So Phone Me Maybe: A list of iPhone/iPad batteries with gas gauge functionality

Posted on September 15, 2014 by ginbot86

Looking for my HDQ Utility to read out your own batteries? Click here!

UPDATE: Turns out the iPhone 3G and 3GS do have gas gauges! I will add them to my list as I find out more about them.

Each iPhone generation since the ~~iPhone 4~~ iPhone 3G uses a TI gas gauge and uses the HDQ bus (iOS refers to this as the SWI [single-wire interface]) to communicate with the outside world. For more information about the HDQ protocol, click here.

I’ve noticed that many of the iPhone 5S and 5C batteries that can be purchased online are reusing iPhone 4 circuits, which will cause a significant decrease in gauge accuracy (proper parameters need to be programmed into the gas gauge, and that information is chemistry dependent), and the protection circuits in the iPhone 4 battery PCB will kick into overvoltage protection mode at 4.25 volts, less than the 4.3 volts that the iPhone 5 (and newer) batteries need to charge fully.

Because I have been unable to find a list of information of each battery generation, I’m making one myself. Because nobody else has dug this deep into the fuel gauges that the iPhone uses, I have to get this information experimentally (that is, by buying various batteries from online shops; the iPhone 5S battery has been very difficult to get, besides the fake ones I mentioned earlier).

So far I’m in need of an iPhone 3G (not the 3GS) battery, as well as all iPad batteries (or, if you have my program on hand, what model the battery is intended for, the fuel gauge device (eg. bq27541, bq27545), firmware version and designed capacity.

Model	Gas Gauge	Firmware	Designed Capacity	Default Unseal Key?	Comments
iPhone 3G	bq27541	?	?	Yes (0x36720414)	Need to acquire one of these.
iPhone 3GS	bq27541	1.17	1200 mAh	Yes (0x36720414)	Limited feature set. My utility will throw “No response” errors when reading this battery.
iPhone 4	bq27541	1.25	1420 mAh	Yes (0x36720414)
iPhone 4S	bq27541	1.35	1430 mAh	Yes (0x36720414)
iPhone 5	bq27545	3.10	1430 mAh	No (0x52695035)	Many thanks to Yann B. for finding the unseal key!
iPhone 5S	bq27545	3.10	1550 mAh	No (0x84966864)
iPhone 5C	bq27545	3.10	1500 mAh	No (0x84966864)
iPhone 6	sn27545-A4 (note 4)	5.02	1751 mAh	No (0x65441236)
iPhone 6 Plus	sn27545-A4 (note 4)	5.02	2855 mAh	No (0x18794977)
iPhone 6S	sn27546-A5 (note 5)	6.01	1690 mAh	No (0x90375994)
iPhone 6S Plus	sn27546-A5 (note 5)	6.01	2725 mAh	No (0x11022669)
iPhone SE	Unrecognized (note 6, 7) (A1141/0x1141)	1.03	1560 mAh	No (unknown)	(See note 6)
Apple Watch (38mm)	sn27545-A4	5.02	235 mAh	No (0x09130978)
Apple Watch (42mm)	sn27545-A4	5.02	245 mAh	No (unknown)	If anyone has one that reads “FULL ACCESS” in my program, please send it to me! 🙂
iPad (3rd gen)	bq27541	1.35	11560 mAh	Yes (0x36720414)

Notes:

All known iPhone battery models use custom firmware, so not all of the features that the mainstream gas gauge models use are available. For example, none of these gauges will calculate the battery’s State of Health percentage (it is basically the percentage of the battery’s full charge capacity (it degrades with use) versus its designed capacity.
The iPhone 5C’s battery label indicates a designed capacity of 1510 mAh, but the battery I’ve received indicates a capacity of 1550 mAh. As I have only been able to get one of these batteries that seem to be genuine, I will need to get more batteries of this type to confirm that this information is correct.
The iPhone 5’s battery label indicates a designed capacity of 1440 mAh, but the fuel gauge reports 1430 mAh. The 5S battery reports 1550 mAh, but is labeled 1560 mAh. The 5C reports 1500 mAh, but is labeled 1510 mAh.
The iPhone 6 and 6 Plus use a special firmware that is identified in TI’s battery software (except the very latest releases where such data was removed), and it has a very extensive feature set, and a lot of data logging features.
The iPhone 6S/6S Plus use a firmware version similar to the iPhone 6/6 Plus, but with a newer chip and some features trimmed out. I’m reasonably confident that the chip is an sn27546-A5 but have no idea if it’s the official part designator.
The iPhone SE battery seems to have a unique custom chip, but has gone back to a DFN-based package (similar to bq27541) rather than a BGA like the bq27545/546. It is marked “A1141” and does not respond to my HDQ adapter, only the official TI EV2300/EV2400. I have only one in my possession, so I am not 100% sure whether this is true for this series of batteries.
Come to think of it, I might have been ripped off with the battery I received, and it could very well be that I just have a counterfeit that uses a non-TI gauge.

43 thoughts on “So Phone Me Maybe: A list of iPhone/iPad batteries with gas gauge functionality”

Nick Juangorena on September 25, 2015 at 6:10 pm said:

Hello Jason,

Did you ever got the unseal key for the iPhone5?

Thanks

LikeLike

Reply ↓
- ginbot86 on September 25, 2015 at 6:16 pm said:
  
  Hi Nick,
  
  Sadly, I still do not have the iPhone 5’s unseal key, and it may very well be the case that I may not ever be able to obtain it. I have not been able to find iPhone 5 batteries that were left in the Full Access/uninitialized state, which is the only practical way for me to obtain the unseal key. I tried brute-forcing the password, but it turns out that the fuel gauge has a 4-second timeout that will reject other unseal password attempts, even if the key is correct.
  
  Jason
  
  LikeLike
  
  Reply ↓
  - Nick on September 28, 2015 at 4:38 pm said:
    
    Oh well… I’ll search on my side for a “Full access” one… if I happen to stumble on one, the sealed to unseal key should be in the data flash, SubClassID 112, offset 0, right? (I read this on the datasheet)
    
    LikeLike
    
    Reply ↓
    - ginbot86 on September 28, 2015 at 5:46 pm said:
      
      Basically. I’ve been doing more work on my HDQ Utility, adding a bunch of features. Right now, I’m trying out the Data Flash commands to do things like read out the unseal key.
      
      LikeLike
      
      Reply ↓
Nick on September 29, 2015 at 9:32 am said:

Great! Hope you can get it to read. I went through ~220 batteries already, no luck, there are various combinations on the Control Status word (6009, 600b, 6039, 603b, 6109, 610b, 7039, 703b) but nothing less than 0x60 on the high byte…

LikeLike

Reply ↓
- ginbot86 on September 30, 2015 at 2:30 am said:
  
  Wow, 220+ batteries? Sure beats the five I had 🙂
  
  I’m thinking of ways to force the gas gauge into a firmware-update mode. If I can induce that, I can read out the entire contents of the Data Flash without needing the unseal key first. I’m not exactly hopeful of that actually working though…
  
  LikeLike
  
  Reply ↓
  - huier on October 2, 2015 at 8:46 am said:
    
    Hi sir ,When i sniffer the iphone6 battery hdq line,i found have one string “68 20 74 00 75 00 76 6A 77 00 “what i don’t understand,Can u explain to me,thx a lot.by the way iPhone5 still have not the unseal key?
    
    LikeLike
    
    Reply ↓
    - ginbot86 on October 2, 2015 at 9:03 am said:
      
      Hi Huier,
      
      Do you have a detailed log of the data you sniffed from the HDQ bus? I can’t find any meaningful information from the hex string that you provided. I still don’t have the iPhone 5 unseal key, but I just bought another one a few minutes ago. Hopefully this one is a “factory leaked” model, if the picture on its eBay listing is true.
      
      LikeLike
      
      Reply ↓
huier on October 3, 2015 at 3:20 am said:

if the byte bit(7)==1 means write the register.and bit(7)==0 is read,
and two bytes is one pair .for example. “01 05” means read reg[0x01]==0x05
and “80 02” write 0x02 to reg[0x00].

80 02 81 00 //FW_VERSION 0x0002 Yes Reports the firmware version on the device type
01 05 00 02 01 05 //
80 13 81 00 //SET_SHUTDOWN 0x0013 Yes Enables the SE pin to change state

0B 00 0A 80 0B 00 //This read-only function returns the contents of the gas-gauge status register, depicting the current operating status.
33 04 32 79 33 04 //ChargeCurrent() 0x32/0x33
13 06 12 53 13 06 //FullChargeCapacity( ): 0x12/13

15 00 14 00 15 00 //AverageCurrent( ): 0x14/0x15
07 0B 06 E1 07 0B //Temperature( ): 0x06/0x07
09 0F 08 DB 09 0F //Voltage( ): 0x08/0x09

68 20 74 00 75 00 76 6A 77 00 //

07 0B 06 E1 07 0B //Temperature( ): 0x06/0x07

E1 01 BF 02 (W61 01 –W3F 02)

40 46 41 47 42 39 43 35 44 30 45 33 46 33 47 4B 48 33 49 52 4A 45 4B 46 4C 57 4D 35 4E 59 4F 42 50 35 51 00 52 00 53 00 54 00 55 00 56 00 57 00 58 00 59 00 5A 00 5B 00 5C 00 5D 00 5E 00 5F 00 60 B7
‘F’ ‘G’ ‘9’ ‘5’ ‘0’ ‘3’ ‘3’ ‘K’ ‘3’ ‘R’ ‘E’ ‘F’ ‘W’ ‘5’ ‘Y’ ‘B’ ‘5’
BlockData( ): 0x40…0x5f
This command range is used to transfer data for data flash class access. This command range is the 32-byte
data block used to access Manufacturer Info Block A or B. Manufacturer Info Block A is read only for the
sealed access. UNSEALED access is read/write.
BlockDataChecksum( ): 0x60

LikeLike

Reply ↓
- ginbot86 on October 6, 2015 at 2:41 am said:
  
  I’m not too sure what’s going on in there, but I think it has to do with a sort of authentication that the iPhone and the battery use, called “system pairing”. Unfortunately, I don’t know anything about how it works, and only know of this feature because TI’s software mentions it.
  
  LikeLike
  
  Reply ↓
Chris on March 11, 2016 at 10:48 am said:

Hey Jason, do you have any knowledge about MacBook battery unseal keys?
Nice blog! -chris

LikeLike

Reply ↓
- ginbot86 on March 11, 2016 at 10:53 am said:
  
  Hi Chris,
  
  Unfortunately, I don’t know much about MacBook unseal keys, especially after the whole rogue-firmware scare several years ago. I doubt I’d ever be able to obtain the keys for them, as it’s likely near impossible to get a battery that was left partially unprogrammed at the factory.
  
  Jason
  
  LikeLike
  
  Reply ↓
  - JackHammer on April 11, 2016 at 1:22 am said:
    
    what is unseal key?
    
    LikeLike
    
    Reply ↓
    - ginbot86 on April 11, 2016 at 1:24 am said:
      
      An unseal key is a special unlocking command that is sent to the battery’s gas gauge. Without it, accessing the gauge’s internal memory is impossible (and many commands aren’t allowed without it).
      
      It hardly matters for most people, unless they are actively trying to access the gauge directly.
      
      LikeLike
      
      Reply ↓
codebar on May 2, 2016 at 5:22 pm said:

You can use iMazing (imazing.com) on your Mac or PC, much easier to check your iPhone battery gas gauge. Select your device and click “Get Info”.

LikeLike

Reply ↓
- ginbot86 on May 3, 2016 at 4:15 pm said:
  
  That’s a pretty cool utility. I still wouldn’t find any use for it, as I don’t even own an iOS device in the first place. 😛
  
  Besides, the scope is completely different. My program’s meant to be used out-of-system (the battery is taken out of the device), and was never intended to be used for working on live devices; on that note, some people have reported that they were able to use it to debug a running system.
  
  LikeLike
  
  Reply ↓
mozzwald on August 2, 2016 at 8:17 am said:

Thanks for keeping this info updated. It’s been helpful to me building an iPhone battery test pcb for cellphone technicians https://mozzwald.com/articles/iphone-battery-charger-tester-breakout-and-hdq-gas-gauge-stats

I also have some very basic arduino code that uses an arduino HDQ library to print out battery stats. Maybe it could be useful for a rewrite of your HDQ Utility? Perhaps the next version of your HDQ Utility could be cross platform so us Linux folks can use it 🙂

Keep up the good work

LikeLike

Reply ↓
- Nick on August 2, 2016 at 3:49 pm said:
  
  Hello Sir,
  
  Just wanted to say Thank you for your library, it saved me a couple of years back when I was assigned the task of sorting out literally thousands of iPhone batteries.
  
  I too created an arduino based fixture to sort them out, I did slight modifications to the timings on the version I found then to make it work and posted it back here:
  
  http://forum.arduino.cc/index.php?topic=262365.msg2013614#msg2013614
  
  They basically wanted up to certain amount of cycles (CycleCount) and above certain SOH (FullChargeCapacity / DesignCapacity), I then created the fixture for these parameters, the test would start automatically once battery voltage was detected at the battery connector using one of the arduino’s analog inputs.
  
  Man, should you have a ‘Donate’ button, i would definetively buy a coffee or two 😉
  
  Cheers!
  
  LikeLike
  
  Reply ↓
  - ginbot86 on August 2, 2016 at 6:41 pm said:
    
    Hi Nick,
    
    I do remember some of your previous emails, and thanks again for the iPhone 6 and 6 Plus batteries you sent in a while ago. One of them is being used as a ‘specimen’ for more detailed analysis of the Data Flash. Here’s a screenshot of one of my test programs: http://puu.sh/qnPRL/4e368e15f2.png
    
    As for the PayPal button, I think it works now. Apparently I can’t create new ones since PayPal wants me to create a Business Account for that. Hopefully this one won’t freeze my account…
    
    Cheers,
    Jason
    
    LikeLike
    
    Reply ↓
    - Nick on August 3, 2016 at 9:23 am said:
      
      Hi Jason
      
      The donate button seems to work, hope it reaches you 😉
      
      Glad to know you put those batteries to good use! hey, I see you’re displaying now the internal resistance as well, does the battery needs to be unsealed to read those fields?
      
      BR!
      Nick
      
      LikeLike
      
      Reply ↓
      - ginbot86 on August 3, 2016 at 2:04 pm said:
        
        Hi Nick,
        
        Many thanks for the donation – I greatly appreciate it! I remember reading a TI document that mentioned accessing the Lifetime Data in the SEALED security state, but it’ll limit how much information I can read out. There’s a good chance I won’t be able to read anything past the “lifetime minimum/maximum cell chemical capacity” portion without unsealing the gauge first. Luckily, I have almost all of the iPhone unseal keys (after finally getting the iPhone 5 key, now I’m waiting for an iPhone SE battery to arrive in the mail – hopefully it’s not a counterfeit!). The advanced Lifetime Data parameters for iPhone/iPad batteries are stored in three different Data Flash subclasses; normally they take up less than one in non-Apple gauges.
        
        When a release version of the HDQ Utility comes out with this Data Flash readout support, I’ll probably have the program re-seal the gauge so that spurious HDQ writes can’t cause any harm to the gauge or its firmware, but the key will be saved in the log file should some mishap occur.
        
        Jason
        
        LikeLike
        
        Reply ↓
- ginbot86 on August 2, 2016 at 5:54 pm said:
  
  Thanks for the kind words; your work looks pretty cool too! I do like the modularity of your charging/test breakout boards, and your Arduino implementation looks pretty nice as well.
  
  My own HDQ Utility is in a state of both flux and limbo. I’ve been intending on moving away from LabWindows/CVI and providing a means of running the program from multiple platforms – sometime I’ll have to try running my HDQ Utility as-is using Wine, perhaps. My utility has gotten a lot of new (unreleased) features, like the ability to read out certain parameters from the gauge’s Data Flash, including serial numbers and lifetime statistics. The difference between my release and test programs has gotten to the point where it’s getting difficult to sync the changes between the two versions, since the program was initially a test program and wasn’t originally intended to be a standalone utility. Additionally, I managed to fry both UART dongles I had on hand, so I have to either buy some replacements, or build one myself.
  
  I’m working on making my HDQ libraries more compartmentalized and portable (HDQ functions are higher-level, with the lower-level communication being handled separately), and have them publicly available so that others can have access to the more advanced features of TI’s gas gauges.
  
  Cheers,
  Jason
  
  LikeLike
  
  Reply ↓
Andy on September 26, 2016 at 6:40 pm said:

do you still want batteries?
i have quite a few dead genuine and otherwise 4s/4/5/5s/5c batteries that i could desolder the controllers from and send to you
also have a few ipad2 battery boards and an ipad mini board
most of my dead 5s/5c batteries are of the fake iphone 4 variety
i do have a few real 5 batteries purchased on ebay new (no residue) that never worked right
they could possibly be only partially programmed or be otherwise interesting

LikeLike

Reply ↓
- ginbot86 on September 27, 2016 at 1:56 pm said:
  
  Hi Andy,
  
  I definitely won’t mind having more gas gauge boards – especially the iPad ones since I don’t have any data on them yet. The non-working iPhone 5 batteries could also be interesting.
  
  Thanks for the offer – you can contact me at ginbot86@gmail.com.
  
  Regards,
  Jason
  
  LikeLike
  
  Reply ↓
Vladimir on October 17, 2017 at 12:01 pm said:

Some information of A1141 it’s IC from powerflash tw

And does you can read flash memory of any sn2754x devices? Thank you for great work.

LikeLike

Reply ↓
- ginbot86 on October 17, 2017 at 12:12 pm said:
  
  Hi Vladimir,
  
  Many thanks for finding more information on the A1141 chip. Looks like there is no public documentation or software available for it, and it’s interesting how Apple has stopped using TI gas gauge chips.
  
  I have been working on some code to read out the Data Flash on the TI gas gauges but have not released any yet. I have been able to read out information like lifetime data and serial numbers.
  
  Regards,
  Jason
  
  LikeLike
  
  Reply ↓
  - vladimir on September 18, 2018 at 6:10 am said:
    
    Hi Jason,
    
    Now I have some interesting information about A1141 IC. In this article https://habr.com/post/423617/ (Russian language). In this article I was able to work with a battery based on A1141 as bq27545. a1141 is a good clone of sn/bq27545.
    
    Regards,
    Vladimir
    
    LikeLike
    
    Reply ↓
    - ginbot86 on September 18, 2018 at 8:34 pm said:
      
      Excellent writeup, Vladimir! It does appear the A1141 has more sensitive timings especially when it comes to sending the HDQ break signal.
      
      LikeLike
      
      Reply ↓
Rafael on March 25, 2018 at 5:46 pm said:

Hello
Nice job so far!!!
Do you have any information about the Iphone 7/ Iphone7 plus battery gauge chip?
I want to use it in a project and readout the remaining percentage(-;

Thanks in advance!
Best regards
Rafael

LikeLike

Reply ↓
- ginbot86 on March 25, 2018 at 5:54 pm said:
  
  Hi Rafael,
  
  I have limited information on the iPhone SE/7 and newer batteries. The ones in my collection were either counterfeit or used non-TI gauges that implemented HDQ differently, rendering them unusable with my UART-based HDQ adapter and software. The iPhone 6S and older batteries should be more usable, as long as they’re using proper TI gauges and not a counterfeit gauge IC.
  
  Jason
  
  LikeLike
  
  Reply ↓
  - sdsw4 on January 19, 2019 at 4:58 am said:
    
    I’ve got a genuine SE battery straight from the phone, I’m replacing. Would you still be interested in getting one?
    
    LikeLike
    
    Reply ↓
    - ginbot86 on January 19, 2019 at 9:20 am said:
      
      If you’re okay with sending things to Canada, I’d be willing to take it in to collect more data. Thanks!
      
      Jason
      
      LikeLike
      
      Reply ↓
      - sdsw4 on January 19, 2019 at 2:58 pm said:
        
        Great! Just email me the address(can you see it from my post?) and I’ll let you know when I mail it out to you. I live in Europe, and international shipping is not overtly expensive. The battery still holds a fair charge as well.
        
        Yeah, I’m working on a side project powering the SE with a different battery. I was able to use an i9500 battery to power the phone after building an adapter. Didn’t want to charge it without any sort of control, so I left that out of testing. I’d be happy to take in any advice or information you may have that can help me with this little project.
        
        LikeLike
        
        Reply ↓
        
        ginbot86 on January 20, 2019 at 3:00 am said:
        
        Yep, I’ve sent an email to the email you provided in the form. I really appreciate it – thanks!
        
        LikeLike
        
        Reply ↓
        
        Tom on July 23, 2019 at 5:22 pm said:
        
        i would love to see what you guys have done with the SE battery. i just started fiddling around with one of my own… originally to revive a dead SE, but then i just found it to be fun and interesting.
        
        LikeLike
        
        Reply ↓
      - fei on December 14, 2019 at 9:02 pm said:
        
        Hello jason
        Do you need iPhone 7/8/8 / X / XS / 11 batteries? I have many iphone original batteries
        I am in Huaqiangbei, Shenzhen, China
        
        LikeLike
        
        Reply ↓
        
        ginbot86 on December 20, 2019 at 9:18 pm said:
        
        Hi Fei,
        As much as it would be helpful to get samples of original batteries, it’s been too cost prohibitive to get a model of each one so far. Thanks though.
        
        LikeLike
        
        Reply ↓
- Uğur Kırçıl on March 15, 2020 at 5:07 am said:
  
  Gauge in iphone 7 is same as iphone 6s / 6s plus. Bq27546 with 6_01 firmware. But it does have different unseal key.
  
  LikeLike
  
  Reply ↓
  - Pavel on February 2, 2021 at 4:06 pm said:
    
    What Unseal Key in iphone 7????
    
    LikeLike
    
    Reply ↓
    - ginbot86 on February 2, 2021 at 4:11 pm said:
      
      I don’t know. I haven’t kept up with the newer iPhone batteries and getting batteries with an unsealed gas gauge are now very difficult to find.
      
      LikeLike
      
      Reply ↓
Pingback: All about iPhone Batteries, and why you don't want 0 cycle | A One Mobiles and Repairs
fundthatpart on July 9, 2019 at 7:12 pm said:

Great read. I got logic analyzer and I’m plugin it in to bunch of electronics to see how they works. I did plug to gauge of iPhone 6. The data that comes out of phone is quite different than what I see on TI commands table. Did you have any luck figuring out how 6/6s batteries gauge work?

LikeLike

Reply ↓
Simon on January 15, 2020 at 1:48 am said:

Hi,
Does anyone have a good source for Apple Watch battery connectors? iPhone connectors can be bought easily from aliexpress, but I couldn’t find any connectors for the watch.

Best
Simon

LikeLike

Reply ↓