PS3 Fault finding YLOD with the SYSCON - First steps and Error reporting

Yes, the very first page of this thread
But the EEPROM patch is to go from external mode to internal mode.
I haven't reached that point yet, haven't I?
You mean my mistake was simply "auth" in lowercase instead of "AUTH" in capital letters? Is this what caused the write timeout error?
Or am I missing something else

Now I'm just getting auth response invalid, as if nothing was connected
 
First only connect rx, Tx and gnd. On pc type script.py com6 CXR
>AUTH
Should be successful

If not reverse rx with Tx until goes successful. Sometimes turn power on and off, try 3~5 times AUTH. If is not working something you forget to connect? Only power supply 5 v cable power line to mobo is needed to standby mode.
No 5 v from usb adapter ever.
Not sure but only CXR do this kind of skip. SW goes straight or even reverse twice goes well.
 
Last edited:
So i heated a dead nvidia 8800gts with the heatgun, after preheating it at the oven for 30' at 100C. It took 3'20'' for the gpu ic to desolder. Because the ps3 has a bigger board and heatspreaders above the ic's, i'm gonna heat it for 4' and check back for the results.

Didn't work...still same red light flashing.
 
I get this output on a SEM-001:
>$ lasterrlog
[SSM] state: 0000 -> 0101
Bringup Mode #0 (0xFF)
[SSM] ssmCb_OnStartingBePowOn() called.
[SSM] First Boot.
[SSM] Bringup mode : syspm_stat=00000000/00000000
[POWSEQ] PowerSeq_Setup called.
[SSM] state: 0101 -> 0201
[POWSEQ] AV Backend Setup
[SSM] state: 0201 -> 0102
[SSM] state: 0102 -> 0202
[SSM] state: 0202 -> 0103
[SSM] state: 0103 -> 0203
[SSM] ssmCb_BeforeBeOn() called.
[SSM] state: 0203 -> 0104
Psbd_SbTransMode_Half:0x20e7
[POWERSEQ] Error : BitTraining RSX:RRAC:RX3:GLOBAL1:RX_STATUS
[SSM] state: 0104 -> 0304
[SSM] ssmCb_AfterBeOn2() called.
[SSM] PowSeq Fail : Detected !
[SSM] state: 0304 -> 0700
[POWSEQ] AV Backend Letup
[SSM] Shutdown mode : syspm_stat=00000000/00000000
[ERROR]: 0xa0404432
[ERROR]: 0xa0403034
[POWSEQ] PowerSeq_Letup called.
[SSM] state: 0700 -> 0600
(PowerOff State) (Fatal)
does anyone know what it is related to?

Edit: so 403034 is related to bad RSX connection as i found in this post.
any idea on 0xa0404432
 
Last edited:
Sorry today Monday I had other things as well, and this started to feel repetitious.

Seems like I do same thing, but get different results.
Most of the time I get Auth invalid.
Then I get some error, and then Auth invalid again. This time the error seems different.
I think I'll disassemble another COK 002 and test. If I don't change my mind before hehehe. Because this was just curiosity.

It's as if when there's an error, the whole thing locks up and from there just auth response invalid. But even if I take everything out and unplug all power, it's still locked up.

Oh well I'm sure I'm making it sound harder than it is, when I mostly wanted to make it easier to newcomer.
 

Attachments

  • IMG_20210222_200603.jpg
    IMG_20210222_200603.jpg
    4 MB · Views: 64
Last edited:
Take measurements on motherboard and see power line resistance for cpu, gpu. This tells exactly what can be done.
@jimlkosmo
It's the same values I posted between the nec/tokin caps.
I measured the vddc, for the 1'' that the ps3 stays on before shutting down. 1.2V_RSX_VDDC is 1.290v and 1.2V_BE_VDDC is 1.110v.
If i power on the ps3 repeatedly, the BE becomes kinda hot, but the RSX is barely warm to the touch.
 
It is dead cpu for sure. If 14 ohms was before reflow, is nothing you can do in first place. @jimlkosmo
@Pacorretaco I will try to understand better just give it patience...
OK typing AUTH with ps3 in standby(red led) , if response 1 invalid, reverse rx with Tx and try to type again AUTH. It should show some error. If you see those errors just power off ps3, power on and rerun(close, open again) cmd script. I will wait your reply.
Does not matter windows version always CRX does like that, at least for me. Starting from ver001 mobo will be easier.
do you use last python script? http://s.go.ro/bi5v2g3p
If drop only script inside cmd even without administration privilege should look like this
75c6922a532a7bbd11a5c1c0c6b009aa.jpg

If 32 bits try to 64, is for sure something related to software side, if multiple reversed rx, Tx did not work. Or that unit may not have 3v3 power supply to syscon.
A simple way to test voltage to rx and Tx, Tx should be hi=3v3 and rx lower 1.5 or 2 can not remember but is low. Test ps3 only in standby without any usb TTL connected.
 
Last edited:
It is dead cpu for sure. If 14 ohms was before reflow, is nothing you can do in first place. @jimlkosmo
@Pacorretaco I will try to understand better just give it patience...
OK typing AUTH with ps3 in standby(red led) , if response 1 invalid, reverse rx with Tx and try to type again AUTH. It should show some error. If you see those errors just power off ps3, power on and rerun(close, open again) cmd script. I will wait your reply.
Does not matter windows version always CRX does like that, at least for me. Starting from ver001 mobo will be easier.
do you use last python script? http://s.go.ro/bi5v2g3p
If drop only script inside cmd even without administration privilege should look like this
75c6922a532a7bbd11a5c1c0c6b009aa.jpg

If 32 bits try to 64, is for sure something related to software side, if multiple reversed rx, Tx did not work. Or that unit may not have 3v3 power supply to syscon.
A simple way to test voltage to rx and Tx, Tx should be hi=3v3 and rx lower 1.5 or 2 can not remember but is low. Test ps3 only in standby without any usb TTL connected.
Ok, in that case tomorrow I think I will try with perfectly working L model VER board.
Because I cannot understand.
When I get auth error (not auth1 response invalid) then after that If I try again without touching the cables or anything, I will get auth1 response invalid again and again.
It's as if it hangs or something. And this is embarrassing because I power off and on and still auth1 response invalid.
But then later somehow I get the other error again. I'm not changing anything but the error changes.

The dongle is set to 3.3v with an included jumper it has.

I will also try with different USB cable and different cables.

Sorry if this is confusing and thank you for the help
 
Last edited:
Ok no worries, should work in the end, if ps3 mobo is on standby with red led should be fine with 3v3 is common rail to syscon if I remember correctly. You just need to see Tx voltage from ps3 and rx, then can be something with software side, any antivirus apart from standard defender?
On ver001 should have auth in small letters. No patch needed, should be all ffff if unit works well when errlog.
 
I still can't believe it, but I think it really was just the USB cable.

No more strange errrors. No more lockup or hangs. I didn't touch anything besides the USB cable.

Now only sometimes I get Auth response invalid, but I just try again and it works.

I try the newer script you just told me and it seems to auth more reliably. The one I was using (from the github page where the PDF is) seems to give auth response invalid quite often for no reason. It is advised to try the auth command a few times in a row.

I also tried "AUTH" and "auth"
Both work, uppercase and lowercase.
So, yeah the whole process shouldn't be hard. It should be quick and easy. I just make it seem more difficult. Maybe bad luck.

As a bonus, yes It can be done without soldering too. @sandungas would be proud
(And yes, when I was banging my head wondering why it wasn't working, I also soldered like a human being to see if this was the problem)

But it's fine
So cheers
 

Attachments

  • IMG_20210223_011131.jpg
    IMG_20210223_011131.jpg
    5.8 MB · Views: 813
  • IMG_20210223_011629.jpg
    IMG_20210223_011629.jpg
    4.8 MB · Views: 90
  • IMG_20210223_012146.jpg
    IMG_20210223_012146.jpg
    1.1 MB · Views: 2,255
Last edited:
Right, now remember to use pdf guide for AUTH on CXR when patch EEP SET. Then with diag and rest of checksum.
After all done this unit will always go with diag on gnd and aurh with small letters without steps for AUTH. Someone else could correct me but I've done few of test on phat CXR models, not very happy when working with them, more in to slims.
Script is from 'M4j0r' thread. Thanks to him and 'zecoxao' all developers, most of us we have a simplified diagnosis of mainboards.
Now waiting ps4 to get this.
 
Last edited:
Haha, yeah, that way is easy (no solder required), safe (prevents lifting pads by pulling the wires by mistake) and relliable (the contact at the tip of the needle is made under pressure so is a good connection)... and it unlocks the bonus points for geekness :D

Yikes!

Interesting way to connect.

The best cable to use i find is AWG 30, anything else is either too large or bad data flow. Plus its the right size for the pins to solder to.
 
It's the same values I posted between the nec/tokin caps.
I measured the vddc, for the 1'' that the ps3 stays on before shutting down. 1.2V_RSX_VDDC is 1.290v and 1.2V_BE_VDDC is 1.110v.
If i power on the ps3 repeatedly, the BE becomes kinda hot, but the RSX is barely warm to the touch.

Yes that's ok for voltages. I suspect your reflow is still not hot enough, you need to be melting that solder under the RSX chip (reason its cold to touch).

CELL and RSX talk to each other, so if the CELL is getting no response from the RSX, you will get those data errors.

Could you run the syscon script again, turn on the ps3 in standby mode, do the usual auth mode, then type:

'bringup'

Then hit enter a few times - this will show the boot up sequence and where it stops at

Then post the full output to this thread.
 
I get this output on a SEM-001:
>$ lasterrlog
[SSM] state: 0000 -> 0101
Bringup Mode #0 (0xFF)
[SSM] ssmCb_OnStartingBePowOn() called.
[SSM] First Boot.
[SSM] Bringup mode : syspm_stat=00000000/00000000
[POWSEQ] PowerSeq_Setup called.
[SSM] state: 0101 -> 0201
[POWSEQ] AV Backend Setup
[SSM] state: 0201 -> 0102
[SSM] state: 0102 -> 0202
[SSM] state: 0202 -> 0103
[SSM] state: 0103 -> 0203
[SSM] ssmCb_BeforeBeOn() called.
[SSM] state: 0203 -> 0104
Psbd_SbTransMode_Half:0x20e7
[POWERSEQ] Error : BitTraining RSX:RRAC:RX3:GLOBAL1:RX_STATUS
[SSM] state: 0104 -> 0304
[SSM] ssmCb_AfterBeOn2() called.
[SSM] PowSeq Fail : Detected !
[SSM] state: 0304 -> 0700
[POWSEQ] AV Backend Letup
[SSM] Shutdown mode : syspm_stat=00000000/00000000
[ERROR]: 0xa0404432
[ERROR]: 0xa0403034
[POWSEQ] PowerSeq_Letup called.
[SSM] state: 0700 -> 0600
(PowerOff State) (Fatal)
does anyone know what it is related to?

Edit: so 403034 is related to bad RSX connection as i found in this post.
any idea on 0xa0404432

[POWERSEQ] Error : BitTraining RSX:RRAC:RX3:GLOBAL1:RX_STATUS - its all related to communication data errors to the RSX <> CELL.

You will need to either - reflow the RSX ( a proper flow!!) or replace the RSX.

Before doing that measure the resistance on the NEC tokins, anything below 0.9ohms is bad, 2.0ohms is good, 1.4ohms below the RSX is on its way out.
 
Just wanted to mention...

While yes, maybe you need more heat to melt the balls... But if you are only using hot air from the top... There is a very high chance that you will cause permanent damage "before" the "balls" get hot enough.
That is, if the damage is still not permanent already.

But this has probably been mentioned before, so be careful.


Btw, before I go into internal mode and start messing with the checksums...
The errorlog can still be retrieved from external mode right?
Isn't this how @squeept does it without risk?
 
Yes I think error log can be done without patch, I took full reading on pdf and done it , never done in AUTH mode or I can not remember right now. It may work. Probably will work with ERRLOG.
 
[POWERSEQ] Error : BitTraining RSX:RRAC:RX3:GLOBAL1:RX_STATUS - its all related to communication data errors to the RSX <> CELL.

You will need to either - reflow the RSX ( a proper flow!!) or replace the RSX.

Before doing that measure the resistance on the NEC tokins, anything below 0.9ohms is bad, 2.0ohms is good, 1.4ohms below the RSX is on its way out.
thanks for getting back to me.
Nec/tokin resistance is 1.5ohms for the RSX ones and 6 ohms for the BE
i tried to heat up the nec/tokins and the rsx and be to see if i get anything different.
now the ylod is a bit longer and the logs are different:

>$ bringup
bringup
[SSM] state: 0000 -> 0101
Bringup Mode #0 (0xFF)
[SSM] ssmCb_OnStartingBePowOn() called.
[SSM] First Boot.
[SSM] Bringup mode : syspm_stat=00000000/00000000
[POWSEQ] PowerSeq_Setup called.
[SSM] state: 0101 -> 0201
[POWSEQ] AV Backend Setup
[SSM] state: 0201 -> 0102
>$ lasterrlog
[SSM] state: 0102 -> 0202
[SSM] state: 0202 -> 0103
[SSM] state: 0103 -> 0203
[SSM] ssmCb_BeforeBeOn() called.
[SSM] state: 0203 -> 0104
Psbd_SbTransMode_Half:0x20e7
[SSM] state: 0104 -> 0204
[SSM] state: 0204 -> 0105
[SSM] state: 0105 -> 0400
(PowerOn State)
[SERV NVS] READ CMD

Boot Loader SE Version 2.0.0 (Build ID: 2655,27256, Build Data: 2007-10-26_12:10:58)
Copyright(C) 2007 Sony Computer Entertainment Inc.All Rights Reserved.
[SERV SETCFG] XDR (CH0,CH1) ASSERT
[SERV SETCFG] XDR (CH0,CH1) DEASSERT
[ERROR]: 0xb0002001 (FATAL) XDR Link not initilized.
ITC_DUMP0000000000000000000000

0xb0002001 as per the ssyscon errorlogs is BE related.
 
Yes, external mode can give you up to 20 errors.
And this can all be done in under 10 minutes (with proper instructions of course)

Of course it took me more than that. I wonder why.

I did not have any urgency to do this. I already was pretty sure this board had a 3034 for a number of reasons.

Now for going to internal mode, for now I think I will be wise and wait until the instructions seem a bit less vage to me.

I have a slim board that I'll test next. That one I'm actually curious to check. And a buch of other funny COK boards but probably later.
Or maybe It would be also possible to install custom SYSCON fan curve to L model (VER board)? I'd like to do that.

Cheers
 

Attachments

  • IMG_20210223_151159.jpg
    IMG_20210223_151159.jpg
    4.2 MB · Views: 711

Similar threads

Back
Top