Tag Archives: iphone gas gauge

So Phone Me Maybe: A list of iPhone/iPad batteries with gas gauge functionality

Posted on by
43

Looking for my HDQ Utility to read out your own batteries? Click here!

UPDATE: Turns out the iPhone 3G and 3GS do have gas gauges! I will add them to my list as I find out more about them.

Each iPhone generation since the iPhone 4 iPhone 3G uses a TI gas gauge and uses the HDQ bus (iOS refers to this as the SWI [single-wire interface]) to communicate with the outside world. For more information about the HDQ protocol, click here.

I’ve noticed that many of the iPhone 5S and 5C batteries that can be purchased online are reusing iPhone 4 circuits, which will cause a significant decrease in gauge accuracy (proper parameters need to be programmed into the gas gauge, and that information is chemistry dependent), and the protection circuits in the iPhone 4 battery PCB will kick into overvoltage protection mode at 4.25 volts, less than the 4.3 volts that the iPhone 5 (and newer) batteries need to charge fully.

Because I have been unable to find a list of information of each battery generation, I’m making one myself. Because nobody else has dug this deep into the fuel gauges that the iPhone uses, I have to get this information experimentally (that is, by buying various batteries from online shops; the iPhone 5S battery has been very difficult to get, besides the fake ones I mentioned earlier).

So far I’m in need of an iPhone 3G (not the 3GS) battery, as well as all iPad batteries (or, if you have my program on hand, what model the battery is intended for, the fuel gauge device (eg. bq27541, bq27545), firmware version and designed capacity.

Model Gas Gauge Firmware Designed Capacity Default Unseal Key? Comments
iPhone 3G bq27541 ? ? Yes (0x36720414) Need to acquire one of these.
iPhone 3GS bq27541 1.17 1200 mAh Yes (0x36720414) Limited feature set. My utility will throw “No response” errors when reading this battery.
iPhone 4 bq27541 1.25 1420 mAh Yes (0x36720414)
iPhone 4S bq27541 1.35 1430 mAh Yes (0x36720414)
iPhone 5 bq27545 3.10 1430 mAh No (0x52695035) Many thanks to Yann B. for finding the unseal key!
iPhone 5S bq27545 3.10 1550 mAh No (0x84966864)
iPhone 5C bq27545 3.10 1500 mAh No (0x84966864)
iPhone 6 sn27545-A4 (note 4) 5.02 1751 mAh No (0x65441236)
iPhone 6 Plus sn27545-A4 (note 4) 5.02 2855 mAh No (0x18794977)
iPhone 6S sn27546-A5 (note 5) 6.01 1690 mAh No (0x90375994)
iPhone 6S Plus sn27546-A5 (note 5) 6.01 2725 mAh No (0x11022669)
iPhone SE Unrecognized (note 6, 7) (A1141/0x1141) 1.03 1560 mAh No (unknown) (See note 6)
Apple Watch (38mm) sn27545-A4 5.02 235 mAh No (0x09130978)
Apple Watch (42mm) sn27545-A4 5.02 245 mAh No (unknown) If anyone has one that reads “FULL ACCESS” in my program, please send it to me! 🙂
iPad (3rd gen) bq27541 1.35 11560 mAh Yes (0x36720414)

Notes:

  1. All known iPhone battery models use custom firmware, so not all of the features that the mainstream gas gauge models use are available. For example, none of these gauges will calculate the battery’s State of Health percentage (it is basically the percentage of the battery’s full charge capacity (it degrades with use) versus its designed capacity.
  2. The iPhone 5C’s battery label indicates a designed capacity of 1510 mAh, but the battery I’ve received indicates a capacity of 1550 mAh. As I have only been able to get one of these batteries that seem to be genuine, I will need to get more batteries of this type to confirm that this information is correct.
  3. The iPhone 5’s battery label indicates a designed capacity of 1440 mAh, but the fuel gauge reports 1430 mAh. The 5S battery reports 1550 mAh, but is labeled 1560 mAh. The 5C reports 1500 mAh, but is labeled 1510 mAh.
  4. The iPhone 6 and 6 Plus use a special firmware that is identified in TI’s battery software (except the very latest releases where such data was removed), and it has a very extensive feature set, and a lot of data logging features.
  5. The iPhone 6S/6S Plus use a firmware version similar to the iPhone 6/6 Plus, but with a newer chip and some features trimmed out. I’m reasonably confident that the chip is an sn27546-A5 but have no idea if it’s the official part designator.
  6. The iPhone SE battery seems to have a unique custom chip, but has gone back to a DFN-based package (similar to bq27541) rather than a BGA like the bq27545/546. It is marked “A1141” and does not respond to my HDQ adapter, only the official TI EV2300/EV2400. I have only one in my possession, so I am not 100% sure whether this is true for this series of batteries.
  7. Come to think of it, I might have been ripped off with the battery I received, and it could very well be that I just have a counterfeit that uses a non-TI gauge.

Looking inside an iPhone 5 battery

Posted on by
14

In the wake of my previous teardowns of the iPhone 4 and 4S batteries, I went onto eBay and Amazon (realizing that they finally have Amazon Prime student rates up in Canada) and bought a few iPhone 5 and 5S batteries. Although I was primarily interested in trying to get the gas gauge information out of the batteries, I had a secondary reason. The Nexxtech Slim Power Bank (a subject of a separate blog post) uses a pair of 3.8-volt Li-ion polymer batteries, and they seemed to be be suspiciously similar in size to what is used in the iPhone 5. But enough of that, we’re here for the iPhone 5 battery in particular!

Battery Casing

The iPhone 5 battery measures 3.7 mm in thickness, 3.2 cm in width and 9.1 cm in length. This particular model, made by Sony, has a model ID of US373291H, with the six digits corresponding to the cell’s dimensions. This cell has a labeled capacity of 1440 mAh at a nominal 3.8 volts, with a maximum charge voltage of 4.3 volts. I tried to read the data matrix barcode on the cell but my barcode scanning app on my phone refused to recognize it. I might try to scan and sharpen the barcode later but it’s not something that’s of a high priority to me.

Battery Teardown and Pinout

The board itself is rather interesting. The protection MOSFETs used to switch the battery’s power are chip-scale packages and are glued down with epoxy, same with the gas gauge itself. This means that I can’t easily replace it with a rework station if the need arises. The board includes the gas gauge, thermistors, protection circuitry and still has room for a polyfuse for extra over-current protection.

iPhone 5 battery PCB layout

iPhone 5 battery PCB layout

The pinout of the iPhone 5 battery is pretty much the same as of the iPhone 4 and 4S. You have Pack-, NTC Thermistor, HDQ and Pack+. In this particular model of battery, the gas gauge is a bq27545 (labeled SN27545), but has basically the same feature set as the iPhone 4/4S’ bq27541. With this information, I soldered to the small terminals on the connector (the actual connectors for this battery haven’t arrived yet since it takes so long to receive items from China on eBay), and hooked it up to my trusty Texas Instruments EV2400 box.

iPhone 5 battery pinout

iPhone 5 battery pinout

Battery Data

iphone 5 firmware versionAnd once again, we’re presented with an obscure firmware revision. The latest bq27545-G1 firmware is only version 2.24, but this chip has version 3.10. After forcing GaugeStudio to accept this gauge as a -G1 version, we’re once again presented with a sealed chip. Let’s try to unseal it with the default key…

... aaaaand nope. No dice with 0x36720414, unlike last time.

Nope. No dice with 0x36720414, unlike last time.

… and I get the dreaded “Unseal Key” prompt. Cue the dramatic Darth Vader “NOOOOO” here. Maybe Apple read my previous post and decided to change the default keys this time (Hey Apple, if you read this, make the iPhone 6’s gas gauge have the default keys again)! This means that not only can I not access any of the juicy details of this battery, but I cannot update its firmware to a more… conventional version either. I could try brute-forcing it, but trying to hack a key with a 32-bit address space over a 7 kbps bus… uh, no. That’s not going to happen. I’d probably have better luck reverse-engineering Apple’s battery code but I doubt they have any facility to do in-system firmware updates for the gas gauge.

Data captured from GaugeStudio

Data captured from GaugeStudio

Now for some rather… interesting details of what we can access. The design capacity of this battery, according to the gas gauge, is 1430 mAh, same as the iPhone 4S and also 100 mAh less than what’s written on the label. That, and the full charge capacity of this battery is 1397 mAh out of the gate. The gauge seems to be an insomniac (it won’t enter Sleep mode even when the battery is not hooked up to any load), and it seems to have less features despite having a higher firmware version (I’m sure the internal temperature isn’t 131 degrees C…), and the Pack Configuration register doesn’t bring up any sensible data.

Battery… conspiracy?

One thing that I haven’t confirmed is whether or not this battery had been tampered with before I received it. I bought this particular battery from eBay and it was listed as new. It had some adhesive residue but no obvious sign of being peeled off from another iPhone. The cycle count is set to 1, and because the gas gauge is sealed, I can’t read any other data like the lifetime data logs. There is a chance that this battery isn’t new and that the seller had somehow changed the data memory and sealed the chip with a non-default key, but I need to wait until some other batteries arrive in the mail and perhaps try reading out batteries taken out directly from some iPhone 5s. Until then, it’s only speculation as to why this chip is sealed with a different key.

The next victims specimens: an iPhone 5S battery, a “new” iPhone 4 battery, and an Amazon Kindle battery.