, the interface is usually quite simplistic and consists of segmented LED displays and buttons for changing the speed, inclination, and program selectors. In more premium models, it is usually implemented as a touch screen with the addition of some physical buttons for controlling speed and inclination.

There is a myriad of quality of life options that can be present on a particular model. For example, the rails may have integrated heartbeat sensors or there could be cooling fans installed.

Anyhow, when I was choosing the treadmill, my key criteria were to have more premium materials for the construction of the frame and to have a convenient interface for the user. I also wanted to ensure that I am not purchasing some quite expensive equipment just to be then locked into the manufacturer’s subscription: it seems both NordicTrack and Pelaton are trying their best to hook you up on their respective memberships which are quite costly (around AUD$50 per month).

So, the NordicTrack Commercial 1750 has a touch screen that runs a custom Android build. My initial analysis shows that one can get access to the underlying system by following a procedure known publicly: on a welcome screen tap ten times on a non-interactive background, wait approximately 7 seconds, and tap ten times again. The interface will challenge you with a code to enter the privileged mode. The code can be acquired by visiting https://getresponsecode.com (you may want to download the page locally, in case the person who is hosting that page decides to shut it down – the logic of acquiring the code is implemented as the client Javascript, so you can have a local copy and it will work).

I was able to access the underlying system, so at least I should be able to do stuff other users have successfully achieved already, e.g. there is a nice Wiki on Reddit for maintaining the privileged mode on the device.

It seems that Nordic Unchained was a one off attempt by somebody to “own” their device and the archive does not have a definitive home. I downloaded it from the Reddit Wiki and looked at the installation script. Basically, all it does is: disables the system iFit apps using adb and then installs a bunch of Android Package Kits (APKs) which the author of the script wanted to have on their device (like Chrome, Hulu, etc.). I think, the most important part the script is doing can be summarised as follows:

    :::bash
adb shell pm disable-user --user 0 com.ifit.eru
adb shell pm disable-user --user 0 com.ifit.launcher
adb shell pm disable-user --user 0 com.ifit.standalone
...
adb shell cmd package set-home-activity com.teslacoilsw.launcher/com.teslacoilsw.launcher.NovaLauncher

So, the first three lines disable the system provided iFit apps, then a bunch of APKs (including iFit) are installed as a user. One of the APKs is for the alternative launcher (Nova Launcher in this case) so the last line above is registering that launcher as the default.

So, what’s next? I will most likely start the way Nordic Unchained did it, since my wife is using the treadmill every day and I can’t just disassemble and experiment with the stuff until I am happy with the results.

The ultimate goal is to have my own build of the firmware and to have the full control of the device. I also want to reverse-engineer how the metadata is incorporated in iFit’s training courses: I suspect they just add an additional track (like subtitles track) to their video containers and that track encodes speed and inclination, so when you are following the course the machine adjusts accordingly. If I can figure that out, I would be able to create my own “exercises”, e.g. using OpenStreetMap, etc.

There is a camera in the touch screen device, but at least in my machine it was attached upside down. I am still deciding whether I want to physically rotate it or do it virtually. In any case, it would be nice to have it for video calls while you are exercising :).

I will try to update my blog with the progress on this topic. Stay tuned!