Tag Archives: teardown

Looking inside a (fake) iPhone 5S battery

Posted on by
18

Considering how popular the iPhone is, there’s always going to be some counterfeits out there. I’ve been out buying various iPhone batteries to build a database of each generation’s characteristics, but one model has eluded me so far: the iPhone 5S. The iPhone 5C’s battery that I bought appears to be genuine (but with its own issues), but none of the iPhone 5S batteries I’ve bought so far (4 of them at the time of writing this blog post) were genuine. All of these fakes look like a genuine battery at first glance, but all of them share a few common traits.

Battery teardown

The fake battery sports the usual iPhone battery information, complete with some dot-matrix printed data and a data-matrix barcode. It’s labeled with a capacity of 1560 mAh and 3.8 volts nominal voltage.

Comparison between real and fake iPhone 5S battery

Comparison between real and fake iPhone 5S battery

The connector itself has two points for soldering the connector to provide durability. However, with the fake batteries, they are not soldered down. The two spots on the ends of the connectors are dark with a small point visible inside it (that point is the reinforcement pin on the connector). If this connector is installed in an iPhone, it will probably not come out without either damaging the battery’s connector, or worse, leave the plastic connector piece inside the phone, requiring tweezers to remove.

Connector lifted off with a hobby knife

Connector lifted off with a hobby knife

iPhone 5S and 5C battery pinout

iPhone 5S and 5C battery pinout

Removing the black protective tape reveals an iPhone 4 battery fuel gauge board. The connector is soldered to this board, with four solder points visible.

iPhone 4 battery PCB with soldered-on flat flex connector

iPhone 4 battery PCB with soldered-on flat flex connector

Pulling out the PCB  reveals another characteristic of these fake batteries: the positive terminal is cut short, with another metal section being clumsily spot-welded to the stub on the cell.

Note how the battery tab is poorly welded to the PCB.

Note how the battery tab is poorly welded to the PCB.

Battery fuel gauge data

The battery fuel gauge requires proper programming to accurately indicate the battery’s charge status. Because of this, each iPhone battery generation has its own specific configuration.

The fake iPhone battery retains the programming for the iPhone 4’s battery, which is a designed capacity of 1420 mAh, using a bq27541 fuel gauge running version 1.25 firmware. The data inside it is often that of a used/recycled battery as well.

This data can be (partially) read out directly from the iPhone with a tool such as iBackupBot, but more data can be read if the battery is read with another tool. I have the EV2400 from Texas Instruments to read this out on a PC, but this data can be read out with a USB-to-TTL serial port, a logic gate (a logic inverter) and a small MOSFET transistor.

I created a small tool that uses this circuit to interface with the fuel gauge and read out its data. Check it out here.

Using my tool, this is the report for one of these fake batteries. Note how it is identified as an iPhone 4 battery. Don’t be fooled by the calculated state of health. It’s not accurate for this battery as the fuel gauge still thinks it’s still inside an iPhone 4 battery pack.


**** START OF HDQ BATTERY LOG REPORT ****
HDQ Gas Gauge Readout Tool version 0.9 by Jason Gin
Date: 9/30/2014
Time: 0:52:24
Serial port: COM26

Battery Identification
========================
DEVICE_TYPE = 0x0541, FW_VERSION = 0x0125, DESIGN_CAPACITY = 1420 mAh
Battery's configuration matches that of a standard iPhone 4 battery.

Basic Battery Information
===========================
Device = bq27541 v.1.25, hardware rev. 0x00B5, data-flash rev. 0x0000
Voltage = 3804 mV
Current = 0 mA
Power = 0 mW
State of charge = 45%
Reported state of health = 0%
Calculated state of health = 99.3%
Cycle count = 14 times
Time to empty = N/A (not discharging)
Temperature = 27.9 °C (80.3 °F) (3009 raw)
Designed capacity = 1420 mAh
Heavy load capacity = 628/1410 mAh
Light load capacity = 673/1455 mAh

Advanced Battery Information
==============================
Capacity discharged = 0 mAh
Depth of discharge at last OCV update = ~778 mAh (8768 raw)
Maximum load current = -200 mA
Impedance Track chemistry ID = 0x0163
Reset count = 11 times

Flags = 0x0180
Flag interpretation:
* Fast charging allowed
* Good OCV measurement taken
* Not discharging

Control Status = 0x6219
Control Status interpretation:
* SEALED security state
* SLEEP power mode
* Constant-power gauging
* Qmax update voltage NOT OK (Or in relax mode)
* Impedance Track enabled

Pack Configuration = 0x8931
Pack Configuration interpretation:
* No-load reserve capacity compensation enabled
* IWAKE, RSNS1, RSNS0 = 0x1
* SLEEP mode enabled
* Remaining Capacity is forced to Full Charge Capacity at end of charge
* Temperature sensor: External thermistor

Device name length = 7 bytes
Device name: bq27541

**** END OF HDQ BATTERY LOG REPORT ****
Advertisement

Review, teardown and analysis of Charging Essentials USB wall outlet

Posted on by
74

(UPDATE: March 2, 2015 – I’ve picked up a pair of the newer tamper-resistant versions of this wall outlet. A review and teardown on that unit is coming up; stay tuned!)
(UPDATE 2: May 29, 2016 – Scratch that on the first tamper-resistant model; it had the same performance as the one mentioned here. Also, Costco has released a 3.1A version of this outlet, and is currently under review.)

About a week ago I bought a set of wall outlets from Costco that integrate two USB charging ports into a standard Decora-type receptacle. It’s marketed to replace your traditional AC adapter, allowing other appliances to be plugged in while charging your portable electronics.

The outlet is made by Omee Electrical Company, but curiously enough this particular model, the OM-USBII, wasn’t listed on their site. The packaging itself bears the name Charging Essentials, with a logo that looks like a USB icon that’s had one Viagra too many. The packaging states that the outlet has:

  • “Two 5VDC 2.1A ports for more efficient charging in less time”
  • “Smarter USB charging with special chip designed to recognize and optimize the charging requirements of your device”
  • “Screw-free wall plate snaps into place for a more clean, modern appearance”

The second note is of particular importance to me. If it’s true, that means it might be using some USB charge port controller like TI’s TPS251x-series chips. But I’m not one to have blind faith in what’s written on the packaging. Let’s rip this sucker apart!

The outlet has a snap-on coverplate which may look sleek but could hamper removal of this outlet later on if needed. I was curious as to why one couldn’t just use a regular screw-on coverplate, and it turns out it’s because the mounting flange doesn’t have any tapped screw holes; you physically can’t use screws on this because the manufacturer didn’t want to go to the effort to make holes that can accept screws!

The casing is held together with four triangle-head screws in a weak attempt to prevent opening of the device. I had a security bit set on hand so this posed no hindrance to me. Upon removing the cover, the outlet seems rather well built. However, after removing the main outlet portion to reveal the AC-DC adapter inside, I quickly rescinded that thought.

The converter seems relatively well-built (at least relative to some crap Chinese power supplies out there). Some thought was put into the safe operation of this device, but there’s almost no isolation between the high and low voltage sides, and the DC side of this adapter is not grounded; the “ground” for the USB ports floats at 60 volts AC with respect to the mains earth pin. The Samxon brand caps are also pretty disappointing.

As for the USB portion of this device, I had to remove some hot glue holding the panel in place. After a few minutes of picking away at the rubbery blob, I was able to pull out the USB ports.

… and I found LIES! DIRTY LIES! There is no USB charge port controller, contrary to what the packaging claims. It just uses a set of voltage dividers to emulate the Apple charger standard, which could break compatibility with some smartphones. Ugh, well let’s put it back together and take a look at it from the performance side of things. At least the USB ports feel pretty solid…

To measure the voltage-current characteristic of the outlet, I rebuilt my bq27510-G3 Li-Ion gas gauge board so it had better handling of high current without affecting my current and voltage measurements. The reason I used this is because the gauge combines a voltmeter and ammeter in one chip, and by using the GaugeStudio software, I could create easy, breezy, beautiful V-I graphs.

Using a Re:load 2 constant-current load, I slowly ramped up the load current while logging the voltage and current data to a CSV file for analysis in Excel.

overall vi graphThis charger’s… okay. It has surprisingly good regulation up to 2.3 amps, but after that point the AC-DC converter basically brickwalls and the voltage plummets to 3 volts. That said, this also means that this outlet is not a set of “two 2.1A USB ports”. You can charge one tablet but you won’t be able to charge a tablet along with another device simultaneously.

Bah, I’ve had it with this wall outlet. Looks like this one’s gonna be returned to Costco in the next few days. This outlet may be adequate for some people, but for me it’s a disappointment.

Pros:

  • Solid USB ports
  • Good voltage stability (up to 2.3 amps, enough to charge ONE tablet)
  • Apple device compatibility

Cons:

  • Annoying coverplate design
  • Does not meet rated current output, will not charge 2 tablets or 1 tablet + another device
  • Does NOT have a “smart charging chip” despite being stated on packaging, some devices (eg. BlackBerry) will refuse to charge from these ports
  • Power supply for USB seems cheap
  • USB port is not grounded – if a short-circuit happens inside the power supply it can be a shock hazard to you

Looking inside an iPhone 4/4S battery

Posted on by
30

A classmate of mine had a couple broken iPhones that he ‘relieved’ of their batteries and let me take a look at them. Being the curious type I peeled away the outer layers of tape to reveal the protection circuit. I spotted a current sense resistor, and  that got me thinking…

… can it be? Yes, I found a bq27541 fuel gauge chip inside the battery! After fooling around with the battery, I found out that the battery is using the HDQ interface.

iphone battery pinoutThe HDQ bus, which stands for ‘High-speed Data Queue’, is a single-wire communications bus used by TI fuel gauges. It’s similar to Maxim’s 1-Wire protocol but runs with different protocols and timing. It operates at 7 kilobits per second (so much for ‘high speed’ right? 😛 ) and a refresh of the data memory in the TI software can take almost half a minute. However, it’s good enough for occasional polling (like every minute or so) since it’s unlikely that the gauge will be read from every second.

The bq27541(labeled BQ 7541) in the iPhone battery runs an unusual firmware version. It’s running version 1.35 and doesn’t match with any release on TI’s website. The gas gauge is sealed so initially it seems like gaining access to the Data Flash memory would be impossible. However, in non-Apple fashion, the gauge’s passwords are left at the default; 0x36720414 and 0xFFFFFFFF for the unseal and full-access keys, respectively (and it’s not the first time Apple’s done this!). Since the firmware version is unknown, I told bqEVSW to treat the chip as if it were the bq27541-V200. I then saved only the calibration, capacity, resistance and lifetime data.

Updating the firmware over HDQ was a nightmare. It took over a dozen tries for each of the two batteries I had, and the update process took 45 minutes (!) to update the bq27541 to the V200 firmware. At one point, it seemed as if I bricked the chip, but a power-on reset of the chip by shorting the cell very quickly 😀 sent the device into ROM mode (ie. firmware-update mode). From there I used bqCONFIG to update the firmware, and it was successful! Now I could use GaugeStudio to interface with the gauge rather than the unsightly bqEVSW software.

bq27541 updated to version 2.00

bq27541 updated to version 2.00

Given how long it took for me to update the firmware of the gauge, I have doubts that iPhones will update their batteries’ firmware in-system. Hell, the iPhone OS ignores the bq27541’s State of Charge readings and substitutes its own. Nice going, Apple!

Now to start going through cell phone recycling bins to pull out dead iPhone batteries for their gauges…

Tearing down and analyzing a cheap-ass “Xtreme” $3.50 external phone battery

Posted on by
1

I was shopping around at this electronics liquidation store and stumbled upon a couple cheap buys: A “1900 mAh” external phone battery and another 4400 mAh pack (which will be the subject of another post and teardown). The batteries were originally priced at $7 and $38 respectively, but they were on sale at half price. For $3.50, I was curious enough about the 1900 mAh battery’s real capacity that I bought it anyway, expecting to be disappointed.

The pack itself is roughly half the size of a typical smartphone and about 1.5 times thicker. The casing itself has no screws; the manufacturer decided it was too expensive to use screws so they simply ultrasonic-welded the case shut. After about half an hour with a plastic spudger tool, I was able to crack the case open.

2014-01-05 00.11.26The soldering quality, surprisingly, is pretty good for a sub-$10 device, save for a bunch of hand-soldered components with flux residue left behind. The circuit board is made up of a battery protection circuit (yes, they actually put one in!), an ME2108A-50 boost converter,  something I’d assume to be a charging circuit, and an LM324 op-amp as a “gas gauge” (if you could even call it that!).

2014-01-05 00.11.36The cell appears to be a thicker version of a typical cell phone battery. It’s similar in size to something like a Nokia BL-5C which is a 1020 mAh cell, and is 5.6 mm thick. The cell in the charger is 7.7 mm thick. The charger’s cell is only 37.5% thicker but should have 190% of the capacity… yeah, no. This is not going to be very promising, given how the spot-welded nickel strips literally fell off the cell when I tried to desolder it from the PCB.

After soldering some 20-gauge solid wire to the terminals and hooking it up to a bq27425-G2A fuel gauge chip, I noticed that it reported that the fully-charged voltage is 4.25 volts. This charger tries to squeeze the most out of the cell by overcharging it! Granted, a Li-Ion cell’s maximum terminal voltage is 4.25 volts but it shouldn’t settle down to this voltage after charging!

1900 mah charger overvoltageAfter performing a few learning cycles to determine capacity and resistance, the cell holds merely 1370 mAh. The internal resistance is about 85 milliohms, which tells me that at least they used a relatively fresh cell in this charger and not just some recycled cell (*cough* UltraFire *cough*).

1900 mah charger graphI knew from the get-go that this battery was going to be a let-down, and I was right. But hey, for $3.50 I get a half-decent 1370 mAh cell and a few scrap chips (no way I’m reusing that battery’s PCB as-is!). But my verdict: Avoid this battery pack if you intend to use it to, I dunno, charge your phone. 😛

Tearing down a Razer Orochi Bluetooth gaming mouse

Posted on by
Reply

Today, I randomly felt like I should take apart my Razer Orochi gaming mouse to see what’s inside. I figured that if I’m going to take it apart, I should document it.

So I did.

2013-05-12 16.26.39

The Razer Orochi is a laptop gaming mouse made by a company called Razer. They make a lot of gaming products like keyboards, mice and headsets. My brother has a bunch of Razer gaming devices (keyboard, headset and mouse) but this is my only Razer product that I own. The Orochi has a detachable micro-USB cord and also has Bluetooth support.

Looking inside, it appears that Razer definitely built this device to a price point. There are only 4 screws holding the device together (T6 Torx screws) and the rest are held together with plastic posts, with some components having the end posts melted to form a “weld” which might hamper repair efforts later if need be.

As for the electronics inside the mouse, there is a Freescale MC9S08JM60 8-bit HC08-architecture microcontroller, housing a 48 MHz CPU, 60 kB of program Flash memory, 4 kB of SRAM, 256 bytes of USB buffer RAM, a full-speed USB interface (12 Mbps), a real-time clock (I doubt that’s being used :)), an 8-pin keyboard interrupt module, and a few other peripherals expected of any general microcontroller (ADC, hardware serial interfaces, etc.). Bluetooth support is provided by a Broadcom BCM2042 module, which is advertised as being a single-chip device providing the HID (Human Interface Device) class and a full Bluetooth stack. It has its own 8051 8-bit CPU, 20 kB of internal SRAM, 8 kB of its own flash memory for configuration data, keyboard inputs, LED and LCD display drivers, quadrature decoders and a bunch of other features which are likely to be unused.

I was intending to replace the LEDs in the mouse (blue is such an ugly colour for LEDs) but it appears that the one on the mainboard is a red/blue bi-colour LED and the one in the scroll wheel is encased in plastic which has the end post melted in lieu of a screw.

Oh well, at least I was able to take a look inside this little piece of plastic and electronics.