BQ27541 HACKED! : Fuel Gauge that cost me 1 night and 1 day.

After the my video about replacing battery to my Lenovo yoga book that I also mention the fuel gauge chip, I want to correct something and also more additional info that will be here.

The on-board silkscreen “HDQ+” is actuall HDQ and + (cells positive) and addition to that the pinout is (-)(SDA)(SCL)(ThermoSensor)(HDQ)(+).

So let’s dive in deeper !

The fuel gauge chip on both batteries (Original Windows and android) have different chip, The windows machine uses bq27542 but another one (android) seems to use the older genereation of bq27541(-V200). But I’m gonna focus on the bq27541 because I don’t want to mess with the fuel gauge on my working battery inside the sealed machine

the bq27541-V200 is a “Smart Battery” monitor IC. It can do from very basic things like voltage, current reading and it can do somethings advanced like coulomb count, lifetime logging, TI’s proprietary algorithm to calculate the capacity and event SHA-1 authentication and command / permission level !. Apple’s Anti right to repair really love these chip ! (and yes, they did use this chip im many iPhone and iPad varients, they locked down the interface left with just HDQ bus.)

A whole load of features

luckily it doesn’t happened with Lenovo here (Although, android and windows machine battery is incompatible, but it might because of software reason and different chip ?) the bq27xxx line-up has a feature call “Seal” (It isn’t living thing tho…) When battery is in sealed mode, some (most) of R/W feature is locked out due to the reason to protect unexpected data corruption. A.K.A. Only manufacture can sell you battery replacement that will only pair to your machine. This lenovo battery came with the Texas Instruments’s factory keys to unlock the seal and enter UNSEAL mode, but you can go further more to the FULL UNSEAL and I will show you how I do it.

Almost 2 pages for “Security” imfo.

First I jumper-wired the I2C bus directly from the connector to the chip, so I can bypass all those resistors and zener diode. Then I use my VL53L1X module as a pull-up (since it has 4.7k resistor pack).

Bodge wiring 😎😂

Then I connect to the I2C bus number 0 on F1C100s board (My lovely Lichee Pi Nano). And then viola ! device detected as 7-bit address = 0x55

Luckily, Linux equipped with bq27xxx fuel gauge driver, just some little bit of code modification is needed in order to UNSEAL and update design capacity value. By the way, the designed capacity is already embedded in the device tree of lichee pi nano on my Linux Kernel GitHub repo.

Nice thing about this driver is I can just

cat /sys/class/power_supply/bq27541-0/uevent

And I can read everything via sysfs, which is really “scripting” friendly. So I coded one, including the interface voa i2ctransfer command to unlock the fuel gauge and allow me to modify the voltage / current settings and much more.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s