So Phone Me Maybe: A list of iPhone/iPad batteries with gas gauge functionality

Looking for my HDQ Utility to read out your own batteries? Click here!

UPDATE: Turns out the iPhone 3G and 3GS do have gas gauges! I will add them to my list as I find out more about them.

Each iPhone generation since the iPhone 4 iPhone 3G uses a TI gas gauge and uses the HDQ bus (iOS refers to this as the SWI [single-wire interface]) to communicate with the outside world. For more information about the HDQ protocol, click here.

I’ve noticed that many of the iPhone 5S and 5C batteries that can be purchased online are reusing iPhone 4 circuits, which will cause a significant decrease in gauge accuracy (proper parameters need to be programmed into the gas gauge, and that information is chemistry dependent), and the protection circuits in the iPhone 4 battery PCB will kick into overvoltage protection mode at 4.25 volts, less than the 4.3 volts that the iPhone 5 (and newer) batteries need to charge fully.

Because I have been unable to find a list of information of each battery generation, I’m making one myself. Because nobody else has dug this deep into the fuel gauges that the iPhone uses, I have to get this information experimentally (that is, by buying various batteries from online shops; the iPhone 5S battery has been very difficult to get, besides the fake ones I mentioned earlier).

So far I’m in need of an iPhone 3G (not the 3GS) battery, as well as all iPad batteries (or, if you have my program on hand, what model the battery is intended for, the fuel gauge device (eg. bq27541, bq27545), firmware version and designed capacity.

Model Gas Gauge Firmware Designed Capacity Default Unseal Key? Comments
iPhone 3G bq27541 ? ? Yes (0x36720414) Need to acquire one of these.
iPhone 3GS bq27541 1.17 1200 mAh Yes (0x36720414) Limited feature set. My utility will throw “No response” errors when reading this battery.
iPhone 4 bq27541 1.25 1420 mAh Yes (0x36720414)
iPhone 4S bq27541 1.35 1430 mAh Yes (0x36720414)
iPhone 5 bq27545 3.10 1430 mAh No (0x52695035) Many thanks to Yann B. for finding the unseal key!
iPhone 5S bq27545 3.10 1550 mAh No (0x84966864)
iPhone 5C bq27545 3.10 1500 mAh No (0x84966864)
iPhone 6 sn27545-A4 (note 4) 5.02 1751 mAh No (0x65441236)
iPhone 6 Plus sn27545-A4 (note 4) 5.02 2855 mAh No (0x18794977)
iPhone 6S sn27546-A5 (note 5) 6.01 1690 mAh No (0x90375994)
iPhone 6S Plus sn27546-A5 (note 5) 6.01 2725 mAh No (0x11022669)
iPhone SE Unrecognized (note 6) (A1141/0x1141) 1.03 1560 mAh No (unknown) (See note 6)
Apple Watch (38mm) sn27545-A4 5.02 235 mAh No (0x09130978)
Apple Watch (42mm) sn27545-A4 5.02 245 mAh No (unknown) If anyone has one that reads “FULL ACCESS” in my program, please send it to me! ๐Ÿ™‚
iPad (3rd gen) bq27541 1.35 11560 mAh Yes (0x36720414)

Notes:

  1. All known iPhone battery models use custom firmware, so not all of the features that the mainstream gas gauge models use are available. For example, none of these gauges will calculate the battery’s State of Health percentage (it is basically the percentage of the battery’s full charge capacity (it degrades with use) versus its designed capacity.
  2. The iPhone 5C’s battery label indicates a designed capacity of 1510 mAh, but the battery I’ve received indicates a capacity of 1550 mAh. As I have only been able to get one of these batteries that seem to be genuine, I will need to get more batteries of this type to confirm that this information is correct.
  3. The iPhone 5’s battery label indicates a designed capacity of 1440 mAh, but the fuel gauge reports 1430 mAh. The 5S battery reports 1550 mAh, but is labeled 1560 mAh. The 5C reports 1500 mAh, but is labeled 1510 mAh.
  4. The iPhone 6 and 6 Plus use a special firmware that is identified in TI’s battery software (except the very latest releases where such data was removed), and it has a very extensive feature set, and a lot of data logging features.
  5. The iPhone 6S/6S Plus use a firmware version similar to the iPhone 6/6 Plus, but with a newer chip and some features trimmed out. I’mย reasonably confident that the chip is an sn27546-A5 but have no idea if it’s the official part designator.
  6. The iPhone SE battery seems to have a unique custom chip, but has gone back to a DFN-based package (similar to bq27541) rather than a BGA like the bq27545/546. It is marked “A1141” and does not respond to my HDQ adapter, only the official TI EV2300/EV2400. I have only one in my possession, so I am not 100% sure whether this is true for this series of batteries.
Advertisements

24 thoughts on “So Phone Me Maybe: A list of iPhone/iPad batteries with gas gauge functionality

    • Hi Nick,

      Sadly, I still do not have the iPhone 5’s unseal key, and it may very well be the case that I may not ever be able to obtain it. I have not been able to find iPhone 5 batteries that were left in the Full Access/uninitialized state, which is the only practical way for me to obtain the unseal key. I tried brute-forcing the password, but it turns out that the fuel gauge has a 4-second timeout that will reject other unseal password attempts, even if the key is correct.

      Jason

      • Oh well… I’ll search on my side for a “Full access” one… if I happen to stumble on one, the sealed to unseal key should be in the data flash, SubClassID 112, offset 0, right? (I read this on the datasheet)

      • Basically. I’ve been doing more work on my HDQ Utility, adding a bunch of features. Right now, I’m trying out the Data Flash commands to do things like read out the unseal key.

  1. Great! Hope you can get it to read. I went through ~220 batteries already, no luck, there are various combinations on the Control Status word (6009, 600b, 6039, 603b, 6109, 610b, 7039, 703b) but nothing less than 0x60 on the high byte…

    • Wow, 220+ batteries? Sure beats the five I had ๐Ÿ™‚

      I’m thinking of ways to force the gas gauge into a firmware-update mode. If I can induce that, I can read out the entire contents of the Data Flash without needing the unseal key first. I’m not exactly hopeful of that actually working though…

      • Hi sir ,When i sniffer the iphone6 battery hdq line,i found have one string “68 20 74 00 75 00 76 6A 77 00 “what i don’t understand,Can u explain to me,thx a lot.by the way iPhone5 still have not the unseal key?

      • Hi Huier,

        Do you have a detailed log of the data you sniffed from the HDQ bus? I can’t find any meaningful information from the hex string that you provided. I still don’t have the iPhone 5 unseal key, but I just bought another one a few minutes ago. Hopefully this one is a “factory leaked” model, if the picture on its eBay listing is true.

  2. if the byte bit(7)==1 means write the register.and bit(7)==0 is read,
    and two bytes is one pair .for example. “01 05” means read reg[0x01]==0x05
    and “80 02” write 0x02 to reg[0x00].

    80 02 81 00 //FW_VERSION 0x0002 Yes Reports the firmware version on the device type
    01 05 00 02 01 05 //
    80 13 81 00 //SET_SHUTDOWN 0x0013 Yes Enables the SE pin to change state

    0B 00 0A 80 0B 00 //This read-only function returns the contents of the gas-gauge status register, depicting the current operating status.
    33 04 32 79 33 04 //ChargeCurrent() 0x32/0x33
    13 06 12 53 13 06 //FullChargeCapacity( ): 0x12/13

    15 00 14 00 15 00 //AverageCurrent( ): 0x14/0x15
    07 0B 06 E1 07 0B //Temperature( ): 0x06/0x07
    09 0F 08 DB 09 0F //Voltage( ): 0x08/0x09

    68 20 74 00 75 00 76 6A 77 00 //

    07 0B 06 E1 07 0B //Temperature( ): 0x06/0x07

    E1 01 BF 02 (W61 01 –W3F 02)

    40 46 41 47 42 39 43 35 44 30 45 33 46 33 47 4B 48 33 49 52 4A 45 4B 46 4C 57 4D 35 4E 59 4F 42 50 35 51 00 52 00 53 00 54 00 55 00 56 00 57 00 58 00 59 00 5A 00 5B 00 5C 00 5D 00 5E 00 5F 00 60 B7
    ‘F’ ‘G’ ‘9’ ‘5’ ‘0’ ‘3’ ‘3’ ‘K’ ‘3’ ‘R’ ‘E’ ‘F’ ‘W’ ‘5’ ‘Y’ ‘B’ ‘5’
    BlockData( ): 0x40โ€ฆ0x5f
    This command range is used to transfer data for data flash class access. This command range is the 32-byte
    data block used to access Manufacturer Info Block A or B. Manufacturer Info Block A is read only for the
    sealed access. UNSEALED access is read/write.
    BlockDataChecksum( ): 0x60

    • I’m not too sure what’s going on in there, but I think it has to do with a sort of authentication that the iPhone and the battery use, called “system pairing”. Unfortunately, I don’t know anything about how it works, and only know of this feature because TI’s software mentions it.

    • Hi Chris,

      Unfortunately, I don’t know much about MacBook unseal keys, especially after the whole rogue-firmware scare several years ago. I doubt I’d ever be able to obtain the keys for them, as it’s likely near impossible to get a battery that was left partially unprogrammed at the factory.

      Jason

      • An unseal key is a special unlocking command that is sent to the battery’s gas gauge. Without it, accessing the gauge’s internal memory is impossible (and many commands aren’t allowed without it).

        It hardly matters for most people, unless they are actively trying to access the gauge directly.

  3. You can use iMazing (imazing.com) on your Mac or PC, much easier to check your iPhone battery gas gauge. Select your device and click “Get Info”.

    • That’s a pretty cool utility. I still wouldn’t find any use for it, as I don’t even own an iOS device in the first place. ๐Ÿ˜›

      Besides, the scope is completely different. My program’s meant to be used out-of-system (the battery is taken out of the device), and was never intended to be used for working on live devices; on that note, some people have reported that they were able to use it to debug a running system.

  4. Thanks for keeping this info updated. It’s been helpful to me building an iPhone battery test pcb for cellphone technicians https://mozzwald.com/articles/iphone-battery-charger-tester-breakout-and-hdq-gas-gauge-stats

    I also have some very basic arduino code that uses an arduino HDQ library to print out battery stats. Maybe it could be useful for a rewrite of your HDQ Utility? Perhaps the next version of your HDQ Utility could be cross platform so us Linux folks can use it ๐Ÿ™‚

    Keep up the good work

    • Hello Sir,

      Just wanted to say Thank you for your library, it saved me a couple of years back when I was assigned the task of sorting out literally thousands of iPhone batteries.

      I too created an arduino based fixture to sort them out, I did slight modifications to the timings on the version I found then to make it work and posted it back here:

      http://forum.arduino.cc/index.php?topic=262365.msg2013614#msg2013614

      They basically wanted up to certain amount of cycles (CycleCount) and above certain SOH (FullChargeCapacity / DesignCapacity), I then created the fixture for these parameters, the test would start automatically once battery voltage was detected at the battery connector using one of the arduino’s analog inputs.

      Man, should you have a ‘Donate’ button, i would definetively buy a coffee or two ๐Ÿ˜‰

      Cheers!

      • Hi Nick,

        I do remember some of your previous emails, and thanks again for the iPhone 6 and 6 Plus batteries you sent in a while ago. One of them is being used as a ‘specimen’ for more detailed analysis of the Data Flash. Here’s a screenshot of one of my test programs: http://puu.sh/qnPRL/4e368e15f2.png

        As for the PayPal button, I think it works now. Apparently I can’t create new ones since PayPal wants me to create a Business Account for that. Hopefully this one won’t freeze my account…

        Cheers,
        Jason

      • Hi Jason

        The donate button seems to work, hope it reaches you ๐Ÿ˜‰

        Glad to know you put those batteries to good use! hey, I see you’re displaying now the internal resistance as well, does the battery needs to be unsealed to read those fields?

        BR!
        Nick

      • Hi Nick,

        Many thanks for the donation – I greatly appreciate it! I remember reading a TI document that mentioned accessing the Lifetime Data in the SEALED security state, but it’ll limit how much information I can read out. There’s a good chance I won’t be able to read anything past the “lifetime minimum/maximum cell chemical capacity” portion without unsealing the gauge first. Luckily, I have almost all of the iPhone unseal keys (after finally getting the iPhone 5 key, now I’m waiting for an iPhone SE battery to arrive in the mail – hopefully it’s not a counterfeit!). The advanced Lifetime Data parameters for iPhone/iPad batteries are stored in three different Data Flash subclasses; normally they take up less than one in non-Apple gauges.

        When a release version of the HDQ Utility comes out with this Data Flash readout support, I’ll probably have the program re-seal the gauge so that spurious HDQ writes can’t cause any harm to the gauge or its firmware, but the key will be saved in the log file should some mishap occur.

        Jason

    • Thanks for the kind words; your work looks pretty cool too! I do like the modularity of your charging/test breakout boards, and your Arduino implementation looks pretty nice as well.

      My own HDQ Utility is in a state of both flux and limbo. I’ve been intending on moving away from LabWindows/CVI and providing a means of running the program from multiple platforms – sometime I’ll have to try running my HDQ Utility as-is using Wine, perhaps. My utility has gotten a lot of new (unreleased) features, like the ability to read out certain parameters from the gauge’s Data Flash, including serial numbers and lifetime statistics. The difference between my release and test programs has gotten to the point where it’s getting difficult to sync the changes between the two versions, since the program was initially a test program and wasn’t originally intended to be a standalone utility. Additionally, I managed to fry both UART dongles I had on hand, so I have to either buy some replacements, or build one myself.

      I’m working on making my HDQ libraries more compartmentalized and portable (HDQ functions are higher-level, with the lower-level communication being handled separately), and have them publicly available so that others can have access to the more advanced features of TI’s gas gauges.

      Cheers,
      Jason

  5. do you still want batteries?
    i have quite a few dead genuine and otherwise 4s/4/5/5s/5c batteries that i could desolder the controllers from and send to you
    also have a few ipad2 battery boards and an ipad mini board
    most of my dead 5s/5c batteries are of the fake iphone 4 variety
    i do have a few real 5 batteries purchased on ebay new (no residue) that never worked right
    they could possibly be only partially programmed or be otherwise interesting

    • Hi Andy,

      I definitely won’t mind having more gas gauge boards – especially the iPad ones since I don’t have any data on them yet. The non-working iPhone 5 batteries could also be interesting.

      Thanks for the offer – you can contact me at ginbot86@gmail.com.

      Regards,
      Jason

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s