Color Open Source Smartwatch

I know this project looks dead, but that's because the watch is hard to find and I was the only one developing for it.

But there is some renewed interest in the firmware, so join us on Freenode IRC channel #smaq2oss

The work is not complete, but with this update, the firmware has all the most important smart watch features.

I've added call and message notifications. The user interface is rather crude, but they serve their purpose.

I've also secured the connection between watch and phone with maximum BLE security, including pairing with passkey check on both sides.

In terms of power consumption, I have confirmed a 12-day battery life. But that was before message notifications, which might eat up some more energy.

I've redesigned the way screens/apps are handled and introduced a main menu.

More importantly, I have managed to get the average current consumption down to 350-550uA (1.5mA previously)!

Turns out a huge chunk of it - 800uA, was a bug in the TWI (I2C) peripheral. Documented in the errata as Anomaly #89, the peripheral does not actually stop consuming power when disabled. Fortunately there is a simple software fix for it.

Another gain was from a small change in the notoriously power-hungry FreeRTOS implementation for nrf52.

Two weeks might be exaggerated, but based on my previous measurements, I expect at least 9 days of normal operation. To help with monitoring, I've added a battery app that shows a charge history graph.

One grid interval is 12 hours (X) and 20% of charge (Y). In this case the slope shows an expected 3 day lifetime - this is with the previous 1.5mA consumption!

UPDATE:

Looks like the current consumption fixes really did make a difference and are in line with my 9 day lifetime expectation.

The new version of the custom replacement board (2 variants) is out. There's also a basic Arduino firmware with tons of features demonstrating most hardware comonents, drawing about 1000µA in dualMode (BLE central and peripheral active at the same time).

https://github.com/BigCorvus/SMA-Q2_replacement_board_v2

https://github.com/BigCorvus/SMA-Q2-nrf52840-dualMode-firmware

I decided to lay my pebble watch to rest, so now I am motivated to make the SMA-Q2 firmware actually useful.

I have designed a new watchface including current weather form Gadgetbridge. I have also added basic music control support, although the song info is not yet transmitted from the phone. That is because I need to decide on a protocol for transmitting large packets of data.

Along with those updates, I have also improved the current consumption, mostly by redrawing the screen only when it is needed. Consumption now oscillates around 1.5mA which should give about 5 days of battery life.

I can already see I will have to heavily modify the current graphics library (Nrf GFX) or find a better one.

I have uploaded my firmware source:

https://github.com/Emeryth/sma-q2-oss

It's based on nRF5 SDK 11.0 and FreeRTOS.

I have also uploaded my fork of Gadgetbridge that lets you connect to the watch:

https://github.com/Emeryth/Gadgetbridge

For you hardware hackers out there:  there is now a custom replacement board for the SMA-Q2 based on the nrf52840 with a custom purely analog pulse sensor. If you manage to open the watch (it IS possible without breaking anything) it is quite easy to install. You'll have to leave out the plastic frame holding the battery. Firmware updates can be made over USB now...I've only flashed the current Adafruit bootlader right now and the thing shows up as a mass storage device. Not done any programming yet.

https://github.com/BigCorvus/SMA-Q2_replacement_board

https://github.com/BigCorvus/PulseSensor-for-SMA-Q2

Not sure whether this whole RTC-based power management stuff is really necessary since the chip can run on really nice low power modes, but this can also be omitted in future revisions. All basic housekeeping (LDO, charger, buttons, accelerometer, display connectors, vibration motor driver...) is in place and the dimensions are correct.

I have been very slowly working on the project.

I now have a very simple firmware (based on Nordic SDK and FreeRTOS) that showcases all the hardware in the watch, and basic integration with Gadgetbridge (smartphone app).

I'm working on publishing the source now.

The heart rate monitor outputs raw waveforms and it's up to the firmware to analyze them.

There is a binary library from Pixart for that, but because it requires 13kB of RAM I don't want to use it.

With simple filtering and FFT I've managed to get a pretty good result, compared to a chest strap sensor.

Unfortunately the slightest movement disturbs the PPG reading, so it may never be useful for fitness tracking.

The accelerometer has built-in tilt and tap detection that works great. It's interesting that the original firmware did not use them at all.

I haven't ported DOOM yet, but have a Tetris clone by my friend [msgctl]:

A few months after release, the watch has received a slight silent mechanical redesign.

Most noticeably, the buttons are now oval instead of round (and feel nicer).

Unfortunately for the hardware hackers, the screws on the back that held the watch together are now GONE!

I don't see any seams on the back, I'm afraid the watch is now glued together and has to be disassembled from the LCD "glass" side.

I'm pretty sure the electronics remain the same, because there is no mention of different watch versions when downloading firmware.

Still, the watch remains entirely hackable without disassembling.

You can upload your own firmware through OTG, you just have to be more careful.

If you soft brick it somehow, you will have to wait for the battery to die to let you reset and go into the bootloader again.

The MCU on board is locked, which means you can't do anything over the debug interface unless you do a total chip erase.

I wanted to dump the internal flash to get the bootloader and perhaps some other interesting stuff.

Since I already have the ability to upload my own firmware, dumping the flash over UART seemed straightforward, but turned out to be not so simple.

For some reason I just could not receive the full dump without interruption.

At first, I blamed the notoriously flaky NRF52 UART when used without flow control. But even when I added flow control by using the SPI flash testpoints, it wouldn't work.

Many hacks later I realized it's the MCU that's resetting periodically.

Turns out the bootloader is enabling the watchdog!

With a reload value of 0x50000 it gives you exactly 10 seconds.

Once I fed it properly (via the RR0 register), I could get the full dump.

The flash layout is standard - Softdevice, followed by user firmware, followed by the OTA bootloader at 0x76000.

There is a tiny bit of data between the firmware and bootloader, that may be the persistent app data partition.

The UICR registers are also unused, except for the bootloader addres and bootloader data page.

NRFFW[0]:00076000
NRFFW[1]:0007E000