iphone gas gauge | Rip It Apart – Jason's electronics blog-thingy Page 1 of 7

Rip It Apart – Jason's electronics blog-

thingy
A site dedicated to my hacks, mods, makes and occasional ramblings.

TA G A R C H IV E S : I P H O N E GA S G A U G E

So Phone Me Maybe: A list of

iPhone/iPad batteries with gas
gauge functionality
Posted on September 15, 2014

UPDATE: Turns out the iPhone 3G and 3GS do have gas gauges! I will add them to
my list as I find out more about them.

Each iPhone generation since the iPhone 4 iPhone 3G uses a TI gas gauge and uses
the HDQ bus (iOS refers to this as the SWI [single-wire interface]) to communicate
with the outside world. For more information about the HDQ protocol, click here.

I’ve noticed that many of the iPhone 5S and 5C batteries that can be purchased
online are reusing iPhone 4 circuits, which will cause a significant decrease in gauge
accuracy (proper parameters need to be programmed into the gas gauge, and that
information is chemistry dependent), and the protection circuits in the iPhone 4
battery PCB will kick into overvoltage protection mode at 4.25 volts, less than the 4.3
volts that the iPhone 5 (and newer) batteries need to charge fully.

Because I have been unable to find a list of information of each battery generation,
I’m making one myself. Because nobody else has dug this deep into the fuel gauges
that the iPhone uses, I have to get this information experimentally (that is, by buying
various batteries from online shops; the iPhone 5S battery has been very difficult to
get, besides the fake ones I mentioned earlier).

 Follow
Rip It Apart – Jason's electronics blog-thingy
Follow “Rip It

https://ripitapart.wordpress.com/tag/iphone-gas-gauge/ 25/07/2015
iphone gas gauge | Rip It Apart – Jason's electronics blog-thingy Page 2 of 7

So far I’m in need of an iPhone 3G (not the 3GS) battery, as well as all iPad batteries
(or, if you have my program on hand, what model the battery is intended for, the fuel
gauge device (eg. bq27541, bq27545), firmware version and designed capacity.

Model Gas Firmware Designed Default Unseal Key? Comments

Gauge Capacity

iPhone bq27541 ? ? Yes (0x37420414) Need to acquire

3G one of these.

iPhone bq27541 1.17 1200 Yes (0x36720414) Limited feature

3GS mAh set. My utility
will throw “No
response”
errors when
reading this
battery.

iPhone bq27541 1.25 1420 Yes (0x36720414)

4 mAh

iPhone bq27541 1.35 1430 Yes (0x36720414)

4S mAh

iPhone bq27545 3.10 1430 No (unknown) If anyone has

5 mAh one that reads
“FULL
ACCESS” in my
program,
please send it
to me!

iPhone bq27545 3.10 1550 No (0x84966864)

5S mAh (not
fully sure
yet)

iPhone bq27545 3.10 1500 No (0x84966864)

5C mAh (not
fully sure
yet)

iPhone bq27545- 5.02 1751 No (0x65441236)

6 A4 mAh

iPhone bq27545- 5.02 2855 No (0x18794977)

6 Plus A4 mAh  Follow
Rip It Apart – Jason's electronics blog-thingy
Follow “Rip It

https://ripitapart.wordpress.com/tag/iphone-gas-gauge/ 25/07/2015
iphone gas gauge | Rip It Apart – Jason's electronics blog-thingy Page 3 of 7

iPad bq27541 1.35 11560 Yes (0x36720414)

(3rd mAh
gen)

Notes:

1. All known iPhone battery models use custom firmware, so not all of the features
that the mainstream gas gauge models use are available. For example, none of
these gauges will calculate the battery’s State of Health percentage (it is
basically the percentage of the battery’s full charge capacity (it degrades with
use) versus its designed capacity.
2. The iPhone 5C’s battery label indicates a designed capacity of 1510 mAh, but
the battery I’ve received indicates a capacity of 1550 mAh. As I have only been
able to get one of these batteries that seem to be genuine, I will need to get
more batteries of this type to confirm that this information is correct.
3. The iPhone 5’s battery label indicates a designed capacity of 1440 mAh, but the
fuel gauge reports 1430 mAh. The 5S battery reports 1550 mAh, but is labeled
1560 mAh. The 5C reports 1500 mAh, but is labeled 1510 mAh.
4. The iPhone 6 and 6 Plus use a special firmware that is identified in TI’s battery
software (except the very latest releases where such data was removed), and it
has a very extensive feature set, and a lot of data logging features.

Posted in Batteries, Hacks | Tagged 0x18794977, 0x36720414, 0x65441236,

0x84966864, battery fuel gauge, battery gas gauge, Battery Management,
bq27541, bq27545, iphone, iphone 3g, iphone 3gs, iphone 4, iphone 4s, iphone
5, iphone 5c, iphone 5s, iphone 6, iphone 6 plus, iphone battery capacity,
iphone battery unlock, iphone battery unseal key, iphone gas gauge, iphone
gas gauge password, iphone hdq, iphone swi, ti gauge password | Leave a
reply

Looking inside an iPhone

5 battery
Posted on July 25, 2014

In the wake of my previous teardowns of the iPhone 4 and 4S batteries, I went onto
eBay and Amazon (realizing that they finally have Amazon Prime student rates up in
Canada) and bought a few iPhone 5 and 5S batteries. Although I was primarily
interested in trying to get the gas gauge information out of the batteries, I had a
secondary reason. The Nexxtech Slim Power Bank (a subject of a separate blog
post) uses a pair of 3.8-volt Li-ion polymer batteries, and they seemed to be be
suspiciously similar in size to what is used in the iPhone 5. But enough of that, we’re
Follow

here –for
Rip It Apart the iPhone
Jason's 5 battery blog-thingy
electronics in particular!
Follow “Rip It

https://ripitapart.wordpress.com/tag/iphone-gas-gauge/ 25/07/2015
iphone gas gauge | Rip It Apart – Jason's electronics blog-thingy Page 4 of 7

Battery Casing

The iPhone 5 battery measures 3.7 mm in thickness, 3.2 cm in width and 9.1 cm in
length. This particular model, made by Sony, has a model ID of US373291H, with the
six digits corresponding to the cell’s dimensions. This cell has a labeled capacity of
1440 mAh at a nominal 3.8 volts, with a maximum charge voltage of 4.3 volts. I tried
to read the data matrix barcode on the cell but my barcode scanning app on my
phone refused to recognize it. I might try to scan and sharpen the barcode later but
it’s not something that’s of a high priority to me.

Battery Teardown and Pinout

The board itself is rather interesting. The protection MOSFETs used to switch the
battery’s power are chip-scale packages and are glued down with epoxy, same with
the gas gauge itself. This means that I can’t easily replace it with a rework station if
the need arises. The board includes the gas gauge, thermistors, protection circuitry
and still has room for a polyfuse for extra over-current protection.

— iPhone 5 battery PCB layout

The pinout of the iPhone 5 battery is pretty much the same as of the iPhone 4 and
 Follow
Rip It Apart – Jason's electronics blog-thingy
Follow “Rip It

https://ripitapart.wordpress.com/tag/iphone-gas-gauge/ 25/07/2015
iphone gas gauge | Rip It Apart – Jason's electronics blog-thingy Page 5 of 7

battery, the gas gauge is a bq27545 (labeled SN27545), but has basically the same
feature set as the iPhone 4/4S’ bq27541. With this information, I soldered to the small
terminals on the connector (the actual connectors for this battery haven’t arrived yet
since it takes so long to receive items from China on eBay), and hooked it up to my
trusty Texas Instruments EV2400 box.

— iPhone 5 battery pinout

Battery Data

And once again, we’re presented with an obscure firmware revision. The latest
bq27545-G1 firmware is only version 2.24, but this chip has version 3.10. After
forcing GaugeStudio to accept this gauge as a -G1 version, we’re once again
presented with a sealed chip. Let’s try to unseal it with the default key…
 Follow
Rip It Apart – Jason's electronics blog-thingy
Follow “Rip It

https://ripitapart.wordpress.com/tag/iphone-gas-gauge/ 25/07/2015
iphone gas gauge | Rip It Apart – Jason's electronics blog-thingy Page 6 of 7

— Nope. No dice with 0x36720414, unlike last time.

… and I get the dreaded “Unseal Key” prompt. Cue the dramatic Darth Vader
“NOOOOO” here. Maybe Apple read my previous post and decided to change the
default keys this time (Hey Apple, if you read this, make the iPhone 6’s gas gauge
have the default keys again)! This means that not only can I not access any of the
juicy details of this battery, but I cannot update its firmware to a more… conventional
version either. I could try brute-forcing it, but trying to hack a key with a 32-bit
address space over a 7 kbps bus… uh, no. That’s not going to happen. I’d probably
have better luck reverse-engineering Apple’s battery code but I doubt they have any
facility to do in-system firmware updates for the gas gauge.

— Data captured from GaugeStudio

Now for some rather… interesting details of what we can access. The design
capacity of this battery, according to the gas gauge, is 1430 mAh, same as the
iPhone 4S and also 100 mAh less than what’s written on the label. That, and the full
charge capacity of this battery is 1397 mAh out of the gate. The gauge seems to be
an insomniac (it won’t enter Sleep mode even when the battery is not hooked up to
 Follow
Rip It Apart – Jason's electronics blog-thingy
Follow “Rip It

https://ripitapart.wordpress.com/tag/iphone-gas-gauge/ 25/07/2015
iphone gas gauge | Rip It Apart – Jason's electronics blog-thingy Page 7 of 7

version (I’m sure the internal temperature isn’t 131 degrees C…), and the Pack
Configuration register doesn’t bring up any sensible data.

Battery… conspiracy?

One thing that I haven’t confirmed is whether or not this battery had been tampered
with before I received it. I bought this particular battery from eBay and it was listed as
new. It had some adhesive residue but no obvious sign of being peeled off from
another iPhone. The cycle count is set to 1, and because the gas gauge is sealed, I
can’t read any other data like the lifetime data logs. There is a chance that this
battery isn’t new and that the seller had somehow changed the data memory and
sealed the chip with a non-default key, but I need to wait until some other batteries
arrive in the mail and perhaps try reading out batteries taken out directly from some
iPhone 5s. Until then, it’s only speculation as to why this chip is sealed with a
different key.

The next victims specimens: an iPhone 5S battery, a “new” iPhone 4 battery, and an
Amazon Kindle battery.

Posted in Batteries, Rambles, Teardowns, The Operation Failed Successfully |

Tagged bq27545, iphone, iphone 5 battery connector, iphone 5 battery pinout,
iphone 5 battery sn27545, iphone gas gauge, sn27545 | 14 Replies

 Follow
Rip It Apart – Jason's electronics blog-thingy
Follow “Rip It

https://ripitapart.wordpress.com/tag/iphone-gas-gauge/ 25/07/2015