Samsung Gear Sport Teardown

Posted by Mark Kirschenbaum on Nov 01, 2017

I recently picked up the Samsung Gear Sport for the possibility of skydiving with it, tracking my daily activity, and getting notifications from my iPhone. Temptation got the best of me, and around hour one, I decided to have a look what's inside.

Disassembly of SM-R600 (Samsung Gear Sport)

Overall, disassembly is easy. Just remove the four, 3-wing screws located in each corner. The bottom pops off with a gentle pry from a spudger. Obviously, be sure to clean off both mating surfaces before closing the unit back up for waterproofness.

Once inside, carefully remove the only screw. Be careful not to touch the pad next to the diode as that is the battery output.

Disconnect battery on Samsung Gear Sport

Placing a piece of Mylar or similar insulator here will disconnect the battery. I would highly recommend doing that before continuing.

Removing the connector and sliding it through the carrier will disconnect the board/battery carrier from the watch face. In this shot, I removed the EMI copper tape to get a better look at the processor stack.

Note: The NFC antenna is the coil on the bottom left.

A cover keeps the battery in place and some adhesive keeps the battery from sliding aft.

Just bellow the battery are three hall effect sensors for sensing the spinning bezel.

The flex push button assemblies are simply taped on to the carrier.

Here is the backside of the motherboard with two more enclosed EMI shields and the antenna front end (top right).

The backside of the carrier houses the two pins for the RF antenna to connect to the body and the haptic feedback source.

It's interesting that they use the stainless steel body as the RF antenna. The two antenna pads can be seen above. Note the housing's metal is sealed so these two access points are the only conductive surface on the body. Unfortunately, I don't have a LRC meter to find out the "antenna's" impedance, but this is an extremely interesting technique.

On the case's backside we can see the o-ring sealed pressure sensor, wireless charging-charging coil, and window for the HR sensor. There are also three magnets that give the rotating bezel its 'click'. I'm unsure why there is an additional MEMS pressure sensor on the main board with this submersible sensor, but it's there. Perhaps someone that knows can drop us a line.

Wow, the display assembly packs a lot in a small space. 360x360 16M colors AMOLED display, ambient light sensor, and gesture touch sensor, all protected by Corning® Gorilla® Glass SR+.

Components

Samsung Gear Sport Processor - Samsung EXYNOS 7270

Samsung EXYNOS 7270 - SOC Dual Core, 64bit Cortex^®-A53 1Ghz, .75GB LDDR3, 4.0 eMMC. Marking: 72708 | SEC731A214 | KMFJX0007A | GME19493
Battery 300mah Li-Ion 1.14Wh
NXP 67T05 NFC Near Field Communication Controller
STMicroelectronics LSM6DSL Inertial Measurement Units iNEMO inertial module
Microphone Samsung? G341-7315
DSP Group DBMD4 Audio Voice Processor | Mic Codec
STMicroelectronics LPS22HB MEMS nano pressure sensor: 260-1260 hPa absolute digital output barometer marking: C731
STMicroelectronics LPS33HW MEMS pressure sensor: 260-1260 hPa absolute digital output barometer with water resistant package (One with o-ring)
Partron PPS960 Heart Rate Sensor: Marking 7090 contains TI AFE4404
Cypress TMA5XX based Cypress Touch Screen Controller silicon_id 0x0b11
IDT P9220 WPC 1.2.1 Compliant, 15W, Single-Chip Solution Wireless Power Receiver
Zinitix ZH915 Vibration Motion Driver
Broadcom BCM4752 Integrated Multi-Constellation GNSS Receiver
Samsung s6e36w1x01 2-inch Super AMOLED 360 x 360 pixels 16M Colors
AMS TSL2584 Ambient Light Sensor

SOC modules

S2MPW01 Samsung PMIC

Samsung Gear Sport Hacked

Software

Tizen OS 3.0.0.0

SW version R600XXU1AQI8

Knox Version 2.2.0

Knox Tizen Wearable 2.2.0

SE for Tizen 1.0.0

TIMA 3.0.0

Freespace Factory: 2.4gb out of 4.0gb

Linux version 3.18.14 (abuild@SWDG0804) (gcc version 4.9.2 20151028 (prerelease) (Tizen/Linaro) ) #1-Tizen SMP PREEMPT Thu Sep 21 08:49:26 UTC 2017

The 45 Sensors

To learn more about these Tizen devices, I decided to extract the various sensor's name, manufacturer, resolution, min & max, and refresh rate. Hopefully this is useful to someone.

Again, there are two pressure sensors reading from 260-1260hpa with 0.000244 resolution and 1ms maximum refresh rate.

Note: SENSOR_NOT_DEFINED_INT means the Tizen defined sensor types were not used for this sensor and there is a custom type. The proceeding int is the type value.

Here is the complete SM-R600 sensor list.

Technology Overview

Overall there is a metric ton of processing power, sensors and connectivity on this device. Bluetooth, WiFi, NFC, wireless charging, GNSS, ambient light sensor, nano pressure sensor, pressure sensor, gyro/accel/inertial measurement unit, HR monitor, haptic feedback, and temperature.

Some nifty features are wake on movement gesture, wake on voice, and voice to text. The device is not rooted and has several layers of security that are beyond the scope of this writeup. With the Tizen SDK, this device is super customizable and is a powerful platform for us hardware geeks.

Please drop me a line if you have more insight or notice something I've missed.

Thank you,

-Trunk