PS3 Fault finding YLOD with the SYSCON - First steps and Error reporting
Reballing/Reflowing Cheap DIY Hardware list ($350):
Here's an example of my setup:
- $104 = IR Preheater (Be sure cord is rated for 15A - it says on the plug. If not, buy another one that is. This is a safety hazard. The cord that came with mine was 10A and was getting hot to the touch after just a few minutes! It would surely have burned my house down had I not replaced it. The 15A cords works perfect for hours of continuous operation whithout warming up in the slightest. They may have fixed this since I purchased, but be sure to check before using it. Otherwise, this is a great preheater!)
- $28 = Dual Channel Temperature Meter with K-Type Thermocouples. This works great. It's not the most accurate thing, but for the price it's perfectly fine. You need to place one probe on each side of the motherboard to monitor the topside and bottomside temperatures. This tells you when you're getting close to flowing temperatures. But you'll still have to watch the chip and nudge it to know for certain. This minimizes the time you stay above the melting point and allsow you to manually simulate a temperature profile. Not perfect, but better than nothing.
- $79 = Hot Air Rework Station. This is the one I have. I only use it for the hot air gun. It's temperature controlled soldering iron is fine, but I prefer my KSGER T12 station. The DC power supply is a bonus and nice to have, but it's not the best. This is a nice all in one that enables the electronics DIY'er for the off job here and there. I like mine.
- ~$20 = 45x45mm IC SMD Rework Nozzel. You need this to evenly distribute the hot air from the rework station. I needed to turn the airflow on the rework station to maximum to get good even pressure in the nozzel, which works well. If you use less than that the heat backs up into the wand and it thermal throttles. The same happens with a heat gun. It'll heat, then cool down, heat, cool down...indefinitely and you'll never get up to temp. You need to get the pressure right or it wont work. I should also mention I had to fit the BGA nozzel over a Hot air nozzel to get it to fit on the end of the wand. I cut the tip off one of the nozzels that came with the hot air station and clamped onto that. You may need to do a similar mod to get it on.
- $20 = Electronis contact cleaner. This is to thoroughly clean the residues and oils off the BGA. This stuff contains some toxic fumes, so do it outside and wear Nitrile Gloves. Use this with the board tilted at an angle and allow it to run underneath the BGA. Place a paper towel under the chip to soak up the dirty solvent as it runs through (you don't want it to run underneath other components and dry, leaving residues). Flip the board 90 degrees and repeat as many times as needed to be sure it's THOROUGHLY clean under the BGA. Any dirt, grime, oils, dust, or residual flux can contaminate the solder when you reflow. That will reduce the amount of time your reflow lasts.
- $13.25 = AMTECH BGA FLUX. Now I know the stuff you buy on ebay is probably a knock off. But it's worked well for me. It's not the stuff you want to use for reballing, but works well to reflow. Once the board is warm, use this to wick under the BGA. Add until it has wicked as much as it can. Then begin increasing the temps to being simulating a reflow profile. After reflowing the chip and cooling the motherboard. Be sure to thoroughly clean off the flux residue with contact cleaner the same as you did before.
- $50-80 = Reballing kit. I wont link to one as I don't like what I got and haven't found a good solution yet. There is a blue jig that everyone sells, but it's hard to adjust and doesn't hold the chip securely. You can file down the ridges that hold the chip so it sits more securely, but it's a PITA. There is a silver one that holds the chip diagonally, but it's too small to hold the RSX substrate corner to corner (found that out the hard way!) It might be able to hold the IHS, but it's better to remove that before reballing so you don't have to heat the chip so much. Anoying! These kits often come with stencils, a variety of leaded solder ball sizes, BGA flux, brush, spudger, suction pen, & etc.
- $5-10 = Aluminum Tape. This is to attach the temperatur probe and mask off the RSX. Regular aluminum foil will work for the rest of the top side, but the area next to the edge of the chip the tape works best. I've tried polyacrylamide tape (Kapton), but the second flux touches it, it looses it's stick. The aluminum adhesive is more resistant and the aluminum itself bends to hold it's shape, even if the adhesive looses some of it's stick. Just be sure to remove while the board is still a little warm. It's hard to remove otherwise. Also the sticky residue it leaves behind needs cleaned off.
- $25 = Swing Arm Mount. This is to hold your Hot air wand above the motherboard, so you don't have to hold it by hand. It takes some modifying, but works pretty good once that's done.
The biggest problem I have run into is getting the new leaded solder balls to adhere to the RSX pads and be perfectly centered on them. This is the hardest part IMO. Removing the chip is a piece of cake. Soldering it back on isn't that difficult either. I did have trouble with the motherboard warping at first, but solved that using aluminum foil on top of the MB, 2 hours drying at 100C, and higher BTM preheat temps (150-180C) during the reflow. It's balling the RSX that's hard!
On the other hand, a reflow with this setup is super easy. It'll last longer than an IFixIt heat gun special, that's for sure...lol!
well, finally i got the tools to do it but... i hardly can remove that goddamn lead (same with the rsx)
botakompong
Member
Maybe this can to
I see from my drive, from 2014, the post from my brother "kiaw"
I see from my drive, from 2014, the post from my brother "kiaw"
Last edited:
botakompong
Member
I think everything can be reballed well, a tip from me, specifically for the cxd 2971, you should install the temperature sensor on the pcb especially attached to the rsx tin ore, sticking to the outermost tin ore is enough, the original sony tin ore for the cxd 2971 will melt at a temperature of 218 celsius max 220, cdx 2971 is not heat resistant compared to other rsx, there is a lot of damage to the rsx during reballing because it does not pay attention to temperature, this is important !!!, pay attention to the melting point, when the temperature reaches 218 celsius it is ready to be lifted, try before 220 celsius, rsx has been lifted, rsx damage due to high heat usually occurs in the R1, R5 (short) voltage area, other areas can also damage RAMRSX (GLOD).well, finally i got the tools to do it but... i hardly can remove that goddamn lead (same with the rsx)
Because the field of the nand ps3 phat type pcb is larger, it is better to keep the heating of all parts evenly, with a good IR setting can make the tin ore under the rsx melt together, that is also an important thing to note The IR setting of each BGA device varies depending on the room conditions and the service life of the BGA itself, so if you pay close attention to the condition of the tin ore, you will get a good setting.
Last edited:
db260179
Member
The trick i find is to have a high bottom plate preheat temp - 160C, and a slow top IR heat of 190C for 1 minute. But you must remove the IHS plate first otherwise all you do is fry the ram chips
Plenty of flux on the edges to help of the RSX to aide removal
RIP-Felix
Senior Member
That's exactly what happened on my first attempt! Haha...sorry, but that's par for the course. I did warn you about the learning curve.well, finally i got the tools to do it but... i hardly can remove that goddamn lead (same with the rsx)
Set your bottom heater to 180C during the reflow. Set the upper heater to 250C at full airflow and slowly inch it down to 1 cm from the chip. Lower a little, wait and watch the temps rise. Put one on edge of chip and one underneath. Both temps should be pretty close (mine stay about 5-20C of each other). If the bottom temperature isn't close, then you are lowering the top heat too quickly or have a draft under the board that's cooling it.
To prevent drafting, cover the board with aluminum foil and pack it in around the edges of the bottom heater to seal off airflow, so that it can't get under the board. Be careful not to block any of the fan vents for the heater itself, it needs to be able to cool itself. You just don't want cool air moving underneath the MB.
Once the temp probe reaches 218C (Lead-Free melting point), begin nudging the chip. Once each corner of the chip moves freely it's ready to pluck. Use a suction plucker immediately after raising the top heat out of the way. Don't give it time to cool and solidify or you'll tear traces like in your photo! You can place the chip on the aluminum foil right next to chip. Just set it solder side down, gently! Don't flip it over! Then lower the heat on your heaters to 100C. Give your top heat a minute to cool and turn off.
Now is a good time to clean the solder off the board, while it's still hot! By then the Chip will have cooled enough for you to work with it. The hard part is balling the chip, which I still haven't done sucessfully myself. It's tedious and takes alot of patience to stop reset the balls that are too close, start again, stop reset the squirmy balls, start again. After about 3 or four of those then the flux dries up and they wont adhere to the center of the pad. If they adhere to the edge of the pad, it's no good because they will bridge when you try to put the chip back on the board (I found out the hard way). So you need to get it right on the first few attempts, before the flux dries up. And if you use too much flux, or add more flux later, they'll swim and merge! IT'S VERY FRUSTRATING! That's why its expensive!
I'd happily pay SONY $150 to do it for me, just to avoid the GORAM solder balls! Luckily I was able to get New Old Stock CXD5301 40nm RSX's. They came pre-balled (Thank GOR!). It's lead-Free, but who cares! The 40nm is going to last regardless.
RIP-Felix
Senior Member
This is fantastic! What other nuggets was your brother hoarding?Maybe this can to
I see from my drive, from 2014, the post from my brother "kiaw"
@sandungas I wonder if you can use this to start a chart in the dev wiki for the RSX like what is available for the CELL here? It looks like alot of the pins are directly labeled. Also, be sure to credit "Kiaw" for it! Gotta pay our respects to THE MAN!
One thing of note, I see the JTAG pin are labeled (AU13 = TCK, AU15 = TRST, AT16 = TDI, AR16 = TDO, & AR14 = TMS)!!! Last I checked the wiki said the RSX JTAG location was unknown. That should allow us to finally identify the spring pin test pads on the motherboard (They're conspicuously unlabeled on the schematic)! It should just be a matter of continuity probing for them. Breaking into the JTAG may reveal more useful diagnostics. I know @vyktormvmpay25 likes to play with things like that!
We have UART to the SYSCON, which is limited. I wonder what can be learned from JTAG? Usually the chipset is daisy chained through JATG for diagnostic purposes. So perhaps it could be even more useful!
It seems like someone would have already figured this out, so I don't want to say...EUREEKA! But from a reverse engineering perspective, finding the JTAG port is one of the first steps to breaking the whole thing wide open. That's why they go to such lengths to hide it.
Last edited:
vyktormvmpay25
Senior Member
You reading my mind about that jtag, was about to scramble pdf schematics to add missing points of rsx and not sure which are for rams exactly. It may help when out of board to see good traces before reball.
Jtag bonduary scan is more advanced for debugging, it can tell by scanning pins which you aren't connected on board.
Jtag bonduary scan is more advanced for debugging, it can tell by scanning pins which you aren't connected on board.
RIP-Felix
Senior Member
Yeah, I think I saw a video about that. Hold on...let me see if I can find it...
You should be able to use JTAG to check the integrity of each individual trace on the chips in the daisy chain (probably how the SYSCON knows exactly where the issue is in the BitTraining readout). It could also allow us to dump the EEPROM and run a debugger! So yeah, it's kinda a big deal!
Last edited:
How do I look for a short circut? Which setting do I use on the multimeter?
RIP-Felix
Senior Member
Set it to resistance, you should see this symbol...
Ω = Ohms
Touch your leads together (a short). The readout should be zero, but it might actually read some small resistance. Now probe your motherboard. If it reads 0, or the same as when you touch the leads together, then it's shorting.
EDIT:
Just a couple of beginner oriented videos to familiarize you with the basics...
Ω = Ohms
Touch your leads together (a short). The readout should be zero, but it might actually read some small resistance. Now probe your motherboard. If it reads 0, or the same as when you touch the leads together, then it's shorting.
EDIT:
Just a couple of beginner oriented videos to familiarize you with the basics...
Last edited:
Jeff The Animal
Forum Noob
Also, the normal result should be in Kohm range in the 12V line (3-5kohm)
marciolsf
Member
I'm late to the party because my alerts have stopped working again, but I must say, this is the most exciting thing I've read today! I was getting bit training errors on my cecha01, and I did notice a few things in the cok001 schematics that seem to indicate where those can be tied to physical connections. I was never able to track that down, but here goes @RIP-Felix again!
I used a cheap suction plucker thinking it had the force enough to pull it but I failed in the first time. Is there any guide about reballing? I have only found videos in youtube
marciolsf
Member
how interesting, I also have a 3034 and the exact same bit training error. Ive wondered before if there were specific "regions" within the BGA array that were more susceptible to failure than others. Of course, it would be hard to know unless we start collecting bit training codes as well as the power up failure code. Sure, one might argue what's the point since the fix is a reball anyway. But! If there's a common pattern, we might be able to isolate the true root cause.
RIP-Felix
Senior Member
RRAC is reffering to YC_RC_VDDIO (I think), which for both the CPU and RSX are the balls closest to the other chip. That makes sense to me because the heat from the CPU and RSX is greatest between them. So the balls closest to the center will experience the highest Delta T and fail the soonest.
marciolsf
Member
That does make sense... I remember speaking with @LSL early on, and he was able to get one of his a01's working by pushing on the top left corner of the RSX, nearest the CPU.
I also think you're on the right track as far as the relationship between the RRAC and YC_RC_VDDIO.... Pages 5, 6, 9 and 10 of the service manual make a lot more sense now, specially compared with the pinout mapping on the dev wiki you linked earlier.
We already knew the roles the tokins played, but going over pages 6 and 10, we can see exactly where those points in the cpu/rsx get their power from. Maybe that can provide additional troubleshooting points, based on whatever you're getting from the bit training error? (or maybe I'm making too much a deal out of this?)
Also, while looking through the schematics to help me organize my thoughts and put this post together, I see that page 10, right in the middle, details where the JTAG (RS_JTAG) is supposed to connect to. How is this different from what you guys were debating? Are these points not useful/usable?
EDIT: spelling
marciolsf
Member
Sorry if this is redundant or not helpful, but here's the points in the RSX where the jtag connectors are supposed to go (based on the service manual. pages 9 and 10)
CL2104 (RS_TMS) -> AR14 - (JTAG_TMS)
CL2102 (RS_TDO) -> AR16 (JTAG_TDO)
CL2103 (RS_TDI) -> AT16 (JTAG_TDI)
CL2106 (RS_TCK) -> AU13 (JTAG_TCK)
CL2105 (not labeled in page 10, but labeled as RS_TRSTNEG on page 9) -> AU15 - JTAG_TRST_N
Now, we don't know where these CL points are, but that last one (JTAG_TRST_N) is connected to R2153, and that is labeled and mapped on the schematic. I can't imagine the other points will be that far, once CL2105 is located.
Even if we find them all, they might still not be usable, as m4j0r has been saying. But at least if we can locate them it'd give us a start, I'd think.
CL2104 (RS_TMS) -> AR14 - (JTAG_TMS)
CL2102 (RS_TDO) -> AR16 (JTAG_TDO)
CL2103 (RS_TDI) -> AT16 (JTAG_TDI)
CL2106 (RS_TCK) -> AU13 (JTAG_TCK)
CL2105 (not labeled in page 10, but labeled as RS_TRSTNEG on page 9) -> AU15 - JTAG_TRST_N
Now, we don't know where these CL points are, but that last one (JTAG_TRST_N) is connected to R2153, and that is labeled and mapped on the schematic. I can't imagine the other points will be that far, once CL2105 is located.
Even if we find them all, they might still not be usable, as m4j0r has been saying. But at least if we can locate them it'd give us a start, I'd think.
RIP-Felix
Senior Member
Yeah, it sounds like the JTAG is probably a dead end, but at least we can enter that field in the wiki...lol! There is a Cell JTAG and SYSCON JTAG already documented, but not the RSX. The SYSCON JTAG is on the CN4009 service connector that was never populated. I'm sure one of the first thing people tried was to reconstitute the JTAG inteface and see if they could poke around. That's the first thing SONY would secure, so Like @M4j0r said, it's not going to be useful without proprietary software - even if we could enable it.
db260179
Member
The frustration of reballing, it took a few attempts but i got a good process to do it easily.
What i found to work the best is as follows:
1.Once you have removed the RSX from the board and its still hot, use flux and solder and with an iron clean around the ball layers, cleaning the solder iron when it builds up to much. This is where i go against the grain, instead of fully removal with solder braid, i just leave the layer of leveled solder on all of the balls points on the RSX.
I found that the ball layers on the RSX loose there ability to retain solder plates, then its game over!
Then with isoproprane clean the flux from the RSX - try to do this while its still warm as flux comes off easier than cold.
2.On to the reball process, In the end i use this - reballing stencil
https://www.aliexpress.com/item/100...exp_id=77fe4877-9cb1-4d47-95b9-275964614355-2
Use some flux and with your finger paste on the RSX ball layer, then put the RSX chip onto the stencil holder and put into the supplied crimp holder.
With a hot air gun put to the lowest air level (completely bottom 0)
Using a aluminuim box, with the ball size of 0.55mm (i found 0.6mm balls kept on joining) sprinkle over and with a flat tool or credit card slowly spread them across.
Then with a fine tweezers just put the balls that didnt go in.
3.In terms of heat, I found 200C was a good setting on the hot air gun, and just slowly, i mean really slowly move the hot air gun from top left to bottom left and then across to right then up, keep doing this until the solder balls become shiny.
Poke one of the balls to see if its melting, you can soon tell as they go shiny when melting.
Once happy, turn off hot air gun and leave to cool - VERY important!
Once cool use a flat head screw driver or flat blade to slowly prise the stencil off. Before this you can do a quick ball test to see if any are loose.
Hope this helps?
Similar threads
-
-
PS3 CECHA00 with several SYSCON errors (3004, 1001,1002, 2120,3011)
- Started by LSL
- Replies: 7
-
PS3 Interesting PS3 Errors (1802, 1701, 1601) and Capacitor Replacement- Started by Cheshire UK
- Replies: 2
-