Samsung Gear Sport Teardown

Posted by Mark Kirschenbaum on

Samsung Gear Sport Teardown
I recently picked up the Samsung Gear Sport for the possibility of skydiving with it, tracking my daily activity, and getting notifications from my iPhone. Temptation got the best of me, and around hour one, I decided to have a look what's inside. 
Gear Sport Altimeter for skydiving

Disassembly of SM-R600 (Samsung Gear Sport)

Overall, disassembly is easy. Just remove the four, 3-wing screws located in each corner.  The bottom pops off with a gentle pry from a spudger. Obviously, be sure to clean off both mating surfaces before closing the unit back up for waterproofness. 
Samsung Gear Sport removed cover
Once inside, carefully remove the only screw. Be careful not to touch the pad next to the diode as that is the battery output. 
Disconnect battery on Samsung Gear Sport
Placing a piece of Mylar or similar insulator here will disconnect the battery. I would highly recommend doing that before continuing.
Motherboard Assembly
Removing the connector and sliding it through the carrier will disconnect the board/battery carrier from the watch face. In this shot, I removed the EMI copper tape to get a better look at the processor stack.
Note: The NFC antenna is the coil on the bottom left.

Samsung Gear Sport Battery
Samsung Gear Sport Battery
A cover keeps the battery in place and some adhesive keeps the battery from sliding aft.

Hall Effect sensorsButtons
Just bellow the battery are three hall effect sensors for sensing the spinning bezel.
The flex push button assemblies are simply taped on to the carrier. 

Backside of SM-R600 motherboard 
Here is the backside of the motherboard with two more enclosed EMI shields and the antenna front end (top right).
Battery Compartment and buzzer
The backside of the carrier houses the two pins for the RF antenna to connect to the body and the haptic feedback source.
Samsung Gear Sport Antenna
It's interesting that they use the stainless steel body as the RF antenna. The two antenna pads can be seen above. Note the housing's metal is sealed so these two access points are the only conductive surface on the body. Unfortunately, I don't have a LRC meter to find out the "antenna's" impedance, but this is an extremely interesting technique. 
Samsung Gear Sport Backside
On the case's backside we can see the o-ring sealed pressure sensor, wireless charging-charging coil, and window for the HR sensor. There are also three magnets that give the rotating bezel its 'click'. I'm unsure why there is an additional MEMS pressure sensor on the main board with this submersible sensor, but it's there. Perhaps someone that knows can drop us a line.
Samsung Gear Sport Display Assembly
Wow, the display assembly packs a lot in a small space. 360x360 16M colors AMOLED display, ambient light sensor, and gesture touch sensor, all protected by Corning® Gorilla® Glass SR+. 


Samsung Gear Sport Processor - Samsung EXYNOS 7270
  • Samsung EXYNOS 7270 - SOC Dual Core, 64bit Cortex®-A53 1Ghz, .75GB LDDR3, 4.0 eMMC. Marking: 72708 |  SEC731A214 | KMFJX0007A | GME19493
  • Battery 300mah Li-Ion 1.14Wh
  • NXP 67T05 NFC Near Field Communication Controller
  • STMicroelectronics LSM6DSL  Inertial Measurement Units iNEMO inertial module
  • Microphone Samsung? G341-7315
  • DSP Group DBMD4 Audio Voice Processor | Mic Codec
  • STMicroelectronics LPS22HB MEMS nano pressure sensor: 260-1260 hPa absolute digital output barometer marking: C731
  • STMicroelectronics LPS33HW MEMS pressure sensor: 260-1260 hPa absolute digital output barometer with water resistant package (One with o-ring)
  • Partron PPS960 Heart Rate Sensor: Marking 7090 contains TI AFE4404
  • Cypress TMA5XX based Cypress Touch Screen Controller silicon_id 0x0b11
  • IDT P9220 WPC 1.2.1 Compliant, 15W, Single-Chip Solution Wireless Power Receiver
  • Zinitix ZH915 Vibration Motion Driver
  • Broadcom BCM4752 Integrated Multi-Constellation GNSS Receiver 
  • Samsung s6e36w1x01 2-inch Super AMOLED 360 x 360 pixels 16M Colors 
  • AMS TSL2584 Ambient Light Sensor

SOC modules

  • S2MPW01 Samsung PMIC

Samsung Gear Sport Hacked


Tizen OS
SW version R600XXU1AQI8
Knox Version 2.2.0
Knox Tizen Wearable 2.2.0
SE for Tizen 1.0.0
TIMA 3.0.0
Freespace Factory: 2.4gb out of 4.0gb
Linux version 3.18.14 (abuild@SWDG0804) (gcc version 4.9.2 20151028 (prerelease) (Tizen/Linaro) ) #1-Tizen SMP PREEMPT Thu Sep 21 08:49:26 UTC 2017
Samsung Gear Sport Bootup

The 45 Sensors

To learn more about these Tizen devices, I decided to extract the various sensor's name, manufacturer, resolution, min & max, and refresh rate. Hopefully this is useful to someone. 

Again, there are two pressure sensors reading from 260-1260hpa with 0.000244 resolution and 1ms maximum refresh rate. 

Note: SENSOR_NOT_DEFINED_INT means the Tizen defined sensor types were not used for this sensor and there is a custom type. The proceeding int is the type value.

Here is the complete SM-R600 sensor list.

Technology Overview

Overall there is a metric ton of processing power, sensors and connectivity on this device. Bluetooth, WiFi, NFC, wireless charging, GNSS, ambient light sensor, nano pressure sensor, pressure sensor, gyro/accel/inertial measurement unit, HR monitor, haptic feedback, and temperature. 
Some nifty features are wake on movement gesture, wake on voice, and voice to text.  The device is not rooted and has several layers of security that are beyond the scope of this writeup. With the Tizen SDK, this device is super customizable and is a powerful platform for us hardware geeks.
Please drop me a line if you have more insight or notice something I've missed.
Thank you,

Share this post

← Older Post Newer Post →

Hypoxic Products