DIY

Apple AirPod Charger Teardown and Reverse Engineering

After tearing down the AirPods themselves we were requested by many people to teardown the charging station too. At first we thought that it would be very ‘dumb’ with just a battery, some PMIC and not much else. 

One thing we noticed when playing with the AirPods is that your phone knows the charge state of the AirPods individually, as well as the case itself. How were they doing this? Our interest was piqued! We also noticed that if you don’t have either AirPod in the charger cradle, the phone is unable to read the charger cradle charge state. It was very unlikely that the case has another Bluetooth radio in it as that seems total overkill and power hungry, so we discussed other options. As there are only 2 contacts between the charger and AirPods, we theorized they must be using a form of powerline communication and hijacking the radio in one of the AirPods to transmit information from the charging cradle to the phone.

Anyway, to the teardown!

charger1

With no obvious screws or easy places to pry at, we went for the Dremel to open this one. 

charger2

The Dremel only got us so far and with a Lithium battery inside somewhere, we decided a less brutal method was in order. Snipping and peeling away the plastic seemed a bit safer.

charger3

With the first glimpse of the innards, we knew this was a lot more than a simple dumb charger. There’s an ARM Cortex-M0+ in there!

charger4

And we’re in! The masses of green glue meant this was not coming apart cleanly, no matter how hard we tried. This is certainly a 1-way teardown. (Things to note: what’s that crazy solder splodge? Also the HUGE spring contacts for connecting to the pair button seem like overkill. Also, no Bluetooth radio as suspected)

charger5

Centre of the board is home to a huge STM32L072 processor and on the right are battery charging and PMIC ICs. On the left is a pair of LTC3441 buck/boost regulators. Interestingly they are using two, one for each of the AirPods. They are supplying 5V DC to each airpod for charging and some special sauce!

More to come later…

charger6

Apple’s amazing attention to detail. The little button on the back is actually a whole custom assembly. Two metal contacts are moulded into a piece of plastic to contact with the springs on board, then a SMD switch soldered on. The button that presses down even has a tiny milled metal insert for pushing the button! Very impressive ME work!

charger7

Even the lightning connector is its own flex-sub-assembly with the inclusion of two tiny ESD diode packages. 

charger8

The power source for the charger! A surprisingly small 1.52Whr 3.81V (4.35V cutoff) Li-Ion battery. This higher-than-normal voltage is a new chemistry from Panasonic we believe.

charger9

The AirPod dock is an entire sub-assembly again with another complex flex that connects the charging contacts, with a status LED and reed switch to detect when the case is open..

charger10

The back of the PCB reveals a myriad of test points again. Way too tempting for an EE! Time to break out the oscilloscope!

So now we can get into reverse engineering this crazy device! First we soldered on some magnet wire to the charging contacts on an AirPod and attached our trusty Keysight scope (affectionately named “scopecreep”). 

Woah, what do we have here!

charger11

We see a 5V output voltage with some data! Aha!

charger12

Zooming on this data and we find it to be a 50MHz sinusoidal carrier coupled onto the charging line.

charger13

Test points found! (left one is data for left channel, right one is ground)

charger14

Doing a little more probing around and we found a testpoint for the raw data signal coming from the processor at 1.8V logic levels. Out first impressions of the data are there is a synch/fixed pattern at the beginning with some sort of counter a few bits in, and what looks like a CRC at the end. 

charger15

A few sequential data packets can be seen overlayed in this GIF.

charger16

We then attached a Saelae Logic 16 analyser to look at the data properly and try to use one of the built-in decoders. 

charger17

A burst of data captured from the processor. Unsure if this is send/received or contains both Tx and Rx. Most decoders could not get anything, apart from 48-bit serial, however we believe this is a bit of a red-herring. 

We find it rather fascinating the amount of effort that clearly goes into designing and implementing a product and implementation like this. It is always great to see how other engineering teams approach problems and is what really inspires us all as engineers.

If you have ideas about decoding the data, feel free to reach out! We would love to hear what you’ve got.