Hardware

Summary

This is tl;dr summary of findings below, you don't need to read the rest.

• 128x32 SSD1306 OLED - SPI2 SCK 5 MOSI 6 RST 4 DC 28 CS 29, has 128x64 memory so needs 0xDA, 0x12 init unlike other 128x32 ones
• PAH8001 HR sensor - TWI0 SCL 7 SDA 8 speed 400kbps, I2C address 0x6b, enable pin 26, i2c bus read hangs if not enabled
• KX023 accelerometer - TWI1 scl 13 sda 14 speed 400kbps, I2C adress 0x1f (whoami register says 0x15 =KX023), INT1 goes to pin 15
• USB plug data pins 22,23 - configured in DFU bootloader as UART RX(23) TX(22) baud rate 38400, unfortunately I got it wrong first time so in espruino/micropython I have it switched so RX=22,TX=23 there
• motor - pin 25
• touch button - pin 30, goes low when touched
• charging power detect - pin 2 as digital or as analog USB power voltage reference (when charging with 5V remember vmul=5/analogRead(D2))
• pin 3 - battery voltage analog (vmul*analogRead(D3))

After taking DS-D6 apart I searched for unused pins and found some of them, see photo here. The area with pins 17,18,19,20 look like unpopulated SPI flash memory or spi font chip (GT24L24A2Y pinout matches this perfectly). Pins 09 and 10 are NFC pins and I noticed there is some leakage between them. When one of them is left floating an the other one has pull up or down, the other one follows. This is documented here - "The pins dedicated to the NFC antenna function will have some limitation when the pins are configured for normal GPIO operation. The pin capacitance will be higher on those, and some increased leakage current between the two pins is to be expected if they are used in GPIO mode, and are driven to different logical values."

Pin No.	Description
02	analog input, charging voltage
03	analog input, battery voltage
04	OLED Reset
05	OLED SPI clock
06	OLED MOSI
07	HR sensor I2C clock- scl
08	HR I2C data - sda
09	NFC pin, unused, floating, available on board
10	NFC pin, unused, floating, available on board
11	unknown, stays down even with input_pullup
12	unknown, stays down even with input_pullup
13	KX023 I2C clock - scl
14	KX023 I2C data - sda
15	KX023 interrupt pin
16	unknown, with no pull goes up, input_pulldown goes down
17	with no pull goes slowly up, input_pulldown goes down, available on board, unpopulated (CS of GT24L24A2Y?)
18	with no pull goes slowly up, input_pulldown goes down, available on board, unpopulated (SCLK of GT24L24A2Y?)
19	with no pull goes up, input_pulldown goes down, available on board, unpopulated (MISO of GT24L24A2Y?)
20	with no pull goes down, available on board, unpopulated (MOSI of GT24L24A2Y?)
21	NRF52832 RESET, under OLED, can be configured as normal GPIO
22	USB connector, configured in Desay DFU bootlader as serial TX, Espruino/Micropython RX by mistake see photo
23	USB connector, configured in Desay DFU bootlader as serial RX - Espruino/Micropython TX by mistake
24	unknown, with no pull goes down
25	motor
26	HR sensor enable
27	unknown, left floating (input_pullup/down changes, with no pull keeps previous state)
28	OLED DC - data/command
29	OLED CS - chip select
30	touch button, active low
31	unknown, with no pull goes down

Firmware source code strings

strings dsd6-flash.bin | grep -i '\.c' | sort | uniq

..\components\ble\device_manager\device_manager_peripheral.c
..\components\libraries\simple_timer\app_simple_timer.c
..\components\libraries\timer\app_timer.c
..\components\softdevice\common\softdevice_handler\softdevice_handler.c
..\source\HeartRate\HeartRate_PAH8001.c
..\source\src\ds_clock.c
..\source\src\ds_hisdata.c
..\source\src\ds_power.c
..\source\src\ds_spi_master.c
..\source\src\ds_wdt.c
..\source\src\gclock.c
..\source\src\i2cdriver.c
..\source\src\KeyEventHandler.c
..\source\src\kx_gsensor.c
..\source\src\main.c
..\source\src\MainUI.c
..\source\src\MotorEventHandler.c
..\source\src\uartdriver.c

• PAH8001 HR sensor
• KX gsensor
• i2c driver - gsensor and hr sensor?
• spi driver - OLED?
• uart - hopefully on USB data pins?

Register dumps

Register dumps made over SWD when rebooted to DFU bootloader (serial enabled!) and later also main app (no serial but rest of HW)

UART https://infocenter.nordicsemi.com/topic/com.nordic.infocenter.nrf52832.ps.v1.1/uart.html?cp=2_1_0_49_9#topic

0x40002500:	0x00000004	0x00000000	0xffffffff	0x00000017
0x40002510:	0xffffffff	0x00000016	0x00000000	0x00000000
0x40002524:	0x009d5000

rx 0x16 23
tx 0x17 22
no parity
baudrate 38400

SPI https://infocenter.nordicsemi.com/topic/com.nordic.infocenter.nrf52832.ps.v1.1/spi.html?cp=2_1_0_47_1#topic

0x40023500:	0x00000001
0x4002350c:	0x00000006
0x40023508:	0x00000005
0x40023510:	0xffffffff
0x40023524:	0x80000000
0x40023554:	0x00000000
spi2 master sck 5 mosi 6 miso -1 speed 8mbps config msb,sample leading shift trailing,acthigh

TWI https://infocenter.nordicsemi.com/topic/com.nordic.infocenter.nrf52832.ps.v1.1/twi.html?cp=2_1_0_48_7#topic

0x40004500:	0x00000005 = ENABLED TWI
0x40004508:	0x0000000d = PSELSCL 13 
0x4000450c:	0x0000000e = PSELSDA 14
0x40004524:	0x06680000 = FREQUENCY 400kbps
TWI1 scl 13 sda 14  speed 400kbps

0x40003500:	0x00000005
0x40003508:	0x00000007
0x4000450c:	0x00000008
0x40003524:	0x06680000
TWI0 scl 7 sda 8 speed 400kbps

GPIO https://infocenter.nordicsemi.com/topic/com.nordic.infocenter.nrf52832.ps.v1.1/gpio.html?cp=2_1_0_19_2#topic

0x50000514:	0x36000070 DIR
0x50000504:	0x00006190 OUT
0x50000510:	0x41216040 IN no charging
0x50000510:	0x40216044 IN charging
0x50000510:	0x40e16004 IN display on
after using also hr sensor
0x50000504:	0x34806190 00110100100000000110000110010000 OUT
0x50000510:	0x40e17984 01000000111000010111100110000100 IN (charging, display off)
0x50000514:	0x36800070 00110110100000000000000001110000 DIR (1=output,0=input)

inputs:
pin 2 goes high when power is attached to usb
pin 30 touch button, goes low when touched
outputs:
pin 4 when display is on and set to 0 display goes off (RST?)
pin 25 motor
pin 26 enable HR sensor
pin 28 ?
pin 29 ?