Looking for my HDQ Utility to read out your own batteries? Click here!
UPDATE: Turns out the iPhone 3G and 3GS do have gas gauges! I will add them to my list as I find out more about them.
Each iPhone generation since the
iPhone 4 iPhone 3G uses a TI gas gauge and uses the HDQ bus (iOS refers to this as the SWI [single-wire interface]) to communicate with the outside world. For more information about the HDQ protocol, click here.
I’ve noticed that many of the iPhone 5S and 5C batteries that can be purchased online are reusing iPhone 4 circuits, which will cause a significant decrease in gauge accuracy (proper parameters need to be programmed into the gas gauge, and that information is chemistry dependent), and the protection circuits in the iPhone 4 battery PCB will kick into overvoltage protection mode at 4.25 volts, less than the 4.3 volts that the iPhone 5 (and newer) batteries need to charge fully.
Because I have been unable to find a list of information of each battery generation, I’m making one myself. Because nobody else has dug this deep into the fuel gauges that the iPhone uses, I have to get this information experimentally (that is, by buying various batteries from online shops; the iPhone 5S battery has been very difficult to get, besides the fake ones I mentioned earlier).
So far I’m in need of an iPhone 3G (not the 3GS) battery, as well as all iPad batteries (or, if you have my program on hand, what model the battery is intended for, the fuel gauge device (eg. bq27541, bq27545), firmware version and designed capacity.
|Model||Gas Gauge||Firmware||Designed Capacity||Default Unseal Key?||Comments|
|iPhone 3G||bq27541||?||?||Yes (0x36720414)||Need to acquire one of these.|
|iPhone 3GS||bq27541||1.17||1200 mAh||Yes (0x36720414)||Limited feature set. My utility will throw “No response” errors when reading this battery.|
|iPhone 4||bq27541||1.25||1420 mAh||Yes (0x36720414)|
|iPhone 4S||bq27541||1.35||1430 mAh||Yes (0x36720414)|
|iPhone 5||bq27545||3.10||1430 mAh||No (0x52695035)||Many thanks to Yann B. for finding the unseal key!|
|iPhone 5S||bq27545||3.10||1550 mAh||No (0x84966864)|
|iPhone 5C||bq27545||3.10||1500 mAh||No (0x84966864)|
|iPhone 6||sn27545-A4 (note 4)||5.02||1751 mAh||No (0x65441236)|
|iPhone 6 Plus||sn27545-A4 (note 4)||5.02||2855 mAh||No (0x18794977)|
|iPhone 6S||sn27546-A5 (note 5)||6.01||1690 mAh||No (0x90375994)|
|iPhone 6S Plus||sn27546-A5 (note 5)||6.01||2725 mAh||No (0x11022669)|
|iPhone SE||Unrecognized (note 6, 7) (A1141/0x1141)||1.03||1560 mAh||No (unknown)||(See note 6)|
|Apple Watch (38mm)||sn27545-A4||5.02||235 mAh||No (0x09130978)|
|Apple Watch (42mm)||sn27545-A4||5.02||245 mAh||No (unknown)||If anyone has one that reads “FULL ACCESS” in my program, please send it to me! 🙂|
|iPad (3rd gen)||bq27541||1.35||11560 mAh||Yes (0x36720414)|
- All known iPhone battery models use custom firmware, so not all of the features that the mainstream gas gauge models use are available. For example, none of these gauges will calculate the battery’s State of Health percentage (it is basically the percentage of the battery’s full charge capacity (it degrades with use) versus its designed capacity.
- The iPhone 5C’s battery label indicates a designed capacity of 1510 mAh, but the battery I’ve received indicates a capacity of 1550 mAh. As I have only been able to get one of these batteries that seem to be genuine, I will need to get more batteries of this type to confirm that this information is correct.
- The iPhone 5’s battery label indicates a designed capacity of 1440 mAh, but the fuel gauge reports 1430 mAh. The 5S battery reports 1550 mAh, but is labeled 1560 mAh. The 5C reports 1500 mAh, but is labeled 1510 mAh.
- The iPhone 6 and 6 Plus use a special firmware that is identified in TI’s battery software (except the very latest releases where such data was removed), and it has a very extensive feature set, and a lot of data logging features.
- The iPhone 6S/6S Plus use a firmware version similar to the iPhone 6/6 Plus, but with a newer chip and some features trimmed out. I’m reasonably confident that the chip is an sn27546-A5 but have no idea if it’s the official part designator.
- The iPhone SE battery seems to have a unique custom chip, but has gone back to a DFN-based package (similar to bq27541) rather than a BGA like the bq27545/546. It is marked “A1141” and does not respond to my HDQ adapter, only the official TI EV2300/EV2400. I have only one in my possession, so I am not 100% sure whether this is true for this series of batteries.
- Come to think of it, I might have been ripped off with the battery I received, and it could very well be that I just have a counterfeit that uses a non-TI gauge.
Did you ever got the unseal key for the iPhone5?
Sadly, I still do not have the iPhone 5’s unseal key, and it may very well be the case that I may not ever be able to obtain it. I have not been able to find iPhone 5 batteries that were left in the Full Access/uninitialized state, which is the only practical way for me to obtain the unseal key. I tried brute-forcing the password, but it turns out that the fuel gauge has a 4-second timeout that will reject other unseal password attempts, even if the key is correct.
Oh well… I’ll search on my side for a “Full access” one… if I happen to stumble on one, the sealed to unseal key should be in the data flash, SubClassID 112, offset 0, right? (I read this on the datasheet)
Basically. I’ve been doing more work on my HDQ Utility, adding a bunch of features. Right now, I’m trying out the Data Flash commands to do things like read out the unseal key.
Great! Hope you can get it to read. I went through ~220 batteries already, no luck, there are various combinations on the Control Status word (6009, 600b, 6039, 603b, 6109, 610b, 7039, 703b) but nothing less than 0x60 on the high byte…
Wow, 220+ batteries? Sure beats the five I had 🙂
I’m thinking of ways to force the gas gauge into a firmware-update mode. If I can induce that, I can read out the entire contents of the Data Flash without needing the unseal key first. I’m not exactly hopeful of that actually working though…
Hi sir ,When i sniffer the iphone6 battery hdq line,i found have one string “68 20 74 00 75 00 76 6A 77 00 “what i don’t understand,Can u explain to me,thx a lot.by the way iPhone5 still have not the unseal key?
Do you have a detailed log of the data you sniffed from the HDQ bus? I can’t find any meaningful information from the hex string that you provided. I still don’t have the iPhone 5 unseal key, but I just bought another one a few minutes ago. Hopefully this one is a “factory leaked” model, if the picture on its eBay listing is true.
if the byte bit(7)==1 means write the register.and bit(7)==0 is read,
and two bytes is one pair .for example. “01 05” means read reg[0x01]==0x05
and “80 02” write 0x02 to reg[0x00].
80 02 81 00 //FW_VERSION 0x0002 Yes Reports the firmware version on the device type
01 05 00 02 01 05 //
80 13 81 00 //SET_SHUTDOWN 0x0013 Yes Enables the SE pin to change state
0B 00 0A 80 0B 00 //This read-only function returns the contents of the gas-gauge status register, depicting the current operating status.
33 04 32 79 33 04 //ChargeCurrent() 0x32/0x33
13 06 12 53 13 06 //FullChargeCapacity( ): 0x12/13
15 00 14 00 15 00 //AverageCurrent( ): 0x14/0x15
07 0B 06 E1 07 0B //Temperature( ): 0x06/0x07
09 0F 08 DB 09 0F //Voltage( ): 0x08/0x09
68 20 74 00 75 00 76 6A 77 00 //
07 0B 06 E1 07 0B //Temperature( ): 0x06/0x07
E1 01 BF 02 (W61 01 –W3F 02)
40 46 41 47 42 39 43 35 44 30 45 33 46 33 47 4B 48 33 49 52 4A 45 4B 46 4C 57 4D 35 4E 59 4F 42 50 35 51 00 52 00 53 00 54 00 55 00 56 00 57 00 58 00 59 00 5A 00 5B 00 5C 00 5D 00 5E 00 5F 00 60 B7
‘F’ ‘G’ ‘9’ ‘5’ ‘0’ ‘3’ ‘3’ ‘K’ ‘3’ ‘R’ ‘E’ ‘F’ ‘W’ ‘5’ ‘Y’ ‘B’ ‘5’
BlockData( ): 0x40…0x5f
This command range is used to transfer data for data flash class access. This command range is the 32-byte
data block used to access Manufacturer Info Block A or B. Manufacturer Info Block A is read only for the
sealed access. UNSEALED access is read/write.
BlockDataChecksum( ): 0x60
I’m not too sure what’s going on in there, but I think it has to do with a sort of authentication that the iPhone and the battery use, called “system pairing”. Unfortunately, I don’t know anything about how it works, and only know of this feature because TI’s software mentions it.
Hey Jason, do you have any knowledge about MacBook battery unseal keys?
Nice blog! -chris
Unfortunately, I don’t know much about MacBook unseal keys, especially after the whole rogue-firmware scare several years ago. I doubt I’d ever be able to obtain the keys for them, as it’s likely near impossible to get a battery that was left partially unprogrammed at the factory.
what is unseal key?
An unseal key is a special unlocking command that is sent to the battery’s gas gauge. Without it, accessing the gauge’s internal memory is impossible (and many commands aren’t allowed without it).
It hardly matters for most people, unless they are actively trying to access the gauge directly.
You can use iMazing (imazing.com) on your Mac or PC, much easier to check your iPhone battery gas gauge. Select your device and click “Get Info”.
That’s a pretty cool utility. I still wouldn’t find any use for it, as I don’t even own an iOS device in the first place. 😛
Besides, the scope is completely different. My program’s meant to be used out-of-system (the battery is taken out of the device), and was never intended to be used for working on live devices; on that note, some people have reported that they were able to use it to debug a running system.
Thanks for keeping this info updated. It’s been helpful to me building an iPhone battery test pcb for cellphone technicians https://mozzwald.com/articles/iphone-battery-charger-tester-breakout-and-hdq-gas-gauge-stats
I also have some very basic arduino code that uses an arduino HDQ library to print out battery stats. Maybe it could be useful for a rewrite of your HDQ Utility? Perhaps the next version of your HDQ Utility could be cross platform so us Linux folks can use it 🙂
Keep up the good work
Just wanted to say Thank you for your library, it saved me a couple of years back when I was assigned the task of sorting out literally thousands of iPhone batteries.
I too created an arduino based fixture to sort them out, I did slight modifications to the timings on the version I found then to make it work and posted it back here:
They basically wanted up to certain amount of cycles (CycleCount) and above certain SOH (FullChargeCapacity / DesignCapacity), I then created the fixture for these parameters, the test would start automatically once battery voltage was detected at the battery connector using one of the arduino’s analog inputs.
Man, should you have a ‘Donate’ button, i would definetively buy a coffee or two 😉
I do remember some of your previous emails, and thanks again for the iPhone 6 and 6 Plus batteries you sent in a while ago. One of them is being used as a ‘specimen’ for more detailed analysis of the Data Flash. Here’s a screenshot of one of my test programs: http://puu.sh/qnPRL/4e368e15f2.png
As for the PayPal button, I think it works now. Apparently I can’t create new ones since PayPal wants me to create a Business Account for that. Hopefully this one won’t freeze my account…
The donate button seems to work, hope it reaches you 😉
Glad to know you put those batteries to good use! hey, I see you’re displaying now the internal resistance as well, does the battery needs to be unsealed to read those fields?
Many thanks for the donation – I greatly appreciate it! I remember reading a TI document that mentioned accessing the Lifetime Data in the SEALED security state, but it’ll limit how much information I can read out. There’s a good chance I won’t be able to read anything past the “lifetime minimum/maximum cell chemical capacity” portion without unsealing the gauge first. Luckily, I have almost all of the iPhone unseal keys (after finally getting the iPhone 5 key, now I’m waiting for an iPhone SE battery to arrive in the mail – hopefully it’s not a counterfeit!). The advanced Lifetime Data parameters for iPhone/iPad batteries are stored in three different Data Flash subclasses; normally they take up less than one in non-Apple gauges.
When a release version of the HDQ Utility comes out with this Data Flash readout support, I’ll probably have the program re-seal the gauge so that spurious HDQ writes can’t cause any harm to the gauge or its firmware, but the key will be saved in the log file should some mishap occur.
Thanks for the kind words; your work looks pretty cool too! I do like the modularity of your charging/test breakout boards, and your Arduino implementation looks pretty nice as well.
My own HDQ Utility is in a state of both flux and limbo. I’ve been intending on moving away from LabWindows/CVI and providing a means of running the program from multiple platforms – sometime I’ll have to try running my HDQ Utility as-is using Wine, perhaps. My utility has gotten a lot of new (unreleased) features, like the ability to read out certain parameters from the gauge’s Data Flash, including serial numbers and lifetime statistics. The difference between my release and test programs has gotten to the point where it’s getting difficult to sync the changes between the two versions, since the program was initially a test program and wasn’t originally intended to be a standalone utility. Additionally, I managed to fry both UART dongles I had on hand, so I have to either buy some replacements, or build one myself.
I’m working on making my HDQ libraries more compartmentalized and portable (HDQ functions are higher-level, with the lower-level communication being handled separately), and have them publicly available so that others can have access to the more advanced features of TI’s gas gauges.
do you still want batteries?
i have quite a few dead genuine and otherwise 4s/4/5/5s/5c batteries that i could desolder the controllers from and send to you
also have a few ipad2 battery boards and an ipad mini board
most of my dead 5s/5c batteries are of the fake iphone 4 variety
i do have a few real 5 batteries purchased on ebay new (no residue) that never worked right
they could possibly be only partially programmed or be otherwise interesting
I definitely won’t mind having more gas gauge boards – especially the iPad ones since I don’t have any data on them yet. The non-working iPhone 5 batteries could also be interesting.
Thanks for the offer – you can contact me at firstname.lastname@example.org.
Some information of A1141 it’s IC from powerflash tw
And does you can read flash memory of any sn2754x devices? Thank you for great work.
Many thanks for finding more information on the A1141 chip. Looks like there is no public documentation or software available for it, and it’s interesting how Apple has stopped using TI gas gauge chips.
I have been working on some code to read out the Data Flash on the TI gas gauges but have not released any yet. I have been able to read out information like lifetime data and serial numbers.
Now I have some interesting information about A1141 IC. In this article https://habr.com/post/423617/ (Russian language). In this article I was able to work with a battery based on A1141 as bq27545. a1141 is a good clone of sn/bq27545.
Excellent writeup, Vladimir! It does appear the A1141 has more sensitive timings especially when it comes to sending the HDQ break signal.
Nice job so far!!!
Do you have any information about the Iphone 7/ Iphone7 plus battery gauge chip?
I want to use it in a project and readout the remaining percentage(-;
Thanks in advance!
I have limited information on the iPhone SE/7 and newer batteries. The ones in my collection were either counterfeit or used non-TI gauges that implemented HDQ differently, rendering them unusable with my UART-based HDQ adapter and software. The iPhone 6S and older batteries should be more usable, as long as they’re using proper TI gauges and not a counterfeit gauge IC.
I’ve got a genuine SE battery straight from the phone, I’m replacing. Would you still be interested in getting one?
If you’re okay with sending things to Canada, I’d be willing to take it in to collect more data. Thanks!
Great! Just email me the address(can you see it from my post?) and I’ll let you know when I mail it out to you. I live in Europe, and international shipping is not overtly expensive. The battery still holds a fair charge as well.
Yeah, I’m working on a side project powering the SE with a different battery. I was able to use an i9500 battery to power the phone after building an adapter. Didn’t want to charge it without any sort of control, so I left that out of testing. I’d be happy to take in any advice or information you may have that can help me with this little project.
Yep, I’ve sent an email to the email you provided in the form. I really appreciate it – thanks!
i would love to see what you guys have done with the SE battery. i just started fiddling around with one of my own… originally to revive a dead SE, but then i just found it to be fun and interesting.
Do you need iPhone 7/8/8 / X / XS / 11 batteries? I have many iphone original batteries
I am in Huaqiangbei, Shenzhen, China
As much as it would be helpful to get samples of original batteries, it’s been too cost prohibitive to get a model of each one so far. Thanks though.
Gauge in iphone 7 is same as iphone 6s / 6s plus. Bq27546 with 6_01 firmware. But it does have different unseal key.
What Unseal Key in iphone 7????
I don’t know. I haven’t kept up with the newer iPhone batteries and getting batteries with an unsealed gas gauge are now very difficult to find.
Pingback: All about iPhone Batteries, and why you don't want 0 cycle | A One Mobiles and Repairs
Great read. I got logic analyzer and I’m plugin it in to bunch of electronics to see how they works. I did plug to gauge of iPhone 6. The data that comes out of phone is quite different than what I see on TI commands table. Did you have any luck figuring out how 6/6s batteries gauge work?
Does anyone have a good source for Apple Watch battery connectors? iPhone connectors can be bought easily from aliexpress, but I couldn’t find any connectors for the watch.