[Part 2] Sony WH-1000XM3 Not turining on

PART 2 Investigating the mainboard

Next, I took the left earpiece apart. Here you have to work very carefully because the NFC cable is very short and is soldered on both sides! After exposing the board I took a look at the bottom side, because there are many visible voltage supply areas. Mostly you can recognize them by the large inductors and capacitors. The Bluetooth chip from qualcomm seems to do the communication, the power management and the hardware buttons. I urgently need to investigate how the data gets from one side to the other, i.e. Atmega to the mainboard. But since all ICs are bga or with luck qfn packages, tracing is extremely difficult. I guess the board has at least 6 layers. Therefore a best guess approach is the best option for me.

I found the Datasheet after some search here.

So I first checked if the power supply reaches the other receiver without problems. This is actually just a connection via cable. Then I checked the voltages of the linear and switchmode controls from within the qualcomm ic. The chip has a total of 4 linear regulators and 2 dcdc internal power supplies. The corresponding voltages (1,8V 3,3V etc)  measured all fine on the board at the inductors and capacitors mentioned earlier.

If the headphones were again in the faulty mode I could see that the voltages increased but then collapsed again after a short time. This happens periodically with about 1.3 Hz. So where does this Signal to shutdown again come from. I started with the powerup cycle...
The datasheet gives the information that the hardware pin VREGENABLE boots the power supplies. This is usually connected to the battery voltage by a momentary switch. This seems to be the case with the WH-1000XM3. But there seems to be a diode in series to the signal, probably for ESD protection.

The voltage arrives at the output of the diode and is thus eliminated as source of error. Next I wanted to see if the power supplies are overloaded and therefore switch off. Therefore I tested all visible capacitors. Here I could not find any problems, as long as measurable in the circuit is usable at this point. So I could be half sure that everything is okay here. Then I tried to inject the voltages with my lab power supply into the board. To make a long story short this did not bring any improvement. What could stop the chip from starting now? And why only sometimes...

I looked at the chip's reset circuitry. The IC can get a reset from some sources. RST# pin, Power-on reset, USB charger attach reset, UART break character and Software configured watchdog timer. At this point I have ruled out a software malfunction for the time being and wanted to continue looking at the hardware. Furthermore the datasheet says: "If RST# is held low for >2.4s CSR8675 BGA turns off. A rising edge on VREGENABLE or VCHG is required to power on CSR8675 BGA". So this could well be my candidate.
As usual the reset pin is designed as active low. So it is either pulled high by a pullup resistor or by another external circuit. So quickly check where the pin for the reset line on this package is. Pad L1 for the reset is fortunately located directly at the edge of the chip and I could hardly believe my luck when I actually saw a track that meandered from this edge to a pad that could probably be measured.

Sorry for the bad image quality! I should' ve taken better images. You can get glorious images at the 52audio webpage that I've shown you in the previous post and here again. Absolute awesome teardown! I love the detailed work!

So I instantly grabbed the oscilloscope probe and examined the pin. And lo and behold, it is indeed the reset pin!!! Unfortunately, the headphones were now back in working mode and I waited a few hours and tried again and again to see if they finally had the error again.
Eventually I found out that as soon as I approach the board with my hands or the probe, the headphones are more likely to be switched on instead of beeing faulty, so we are definitely dealing with a floating pin or something like that!
Since I could not access the reset line properly without distorting the IC, I wanted to solder a thin copper wire to the pin. The problem with the idea was that the pad has an edge length of only about 0.3mm. This is a good demonstration on how small this is... This in combination with a high layercount of the board makes me suspect really bad things... To explain why this is so problematic: You try to heat a very small area so that the solder melts. To do this you have to use a lot of energy to overcompensate the heat dissipation into the other layers. This usually results in raising the temperature of the soldering iron, which in turn dramatically increases the chance of detaching the tiny pad from the board. The whole thing gets even worse when you consider that the wafer-thin copper layer on the board will expand faster than the substrate material underneath. And that in turn leads to pad detachment too. So extreme caution is required when working on such boards without preheating the whole board. But after about 10 minutes of soldering I had finally made a connection.

This is not the actual pad! Just to give you an idea on how tiny the pad is. That I was trying to solder to. The lower component is a SOT 23-3.

Not nice but in my defense: The insulation layer on the wire, which I unwound from a transformer, unfortunately contained more epoxy resin than I wanted (produces a lot of slag during soldering).

The green cable is a probe connection to one of the supply rails. Also only 0.5mm diameter...

Sneak peek through my microscope

Now I could make measurements without touching the board. The headphones were also nice enough to cooperate with me and entered their failed mode on the first try.

On the screen we see one of the power supplies (yellow trace) and the reset line (blue trace). There is a clear correlation between the two. So next I tried to overwrite the reset pin with the lab power supply to keep the IC permanently in non-reset mode. Now the headphones could not be switched on at all. Only when I disconnected the voltage I could switch them on again... So the reset pulse seems to be really important for the startup. At this point I unfortunately have to interrupt the repair because of lack of time... This time probably for a longer time until I have written my exams. In the meantime there is another project I am working on since the beginning of the year (Yes my projects take ages at the moment...).

[Part 1] Sony WH-1000XM3 Not turining on

PART 1 Hacking my way into the battery management

[somewhat off topic]
First a little story on how I got myself into fixing a pair of headphones. Due to the global pandemic I currently have to study at home. The problem here is that if you live on a busy street, the daily street noise keeps you off track every now and then. So I spent the last months with my simple Apple earpods to block the noise with music. The problem with these earpods is that they become uncomfortable after a while and the cable in front of you on the table is always in the way. Of course small problems but when you are confronted with this problem for hours every day it becomes a big problem. Therefore I have been looking for new headphones. However the really good ones are very expensive. At some point I had the idea to look for broken good ones. There I also found them very quickly. The problem from the article description was "cannot be switched on". Usually these kind of problems are caused by a unhealthy battery or problems with the battery management.

As soon as I got them I first tried the reset variants noted by Sony but the headphones didn't react to them at all. So the next thing I did was to open the left headphone. This is done by simply removing the ear pads and the foam underneath. After unplugging the flat ribbon cable for the touch interface the battery is already exposed. First I removed the battery and measured the voltage with my multimeter. A cell voltage of 3.9V is still full enough to work propaly. But to bei sure I discharged the battery with my charger and charged it afterwards. Thereby I can determine the remaining capacity of the battery. From the 1000 mAh labeled on the battery approx. 920 mAh went in. So the battery was definitely not the problem. Because the battery was not plugged in for some time now the remaining charge in the headphones should have been discharged. So I tried to switch on the headphone. And it worked at the first try! I thought okay that was probably the problem. It was probably just the battery management that was wrong with the cell charge. I used the headphones and was very pleased with the performance. The next day I wanted to switch them on again but unfortunately they were dead again. So I unscrewed the left earphone again and disconnected the battery. Unfortunately this was not successful. Also further attempts with very long disconnection times do not need success.

[rant]
Because I didn't really have the time to work on the device I decided to send it in for service. I thought with the price I would be cheaper even with repair. It seems that Sony itself does not repair their own products and so I had to send the headphones to their German support center which is not owned by them. After about one week of sending it in, I got a cost proposal with the content: "Repair not possible, because the spare parts are not available". On request I found out that it would be the motherboard. At this point I was very sure that the company had neither disassembled the headphones nor could they repair anything on the headphones beyond a battery. Ridiculous to call such thing a service. Well, I was then allowed to pay an inspection fee and the return shipping. A total of over 50€ for a statement that they could have given me in advance (known issue and I've even attached a long note with all the behaviours). As I find an absolute naughtiness. You want to leave something to the professionals and the only thing you get is an unfriendly mail contact (you don't even want to make a phone call there, trust me)... But enough ranting. That was the last time I sent something private in for repair that is for sure. Nobody there can do anything except exchange whole devices or write inspection fees for things that they cannot prove to me or when they are just guessing.

So I have the self-made problem of defective headphones, and unnecessary additional costs and no time to spend. Any normal person would stop at this point and either throw the headphones away or sell them. But that is out of question for me.

[starting with the actual repair]
After some research I found a teardown with datasheets for the headphones. The charging is done by a BQ27421 from TI and the battery is charged by a MP2625 from MPS. So the BQ27421 was my first candidate. This IC is accessed via I2C (from an Atmel chipset on the same board, which also processes the touch functions simultaneously). After I measured the resistors around the chip the orientation of the chip was clear to me and the two data lines lead past the battery connector to the other side (see picture).

Before the two data lines disappear into the board there are two test pads which give you good access to them. So I quickly soldered some cables to them and connected my logic analyzer. (If you want access to the samples that I took let me know). A good ground point can also be found in the photo (red cable). I took a few samples and started reverse enginieering. You always feel like a researcher at archaeological excavations. Always looking for what the engineers who were there before were doing.

After some pen and paper processing I was able to decode the actual measured battery voltage, state of charge (SOC), state of health (SOH) and many more parameters. Interestingly, the transmitted voltage was only 3100 mV which was definitely not correct because the battery was fully charged (so should be about 4V). So I felt encouraged to be on the right track. I wrote some code for an atmega328 which also connects to the I2C bus and can communicate with the battery management and the Atmega supervisor. After a bit of trial and error this solution was quite fast (about 2h into the repair). Now I was able to read the values live and also execute actions myself. I should have mentioned earlier that sometimes the headphones can be switched on for unexplainable reasons until you leave them off for a while. So I was able to log during normal operation and in case of an error. Sometimes the battery management reported a SOH of 0% which made me suspicious. Since the Atmega master on the board resets the chip when values that have been set before are wrong (I know this from my paper pen reverse) I decided to simply make hard reset requests as soon as I read a faulty status. These were accepted by the chip immediately but did not solve the problem. I tried many things at this point that all failed. Therefore I will omit them from this documentation. However all in all a quite interesting and satisfying thing to be able to see what ist going on.
Here a short video of the live output working during the speakers in normal operation. I'll continiue this as soon as possible I promise.

LS220D Serial interface

After some research I actually found the serial interface connections on the Buffalo LS220D.  Discussion and Datasheets over here: https://github.com/1000001101000/Debian_on_Buffalo/issues/52

The image is copyright free to use!

For logfiles or the full res image: https://drive.google.com/drive/folders/1rYEgoIc2LDBapYcMtrX-bgB10CaHhF_L?usp=sharing

Epson WF-2760 Error 0x9A fix and others

Today I repaired an Epson Wf-2760 and thought, since it took me a long time to find information myself, I would like to show you my solution here.
Unfortunately, the whole thing is not really documented in pictures, because I did not expect to have to repair anything at all. But as always with things I buy: There is something to repair...

Since we needed a new fax machine and the prices for these simple devices went extremely high (since the sales figures have probably fallen considerably) I looked around for alternatives. Since I myself use an Epson WF-2630 all in one as my copier (besides the Ricoh color laser of course which you can find more information about here ;-) ), I started looking for cheap used machines for these series. I came up with a bundle of 3 printers (two WF-2760 and one WF-2630) for free to pickup nearby. They where listed as "not printing condition". So I contacted the Seller and picked them up, thinking that I only need the fax function to work (digital fax reception only so no printouts needed). After an hour and a half of driving and traffic jam I had the printers at my home and got a fright, because the devices already lost the first screws when opening. But for free still justifiable. So I reassembled all loose parts and wanted to plug in the first printer. I had to find out that the printer already had no power supply. So further to the next... This one could actually be switched on, but then it threw an unrecoverable error. The error message called the error code 0x9A which you 'should' find in the documentation. I thought it would be great if you could read the codes directly from the manual. Full of anticipation for a quick troubleshooting I went to search for the code and had to find out that Epson itself did not list the error codes.
After a long search I had to find annoyed users in forums that have the same problem after a paper jam. But most often you can find that there is an error with the print head. The previous owner had already disassembled it and then obviously did not successfully break it off and gave it away in parts. So I thought to myself okay shit, all the driving for nothing. A new print head would not be worth the price and I would not even be sure that it is really the fault and not more things are defective. Shortly before I wanted to give up after hours of cleaning contacts, plugs and flat ribbon cables I found this forum entry which showed a debug software where the error 0x9a was also listed as a circuit error on the motherboard. So as a last resort, I ripped the motherboard out of the printer without power supply and took a close look at it. Then I looked for fuses and found the fuse F1.

The entire main board (pretty nicely made for the price!)

Faulty fuse before replacing it

After measuring this fuse it was clear to me I have the error! Since it was already late I postponed the further repair to the next afternoon. I bridged the fuse and assembled the printer so far that I could at least switch it on. I now got another fatal error but the print carriage moved very easily. So I realized that I probably fixed the error completely. So I started to build a complete printer with the remaining parts of the two WF-2760. This was successful after a lot of trial and error. If you want to do such a repair, take a look at this video, which will help you with the disassembly...

Full credits to the original maker of the video! It helped me a lot to find the matching screw holes for all the loose screws in my printer.

In the end I had a visually complete printer. So switch it on and see with a sharp eye what's going on. No smoke, no strange noises. Only a quiet noise of the print head while driving back and forth. And I had a main menu in front of me with all the functions that were important to me. I then checked the printer for function and everything works as it should. I would not recommend this repair to a beginner but people who can use a screwdriver, soldering iron and want to save a lot of money are sure to get what they want. After the repair I found the tool which was used in the screenshot in the forum. You can find it here. Very very useful if you want to maintain such a device or just want to know what a certain error code means. I hope I can help some people with this problem and I would appreciate feedback if you try it. I was not lucky enough to find this method on the net but I hope that my hours will be worth it for others.

Happy Stefan after first successful startup