PS3 Fault finding YLOD with the SYSCON - First steps and Error reporting

[RIP-Felix]

Is there a reason @squeept and @sandungas are still using image websites to upload pictures? As opposed to dragging directly into the forum?

You guys do realize you can do that after 10 posts right? It's easier.

 

[squeept]

Hey kid! I'm a computer!

 

[alty75]

If I remember correctly that was PS3 #7. @squeept traded me that board, which had genuine tokin fault after he reballed the RSX. I performed a bunch of characterization of the tokin noise using that console before the reball failed.

Basically the Cell noise can leak through to the RSX side and amplify it. Alternatively the VRM can be going bad. Also there is a 1st stage RC filter that amplifies the effect of the 2nd stage LRC filter the tokins are a part of. So those need to be good.
View attachment 37065

I solved it for myself with the same issue! it was a bad batch of tant caps grrrrr

 

[alty75]

@alty75 @RIP-Felix Take a good look at the filter that Felix shows a picture of, those little guys will be melted off the board sometimes.

It's all good!
i buy reels of 1000 tant caps and the most recent reel most of the caps are dodgy
put some known good tant caps on and it was all good

 

[antharian]

Afternoon all,

I've been triaging a CECHL01 (VER-001 MB) and just started following (and caught up) on the thread with @SkaziChris and his errors with a similar board.

Mine has all of the same early behaviors as his experience, based on the errorlog that I pulled. I have not delidded. Only added new thermal paste to the heat sync and attached the UART to pull the error logs.

From the best I can tell, this unit has never been opened and stopped working aprox 2017 (based on the saved games). I wish I head found this area earlier so I could have pulled better logs. I will be disassembling the PS3 and reattaching the UART this evening to hopefully get better diagnostics.

I am able to get video and functionality for a short period before the 3 beeps and a red flashing light.

Resetting the output mode by holding the power button for 10 seconds, after a few attempts, it will usually come to life and function for a while.

The same symptom of 2124 and 1002 were pulled from the logs, no other errors were present. Unfortunately, I didn't find this thread until after I removed the UART and reassembled the PS3. I did not have the benefit of the wonderful documentation put together by @RIP-Felix. I will be reattaching the UART to pull more detailed logs.

> errlog
00000000
# CODE CLOCK
# A0802124 0C5BC655
# A0801002 0C5BC655
# A0802124 0C5BBD41
# A0801002 0C5BBD41

My work station is no where near as sophisticated as what I've seen here. A simple hotair and solder station... is it too soon to give a preliminary diagnostic? As much as I know the NEC tokens get a false wrap, if I am reading the thread correctly, this would appear to be a case where they might be the culprits?

-a

 

[Hasan Ahmed]

Hi guys!
I have ps3 slim ylod dyn-001
Ps3 syscon reader tool gives these codes
A0802114 FFFFFFFF
A0092114 FFFFFFFF
A0102110 FFFFFFFF
What does that mean?

 

[Bazylski]

Technically you can practice on the same sacrificial board as many times as you like before you feel like you're ready for the real thing. Just be aware that the COK boards are thicker and harder to work with than slims.

I've tried (and failed) desoldering on both of my sacrificial boards, must've set my temperatures too high because I'd get consistently torn vias/pads on the upper-left hand corner of the logic board under the RSX and Cell.

Seeing how stern you were, and knowing what kind of being stern it was (the "Dear noobie, please don't repeat my mistakes, I've been there, you can't lifehack around the lack of proper tools/experience" kind of stern), I decided to look for someone more proficient at the job and, most importantly, having access to professional BGA equipment. Gave them the board in question (JSD-001) for an RSX reball, and my previously working COK-002 that developed a case of RSX-related YLOD again, within 2 months of operation after reflow. I asked them to replace the RSX with a 40nm, but now I'll have to turn to the Frankenmod thread to beg for the voltage regulator. Serves me right for not reading the required components in advance.

 

[Timbo9876]

Hi, as far as I am aware it's a simple reprogramming of the Syscon using Python. Once this is done the MB will accept the new RSX.

You will need to know what commands to add and how to add them, I do belive Computer Booter did it on one of his live streams, you should be able to access a recording of this on YouTube.

Sent from my SM-G988B using Tapatalk

 

[Bazylski]

Hi, as far as I am aware it's a simple reprogramming of the Syscon using Python. Once this is done the MB will accept the new RSX.

You will need to know what commands to add and how to add them, I do belive Computer Booter did it on one of his live streams, you should be able to access a recording of this on YouTube.

Sent from my SM-G988B using Tapatalk

I apologize in advance if this is off-topic discussion.

There is a tutorial posted on page 76 of the Frankenstein mod thread that describes the correct method/commands for all compatible varieties of the PS3. For COK-002 boards, apart from the SYSCON programming, the removal of a single resistor and rotating a resistor 45 degrees, one has to replace the voltage regulator near the RSX. Otherwise, the voltage is too high (1.2V instead of 0.95V IIRC) which may cause the RSX to literally burn out.

 

[Timbo9876]

Has this recently come to light? I did remember reading a little while ago that someone posted there fat COK002 board and the resistor being moved at an angle is something I remember being mentioned.

Sent from my SM-G988B using Tapatalk

 

[RIP-Felix]

I've tried (and failed) desoldering on both of my sacrificial boards, must've set my temperatures too high because I'd get consistently torn vias/pads on the upper-left hand corner of the logic board under the RSX and Cell.

Seeing how stern you were, and knowing what kind of being stern it was (the "Dear noobie, please don't repeat my mistakes, I've been there, you can't lifehack around the lack of proper tools/experience" kind of stern), I decided to look for someone more proficient at the job and, most importantly, having access to professional BGA equipment. Gave them the board in question (JSD-001) for an RSX reball, and my previously working COK-002 that developed a case of RSX-related YLOD again, within 2 months of operation after reflow. I asked them to replace the RSX with a 40nm, but now I'll have to turn to the Frankenmod thread to beg for the voltage regulator. Serves me right for not reading the required components in advance.

Don't give up after your first few attempts. My first 2 attempts resulted in the same exact result as yours, torn pads. If they're not too bad they can be repaired BTW.

There are lots os subtile tricks to getting this right. Like using a jig to keep the board strait, wrapping in aluminum to reflect IR and keep heat in, prevent drafting underneathe the board, using the preheater to do 90% of the heating and top heater only to reflow, using thermocouples above and below the board to get an idea of when the chip is ready to flow, nudging the chip on 2 corners to see if it has flowed, taping off the thermal vias so flux doesn't drip and catch fire, using the right kind of flux, and the cleaning process, reballing process each have many subtile tricks too.

Sounds like a lot, and it is, but it's also rewarding when you finally get over the hill and have some sucess.

There is a reason reballing is expensive. It's very difficult and technical work. Requires experiance. But that's not to say you need professional tools. I work with a T-8280 and cheap Hotair want with 45x45mm BGA nozzle. That works fine, it's just learning how to achieve good results with it was a steap curve.

I apologize in advance if this is off-topic discussion.

There is a tutorial posted on page 76 of the Frankenstein mod thread that describes the correct method/commands for all compatible varieties of the PS3. For COK-002 boards, apart from the SYSCON programming, the removal of a single resistor and rotating a resistor 45 degrees, one has to replace the voltage regulator near the RSX. Otherwise, the voltage is too high (1.2V instead of 0.95V IIRC) which may cause the RSX to literally burn out.

It wont burn it out anytime soon. 0.95V makes it last longer, which is the whole point of replacing it in the first place. So it's reccomended. But technically 1.2v will be fine, until it isn't. And we don't have any idea how long that is. Could be years.

 

[Bazylski]

Don't give up after your first few attempts. My first 2 attempts resulted in the same exact result as yours, torn pads. If they're not too bad they can be repaired BTW.

There are lots os subtile tricks to getting this right. Like using a jig to keep the board strait, wrapping in aluminum to reflect IR and keep heat in, prevent drafting underneathe the board, using the preheater to do 90% of the heating and top heater only to reflow, using thermocouples above and below the board to get an idea of when the chip is ready to flow, nudging the chip on 2 corners to see if it has flowed, taping off the thermal vias so flux doesn't drip and catch fire, using the right kind of flux, and the cleaning process, reballing process each have many subtile tricks too.

Sounds like a lot, and it is, but it's also rewarding when you finally get over the hill and have some sucess.

There is a reason reballing is expensive. It's very difficult and technical work. Requires experiance. But that's not to say you need professional tools. I work with a T-8280 and cheap Hotair want with 45x45mm BGA nozzle. That works fine, it's just learning how to achieve good results with it was a steap curve.

It wont burn it out anytime soon. 0.95V makes it last longer, which is the whole point of replacing it in the first place. So it's reccomended. But technically 1.2v will be fine, until it isn't. And we don't have any idea how long that is. Could be years.

Allow me to ask you, does transplanting the voltage regulator from a 65nm board do anything? Is there a difference in voltage between 90nm and 65nm RSXes? I obviously have access to two boards like that, but I don't know if there's any point in that and if I should just wait for the 40nm RSX regulator.

 

[RIP-Felix]

Allow me to ask you, does transplanting the voltage regulator from a 65nm board do anything? Is there a difference in voltage between 90nm and 65nm RSXes? I obviously have access to two boards like that, but I don't know if there's any point in that and if I should just wait for the 40nm RSX regulator.

IDK what voltage the 65nm RSX VDDR runs on, but I suspect it's 1.2v like the 90nm. So it would be pointless.

The voltage regulator from a 40nm slim is easier to use, but not particularly sustainable. There are a ton more slims out there than BC Phats, so it's not like we'll ever run out, but it would be nice to find a source of them that doesn't require harvesting from a slim.

The official sony method uses another MOSFET controller to select the voltage output with resistors, which is a better strategy from an enginerring perspective. And you can procure them new. But it's harder. And I haven't personally performed it or seen anyone do it sucessfully. The theory is sound and math checks out. @botakompong has tested it long ago, but I haven't personally seen it done, confirming it works.

 

[Bazylski]

IDK what voltage the 65nm RSX VDDR runs on, but I suspect it's 1.2v like the 90nm. So it would be pointless.

The voltage regulator from a 40nm slim is easier to use, but not particularly sustainable. There are a ton more slims out there than BC Phats, so it's not like we'll ever run out, but it would be nice to find a source of them that doesn't require harvesting from a slim.

The official sony method uses another MOSFET controller to select the voltage output with resistors, which is a better strategy from an enginerring perspective. And you can procure them new. But it's harder. And I haven't personally performed it or seen anyone do it sucessfully. The theory is sound and math checks out. @botakompong has tested it long ago, but I haven't personally seen it done, confirming it works.

I am located in Poland and unless I were to find an alternative component within the same form factor and specifications - it is impossible for me to get a MOSFET used in the Sony method. I am currently trying to find a 40nm RSX board that got bricked by a failed delid/desoldering attempt, because it'd break my heart if I were to destroy a working one.

 

[RIP-Felix]

I am located in Poland and unless I were to find an alternative component within the same form factor and specifications - it is impossible for me to get a MOSFET used in the Sony method. I am currently trying to find a 40nm RSX board that got bricked by a failed delid/desoldering attempt, because it'd break my heart if I were to destroy a working one.

There were only 5.6 million BC models made. There were like 30 million 40nm slims. Don't worry about it. Visit a local electronics recycling facility and see if they come across any. You might find one.

 

[Bazylski]

There were only 5.6 million BC models made. There were like 30 million 40nm slims. Don't worry about it. Visit a local electronics recycling facility and see if they come across any. You might find one.

Bought a known good RSX from a shop, had it replaced by a qualified professional. Ripped the MOSFET out of a blackouting CECH-3004. Removed the resistor, scratched off some solder mask to make a new pad at 45 degrees, moved the black one to its place, replaced MOSFET, programmed SYSCON aaaaand... my freshly frankensteinized CECHC is YLODing. Here are the bringup logs, I hit enter to get the extra lines after [ERROR] 0xa0093004:

Spoiler

>$ bringup
bringup
[SSM] state: 0000 -> 0101
Bringup Mode #0 (0xFF)
[SSM] ssmCb_OnStartingBePowOn() called.
[SSM] First Boot.
[SSM] Bringup mode : syspm_stat=00000000/00000000
[POWSEQ] PowerSeq_Setup called.
[SSM] state: 0101 -> 0301
[SSM] PowSeq Fail : Detected !
[SSM] state: 0301 -> 0700
[POWSEQ] AV Backend Letup
[SSM] Shutdown mode : syspm_stat=00000000/00000000
[ERROR]: 0xa0093004
>$
[POWSEQ] PowerSeq_Letup called.
[SSM] state: 0700 -> 0600
(PowerOff State) (Fatal)
[mullion]$

And the errlog:

Spoiler

===================================
ERR 00: 00000000 A0093004 FFFFFFFF
ERR 01: 00000000 A0093004 FFFFFFFF
ERR 02: 00000000 A0093004 FFFFFFFF
ERR 03: 00000000 A0093004 FFFFFFFF
ERR 04: 00000000 A0A02031 FFFFFFFF
ERR 05: 00000000 A0A02031 FFFFFFFF
ERR 06: 00000000 A0093004 FFFFFFFF
ERR 07: 00000000 A0093004 FFFFFFFF
ERR 08: 00000000 A0093004 FFFFFFFF
ERR 09: 00000000 A0093004 FFFFFFFF
ERR 10: 00000000 A0093004 FFFFFFFF
ERR 11: 00000000 A0093004 FFFFFFFF
ERR 12: 00000000 A0093004 FFFFFFFF
ERR 13: 00000000 A0A02031 FFFFFFFF
ERR 14: 00000000 A0093004 FFFFFFFF
ERR 15: 00000000 A0A02031 FFFFFFFF
ERR 16: 00000000 A0093004 FFFFFFFF
ERR 17: 00000000 A0A02031 FFFFFFFF
ERR 18: 00000000 A0A02031 FFFFFFFF
ERR 19: 00000000 A0A02031 FFFFFFFF
===================================

Here's the historical errlog, the first two entries are after the mod, but the remaining 18 are from the original YLOD. The nonsensical 2005 date is from having a flat CMOS battery.

Spoiler

===================================
ERR 00: 00000000 A0A02031 FFFFFFFF
ERR 01: 00000000 A0A02031 FFFFFFFF
ERR 02: 00000000 A0403034 FFFFFFFF
ERR 03: 00000000 A0404421 FFFFFFFF
ERR 04: 00000000 A0403034 FFFFFFFF
ERR 05: 00000000 A0404421 FFFFFFFF
ERR 06: 00000000 A0403034 FFFFFFFF
ERR 07: 00000000 A0404421 FFFFFFFF
ERR 08: 00000000 A0403034 FFFFFFFF
ERR 09: 00000000 A0404421 FFFFFFFF
ERR 10: 00000000 A0801701 0B489879
ERR 11: 00000000 A0403034 FFFFFFFF
ERR 12: 00000000 A0404421 FFFFFFFF
ERR 13: 00000000 A0401200 FFFFFFFF
ERR 14: 00000000 A0403034 FFFFFFFF
ERR 15: 00000000 A0404421 FFFFFFFF
ERR 16: 00000000 A0401200 FFFFFFFF
ERR 17: 00000000 A0403034 FFFFFFFF
ERR 18: 00000000 A0404421 FFFFFFFF
ERR 19: 00000000 A0401200 FFFFFFFF
===================================

I've covered the RSX MOSFET with black electrical tape to prevent shorting, still nothing...

Edit: Worryingly enough, powerstate, tmp 0 and tmp 1 say that the sensors are unavailable

 

[RIP-Felix]

09 3004 is occuring before the console even gets to the stage where it calibrates the FlexIO interface between Cell/RSX (BitTraining). Step#40 is when the syscon changes needed for the 40nm chip to work come in. So the console isn't making it that far into power on sequencing.

09 3004 is RSX power Failure, usually a tokin short. Measure resistance from + to GND rails. Double check the work done there. I'm assuming the tokins were replaced? If not, then do so.

If the work is good and the short is still present, then remove the shunt resistors behind the Tokins to isolate the VDDC line and test again. And if the short is still present then the RSX is dead (internal core voltage is short or the reball failed).

If the short dissappears after the shunt resistors are removed then the short is in the VRMs and you need to isolate it there.

 

[Bazylski]

09 3004 is occuring before the console even gets to the stage where it calibrates the FlexIO interface between Cell/RSX (BitTraining). Step#40 is when the syscon changes needed for the 40nm chip to work come in. So the console isn't making it that far into power on sequencing.

09 3004 is RSX power Failure, usually a tokin short. Measure resistance from + to GND rails. Double check the work done there. I'm assuming the tokins were replaced? If not, then do so.

If the work is good and the short is still present, then remove the shunt resistors behind the Tokins to isolate the VDDC line and test again. And if the short is still present then the RSX is dead (internal core voltage is short or the reball failed).

If the short dissappears after the shunt resistors are removed then the short is in the VRMs and you need to isolate it there.

Work for days - that's what I like! I never actually thought about the TOKINs - they're shorted! A bit of a backstory on this console - I got it non-working (YLOD) from a person online, it had a massive flux puddle under the CELL/BE and none under the RSX, yet it threw these errors:

Spoiler

So I thought, if whoever was in there previously reflowed the CELL and it's still doing the 4421 YLOD, that has to be the RSX. I reflowed the RSX with the tools I described earlier ITT, it worked for approximately 2 months and then it failed on my birthday, in a game of GT6, with minor artifacting prior to the fail. Knowing how it had RSX issues previously, I decided to ask a friend of a friend to replace the RSX with a 40 nm one, presumably eliminating the failed component. I should've done a SYSCON diag instead of guessing. The TOKINs are intact but I guess it's time for them to go, at least on one side. I have enough dead Slims to salvage some tantalums, not to mention the training DYN-001.

Does a shorted TOKIN always mean a dead TOKIN? I'd rather keep them in, but if it's absolutely necessary, they're going out.

 

[Tony359]

Hello all,
First post here!

I'm attempting to recover a COK-002 PS3 which I acquired for very little. Very much abused, blown ferrite bead on fan so the previous owner made a large hole on the bottom case to add a computer fan. PSU was also dead (probably unrelated, I guess the owner just got rid of a few faulty parts!).

Anyways, I fixed the PSU and now the PS3 does this:

I discovered Syscon (thank you NSC!!) and successfully connected to the PS3. I get error A0801200 - CELL overheating. Not surprised, it seems the system feels the CPU is on fire!

Now, for the PS3 to shut down so quickly that must be a fault of some sort - not just thermal paste.

So I suspect:
1. The Cell itself, bad temperature sensor inside
2. The BGA ball of the temperature sensor are faulty (I'd imagine open line = max temp reported, or a fault on the sensor connection would fool the system to think that the CPU is very cool, leading to overheating and possibly accidents.)
3. The temperature management chip IC1101

I think my next step would be to check in Syscon what the reported temperature is. Then I guess I'll move backwards, I found where the CELL is connecting to the temperature monitor chip - but I need to understand what I am measuring there: is that chip just converting an analogue signal from the CPU (temp sensor) to a digital signal?

https://www.psdevwiki.com/ps3/File:IC1101_CELL_BE_Temperature_Monitor.png

https://www.psdevwiki.com/ps3/File:COK-002_CELL_thermal_monitor.jpg

What I need to find is

1. Can I check the temperature in Syscon and if so, how?
2. Can I check the behaviour of the temp sensor from the CELL directly, and if so, how? Multimeter in resistance mode?

I suppose that if I isolated the D+ and D- on the temperature management chip and feed a healthy signal, the PS3 may start?

Any input is appreciated!

Thank you!

 

[Bazylski]

Hello all,
1. Can I check the temperature in Syscon and if so, how?

Yes you can! Patch the Syscon and run the DIAG-GND wire, that way you will be able to issue the commands "tmp 0", "tmp 1" and so on. One of those is for the CELL temperature sensor. You can also run "powerstate" to get the availability of the RSX/CELL sensors. They're unavailable on my shorted-out COK-002 which brings us to...

Spoiler

(measurements taken to ground)
Pads in purple have a resistance of 85 kOhms if I'm reading my multimeter right.
Pads in brown have a resistance that varies between 0,05 Ohm and 15 Ohms depending on how long I'm holding the probes.
Pads in red have a resistance of 0,05 Ohm. Initially it shows a much higher value but stabilizes on this reading after ~2 seconds.