Testing laptop battery: pinout, SMBus, charge capacity

What is on the battery connector

A modern laptop pack is not a battery with two wires. It is a battery, a protection circuit and a small computer — the battery management controller — that tracks charge, temperature, cycle count and health. The controller talks over SMBus, a two-wire bus derived from I²C, using the Smart Battery System data set. That is why the pack has four or five contacts: V+, V−, and the two data lines (SMBC and SMD), sometimes plus a thermistor or an ID pin.

Reading the pack over SMBus is safe and informative. Opening the pack is a different matter entirely, and the last section covers why.

The electrical layer

• Speeds: 100 kHz is the safe default; some packs accept 400 kHz. SMBus tolerates clock stretching and has a 35 ms timeout, which is longer than plain I²C — this matters if you use a microcontroller I²C peripheral, because the AVR TWI timeout is shorter in some modes.
• Levels: 3.3 V logic, open-drain, with pull-ups on the host side. Never assume the pack provides pull-ups.
• Address: the smart battery answers at 0x0B (7-bit). The SMBus host/charger sits at 0x09–0x0B depending on role, and the “Smart Battery Charger” at 0x09. If 0x0B does not respond, the pack may be in a protected state or the data lines may need the host to release them properly.
• PEC: optional packet error checking. If the pack requires it and the host does not send it, reads fail. Most host adapters handle this automatically; a hand-rolled bit-bang implementation often does not.

The commands worth reading

The Smart Battery Data Specification defines a standard command set. These are the ones that matter when you want to know what condition a pack is in:

• 0x08 Temperature — in 0.1 K units.
• 0x09 Voltage — millivolts.
• 0x0A Current — signed, in milliamps; negative while discharging.
• 0x0D RelativeStateOfCharge — percent of full charge, the number the OS shows.
• 0x0E AbsoluteStateOfCharge — percent of design capacity.
• 0x0F RemainingCapacity and 0x10 FullChargeCapacity — in mAh or 10 mWh depending on the pack’s mode.
• 0x16 BatteryStatus — bit flags for over-charge, over-temperature, terminating charge and, importantly, whether the pack is in a permanent failure state.
• 0x17 CycleCount, 0x18 DesignCapacity, 0x19 DesignVoltage, 0x1A SpecificationInfo.
• 0x20 ManufacturerName, 0x21 DeviceName, 0x22 DeviceChemistry — ASCII strings.

Health is the ratio FullChargeCapacity ÷ DesignCapacity. A pack reporting 82 % of design capacity after 400 cycles is behaving normally; one reporting 40 % after 50 cycles has a failing cell or a controller that has lost its calibration.

Note the units trap: capacities come back in mAh or in 10 mWh depending on the CapacityMode bit in BatteryMode (0x03). Reading a 10 mWh value as mAh makes a healthy pack look absurd.

Reading it from a microcontroller

/* SMBus word read: command, then LSB-first 16-bit result */
uint8_t cmd = 0x09;              /* Voltage */
i2c_start(); i2c_write(0x0B << 1); i2c_write(cmd);
i2c_start(); i2c_write((0x0B << 1) | 1);
uint16_t v = i2c_read_ack() | (i2c_read_nack() << 8);
i2c_stop();                      /* v is in millivolts */

Two practical notes: the first read after power-up can return stale or zero data while the controller wakes, so read twice; and a pack that has tripped protection may answer with 0 V and 0 mA until a charger releases the safety output.

Why packs stop working, and what a reader can tell you

• Permanent failure flag. Once BatteryStatus sets the permanent-failure bit, many controllers refuse to charge again. No amount of resetting revives them; the controller has decided the pack is unsafe.
• Lost calibration. Some controllers relearn capacity over a full discharge/charge cycle; a pack that reads oddly right after being swapped may simply be uncalibrated.
• Cell imbalance. The controller reports pack totals only. A pack at 11.1 V that sags under load can have one weak cell and two good ones, which SMBus will never tell you.
• Blown fuse. Many packs have a chemical or one-time fuse in series. It is inside the pack and cannot be reset from the connector.

Do not open the pack

Lithium-ion cells store enough energy to weld tools, ignite, and produce a jet of flame. Inside a laptop pack the cells are in series with no accessible fusing between them, and the protection circuit is what keeps them safe. Puncturing a cell, shorting a group, or reconnecting a controller to cells at a different state of charge can result in fire that water will not put out. Reading SMBus from the outside is diagnosis; cutting the case open is a different risk class and needs a fire-safe area, insulated tools and knowledge of the specific controller — not a tutorial.

If a pack reads a permanent failure or a badly degraded capacity, the correct action is replacement, not repair.

References

• Smart Battery Data Specification (SBS Implementers Forum, v1.1) — command set, units, CapacityMode, BatteryStatus bit definitions.
• SMBus Specification (Intel, v2.0) — 100 kHz timing, clock stretching, 35 ms timeout, PEC.
• NXP, UM10204 I²C-bus specification — the underlying electrical layer and pull-up sizing.

Command numbers and units above follow the SBS specification. Battery behaviour varies by controller vendor; treat reported values as the controller’s opinion, not a measurement.