(Day 3 and 4 of 4) Mini-Ramble: Dallas! TI! Batteries!

Oh wow, already a week since the event finished; I need to get posts written up more often!

Anyway, the last 2 days of the event were pretty much information seminars with three separate ‘tracks’ with one of them being all about fuel gauges (you can guess which one I went to :) ). They discussed the reasons that fuel gauging is so important (and why “just measure the voltage” usually isn’t good enough), and also explained why your battery life just plummets after a few hundred cycles or 20% wear.

One of the main fuel gauge guys at TI gave me an evaluation board for their latest-and-greatest fuel gauge, the bq40z50. This gauge is able to handle 1-4 cells in series, which means that you can now pack a laptop battery’s smarts into a battery meant for a smartphone or tablet.

I’d post more but these few posts were “Mini-Rambles” after all. I may post a few pictures later on.

(Day 2 of 4) Mini-Ramble: Dallas! TI! Batteries!

Today was the first day of the actual Texas Instruments Battery Management Systems event. To my surprise, a couple hundred of people showed up from TI employees, a lot of customers (representatives from various companies like Bose, Google, and many others), and me as well. :)

The first day was a basic but still detailed introduction to the inner workings of Li-Ion technology as well as its limitations, failure modes (the gas coming from a Li-Po [lithium-ion polymer] cell contains carbon monoxide, hydrogen and a bunch of other gases), with this leading towards battery fuel gauges and why just measuring the voltage is not enough to accurately determine how full a battery is.

The day ended with a lab showcasing TI’s new Gauge Development Kit (GDK), which, in layman’s terms, is a “battery lab on a board”. It includes PC communication hardware, an adjustable charger, adjustable load and an on-board fuel gauge (but it’s set to use an external fuel gauge by default). I even got a chance to talk the TI battery management team, and even had a dinner with a few key TI guys including the one who made THE design for the GDK.

(Day 1 of 4) Mini-Ramble: Dallas! TI! Batteries!

Woohoo, travel time! Today marks the first day in Dallas attending Texas Instruments’ Battery Management Systems deep-dive seminar. Okay, technically it doesn’t start until tomorrow, but that doesn’t mean today was any less exciting.

The flight from Calgary to Dallas wasn’t too eventful, besides a controller fault that required going back to the terminal to resolve, but trying to grab a SIM card to put in my phone was a whole other ordeal. Fry’s carries the card but doesn’t carry the refill PINs, and my Canadian credit card would not work both online and on the phone; it was only when I went to Best Buy to purchase a refill card with cash that I was finally able to get cellular phone and data access.

I was also given a tour of the main TI facility, and boy it is HUGE! As much as I would have loved to share images, I signed an agreement explicitly stating I cannot do so. However, I was able to see a bunch of the lab rooms, offices and demo stands showcasing various TI technologies at work, such as the ARM processors in the Nest thermostat, the DLP chips in pocket projectors, and so on. I even got to see many of the people in the TI Battery Management team in person, but because of the seminar running from Tuesday to Thursday, they were visibly too busy with work to have a chat.

Tomorrow marks the first instalment of the Battery Management Deep-Dive Training sessions. There is preliminary word that I may have an opportunity to speak in public for a couple minutes about the TI forums and why I’m here.

A Little Pick-Me-Up: Samsung 840 EVO SSD slowdowns, and how to fix it (for now…)

There’s been word going around that Samsung’s 840 EVO solid-state drives have an issue where they become really, really slow to read if the data on it has been sitting around for a few months, and I can confirm this is the case as well.

The first half of the drive (which holds a fair amount of static data) was being read at around 30 MB/s, with newer data being read at almost 500 MB/s. That’s a pretty big difference. One thing to note (I didn’t take a screenshot for this) is that although the overall read speed was significantly affected, the read latency was only somewhat slower; only about 10-20 microseconds of extra latency.

To temporarily fix this (at least until Samsung releases a firmware update in the middle of October), I used Hard Disk Sentinel to read and rewrite all of the data on the SSD. Because this involves accessing data that is normally locked by Windows, I made a custom WinPE (a slimmed-down, portable version of Windows that’s used for installation and recovery) image with Hard Disk Sentinel inside it. This allowed me to boot outside of the normal Windows setup, and perform the Read+Write+Read test to refresh all of the data stored on the SSD. Note that this will impart a lot of write activity to the NAND flash in the SSD (hence a chance for increasing wear), but modern SSDs aren’t as delicate as people might think.

HD Sentinel's Refresh Data Area test

Hard Disk Sentinel’s “Refresh Data Area” test

This took about 2 hours on my 250 GB SSD. Afterwards, another read test showed that the drive was working smoothly again.

Will I still buy a Samsung SSD? Absolutely. No data was lost and Samsung did the right thing by acknowledging the issue and also finding a way to fix it, as opposed to simply calling it a non-issue and sweeping it under the rug.

Looking inside a (fake) iPhone 5S battery

Considering how popular the iPhone is, there’s always going to be some counterfeits out there. I’ve been out buying various iPhone batteries to build a database of each generation’s characteristics, but one model has eluded me so far: the iPhone 5S. The iPhone 5C’s battery that I bought appears to be genuine (but with its own issues), but none of the iPhone 5S batteries I’ve bought so far (4 of them at the time of writing this blog post) were genuine. All of these fakes look like a genuine battery at first glance, but all of them share a few common traits.

Battery teardown

The fake battery sports the usual iPhone battery information, complete with some dot-matrix printed data and a data-matrix barcode. It’s labeled with a capacity of 1560 mAh and 3.8 volts nominal voltage.

Comparison between real and fake iPhone 5S battery

Comparison between real and fake iPhone 5S battery

The connector itself has two points for soldering the connector to provide durability. However, with the fake batteries, they are not soldered down. The two spots on the ends of the connectors are dark with a small point visible inside it (that point is the reinforcement pin on the connector). If this connector is installed in an iPhone, it will probably not come out without either damaging the battery’s connector, or worse, leave the plastic connector piece inside the phone, requiring tweezers to remove.

Connector lifted off with a hobby knife

Connector lifted off with a hobby knife

iPhone 5S and 5C battery pinout

iPhone 5S and 5C battery pinout

Removing the black protective tape reveals an iPhone 4 battery fuel gauge board. The connector is soldered to this board, with four solder points visible.

iPhone 4 battery PCB with soldered-on flat flex connector

iPhone 4 battery PCB with soldered-on flat flex connector

Pulling out the PCB  reveals another characteristic of these fake batteries: the positive terminal is cut short, with another metal section being clumsily spot-welded to the stub on the cell.

Note how the battery tab is poorly welded to the PCB.

Note how the battery tab is poorly welded to the PCB.

Battery fuel gauge data

The battery fuel gauge requires proper programming to accurately indicate the battery’s charge status. Because of this, each iPhone battery generation has its own specific configuration.

The fake iPhone battery retains the programming for the iPhone 4’s battery, which is a designed capacity of 1420 mAh, using a bq27541 fuel gauge running version 1.25 firmware. The data inside it is often that of a used/recycled battery as well.

This data can be (partially) read out directly from the iPhone with a tool such as iBackupBot, but more data can be read if the battery is read with another tool. I have the EV2400 from Texas Instruments to read this out on a PC, but this data can be read out with a USB-to-TTL serial port, a logic gate (a logic inverter) and a small MOSFET transistor.

I created a small tool that uses this circuit to interface with the fuel gauge and read out its data. Check it out here.

Using my tool, this is the report for one of these fake batteries. Note how it is identified as an iPhone 4 battery. Don’t be fooled by the calculated state of health. It’s not accurate for this battery as the fuel gauge still thinks it’s still inside an iPhone 4 battery pack.

HDQ Gas Gauge Readout Tool version 0.9 by Jason Gin
Date: 9/30/2014
Time: 0:52:24
Serial port: COM26

Battery Identification
DEVICE_TYPE = 0x0541, FW_VERSION = 0x0125, DESIGN_CAPACITY = 1420 mAh
Battery's configuration matches that of a standard iPhone 4 battery.

Basic Battery Information
Device = bq27541 v.1.25, hardware rev. 0x00B5, data-flash rev. 0x0000
Voltage = 3804 mV
Current = 0 mA
Power = 0 mW
State of charge = 45%
Reported state of health = 0%
Calculated state of health = 99.3%
Cycle count = 14 times
Time to empty = N/A (not discharging)
Temperature = 27.9 °C (80.3 °F) (3009 raw)
Designed capacity = 1420 mAh
Heavy load capacity = 628/1410 mAh
Light load capacity = 673/1455 mAh

Advanced Battery Information
Capacity discharged = 0 mAh
Depth of discharge at last OCV update = ~778 mAh (8768 raw)
Maximum load current = -200 mA
Impedance Track chemistry ID = 0x0163
Reset count = 11 times

Flags = 0x0180
Flag interpretation:
* Fast charging allowed
* Good OCV measurement taken
* Not discharging

Control Status = 0x6219
Control Status interpretation:
* SEALED security state
* SLEEP power mode
* Constant-power gauging
* Qmax update voltage NOT OK (Or in relax mode)
* Impedance Track enabled

Pack Configuration = 0x8931
Pack Configuration interpretation:
* No-load reserve capacity compensation enabled
* IWAKE, RSNS1, RSNS0 = 0x1
* SLEEP mode enabled
* Remaining Capacity is forced to Full Charge Capacity at end of charge
* Temperature sensor: External thermistor

Device name length = 7 bytes
Device name: bq27541


Reading out HDQ-equipped battery fuel gauges with a serial port

Battery fuel gauges are the unsung hero of the battery world. There’s more to it than just measuring the voltage on the battery terminals,. These little chips are microcontrollers (tiny computers, essentially) that sit inside the battery pack and keep tabs on the battery’s performance for the life of that battery pack.

Texas Instruments makes battery fuel gauges that are small enough to fit in the circuitry of a cell phone, and one of the most common ones that uses this technology are iPhone batteries. These batteries use a single-wire interface called HDQ (which stands for High-Speed Data Queue). It may sound similar to Dallas Semiconductors’ 1-Wire protocol, but the two are completely different and incompatible with each other.

Protocol details

The HDQ protocol can be emulated with a serial port and a little bit of external circuitry. The protocol can be emulated with a serial port at 57600 baud with 8 data bits, no parity bit and 2 stop bits. Because this is a bi-directional bus, an open-drain configuration is needed. Most TTL serial ports are not open-drain, so some circuitry is required to do this. TI’s application note suggests using a CMOS inverter and an N-channel MOSFET along with a 1 kOhm pull-up resistor, but this can be cut down with a 74HC07 open-drain buffer and pull-up resistor.



The HDQ protocol uses a short pulse to indicate a logic 1, with a longer pulse to indicate a logic 0. The data is sent LSB (least significant byte) first, with a 7-bit address and an eighth bit to indicate if the operation is a read or write (0 is read, 1 is write). If it is a read operation, the fuel gauge will respond with one byte of data. As you might think, this is a very slow means of communication; the typical bus speed is 5-7 kilobits per second, but the actual usable throughput will be less than this.

The hack in this is that the bit timing can be made by sending a specially crafted UART byte that meets the timing specifications. Each bit takes up one byte of UART buffer memory, with 24 bytes being enough to perform an HDQ read (the first 8 bytes are echoed back to the PC and need to be ignored by the software). TI’s application note goes into this with a bit more detail.

Windows HDQ utility

HDQ utility icon, in all its pixelated glory.

HDQ utility icon, in all its pixelated glory.

I have written a small Windows program that will read out the battery’s main data, identify as a certain iPhone battery model (with the iPhone 5S, 6 and 6 Plus being unknown), and save a copy of this data to a text file for safekeeping. This program requires the National Instruments LabWindows/CVI Runtime library to run, since I whipped this program up with the first available IDE on my college PC.

Screenshot of program

Screenshot of program

The source code is not yet available (translation: I’m too ashamed of my programming skills to share it with others); however, a Windows executable is available for download below.

You will need to download the National Instruments LabWindows/CVI Runtime to run this program.



So Phone Me Maybe: A list of iPhone batteries with gas gauge functionality

UPDATE: Turns out the iPhone 3G and 3GS do have gas gauges! I will add them to my list as I find out more about them.

Each iPhone generation since the iPhone 4 iPhone 3G uses a TI gas gauge and uses the HDQ bus (iOS refers to this as the SWI [single-wire interface]) to communicate with the outside world. For more information about the HDQ protocol, click here.

I’ve noticed that many of the iPhone 5S and 5C batteries that can be purchased online are reusing iPhone 4 circuits, which will cause a significant decrease in gauge accuracy (proper parameters need to be programmed into the gas gauge, and that information is chemistry dependent), and the protection circuits in the iPhone 4 battery PCB will kick into overvoltage protection mode at 4.25 volts, less than the 4.3 volts that the iPhone 5 (and newer) batteries need to charge fully.

Because I have been unable to find a list of information of each battery generation, I’m making one myself. Because nobody else has dug this deep into the fuel gauges that the iPhone uses, I have to get this information experimentally (that is, by buying various batteries from online shops; the iPhone 5S battery has been very difficult to get, besides the fake ones I mentioned earlier).

If anyone has any iPhone 5S, 5C or 6 batteries that they’d like to donate, give me a shout! :)

Model Gas Gauge Firmware Designed Capacity Default Unseal Key? Comments
iPhone 3G bq27541 ? ? Yes (0x37420414) Need more samples to confirm.
iPhone 3GS bq27541 1.17 1200 mAh Yes (0x36720414) Limited feature set. My utility will throw “No response” errors when reading this battery.
iPhone 4 bq27541 1.25 1420 mAh Yes (0x36720414)
iPhone 4S bq27541 1.35 1430 mAh Yes (0x36720414)
iPhone 5 bq27545 3.10 1430 mAh No (not yet known)
iPhone 5S bq27545 3.10 1550 mAh (not fully sure yet) No (not confident that this is consistent across different pack makers) Need more samples to confirm.
iPhone 5C bq27545 3.10 1500 mAh (not fully sure yet) No (however, key does appear to be the same as the 5S) Need more samples to confirm.
iPhone 6 ? ? ? ? Someone get me one of these, please :)
iPhone 6 Plus ? ? ? ? Ditto


  1. All known iPhone battery models use custom firmware, so not all of the features that the mainstream gas gauge models use are available. For example, none of these gauges will calculate the battery’s State of Health percentage (it is basically the percentage of the battery’s full charge capacity (it degrades with use) versus its designed capacity.
  2. The iPhone 5C’s battery label indicates a designed capacity of 1510 mAh, but the battery I’ve received indicates a capacity of 1550 mAh. As I have only been able to get one of these batteries that seem to be genuine, I will need to get more batteries of this type to confirm that this information is correct.
  3. The iPhone 5’s battery label indicates a designed capacity of 1440 mAh, but the fuel gauge reports 1430 mAh. The 5S battery reports 1550 mAh, but is labeled 1560 mAh. The 5C reports 1500 mAh, but is labeled 1510 mAh.