Thread by @travisgoodspeed

Howdy y'all! In this friendly little tweety-box thread, I'd like to share my new project with you. It's called the GoodWatch, and it will be next month at Shmoocon. 1/n

I began by measuring the pinouts of the LCD and keypad of the Casio 3208 watch module, shown on the right, and cloning them into my own GoodWatch10 PCB on the left. The sticky notes let me distinguish COMMON from SEGMENT pins in the LCD, so that my wiring would be correct. 2/n

The CC430F6137 that I chose can't quite control all of the pixels, but with three commons and all available segment pins, I was able to get everything except for the day-of-week pixels in the upper right corner. 3/n

In idle mode, the GoodWatch10 (shown on the left) can easily implement all features of the original Casio. It has ~5 years of battery life, knows days of the week for the next two thousand years, and has a handy RPN calculator. 4/n

It also has a hex editor, because no proper lady or gentleman would be caught in public without one on the wrist. Here the hex editor is diagnosing a clock fault by reading the appropriate register. (Now there's a test case for that, of course.) 5/n

"But Travis," you say, "What about a disassembler? What if you're stuck in an hour-long SCRUM meeting and need to reverse engineer your watch's firmware with pen and paper to retain your own sanity?"

An MSP430 disassembler is built-in, of course. 6/n

And while the GoodWatch10 was certainly the coolest hex editor watch to wear last month, things can be niftier. In this photo, it a GoodWatch20 is beaconing my #hamradio callsign to a Yaesu 817 as Morse code. 7/n

This tiny green wire--the only cosmetic blemish of the watch--uses the stainless steel watchband as a random wire antenna. It's not well tuned, but it gets the job done. 8/n

The firmware also includes a serial debug monitor, so after flashing firmware and a codeplug of radio frequencies, you can self-test the device or send and receive packets from the air. 9/n

The radio is based on the same CC1101 core that the GirlTech IMME used, so all the old IMME hacks are portable. My reflexive jammer for P25, Mike Ossmann's iClicker emulator, and Samy's OpenSesame can all be adapted to this platform. 10/n

You can't leave the receiver idly receiving in the background for power budget reasons, but otherwise the radio is fully functional. Receive and transmit, everything from CW to 4FSK. 11/n

The codeplug is compiled from a textfile and loaded into Info Flash, where it won't be accidentally overwritten by firmware updates. Writing a CHIRP plugin won't be much trouble. 12/n

Firmware for the watch is written in clean C89, designed to compile with GCC on Debian/Stable with no weird third-party packages or commercial compilers. The radio features gracefully disable on watches without a 26MHz crystal. 13/n

Because it can be a pain to debug radio configurations in device firmware, the UART monitor provides easy Python access to all the radio functions. You can mock up a working prototype of your radio application in host-side python, then rather directly port to C. 14/n

GoodWatch source code and CAD will be available early next month. I'll be giving away unpopulated PCBs at Shmoocon, and they fit all Casio 3208 devices, such as the CA-53W and CA-506 calculator watches. They do not fit the older Databank devices. Soldering is QFN and 0201. 15/n

The GoodWatch and other projects were helpfully financed by @skytee, who has been funding my recent sabbatical by paying me one dollar for every day since I last wasted an hour of my life in a daily SCRUM meeting.

Thanks, neighbor! 16/n

Surprisingly, a stainless steel watchband isn't too far out of tune at 70cm. 17/n

As promised, the GoodWatch design is now open. Catch me at Shmoocon for a PCB. 18/n
goodwatch.org/posts/introduc…

The direct Github link is github.com/travisgoodspee… 19/n

My talk on the GoodWatch is today at high noon in the Build It track of Shmoocon. Learn how to clone a calculator watch with custom hardware, software, and a ham radio! 20/n

Those not in DC can stream the talk online in one hour at livestream.com/ShmooConTrack1 21/n

The only downside to this casing is that strangers in bars think I'm insane when I tell them it's my own electronics and software. 22/n

So how do you add a radio protocol to the GoodWatch? Let's start with a cheap OOK remote control in the 433MHz band. 23/n

For OOK, you need to know the center frequency, the symbol duration (or rate), and valid packets. Universal Radio Hacker (URH) makes short work of both measuring these parameters and decoding the keyfob's packets.

At 341µs/bit, e8e8ee88e88ee888eee8888e80 is the A button. 24/n

The bit timing and other fields are configured by a Windows tool called SmartRF, which runs well under Wine. It exports register settings which you can place in your own Python or C code. 25/n

Of course, SmartRF isn't so smart. You'll have to manually chase a few register settings in the datasheet to disable the automatic preamble and checksum that the radio core will helpfully add to your outbound packets. 26/n

At this point, it's tempting to jump straight to C firmware, but it's better to send a test signal from the goodwatch's Python debug monitor, and verify the parameters of that signal. (An RFCat uses the same radio, so it would work just as well.) 27/n

For example, you might have the wrong PKTLEN setting. This sounds a bit short in the air, and you might notice the occasional transmit overflow or underflow, but it's very easy to see--and then fix--in URH. Every packet is a different length and entire bytes are missing! 28/n

After fixing these settings with the short testing time of the Python monitor, they can be wrapped up into an applet for the radio firmware. See firmware/apps/ook.c and ook.h on Github. 29/n

And finally, our happy little watch can switch 12V relays all around the apartment!

See github.com/travisgoodspee… on the wiki for a more thorough explanation than Twitter can hold. 30/n

And what if you need a quick guess at the frequency of a transmitter, but you don't have an SDR or frequency counter handy?

The GoodWatch has a Frequency Counter application, of course! Just tap a button for a rough estimate at the center frequency of the strongest signal. 31/n

I recently bought an NK-Tech NK-M2 radio, but the frequencies weren't listed. My GoodWatch quickly and conveniently found its Channel 1 frequency within 50kHz. #hamradio 32/n

The watch now reliability shows battery voltage. It stays pretty steady unless the radio is activated, then drops like a rock. 33/n

Today I extended the GoodWatch to emulate my Magicfly doorbell. You can now load your own OOK codes into config.h for use in the watch without causing a diff from the master branch. 34/n

This afternoon I cloned another OOK remote, the Eco-Worthy motor controller that drives my truck's HF screwdriver antenna. My watch now drives the antenna tuning!

USRP recordings and a URH project at github.com/travisgoodspee… in case you'd like to play with them.

35/n

Among other minor improvements, the GoodWatch22 moves the antenna pad to the rear side, for easier mounting. It will be the last revision before the GoodWatch30, which drops the bandpass filter for a choice of 70cm or 33cm lowpass filters.

36/n

Power profiling for the GoodWatch has now been built using energytrace-util from the Pluto Watch project and a $15 TI eval kit. By these estimates, we idle at 6 or 7 uA and have far better than a year of CR2016 battery life when the radio is off.

github.com/travisgoodspee…
37/n

Now that we have proper power profiling, I can predict the battery life of any patch with a Makefile target. Current is now down to 3.5µA by *increasing* the CPU clock rate and finishing the interrupt handler faster, so the battery life is up to 38 months on a CR2016 coin cell!

You can see that Port J isn't used for anything, but I left it unconnected instead of grounding it. In CMOS, unconnected inputs can waste power, and setting these to output mode cleared the last of the power mysteries.

The GoodWatch now reliably has three years of life! 39/n

GoodWatch30 boards have arrived, ditching the uncomfortably narrow 433MHz bandpass filter for a 500MHz or 950MHz lowpass filter. Thank @esden for upsizing passives to 0402 and other handy changes to the layout. 40/n

And the GoodWatch30 gets a nifty cameo appearance at #s4x19 this year, where it was used to remote control a crane! 41/n

https://twitter.com/mitt_nya_nym/status/1085247816363061248

And if remote controlling industrial equipment isn't nifty enough for you, the GoodWatch can also receive #POCSAG pages from the #DAPNET network over the 70cm amateur radio band! 42/n