The 31.9 mm puck opened: the Nordic nRF52832 BLE SoC and its NFCT peripheral, the Apple U1 UWB responder, the NXP NT3H2111 NTAG-I²C-plus front-end (Type-2 / 14443-A, pinned), the voice-coil speaker that doubles as the battery interlock, the CR2032 power tree and its one-year current budget, and how three radios and three antennas coexist in an 8 mm coin

5.1 About this Volume

The three theory volumes are done. Vol 2 dissected the BLE offline-finding mechanism — the rotating NIST P-224 key in a FF 4C 00 12 … advertisement; Vol 3 covered the Ultra-Wideband Precision Finding radio — Apple’s U1, the 802.15.4z HRP PHY, two-way ranging and angle-of-arrival; Vol 4 covered the NFC tap, Lost Mode, and the separated-state anti-stalking beaconing that bridges into the detection half. Each of those volumes pointed here for the physical embodiment: “the nRF52832 of Vol 2 — the power tree that enforces its duty cycle is Vol 5”; “the U1 package, antennas, and PCB are the AirTag teardown in Vol 5”; “the exact NFC tag platform Apple uses is identified at the silicon level in the Vol 5 teardown.” This volume pays those debts. It is the hardware volume: open the puck, name every part, place it on the board, and show how three radios and a coin cell share an 8 mm-thick, 31.9 mm-diameter enclosure.

This is a teardown, and a teardown without photographs is a parts list. The reader is an EE with a full PCB-fab and assembly lab; the load-bearing artifacts here are the board photos — exterior, PCB top, PCB bottom, exploded view — and they are deliberately left as FIGURE SLOT placeholders, to be filled the day a unit goes on the bench under a microscope (per the spec’s bench trajectory). Until then, the diagrams (a labeled board-block, an antenna-layout map, an exploded stack-up) and the tables (a full BoM with part numbers, a power budget, a teardown-step sequence) carry the structure, and every silicon identification is footnoted to a published teardown or a vendor datasheet rather than asserted from a bench you do not yet have.

Spec-sourced, grounded in published teardowns. As of 2026-06-25 no AirTag is on the bench, so nothing here is a bench measurement. It does not need to be: the AirTag has been torn down publicly and exhaustively. The anchor references are iFixit’s AirTag teardown^[iFixit, AirTag Teardown, May 2021 — https://www.ifixit.com/Teardown/AirTag+Teardown/142309. Identifies the main PCB, the Nordic nRF52832 BLE SoC, the Apple-marked U1 UWB die, the NXP NFC front-end, the magnet/voice-coil speaker assembly that doubles as the battery interlock, and the CR2032 holder. The board-placement and “speaker is structural” observations in §2, §3, §7 are from this teardown and its photo set.] and the silicon vendors’ own datasheets — the Nordic nRF52832 Product Specification^[Nordic Semiconductor, nRF52832 Product Specification v1.4 (and Objective Spec). ARM Cortex-M4F @ 64 MHz; QFAA variant = 512 kB flash / 64 kB RAM; 2.4 GHz multiprotocol radio (BLE 5, –96 dBm BLE-1M sensitivity, +4 dBm max TX); NFC-A tag peripheral (NFCT) on the NFC1/NFC2 pins. Page-level figures cited in §4 are from this document.] and the NXP NT3H2111 (NTAG I²C plus) datasheet^[NXP Semiconductors, NT3H2111/NT3H2211 — NTAG I²C plus, NFC Forum Type 2 Tag compliant IC with I²C interface, data sheet. The part is an ISO/IEC 14443 Type A, NFC Forum Type-2 tag with a passive RF interface to the phone and an I²C interface to a host MCU, sharing a pass-through SRAM and offering field-detect + energy-harvest outputs. The NFC-type determination in §6 is from this datasheet.]. Where the exact part number or variant is not nailed down by a public teardown — most notably the precise NXP NTAG marking and the U1’s package details — this volume states the function, gives the most likely part, and flags it “per iFixit teardown / to confirm on bench” rather than inventing a number. Where a Vol 3/Vol 4 theory point recurs, it is cross-referenced, not re-derived.

This volume also settles one open question the theory volumes deliberately left dangling. Vol 4 §2.1 called the AirTag’s NFC interface a “Type-2/Type-5-class tag” and explicitly deferred the silicon identification to here. §6 pins it: the AirTag NFC is an NFC Forum Type-2 / ISO-IEC 14443-A tag — a 13.56 MHz NTAG-class part, not an ISO 15693 / Type-5 vicinity tag. That distinction matters to anyone building a reader (Vol 12), so it gets its own section.

5.2 The mechanical package

Before the board, the box it lives in — because on the AirTag the box is not inert packaging. The stainless cover is a battery door and an acoustic surface; the white plastic shell is structure and the RF window the three antennas radiate through. Mechanical and electrical design are unusually fused in a device this small.

5.2.1 Dimensions, mass, and ingress rating

The headline mechanicals, from Apple’s published specification^[Apple, AirTag — Technical Specifications, https://www.apple.com/airtag/specs/. Diameter 31.9 mm, height 8.0 mm, weight 11 g (0.39 oz); IP67 (max depth 1 m, up to 30 min) per IEC 60529; user-replaceable CR2032 coin cell; Bluetooth, Apple-designed U1 with Ultra Wideband, NFC tap for Lost Mode. The “Precision Finding requires U1-equipped iPhone” note ties back to Vol 3 §4.]:

Table 1 — The headline mechanicals, from Apple's published specification^[Apple, AirTag — Technical Specifications, https://www.apple.com/airtag/specs/. Diameter 31.9 mm, height 8.0 mm, weight 11 g (0.39 oz); IP67 (max depth 1 m, up to 30 min) per IEC 60529; user-replaceable CR2032 coin cell; Bluetooth, Apple-designed U1 with Ultra Wideband, NFC tap for Lost Mode. The "Precision Finding requires U1-equipped iPhone" note ties back to Vol 3 §4.]

Parameter	Value	Note
Diameter	31.9 mm	A hair under a US quarter (24.3 mm) is smaller; closer to a 10-pence coin
Height (thickness)	8.0 mm	Coin-cell-thick — the CR2032 (3.2 mm) plus board plus contacts sets the floor
Mass	11 g	Most of it the stainless cover and the cell
Ingress protection	IP67	Dust-tight; 1 m immersion, ≤ 30 min (IEC 60529)
Battery	CR2032, user-replaceable	3 V Li/MnO₂ coin cell, twist-off access (§8)
Operating range	BLE ~tens of m; UWB ~0.1–10 m (Vol 3 §7.4)	Two radios, two ranges

The 8.0 mm thickness is almost entirely set by the coin cell: a CR2032 is 3.2 mm thick on its own, and once you stack the sprung contacts, the main PCB, the speaker magnet, and two enclosure walls, 8 mm is about as thin as this electro-mechanical sandwich goes without going to a thinner (and lower-capacity) cell. This is the same packaging logic Vol 8 will revisit when comparing the credit-card-format tags (Chipolo CARD, Tile Slim) — they trade the CR2032 for a thin sealed LiPo and give up user-replaceable batteries to hit a 2–3 mm card profile.

[FIGURE SLOT — Vol 5, § 2.1] Exterior hero shot of an Apple AirTag: the polished white plastic dome on top, the brushed stainless-steel cover on the bottom, ideally with a coin alongside for scale. A second angle showing the seam between the two enclosure halves. Source: Photo Helper Commons/Openverse search “Apple AirTag” (product class) — or Apple’s product page imagery, credited, if Commons is thin. Caption when filled: “Figure 5.1 — The AirTag exterior: white plastic top (the RF-transparent antenna window) and removable stainless-steel cover (battery door and speaker surface). 31.9 mm diameter, 8.0 mm thick, 11 g. Photo: . .“

5.2.2 The two-piece enclosure and the stainless cover

The enclosure is two parts that meet at a press-and-twist bayonet:

The white plastic top is the larger structural half — a polished polycarbonate-class dome that houses the PCB and the antenna structures. It is the device’s RF window: BLE (2.4 GHz), UWB (6.5–8 GHz), and NFC (13.56 GHz… 13.56 MHz) all radiate through it, so it is deliberately a low-loss dielectric with no metal in the radiating apertures. This is why the visible top is plastic and not the same steel as the bottom — you cannot radiate three antennas through a metal can.
The stainless-steel cover is the bottom: a removable, polished cap that the user presses down and twists counter-clockwise to release (the same gesture as a child-proof pill bottle). It is the battery door, the ground/return surface against the cell’s positive terminal path, and — crucially — part of the acoustic system: the speaker’s voice coil drives the enclosure, and the steel cover is a stiff surface the trapped-air resonance loads against (§7.1). The cover carries the regulatory/serial laser-etch and, on engraved units, the personalization.

The two halves seal against a gasket to make the IP67 rating: dust-tight and good for 1 m of immersion for half an hour. The seal is the reason battery replacement is the one user-serviceable operation but disassembly past that is destructive — once you pry the plastic top off its ultrasonic welds / adhesive (§10) you have broken the ingress seal for good.

5.2.3 The stack-up, top to bottom

The internal stack, from the white dome down to the steel cover, is a tight electro-mechanical sandwich. This is the exploded view an assembler wants:

   AirTag exploded stack-up (top → bottom)
   ════════════════════════════════════════

   ┌───────────────────────────────────────┐  ① WHITE PLASTIC TOP
   │   polished dome — the RF window         │     (houses PCB; antennas
   │   (BLE / UWB / NFC all radiate through)  │      radiate through it)
   └───────────────────────────────────────┘
                    │  NFC coil bonded to inner wall / on flex
                    ▼
   ┌───────────────────────────────────────┐  ② MAIN PCB (double-sided)
   │  TOP:  nRF52832 (BLE+MCU) · U1 (UWB)     │     ── the silicon (§3,§4,§5)
   │  BOT:  NXP NTAG · passives · contacts    │     ── §6 + power tree
   └───────────────────────────────────────┘
                    │  spring contacts to cell
                    ▼
   ┌───────────────────────────────────────┐  ③ SPEAKER / MAGNET ASSEMBLY
   │  voice coil + ring magnet — also the     │     (acoustic driver AND the
   │  mechanical seat the battery presses on  │      battery "interlock", §7)
   └───────────────────────────────────────┘
                    │  CR2032 sits in the magnet well, + up
                    ▼
   ┌───────────────────────────────────────┐  ④ CR2032 COIN CELL (3 V)
   │  user-replaceable; + terminal to cover   │     (§8)
   └───────────────────────────────────────┘
                    │  press-and-twist bayonet + gasket (IP67)
                    ▼
   ┌───────────────────────────────────────┐  ⑤ STAINLESS-STEEL COVER
   │  battery door · ground return · speaker  │     (removable; §2.2)
   │  surface · laser-etched serial           │
   └───────────────────────────────────────┘

The single most-quoted observation from the iFixit teardown is that the speaker magnet assembly (③) is structural: the coin cell drops into the well formed by the ring magnet, and the speaker is therefore both the acoustic transducer and the mechanical seat the battery presses against. That dual role is why third-party “silent AirTag” mods that disconnect or remove the speaker have to be done carefully — you are modifying a part that also holds the battery (§7.3).

[FIGURE SLOT — Vol 5, § 2.3] Exploded view of the AirTag: white top, main PCB, speaker/magnet assembly, CR2032, steel cover — laid out in stack order on a neutral surface, ideally annotated. Source: Photo Helper Commons/Openverse search “AirTag teardown exploded” — or an iFixit teardown frame credited reference-only if no CC image exists. Caption when filled: “Figure 5.2 — Exploded stack-up: ① white RF-window top, ② main PCB, ③ speaker/magnet assembly (also the battery seat), ④ CR2032, ⑤ stainless cover. Photo: . .“

5.3 The board-block architecture

The AirTag main PCB is a small, dense double-sided board carrying three radios, one MCU (which is one of the radios), an NFC tag IC, and the power/contact structures, with the antennas distributed around and through the enclosure. This section is the map; §4–§9 zoom into each block.

5.3.1 The labeled board block

This is the required board-block diagram: which chip does what, and how the three radios connect. The nRF52832 is the brain and the BLE radio at once; the U1 is a co-processor radio it wakes over a control bus; the NXP NTAG is a passive tag it updates over I²C.

   AirTag main-board block diagram — three radios + one MCU
   ════════════════════════════════════════════════════════

                         ┌──────────────────────┐
        BLE antenna ◄────┤  Nordic nRF52832      │
        (2.4 GHz,        │  ARM Cortex-M4F 64MHz │
         §9.2)           │  512 kB flash/64 kB RAM│
                         │  ── THE BRAIN ──       │
                         │  • Find My firmware    │
                         │  • rotating-key engine │
                         │  • BLE 5 advertiser    │ (Vol 2)
                         │  • drives speaker      │
                         │  • owns the power state │
                         └──┬─────────┬────────┬──┘
                            │ control │ I²C    │ GPIO/PWM
                            │  (SPI/  │        │ (audio
                            │  UART)  │        │  drive)
                            ▼         ▼        ▼
              ┌───────────────┐ ┌──────────┐ ┌─────────────┐
   UWB    ◄──┤ Apple U1      │ │ NXP NTAG │ │ Speaker      │
   antenna   │ UWB responder │ │ I²C plus │ │ voice coil + │
   (6.5–8GHz, │ 802.15.4z HRP │ │ NT3H2111 │ │ ring magnet  │
   §9.3)     │ (Vol 3)       │ │ (§6)     │ │ (§7)         │
              └───────────────┘ └────┬─────┘ └─────────────┘
                                     │ RF (13.56 MHz)
                                     ▼
                              NFC coil antenna ──► phone tap
                              (loop, §9.4)         (Vol 4)

                         ┌──────────────────────┐
                         │  CR2032  3 V coin cell │──► powers all of the above
                         │  via sprung contacts   │    (power budget §8.2)
                         └──────────────────────┘

Three things to read out of that diagram:

The nRF52832 is both the MCU and the BLE radio. There is no separate Bluetooth chip — the Nordic part runs the Find My firmware (the rotating-key derivation of Vol 2 §4), is the BLE 5 advertiser, drives the speaker, and is the master that wakes the U1 and writes the NTAG. Everything else hangs off it.
The U1 is a slave radio woken on demand. It does nothing until the nRF — at the behest of a Precision Finding session (Vol 3 §7.1) — tells it to wake and range. It is the responder end of the UWB link; all the geometry happens in the phone.
The NTAG runs even when everything else is asleep. Because the NXP front-end is RF-powered from the phone’s field, the Lost-Mode tap (Vol 4) works whether or not the nRF is awake or the battery is even good — the phone energizes the tag. The nRF only needs to have written the current NDEF content into the NTAG’s SRAM beforehand (§6.3).

5.3.2 Who talks to whom — the interconnect

The buses between the blocks, with the caveat that the exact pin assignments are not published by Apple and would be confirmed by probing on the bench:

Table 2 — The buses between the blocks, with the caveat that the exact pin assignments are not published by Apple and would be confirmed by probing on the bench

Link	Bus	Master	Slave	Purpose	Confidence
nRF ↔ U1	SPI or UART + IRQ/wake (likely)	nRF52832	U1	Wake UWB, hand it the ranging-session parameters, read status	Function certain; bus per-bench
nRF ↔ NTAG	I²C	nRF52832	NT3H2111	Write the Lost-Mode NDEF / URL into the tag’s SRAM; read field-detect	Datasheet: NTAG I²C plus is an I²C device
nRF → speaker	GPIO/PWM → driver	nRF52832	voice coil	Play the locate chirp / anti-stalking sound	Function certain
cell → all	power rails	—	—	3 V from CR2032 through sprung contacts	Certain
nRF ↔ BLE ant	RF (matching net)	—	—	2.4 GHz transmit (advertising)	Certain
U1 ↔ UWB ant	RF (matching net)	—	—	6.5–8 GHz impulse radio	Certain
NTAG ↔ NFC coil	RF (13.56 MHz)	—	—	The phone-tap RF interface + RF harvest	Certain

The I²C link from the nRF to the NTAG is the architecturally interesting one and the reason the part is specifically an NTAG I²C plus and not a plain NTAG: it has two faces. The nRF writes to it over I²C (so the Lost-Mode message and the rotating identifiers can be kept current), and the phone reads the same memory over RF (§6.3). A plain Type-2 NTAG with only an RF interface could not be updated by the host MCU.

5.3.3 The bill of materials

The required BoM. Part numbers for the active silicon are from the iFixit teardown and the vendor datasheets; passives and the exact NTAG/U1 markings are “to confirm on bench.” Datasheet refs point at the document that grounds each row.

Table 3 — 3.3 The bill of materials

#	Component	Part / marking	Function	Datasheet / ref
1	BLE SoC + MCU	Nordic nRF52832 (QFAA, QFN-48 6×6 mm)	The brain: Find My firmware, rotating-key engine, BLE 5 advertiser, speaker driver, system power state	Nordic nRF52832 PS (§4)
2	UWB radio	Apple U1 (Apple-marked die)	802.15.4z HRP UWB responder for Precision Finding	Apple-designed; teardown-ID’d (§5; Vol 3 §4.1)
3	NFC front-end	NXP NT3H2111 — NTAG I²C plus	Passive Type-2 / 14443-A tag for the Lost-Mode tap; I²C-writable by the nRF	NXP NT3H2111 DS (§6)
4	Acoustic driver	Voice-coil speaker + ring magnet assembly	Locate chirp + anti-stalking sound; also the structural battery seat	iFixit teardown (§7)
5	Power source	CR2032 Li/MnO₂ coin cell, 3 V, ~225 mAh	Primary power; user-replaceable	IEC 60086 / cell vendor DS (§8)
6	Battery contacts	Sprung leaf/clip contacts (BeCu likely)	Cell + and − to the board; tolerate twist-cover removal	iFixit teardown (§8.1)
7	BLE antenna	PCB/flex trace (IFA/meander)	2.4 GHz radiating element	§9.2
8	UWB antenna	Dedicated UWB element (patch/monopole)	6.5–8 GHz radiating element for the U1	§9.3
9	NFC coil	Multi-turn loop (PCB or wound, on inner wall)	13.56 MHz inductive coupling + RF harvest	§9.4
10	32.768 kHz xtal	Low-frequency crystal	RTC / sleep timebase for the duty-cycled wake	Nordic PS LFXO (§4, §8)
11	32 MHz xtal	High-frequency crystal	nRF radio reference clock (HFXO)	Nordic PS HFXO (§4)
12	Matching nets	L/C passives per radio	Antenna impedance matching for each band	§9
13	Decoupling	MLCC bypass caps	Rail decoupling across the 3 V tree	§8

[FIGURE SLOT — Vol 5, § 3.3] PCB top side, high-resolution, square-on: the nRF52832 and the Apple-marked U1 die, the crystals, the BLE/UWB matching networks. Annotate the chip markings. Source: Photo Helper Commons/Openverse search “AirTag PCB” / “AirTag board” — or iFixit teardown frame credited reference-only. Caption when filled: “Figure 5.3 — Main PCB, top side. ① Nordic nRF52832 (BLE SoC + MCU). ② Apple U1 (UWB). ③ HF/LF crystals. ④ per-radio matching networks. Photo: . .”

[FIGURE SLOT — Vol 5, § 3.3] PCB bottom side: the NXP NTAG front-end, the battery spring contacts, decoupling passives, and the NFC-coil bonding points. Source: Photo Helper Commons/Openverse search “AirTag PCB back” — or iFixit teardown frame credited reference-only. Caption when filled: “Figure 5.4 — Main PCB, bottom side. ① NXP NT3H2111 NTAG. ② battery spring contacts. ③ decoupling. ④ NFC-coil pads. Photo: . .“

5.4 The BLE SoC — Nordic nRF52832

The single most important part in the AirTag, and the one cross-referenced most by the rest of the series: every byte of the Find My advertisement Vol 2 dissected is emitted by this chip, and every rotating-key derivation of Vol 2 §4 runs on its Cortex-M4. Treat this section as the datasheet-grade walk the brief asks for.

5.4.1 The QFAA variant and its memory

The nRF52832 is a multiprotocol 2.4 GHz SoC built around an ARM Cortex-M4 with FPU (M4F) running at up to 64 MHz. It ships in several build codes that differ by memory and package; the AirTag carries the QFAA build^[Build-code naming per the Nordic nRF52832 PS ordering information: the suffix encodes package + memory. QFAA = QFN-48 (6×6 mm, 0.5 mm pitch) with 512 kB flash / 64 kB RAM; QFAB = QFN-48 with 256 kB/32 kB; CIAA = WLCSP. The AirTag’s QFAA identification is from the iFixit teardown chip marking. 512 kB/64 kB is comfortably more than the Find My firmware needs and leaves headroom for OTA-style updates.]:

Table 4 — The nRF52832 is a multiprotocol 2.4 GHz SoC built around an ARM Cortex-M4 with FPU (M4F) running at up to 64 MHz. It ships in several build codes that differ by memory and package; the AirTag carries the QFAA build^[Build-code naming per the Nordic nRF52832 PS ordering information: the suffix encodes package + memory. QFAA = QFN-48 (6×6 mm, 0.5 mm pitch) with 512 kB flash / 64 kB RAM; QFAB = QFN-48 with 256 kB/32 kB; CIAA = WLCSP. The AirTag's QFAA identification is from the iFixit teardown chip marking. 512 kB/64 kB is comfortably more than the Find My firmware needs and leaves headroom for OTA-style updates.]

Attribute	nRF52832-QFAA	Why it matters here
Core	ARM Cortex-M4F @ 64 MHz	Runs Find My firmware + P-224 key math (Vol 2 §4.2)
Flash	512 kB	Firmware + key state + OTA headroom
RAM	64 kB	Working memory; RAM-retention in sleep (§8.2)
Package	QFN-48, 6×6 mm, 0.5 mm pitch	The dominant footprint on the PCB top
Crypto	ARM CryptoCell CC310 (AES, ECC, RNG)	Hardware-accelerates the ECC/AES of Vol 2 §4–§5
NFC	NFC-A tag peripheral (NFCT) on NFC1/NFC2	Present — but not the AirTag’s tap path (§4.3)
Supply	1.7–3.6 V	Runs directly off the CR2032’s 3 V (§8)

The CryptoCell CC310 is worth a beat: the nRF52832 has a dedicated crypto accelerator with AES, ECC over standard curves, and a TRNG. The rotating-key chain of Vol 2 (ANSI X9.63 KDF → scalar diversification on P-224 → SHA-256 indices) is exactly the workload CC310 exists to make cheap on a coin cell. Doing P-224 scalar multiplications in pure Cortex-M4 software every 15 minutes would be a measurable power line item; in hardware it is a blip (§8.2).

5.4.2 The 2.4 GHz radio

The radio is a single-ended 2.4 GHz multiprotocol transceiver — it speaks Bluetooth LE (and 802.15.4 / proprietary 2.4 GHz, unused here). The numbers that bound the AirTag’s RF and power behavior^[Nordic nRF52832 PS, radio chapter: BLE-1Mbps sensitivity –96 dBm; on-air rates 1 Mbps (and 2 Mbps / 125 kbps coded in BLE 5); TX power programmable –20 dBm to +4 dBm; RX current ~5.4 mA and TX current ~5.3 mA at 0 dBm (DC/DC on, 3 V). These current figures drive the §8.2 budget. The radio needs an external 32 MHz crystal (HFXO) as its reference.]:

Table 5 — The radio is a single-ended 2.4 GHz multiprotocol transceiver — it speaks Bluetooth LE (and 802.15.4 / proprietary 2.4 GHz, unused here). The numbers that bound the AirTag's RF and power behavior^[Nordic nRF52832 PS, radio chapter: BLE-1Mbps sensitivity –96 dBm; on-air rates 1 Mbps (and 2 Mbps / 125 kbps coded in BLE 5); TX power programmable –20 dBm to +4 dBm; RX current ~5.4 mA and TX current ~5.3 mA at 0 dBm (DC/DC on, 3 V). These current figures drive the §8.2 budget. The radio needs an external 32 MHz crystal (HFXO) as its reference.]

Radio parameter	Value	Consequence
Protocol	BLE 5 (1 Mbps used for adverts)	The `ADV_NONCONN_IND` of Vol 2 §2.2
RX sensitivity	–96 dBm (BLE 1 Mbps)	Sets how far a finder can hear it
TX power	–20 … +4 dBm programmable	AirTag advertises modestly to save power
TX current	~5.3 mA @ 0 dBm, DC/DC on, 3 V	The dominant active draw (§8.2)
RX current	~5.4 mA @ 3 V	Mostly irrelevant — a separated AirTag rarely listens
HF reference	external 32 MHz crystal (HFXO)	BoM #11

The architecturally key point for power (§8): a separated AirTag is a pure advertiser. It does not scan, does not maintain a connection, and spends ~99.9 % of its life in deep sleep, waking on its 32.768 kHz RTC tick to fire one advertising event (three channels) roughly every two seconds and then dropping straight back to sleep. The radio is hot for single-digit milliseconds per wake. That duty cycle, multiplied by the 5 mA TX figure above, is what the one-year budget is built on.

5.4.3 The NFCT peripheral — and why it is not the tap path

Here is a subtlety worth pinning, because it is a natural place to get the architecture wrong. The nRF52832 has its own NFC-A tag peripheral, the NFCT, brought out on the dedicated NFC1 / NFC2 pins (which double as GPIO if NFC is unused)^[Nordic nRF52832 PS, NFCT chapter: an NFC-A listen-mode (tag) peripheral, ISO/IEC 14443-A Type-2-tag-capable, 13.56 MHz, antenna across NFC1/NFC2 with two external tuning caps. It is a tag (card-emulation/listen) peripheral, not a reader. On the nRF it is commonly used for “tap-to-pair” / OOB Bluetooth pairing bootstrap.]. So in principle the nRF could be the AirTag’s NFC tag, with no separate NXP chip — tie an antenna and two caps across NFC1/NFC2 and you have a Type-2 tag.

The AirTag does not do that. It carries a dedicated NXP NTAG front-end (§6) instead, and the reason is power and availability: the nRF’s NFCT only works when the nRF is powered and at least in a listening state, whereas the NXP NTAG is a fully passive, RF-harvesting tag that the phone energizes from its own field — so the Lost-Mode tap reads even if the AirTag’s battery is dead or the nRF is in its deepest sleep. For a found-item contact path (Vol 4), “works on a dead battery” is a feature you want, and it is exactly what a separate passive NTAG buys you that the host MCU’s on-die NFCT cannot. The nRF’s NFCT is present on the silicon but, on the evidence of the dedicated NXP part, is not the tap path. (This is the kind of design decision that only a teardown settles — confirm on the bench which pins are populated.)

5.4.4 Why an nRF52832 and not something cheaper

An obvious EE question: why a 512 kB Cortex-M4F with a crypto accelerator for a beacon that mostly shouts 31 bytes? Because the workload is not “shout 31 bytes” — it is “derive a fresh P-224 keypair every 15 minutes, drive a speaker, wake and coordinate a UWB co-processor, update an NFC tag, and do it all on µA-average power for a year.” The Cortex-M4F + CC310 makes the ECC cheap; the 512 kB flash holds firmware plus update headroom; the deep-sleep current (single-digit µA with RAM retention) makes the budget close. This is also exactly the chip class the DIY world reaches for: an OpenHaystack / Macless-Haystack beacon runs on an nRF51822 / nRF52832 or an ESP32 (Vol 10) — the AirTag is, at the silicon level, a polished version of the same nRF-class beacon you can flash yourself, plus the U1 and the NXP NTAG the DIY build omits.

[FIGURE SLOT — Vol 5, § 4.1] A bare Nordic nRF52832 (QFN-48) on a dev board or reel, to put a face on the silicon class. (Generic component shot — license-clean.) Source: Photo Helper Commons/Openverse search “nRF52832 QFN” / “nRF52832 module”. Caption when filled: “Figure 5.5 — A Nordic nRF52832 (QFN-48, 6×6 mm) — the BLE SoC + Cortex-M4F at the heart of the AirTag, and the same silicon class a DIY OpenHaystack beacon uses (Vol 10). Photo: . .“

5.5 The UWB silicon — Apple U1 responder

Vol 3 is the UWB theory volume — the 802.15.4z HRP PHY, the channel-5/9 plan, two-way ranging, angle-of-arrival. This section covers the U1 strictly as a board component: what it is on the PCB, how it connects, and the asymmetry that makes the AirTag’s U1 a far simpler thing than the iPhone’s.

5.5.1 The U1 as a board component

The U1 is an Apple-designed UWB die, marked as an Apple part on teardowns rather than a third-party silicon vendor’s^[The U1 in the AirTag is identified in teardowns (iFixit; TechInsights/System Plus die analyses of the iPhone 11-era U1) as an Apple-marked UWB IC implementing 802.15.4z HRP on channels 5/9. Apple publishes no U1 datasheet; package, antenna count, and interface to the host MCU are teardown-reported or inferred, not from an Apple document. See Vol 3 §4.1 for the silicon background.]. On the AirTag board it sits on the PCB top near the nRF52832, with its own RF matching network out to the UWB antenna (§9.3) and a control/data link back to the nRF (§3.2). It is asleep almost always; the nRF wakes it only for a Precision Finding session (Vol 3 §7.1), which is why it contributes essentially nothing to the battery budget (§8.2) — UWB is a seconds-at-a-time, owner-initiated burst, not a duty-cycled always-on radio like the BLE side.

5.5.2 Single-antenna responder, not an anchor

The defining hardware fact, carried over from Vol 3 §6.1 and stated here as a board observation: the AirTag’s U1 drives a single UWB antenna and computes no geometry. It is the responder in the ranging exchange — it receives the phone’s POLL, waits a known turnaround, and transmits a RESPONSE (Vol 3 §5.2). All the range math (two-way time-of-flight) and all the bearing math (multi-antenna angle-of-arrival) happen in the iPhone’s U1/U2, which has the multi-antenna array. This asymmetry is why a $29 coin-cell AirTag can carry “the same U1” as a flagship iPhone: the expensive part — the antenna array and the AoA DSP — lives in the phone you already own; the tag just answers.

For the teardown that means: expect one UWB antenna element and a relatively simple RF front-end around the U1, not the three-antenna array you would find tearing down an iPhone. (Confirm the antenna count on the bench — it is the single cleanest way to verify “responder, not anchor” physically.)

5.6 The NFC front-end — NXP NT3H2111

This section settles the question Vol 4 §2.1 deferred. The AirTag’s NFC tap is served by a dedicated NXP NTAG-class front-end, and pinning which class it is — Type-2 vs Type-5 — is the load-bearing deliverable for anyone building a reader (Vol 12).

5.6.1 Pinning the part: NTAG I²C plus

The teardown shows an NXP NFC IC on the board; the function (an I²C-writable passive NFC tag) matches NXP’s NTAG I²C plus family, whose canonical part number is the NT3H2111 (1 kB user memory; the NT3H2211 is the 2 kB sibling)^[NXP NT3H2111/NT3H2211 data sheet, NTAG I²C plus. Two interfaces sharing memory: a passive 13.56 MHz NFC Forum Type-2 (ISO/IEC 14443 Type A) RF interface to a reader, and a 400 kHz I²C interface to a host MCU. Features a 64-byte SRAM “pass-through” mailbox, a field-detection pin, and an energy-harvesting output. The exact AirTag marking is teardown-reported as an NXP NTAG-class part; NT3H2111 is the best-match part number and is flagged to-confirm-on-bench.]. The “plus” / I²C variant is the right family specifically because the AirTag needs a host MCU (the nRF) to be able to write the tag’s content over I²C while the phone reads it over RF — a plain NTAG21x with only an RF interface could not be updated by the nRF (§3.2, §6.3).

The exact part number is flagged per iFixit teardown / to confirm on bench — the published teardowns identify “an NXP NFC chip” with confidence but not always the precise marking, and Apple could be using a custom-marked variant. The family (NTAG I²C plus, NT3H21xx) is the right answer; the precise die mark is a bench confirmation.

5.6.2 Type-2 / ISO 14443-A — the ambiguity resolved

Vol 4 §2.1 called the AirTag NFC a “Type-2/Type-5-class tag” and explicitly punted the determination to this teardown. Here is the determination: it is an NFC Forum Type-2 tag, on the ISO/IEC 14443-A (13.56 MHz, proximity) air interface. It is not a Type-5 / ISO 15693 (vicinity) tag. The NT3H2111 datasheet is unambiguous on this — the NTAG I²C plus family is “NFC Forum Type 2 Tag compliant” and “ISO/IEC 14443 Type A.” That settles it.

The distinction is not pedantry; it changes how you build a reader (Vol 12):

Table 6 — The distinction is not pedantry; it changes how you build a reader (Vol 12)

Property	Type-2 / ISO 14443-A (the AirTag)	Type-5 / ISO 15693 (NOT the AirTag)
Air-interface standard	ISO/IEC 14443-A	ISO/IEC 15693
Coupling range class	Proximity (~≤ 10 cm)	Vicinity (~≤ 50–70 cm)
Anticollision / UID	14443-A cascade, NFCID1	15693 inventory, 64-bit UID
NFC Forum tag type	Type 2	Type 5
Typical silicon	NTAG / MIFARE Ultralight class	ICODE / ST25 class
Phone read	Every NFC phone, built-in handler	Most modern phones, but a different stack
Reader you bring (Vol 12)	A 14443-A reader (PN532, Proxmark HF, Flipper NFC)	A 15693 reader

So when Vol 12 has you tap a found AirTag to read its Lost-Mode URL and the last-digits owner contact, you bring an ISO 14443-A reader — the same HF stack that reads a MIFARE Ultralight or any NTAG. The Proxmark3 HF, the Flipper Zero’s NFC app, the iCopy-X HF coil, a PN532 breakout: all 14443-A-capable, all correct for this job. Reach for a 15693 reader and you will tap an AirTag and read nothing.

The Vol 4 §2.1 correction, stated for the record. The AirTag NFC is a 13.56 MHz, NFC Forum Type-2, ISO/IEC 14443-A tag, served by an NXP NTAG I²C plus (NT3H2111-class) front-end — not an ISO 15693 / Type-5 vicinity tag. Vol 4 §2.1’s “Type-2/Type-5-class” hedge should be read as resolved to Type-2 / 14443-A. Any reader-side work (Vol 12) targets the 14443-A stack. (Part-number marking to confirm on bench; the tag type is certain from the NTAG-class datasheet.)

5.6.3 The I²C-to-RF bridge and the shared SRAM

The mechanism that makes “the nRF writes it, the phone reads it” work is the NTAG I²C plus’s dual-ported memory. The tag’s EEPROM/SRAM is reachable from both faces:

I²C side (to the nRF): the nRF, as I²C master, writes the current NDEF message — the Lost-Mode URL (https://found.apple.com/… or the apple.com/airtag deep link), the tag’s identifier, and whatever Lost-Mode contact string the owner set (Vol 4 §2.3). It can update this whenever state changes.
RF side (to the phone): the phone, as a 14443-A reader, energizes the tag from its field and reads the NDEF out — even if the nRF is asleep and even if the battery is flat, because the read is RF-powered from the phone, not from the cell.
The pass-through mailbox + field-detect: the NT3H2111 exposes a 64-byte SRAM “mailbox” and a field-detection signal, so the nRF can be notified that a phone is tapping (field present) and can react — which is the hook Apple uses to log/age the Lost-Mode interaction and update behavior.

This is the whole reason the part is an NTAG I²C plus and not a plain passive NTAG: the two-faced memory is what lets a host-MCU-managed device present a phone-readable, battery-independent contact tag. It is a small, elegant piece of system design — and it is invisible from the outside, which is why it took a teardown to see it.

5.7 The acoustic assembly

The speaker is the AirTag’s most physically interesting part: it is simultaneously a transducer, a structural member, and the center of the device’s biggest controversy. The brief flags it for posture, and it earns the attention.

5.7.1 Voice coil, magnet, and the enclosure as a diaphragm

The AirTag’s sound source is a small voice-coil speaker built around a ring magnet^[iFixit AirTag Teardown: the speaker is a voice coil + magnet assembly seated against the enclosure; the magnet well also forms the seat the CR2032 drops into, making the speaker structural. The AirTag uses the enclosure cavity as the resonating body rather than a discrete cone — a magnet/coil driving the case, closer to a bone-conduction/exciter topology than a classic cone speaker.], not a piezo disc. (Both topologies exist in tracker design; the AirTag is the voice-coil/magnet kind.) The notable bit is that there is no conventional speaker cone — the coil-and-magnet drives the enclosure itself as the radiating surface, with the trapped-air cavity between the plastic top and the steel cover acting as the resonating body. The stiff stainless cover (§2.2) is part of what the system loads against. This is why the AirTag’s chirp has the particular bright, cavity-resonant timbre it does, and why the sound couples efficiently out of such a small package: the whole puck is the speaker.

The structural double-duty is the headline: the ring magnet forms the well the CR2032 sits in (§2.3, ③). So the part that makes sound is also the part that seats the battery — you cannot remove the speaker without disturbing the battery mount, which is precisely what makes the “silent AirTag” mod (§7.3) a careful operation rather than a snip.

5.7.2 What it plays, and the drive path

The nRF52832 drives the voice coil through a GPIO/PWM path and a small driver (§3.2). It plays two functionally distinct sounds:

Table 7 — The nRF52832 drives the voice coil through a GPIO/PWM path and a small driver (§3.2). It plays two functionally distinct sounds

Sound	Trigger	Purpose	Cross-ref
Locate chirp	Owner taps “Play Sound” in Find My, or Precision Finding nears the tag	Help the owner find their own tag by ear	Vol 6 (use)
Anti-stalking sound	A separated tag that has been away from its owner and moving with a stranger, after a delay	Alert a potential victim that an unknown tag is traveling with them	Vol 4 (DULT timing)

The two share the transducer but are policy-distinct: the locate chirp is owner-serving; the anti-stalking sound is victim-serving and is the audible half of the DULT unwanted-tracking countermeasures Vol 4 details (the inaudible half is the Bluetooth alert on the victim’s phone). The hardware is the same coil; the firmware decides when each plays.

5.7.3 The “silent AirTag” modification

This is the posture-sensitive part the brief calls out. Within months of the AirTag’s launch, third-party sellers offered “silenced” AirTags — units with the speaker physically disabled (coil disconnected, magnet/voice-coil removed, or the transducer damped) so the anti-stalking sound cannot play, while BLE/UWB/NFC all still work. The intent is unambiguous: defeat the audible anti-stalking countermeasure so a planted tag cannot announce itself by sound.

The speaker-disable mod, and why it does not actually make a tag undetectable — the posture note. A “silent AirTag” removes only the audible countermeasure. It does not stop the tag from BLE-advertising the FF 4C 00 12 … Find My signature (Vol 2 §2.4), does not stop the separated-state behavior, and does not stop a victim’s phone from raising the DULT unwanted-tracking alert (Vol 4) — the silent-notification path is independent of the speaker. So a silenced tag is quieter, not invisible: every BLE-based detection method in the counter-surveillance half of this series (Vols 11–13 — OS-native alerts, AirGuard, a Flipper/Marauder/nRF scan) still sees it, because they key on the radio signature, not the sound. The defensive takeaway carried into Vol 14: do not rely on hearing a tag; rely on the OS alert and a BLE scan. The existence of silenced tags is exactly why the audible chirp was never sufficient on its own and why the DULT spec mandates a silent alert too. Author this strictly defensively — the value is understanding the countermeasure landscape; see _shared/legal_ethics.md. Full treatment of detection-despite-silencing is Vol 14.

The hardware lesson for the teardown: because the speaker is structural (§7.1), a clean silencing mod is non-trivial — you are working around the battery seat. That mechanical awkwardness is incidental to the posture point, but it is the reason “silenced” units are a manufactured product rather than a thirty-second home snip.

5.8 Power — the CR2032 tree

The entire device exists to run for about a year on a coin cell, and every architectural choice above — the duty-cycled BLE advertiser, the sleeping U1, the RF-powered NTAG, the hardware crypto — is in service of that budget. This section does the math the brief asks for.

5.8.1 The cell, the holder, and the sprung contacts

The AirTag is powered by a single CR2032: a 20 mm-diameter, 3.2 mm-thick lithium / manganese-dioxide (Li/MnO₂) primary coin cell, 3.0 V nominal, with a typical capacity around 225 mAh (210–240 mAh depending on brand and discharge profile)^[CR2032 per IEC 60086-3 / major-vendor datasheets (e.g. Energizer, Panasonic, Murata/Sony): Li/MnO₂ chemistry, 3.0 V nominal (~2.0 V end-of-life), nominal capacity ~210–235 mAh at low continuous drain, 20.0 mm × 3.2 mm. Pulse-capable but with notable internal resistance that rises as the cell depletes — relevant to the BLE/UWB current pulses (§8.2). “CR” denotes the lithium chemistry; “2032” the dimensions.]. The “CR” prefix is the lithium chemistry; “2032” is literally the size (20 mm × 3.2 mm).

The cell drops into the well formed by the speaker’s ring magnet (§2.3, §7.1), positive face toward the steel cover. Sprung leaf contacts (beryllium-copper-class) carry the cell’s + and − to the board and are designed to tolerate the user repeatedly twisting the cover off and dropping a new cell in — a contact system that has to survive cycling, not a soldered tab. The stainless cover closes over the cell and completes the mechanical retention; the IP67 gasket (§2.2) seals around it.

[FIGURE SLOT — Vol 5, § 8.1] A CR2032 coin cell (generic, for the power section). Source: Photo Helper Commons search “CR2032 coin cell”. Caption when filled: “Figure 5.6 — A CR2032 lithium coin cell. Photo: . .“

5.8.2 The current budget — justifying one year

Apple rates the AirTag at about one year on a CR2032. Does the budget close? A year is 8,760 hours; 225 mAh / 8,760 h = ~25.7 µA average. So the question is whether the AirTag’s average current lands around 25 µA. Build it up from the modes:

Table 8 — Apple rates the AirTag at about one year on a CR2032. Does the budget close? A year is 8,760 hours; 225 mAh / 8,760 h = ~25.7 µA average. So the question is whether the AirTag's average current lands around 25 µA. Build it up from the modes

Mode	Current (active)	Duty cycle	Avg contribution	Basis
Deep sleep (System OFF/ON, RAM retained, RTC running)	~1.5–3 µA	~99.8 % of the time	~2–3 µA	Nordic PS sleep figures + 32 kHz RTC
BLE advertising event (3-channel `ADV_NONCONN_IND`)	~5–6 mA peak, ~2–4 ms/event incl. radio ramp + CPU	one event ~every 2 s → ~0.1–0.2 %	~8–15 µA	nRF52832 TX ~5.3 mA @ 0 dBm × duty
Rotating-key derivation (P-224 via CC310)	~3–4 mA for a few ms	every ~15 min (Vol 2 §4.3)	< 0.1 µA	CryptoCell, rare + brief
NFC tap service (NTAG)	RF-harvested from phone	only during a tap	~0 µA (cell)	NT3H2111 is passive (§6.3)
UWB ranging (U1)	mW-class burst	owner-initiated, seconds/find, days apart	negligible avg	Vol 3 §7.1; sleeps otherwise
Speaker (chirp/alert)	tens of mA	seconds, occasional	negligible avg	§7.2
Total	—	—	~10–18 µA typical	sum of the above

The budget closes with margin: a typical average around 10–18 µA implies ~1.4–2.6 years of theoretical cell life, which Apple derates to a conservative “about a year” to cover cold-temperature capacity loss, brand-to-brand capacity spread, rising internal resistance as the cell ages (which clips the BLE current pulses), and heavier-than-average use (lots of Precision Finding, lots of chirps, frequent separated-state alerting). The dominant line item by far is BLE advertising — which is why the duty cycle (advertise, sleep, repeat every ~2 s) is the single most important power decision in the device, and why the radio’s job is to be hot for as few milliseconds as possible. The diagram:

   AirTag average-current budget (≈ one CR2032-year)
   ═════════════════════════════════════════════════

   BLE advertising  ████████████████████████  ~8–15 µA   ◄─ dominant
   Deep sleep       ██████                     ~2–3  µA
   Key derivation   ▏                          <0.1  µA
   NFC tap          (RF-harvested, 0 from cell) ~0    µA
   UWB ranging      (seconds/find, days apart)  ~0    µA avg
   Speaker          (occasional)                ~0    µA avg
                    ─────────────────────────────────────
   Σ average        ≈ 10–18 µA  →  225 mAh / ~14 µA ≈ 1.8 yr
                                  Apple derates → "~1 year"

   225 mAh / 8760 h = 25.7 µA would be the break-even for EXACTLY 1 yr;
   the AirTag runs comfortably under that.

5.8.3 Battery replacement — the gotchas

The required battery-replacement callout. Replacement is the one user-serviceable operation, and it has four well-known traps:

CR2032 replacement gotchas — read before you swap. (1) The “bitter coating” trap. Many CR2032 cells — Duracell most visibly — ship with a non-toxic bitter coating on the cell to deter child ingestion. That coating is an insulator: AirTags (and other coin-cell devices) frequently fail to power on or chirp with a fresh bitter-coated cell because the coating raises contact resistance at the sprung leaf contacts (§8.1). Symptom: a brand-new battery “doesn’t work.” Fix: use an uncoated cell, or wipe the contact faces. This is a real, widely-reported AirTag failure mode, not a battery defect. (2) Twist direction and seating. The cover is press-down-and-twist-counter-clockwise to open, clockwise to close; it must seat fully and click or the IP67 seal (§2.2) is not made and the cell can lose contact. (3) Confirm the swap — the AirTag plays a tone when a fresh cell seats correctly; no tone means bad contact (often the coating, see #1). (4) Cell quality / IR. A high-internal-resistance bargain cell can brown-out the BLE current pulses (§8.2) even while reading “3 V” unloaded — buy a reputable Li/MnO₂ cell. Do not substitute a rechargeable LIR2032 (3.6 V, lower capacity) — the voltage and capacity are both wrong.

The bitter-coating issue is the one that surprises people: a $30 device “bricked” by a brand-new battery, where the actual fault is a child-safety coating doing its job a little too well at the contact interface.

5.9 Antennas — three radios in a 32 mm puck

The hardest RF problem in the AirTag is not any single radio — it is fitting three of them, at three very different frequencies, into a 31.9 mm disc without them stepping on each other. This section maps the antenna structures and the coexistence.

5.9.1 The antenna-layout map

The three radiating systems and where they live, conceptually (exact geometry confirms on the bench):

   AirTag antenna layout (plan view, through the white top)
   ════════════════════════════════════════════════════════

        ┌───────────────────────────────────────┐
        │   ╭───────────── NFC coil ───────────╮ │  ← multi-turn LOOP
        │   │  (loop around the perimeter,      │ │    13.56 MHz, §9.4
        │   │   bonded to inner wall / on flex) │ │    (inductive, near-field)
        │   │   ┌───────────────────────────┐   │ │
        │   │   │  ┌──────────┐  ┌────────┐  │   │ │
        │   │   │  │ nRF52832 │  │  U1    │  │   │ │
        │   │   │  │  ──BLE──► │  │ ──UWB─►│  │   │ │
        │   │   │  └────┬─────┘  └───┬────┘  │   │ │
        │   │   │       │            │       │   │ │
        │   │   │  [BLE ant]    [UWB ant]    │   │ │
        │   │   │   2.4 GHz      6.5–8 GHz   │   │ │
        │   │   │   §9.2         §9.3        │   │ │
        │   │   └───────────────────────────┘   │ │
        │   ╰───────────────────────────────────╯ │
        └───────────────────────────────────────┘
              ▲ all three radiate through the white plastic top
                (the steel cover is on the far side — a ground/reflector)

   Frequency separation does most of the isolation work:
     NFC 13.56 MHz  ───────────────────────────  near-field, inductive
     BLE 2.4  GHz   ──────┐
     UWB 6.5–8 GHz  ──────┴── far-field; ~3× apart in frequency

The good news for the designer is that the three bands are enormously far apart — 13.56 MHz, 2.4 GHz, and 6.5–8 GHz span more than two and a half decades — so they are largely orthogonal by frequency alone. The NFC coil is a near-field inductive structure that does not meaningfully radiate at 2.4/8 GHz; the BLE and UWB antennas are far-field structures with no response at 13.56 MHz. The hard part is purely spatial: physically fitting all three apertures in the disc and keeping the steel cover (a conductor) from detuning them.

5.9.2 The BLE antenna

The 2.4 GHz BLE antenna is a printed trace antenna — an inverted-F (IFA) or meandered monopole on the PCB or a flex, fed from the nRF52832 through a small matching network (§3.3, BoM #7, #12). A trace antenna is the universal choice at 2.4 GHz for space-constrained consumer devices: it is free (it is just copper), it is repeatable in manufacturing, and at λ ≈ 12.5 cm a quarter-wave is ~31 mm — which is awkwardly the whole diameter of the AirTag, so the trace is meandered/folded to fit. The white plastic top is the radome; the steel cover behind it acts as a ground plane / reflector that the antenna is tuned in the presence of. This is the antenna that emits every Find My advertisement of Vol 2.

5.9.3 The UWB antenna

The UWB antenna (BoM #8) feeds the U1 across the 6.5–8 GHz span (802.15.4z channels 5 and 9, Vol 3 §3.3). At these frequencies the wavelength is tiny — λ ≈ 4.6 cm at channel 5’s 6489.6 MHz, ≈ 3.75 cm at channel 9’s 7987.2 MHz — so a UWB element is physically small (sub-centimetre features) and easy to fit. The challenge at UWB is not size but bandwidth and phase: the antenna must pass a 499.2 MHz-wide impulse (Vol 3 §3.4) without smearing the leading edge that ranging depends on, so it is a broadband element (a patch or a printed monopole tuned for flat group delay across the band), not a narrowband resonator. The AirTag needs only one such element because it is a single-antenna responder (§5.2); the angle-of-arrival array is the iPhone’s problem.

5.9.4 The NFC coil

The NFC antenna (BoM #9) is a multi-turn loop — a coil, not a trace monopole — because 13.56 MHz NFC is inductive near-field coupling, not far-field radiation. At 13.56 MHz a resonant half-wave antenna would be ~11 m long; you do not radiate at NFC, you couple magnetically, so the antenna is a flat spiral coil tuned with a capacitor to resonate at 13.56 MHz and exchange energy with the phone’s coil by mutual inductance (transformer action). The coil is sized to ring the perimeter of the puck (maximizing loop area → coupling) and is bonded to the inner wall of the plastic top or carried on a flex. It serves the NXP NTAG (§6) for both the phone-read and the RF energy harvest that powers the passive tap on a dead battery (§6.3).

5.9.5 Coexistence — three bands, one ground

How do three radios share one tiny board? Three mechanisms, in order of how much work they do:

Table 9 — How do three radios share one tiny board? Three mechanisms, in order of how much work they do

Mechanism	What it does	Which pairs it isolates
Frequency separation	13.56 MHz / 2.4 GHz / 6.5–8 GHz are >2.5 decades apart; each antenna is blind to the others’ bands	All three pairs — does most of the work
Near-field vs far-field	The NFC coil is inductive (energy stays local); BLE/UWB are radiating	NFC ↔ {BLE, UWB}
Time-domain duty cycling	BLE and UWB are almost never on simultaneously — UWB only wakes when BLE has already found the tag (Vol 3 §7.1); the NFC tap is a separate occasional event	BLE ↔ UWB (they rarely transmit at once)
Spatial layout + matching	Physical placement + per-radio matching nets keep each antenna tuned despite the steel cover and the neighbors	Fine-tuning all three

The elegant part is the time-domain point: even though BLE and UWB are only ~3× apart in frequency (2.4 vs ~7 GHz, close enough that filtering alone is not trivial), they almost never transmit at the same instant, because the system design makes UWB a consequence of BLE — the phone has to hear the BLE advert and then ask the tag to wake UWB. So the coexistence is solved as much by the protocol sequencing of Vol 3 §7 as by RF filtering. Three radios in a 32 mm puck works because two of them take turns and the third lives in a different physical regime entirely.

5.10 The teardown, step by step

The required teardown-step table — the destructive disassembly sequence, from “in your hand” to “bare board,” with what you risk at each step. Steps 1–2 are user-serviceable and reversible; steps 3 onward break the IP67 seal and are one-way.

Table 10 — 10. The teardown, step by step

Step	Action	Tool	Reversible?	Risk / note
1	Press the steel cover down and twist counter-clockwise; lift it off	Fingers	Yes	The intended battery-access path; no seal broken
2	Lift out the CR2032 from the magnet well	Fingers	Yes	Mind the sprung contacts; note + face was toward the cover
3	Pry the white plastic top from the body (adhesive/ultrasonic weld)	Spudger/iOpener heat	No	Breaks the IP67 seal permanently; risk cracking the dome
4	Free the speaker/magnet assembly from the body	Spudger	No	It is structural (it seats the battery, §7.1) — note orientation
5	Disconnect the NFC coil from the board (flex/solder to inner wall)	Tweezers/iron	No	Easy to tear the coil flex; note the bond points
6	Lift the main PCB out of the housing	Spudger	No	Watch the battery spring contacts and any antenna feeds
7	Image PCB top (nRF52832, U1, crystals, matching nets)	Microscope	—	Capture chip markings — FIGURE SLOT §3.3
8	Flip and image PCB bottom (NXP NTAG, contacts, passives)	Microscope	—	Capture the NXP marking to confirm §6.1
9	Probe buses to confirm interconnect (nRF↔U1, nRF↔NTAG I²C)	Logic analyzer / Bus Pirate	—	Confirms §3.2 (the `Bus Pirate 6/` deep dive covers the I²C capture)

Disassembly past step 2 is destructive and one-way. Steps 1–2 (cover off, battery out) are the only user-serviceable operations and re-seal to IP67 when reversed. From step 3 the device is sacrificed: prying the plastic top breaks the ingress seal, the adhesive/weld, and risks the antenna structures bonded to the inner wall (§9.1, §9.4). This is the teardown that produces the FIGURE SLOT photos in §2, §3 — do it on a unit you are willing to destroy, not your daily tag. Confirm the silicon markings (steps 7–8) against the BoM (§3.3): the nRF52832-QFAA, the Apple-marked U1, and the NXP NTAG-class part are the three identifications this whole volume rests on; the bench is where “to confirm” becomes “confirmed.”

5.11 Cheatsheet updates

This volume’s contributions to the Vol 15 laminate-ready cheatsheet — the hardware facts to carry without re-opening the teardown:

Mechanicals. 31.9 mm diameter, 8.0 mm thick, 11 g, IP67. Two-piece: white plastic top (the RF window — all three antennas radiate through it) + removable stainless cover (battery door + speaker surface + serial etch). Press-and-twist-CCW to open.
The brain = Nordic nRF52832-QFAA. ARM Cortex-M4F @ 64 MHz, 512 kB flash / 64 kB RAM, QFN-48 6×6 mm, CryptoCell CC310 (hardware ECC/AES for the Vol 2 key chain). It is the BLE radio (no separate BT chip): –96 dBm RX sens, +4 dBm max TX, ~5.3 mA TX @ 0 dBm. Has an on-die NFCT peripheral but does not use it for the tap.
UWB = Apple U1, single-antenna responder. 802.15.4z HRP, ch 5/9 (6.5–8 GHz). Woken over a control bus by the nRF only for a Precision Finding session (Vol 3 §7.1); computes no geometry — the phone does. Negligible average power.
NFC = NXP NT3H2111 (NTAG I²C plus). NFC Forum Type-2 / ISO 14443-A, 13.56 MHz — not Type-5 / 15693. (This resolves Vol 4 §2.1’s “Type-2/Type-5” hedge → Type-2 / 14443-A.) Dual-ported: nRF writes the NDEF over I²C, phone reads it over RF, RF-powered so it works on a dead battery. Read it with a 14443-A reader (Flipper NFC, Proxmark HF, PN532) — Vol 12.
Speaker = voice coil + ring magnet, structural. Drives the enclosure as the diaphragm; the ring magnet also seats the CR2032. Plays the owner locate chirp and the anti-stalking sound (Vol 4). “Silent AirTags” disable only the sound — BLE/UWB/NFC and the silent DULT alert still work, so they are quieter, not invisible (Vol 14).
Power = CR2032, 3 V, ~225 mAh, ~1 year. Budget: ~10–18 µA average, dominated by BLE advertising (~8–15 µA); deep sleep ~2–3 µA; NFC tap and UWB ~0 average. 225 mAh / ~14 µA ≈ 1.8 yr theoretical, derated to “~1 yr.” Battery gotcha: bitter-coated cells (Duracell etc.) can fail to power the tag — the coating insulates the contacts; use uncoated or wipe the faces. No tone on insert = bad contact.
Three radios, three antennas, one puck. BLE = 2.4 GHz printed/meandered trace; UWB = one broadband 6.5–8 GHz element (flat group delay for the impulse); NFC = multi-turn inductive coil (near-field, also harvests power). Coexist by frequency separation (>2.5 decades), near-field-vs-far-field, and time-domain sequencing (UWB only wakes after BLE finds the tag).
At the silicon level the AirTag is a polished nRF beacon. The nRF52832 is the same class a DIY OpenHaystack/Macless-Haystack beacon runs on (Vol 10) — plus the U1 and the NXP NTAG the DIY build omits.

This is Volume 5 of a fifteen-volume series. Next: Vol 6 leaves the silicon for the operator’s seat — how to actually use an AirTag end to end: pairing, the Find My app, Precision Finding (following the arrow this teardown’s U1 makes possible), Lost Mode (writing the NDEF this volume’s NXP NTAG serves), sharing, and the battery-replacement lifecycle (§8 in practice). The teardown’s parts become a workflow.

AirTags Volume 5 — AirTag Hardware Teardown