Looking inside an iPhone 4/4S battery

Posted on February 12, 2014 by ginbot86

A classmate of mine had a couple broken iPhones that he ‘relieved’ of their batteries and let me take a look at them. Being the curious type I peeled away the outer layers of tape to reveal the protection circuit. I spotted a current sense resistor, and that got me thinking…

: The current-sense resistor is on the left of the three gold test pads.

: The bq27541 in the iPhone battery is on the lower right of this image.

… can it be? Yes, I found a bq27541 fuel gauge chip inside the battery! After fooling around with the battery, I found out that the battery is using the HDQ interface.

The HDQ bus, which stands for ‘High-speed Data Queue’, is a single-wire communications bus used by TI fuel gauges. It’s similar to Maxim’s 1-Wire protocol but runs with different protocols and timing. It operates at 7 kilobits per second (so much for ‘high speed’ right? 😛 ) and a refresh of the data memory in the TI software can take almost half a minute. However, it’s good enough for occasional polling (like every minute or so) since it’s unlikely that the gauge will be read from every second.

The bq27541(labeled BQ 7541) in the iPhone battery runs an unusual firmware version. It’s running version 1.35 and doesn’t match with any release on TI’s website. The gas gauge is sealed so initially it seems like gaining access to the Data Flash memory would be impossible. However, in non-Apple fashion, the gauge’s passwords are left at the default; 0x36720414 and 0xFFFFFFFF for the unseal and full-access keys, respectively (and it’s not the first time Apple’s done this!). Since the firmware version is unknown, I told bqEVSW to treat the chip as if it were the bq27541-V200. I then saved only the calibration, capacity, resistance and lifetime data.

: Chip identifed as bq27541 version 1.35

: bqEVSW treating the bq27541 as if it was running version 2.0 firmware

Updating the firmware over HDQ was a nightmare. It took over a dozen tries for each of the two batteries I had, and the update process took 45 minutes (!) to update the bq27541 to the V200 firmware. At one point, it seemed as if I bricked the chip, but a power-on reset of the chip by shorting the cell very quickly 😀 sent the device into ROM mode (ie. firmware-update mode). From there I used bqCONFIG to update the firmware, and it was successful! Now I could use GaugeStudio to interface with the gauge rather than the unsightly bqEVSW software.

bq27541 updated to version 2.00

Given how long it took for me to update the firmware of the gauge, I have doubts that iPhones will update their batteries’ firmware in-system. Hell, the iPhone OS ignores the bq27541’s State of Charge readings and substitutes its own. Nice going, Apple!

Now to start going through cell phone recycling bins to pull out dead iPhone batteries for their gauges…

32 thoughts on “Looking inside an iPhone 4/4S battery”

Pingback: Looking inside an iPhone 5 battery | Rip It Apart – Jason's electronics blog-thingy
Pingback: So Phone Me Maybe: A list of iPhone batteries with gas gauge functionality | Rip It Apart – Jason's electronics blog-thingy
ubaidullah on December 13, 2014 at 8:11 am said:

I like it

LikeLike

Reply ↓
tomas giudici on July 7, 2015 at 10:13 pm said:

hello, what do you think about put 2 batteries in parallel into an iphone 4s? do you think that the bq27541 it has to be reprogramed? i mean to allow more (the double) current charging capability?

LikeLike

Reply ↓
- ginbot86 on July 7, 2015 at 10:19 pm said:
  
  Hi Tomas,
  
  If you mean putting two iPhone 4 cells in parallel with one fuel gauge, you will certainly need to have a means of reprogramming the bq27541 to recognize the capacity of the new battery. Although it can increase your battery capacity, the fuel gauge would likely prevent you from seeing the sort of performance gains that you are expecting from doubling up on battery capacity. Also, it probably won’t allow you to halve charging time or double the charging current; if anything, it would just double the amount of time that your phone would need to fully charge.
  
  Jason
  
  LikeLike
  
  Reply ↓
alex on October 19, 2015 at 4:58 pm said:

Hello, I have a question regarding this board inside the the 4S battery, When a mesure the voltage directly on the battery contacts i find 4.3v but nothing 0v between -Grey and +Red ! Idis you think is a dead fuse cause ? I see on the top a CMS look like a resistor and on the back side much more components but I don’t know what is the protection ones ! Please can you tell me some indication ???
Alex.

LikeLike

Reply ↓
George on December 12, 2015 at 9:53 am said:

Hello, great work. I was trying to use laptop battery cell with the protection circuit of the iPhone 4s cause its battery is almost dead (it wasn’t original), but the phone didn’t work. What happens if I disconnect the battery from the circuit? and is it possible to use a good battery with the protection circuit? Do I have to reprogram it? thanks in advance.
George

LikeLike

Reply ↓
- ginbot86 on December 13, 2015 at 4:09 am said:
  
  Hi George,
  
  If you disconnect the battery, you might need to re-activate the protection circuitry. Briefly short the Pack- and Cell- terminals together, and it should reset the protection circuit. You can use another cell, but it will not operate properly without being reprogrammed with TI’s software. I have thought of making my own tool so that a $50-200 tool wouldn’t need to be used, but the complexities of TI’s Impedance Track algorithm would prevent me from doing that easily.
  
  Jason
  
  LikeLike
  
  Reply ↓
  - George on February 18, 2016 at 12:38 am said:
    
    Hi,
    I would like to share my experience with everyone which might help.
    I did replace iPhone 4s battery with a laptop battery and thanks to your advice, it worked. By the way we would love to see your work in video, If you have a YouTube channel or something like that please share it with us.
    
    LikeLike
    
    Reply ↓
Ivan on February 17, 2016 at 8:43 am said:

Hi there.
Can you briefly explain the terms pack and cell terminals on the batteries. And how do you make the shorting trick. ( I am just started investigating Iphone batteries, exciting)

LikeLike

Reply ↓
- ginbot86 on February 19, 2016 at 12:20 am said:
  
  Hi Ivan,
  
  The Pack and Cell terminals refer to the contacts on the battery’s circuit board. The Cell terminals are directly connected to the Li-ion cell itself (and are located directly on the PCB itself), and the Pack terminals are on the connector that plugs into the phone’s motherboard.
  
  Jason
  
  LikeLike
  
  Reply ↓
someone on May 28, 2016 at 1:44 pm said:

Hi , I was hoping to use a spare original iphone 4 battery for a project. I was trying to charge the battery via 18650 Lithium Battery Charging module which uses tp4058 ic. I can charge the battery from cell terminals, but i want to do it through pack terminals but i can’t there is no current draw when o try to do it from pack terminals. Why does it happening? and How can i make it work? or do you think there is no need to charge it through protection circuit since tp4058 has some integrated already

Thanks in advance 🙂

LikeLike

Reply ↓
- ginbot86 on May 29, 2016 at 6:19 pm said:
  
  Measure the voltage across the Pack+/- pins. If you don’t see the battery voltage on them, briefly short the Pack- and Cell- terminals with a small piece of wire. It is possible that the protection circuit was activated, but didn’t automatically reset itself. I find that the TP40xx charger ICs might not always be able to “wake” a Li-ion protection circuit. The protection that the TP4058 offers is only for the charger, not the battery itself. Although you can charge (not discharge) the cell directly and bypass the protection, it puts you at risk of a fire should something go wrong. Also, if the protection circuit refuses to function even if the cell itself is fully charged, then the battery pack is unsafe to use until the protection circuit (or the whole battery pack) is replaced.
  
  Jason
  
  LikeLike
  
  Reply ↓
Jean on July 15, 2016 at 8:16 am said:

Hello Jason, Congratulations for your job on iPhone 4/4S battery. I would like to know if the APN is really stored in the flash memory of the BQ27541. Normally it should be but I do not know where.
Thanks for your answer.
BR
Jean

LikeLike

Reply ↓
- ginbot86 on July 15, 2016 at 4:04 pm said:
  
  Hi Jean,
  
  I’ve been doing some quick tests on my collection of iPhone batteries, and none of them store the APN in the Data Flash (I presume you mean the ones like 616-0512 for the iPhone 4 battery?). They do contain serial numbers, however.
  
  Jason
  
  LikeLike
  
  Reply ↓
  - Jean on July 16, 2016 at 10:37 am said:
    
    Hello Jason,
    When you change the original battery of an iPhone 4S with a battery that has an APN older than the one of the original battery (for example you change a 4S battery with APN : 616-0582 by a new battery with APN : 616-0579) you will have an error #29 when you will boot the iPhone and it will be impossible to restore the iPhone on iTunes. Only solution to restore will be to come back to original battery.
    So clearly IOs operating system is checking the version of the battery. For me it was the APN but maybe this is a serial number… I have made some reading of the Bq27541 using an evaluation board EV2300 from TI and I cannot see where the APN or Serial number is stored. Do you have an idea where it could be stored ?
    Thanks in advance for your help.
    
    Jean,
    
    LikeLike
    
    Reply ↓
    - ginbot86 on July 18, 2016 at 3:45 am said:
      
      Hi Jean,
      
      The serial numbers are stored in the System Data section of the Data Flash. Under Manufacturer Info, Block A is some sort of 7-byte serial number (like 4D E0 FD 3F 10 42 48), and Block B is the ASCII serial number that iOS uses (like ST135113240UFT1420), as far as I know. The iPhone 5 has another sort of part number(?) in Block C (like 069782306). The iPhone 6 and newer has a different serial numbering system, as they include some sort of “system pairing” feature that I am not very familiar with at the moment.
      
      Jason
      
      LikeLike
      
      Reply ↓
      - Jean on July 19, 2016 at 3:37 am said:
        
        Thank you Jason.
        Do you have any idea to make the relation ship between Serial number and APN ?
        On an original iPhone 4S battery serial number is in hexadecimal : 89 81 2D 3F 8F 42 48. APN number is 616-0581. Device name is bq27541.
        On a “probably non-original” iPhone 4S Battery, I did not succeed to read the serial number…. I read the device name and it is SH36600. I guess my problem to read the serial number comes from the fact that the chip is not a BQ/TI chip but an equivalent. The footprint/casing of the IC is the same as a BQ/TI 27541. Any idea of what manufacturer is behind this reference SH36600 ?
        Thanks for your help.
        
        Jean
        
        LikeLike
        
        Reply ↓
        
        ginbot86 on July 19, 2016 at 4:24 am said:
        
        Hi Jean,
        
        As far as I know, the APN is fixed, and only differs between cell manufacturers. As for the battery you mentioned, you said you have the EV2300 on hand. Do you have any screenshots of the TI software that shows the data you’re reading from the battery?
        
        Jason
        
        LikeLike
        
        Reply ↓
        
        Jean on July 19, 2016 at 5:17 am said:
        
        Hello Jason,
        
        Do you have an email address to send you my screen shot ? I have more than 10 to send you.. by email it will be more convenient.. possible ?
        
        Jean
        
        LikeLike
        
        Reply ↓
        
        ginbot86 on July 19, 2016 at 5:23 am said:
        
        Hi Jean,
        
        I can be reached at ginbot86@gmail.com. We can continue our discussion by email after that.
        
        Jason
        
        LikeLike
        
        Reply ↓
Alb on September 20, 2016 at 3:17 pm said:

Sorry for my question.. Could you explain me what is the function of the chip near gauge, on the left? There is a signe (D7 or 07).. Thank you

LikeLike

Reply ↓
cg423 on October 20, 2016 at 12:36 pm said:

I was trying to update my iPhone when it stopped due to an error. Looking at the iTunes iPhone logs I discovered the error was:
gasgauge_swupdate returned -4
Any ideas what the error code -4 means? I assume the iPhone was unable to update to the firmware of the gas guage?

Thanks!

LikeLike

Reply ↓
- ginbot86 on October 20, 2016 at 10:15 pm said:
  
  Unfortunately, I do not know the answer to that. My focus has been the batteries themselves as I do not own an iOS device myself. I’d be surprised if the phone updated the gas gauge’s firmware as it would take over 10 minutes to do over the HDQ interface.
  
  LikeLiked by 1 person
  
  Reply ↓
Pingback: Charging, Batteries, HDQ/SWI - iPhones/iPads How does it work?
Arvi Guinto on February 5, 2019 at 9:00 pm said:

Man you’re a life saver! nice tutorial — The restarting of protection board works! Now the only problem is how to wire the damn connector lol (iphone 5 batt doesn’t have expose terminals).

LikeLike

Reply ↓
- ginbot86 on February 5, 2019 at 9:01 pm said:
  
  I’ve yet to discern how to recover the connections for iPhone 5 and later batteries since the flexible cable is built into the same circuit board as the protection/gauge. It’s really annoying!
  
  LikeLike
  
  Reply ↓
cc213t on July 31, 2020 at 2:59 pm said:

I have a 4S which I am repurposing as a permanent host for an expensive piano tuning app. I’d like to remove the aging Li-ion battery for safety reasons and run the phone exclusively from external power via the 30-pin connector. It WILL run this way but not smoothly (need to hold the power button during bootup after applying power or else it will get stuck in a loop displaying the Apple logo and then rebooting; once started up, it will also reboot spontaneously when accessing certain settings). Is there a way I can fake out the phone that the battery is connected and OK so the phone runs more stably? I do have the original battery and could salvage the connector, protection circuit, etc. Thought maybe I could jump the external supply to the pack +/- terminals or something like that…?

LikeLike

Reply ↓
Akram on December 29, 2021 at 3:37 am said:

hello, the battery table cloth of my iphone 4 is damaged and i’d like to solder it directly with the bq27541 but i dont know the pinout.

LikeLike

Reply ↓
- ginbot86 on December 29, 2021 at 7:24 am said:
  
  If the iPhone 4 battery PCB itself is still intact, the pinout from the edge towards the center of the PCB is:
  
  1: Pack-
  2: HDQ
  3: Thermistor
  4: Pack+
  
  LikeLike
  
  Reply ↓
proninyaroslav on March 5, 2024 at 1:05 pm said:

Hello. I want to repack the cell on my iPhone 3G battery. Will I be able to reset the current full-charge capacity to factory capacity without programming after replacing the cell?

LikeLike

Reply ↓
- ginbot86 on March 5, 2024 at 1:10 pm said:
  
  You can but indirectly. The fuel gauge will relearn the capacity to some extent with full charge-discharge cycles with a few hours of relaxation time after finishing charging, and finishing discharging.
  
  This won’t reset the cycle count but the 3G doesn’t really care about that data value anyway.
  
  LikeLiked by 1 person
  
  Reply ↓