Rip It Apart - Jason's Electronics Blog-Thingy

iphone gas gauge | Rip It Apart Jason's electronics blog-thingy
Page 1 of 7
Rip It Apart Jason's electronics blogthingy

A site dedicated to my hacks, mods, makes and occasional ramblings.
TA G A R C H IV E S : I P H O N E GA S G A U G E
So Phone Me Maybe: A list of

iPhone/iPad batteries with gas
gauge functionality
Posted on September 15, 2014
UPDATE: Turns out the iPhone 3G and 3GS do have gas gauges! I will add them to
my list as I find out more about them.
Each iPhone generation since the iPhone 4 iPhone 3G uses a TI gas gauge and uses
the HDQ bus (iOS refers to this as the SWI [single-wire interface]) to communicate
with the outside world. For more information about the HDQ protocol, click here.
Ive noticed that many of the iPhone 5S and 5C batteries that can be purchased
online are reusing iPhone 4 circuits, which will cause a significant decrease in gauge
accuracy (proper parameters need to be programmed into the gas gauge, and that
information is chemistry dependent), and the protection circuits in the iPhone 4
battery PCB will kick into overvoltage protection mode at 4.25 volts, less than the 4.3
volts that the iPhone 5 (and newer) batteries need to charge fully.
Because I have been unable to find a list of information of each battery generation,
Im making one myself. Because nobody else has dug this deep into the fuel gauges
that the iPhone uses, I have to get this information experimentally (that is, by buying
various batteries from online shops; the iPhone 5S battery has been very difficult to
get, besides the fake ones I mentioned earlier).
Follow
Rip It Apart Jason's electronics blog-thingy
https://ripitapart.wordpress.com/tag/iphone-gas-gauge/
Follow Rip It
25/07/2015
Page 2 of 7
So far Im in need of an iPhone 3G (not the 3GS) battery, as well as all iPad batteries
(or, if you have my program on hand, what model the battery is intended for, the fuel
gauge device (eg. bq27541, bq27545), firmware version and designed capacity.
Model
Gas
Firmware Designed Default Unseal Key?
Gauge
iPhone
bq27541
Capacity
?
Yes (0x37420414)
3G
iPhone
Comments
Need to acquire
one of these.
bq27541
1.17
3GS
1200
Yes (0x36720414)
mAh
Limited feature
set. My utility
will throw No
response
errors when
reading this
battery.
iPhone
bq27541
1.25
4
iPhone
Yes (0x36720414)
mAh
bq27541
1.35
4S
iPhone
1420
1430
Yes (0x36720414)
mAh
bq27545
3.10
1430
No (unknown)
If anyone has
mAh
one that reads

FULL
ACCESS in my
program,
please send it
to me!
iPhone
bq27545
3.10
5S
1550
No (0x84966864)
mAh (not
fully sure
yet)
iPhone
bq27545
3.10
5C
1500
No (0x84966864)
mAh (not
fully sure
yet)
iPhone
bq27545-
A4
iPhone
bq27545-
6 Plus
A4
5.02
1751
No (0x65441236)
mAh
5.02
2855
No (0x18794977)
mAh
Follow
Follow Rip It
25/07/2015
iPad
bq27541
1.35
(3rd
11560
Page 3 of 7
Yes (0x36720414)
mAh
gen)
Notes:
1. All known iPhone battery models use custom firmware, so not all of the features
that the mainstream gas gauge models use are available. For example, none of
these gauges will calculate the batterys State of Health percentage (it is
basically the percentage of the batterys full charge capacity (it degrades with
use) versus its designed capacity.
2. The iPhone 5Cs battery label indicates a designed capacity of 1510 mAh, but
the battery Ive received indicates a capacity of 1550 mAh. As I have only been
able to get one of these batteries that seem to be genuine, I will need to get
more batteries of this type to confirm that this information is correct.
3. The iPhone 5s battery label indicates a designed capacity of 1440 mAh, but the
fuel gauge reports 1430 mAh. The 5S battery reports 1550 mAh, but is labeled
1560 mAh. The 5C reports 1500 mAh, but is labeled 1510 mAh.
4. The iPhone 6 and 6 Plus use a special firmware that is identified in TIs battery
software (except the very latest releases where such data was removed), and it
has a very extensive feature set, and a lot of data logging features.
Posted in Batteries, Hacks | Tagged 0x18794977, 0x36720414, 0x65441236,
0x84966864, battery fuel gauge, battery gas gauge, Battery Management,
bq27541, bq27545, iphone, iphone 3g, iphone 3gs, iphone 4, iphone 4s, iphone
5, iphone 5c, iphone 5s, iphone 6, iphone 6 plus, iphone battery capacity,
iphone battery unlock, iphone battery unseal key, iphone gas gauge, iphone
gas gauge password, iphone hdq, iphone swi, ti gauge password | Leave a
reply
Looking inside an iPhone

5 battery
Posted on July 25, 2014
In the wake of my previous teardowns of the iPhone 4 and 4S batteries, I went onto
eBay and Amazon (realizing that they finally have Amazon Prime student rates up in
Canada) and bought a few iPhone 5 and 5S batteries. Although I was primarily
interested in trying to get the gas gauge information out of the batteries, I had a
secondary reason. The Nexxtech Slim Power Bank (a subject of a separate blog
post) uses a pair of 3.8-volt Li-ion polymer batteries, and they seemed to be be
suspiciously similar in size to what is used in the iPhone 5. But enough of that, were
here for
the iPhone
5 battery blog-thingy
in particular!
Rip It Apart
Jason's
electronics
Follow
Follow Rip It
25/07/2015
Page 4 of 7
Battery Casing
The iPhone 5 battery measures 3.7 mm in thickness, 3.2 cm in width and 9.1 cm in
length. This particular model, made by Sony, has a model ID of US373291H, with the
six digits corresponding to the cells dimensions. This cell has a labeled capacity of
1440 mAh at a nominal 3.8 volts, with a maximum charge voltage of 4.3 volts. I tried
to read the data matrix barcode on the cell but my barcode scanning app on my
phone refused to recognize it. I might try to scan and sharpen the barcode later but
its not something thats of a high priority to me.
Battery Teardown and Pinout
The board itself is rather interesting. The protection MOSFETs used to switch the
batterys power are chip-scale packages and are glued down with epoxy, same with
the gas gauge itself. This means that I cant easily replace it with a rework station if
the need arises. The board includes the gas gauge, thermistors, protection circuitry
and still has room for a polyfuse for extra over-current protection.
iPhone 5 battery PCB layout
The pinout of the iPhone 5 battery is pretty much the same as of the iPhone 4 and
Follow
Follow Rip It
25/07/2015
Page 5 of 7
battery, the gas gauge is a bq27545 (labeled SN27545), but has basically the same
feature set as the iPhone 4/4S bq27541. With this information, I soldered to the small
terminals on the connector (the actual connectors for this battery havent arrived yet
since it takes so long to receive items from China on eBay), and hooked it up to my
trusty Texas Instruments EV2400 box.
iPhone 5 battery pinout
Battery Data
And once again, were presented with an obscure firmware revision. The latest
bq27545-G1 firmware is only version 2.24, but this chip has version 3.10. After
forcing GaugeStudio to accept this gauge as a -G1 version, were once again
presented with a sealed chip. Lets try to unseal it with the default key
Follow
Follow Rip It
25/07/2015
Page 6 of 7
Nope. No dice with 0x36720414, unlike last time.
and I get the dreaded Unseal Key prompt. Cue the dramatic Darth Vader
NOOOOO here. Maybe Apple read my previous post and decided to change the
default keys this time (Hey Apple, if you read this, make the iPhone 6s gas gauge
have the default keys again)! This means that not only can I not access any of the
juicy details of this battery, but I cannot update its firmware to a more conventional
version either. I could try brute-forcing it, but trying to hack a key with a 32-bit
address space over a 7 kbps bus uh, no. Thats not going to happen. Id probably
have better luck reverse-engineering Apples battery code but I doubt they have any
facility to do in-system firmware updates for the gas gauge.
Data captured from GaugeStudio
Now for some rather interesting details of what we can access. The design
capacity of this battery, according to the gas gauge, is 1430 mAh, same as the
iPhone 4S and also 100 mAh less than whats written on the label. That, and the full
charge capacity of this battery is 1397 mAh out of the gate. The gauge seems to be
an insomniac (it wont enter Sleep mode even when the battery is not hooked up to
Follow
Follow Rip It
25/07/2015
Page 7 of 7
version (Im sure the internal temperature isnt 131 degrees C), and the Pack
Configuration register doesnt bring up any sensible data.
Battery conspiracy?
One thing that I havent confirmed is whether or not this battery had been tampered
with before I received it. I bought this particular battery from eBay and it was listed as
new. It had some adhesive residue but no obvious sign of being peeled off from
another iPhone. The cycle count is set to 1, and because the gas gauge is sealed, I
cant read any other data like the lifetime data logs. There is a chance that this
battery isnt new and that the seller had somehow changed the data memory and
sealed the chip with a non-default key, but I need to wait until some other batteries
arrive in the mail and perhaps try reading out batteries taken out directly from some
iPhone 5s. Until then, its only speculation as to why this chip is sealed with a
different key.
The next victims specimens: an iPhone 5S battery, a new iPhone 4 battery, and an
Amazon Kindle battery.
Posted in Batteries, Rambles, Teardowns, The Operation Failed Successfully |
Tagged bq27545, iphone, iphone 5 battery connector, iphone 5 battery pinout,
iphone 5 battery sn27545, iphone gas gauge, sn27545 | 14 Replies
Follow
Follow Rip It
25/07/2015

Rip It Apart - Jason's Electronics Blog-Thingy

Uploaded by

Copyright:

Available Formats

Rip It Apart - Jason's Electronics Blog-Thingy

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Rip It Apart - Jason's Electronics Blog-Thingy

Uploaded by

Copyright:

Available Formats

iphone gas gauge | Rip It Apart Jason's electronics blog-thingy