[Part 1] Sony WH-1000XM3 Not turining on

PART 1 Hacking my way into the battery management

[somewhat off topic]
First a little story on how I got myself into fixing a pair of headphones. Due to the global pandemic I currently have to study at home. The problem here is that if you live on a busy street, the daily street noise keeps you off track every now and then. So I spent the last months with my simple Apple earpods to block the noise with music. The problem with these earpods is that they become uncomfortable after a while and the cable in front of you on the table is always in the way. Of course small problems but when you are confronted with this problem for hours every day it becomes a big problem. Therefore I have been looking for new headphones. However the really good ones are very expensive. At some point I had the idea to look for broken good ones. There I also found them very quickly. The problem from the article description was "cannot be switched on". Usually these kind of problems are caused by a unhealthy battery or problems with the battery management.

As soon as I got them I first tried the reset variants noted by Sony but the headphones didn't react to them at all. So the next thing I did was to open the left headphone. This is done by simply removing the ear pads and the foam underneath. After unplugging the flat ribbon cable for the touch interface the battery is already exposed. First I removed the battery and measured the voltage with my multimeter. A cell voltage of 3.9V is still full enough to work propaly. But to bei sure I discharged the battery with my charger and charged it afterwards. Thereby I can determine the remaining capacity of the battery. From the 1000 mAh labeled on the battery approx. 920 mAh went in. So the battery was definitely not the problem. Because the battery was not plugged in for some time now the remaining charge in the headphones should have been discharged. So I tried to switch on the headphone. And it worked at the first try! I thought okay that was probably the problem. It was probably just the battery management that was wrong with the cell charge. I used the headphones and was very pleased with the performance. The next day I wanted to switch them on again but unfortunately they were dead again. So I unscrewed the left earphone again and disconnected the battery. Unfortunately this was not successful. Also further attempts with very long disconnection times do not need success.

[rant]
Because I didn't really have the time to work on the device I decided to send it in for service. I thought with the price I would be cheaper even with repair. It seems that Sony itself does not repair their own products and so I had to send the headphones to their German support center which is not owned by them. After about one week of sending it in, I got a cost proposal with the content: "Repair not possible, because the spare parts are not available". On request I found out that it would be the motherboard. At this point I was very sure that the company had neither disassembled the headphones nor could they repair anything on the headphones beyond a battery. Ridiculous to call such thing a service. Well, I was then allowed to pay an inspection fee and the return shipping. A total of over 50€ for a statement that they could have given me in advance (known issue and I've even attached a long note with all the behaviours). As I find an absolute naughtiness. You want to leave something to the professionals and the only thing you get is an unfriendly mail contact (you don't even want to make a phone call there, trust me)... But enough ranting. That was the last time I sent something private in for repair that is for sure. Nobody there can do anything except exchange whole devices or write inspection fees for things that they cannot prove to me or when they are just guessing.

So I have the self-made problem of defective headphones, and unnecessary additional costs and no time to spend. Any normal person would stop at this point and either throw the headphones away or sell them. But that is out of question for me.

[starting with the actual repair]
After some research I found a teardown with datasheets for the headphones. The charging is done by a BQ27421 from TI and the battery is charged by a MP2625 from MPS. So the BQ27421 was my first candidate. This IC is accessed via I2C (from an Atmel chipset on the same board, which also processes the touch functions simultaneously). After I measured the resistors around the chip the orientation of the chip was clear to me and the two data lines lead past the battery connector to the other side (see picture).

Before the two data lines disappear into the board there are two test pads which give you good access to them. So I quickly soldered some cables to them and connected my logic analyzer. (If you want access to the samples that I took let me know). A good ground point can also be found in the photo (red cable). I took a few samples and started reverse enginieering. You always feel like a researcher at archaeological excavations. Always looking for what the engineers who were there before were doing.

After some pen and paper processing I was able to decode the actual measured battery voltage, state of charge (SOC), state of health (SOH) and many more parameters. Interestingly, the transmitted voltage was only 3100 mV which was definitely not correct because the battery was fully charged (so should be about 4V). So I felt encouraged to be on the right track. I wrote some code for an atmega328 which also connects to the I2C bus and can communicate with the battery management and the Atmega supervisor. After a bit of trial and error this solution was quite fast (about 2h into the repair). Now I was able to read the values live and also execute actions myself. I should have mentioned earlier that sometimes the headphones can be switched on for unexplainable reasons until you leave them off for a while. So I was able to log during normal operation and in case of an error. Sometimes the battery management reported a SOH of 0% which made me suspicious. Since the Atmega master on the board resets the chip when values that have been set before are wrong (I know this from my paper pen reverse) I decided to simply make hard reset requests as soon as I read a faulty status. These were accepted by the chip immediately but did not solve the problem. I tried many things at this point that all failed. Therefore I will omit them from this documentation. However all in all a quite interesting and satisfying thing to be able to see what ist going on.
Here a short video of the live output working during the speakers in normal operation. I'll continiue this as soon as possible I promise.