Reverse Engineering Egofit Treadmill Serial Interface

[hofcake]

I recently decided to pick up a treadmill for my apartment so I would feel a little less bad about spending hours upon hours at my desk. After some not so careful consideration I ended up going with the Egofit Pro-M1. This is absolutely not an endorsement, since this treadmill suffers from the same issues that plague many of the cheaper treadmills (ElectroBOOM has a good video demonstrating these).

Once I got it in hand, I noticed there was a usb connector for an accessory that displays speed, steps, etc. and allows for control. I connected it to my logic analyzer and saw:



After doing a little head scratching it looks like this is mostly 7 segment display encoding with the first bit being the decimal! All of which is sent over your bog standard 9600baud async serial

Byte #   Encoding   Purpose
0      unknown
1      unknown
2      unknown
3      unknown
4   7SD + Dec   Speed [0.X]
5   7SD + Dec   Speed [X.0]
6   7SD + Dec   Time [00:0X]
7   7SD + Dec   Time [00:X0]
8   7SD + Dec   Time[0X:00]
9   7SD + Dec   Time[X0:00]
10   7SD + Dec   Steps [000X]
11   7SD + Dec   Steps [00X0]
12   7SD + Dec   Steps[0X00]
13   7SD + Dec   Steps[X000]
14   7SD + Dec   Dist [00X]
15   7SD + Dec   Dist [0X0]
16   7SD + Dec   Dist [X00]
17   7SD + Dec   Calories[00X]
18   7SD + Dec   Calories[0X0]
19   7SD + Dec   Calories[X00]
20      unknown
21      unknown
22      unknown


The D- wire is completely unused, and I suspect is how the accessory would send commands back to the treadmill itself. I might have to get my hands on one or see if there's an MCU to attach GDB to in order to figure out how that works. I figured I would post this here in case anyone else purchased one and wanted to integrate treadmill metrics and/or control into something else. I am also open to ideas on what to do next, I was thinking a teardown?