Batterias-iphone.pdf

iphone gas gauge | Rip It Apart – Jason's electronics blog-thingy

Page 1 of 7

Rip It Apart – Jason's electronics blogthingy A site dedicated to my hacks, mods, makes and occasional ramblings.

TA G A R C H IV E S : I P H O N E GA S G A U G E

So Phone Me Maybe: A list of iPhone/iPad batteries with gas gauge functionality Posted on September 15, 2014 UPDATE: Turns out the iPhone 3G and 3GS do have gas gauges! I will add them to my list as I find out more about them. Each iPhone generation since the iPhone 4 iPhone 3G uses a TI gas gauge and uses the HDQ bus (iOS refers to this as the SWI [single-wire interface]) to communicate with the outside world. For more information about the HDQ protocol, click here. I’ve noticed that many of the iPhone 5S and 5C batteries that can be purchased online are reusing iPhone 4 circuits, which will cause a significant decrease in gauge accuracy (proper parameters need to be programmed into the gas gauge, and that information is chemistry dependent), and the protection circuits in the iPhone 4 battery PCB will kick into overvoltage protection mode at 4.25 volts, less than the 4.3 volts that the iPhone 5 (and newer) batteries need to charge fully. Because I have been unable to find a list of information of each battery generation, I’m making one myself. Because nobody else has dug this deep into the fuel gauges that the iPhone uses, I have to get this information experimentally (that is, by buying various batteries from online shops; the iPhone 5S battery has been very difficult to get, besides the fake ones I mentioned earlier).

 Follow Rip It Apart – Jason's electronics blog-thingy

https://ripitapart.wordpress.com/tag/iphone-gas-gauge/

Follow “Rip It 25/07/2015

iphone gas gauge | Rip It Apart – Jason's electronics blog-thingy

Page 2 of 7

So far I’m in need of an iPhone 3G (not the 3GS) battery, as well as all iPad batteries (or, if you have my program on hand, what model the battery is intended for, the fuel gauge device (eg. bq27541, bq27545), firmware version and designed capacity.

Model

Gas

Firmware Designed Default Unseal Key?

Gauge iPhone

bq27541

Capacity ?

?

Yes (0x37420414)

3G iPhone

Comments

Need to acquire one of these.

bq27541

1.17

3GS

1200

Yes (0x36720414)

mAh

Limited feature set. My utility will throw “No response” errors when reading this battery.

iPhone

bq27541

1.25

4 iPhone

Yes (0x36720414)

mAh bq27541

1.35

4S iPhone

1420

1430

Yes (0x36720414)

mAh bq27545

3.10

5

1430

No (unknown)

If anyone has

mAh

one that reads “FULL ACCESS” in my program, please send it to me!

iPhone

bq27545

3.10

5S

1550

No (0x84966864)

mAh (not fully sure yet)

iPhone

bq27545

3.10

5C

1500

No (0x84966864)

mAh (not fully sure yet)

iPhone

bq27545-

6

A4

iPhone

bq27545-

6 Plus

A4

5.02

1751

No (0x65441236)

mAh 5.02

2855

No (0x18794977)

mAh

Rip It Apart – Jason's electronics blog-thingy

https://ripitapart.wordpress.com/tag/iphone-gas-gauge/

 Follow

Follow “Rip It 25/07/2015

iphone gas gauge | Rip It Apart – Jason's electronics blog-thingy

iPad

bq27541

1.35

(3rd

11560

Page 3 of 7

Yes (0x36720414)

mAh

gen)

Notes: 1. All known iPhone battery models use custom firmware, so not all of the features that the mainstream gas gauge models use are available. For example, none of these gauges will calculate the battery’s State of Health percentage (it is basically the percentage of the battery’s full charge capacity (it degrades with use) versus its designed capacity. 2. The iPhone 5C’s battery label indicates a designed capacity of 1510 mAh, but the battery I’ve received indicates a capacity of 1550 mAh. As I have only been able to get one of these batteries that seem to be genuine, I will need to get more batteries of this type to confirm that this information is correct. 3. The iPhone 5’s battery label indicates a designed capacity of 1440 mAh, but the fuel gauge reports 1430 mAh. The 5S battery reports 1550 mAh, but is labeled 1560 mAh. The 5C reports 1500 mAh, but is labeled 1510 mAh. 4. The iPhone 6 and 6 Plus use a special firmware that is identified in TI’s battery software (except the very latest releases where such data was removed), and it has a very extensive feature set, and a lot of data logging features. Posted in Batteries, Hacks | Tagged 0x18794977, 0x36720414, 0x65441236, 0x84966864, battery fuel gauge, battery gas gauge, Battery Management, bq27541, bq27545, iphone, iphone 3g, iphone 3gs, iphone 4, iphone 4s, iphone 5, iphone 5c, iphone 5s, iphone 6, iphone 6 plus, iphone battery capacity, iphone battery unlock, iphone battery unseal key, iphone gas gauge, iphone gas gauge password, iphone hdq, iphone swi, ti gauge password | Leave a reply

Looking inside an iPhone 5 battery Posted on July 25, 2014 In the wake of my previous teardowns of the iPhone 4 and 4S batteries, I went onto eBay and Amazon (realizing that they finally have Amazon Prime student rates up in Canada) and bought a few iPhone 5 and 5S batteries. Although I was primarily interested in trying to get the gas gauge information out of the batteries, I had a secondary reason. The Nexxtech Slim Power Bank (a subject of a separate blog post) uses a pair of 3.8-volt Li-ion polymer batteries, and they seemed to be be suspiciously similar in size to what is used in the iPhone 5. But enough of that, we’re here –for the iPhone 5 battery blog-thingy in particular! Rip It Apart Jason's electronics

https://ripitapart.wordpress.com/tag/iphone-gas-gauge/

Follow

Follow “Rip It 25/07/2015

iphone gas gauge | Rip It Apart – Jason's electronics blog-thingy

Page 4 of 7

Battery Casing

The iPhone 5 battery measures 3.7 mm in thickness, 3.2 cm in width and 9.1 cm in length. This particular model, made by Sony, has a model ID of US373291H, with the six digits corresponding to the cell’s dimensions. This cell has a labeled capacity of 1440 mAh at a nominal 3.8 volts, with a maximum charge voltage of 4.3 volts. I tried to read the data matrix barcode on the cell but my barcode scanning app on my phone refused to recognize it. I might try to scan and sharpen the barcode later but it’s not something that’s of a high priority to me. Battery Teardown and Pinout The board itself is rather interesting. The protection MOSFETs used to switch the battery’s power are chip-scale packages and are glued down with epoxy, same with the gas gauge itself. This means that I can’t easily replace it with a rework station if the need arises. The board includes the gas gauge, thermistors, protection circuitry and still has room for a polyfuse for extra over-current protection.

—

iPhone 5 battery PCB layout

The pinout of the iPhone 5 battery is pretty much the same as of the iPhone 4 and

Rip It Apart – Jason's electronics blog-thingy

https://ripitapart.wordpress.com/tag/iphone-gas-gauge/

 Follow

Follow “Rip It 25/07/2015

iphone gas gauge | Rip It Apart – Jason's electronics blog-thingy

Page 5 of 7

battery, the gas gauge is a bq27545 (labeled SN27545), but has basically the same feature set as the iPhone 4/4S’ bq27541. With this information, I soldered to the small terminals on the connector (the actual connectors for this battery haven’t arrived yet since it takes so long to receive items from China on eBay), and hooked it up to my trusty Texas Instruments EV2400 box.

—

iPhone 5 battery pinout

Battery Data

And once again, we’re presented with an obscure firmware revision. The latest bq27545-G1 firmware is only version 2.24, but this chip has version 3.10. After forcing GaugeStudio to accept this gauge as a -G1 version, we’re once again presented with a sealed chip. Let’s try to unseal it with the default key…

 Follow Rip It Apart – Jason's electronics blog-thingy

https://ripitapart.wordpress.com/tag/iphone-gas-gauge/

Follow “Rip It 25/07/2015

iphone gas gauge | Rip It Apart – Jason's electronics blog-thingy

—

Page 6 of 7

Nope. No dice with 0x36720414, unlike last time.

… and I get the dreaded “Unseal Key” prompt. Cue the dramatic Darth Vader “NOOOOO” here. Maybe Apple read my previous post and decided to change the default keys this time (Hey Apple, if you read this, make the iPhone 6’s gas gauge have the default keys again)! This means that not only can I not access any of the juicy details of this battery, but I cannot update its firmware to a more… conventional version either. I could try brute-forcing it, but trying to hack a key with a 32-bit address space over a 7 kbps bus… uh, no. That’s not going to happen. I’d probably have better luck reverse-engineering Apple’s battery code but I doubt they have any facility to do in-system firmware updates for the gas gauge.

—

Data captured from GaugeStudio

Now for some rather… interesting details of what we can access. The design capacity of this battery, according to the gas gauge, is 1430 mAh, same as the iPhone 4S and also 100 mAh less than what’s written on the label. That, and the full charge capacity of this battery is 1397 mAh out of the gate. The gauge seems to be an insomniac (it won’t enter Sleep mode even when the battery is not hooked up to

Rip It Apart – Jason's electronics blog-thingy

https://ripitapart.wordpress.com/tag/iphone-gas-gauge/

 Follow

Follow “Rip It 25/07/2015

iphone gas gauge | Rip It Apart – Jason's electronics blog-thingy

Page 7 of 7

version (I’m sure the internal temperature isn’t 131 degrees C…), and the Pack Configuration register doesn’t bring up any sensible data. Battery… conspiracy? One thing that I haven’t confirmed is whether or not this battery had been tampered with before I received it. I bought this particular battery from eBay and it was listed as new. It had some adhesive residue but no obvious sign of being peeled off from another iPhone. The cycle count is set to 1, and because the gas gauge is sealed, I can’t read any other data like the lifetime data logs. There is a chance that this battery isn’t new and that the seller had somehow changed the data memory and sealed the chip with a non-default key, but I need to wait until some other batteries arrive in the mail and perhaps try reading out batteries taken out directly from some iPhone 5s. Until then, it’s only speculation as to why this chip is sealed with a different key. The next victims specimens: an iPhone 5S battery, a “new” iPhone 4 battery, and an Amazon Kindle battery. Posted in Batteries, Rambles, Teardowns, The Operation Failed Successfully | Tagged bq27545, iphone, iphone 5 battery connector, iphone 5 battery pinout, iphone 5 battery sn27545, iphone gas gauge, sn27545 | 14 Replies

 Follow Rip It Apart – Jason's electronics blog-thingy

https://ripitapart.wordpress.com/tag/iphone-gas-gauge/

Follow “Rip It 25/07/2015