Decathlon Kalenji OnMove

OnMove is the brand name of a family of GPS watches by Decathlon Kalenji.

Inspired by Renaud Schleck's work on a previous iteration of the watch, I'm taking apart an OnMove 500, documenting my hardware and software related findings here. Eventually I wrote my own firmware (see below).

Hardware components

• Freescale MKL26Z256VLH4 microcontroller. Debugging available via SWD.
• Macronix MX25L1606EZNI-12G NOR flash (capacity: 2 MB). Stores settings and presumably workout data. Connected via SPI.
• Dialog DA14680. Presumably used to talk to the external heart rate monitor.
• Unknown LCD. Connected via I2C.

See onmove500-pcb-back-annotated.png for some interesting test point locations.

Display

There's a sigrok dump of what seems to be the display's initialization sequence.

Vendor firmware

• There's a bootloader at offset 0x0.
• The application firmware (firm500.frm) is put at offset 0x8000 in the MCU's flash.
• The watch presents as a mass storage device on the USB. To update the firmware, copy firm500.frm to USB and press the backlight button to initiate the flashing.
• The application firmware is "protected" with an 8 bit XOR checksum stored in its final byte. The bootloader(?) refuses to perform an update if that checksum does not match.

My custom firmware

I have written my own firmware for these watches. It only offers very basic functionality, but it works reliably and can be installed on OnMove 220 and OnMove 500 without opening the watches. The sources are available in git.