Looking inside an iPhone 4/4S battery

A classmate of mine had a couple broken iPhones that he ‘relieved’ of their batteries and let me take a look at them. Being the curious type I peeled away the outer layers of tape to reveal the protection circuit. I spotted a current sense resistor, and  that got me thinking…

… can it be? Yes, I found a bq27541 fuel gauge chip inside the battery! After fooling around with the battery, I found out that the battery is using the HDQ interface.

iphone battery pinoutThe HDQ bus, which stands for ‘High-speed Data Queue’, is a single-wire communications bus used by TI fuel gauges. It’s similar to Maxim’s 1-Wire protocol but runs with different protocols and timing. It operates at 7 kilobits per second (so much for ‘high speed’ right? 😛 ) and a refresh of the data memory in the TI software can take almost half a minute. However, it’s good enough for occasional polling (like every minute or so) since it’s unlikely that the gauge will be read from every second.

The bq27541(labeled BQ 7541) in the iPhone battery runs an unusual firmware version. It’s running version 1.35 and doesn’t match with any release on TI’s website. The gas gauge is sealed so initially it seems like gaining access to the Data Flash memory would be impossible. However, in non-Apple fashion, the gauge’s passwords are left at the default; 0x36720414 and 0xFFFFFFFF for the unseal and full-access keys, respectively (and it’s not the first time Apple’s done this!). Since the firmware version is unknown, I told bqEVSW to treat the chip as if it were the bq27541-V200. I then saved only the calibration, capacity, resistance and lifetime data.

Updating the firmware over HDQ was a nightmare. It took over a dozen tries for each of the two batteries I had, and the update process took 45 minutes (!) to update the bq27541 to the V200 firmware. At one point, it seemed as if I bricked the chip, but a power-on reset of the chip by shorting the cell very quickly 😀 sent the device into ROM mode (ie. firmware-update mode). From there I used bqCONFIG to update the firmware, and it was successful! Now I could use GaugeStudio to interface with the gauge rather than the unsightly bqEVSW software.

bq27541 updated to version 2.00

bq27541 updated to version 2.00

Given how long it took for me to update the firmware of the gauge, I have doubts that iPhones will update their batteries’ firmware in-system. Hell, the iPhone OS ignores the bq27541’s State of Charge readings and substitutes its own. Nice going, Apple!

Now to start going through cell phone recycling bins to pull out dead iPhone batteries for their gauges…

Advertisements

24 thoughts on “Looking inside an iPhone 4/4S battery

  1. Pingback: Looking inside an iPhone 5 battery | Rip It Apart – Jason's electronics blog-thingy

  2. Pingback: So Phone Me Maybe: A list of iPhone batteries with gas gauge functionality | Rip It Apart – Jason's electronics blog-thingy

  3. hello, what do you think about put 2 batteries in parallel into an iphone 4s? do you think that the bq27541 it has to be reprogramed? i mean to allow more (the double) current charging capability?

    • Hi Tomas,

      If you mean putting two iPhone 4 cells in parallel with one fuel gauge, you will certainly need to have a means of reprogramming the bq27541 to recognize the capacity of the new battery. Although it can increase your battery capacity, the fuel gauge would likely prevent you from seeing the sort of performance gains that you are expecting from doubling up on battery capacity. Also, it probably won’t allow you to halve charging time or double the charging current; if anything, it would just double the amount of time that your phone would need to fully charge.

      Jason

  4. Hello, I have a question regarding this board inside the the 4S battery, When a mesure the voltage directly on the battery contacts i find 4.3v but nothing 0v between -Grey and +Red ! Idis you think is a dead fuse cause ? I see on the top a CMS look like a resistor and on the back side much more components but I don’t know what is the protection ones ! Please can you tell me some indication ???
    Alex.

  5. Hello, great work. I was trying to use laptop battery cell with the protection circuit of the iPhone 4s cause its battery is almost dead (it wasn’t original), but the phone didn’t work. What happens if I disconnect the battery from the circuit? and is it possible to use a good battery with the protection circuit? Do I have to reprogram it? thanks in advance.
    George

    • Hi George,

      If you disconnect the battery, you might need to re-activate the protection circuitry. Briefly short the Pack- and Cell- terminals together, and it should reset the protection circuit. You can use another cell, but it will not operate properly without being reprogrammed with TI’s software. I have thought of making my own tool so that a $50-200 tool wouldn’t need to be used, but the complexities of TI’s Impedance Track algorithm would prevent me from doing that easily.

      Jason

      • Hi,
        I would like to share my experience with everyone which might help.
        I did replace iPhone 4s battery with a laptop battery and thanks to your advice, it worked. By the way we would love to see your work in video, If you have a YouTube channel or something like that please share it with us.

  6. Hi there.
    Can you briefly explain the terms pack and cell terminals on the batteries. And how do you make the shorting trick. ( I am just started investigating Iphone batteries, exciting)

    • Hi Ivan,

      The Pack and Cell terminals refer to the contacts on the battery’s circuit board. The Cell terminals are directly connected to the Li-ion cell itself (and are located directly on the PCB itself), and the Pack terminals are on the connector that plugs into the phone’s motherboard.

      Jason

  7. Hi , I was hoping to use a spare original iphone 4 battery for a project. I was trying to charge the battery via 18650 Lithium Battery Charging module which uses tp4058 ic. I can charge the battery from cell terminals, but i want to do it through pack terminals but i can’t there is no current draw when o try to do it from pack terminals. Why does it happening? and How can i make it work? or do you think there is no need to charge it through protection circuit since tp4058 has some integrated already

    Thanks in advance 🙂

    • Measure the voltage across the Pack+/- pins. If you don’t see the battery voltage on them, briefly short the Pack- and Cell- terminals with a small piece of wire. It is possible that the protection circuit was activated, but didn’t automatically reset itself. I find that the TP40xx charger ICs might not always be able to “wake” a Li-ion protection circuit. The protection that the TP4058 offers is only for the charger, not the battery itself. Although you can charge (not discharge) the cell directly and bypass the protection, it puts you at risk of a fire should something go wrong. Also, if the protection circuit refuses to function even if the cell itself is fully charged, then the battery pack is unsafe to use until the protection circuit (or the whole battery pack) is replaced.

      Jason

  8. Hello Jason, Congratulations for your job on iPhone 4/4S battery. I would like to know if the APN is really stored in the flash memory of the BQ27541. Normally it should be but I do not know where.
    Thanks for your answer.
    BR
    Jean

    • Hi Jean,

      I’ve been doing some quick tests on my collection of iPhone batteries, and none of them store the APN in the Data Flash (I presume you mean the ones like 616-0512 for the iPhone 4 battery?). They do contain serial numbers, however.

      Jason

      • Hello Jason,
        When you change the original battery of an iPhone 4S with a battery that has an APN older than the one of the original battery (for example you change a 4S battery with APN : 616-0582 by a new battery with APN : 616-0579) you will have an error #29 when you will boot the iPhone and it will be impossible to restore the iPhone on iTunes. Only solution to restore will be to come back to original battery.
        So clearly IOs operating system is checking the version of the battery. For me it was the APN but maybe this is a serial number… I have made some reading of the Bq27541 using an evaluation board EV2300 from TI and I cannot see where the APN or Serial number is stored. Do you have an idea where it could be stored ?
        Thanks in advance for your help.

        Jean,

      • Hi Jean,

        The serial numbers are stored in the System Data section of the Data Flash. Under Manufacturer Info, Block A is some sort of 7-byte serial number (like 4D E0 FD 3F 10 42 48), and Block B is the ASCII serial number that iOS uses (like ST135113240UFT1420), as far as I know. The iPhone 5 has another sort of part number(?) in Block C (like 069782306). The iPhone 6 and newer has a different serial numbering system, as they include some sort of “system pairing” feature that I am not very familiar with at the moment.

        Jason

      • Thank you Jason.
        Do you have any idea to make the relation ship between Serial number and APN ?
        On an original iPhone 4S battery serial number is in hexadecimal : 89 81 2D 3F 8F 42 48. APN number is 616-0581. Device name is bq27541.
        On a “probably non-original” iPhone 4S Battery, I did not succeed to read the serial number…. I read the device name and it is SH36600. I guess my problem to read the serial number comes from the fact that the chip is not a BQ/TI chip but an equivalent. The footprint/casing of the IC is the same as a BQ/TI 27541. Any idea of what manufacturer is behind this reference SH36600 ?
        Thanks for your help.

        Jean

      • Hi Jean,

        As far as I know, the APN is fixed, and only differs between cell manufacturers. As for the battery you mentioned, you said you have the EV2300 on hand. Do you have any screenshots of the TI software that shows the data you’re reading from the battery?

        Jason

      • Hello Jason,

        Do you have an email address to send you my screen shot ? I have more than 10 to send you.. by email it will be more convenient.. possible ?

        Jean

  9. Sorry for my question.. Could you explain me what is the function of the chip near gauge, on the left? There is a signe (D7 or 07).. Thank you

  10. I was trying to update my iPhone when it stopped due to an error. Looking at the iTunes iPhone logs I discovered the error was:
    gasgauge_swupdate returned -4
    Any ideas what the error code -4 means? I assume the iPhone was unable to update to the firmware of the gas guage?

    Thanks!

    • Unfortunately, I do not know the answer to that. My focus has been the batteries themselves as I do not own an iOS device myself. I’d be surprised if the phone updated the gas gauge’s firmware as it would take over 10 minutes to do over the HDQ interface.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s