PS3 Frankenstein PHAT PS3: CECHA with 40nm RSX

PS3#7 - mini-update

It's been along while since I have done anything with this console. If you don't recall this is the @squeept reballed console that had 1002 errors, which I did a bunch of tokin/tantalum tests on. After some testing the 3034 returned so I attempted to attach a 40nm RSX. Afterward, VDDC was short to GND. I was discouraged by the loss and set the console aside (didn't even clean off the flux). That's the last you heard.

Yesterday I decided to measure resistance of the RSX & CELL voltages. All but RSX_VDDC seemed okay. So I thought just maybe my tantalizer had shorted +/GND. I didnt see any solder bridging, but maybe underneath there was one I didnt see.

So this morning I removed them and did indeed confirm the short is on the BGA. I took the oppritunity to clean the flux off while I had it on the T8280 preheater, which allowed me to remove the tantalizer with hot air when the board is at 100C. Also makes cleaning off the flux easier. I used my new MB jig to hold the MB strait Worked great!

Anyway, I'll need to remove the RSX again. So I think this weekend I'm going to try my hand at reballing again. I have been watching lots of videos and have some ideas about why previius attempts failed. I feel better about my chances of success this time.

If the reball goes well, then I'll do the orbis mod and we'll see if I can get my 2nd Frankenstein working. Maybe this time the PS2 BC will work.
 
Don't know what to say about reversing code, probably M4j0r will have more details about it when he gets time to investigate.
Still doubt without any expansion ic or on fly injection code this will work on stock setting.
Why even Sony did hard modifications?
Wasn't possible to just patch stock syscon.
So either we reproduce same process as this modchip from scratch or we just go along with it.
 
vyktormvmpay25 said:
Don't know what to say about reversing code, probably M4j0r will have more details about it when he gets time to investigate.
Still doubt without any expansion ic or on fly injection code this will work on stock setting.
Why even Sony did hard modifications?
Wasn't possible to just patch stock syscon.
So either we reproduce same process as this modchip from scratch or we just go along with it.
Click to expand...


I'm not sure who you're replying to. There isn't much to say about it.The code is password protected. M4jor understand this better. I think you can check the communication lines on a refurbished board with bus pirate and make your own modchip.

Sony couldn't patch the stock syscon because there's not enough space. That's why they replaced it. Did you forget?
 
No as I don't have any clue what commands I should send into rsx spi port?
How do I use any information I get? How that Xc2c32a or something else is configured to be used as master/slave in parallel spi or on fly injection config.
I did not learn programming on my time and sorry for that.
We better let people with more experience to do this. Not sure if anyone is interested but we have to start from the first beginning to understand this.
Theory buspirate is 3v3 logic level, rsx spi is 1v8 logic level?
 
Last edited:
PS3#7 ‐ Update
(MB is effed, but hey I Balled my first RSX!)
​
Well this morning I pulled off the RSX and I think the 40nm RSX survived. I still need to measure the voltages to confirm, but it "looks" okay. No bridged pads. There is one brown pad I need to work on, but I'll have a closer look later.

The MB is another story. There are multiple missing pads. I noted this before, but decided to YOLO it since it's such a PITA to setup my ghetto reballing setup for another run. Most of the missing pads have no VIA and are therefor NC. So I can ignore them. But there are 2 (BA6 and BA7, MOS/MIS) I'm going to need to repair...
PS3#7 (MB damage to repair).jpg

PS3#7 (MB damage to repair 1).jpg

The PLL is going to need some solder mask to cover the trace between them. This MB has been through maybe 10 reflow cycles already. It's worse for the wear, but it's good practice and has some life left in it. There are other exposed traces to the via. They'll need covered with solder mask too. Otherwise the balls will wick to the trace and not form a ball of equal height with the others around them. They'll pull off soon. So this MB will need microsoldering BGA trace repair and solder mask repair. :oops:

I just ordered some 0.02mm wire in a pen dispenser for microsoldering trace repair. It's finally time for me to take that next step! Believe it or not, I'm actually kinda excited for it?! :stupid:

I went ahead and ordered some UV solder mask, UV flashlight, and a few other things I'll need. I still need a microscope boom arm. My scope just has a regular stand that wont accommodate the MB. I can't get it far enough under to view it. So I need a boom arm, something I can clamp to a table and move when I'm done. Preferably something that can double as a holster for my hot air wand for reballing. I'm tired of my Sid modified PIXAR lamp (extra points if you get the reference).

So today was a bust, but I did have one HUGE win...
40nm #1 Reballed.jpg

I successfully balled my first RSX! Been watching videos and had an idea to fix my previous method. It worked great! The difference this time was using WAY less flux to begin with. Then after placing the balls I used a microscope to reposition balls that didn't sit perfectly to begin with. That solved my shaky hands problem. Turns out it wasn't nerves, it was my eyes. Who knew hand-eye cordination isn't just about your hands? Lol...I didn't realize when everything was magnified my hands wouldn't shake so much. Weird, but cool!

Balling the RSX has been the single most difficult part of the process for me. The tedious hand shaking and ball placing process had me fearing it. To the point I was buying NOS chips to avoid having to do it myself! It was about time I maned up! Under the microscope this part is actually kinda relaxing. Almost enjoyable! What a difference the microscope makes!!!

Oh, and I saw an optometrist and did need glasses, so I got those now...ugg! It helps tho.

The last step was to go really slow with the heat and start on a corner slowly introducing it. I went hotter too (instead of 380, I bumped it up to 450 ish). Scary, but it worked. The balls don't jump to the center of the pad though. They just adhere enough to add more flux and then do a real reflow. This way they don't swim and jump around. The second time with lots of flux they centered. Well, the ones in the middle didn't center that great, but they are on there good enough...I think. They didn't detach when I cleaned off the flux with IPA.

BTW, I used that Kingbow bga flux that comes with reballing kits on ebay. It doesn't seem to work that great with lead balls. They didn't snap to the pads like I thought they should. I'm debating on using AMTECH NC-559-V2-TF instead, when I go to actually attach the leaded balls. It says it's specifically for Sn/Pb alloy solder. I think that would be the smart move.

I feel like today was a success for this alone, even though I wasn't able to continue with the Frankenstein mod this MB. Oh well, that's how it goes. The real win was that I feel like I can make this work from now on, so my confidence is through the roof. LET'S FREAKING GO!

We'll see if I'm singing a different tune after attempting BGA trace/mask repair!

I do have three more YLOD consoles waiting to be diagnosed and worked on (2x COK-001 and 1x COK-002). I bought them to frankenstein, so I could bust them open and give it a go, but I need to SYSCON and diagnose them first. I don't feel like doing that today.
 
Last edited:
RIP-Felix said:
PS3#7 ‐ Update
(MB is effed, but hey I Balled my first RSX!)
​
Well this morning I pulled off the RSX and I think the 40nm RSX survived. I still need to measure the voltages to confirm, but it "looks" okay. No bridged pads. There is one brown pad I need to work on, but I'll have a closer look later.

The MB is another story. There are multiple missing pads. I noted this before, but decided to YOLO it since it's such a PITA to setup my ghetto reballing setup for another run. Most of the missing pads have no VIA and are therefor NC. So I can ignore them. But there are 2 (BA6 and BA7, MOS/MIS) I'm going to need to repair...
View attachment 36179
View attachment 36180
The PLL is going to need some solder mask to cover the trace between them. This MB has been through maybe 10 reflow cycles already. It's worse for the wear, but it's good practice and has some life left in it. There are other exposed traces to the via. They'll need covered with solder mask too. Otherwise the balls will wick to the trace and not form a ball of equal height with the others around them. They'll pull off soon. So this MB will need microsoldering BGA trace repair and solder mask repair. :oops:

I just ordered some 0.02mm wire in a pen dispenser for microsoldering trace repair. It's finally time for me to take that next step! Believe it or not, I'm actually kinda excited for it?! :stupid:

I went ahead and ordered some UV solder mask, UV flashlight, and a few other things I'll need. I still need a microscope boom arm. My scope just has a regular stand that wont accommodate the MB. I can't get it far enough under to view it. So I need a boom arm, something I can clamp to a table and move when I'm done. Preferably something that can double as a holster for my hot air wand for reballing. I'm tired of my Sid modified PIXAR lamp (extra points if you get the reference).

So today was a bust, but I did have one HUGE win...
View attachment 36181
I successfully balled my first RSX! Been watching videos and had an idea to fix my previous method. It worked great! The difference this time was using WAY less flux to begin with. Then after placing the balls I used a microscope to reposition balls that didn't sit perfectly to begin with. That solved my shaky hands problem. Turns out it wasn't nerves, it was my eyes. Who knew hand-eye cordination isn't just about your hands? Lol...I didn't realize when everything was magnified my hands wouldn't shake so much. Weird, but cool!

Balling the RSX has been the single most difficult part of the process for me. The tedious hand shaking and ball placing process had me fearing it. To the point I was buying NOS chips to avoid having to do it myself! It was about time I maned up! Under the microscope this part is actually kinda relaxing. Almost enjoyable! What a difference the microscope makes!!!

Oh, and I saw an optometrist and did need glasses, so I got those now...ugg! It helps tho.

The last step was to go really slow with the heat and start on a corner slowly introducing it. I went hotter too (instead of 380, I bumped it up to 450 ish). Scary, but it worked. The balls don't jump to the center of the pad though. They just adhere enough to add more flux and then do a real reflow. This way they don't swim and jump around. The second time with lots of flux they centered. Well, the ones in the middle didn't center that great, but they are on there good enough...I think. They didn't detach when I cleaned off the flux with IPA.

BTW, I used that Kingbow bga flux that comes with reballing kits on ebay. It doesn't seem to work that great with lead balls. They didn't snap to the pads like I thought they should. I'm debating on using AMTECH NC-559-V2-TF instead, when I go to actually attach the leaded balls. It says it's specifically for Sn/Pb alloy solder. I think that would be the smart move.

I feel like today was a success for this alone, even though I wasn't able to continue with the Frankenstein mod this MB. Oh well, that's how it goes. The real win was that I feel like I can make this work from now on, so my confidence is through the roof. LET'S FREAKING GO!

We'll see if I'm singing a different tune after attempting BGA trace/mask repair!

I do have three more YLOD consoles waiting to be diagnosed and worked on (2x COK-001 and 1x COK-002). I bought them to frankenstein, so I could bust them open and give it a go, but I need to SYSCON and diagnose them first. I don't feel like doing that today.
Click to expand...


I reballed a 40nm today, I use AMTECH and haven't had an issue so far on the few i've re-reballed. Not telling you to upgrade your machine, but if you ever do, you can use the top heater to reflow the balls on, atleast that's what i've done with the last 3 chips i've reballed (2 RSX 1 360 GPU) and balls attached at 205C, zero issues, no fuss! I wonder if the top heater you're using would also work the same if you have one of them RSX sized nozzles. Are you using a 968 as a top heater?
 
Shawn Shakir said:
Are you using a 968 as a top heater?
Click to expand...
Yeah, it's a cheap hot air wand from china in one of those, soldering iron/hot air/DC PSU combos. But it is surprisingly capable (for hot air). I would prefer IR, but I have this. I use a 45x45mm BGA nozel for it. Works well, but not fast.
 
acording to victor looks like my board have the cell dying low vcore on cell. that triggers all the hell. didnt expect cell to die that easy its only 176 days running according to my last syscon read. victor told me to wait for a better board and that will be the best thing to do instead to take that board back
 
Yes sure I tell by experience this low resistance won't last long.
I will fix and send both units as this will fail for sure short time. Not rsx with 2031 but cell.
Board is that on jig. Even with neck caps it should not be under 2.7 ohms on board condition.
http://s.go.ro/dcnqo079
All boards have been tested by now.
All boards have a minimum condition between 2.7 ohms and 4.7. This is my opinion.
I have fixed recently one cok001 It was over 3 ohms pretty sure( I'll update photos from it and video comparison when I find them)
Edit
Found measurements before work on this board from Germany and add them to his link
http://s.go.ro/uj9uiow2
Anyway anyone feel free to add measurements.
 
Last edited:
I just measured a COK-001 (PS3#13) with 2 ohms on RSX and CELL cores. It looks to be working fine, but I haven't done any stress testing.

I don't like how low it is, but anything over 1.5 ohms should be okay.

Now, I have seen that resistance rise after a reflow and tokin replacment. Not sure why.
 
I'm willing to do those improvements like I always do Felix. At least if now this board is starting, it should start fine and to recover some data. Can't promise warranty when I see they are low. I'll do my best, also another backup unit will be sent.
 
my board that is low ohm on cell vcore it has booting issues. it needs more than one try when its cold it can be 2 or 5 tryes. when power down and up when its hot it always boot 1st try but after boot in both cold and hot it never freezes to me. even on last of us
 
Some interesting news:
I received a test console (DIA-002 with 40nm RSX and CXR713F120A Syscon) from @vyktormvmpay25 :)
And that did some extreme speed up to the 40nm RSX Syscon patches development.

First I tried to copy the official Sony procedure, for that I flashed the 304GB (v1.5.1k2) firmware to the Syscon and performed the following patches to the original (DIA-002) EEPROM:
Code: 
Fix thermal config unk:     w 348B 8B
                            w 34AF 8B
Change RSX version to 40nm: w 3912 30
Write new training data:    w 3F62 EF 87 F9 19
                            w 3F69 07 F9 1D
                            w 3F6F 1F F9 0D
                            w 3F74 EF 0F F9 0D
                            w 3FA2 03 61 82 80 01 91
(the thermal config fix isn't mandatory)
And it worked! That's the first "official" 40nm swap that wasn't done by Sony.
But of course that's not really surprising since we just copy what Sony did.

After that test I flashed the 302GB (v1.4.4k2) firmware to Syson, that's the DIA-002 standard Syscon firmware.
I did apply many patches to that firmware to debug the RSX FlexIO training and discovered something very interesting! Even though the 90nm/65nm/40nm RSX need different FlexIO training data/algorithm you can just use the 90nm/65nm data/algorithm to train a 40nm chip and it'll work. RSX will complain a lot to Syscon but Syscon can ignore that.

To further test that I removed all my custom patches from the firmware, so now it's a stock 302GB Syscon.
By applying these patches to the EEPROM:
Code: 
w 3242 03 61 82 80 01 91
w 3254 21 EC
a stock 302GB Syscon will train the 40nm RSX and the console will boot without any error.
And it doesn't matter wether 0x3912 is set to 0x11 for 90nm or 0x21 for 65nm. So you can train a 40nm RSX with the 90nm or 65nm data as long as you applied these patches to the EEPROM.
Just one note: If w 3254 21 EC doesn't work, use w 3254 21 EB since there're two different 40nm chip variants.

I also did test that on the 203GB (v1.2.3k1) and 301GB (v1.3.3k1) Syscon firmwares and it works too!
(I needed to patch these firmwares in order to work on the DIA-002 but I didn't touch anything RSX related).
That means the same patches work on SEM-001 and DIA-001 (and of course DEB-001).

I can't perform the final test since I have no COK board with a 40nm RSX, but since the other chips can train a 40nm RSX with the 90nm training data, the same EEPROM patches should do the job on the 201GB/202GB Syscon. Maybe someone can test that :D.

In summary (TLDR): A 203GB/301GB/302GB Syscon supports 40nm RSX after applying two EEPROM patches. 201GB/202GB haven't been tested yet but should in theory work since it's the same code.

A little extra: If you plan on replacing the 90nm RSX with a 65nm one, try these patches:
Code: 
w 3242 03 A2 03 B0 07 71
w 3254 21 E8


Edit (NOT TESTED):
1) For SW/2 Syscons use offset 0x182 instead of 0x3242 and 0x194 instead of 0x3254
2) For SW3 Syscons use offset 0x212 instead of 0x3242 and 0x224 instead of 0x3254
3) For the 28nm RSX replace the second command with w 3254 21 EE
 
Last edited:
Great news! What's next step should be done for those cok002, what do you suggest I should do @M4j0r.
Also I believe I'll prefer to test one here working and send it to you for experimental tests. Also I should finish syscon socket for that so you can fast swap test.
@RIP-Felix hope you like this when you get up.
 
Last edited:
M4j0r said:
Some interesting news:
I received a test console (DIA-002 with 40nm RSX and CXR713F120A Syscon) from @vyktormvmpay25 :)
And that did some extreme speed up to the 40nm RSX Syscon patches development.

First I tried to copy the official Sony procedure, for that I flashed the 304GB (v1.5.1k2) firmware to the Syscon and performed the following patches to the original (DIA-002) EEPROM:
Code: 
Fix thermal config unk:     w 348B 8B
                            w 34AF 8B
Change RSX version to 40nm: w 3912 30
Write new training data:    w 3F62 EF 87 F9 19
                            w 3F69 07 F9 1D
                            w 3F6F 1F F9 0D
                            w 3F74 EF 0F F9 0D
                            w 3FA2 03 61 82 80 01 91
(the thermal config fix isn't mandatory)
And it worked! That's the first "official" 40nm swap that wasn't done by Sony.
But of course that's not really surprising since we just copy what Sony did.

After that test I flashed the 302GB (v1.4.4k2) firmware to Syson, that's the DIA-002 standard Syscon firmware.
I did apply many patches to that firmware to debug the RSX FlexIO training and discovered something very interesting! Even though the 90nm/65nm/40nm RSX need different FlexIO training data/algorithm you can just use the 90nm/65nm data/algorithm to train a 40nm chip and it'll work. RSX will complain a lot to Syscon but Syscon can ignore that.

To further test that I removed all my custom patches from the firmware, so now it's a stock 302GB Syscon.
By applying these patches to the EEPROM:
Code: 
w 3242 03 61 82 80 01 91
w 3254 21 EC
a stock 302GB Syscon will train the 40nm RSX and the console will boot without any error.
And it doesn't matter wether 0x3912 is set to 0x11 for 90nm or 0x21 for 65nm. So you can train a 40nm RSX with the 90nm or 65nm data as long as you applied these patches to the EEPROM.
Just one note: If w 3254 21 EC doesn't work, use w 3254 21 EB since there're two different 40nm chip variants.

I also did test that on the 203GB (v1.2.3k1) and 301GB (v1.3.3k1) Syscon firmwares and it works too!
(I needed to patch these firmwares in order to work on the DIA-002 but I didn't touch anything RSX related).
That means the same patches work on SEM-001 and DIA-001 (and of course DEB-001).

I can't perform the final test since I have no COK board with a 40nm RSX, but since the other chips can train a 40nm RSX with the 90nm training data, the same EEPROM patches should do the job on the 201GB/202GB Syscon. Maybe someone can test that :D.

In summary (TLDR): A 203GB/301GB/302GB Syscon supports 40nm RSX after applying two EEPROM patches. 201GB/202GB haven't been tested yet but should in theory work since it's the same code.

A little extra: If you plan on replacing the 90nm RSX with a 65nm one, try these patches:
Code: 
w 3242 03 A2 03 B0 07 71
w 3254 21 E8
Click to expand...

Amazing work. What a twist... Things just got a whole lot easier now.
 
vyktormvmpay25 said:
Great news! What's next step should be done for those cok002, what do you suggest I should do @M4j0r.
Also I believe I'll prefer to test one here working and send it to you for experimental tests. Also I should finish syscon socket for that so you can fast swap test.
Click to expand...
The easiest test on a COK-001 or COK-002 with 40nm would be to run these commands and see if it'll boot:
Code: 
w 3242 03 61 82 80 01 91
w 3254 21 EC
or
Code: 
w 3242 03 61 82 80 01 91
w 3254 21 EB
If that doesn't work I'll need another testbed.
 
You must log in or register to reply here.

Similar threads

Back
Top