• Tearsday Thurdown #4

    05/12/2022 at 08:41 0 comments

    Tearing into Sony WH-CH510 headphones

    These headphones were stolen off a friend who had owned them for many years as he was going to throw them out. Why were they bin worthy? A piece of plastic snapped on one headphone, which I was able to fix with a bit of super glue. These are still in great working condition even with the thoroughly worn ear cushions.


    The mechanical design of the headphones are simple the plastic curved piece of plastic has a good amount of spring to hold the headphones over a large head and could be adjusted with a sliding mechanism with multiple soft locking notches. The headphones are very lightweight so let’s look inside to see what’s inside.

    The first step is to remove the ear cushions from the headphones, which exposes three screw holes.Once the screws in these three holes have been removed you can proceed to separate this plastic plate, by levering a small flathead screwdriver into the bottom, where there is a notch in the plastic plate. Now we can see inside the headphones!

    To the electron city! (aka PCB)

    All of the circuitry for this device is located in the right headphone housing as seen below. This circuit is very simple and has similar components to my first teardown of some wireless earbuds. However these headphones have a much larger volume of space, sizing constraints are much less of an issue (boring!). The major components we can see when we open the housing is a 3.7 V Lipo battery, a small conical speaker and the main PCB. 

    On the circumference of the PCB from left to right we have three tactile switches and LED connected to a lightpipe and a USB C charging port. The top of the PCB has very few components; only passive components like resistors, capacitors, and test points are present on this side. We call also see ‘through via’ stitching throughout the board to shield the RF parts of the circuit and ensure impedances of radio frequency lines are controlled. To reveal the other side of the PCB we simply unscrew one black screw near the centre of the PCB.

    The rear of the PCB is also very simple. We have the power management circuit next to the USB header, the micro in the centre of the board and what looks like some FETs, diodes and maybe a regulator sparsely scattered around the rest of the board. The crab logo is a clear indicator that this is a Realtek SoC (RTL8763BFS). This SoC contains a silly amount of features including:

    • Low power DSP - dedicated filtering microphone data and a 24bit audio codec
    • Integrated dual switch mode power regulator, linear regulators, and battery charger; charging current up to 400mA
    • Bluetooth radio - BLE, BT 5.0 and BDR/EDR
    • USB 2.0 and USB C compatibility
    • 32-bit ARM Cortex-M4F Processor

    Amongst many other features somehow packed into one small package.

    Below the SoC we can see a 40MHz crystal oscillator. Surrounding the SoC in close proximity are of course the decoupling/bulk capacitors. 

    To the left of the PCB we have an PCB trace antenna which will have all of its trace and components specifically sized to a specific impedance to optimise the radiation power of the antenna. There seems to be a blue multilayer chip antenna of sorts attached to the end of the PCB trace antenna. It is difficult to know how this antenna setup works without learning more about the intricacies of antenna engineering and the relevant electromagnetic physics principles. This is meant to be a good site for mere laymen who want to learn about antennae from fundamentals -> https://www.antenna-theory.com/ .


    Overall a very simple teardown with proof that complex circuitry isn’t required at all when you can find a SoC that can do it all from power management to radio to processing etc. A fun quick easy teardown. They worked perfectly when put back together ready to push more well timed air pressure waves into my ears!

  • Tearsday Thurdown #3

    04/21/2022 at 09:40 0 comments

    Garmin Vivoactive 1 teardown

    I’ve had this Garmin Vivoactive for over 6 years now and upgraded a couple of years ago to the Garmin Forerunner 45 for running and swimming. The old Vivoactive used to have the stamina of a rabbit in bed (it had a great battery life), but the battery life rapidly deteriorated as I was starting to use it a lot less. The watch strap completely broke on one side so I replaced it with a piece of janky elastic. It still functions well, taking a reasonable amount of time to pick up some solid GPS satellite signals. Enough chit chat let’s tear in!

    How do we open a waterproof watch??

    The housing of the Vivoactive is very sleek and much thinner than many other current smart watches(8mm vs 12mm for my Forerunner 45), but also has a lot less features. After a good few minutes of inspecting the watch for any edges to pry open I noticed a change of material between the watch face and housing. I assumed like in other devices (such as phones and the Kaiser Baas teardown that the screen was simply glued on. Being a water-tight device my smallest tools could not pry the screen off, so I use an iron to soften the glue holding the screen down. I then used a small suction cup to pull on the screen, which lifted a small edge to be pyred open as seen in the figure below. This has definitely ruined the rated 5 ATM waterproof rating.

    The insides

    After very carefully prying off the LCD/touchscreen the quite simple insides were exposed. The main visible components were the 

    • Lipo battery, 150mAh, 3.7v
    • PCB
    • Antenna
    • Flex PCB interconnect

    The antenna is made by TE and sits on three pins protruding from the PCB. A small connector sits under the antenna, which could be used for programming or other testing purposes. The push buttons on either side of the PCB are supported with a resin substance. The main IC seen on the right side of the PCB is a Nordic nRF51422 BLE, ANT and 2.4 GHz SoC. A great SoC for a wearable device, with plenty of computing power with its M0 core, flexible radio usage, and low energy modes. There is an external 32MHz crystal oscillator adjacent to and driving the Nordic chip.

    In the centre of the PCB we can see a low profile FPC connector. All of the the components look to be 0201 as expected with a wearable device of this size. There is a farm of caps and resistors on the left side of the PCB likely a mixture of decoupling caps and peripheral components for setting up IC parameters. 

    The dark side of the PCB

    To access the other side of the PCB the LiPo battery is gently levered out and the four conductive ‘power’ screws are removed. Upon removal and flipping over the PCB we find that the other side is completely boxed in and shielded. Half of the metal shield is covered in copper tape with the other half of the laying under the battery. Under this side we likely have an IMU, a GPS module and adjoining circuitry.

    The antenna is provided by TE connectivity and has a PN that looks like 2??8462. To aid the rf part of the PCB we have a keepout copper area between the antenna and the SoC. There is a component between the antenna and the SoC which is likely to be some kind of impedance matching/ signal conditioning circuit. We can also see ground plane stitching around the perimeter of the PCB, in particular near the antenna. There are many exposed circular gold plated test points

     on the PCB, likely for use with an ICT method like flying probe or bed-of-nails. 

    The screen used for the watch uses memory in pixel (MIP) technology where the LCD pixels required a very low power to stay ON. This is evident as the screen does not emit light but uses ambient light to illuminate the screen or a backlight on demand. The screen is also a touch screen for extra UI functionality.

    The charging case

    The charging case was simple to pull apart, only held together with glue. There is a single component PCB in the case with a 2A fused attached to the positive terminal of the charger. The...

    Read more »

  • Tearsday Thurdown #2

    03/04/2022 at 08:19 0 comments

    Tearing down a Kaiser Bass X200 Action Camera

    Today we're taking apart a Kaiser Bass X200 Action camera I took on a hiatus to Europe and Central Asia for a few months. This camera has been through the wars it's been used in in Kazahk sand, Turkish water and Mongolian dirt. It was great for taking photos, however it's video quality was terrible. Video quality was similar to 240p with a non-constant frame rate.


    The first step as usual is to tear into the housing. Firstly the lithium ion battery (3.7v 900mAh, 3.33Wh) was removed to find the opening point of the housing.  This exposed an easy place to pry the face-plate from the main body of the housing. 

    With the face plate removed, this exposes four corner screws, a power button PCB, and a small coin shaped speaker down the side of the camera. The screws are removed to reveal the LCD screen and motherboard.

     The LCD screen is slotted into the housing. There is a highly diffuse sheet light guide (backlight) behind the LCD screen illuminated by three right angle LEDs beside the ribbon cable.

    The Motherboard


    The top of the PCB is likely the power supply part of the board where we can see an inductor and an 8SOIC boost converter, which steps up/down the battery voltage for the various circuits on the rest of the board. The chip with the CNVL marking in the top left corner is a low voltage detector. This chip will actively output a high or low signal whenever the input voltage drops below 3v, to protect the device from brown out related failure. I assume many of the capacitors in the top part of the PCB are decoupling caps for the main MCUs power supply input.

    The Smarts

    The ribbon connector in the centre of the board is for the LCD screen. The PUYA 8 pin IC on the mid-left side of the board is flash memory for the MCU likely required for storage of images before they are transferred to the SD card and just extra memory for the program running on the MCU. The SD card slot is obviously nestled down the bottom beside the two LEDs.


    If we now flop over the PCB we can see the microprocessor with the GPCV5168B… marking. I could not any datasheets for this MCU but assume it has an ARM processor or similar. To the left of the processor we can see three pins protruding to make contact with the Lipo battery. It is clocked by a 12MHz crystal oscillator just to the right of the MCU. There are a bunch of unpopulated footprints for other potential models/versions of the PCB with different MCUs. Or these could potentially be for redundancy for when the MCU goes EOL they can easily just populate with an alternative part with similar specs. Hidden behind the lens we have a MEMS microphone and two separate ports for USB mini and micro connections. To the right of the USB connector we can see a small antenna trace which likely connects to an IC for a different WiFi or Bluetooth enabled version of Kaiser Baas.

    The Lens

    The camera lens module was mounted to the PCB using double sided foam tape. This double sided foam tape would have helped dampen any small vibrations applied to the camera. Without getting destructive presumably within the lens module we would find a CCD. Often these cameras can have small stepper motors inside to help adjunct the focus of the camera dynamically.

    The End

    I haven’t discussed all the little black box ICs in the PCB, but many of them would’ve been ya classic transistors, regulators, or other similar devices. It was all easy enough to put back together apart from inserting the LCD screen ribbon back into its connector, small fiddly tweezers were required. This device is going straight into the bin anyho, it is a very cheap design costing cerca $70, so you get what you pay for. I wouldn't recommend buying one, but it was fun and eay to take apart and put back together.