PS3 (Research/Experimental) - NEC/TOKIN Capacitors Replacement - YLOD

I was confused about the "diag" conductor, but I see it's just for grounding later in the process. Also, the eep checksum business has me leery. It's kinda complicated and the example is only an example, something I have to figure out specific to my board. This is more coding than I'm comfortable with. I wish there was video showing the process.

Exactly, you're not supposed to ground the diag point until after you enabled diag mode. You can't get into low-level diag until you've both enabled the flag and grounded the pin, in that order. Not at all convoluted :)

I understand your reluctance with the eep checksum stuff! One thing that confuses people with the guide is that the values are written for COK002, which are slightly different from a COK001 (which is what I own). When I made my changes, I accidentally used the COK002 values... doh! It took a few extra steps to get the checksum corrected, but I was able to get it going. Something to keep in mind is that the error message will tell you what needs be changed in order to fix the checksum -- it's understanding the message that gets tricky.

The reason you need to do this whole song and dance is that once you enable the flag, the syscon's checksum now different and it refuses to boot. Once you've successfully enabled diag mode and grounded diag, you actually need to set the flag back so the checksum is good and the PS3 boots normally.

I've been wanting to put a video together showing how this whole process, but my dead PS3 is stored away while I work on repairing other stuff. I've been itching to get back into things, so once I'm done with my current batch of hardware, I'll see if I can do a video.
 
Last edited:
I still have concerns over needing reball, as I have fast ylod and heating caps still won't allow booting. I partially disassembled, then attempted booting whilst pressing HARD over cell, then rsx, still fast ylod either way. SO, finally removed both pairs of caps under emi shield(opposite side of actual rsx and cell) and tested resistance between gnd and power rails. Cell side measured 4.42 ohms. RSX side measured 2.38 ohms. Can I rule out dead cell or rsx now? Then went ahead and tested capacitance(I think, maybe used diode drop setting?) between power rails on rsx and cell. Between power rails on cell side, one group measured ~.307nF,then flashed mF, then ended on open(OL). Other group measured ~1.89nF, then ended on open. RSX 1st pair measured ~.19nf, ending on open. Second pair measured ~.17nF, ending on open...Does this tell you anything?

Finally decided to remove both pairs of nec/tokins from top? of board(under emi shield, not side of actual rsx, cell chips). It was surprisingly easy to do with a large hobby knife and steady hands AND after reading thru everone's tips and tricks here. Surprisingly I found one thing I DO like about the ROHS solder...It was so much harder than leaded solder(obviously) and you could get your blade under the long pcs on the gnd and power rails and "flick" the ends up, then work your blade across and peel them completely off the solder easily without any heat involved. It literally took less than a minute per cap, no heat, no damage whatsoever. I'll try to upload some pics I took along the way to help the tentative visualize what people have been trying to explain...Since it was easy to remove the long pcs of metal actually left behind on the solder rails without heat, it was pretty easy to clean up. I added some Pb solder to the rails, then LOTS of flux, and LOTS of flux on pcs or solder braid and a large bevel tip @650degrees to clean the rails up. My goodness, that board can take some heat...But worked in my favor as there was no sign of lifting or damaging the rails during the process. I would normally never use the temps and time I used to clean them up, but the board took it like a trooper. Thanks for everyone's tips and tricks mentioned throughout this thread.

can you make a video for it
 
I forgot to save "before" images on the A01. The GPU is going back on tonight if I have time. It would be rather unscientific to throw only the "after" images up, but I can grab them if you want. Once I'm fully back to work (spending this week making sure my house is a fortress and I'm all stocked up to hide for a few weeks from the riots and 'rona), I usually do a little over 1 fatty a week so I can start saving lots of images again if there's anything else we're looking for.

Yeah, all those images look good to me. There will be a discrete switch to the altogether different looking signal if they're bad. Easily visible jaggedy 100mV sawtooth on the GPU, and an easily visible 50mV sine wave on the CPU. 50 some pages ago, we did manage to get another user with a 'scope that found both of his sets were dead and the images looked the same as mine.

edit: page 120
 
Last edited:
Just got ahold of a YLOD CECHA01. The YLOD is instant and the fans hardly move when it tries to start up. Does this mean problems with the power supply? I plan on delidding and replacing the capacitors but I think I remember reading that the fans hardly moving has something to do with the power supply
 
Just got ahold of a YLOD CECHA01. The YLOD is instant and the fans hardly move when it tries to start up. Does this mean problems with the power supply? I plan on delidding and replacing the capacitors but I think I remember reading that the fans hardly moving has something to do with the power supply
The fan should definitely have a bit more spin than that... I would investigate that before messing with the caps.
 
BTW my tantan fix 16x china 470uF 2.5V for back side of the board fix works about 2 weeks. I think it work so well because i use pcb rework heatgun when removing nec/tokins so i heated up board and top nec/tokins in same time.

Now i tested directly heating the top 4x nec/tokins and ps3 boots normally and after half hour YLOD again.

I ordered capasitanse meter in amazon to see what going on, because i dont really know what is real capasitance of these chinese tantalta. I think those may work if there if enough but i need data what is capasitanse of those to know how mutch is enough.
I'm not an engineer, just an electronics enthusiast.
 
Wow, this CECHA01 is in pretty bad shape lol. I found the reason why the fans hardly moved. It's just missing the RSX caps on the underside. It's also missing one cap on the top side too. The thermal paste is some of the worst I've ever seen, the RSX is already delidded and it's all over the thing. There's hardly any paste on the CELL too. It was missing a lot of screws when I opened it up so I knew it had been opened but damn this is bad lmao. I hope it's not permanently damaged
 
When you look for BC PS3s, always get unopened ones, and always have a known working one at hand for testing things like the PSU.

Yesterday, I finally delidded my CECHC. The CPU is now about 5-10°C cooler, despite using worse thermal paste (arctic MX-4 versus Kryonaut which I used before) and the fan spins much slower. Ironically, due to the lower fan speed, the RSX is running hotter than before now (I did also delid and repaste it). Together with another PSU from another (YLOD) CECHC, this CECHC works completely fine now. It might not have had issues with BGA or the caps to begin with. Or they don't show at the moment due to the lower temps.
 
Exactly, you're not supposed to ground the diag point until after you enabled diag mode. You can't get into low-level diag until you've both enabled the flag and grounded the pin, in that order. Not at all convoluted :)

I understand your reluctance with the eep checksum stuff! One thing that confuses people with the guide is that the values are written for COK002, which are slightly different from a COK001 (which is what I own). When I made my changes, I accidentally used the COK002 values... doh! It took a few extra steps to get the checksum corrected, but I was able to get it going. Something to keep in mind is that the error message will tell you what needs be changed in order to fix the checksum -- it's understanding the message that gets tricky.

The reason you need to do this whole song and dance is that once you enable the flag, the syscon's checksum now different and it refuses to boot. Once you've successfully enabled diag mode and grounded diag, you actually need to set the flag back so the checksum is good and the PS3 boots normally.

I've been wanting to put a video together showing how this whole process, but my dead PS3 is stored away while I work on repairing other stuff. I've been itching to get back into things, so once I'm done with my current batch of hardware, I'll see if I can do a video.
SYSCON Troubles. I put this in spoilers to not fill up the thread. This belongs in the SYSCON thread, but I wanted to post here so others following my progress on this thread know where I'm at with it. I want to get the error codes off this console this weekend, but I have some yard work to do and then we're taking a drive to hike up a waterfall. So I'll check back in tonight.
Hardware Prerequisites:
I soldered RX, TX, and DIAG wires onto motherboard. I used breadboard conductors so that I could easily connect to the USB's pin headers. For safety. I understand that the 5v is to be left unconnected.

Questions:
  1. My TTL USB Serial cable pinout is (R=5v, B=GND, W=RXD, G=TXD). Does RXD go to the motherboard's RX? Same for TX? Or does the USB's RXD goto MB TX? In other words, does the motherboard's transmit go to the USB cable's Receive?
  2. Does the GND wire on my USB cable need to be grounded to the PS3? This was not clear in the Tutorial.
Software Prerequisites:
I was/am stuck. Basically, I needed a "SYSCON for dummies" tutorial. Firstly, I'm a window user, not Linux. Also, I have only messed around with coding where I had to for projects like this. And that's been very few times total (mostly just batch files and regular expressions), so consider me a coding noob. I had Python 3.6 installed and no idea what "modules" were or how to install them. The tutorial briefly mentions needing a serial and crypto module, but how to install them was not. It just says to type in $# dmesg, which returned a syntax error. So that's as far as I got.

So I went on the interwebs to figure it out and what followed wasted my morning. I wrote this up to make life easier for the next poor sap:
  1. Download Python. During installation process check box "Add python to PATH" then choose "Customize Installation." On the optional Feature page check all the boxes and press "Next." On the Advanced Option page check the boxes for "Install for all users" and "Add Python to environment variables." Now press install.
  2. After python installs, download pyserial. Extract the "pyserial-3.4.tar" file using 7z or WinRAR. Inside the extracted folder should be a file called "setup.py". Right click on "setup.py" and choose properties. Highlight the location and right click to cop the directory to the clipboard.
  3. Go to the search bar (Win10) and search "CMD." The top result will be command prompt. Right click on it and choose "run as administrator."
  4. In the command prompt enter "CD" "space" then press CTRL+V to paste the directory you copied to the clip board. It should look something like this, "CD C:\Users\HTPC\Desktop\PS3\SYSCON\pyserial-3.4", except it will be where your file is located not mine. Press enter to change the directory.
  5. Now type, "python setup.py install" and press enter.
  6. It will do a bunch of loading and say "finished installing dependencies for python==3.4" if it installed correctly.
  7. If it just jumps to the next line without a bunch of text, it did not install.
  8. Here's a video of the process:
  9. Now install the python-crypto dependencies. Close out of the command prompt and open it again with administrator privileges. Now type "pip install cryptography". This will automatically install the package.
  10. Plug in TTL USB Serial Cable
  11. Got to the search bar (Win10) and search "device manager". Open device as admistrator and find the USB device that has a yellow exclamation point on it. Right click it and choose "Update Driver." Search the internet automatically and download the driver. Mine was found under, "Prolific USB to Serial Comm Port (COM6)." It required a restart.
Okay, I think that should be the correct way to satisfy the software prerequisites. Correct me if I missed something. I have not actually tried to communicate with it yet...

Questions:
  1. Do I launch a python terminal or a CMD promt to enter $# dmesg? Or is that a linux command that doesn't apply to windows at all?
  2. How does the next part work ($# python ps3_syscon_uart_script.py)? do I have to change directory to the python script, then launch it?
  3. What about the specific variables, Comm port and baud rate? Is this the same for windows as it is for linux? My USB was in serial port COM6, which doesn't look like the "/dev/ttyUSB0" example provided in the tutorial. So would I do the following?
Code:
CD C:\Users\HTPC\Desktop\PS3\SYSCON
python ps3_syscon_uart_script.py COM6 CXR
 
  • My TTL USB Serial cable pinout is (R=5v, B=GND, W=RXD, G=TXD). Does RXD go to the motherboard's RX? Same for TX? Or does the USB's RXD goto MB TX? In other words, does the motherboard's transmit go to the USB cable's Receive?
  • Does the GND wire on my USB cable need to be grounded to the PS3? This was not clear in the Tutorial.

Disclaimer:
For the life of me I can't find the source of these additional test points, but here's how I have them documented -- I'm sure @db260179 has this somewhere. In the official service manual, they're off of connector CN4009 (see page 21 and 30 of the manual for block diagram and board layout, respectively). In the manual, they're on pins 10 and 11, but someone somewhere told me they map also to the test points I'm using, which are WAY easier to solder to. Oddly enough, testing continuity between CN4009 and those test points below doesn't return anything, and those test points aren't documented in the manual. They 100% work, though, I just don't know where I found this.
/Disclaimer


I'm using the red/white wire for the diag pin (still floating, at this point). Syscon RX goes to UART RX, and Syscon TX goes to the UART TX. There is NO crossover. EDIT for posterity -- You are supposed to cross the connections TX to RX and RX to TX.

FEdmhWC.jpeg


Here's a slightly better close up -- sorry, I only have my phone camera...

Vf9DKzf.jpeg



From those points, they connect to the RX and TX of the UART device, like this. Note that I'm using a white wire for GND, but that's grounded to the PS3 chassi.

LsHTZae.jpg



I needed a "SYSCON for dummies" tutorial.

I also use python for windows, not linux, and I use it straight on windows, not WSL. I think we learned early on that there were odd compatibility issues with 3+ python, and that 2.7 works more reliably. Getting python to show as part of the PATH can be a little tricky sometimes, it seems that the installer doesn't always puts it where you think it should. I'm going to uninstall and reinstall my workspace and take better notes of how to get it working.

Do I launch a python terminal or a CMD promt to enter $# dmesg? Or is that a linux command that doesn't apply to windows at all?

Just CMD prompt works fine (or windows terminal, if you have it, works as well). You don't need to type dmesg, though -- that's a linux command.

How does the next part work ($# python ps3_syscon_uart_script.py)? do I have to change directory to the python script, then launch it?

Right, you have to be on the same directory where you saved the script., then launch it.

What about the specific variables, Comm port and baud rate? Is this the same for windows as it is for linux? My USB was in serial port COM6, which doesn't look like the "/dev/ttyUSB0" example provided in the tutorial. So would I do the following?

Your command is correct! In windows, you only specify the port windows auto-assigned for you (in your case, com6 -- mine is com3). You don't need to specify the baud speed, only the connection mode (which is either CXR or CXRF).


Ultimately, you don't have to be a python expert -- I'm most definitely not. It's unfortunate that getting python up and running is such a pain, but that's the extent of it. Everything else is just direct interaction with the syscon.
 
Last edited:
Nope, can't get past this error:
Result.JPG


What is the "crypto" module they are talking about in the tutorial, and if it's so important, why the hell wouldn't they tell you how to install it? That is a frustrating oversight guys! It will trip up every single windows user trying to contribute to this project and deter them from helping.

I tried:
Code:
pip install pycrypto
that results in an error:
Capture.JPG

Code:
pip install cryptography
This installed successfully, but doesn't seep to be the correct module.

Then I just tried installing "crypto" which installed something, but I have no idea what or if it was safe to do so. And that is a bit scary! WTF!

I uninstalled python 3.4 I had previously. I did not uninstall 3.9, but after I installed 2.7.18 it seems to be the one that automatically runs from the command prompt, since it warns me that it is end of life and will loose support in 2021. I reinstalled pyserial-3.4 and the crypto modules again (all of the above methods anyway). Py serial seems to be installed, but the crypto isn't. I still get the same crypto error.
 
Nope, can't get past this error:
View attachment 28493

What is the "crypto" module they are talking about in the tutorial, and if it's so important, why the hell wouldn't they tell you how to install it? That is a frustrating oversight guys! It will trip up every single windows user trying to contribute to this project and deter them from helping.

I tried:
Code:
pip install pycrypto
that results in an error:
View attachment 28494
Code:
pip install cryptography
This installed successfully, but doesn't seep to be the correct module.

Then I just tried installing "crypto" which installed something, but I have no idea what or if it was safe to do so. And that is a bit scary! WTF!

I uninstalled python 3.4 I had previously. I did not uninstall 3.9, but after I installed 2.7.18 it seems to be the one that automatically runs from the command prompt, since it warns me that it is end of life and will loose support in 2021. I reinstalled pyserial-3.4 and the crypto modules again (all of the above methods anyway). Py serial seems to be installed, but the crypto isn't. I still get the same crypto error.

100% agree, I had to go back and forth with the modules until I got them right, and it's maddening that there are multiple crypto packages. However, pycrypto is the correct package to install, not cryptography. That's wrong, see edits below.

As far as safety, though, it's just a module to add functionality for your scripts, it doesn't do anything in and of itself.

The reason we need the crypto package is because syscon communication is encrypted, and the python script handles that for you automatically. Otherwise you would end up needing to write your own decryption routines, instead of focusing on fixing the PS3.

I'm going to write a separate guide for windows later today, once I get a bunch of things out of the way.

EDIT: just for kicks, I ran pip install pycripto, and sure enough, I got a wall of errors as well. Funny enough, I'm still able to run the script and interact with syscon, so color me confused. I'll hurry up and the the updated guide up written as soon as I can.

EDIT 2: Good news! I found my original post, where I discussed the script with @M4j0r (who provided me the original script). Here's the post --> https://www.psx-place.com/threads/fun-with-syscon-and-serial-commands.29913/

And here's the correct list of modules, all installed via PIP INSTALL
  • pycryptodome (not cryptography or pycrypto -- sorry about that)
  • pyserial
 
Last edited:
Any other ideas?
Capture.JPG
EDIT:
The module was automatically installed to "C:\Python27\Lib\site-packages\crypto\Cipher\AES.py" so I'm not sure why the script can't import it. The script has it "from Crypto.Cipher import AES", but that doesn't find it. Does the script need to be modified to point it to the right directory? It sounds like it's expecting a folder called modules, but it's downloading to a folder called site-packages. This is definitely out of my area, so the coders among you will have to chime in.
 
Last edited:
I'M IN! Now what?
I uninstalled every installation of python I had. Then I installed Python 2.7.18 fresh, checking the box to add it to the PATH during installation. Then I opend a CMD prompt and performed a "pip install pycryptodome", which installed sucessfully. It informed me of a pip update and game me a command to run it, which I did sucessfully. Them I performed the "pip install pyserial", which completed sucessfully. After that, I was finally able to use change the directory and run the script successfully. It greeted me with >$ instead of the previous error messages. So that was anticlimactic, but it's progress. I'll take it!
Code:
>$ AUTH
Auth1 response invalid
The guide says I did need to flip the RX/TX wires, if I get this response. I got the above response when the RXD went to RX and the TXD went to TX. So I fliped them so that, the USB cable's receive (RXD) goes to the PS3's Transmit (TX) header, and visa versa (which makes sense, actually). Then I exited the CMD prompt, re-ran the script...
Code:
>$ AUTH
AUTH Successful
>$ EEP SET
F0000003
>$ EEP GET 3961 01
F0000003

Now what? Do I literally type in this?
Code:
EEP SET 3961 01 00
EDIT:
I Think I got it. The Case is sensitive! I needed to pay close attention to the uppercase and lowecase commands in the guide. So used the
Code:
EEP GET 3961 01
...and it responded "000000000 FF" as expected. Then I proceeded to:
Code:
EEP SET 3961 01 00
and it responded correctly. I double checked that it wrote the changes with...
Code:
EEP GET 3961 01
...and it responded "000000000 00"

So then I turned it off, grounded the Diag wire and fliped PWR back on. It beeped 3 times and flashed red now. I restarted teh CMD prompt and used the CXRF baud rate this time:
Capture.JPG

Capture2.JPG

When you change the EEP the checksum fails and the console beeps 3 times and flashes red. I followed the guide closely and changed the entry that failed the checksum. It only required one write. Then I was able to run the error log. I don't know if this is everything or if I need to restart the console, power it up to get a YLOD, then restart, SYSCON in and THEN run the error log? Or does it record all the failures period?
 
Last edited:
I'M IN! Now what?
I uninstalled every installation of python I had. Then I installed Python 2.7.18 fresh, checking the box to add it to the PATH during installation. Then I opend a CMD prompt and performed a "pip install pycryptodome", which installed sucessfully. It informed me of a pip update and game me a command to run it, which I did sucessfully. Them I performed the "pip install pyserial", which completed sucessfully. After that, I was finally able to use change the directory and run the script successfully. It greeted me with >$ instead of the previous error messages. So that was anticlimactic, but it's progress. I'll take it!
Code:
>$ AUTH
Auth1 response invalid
The guide says I did need to flip the RX/TX wires, if I get this response. I got the above response when the RXD went to RX and the TXD went to TX. So I fliped them so that, the USB cable's receive (RXD) goes to the PS3's Transmit (TX) header, and visa versa (which makes sense, actually). Then I exited the CMD prompt, re-ran the script...
Code:
>$ AUTH
AUTH Successful
>$ EEP SET
F0000003
>$ EEP GET 3961 01
F0000003

Now what? Do I literally type in this?
Code:
EEP SET 3961 01 00

That's great! I'm glad you were able to get it to work. I"ll update my post to reflect that the wires do need to be crossed, after all.

A response of F0000003 indicates that the command was not found, whereas a response of 00000000 indicates a successful command. Before you change anything, though, try the following command

Code:
errlog

This will at least get you what the latest error in your PS3.

This page lists all the commands available. You're currently in "External command" mode
https://www.psdevwiki.com/ps3/System_Controller_Firmware#External_commands_.28COK-001.29

This page lists all the known error codes
https://www.psdevwiki.com/ps3/Error_Codes#SYSCON_Error_Codes


And we go into a deeper discussion of what the commands are and what they mean in the other syscon thread. You'll want to download a copy of the Sony PDF doc (same location you got the script from) that indicates which chip maps to which syscon error (for example, i currently have 0xa0403034, aka 3034, which we currently think it's a bad solder/ball issue)
https://www.psx-place.com/threads/f...syscon-first-steps-and-error-reporting.30100/
 
Okay, I think I got the log. I pressed power to initiate the boot process and it YLOD as expected. The I ran "lasterrlog" to get this: And here is the full log. I'm still not sure what I'm looking at.

So, lasterrlog went through all the steps of the power-up sequence. You can see SSM moving along power up until it hits an error, then shutdown and return two errors:

0xa0404003
0xa0403034

Based on the syscon error log codes document that someone leaked out of Sony, the only meaningful parts of the error code is the last 4 digits, in this case 4003 and 3034.

3034:
3 - the first digit indicates a fatal booting error
0 - the second digit is always 0 for category 3
3 - that's a CELL BE error -- the chip is IC1001
4 - that's also a CELL BE error. It ranges from 0-4, and the significance of the last digit is not known yet

For 3034, the problem is with CELL BE, IC1001

4003:
4 - the first digit indicates a Data error
0 - the second digit ranges from 0-4, indicating different ICs
0 - the third digits ranges from 0-4, indicating different ICs as well
3 - the fourth digit also ranges from 1-3, meaning CELL/BE, RSX or SB (Southbridge)

For 4003, the problem is with SB, IC3001

So what does it all mean?

The current consensus is that 3034 is either a bad CELL chip, or no power going to the it. For 4003, there's a similar problem with IC3001. I know that at one point I removed all the tokins, and started getting a 3003 -- POWERFAIL. That makes sense! no power going to CELL. There was another time I fried some other southbridge fuse, and started getting an error on the chip that was no longer getting power. I fixed the fuse and the problem went away. The point I'm trying to make is, don't assume the chip is necessarily bad, it could just be some problem down the line that is impacting the chip syscon is reporting a problem with.
 
Yeah, I was just looking at that document. I, like you have that 3034 (Fatal Booting Error "BE Error IC1001.") That suggests, what? Any critical power failure on the CELL? So this could be anything, such as a BGA defect, Bypass cap failure, etc. Looking closely at that document shows errors 3000-3005 are "POWER FAIL." Everything else in that section is CPU, RSX, SB, and Flash controller related. I'm thinking it's kinda suspicious that there happens to be five of them and also five voltage regulators. If a VRM fails I wonder if it would trigger one of those. If so, then my VRM are probably fine and the error is isolated to the second stage filter or the BGA itself (My guess).

The 4002 (Data error "RSX Error IC2001"). Could that a BGA thing or perhaps a memory problem?
 
If a VRM fails I wonder if it would trigger one of those.

That's correct, pretty sure when damaged one of the vrm (I forget which), I was getting 3003 until I replaced the cap I fried with the saddest little bodge ever.

As far ar 3034, one of the users in the other thread suggested that every time he had that error, he fixed it with a reball. I haven't been able to verify that for myself -- I don't have a scope good enough to verify my cap job, and I'm fairly certain I don't have enough caps in there anyway. I've been looking for a reputable place to get a reball done, but only once Ive verified the caps are good.

My method for troubleshooting was somewhat slow and methodical - I was going through each module (as identified in the service manual), and verified that the voltages out of each main IC were correct. That's not really doable for cell and rsx, but fairly doable for everything else.

I'm curious about your Southbridge error, though -- have you checked your fuses over there?
 
Back
Top