watch out by pasi toska
a short demo on a Timex Datalink 150 wrist watch


Introduction:

The Datalink series of watches from Timex allowed transferring of user data to
the watch. The data that could be transferred to the watch included time and
date, appointments, alarms, anniversaries, phone numbers and todo lists. The
data, entered on a PC, was transferred optically, by using the raster scan of
a CRT monitor with select horizontal lines representing bits to be
transferred. These days active matrix LCDs do not scan, and LCDs would likely
be too slow anyway for this interface. External hardware is thus required to
interface with the watch these days (more on this later).

Starting with the Datalink 150, which was introduced 1995, the watches could
also load something that Timex called wristapps. The wristapps allowed
extending the features of the watch, such as adding a countdown timer or a
stopwatch mode. A small set of wristapps were distributed with the watch, and
additional ones were available for purchase from Timex.

The family of watches were human space flight qualified, and have been worn by
several astronauts and cosmonauts to space.


Datalink 150:

The watch features a customized version of the Motorola MC68HC05
microcontroller. This version has 1.25kB of RAM and a 16 kB ROM. It also has
a 2kB EEPROM, which is used to store most of the data transferred to the
watch. The EEPROM is not memory-mapped, but is connected to the MCU through a
serial line. The clock rate of the CPU has never been reported (and I've been
unable to measure it reliably so far).

The watch display features two 6-digit 9-segment displays, capable of
displaying most letters in addition to numbers, as well as a 40x5 dot matrix
subdivided into 8 5x5 digits. The sound hardware is capable of producing 14
different tones, one at a time of course. The watch also includes the Timex
Indiglo electroluminescent backlight. Unfortunately this cannot be turned on
while sound is playing, so it is not used in the demo.

During 1997-1998, a large part of the wristapp system was reverse engineered.
This included the transfer protocol used to send data to the watch, and the
way the aynchronous event system on the watch worked, as well as many of the
service routines included in the ROM. A lot though remains to be
reverse-engineered. A full ROM dump for example is not publicly available.
Pieces of interest may be dumped on screen and disassembled.

Wristapps are stored in the RAM of the watch, at address 0x0110. There is 806
bytes total reserved for the wristapp and a melody file. With the default
melody, this results in about 760 bytes available for the wristapp. This
estimate is based on a rather empirical evaluation.


Getting the demo to run on your Datalink 150 watch:

The watch isn't modified in any way. However, a suitable device configuration
cannot be generated using the original Datalink transfer software by Timex.
This is because I'm using the EEPROM of the watch to store the text scroller
contents, which would otherwise not fit in the binary. In order to do this, I
upload custom EEPROM data and store non-standard addresses to the EEPROM
content vectors.

You should be, however, able to transfer just the binary using the stock
transfer software. This will result in garbage in the text scroller of the
demo, but it should otherwise work fine. I've provided the .zap file, which
should be compatible with the original software (though I've not tested this).

The preferred way to load the demo is to use the provided bitstream file. For
transferring to the watch, the bitstream needs to be converted to physical
flashes of light in some way. I used a small microcontroller to flash an LED,
while receiving the bitstream over UART. My quick and dirty project can be
found at https://github.com/ahhuhtal/timex_datalink_uploader. There are also
two other ways to flash an LED and a CRT method, all described in
https://github.com/dfries/datalink_ironman. The first method simply connects
an LED to a RS232 port, while the second one uses a microcontroller to flash
the LED. The third method uses an svgalib based CRT flasher.

Notice, that transmitting the provided bitstream will overwrite your EEPROM
contents (appointments, anniversaries, phone numbers, todo lists) and
obviously your wristapp. Time settings, alarm settings and hopefully melody
settings are not overwritten. Since wristapps and melodies share the same
memory area, the melody may get overwritten by the binary if you're using a
particularly large melody file. This can cause the watch to crash. I've only
tested the binary with the default melody.

After transferring the data to the watch, to actually run the demo, use the
mode button on the watch to advance the mode menu past the COMM mode to the
wristapp mode (reads: real wild mode). The demo will start after a short time
out. You can exit the demo using the mode button and return back to time mode.
If you exit the demo during sound playback, and you have not enabled button
sounds in the system settings, you unlock a special feature: the sound
hardware will continue playing the last sound until some other sound
overwrites it. Fixing this bug requires way too much code space, so I've
decided not to fix it.


Miscellaneous points:

I've included bitstreams for both Datalink 150 and Datalink 150s, but I've
only tested this on a Datalink 150. The same holds true for the .zap file. It
includes binaries for both, but only the 150 version is tested. It is likely
that the demo will run on a 150s, since they are almost identical apart from a
few ROM routine addresses.

If you end up crashing your watch, it can be reset by holding all five buttons
pressed for a few seconds. If that doesn't work, removing the battery for a
few minutes will reset the watch. Resetting the watch will erase all of your
data.


Files list:

watchout.mp4 - Video recording of the demo running on my Datalink 150 watch.
               The video and audio were recorded separately, and combined
               together in this file for maximum quality.

watchout.zap - Binary of the demo in .ZAP format, which should be compatible
               with the original Timex Datalink transfer software for Windows. 
               Contains both the Datalink 150 and Datalink 150s versions.

watch150.bin - Raw binary of the Datalink 150 version of the demo. File
               origin is at 0x0110 in watch memory.

watc150s.bin - Raw binary of the Datalink 150s version of the demo. File
               origin is at 0x0110 in watch memory.

watch150.bts - Bitstream of the transfer protocol for transferring the demo
               and supplementary EEPROM contents to a Datalink 150.

watc150s.bts - Bitstream of the transfer protocol for transferring the demo
               and supplementary EEPROM contents to a Datalink 150s.


Resources:

http://www.toebes.com/Datalink/
  Assembler and header files for Datalink 150 and 150s development.
  Annoyingly, the assembler requires that the original Datalink transfer
  software is installed (which doesn't work in Windows XP or later).

https://assets.timex.com/html/data_link_software.html
  Original Timex Datalink software.

https://github.com/dfries/datalink_ironman
  Open source tools for generating transfer data for many Datalink watches.
  Can generate the transfer bitstream to a file. Features also a few methods
  for physical data transfer to watch.

https://github.com/ahhuhtal/timex_datalink_uploader
  My microcontroller project for flashing an LED to physically transmit data
  to the watch. Takes as input the transfer bitstream.

huhta@iki.fi
  Contact me if you have any questions.
