PS3 Fault finding YLOD with the SYSCON - First steps and Error reporting

If you guys wait for me to fix another 2500 unit for few tests. Next coming week it will be done. That will be for sure sw 302. Previous fixed units all sold out and in rush forgot to dump or run further tests if took to much time has been left aside.
This days been out chilling with friends.
 
If you guys wait for me to fix another 2500 unit for few tests. Next coming week it will be done. That will be for sure sw 302. Previous fixed units all sold out and in rush forgot to dump or run further tests if took to much time has been left aside.
This days been out chilling with friends.
It could be very handy if some of you that does repairs frequently and have access to lot of PS3 motherboards to check in this link if the syscon was dumped and documented before. Are the ones marked in red
https://www.psdevwiki.com/ps3/System_Controller_Firmware#Syscon_firmwares

From the mullions... are missing the CXR713120-202GB, the CXR713120-203GB (this ones are common)... and the rare CXR714120-303GB (but this is used only in the official 65nm RSX frankensteins)
And from the sherwoods... are missing a lot, 7 in total SW-302, SW2-302, SW2-303, SW3-301, SW3-302, SW3-303, SW3-304

A PS3 model CECH-25xx is supposed to have a SW2-303
 
Last edited:
It could be very handy if some of you that does repairs frequently and have access to lot of PS3 motherboards to check in this link if the syscon was dumped and documented before. Are the ones marked in red
https://www.psdevwiki.com/ps3/System_Controller_Firmware#Syscon_firmwares

From the mullions... are missing the CXR713120-202GB, the CXR713120-203GB (this ones are common)... and the rare CXR714120-303GB (but this is used only in the official 65nm RSX frankensteins)
And from the sherwoods... are missing a lot, 7 in total SW-302, SW2-302, SW2-303, SW3-301, SW3-302, SW3-303, SW3-304

A PS3 model CECH-25xx is supposed to have a SW2-303
Found few of them, I will post in your treat. Now another student question (nowhere else to quick ask), if some good developers have kindness to answer a question about spi mode working with syscon. In first place though syscon is working as master in mode "3" of spi where all southbridge, BE, RSX, are slave. But looking at the way are connected in old phats, this interconnect is not really that mode "3". So which mode of spi I can use? Probably I can get more data over from each line?
Not big deal, but it reduces the amount of time for investigation/reading.
Probably not very good enough with buspirate (properly to slow)?
Or any idea about logic analyzer for this spi communication monitor like UART monitoring data in real time?
I see jtag has a bonduary scan or waveform that could help. Though would be possible in spi to do something like this.
I really appreciate any pointing direction.
 
Found few of them, I will post in your treat. Now another student question (nowhere else to quick ask), if some good developers have kindness to answer a question about spi mode working with syscon. In first place though syscon is working as master in mode "3" of spi where all southbridge, BE, RSX, are slave. But looking at the way are connected in old phats, this interconnect is not really that mode "3". So which mode of spi I can use? Probably I can get more data over from each line?
Not big deal, but it reduces the amount of time for investigation/reading.
Probably not very good enough with buspirate (properly to slow)?
Or any idea about logic analyzer for this spi communication monitor like UART monitoring data in real time?
I see jtag has a bonduary scan or waveform that could help. Though would be possible in spi to do something like this.
I really appreciate any pointing direction.
I dont know much about the syscon SPI buses, all i know is there are 4 and are dedicated (not shared)
3 of them are for CELL/RSX/SB... and the other is a direct access to the syscon EEPROM
There are some comments in wiki from people that was using a bus pirate to dump the syscon EEPROM by SPI (and i remember squeept did it too in the frankenstein thread)
The SPI communications in between syscon and CELL (and i guess SB too) was already studied by m4j0r and the team that published the syscon exploits... but the RSX was left behind, probably because it was not considered interesting... but now the talks about the frankensteins and the malasyan modchip became so popular probably is under research... i dont really know, you should talk with m4j0r
 
Hi Guys,

I have a CECHC04 FAT PS3 which had some intermittent YOLD issues. In some cases after random times playing game sit went to YOLD and when I waited about 10-15 it turned back on. The COU and GPU temps were alwyas aroun 65-70C during gaming. I started to change the NEC tokins on the other side of the GPU and CPU and changed all the 4 on the opposite site for about 6 months ago and it looke dlike it sorted the problem. But in about a month ago it started again the YOLD. This time I changed 1 NEC tokin above the RSX and 1 above the CELL. But since than it just goes into YOLD.

I hooked up the serial to the syscon it gives me the "0xa0203010" error which looks like some CELL/BE power error. It looks like form the error it does not get any power. Can it be because of the NEC tokins? Since I put back the original Tokins back on the GPU and CPU side but it also did not help.

Do you know anthying about his error a0203010 is there a way fix or further debug this issue? I am posting the syscon bringup log here as well:

Code:
>$ bringup
bringup
[SSM] state: 0000 -> 0101
Bringup Mode #0 (0xFF)
[SSM] ssmCb_OnStartingBePowOn() called.
[SSM] Bringup mode : syspm_stat=00000000/00000000
[POWSEQ] PowerSeq_Setup called.
[SSM] state: 0101 -> 0201
[POWSEQ] AV Backend Setup
[SSM] state: 0201 -> 0102
[POWERSEQ] Error : wait attention timeout.(SEQ1)
[SSM] state: 0102 -> 0302
[SSM] PowSeq Fail : Detected !
[SSM] state: 0302 -> 0700
[POWSEQ] AV Backend Letup
[SSM] Shutdown mode : syspm_stat=00000000/00000000
[ERROR]: 0xa0203010
[POWSEQ] PowerSeq_Letup called.
[SSM] state: 0700 -> 0600)

Thank you for you help in advance
 
Fantastic work on the tool, thanks to everyone who contributed towards this discovery!!

I've been able to get the errors and all of them were 3034
Just would like to know if it's worth checking into the internal mode with a more detailed log, or we could already conclude that the console requires reball to RSX? Thank you in advance.

===================================
ERR 00: 00000000 A0403034 FFFFFFFF
ERR 01: 00000000 A0403034 FFFFFFFF
ERR 02: 00000000 A0403034 FFFFFFFF
ERR 03: 00000000 A0403034 FFFFFFFF
ERR 04: 00000000 A0403034 28233151
ERR 05: 00000000 A0403034 2820D7A8
ERR 06: 00000000 A0403034 2820D797
ERR 07: 00000000 A0403034 2820B2B5
ERR 08: 00000000 A0403034 2820B2A7
ERR 09: 00000000 A0403034 2820B291
ERR 10: 00000000 A0403034 281C9B09
ERR 11: 00000000 A0403034 281C1736
ERR 12: 00000000 A0403034 28180DBA
ERR 13: 00000000 A0403034 28164CF3
ERR 14: 00000000 A0403034 28162170
ERR 15: 00000000 A0403034 2816215F
ERR 16: 00000000 A0403034 28161962
ERR 17: 00000000 A0403034 28161958
ERR 18: 00000000 A0403034 2816194B
ERR 19: 00000000 A0403034 2815EE94
===================================
 
Fantastic work on the tool, thanks to everyone who contributed towards this discovery!!

I've been able to get the errors and all of them were 3034
Just would like to know if it's worth checking into the internal mode with a more detailed log, or we could already conclude that the console requires reball to RSX? Thank you in advance.

Internal mode would give you the same error codes, so its not really worth the trouble just for that. If you're looking for more tests, after getting the error codes, it might be worth it checking out the resistance points (documented in the original post) and see what your values are.
 
So I made some progress with go-ps3syscon, tweaked code a bit, still alpha and still cxrf mode only.

So I finally Implemented CXR mode and looking for someone with Windows and Linux to test if it's working or not. You can grab it over my github. For some reason I still can't post links, so I edited link in my quote.
 
Fantastic work on the tool, thanks to everyone who contributed towards this discovery!!

I've been able to get the errors and all of them were 3034
Just would like to know if it's worth checking into the internal mode with a more detailed log, or we could already conclude that the console requires reball to RSX? Thank you in advance.
Hmm, that looks interesting actually.
I don't remember seeing a string of 3034 errors alone.
Normally when it's the typical RSX related ~3s YLOD, the 3034 doesn't come alone, instead it's always accompanied by 44XX error.
Because we could understand this error as a failure in communication between CELL CPU and RSX. (BitTraining error, in bringup is more detailed)
But in your case, without the RSX associated 44XX data error... Only 3034 is actually not so conclusive in my eyes.

It could be the CPU. But of course the rsx is still suspicious as always, just nothing definitive.
 
Beside errors people should post some of measurement with resistance to power lines of cpu and gpu, will be more easy to give a better solution.
As you seen that error 1002 on 2000 slim appeared after one working day, 2024 in super slim where I exchanged both AV/Hdmi ic because I wasn't sure which was faulty.
This case I can say dead cpu only if resistance is nearly 2 ohms on untouched board (reball/reflow attempts)
 
I have been wanting to change the fantables manually using the SYSCON, so that we don't have to jailbreak and install webMAN. I would love to see a tutorial for it. Would you mind copy/pasting the string on the CMD prompt after you change the fantables? I'd like to see the commands and such (kinda like a tutorial).

So when you change the ini are you not changing the eeprom? I was under to impression that changing the fantbls would cause the eeprom checksum to fail and then you would have go back in and fix it one by one.
By the way, in the end I posted some kind of guide on how to modify the SYSCON fan settings, if you were interested.
I wasn't sure if it belonged here, in sandungas's fan curves thread, or in a new thread of its own.

https://www.psx-place.com/threads/syscon-fan-settings-coordinate-graphs.31188/page-4

For the moment It's there
 
I can test further on this mpx with emmc, just let you know when I start and don't understand the side of set init atm, I will read more at right moment, quite busy with work on my business website for sellings. Starting with something new to help my brother.
 
Hi, I have been trying to use syscon with my recently bought ps3 (fat, CECHG, SEM-001 motherboard) and I can't auth nor send any command to it

I have tried Windows, Linux, checked if I soldered it correctly, swapped RX and TX but no luck. Sometimes I get a python error, sometimes not.

https://imgur.com/a/44uQG7R
 
Hi, I have been trying to use syscon with my recently bought ps3 (fat, CECHG, SEM-001 motherboard) and I can't auth nor send any command to it

I have tried Windows, Linux, checked if I soldered it correctly, swapped RX and TX but no luck. Sometimes I get a python error, sometimes not.

https://imgur.com/a/44uQG7R
Please read pdf inside github link in first post.
https://github.com/db260179/ps3syscon
Beside rx,tx do you use pin of gnd? First time try only with "AUTH" big letters,focus on that.
Also think you are missing some software components, not sure not Linux expert.
Describe software side of components as well.
 
Last edited:
Hi, I have been trying to use syscon with my recently bought ps3 (fat, CECHG, SEM-001 motherboard) and I can't auth nor send any command to it

I have tried Windows, Linux, checked if I soldered it correctly, swapped RX and TX but no luck. Sometimes I get a python error, sometimes not.

https://imgur.com/a/44uQG7R
Seems like your problem is GND. It's missing? Both the device, the adapter and the host need to share the same ground to communicate properly. Do you get a dim red light on your adapter without USB power?

Also DIAG is only for internal CXRF mode.
Maybe you got confused

This is a small guide to get started. Done by Paco.
I write this in addition to linux guide (work in progress) by db260179.
https://www.psx-place.com/threads/f...syscon-first-steps-and-error-reporting.30100/
Be sure to check.

I will try to explain step by step, as easy as I can explain it.
Really this can be done in 10 minutes.

First of all let's make clear what we are doing:
We are simply running a python script that will let us communicate with the PS3 SYSCON (its brain), using a 3.3v serial (COM) port.

We can thank guys like 'M4j0r' and 'zecoxao' for making this possible in the first place. We are just running their script.

So, what do we need in order to run this script?

Python installed, with additional modules pycryptodome and pyserial
And a 3.3v serial (COM) port

************

*For Windows users (most people) this is what you can do:

-First install python 2.7.18 (you can get from python.org) (newer versions may be supported but 2.7.18 is guaranteed to work)
-When you run the installer, you can check the last box "add to Path environment variable" (it will make things easier; allows you to run python commands from any location) (see image at the end)

Once it's installed, you should already be able to run python commands and scripts. How? Directly from the windows command prompt (which you can open in many ways; I like shift+right click to open cmd window here) you can type:
python script.py
("script.py" is just an example; this should be the name (or full path) of the script you are trying to run)
But our particular script relies on two additional modules. (If you try without them, it will tell you the problem)
Don't worry,
-You can download and install them automatically by typing in the command line:

pip install pycryptodome
pip install pyserial

That's it. Now you should be able to run the magic script. Just specify the COM port and the syscon mode at the end.
-For example:

python script.py COM4 CXR

************

What COM port?
This is where the USB to serial 3.3v adapter comes in handy.
When you plug it into your computer, it should show up in device manager as a COM port. If not, you need to install drivers for it.
This will depend on your particular operating system and dongle.

What is CXR? This will depend on the syscon you are trying to communicate with. SW is for newer (SherWood) Syscons. CXR(F) for the older BGA models
Further details are available.

If all is correct, no errors will come up immediately. Even without anything physically connected.
You can then type AUTH, and will get
"Auth1 response invalid"

Of course, to get past this, everything has to be connected and working properly. Even then it may take a couple tries in a row. Eventually you should get:
Auth successful

Which means all is good and you can now run external commands (In capital letters) such as:
ERRLOG GET 00

(If you are still getting "Auth1 response invalid", first simply try again a couple times, turn the ps3 power off and on, if not, swap Rx and Tx wires around and repeat (This is not dangerous, don't worry). Check all the connections etc... (good GND is important too)...It should all work in the end)
That's it for now

*But what serial adapter dongle should I get?

-This is the one I got and it works. 2$ worldwide.

US $1.14 | High Quality FT232RL FT232 FTDI USB 3.3V 5.5V to TTL Serial Adapter Module Mini Port
https://a.aliexpress.com/_vLbCPR

FT232RL is the name of the main IC.
But many others will work too. Get what's most available to you. Preferably from local seller. These are widely used for many other applications. They are COMmon.
You may need to download and install drivers manually If it doesn't automatically appear listed in device manager as a COM port
-Just make sure it's working at 3.3v. (Very important) (To make sure you can check 3.3v with a multimeter between Rx/Tx and GND) If it's 5v or more... It can damage the SYSCON so be careful... 3.3v only!

/SPOILER]
 
Hi, I have been trying to use syscon with my recently bought ps3 (fat, CECHG, SEM-001 motherboard) and I can't auth nor send any command to it

I have tried Windows, Linux, checked if I soldered it correctly, swapped RX and TX but no luck. Sometimes I get a python error, sometimes not.

https://imgur.com/a/44uQG7R
From my experience with SYSCON that means your syscon receives some random data (possible it's not even a response to your command), for me the solution was connect usb to ttl then plug ps3 into power socket. Sometimes it's just adapter, I had CP2102 and it completely not working in CXR mode in MacOS, but works on Linux.

If you connect RX TX the other way you will receive command you send in response.
 
I'm not sure exactly how syscon works, but maybe the codes were overwritten?

Let me explain, since my first ylod, I was trying to power it up without any luck, maybe I tried to launch it more than 10 times(I probably did lol) and since I've made so many attempts, maybe that's the case why every code is 3034? Basically, the rest of the codes were overwritten by my failed launch attempts since first ylod?
 
Please read pdf inside github link in first post.
https://github.com/db260179/ps3syscon
Beside rx,tx do you use pin of gnd? First time try only with "AUTH" big letters,focus on that.
Also think you are missing some software components, not sure not Linux expert.
Describe software side of components as well.

I saw a video where only TX and RX were needed (I think, I might be wrong). Always I read the pdf I don't understand where to connect the GND.

I'm using Windows 10 with python27, ft232r usb uart

Seems like your problem is GND. It's missing? Both the device, the adapter and the host need to share the same ground to communicate properly. Do you get a dim red light on your adapter without USB power?

Also DIAG is only for internal CXRF mode.
Maybe you got confused

I couldn't solder where it says the GND in the motherboard, should I use a knife to scratch it?

From my experience with SYSCON that means your syscon receives some random data (possible it's not even a response to your command), for me the solution was connect usb to ttl then plug ps3 into power socket. Sometimes it's just adapter, I had CP2102 and it completely not working in CXR mode in MacOS, but works on Linux.

If you connect RX TX the other way you will receive command you send in response.

So I though well when I saw something like receiving the command after sending it
 

Similar threads

Back
Top