Looking inside an iPhone 5 battery

In the wake of my previous teardowns of the iPhone 4 and 4S batteries, I went onto eBay and Amazon (realizing that they finally have Amazon Prime student rates up in Canada) and bought a few iPhone 5 and 5S batteries. Although I was primarily interested in trying to get the gas gauge information out of the batteries, I had a secondary reason. The Nexxtech Slim Power Bank (a subject of a separate blog post) uses a pair of 3.8-volt Li-ion polymer batteries, and they seemed to be be suspiciously similar in size to what is used in the iPhone 5. But enough of that, we’re here for the iPhone 5 battery in particular!

Battery Casing

The iPhone 5 battery measures 3.7 mm in thickness, 3.2 cm in width and 9.1 cm in length. This particular model, made by Sony, has a model ID of US373291H, with the six digits corresponding to the cell’s dimensions. This cell has a labeled capacity of 1440 mAh at a nominal 3.8 volts, with a maximum charge voltage of 4.3 volts. I tried to read the data matrix barcode on the cell but my barcode scanning app on my phone refused to recognize it. I might try to scan and sharpen the barcode later but it’s not something that’s of a high priority to me.

Battery Teardown and Pinout

The board itself is rather interesting. The protection MOSFETs used to switch the battery’s power are chip-scale packages and are glued down with epoxy, same with the gas gauge itself. This means that I can’t easily replace it with a rework station if the need arises. The board includes the gas gauge, thermistors, protection circuitry and still has room for a polyfuse for extra over-current protection.

iPhone 5 battery PCB layout

iPhone 5 battery PCB layout

The pinout of the iPhone 5 battery is pretty much the same as of the iPhone 4 and 4S. You have Pack-, NTC Thermistor, HDQ and Pack+. In this particular model of battery, the gas gauge is a bq27545 (labeled SN27545), but has basically the same feature set as the iPhone 4/4S’ bq27541. With this information, I soldered to the small terminals on the connector (the actual connectors for this battery haven’t arrived yet since it takes so long to receive items from China on eBay), and hooked it up to my trusty Texas Instruments EV2400 box.

iPhone 5 battery pinout

iPhone 5 battery pinout

Battery Data

iphone 5 firmware versionAnd once again, we’re presented with an obscure firmware revision. The latest bq27545-G1 firmware is only version 2.24, but this chip has version 3.10. After forcing GaugeStudio to accept this gauge as a -G1 version, we’re once again presented with a sealed chip. Let’s try to unseal it with the default key…

... aaaaand nope. No dice with 0x36720414, unlike last time.

Nope. No dice with 0x36720414, unlike last time.

… and I get the dreaded “Unseal Key” prompt. Cue the dramatic Darth Vader “NOOOOO” here. Maybe Apple read my previous post and decided to change the default keys this time (Hey Apple, if you read this, make the iPhone 6’s gas gauge have the default keys again)! This means that not only can I not access any of the juicy details of this battery, but I cannot update its firmware to a more… conventional version either. I could try brute-forcing it, but trying to hack a key with a 32-bit address space over a 7 kbps bus… uh, no. That’s not going to happen. I’d probably have better luck reverse-engineering Apple’s battery code but I doubt they have any facility to do in-system firmware updates for the gas gauge.

Data captured from GaugeStudio

Data captured from GaugeStudio

Now for some rather… interesting details of what we can access. The design capacity of this battery, according to the gas gauge, is 1430 mAh, same as the iPhone 4S and also 100 mAh less than what’s written on the label. That, and the full charge capacity of this battery is 1397 mAh out of the gate. The gauge seems to be an insomniac (it won’t enter Sleep mode even when the battery is not hooked up to any load), and it seems to have less features despite having a higher firmware version (I’m sure the internal temperature isn’t 131 degrees C…), and the Pack Configuration register doesn’t bring up any sensible data.

Battery… conspiracy?

One thing that I haven’t confirmed is whether or not this battery had been tampered with before I received it. I bought this particular battery from eBay and it was listed as new. It had some adhesive residue but no obvious sign of being peeled off from another iPhone. The cycle count is set to 1, and because the gas gauge is sealed, I can’t read any other data like the lifetime data logs. There is a chance that this battery isn’t new and that the seller had somehow changed the data memory and sealed the chip with a non-default key, but I need to wait until some other batteries arrive in the mail and perhaps try reading out batteries taken out directly from some iPhone 5s. Until then, it’s only speculation as to why this chip is sealed with a different key.

The next victims specimens: an iPhone 5S battery, a “new” iPhone 4 battery, and an Amazon Kindle battery.

Review, teardown and analysis of Charging Essentials USB wall outlet

About a week ago I bought a set of wall outlets from Costco that integrate two USB charging ports into a standard Decora-type receptacle. It’s marketed to replace your traditional AC adapter, allowing other appliances to be plugged in while charging your portable electronics.

The outlet is made by Omee Electrical Company, but curiously enough this particular model, the OM-USBII, wasn’t listed on their site. The packaging itself bears the name Charging Essentials, with a logo that looks like a USB icon that’s had one Viagra too many. The packaging states that the outlet has:

  • “Two 5VDC 2.1A ports for more efficient charging in less time”
  • “Smarter USB charging with special chip designed to recognize and optimize the charging requirements of your device”
  • “Screw-free wall plate snaps into place for a more clean, modern appearance”

The second note is of particular importance to me. If it’s true, that means it might be using some USB charge port controller like TI’s TPS251x-series chips. But I’m not one to have blind faith in what’s written on the packaging. Let’s rip this sucker apart!

The outlet has a snap-on coverplate which may look sleek but could hamper removal of this outlet later on if needed. I was curious as to why one couldn’t just use a regular screw-on coverplate, and it turns out it’s because the mounting flange doesn’t have any tapped screw holes; you physically can’t use screws on this because the manufacturer didn’t want to go to the effort to make holes that can accept screws!

The casing is held together with four triangle-head screws in a weak attempt to prevent opening of the device. I had a security bit set on hand so this posed no hindrance to me. Upon removing the cover, the outlet seems rather well built. However, after removing the main outlet portion to reveal the AC-DC adapter inside, I quickly rescinded that thought.

The converter seems relatively well-built (at least relative to some crap Chinese power supplies out there). Some thought was put into the safe operation of this device, but there’s almost no isolation between the high and low voltage sides, and the DC side of this adapter is not grounded; the “ground” for the USB ports floats at 60 volts AC with respect to the mains earth pin. The Samxon brand caps are also pretty disappointing.

As for the USB portion of this device, I had to remove some hot glue holding the panel in place. After a few minutes of picking away at the rubbery blob, I was able to pull out the USB ports.

… and I found LIES! DIRTY LIES! There is no USB charge port controller, contrary to what the packaging claims. It just uses a set of voltage dividers to emulate the Apple charger standard, which could break compatibility with some smartphones. Ugh, well let’s put it back together and take a look at it from the performance side of things. At least the USB ports feel pretty solid…

To measure the voltage-current characteristic of the outlet, I rebuilt my bq27510-G3 Li-Ion gas gauge board so it had better handling of high current without affecting my current and voltage measurements. The reason I used this is because the gauge combines a voltmeter and ammeter in one chip, and by using the GaugeStudio software, I could create easy, breezy, beautiful V-I graphs.

Using a Re:load 2 constant-current load, I slowly ramped up the load current while logging the voltage and current data to a CSV file for analysis in Excel.

overall vi graphThis charger’s… okay. It has pretty good regulation up to 2.3 amps, after that point the AC-DC converter basically brickwalls and the voltage plummets to 3 volts. That said, this also means that this outlet is not a set of “two 2.1A USB ports”. You can charge one tablet but you won’t be able to charge a tablet along with another device simultaneously.

Bah, I’ve had it with this wall outlet. Looks like this one’s gonna be returned to Costco in the next few days. This outlet may be adequate for some people, but for me it’s a disappointment.

Pros:

  • Solid USB ports
  • Good voltage stability (up to 2.3 amps, enough to charge ONE tablet)
  • Apple device compatibility

Cons:

  • Annoying coverplate design
  • Does not meet rated current output, will not charge 2 tablets or 1 tablet + another device
  • Does NOT have a “smart charging chip” despite being stated on packaging, some devices (eg. BlackBerry) will refuse to charge from these ports
  • Power supply for USB seems cheap
  • USB port is not grounded – if a short-circuit happens inside the power supply it can be a shock hazard to you

A Temporary Hold: Creating Li-Ion battery holders with prototype boards and pin headers

As seen on Hackaday!

Lithium-ion batteries are great. They have high energy density, are lightweight, and in the case of many portable devices, they can be easily swapped in and out. One problem with prismatic (the types you often find on cell phones that have a set of flat contacts on one end of the battery) packs is that they’re all custom; the cell may be standardized but the pack it’s in is often proprietary to a certain make and model. Sure, there are “universal” holders out there, but they provide poor electrical contact at best. Since I need a secure electrical connection when using my battery fuel gauges, I sought to create a more sturdy holder for the batteries I have lying around.

The construction of the holder is pretty simple. A strip of female pin header (I used a single-pin-width header but a double-width one can be used for greater mechanical strength) is used as an end-stop for the battery, and a right-angle pin header is used to create contact with the battery’s terminals and to provide the physical “clamping” needed to create a good connection. The right-angle header can be bent and soldered into place to adjust the holder to the particular cell you’re using. Additionally, be sure to use some high-quality FR4-based boards as the brown-coloured paper/resin-based boards won’t have as good resilience and strength, and probably won’t be plated through either (this improves the structural integrity of the holder since the pin headers will be under a bit of physical stress).

For connections, I have a 2-pin header (physically a 3-pin header with one removed to denote polarity) and a set of screw terminals. These are wired up using a flat ribbon “wire” used to connect solar cells together as they can handle several amps and come pre-tinned with solder.

This sort of setup can be adapted to nearly any commercially available prismatic battery, provided it uses a flat contact area on the sides.

Mini-Ramble: Upcoming posts

In lieu of any recent posts, I’d at least post what I plan to write in the near future:

  • Failure analysis of KitchenAid KICU509XBL induction cooktop
  • Teardown/analysis of XtremeMac InCharge power bank
  • Teardown/analysis of Nexxtech Slim Power Bank (3000 mAh)
  • Shoehorning a Nokia BL-5C into a Samsung Galaxy S II
  • Review of the Texas Instruments Gauge Development Kit (GDK) – it’s a beauty!
  • Create a tiny stereo audio amp that’s efficient enough to run off a coin cell!
  • Adding fuel gauges to devices that normally don’t have one (or at least provide some way to track capacity remaining in the battery)
  • Creating a digital music player, using only 7400 logic, some EPROM or NOR flash, and an oscillator. (might even post this one on HackADay :) )
  • Plans for making Li-Ion gauge boards on Tindie
  • More solar panels

KitchenAid induction cooktop service manual

In preparation for a future post in which I do some failure analysis on my KitchenAid KICU509XBL induction cooktop, I dug up the service manual I had laying in one of my document drawers and have scanned it into a PDF. Download the PDF file here.

Since Googling for the cooktop’s error/failure codes didn’t turn up anything useful, I’ll post them here so that people can find it more easily (note that I’ve paraphrased it from what’s listed in the PDF itself):

Failure types:

  1. Power control board: Affects only one burner, with the rest remaining functional.
  2. Usually from the power control board, but could be some exceptions: Affects all burners associated with that control board, but any burners that aren’t using said board will still work.
  3. User interface board: Entire cooktop will be unusable.

Error codes:

  • F12: Type 1 – Insufficient current to a burner’s electromagnetic coil.
  • F21: Type 2 – Mains power supply frequency is out of range.
  • F25: Type 2 – Cooling fan is stuck or dead. The specific fan that has failed can be determined by which side the F25 error code is appearing on the user interface board.
  • F36, F37: Type 1 – A burner’s temperature sensor has failed.
  • F40: Type 1 or Type 2 – Power control board has failed.
  • F42: Type 2 – Mains power supply voltage has a problem, perhaps an open fuse on the EMI filter/mains input board.
  • F47: Type 2 – User interface board cannot communicate with the power control board, and/or its fuse is blown. (This failure code is what appeared on my particular cooktop.)
  • F56: Type 3 – The configuration data on the cooktop’s user interface board EEPROM is invalid.
  • F58: Type 2 – The configuration data on the cooktop’s power control board EEPROM is invalid.
  • F60: Type 3 – User interface board has failed.
  • F61: Type 2 – Power control board has failed, likely because it is not receiving enough voltage.
  • C81, C82: Type 2 – Cooktop is overheating.

 

How NOT to cut monocrystalline solar cells

The notion of “free electricity” has had some allure for me for quite some time. Back in the middle of high school, with a relatively full pocket after a hard summer job operating rides at a local outdoor theme park, I thought “Hm… Calgary sure gets a lot of sun. Now what if I tried to harness its energy?”

Back in late 2011 I purchased a set of 44 6″ by 6″ monocrystalline solar cells (the good stuff) off eBay. These cells sat unused for years until I tried to build a small panel with one of the cells. I wanted to have a small portable panel that I could bring around to charge my phone (I shoehorned a Nokia BL-5C into my Samsung Galaxy S II and it still works better than my fake “Samsung” battery I bought off eBay for $7 or so).

Cell plan created in Publisher

Cell plan created in Publisher

I created a layout of the way to cut up the cells using Microsoft Publisher, as it has the ability to create shapes in a what-you-see-is-what-you-get manner. I divided the 6-by-6 inch cell into 12 subcells. One whole cell is rated for 4 watts in full sun (0.5 volts * 8 amps), so each subcell should produce ~667 mA or 333 mW. However, the corner cells will have 1.5 cm^2 less area because monocrystalline cells are manufactured from a round wafer, but the output difference isn’t of huge concern to me. Of course, the useful power output of the cells will be much lower than this, but designing for that’s all part of the fun (or pain, depending on how you look at things).

I used a diamond cutting disk designed for a Dremel or other rotary tool, and scored the top side of the solar cell. If things went as planned, I could “snap” the cell at that scored line and it should break cleanly.

Since at this point the cell was basically ruined (Most of the fragments are usuable, provided the silver conductive pad is present on the back of the cell), I decided to cut up some “usable” sections by scoring both sides (and with more depth). It worked… okay I guess. The yield was poor but I did have a few cells that split acceptably.

Overall, the panel’s usable area is much less than what I expected. With 12 subcells I can expect about 1-2.5 watts from this panel. Oh well, live and learn.

Next up is to acquire a proper glass-cutter with a flat working surface…