With no obvious screws or easy places to pry at, we went for the Dremel to open this one.

The Dremel only got us so far and with a Lithium battery inside somewhere, we decided a less brutal method was in order. Snipping and peeling away the plastic seemed a bit safer.

With the first glimpse of the innards, we knew this was a lot more than a simple dumb charger. There’s an ARM Cortex-M0+ in there!

And we’re in! The masses of green glue meant this was not coming apart cleanly, no matter how hard we tried. This is certainly a 1-way teardown. (Things to note: what’s that crazy solder splodge? Also the HUGE spring contacts for connecting to the pair button seem like overkill. Also, no Bluetooth radio as suspected)

Centre of the board is home to a huge STM32L072 processor and on the right are battery charging and PMIC ICs. On the left is a pair of LTC3441 buck/boost regulators. Interestingly they are using two, one for each of the AirPods. They are supplying 5V DC to each airpod for charging and some special sauce!

More to come later…

Apple’s amazing attention to detail. The little button on the back is actually a whole custom assembly. Two metal contacts are moulded into a piece of plastic to contact with the springs on board, then a SMD switch soldered on. The button that presses down even has a tiny milled metal insert for pushing the button! Very impressive ME work!

Even the lightning connector is its own flex-sub-assembly with the inclusion of two tiny ESD diode packages.

The power source for the charger! A surprisingly small 1.52Whr 3.81V (4.35V cutoff) Li-Ion battery. This higher-than-normal voltage is a new chemistry from Panasonic we believe.

The AirPod dock is an entire sub-assembly again with another complex flex that connects the charging contacts, with a status LED and reed switch to detect when the case is open..

The back of the PCB reveals a myriad of test points again. Way too tempting for an EE! Time to break out the oscilloscope!

So now we can get into reverse engineering this crazy device! First we soldered on some magnet wire to the charging contacts on an AirPod and attached our trusty Keysight scope (affectionately named “scopecreep”).

Woah, what do we have here!

We see a 5V output voltage with some data! Aha!

Zooming on this data and we find it to be a 50MHz sinusoidal carrier coupled onto the charging line.

Test points found! (left one is data for left channel, right one is ground)

Doing a little more probing around and we found a testpoint for the raw data signal coming from the processor at 1.8V logic levels. Out first impressions of the data are there is a synch/fixed pattern at the beginning with some sort of counter a few bits in, and what looks like a CRC at the end.

A few sequential data packets can be seen overlayed in this GIF.

We then attached a Saelae Logic 16 analyser to look at the data properly and try to use one of the built-in decoders.

A burst of data captured from the processor. Unsure if this is send/received or contains both Tx and Rx. Most decoders could not get anything, apart from 48-bit serial, however we believe this is a bit of a red-herring.

We find it rather fascinating the amount of effort that clearly goes into designing and implementing a product and implementation like this. It is always great to see how other engineering teams approach problems and is what really inspires us all as engineers.

If you have ideas about decoding the data, feel free to reach out! We would love to hear what you’ve got.