Close
0%
0%

Color Open Source Smartwatch

Reverse engineering the SMA-Q2 smartwatch to run open source firmware on it

Similar projects worth following
SMA-Q2 also known as SMA TIME is a Chinese smartwatch featuring a color Memory LCD, heart rate sensor and a NRF52832 Bluetooth SoC to drive it all.

Its low price, cool features and simple construction make it look like a prefect platform for an open source smartwatch firmware.

Firmware

Original firmware

The original firmware runs on S132 SoftDevice ver 2.0.1.

The device contains an OTA bootloader that can be used with the generic Nordic upload tool, so new firmware can be uploaded safely.

Custom firmware

The chip is locked, so if you want to use your own firmware you have to use the built-in OTA bootloader or erase the whole chip to remove the lock.

Hardware

Hardware Components

NRF52832-QFAAB0
Main SoC
LP2985 (?)      
 3.3V LDO for everything
LP2985 (?)
3.3V LDO for heart rate sensor module
RT9526 (?)
Battery charger
KX022-10203-Axis accelerometer
PAH8002Heart rate sensor
GD25Q16C16Mbit SPI flash
LPM013M126A176×176 Japan Display Color memory LCD   

Main MCU

Nordic Semiconductor NRF52832.
32-bit ARM Cortex-M4F CPU with 512kB flash and 64kB RAM and of course Bluetooth.

MCU pinout:

Pin

Description

P0.02

LCD SCLK

P0.03

LCD SI

P0.05

LCD SCS

P0.06

LCD EXTCOMIN

P0.07

LCD DISP



P0.04

Battery voltage measurement (x0.25 divider)



P0.08

BACKLIGHT ON



P0.09

BUTTON BACK

P0.27

BUTTON UP

P0.28

BUTTON OK

P0.29

BUTTON DOWN



P0.11

FLASH MISO

P0.12

FLASH CS

P0.13

FLASH MOSI

P0.14

FLASH CLK



P0.25

UART RX

P0.26

UART TX



P0.30

VIBRATOR ON



P0.15

ACCEL INT ?

P0.16

ACCEL POWER

P0.17

ACCEL SDA

P0.18

ACCEL SCL



P0.19

HRM SDA

P0.20

HRM SCL

P0.22

HRM INT ?

P0.10

HRM RESET ?

P0.31

HRM POWER ON



P0.23 CHARGER STATUS ?
P0.24 CHARGER POWER GOOD ?

3.3V LDO for system

Unknown chip, but similar to LP2985. Powers the whole thing

3.3V LDO for heart rate sensor module

Same as above. Powers the PAH8002 heart rate sensor module.
Enable pin controlled by the MCU.

Battery charger

Unknown chip, seems like a generic linear li-ion battery charger IC.

Possibly a Richtek RT9526, the pinout seems to match.

Accelerometer

Kionix KX022-1020 3-axis accelerometer.
Communication over I2C. Powered from an MCU pin!

Heart rate sensor

PAH8002 heart rate sensor with green and infrared LEDs. Mounted on the back plate of the watch, connects to the mainboard with a ribbon cable.
Communicates over I2C.
I have managed to dig up the complete datasheet and application note.

External Flash

GigaDevices GD25Q16C 16Mbit (2MB) SPI Flash.

LCD

LPM013M126A 176×176 Japan Display Color memory LCD.

Driven with SPI. Has a LED backlight controlled...

Read more »

SMA_Q2_HRM2.txt

I2C bus sniff after starting the HRM function. Finger on sensor. Stopping measurement at the end.

plain - 155.80 kB - 01/09/2019 at 11:23

Download

SMA_Q2_HRM.txt

I2C bus sniff after starting the HRM function. Finger not on sensor.

plain - 77.04 kB - 01/09/2019 at 11:19

Download

plain - 48.67 kB - 01/01/2019 at 15:00

Download

  • A bit of bad news

    emeryth04/08/2018 at 15:48 2 comments

    A few months after release, the watch has received a slight silent mechanical redesign.

    Most noticeably, the buttons are now oval instead of round (and feel nicer).

    Unfortunately for the hardware hackers, the screws on the back that held the watch together are now GONE!

    Left: old watch, right: current version

    I don't see any seams on the back, I'm afraid the watch is now glued together and has to be disassembled from the LCD "glass" side.

    I'm pretty sure the electronics remain the same, because there is no mention of different watch versions when downloading firmware.

    Still, the watch remains entirely hackable without disassembling.

    You can upload your own firmware through OTG, you just have to be more careful.

    If you soft brick it somehow, you will have to wait for the battery to die to let you reset and go into the bootloader again.

  • Dumping the internal flash

    emeryth03/19/2018 at 18:34 0 comments

    The MCU on board is locked, which means you can't do anything over the debug interface unless you do a total chip erase.

    I wanted to dump the internal flash to get the bootloader and perhaps some other interesting stuff.

    Since I already have the ability to upload my own firmware, dumping the flash over UART seemed straightforward, but turned out to be not so simple.

    For some reason I just could not receive the full dump without interruption.

    At first, I blamed the notoriously flaky NRF52 UART when used without flow control. But even when I added flow control by using the SPI flash testpoints, it wouldn't work.

    Many hacks later I realized it's the MCU that's resetting periodically.

    Turns out the bootloader is enabling the watchdog!

    With a reload value of 0x50000 it gives you exactly 10 seconds.

    Once I fed it properly (via the RR0 register), I could get the full dump.



    The flash layout is standard - Softdevice, followed by user firmware, followed by the OTA bootloader at 0x76000.

    There is a tiny bit of data between the firmware and bootloader, that may be the persistent app data partition.

    The UICR registers are also unused, except for the bootloader addres and bootloader data page.

    NRFFW[0]:00076000
    NRFFW[1]:0007E000

  • Dumping the external flash

    emeryth03/13/2018 at 19:14 1 comment

    Yesterday I dumped the external flash. You can find the image in the owncloud archive.
    Turns out most of it is used to store an almost complete 16-bit Unicode font.

    I figured that out by converting the binary to an image and looking for repeating or familiar patterns.
    A good tool for that is ImageMagick.

    With the following command:

    convert -depth 1 -size 16x2048 gray:flash_dump.bin flash.png 

    you can turn the binary into binary (heh) images.

    Using a width of 16 pixels reveals that most of the space is taken by a font.

    But you can see that some of the characters are messed up. It's not a problem with the dump or some offset, the problems clearly happen on smaller characters, so the font must not be of fixed 16x16 size. We cannot decode the glyphs without knowing their width!

    In memory, the glyphs follow a rather large area with some other data, it must be some kind data structure for the font, perhaps with info about the width of every character.

    0000:2000 | 55 46 4C 11  54 F0 12 00  01 10 FF 3F  62 77 00 00 | UFL.Tð....ÿ?bw..
    0000:2010 | 20 00 E6 FF  18 00 00 00  34 FF 03 10  44 FF 03 10 |  .æÿ....4ÿ..Dÿ..
    0000:2020 | 54 FF 03 18  64 FF 03 24  84 FF 03 24  A4 FF 03 38 | Tÿ..dÿ.$.ÿ.$¤ÿ.8

    The data starts with a magic header "UFL", unfortunately, even with that, I was unable to find any info about this font format.

    So I had to dig deeper.



    The strings in the original watch firmware refer to something called 'arialuni_U16.bin'.
    That turns out to be a font file with unicode characters used by a Chinese modification for GRUB4DOS.
    When I downloaded the file from Google Code it turned out to be of the same binary format! (not identical though)

    Lots of searching and translating later I have found what seems to be a blog of the author of a Chinese font creation tool called FontMaker that seems to be the source of the format.

    There I found a simple explanation (that google translates amazingly well) of the format:

    http://blog.sina.com.cn/s/blog_5d8cc6410100dkko.html

    C. Unicode
    
    00000000h: 55 46 4C 10 28 AB 07 00 01 10 81 00 00 00 00 00
    00000010h: 20 00 FF FF 18 00 00 00 98 FF 03 10 A8 FF 03 10
    ...
    0003ff90h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0003ffa0h: 00 00 00 00 00 00 00 00 00 00 40 40 40 40 40 40
    0003ffb0h: 40 40 00 40 40 00 00 00 00 48 48 48 48 00 00
    ...
    
    
    Analyze as follows:
    1). File header (first 16 Byte)
    
    55 46 4C 10 -- Marker to determine if it is a valid font file.
    55 = 'U', indicates that the file is a font file in unicode encoding format.
    46 = 'F', 4C = 'L'
    10 indicates that the font file version information is: Version 1.0
    28 AB 07 00 -- Total file length
    01 -- contains several Sections. 1- 1 Section (without CJK, it is divided into 3 Sections)
    10 -- font height 0x10 == 16
    81 00 -- The selected character set flag. 1-ID selection, 0-ID not selected. Therefore, the current selection is: Japanese + Western European character set.
    00 00 00 00 -- reserved bytes
    
    2). Segment information (n section * sizeof(FL_SECTION_INF) = 1 * 8 = 8))
    20 00 -- First character
    FF FF -- Last character
    18 00 00 00 -- OffAddr;
    
    3). Search table ((Section[0].Last - Section[0].First + 1) * 4 + (Section[n-1].Last - Section[n-1].First + 1) * 4)
    Each 4 bytes represents one character of search information, starting with the character Section[0].First. So the character 0x20 search information (start address =
    (character unicode code - Section[x].First) × 4 + Section[x].OffAddr, x is the current section character in the section index value, can be judged. ): 98 FF 03 10
    That is, a 32-bit number is obtained: 0x1003FF98 (hexadecimal) --- (00010000 00000011 11111111 10011000).
    The high 6 indicates the width of the current character. Therefore, we get 000100 -- 4 (font size is 4)
    The lower 26 bits indicate the offset address of the dot matrix information of the current character. Therefore, we get 0000000011 11111111 10011000 -- 0x3FF98 (starting address of dot matrix information is 0x3FF98)
    ...
    Read more »

View all 3 project logs

Enjoy this project?

Share

Discussions

Jacob MacLeod wrote 10/01/2019 at 08:54 point

How expensive is this to make?

  Are you sure? yes | no

James Hall wrote 09/26/2019 at 16:38 point

Have you heard about the PineTime watch? Sounds interesting: https://wiki.pine64.org/index.php/PineTime

  Are you sure? yes | no

emeryth wrote 09/28/2019 at 07:50 point

Yes, I hope this will lead to more interest in some kind of open smartwatch ecosystem.

I still think the SMA-Q2 has superior hardware :P

  Are you sure? yes | no

arthur_jordan05 wrote 09/23/2019 at 14:22 point

some interesting discussion about coding for for the SMA-Q2 using the Arduino IDE has been going on under this video lately:

https://www.youtube.com/watch?v=3gjmEdEDJ5A&t=825s

https://www.forward.com.au/pfod/BLE/LowPower/index.html is a low power mod for the sandeepmistry core which implements some slightly weird but also convenient stuff. I've written a custom SMA-Q2 firmware based on this core now. Power consumption is quite nice. (45µA with display on and 500ms advertising interval, with some thin current spikes in between). Code will be published as soon as it has matured a little.

  Are you sure? yes | no

emeryth wrote 09/23/2019 at 21:13 point

Thanks for the info. I know this project looks dead, but I *am* working on it slowly.
Recently I got very close to getting the heart rate sensor to work.

I have also had success with adding very basic support for my firmware to Gadgetbridge, which is an android app for managing smart watches.

  Are you sure? yes | no

de∫hipu wrote 09/23/2019 at 21:28 point

That's great news to hear! A project log once in a while couldn't hurt, even if it was just a photo of your testing rig, or a short "now working on this". Just saying.

  Are you sure? yes | no

arthur_jordan05 wrote 09/26/2019 at 14:16 point

Great! I assume you're still using the Nordic SDK? Which IDE are you using? Ireally like Segger embedded Studio that is easy to use withe more recent versions of the SDK, but I havent't managed to make it work with the SDK 11.0

Aaron Christophel was able to find a precompiled algorithm library for the PAH8002 by the manufacturer so they seem to be around somewhere...are you using that in your implementation too? I heard that otherwise these sensors are hard to get useful data from the wrist area....

Btw. the first revision of my nrf52840 replacement board seems to have bugs on it and is not working properly. Was able to upload the bootloadervia SWD and it even showed up as a USB device once but now I can't upload anything anymore. Dammit. I have to overcome my laziness and finally publish the current design.

  Are you sure? yes | no

emeryth wrote 09/28/2019 at 08:03 point

Yes, I'm using Nordic SDK. As for IDE I'm using regular eclipse with gnu arm eclipse plugins for debugging over openocd.

I just got PAH8002 to work using that precompiled library. I get reasonable readings now.

The drawbacks are that it's not open obviously, and it needs 13kB of RAM to run.

But looking at the raw waveforms from the sensor, it really needs some serious DSP.


I hope to publish my basic firmware soon.

  Are you sure? yes | no

arthur_jordan05 wrote 09/28/2019 at 09:03 point

Awesome! Really looking forward to having a look

  Are you sure? yes | no

arthur_jordan05 wrote 03/04/2019 at 13:36 point

Currently designing a custom replacement board with an nrf52840 module somewhat based on the feather board. It will also feature a https://abracon.com/realtimeclock/AB-RTCMC-32.768kHz-IBO5-S3.pdf RTC which is supposed to make programming easier. It will take care of generating the extcomin signal and minute-wise updates of the display. In between the updates the MCU can be turned off completely which will lead to very low  overall power consumption of the watch. That way one can just write Sketches for the nrf52840 without having to engineer low power stuff, so one should have a reliable device capable for everyday use. The final design is supposed to have native USB for DFU und other communication via the charging cable which has a USB plug connected to the  four contacts anyway. The accelerometer will be a BMA400 and the heart rate sensor based on https://pulsesensor.com sitting on a custom flex PCB connected to an analog input.

  Are you sure? yes | no

Kian wrote 01/20/2019 at 13:59 point

Hi everyone, I just got one of this watch and I am trying to see how I can program this. Has anyone manage to program this using OTA.

I have some experience in writing programs for the nrf52832 and can compile and upload programs onto the nordic development boards for testing. I am however clueless on how I can actually upload some program onto the watch using OTA.

Which SDK version do I need to use? I am using Keil. So I just compile my program as what I use to do and generate the Hex file. I am able to put the watch to OTA mode, and I have transferred the hex file to my mobile phone running the nRF toolbox app. I start the DFU program on my phone and I selected the hex file as an application. Then I got this message:

**********************

Init packet

Do you want to select the init packet file?

The init packet file (*.dat) should contain the device type and revision, application version, list of supported Soft Device and firmware CRC in binary format.....

*********************

I don't know what to do and where to find this file. So I just clicked Yes, and select the same hex file again.  I then select the device, in this case the phone see  the device "Dfu10B10". I selected this and click on UPLOAD.

Then the app just stays at Uploading..... Starting DFU....and nothing happens. 

Now the watch is forever stucked in the OTA mode.

  Are you sure? yes | no

emeryth wrote 01/21/2019 at 19:12 point

You have to use SDK 11.0 to be compatible with the old softdevice that is on the watch.

To generate the update package I use an old version of nrfutil with the following command:

nrfutil dfu genpkg --application application.hex --application-version 0xffffffff --dev-revision 0xffff --dev-type 0xffff --sd-req 136 app_dfu_package.zip

See the original firmware package for reference what it should contain.

  Are you sure? yes | no

Francisco wrote 12/21/2018 at 06:16 point

Hello, accelerometer is working with micooke library:

https://github.com/micooke/arduino-nRF5-smartwatches/tree/master/libraries

Just change the Wire interface in variant.h:

#define PIN_WIRE_SDA         (17u)
#define PIN_WIRE_SCL         (18u)

 Best,

Francisco

  Are you sure? yes | no

fabianpie wrote 12/28/2018 at 19:58 point

Gracias Francisco !!!

By the way, did you find a library for heart rate sensor ?

Best,

Fabian

  Are you sure? yes | no

Francisco wrote 12/28/2018 at 20:13 point

No I didn't.

I was trying to port one that I found from mbed, but inside the code It calls to a file with an algorithm from the company that built the chip. And that files seems that is not on the web.

Best,

Francisco 

  Are you sure? yes | no

fabianpie wrote 02/17/2019 at 06:53 point

Hi, anybody implemented a step counter with this accelerometer or have any reference code ?

Thanks,

Fabian

  Are you sure? yes | no

fabianpie wrote 07/14/2019 at 05:14 point

Hi Francisco,

Have you developed anything for the heart rate sensor this year ?

Best,

Fabian

  Are you sure? yes | no

arthur_jordan05 wrote 09/23/2018 at 12:22 point

Display library is online now. https://github.com/BigCorvus/ColorMemLCD

The example also explains how to feed the watchdog.

The RTC library is here: https://github.com/arduino-org/arduino-core-nrf52/tree/master/libraries/RTC. If you use the Adafruit core 0.8.5. only the line #include "nrf_clock.h" has to be commented out and the library works.

Having trouble getting the accelerometer to work. Tried several libraries without success. 

  Are you sure? yes | no

fabianpie wrote 09/27/2018 at 04:25 point

Hi, I'm waiting for my samples to contribute. By the way have you tried this library https://os.mbed.com/teams/Rohm/code/KX022/ ?

  Are you sure? yes | no

arthur_jordan05 wrote 09/28/2018 at 09:31 point

Haven't tried ports of the mbed lib you mentioned yet, but several other Arduino libraries instead.  (https://github.com/micooke/Kx022-1020, https://github.com/jgromes/RohmMultiSensor, https://github.com/goran-mahovlic/nRF51_ID107_libs) When I have some spare time left I'll hook up a logic analyzer and check the activity on the bus...

The power and reset management has to be done by the application itself: Created an example now: https://github.com/BigCorvus/SMA-Q2-Arduino

  Are you sure? yes | no

fabianpie wrote 10/10/2018 at 06:19 point

Still waiting for my samples :) There was a delay at Spain customs because of the batteries ... Any news about the accelerometer and or heart rate ? I hope to get my samples soon in order to contribute with the project.

  Are you sure? yes | no

arthur_jordan05 wrote 10/13/2018 at 08:08 point

unfortunately not. Lots of worki worki. But I've started coding the library for the heart rate sensor. Ordered another device so there is one for development and power consumption measurement and one for actual usage ^^

  Are you sure? yes | no

fabianpie wrote 11/10/2018 at 04:17 point

Hi, Arthur. I'm receiving my SMA-Q2 on Monday, if you have any work of accelerometer and/or heart rate please share in github or any place to collaborate in the development.

Thanks,

  Are you sure? yes | no

arthur_jordan05 wrote 11/13/2018 at 08:10 point

Hi Fabian

unfortunately, my time for the hobby is virtually non-existent at the moment, but my first steps in writing the PAH8002 library are here: https://github.com/BigCorvus/PAH8002/blob/master/README.md 

This is just a starter and the code is not working yet. It has to be brought into shape with adaptation of the I2c write/read functions etc.. Feel free to contribute ;) If I advance, I'll update the repository.

  Are you sure? yes | no

fabianpie wrote 11/25/2018 at 04:47 point

Hi Arthur,

I received my SMA-Q2. I compiled https://github.com/BigCorvus/SMA-Q2-Arduino with AdaFruit 0.9.1 to avoid nrf_clock.h error and exported binary and then create de zip with nrfutil-0.5.2 of AdaFruit 0.8.5. I used NRF tools selecting the zip and when I have to select ALL, SYSTEM or APP I selected APP. The firmware was uploaded the progress bar in OTA of SMA-Q2 reach the end  but the application never started. Any idea ? Do you think the problem could have been to use 0.9.1 core instead 0.8.5 I have other SMA-Q2 but I want to recover this one I hope with having to disassembly the watch. Please give me any advice.

Thanks ,

Fabian

  Are you sure? yes | no

arthur_jordan05 wrote 11/25/2018 at 12:25 point

I think you should compile this firmware only with the core it was written for (0.8.5 in tihis case). Throughout the core updates the Adafruit folks might have implemented changes that are not compatible to the sketch. 

We do not necessarily need the newest core here since we have an old softdevice at our disposal. The potential do implement fancy stuff via the low level API is still there with the 0.8.5 core I think. You just have to study the examples of the "raw" nordic SDK und port the functions you need to Arduino. This is how I implemented the watchdog feeder for example. 

If the DFU screen is persisting, the error might as well be in the pin definition file for the display pins. Have you re-defined the SPI pins in the variant.h file? If the code is not running properly the watchdog might not get fed. Try holding down the OTA DFU button combo for at least 10s. Maybe the thing will reset and get into DFU mode. Otherwise try the back button for some seconds and then the up button to turn back on in case the actual code IS running without the display being driven properly.

Good luck!

  Are you sure? yes | no

fabianpie wrote 11/25/2018 at 17:30 point

Hi Arthur, I confirm your examples only work with Adafruit core 0.8.5. Now I have a working environment. Thanks !!!!

By the way I'll start with the accelerometer could you share your work to move forward from there ? 

  Are you sure? yes | no

arthur_jordan05 wrote 11/25/2018 at 19:15 point

well done! I'm curious what you will come up with. Unfortunately I didn't keep the code I for the accelerometer, mainly because it didn't work at all and because it was too simple (it would have produced a non-working primer sketch and nobody wants that!).

There are several Arduino libs for the KX022-1020. Just try them, most of them are easy to use. Don't forget to set the I2C pins in the variant.h file. I hope that you do better than I did. I just don't have the time to advance this topic right now, although I would love to.

  Are you sure? yes | no

fabianpie wrote 12/19/2018 at 15:57 point

Hi Arthur, I was trying to connect the accelerometer. The chip is there as it answers to the address but it doesn't. Did you have time to check the bus with a logic analyzer with the manufacturer firmware ? I don't have one ...  If you could get of the information exchange I could dig in the documentation and create a library.

It would be also great to have a dump for the pulse rate chip.

I hope you have a bit of time.

Best,

Fabian

  Are you sure? yes | no

Francisco wrote 12/21/2018 at 08:31 point

Hello Fabian,

I´m using the library from micooke:

https://github.com/micooke/arduino-nRF5-smartwatches/tree/master/libraries

Just change the Wire interface in variant.h:

#define PIN_WIRE_SDA         (17u)
#define PIN_WIRE_SCL         (18u)

 Best,

Francisco

  Are you sure? yes | no

arthur_jordan05 wrote 01/01/2019 at 15:06 point

Happy new year!

I hooked up a logic analyzer to the accelerometer bus and recorded the activity upon power-up:

https://cdn.hackaday.io/files/854633656448992/accelQ2.txt

Still need to make sense of the data. 

Did you actually get useful data from micooke's library Francisco? I wasn't able to get the library to work. Thanks for joining us.

Best, Arthur.

  Are you sure? yes | no

fabianpie wrote 01/01/2019 at 18:15 point

Hi Arthur. Happy new year !!

For micooke's library try changing in variant.h  #define PIN_LED1 (17) to other pin. If I read in every loop and show the values in the display I'm having problems to show the values so I'm using something like: 

if (millis() - accSampleTimer > 20) { // 20ms = 50Hz 
    accSampleTimer = millis();
    acc.getAccelXYZ(xyz);

}

Best,

  Are you sure? yes | no

fabianpie wrote 01/01/2019 at 18:25 point

By the way if anybody can capture any data from heart rate please share the code. I'm trying to contact the manufacturer to get the algorithm if not i'll try to analyze the data to try to define the pattern to calculate the heart rate.

Thanks,

  Are you sure? yes | no

arthur_jordan05 wrote 01/06/2019 at 15:04 point

aaah OK, I didn't notice that pin 17 was already taken by the LED. Thank you! I'll try to capture the I2C communication on the heart rate sensor lines and upload the file. 

I don't think we necessarily need this algorithm. Most important ting is to interface to to the sensor, get the data and figure out how to get into low power modes etc. If we get the photoplethysmography data there sure will be some open source algorithm we can apply to get heart rate...or we just write our own.

What I find interesting is the power consumption of the original firmware. I measured it with a Current Ranger and during non-connected normal operation, displaying the time and advertising itself the device draws about 200µA with short 3ma spikes during TX. It should be a challenge to get power consumption down to this level, but theoretically possible. 

What I also noticed on the original firmware is that timekeeping is not very accurate. My device has a deviation of about 2 minutes/month. Already thought about hiding a tiny I2C real time clock somwhere inside the enclosure. 

  Are you sure? yes | no

arthur_jordan05 wrote 01/09/2019 at 11:25 point

Hi everybody,

data from the heart rate sensor is online now. I sniffed the bus with finger on sensor and without.

We have to get a second i2c bus working correctly with the bus in order to use both devices.

  Are you sure? yes | no

arthur_jordan05 wrote 09/11/2018 at 09:24 point

How cool is that. You can program this thing via the Arduino IDE easily by installing the Adafruit nrf52 core, which also contains an older version of the nrfutil (0.5.2 in the case of core version 0.8.5). With the following nrfutil commands you can generate the .zip files for OTA DFU from .hex files the Arduino IDE produces if you go to "Sketch->Export compiled binary"  (I'm working under windows):

C:\Users\[.....]\AppData\Local\Arduino15\packages\adafruit\hardware\nrf52\0.8.5\tools\nrfutil-0.5.2\binaries\win32\nrfutil dfu genpkg --application C:\Users\[.....]\Documents\Arduino\SMAQ2_test\SMAQ2_test.ino.feather52.hex --sd-req 0x88 C:\Users\[.....]\Documents\Arduino\SMAQ2_test\vibrotest1.zip

The --sd-req 0x88 stands for s132 2.0.1 on nRF52

You enter the DFU mode of the watch by pressing the "back" as well as the "up" and "down" buttons simultaneously (a little acrobatic) when the watch powered off. Alternatively press this button combo and reset the thing (by pulling the rst testpad (P0.21) to ground) or power-cycling it. 

Once in DFU mode the .zip file can be fed into the DFU tool of the "nRF Toolbox" Android app to program the device over the air.

I hope this helps somebody to get started quickly.

  Are you sure? yes | no

arthur_jordan05 wrote 09/08/2018 at 15:06 point

i received a newer SMA-Q2 instead of the older one. If you're patient you can open it from the upper side as you said, f.e. using a "sesamo opening tool". The problem is  that you'd have to glue it back together with some elastical glue with sealing properties which is annoying. The circuit board has a blue solder mask but is otherwise identical. I'm planning to include a tiny reed switch for reset purposes after which the thing will be glued together again.

Which platform do you use to program yours? Did you roll your own display library or is there one around which is wasy to modify (for example for sharp memory displays).

Thanks for sharing the fruits of your effort here. 

  Are you sure? yes | no

emeryth wrote 09/11/2018 at 20:54 point

Great! Thanks for the info.

Even though I have a few spare watches, I couldn't get myself to wreck one.

As for the platform, I'm just using Nordic SDK 11.0 (for compatibility with the old softdevice already on the watch) and GCC.

The LCD is pretty simple to use, you basically just send pixel values over SPI. I think it is a clone of the sharp displays, so you can reference existing libraries.

  Are you sure? yes | no

arthur_jordan05 wrote 09/19/2018 at 18:17 point

Ok I have a working Arduino library for the display (ported from mbed) which uses the Adafruit GFX library and a working real time clock library based on the real time counter. Originally the latter was included in the "official" Arduino nrf52 core and worked almost out of the box with the Adafruit core. I already have a crude sketch that ties stuff together and demonstrates some fundamental functions too... Will publish everything on Github soon. Now it's time for the PAH8002. Unfortunately I've lost the programming application note and the files on Nextcloud are gone...any chance to get them back online? 

This hack has a lot of potential, What's quite cool about this OTA concept is that you can carry several different firmwares with you on the phone and just upload them on the fly if you need a certain functionality. The low power consumption of the nrf52832 is remarkable too. 

  Are you sure? yes | no

emeryth wrote 09/19/2018 at 18:26 point

Sorry, we are having a rough transition to NextCloud, try this link for now:

https://owncloud.hackerspace.pl/index.php/s/fR7jom478oSoE8p

  Are you sure? yes | no

ddavidmelo wrote 03/14/2018 at 21:53 point

I have this watch and I think with a good firmware can be better than pebble. Keep going with this work, I would love to see the something cool in the end.

  Are you sure? yes | no

Similar Projects

Does this project spark your interest?

Become a member to follow this project and never miss any updates