PS3 Fault finding YLOD with the SYSCON - First steps and Error reporting

RIP-Felix · Aug 31, 2021

lordpaladimo said:
Could an error in the command to correct the checksum cause the problem?
Due to an error I executed EEP SET 3901 01 00 and the correct one was EEP SET 3961 01 00.

No reflow or reballing in this console.

Sorry for bad english!
Thanks in advance!

Yes that might be what got corrupted!

If you got it wrong and changed something that you shouldn't have, the ckecksum won't match and the console will issues 3 beeps the moment you flip the power rocker on, instead of going to standby. You'll have to fix the checksum before it'll boot. Which I assume you did to gain internal access the first time. However, you should only have needed to fix one checksum mismatch (the byte we changed at 3961 01). If you had 2 mismatches, then that means you got it wrong and corrupted something. If you're sure you changed 3901 01 to 00 then you need to put back the way it was. On my A model (COK-001)...

EEP GET 3901 01 --> 00000000 BF

First, auth back into external mode (unplug DIAG). Type in EEP GET 3901 01. If it reads 00, then you definitely changed it and need to change it back to what it was before. What model is your console? We shouldn't assume it's always BF. It is on COK-001. I checked an EEPROM dump from another COK-001...

...so it doesn't vary between consoles of the same model. But someone here will need to confirm what that bit is supposed to be on the same model you have to be sure what it's supposed to be. In terms of Hexadecimals, B = 1011 in binary and F = 1111. Address 3900 has 16 bytes, 15/16 offsets are FF (1111 1111), except offset 01, where it's supposed to be BF (1011 1111). Each hexadecimal pair is a Byte. It contains 8 bits of Binary. That's not really relevant, it just clicked for me seeing it spelled out like this. Anyway, if you changed the hexadecimal "byte" to 00, then it would become (0000 0000). That would definately screw something up!

If you have a COK-001 then all you need to do is execute command EEP SET 3901 01 BF. Then confirm EEP GET 3901 01 returns 00000000 BF. Flip PWR rocker off, ground the Diag wire, and flip PWR rocker on. You should hear 3 beeps because the checksum doesn't match. AUTH into internal mode now. You'll have to fix the checksum again. This time maybe it'll work.

Bbowes9 · Sep 1, 2021

Hi! I recently did a delid on both the RSX and the CPU of a WORKING A01 board. the RSX came off no problem and the CPU was a little more tough as always, but I know for fact I didn't scratch anywhere on the chip. Now after I reapplied paste and gave it a shot at turning on I almost instantly got a YLOD. So I turned to the syscon error logs and saw I was getting a error of A0313032. I also took a look at the bringup command and will post the results. All help his appreciated, I'm not sure what the error could be pointing to!

Bbowes9 · Sep 1, 2021

RIP-Felix · Sep 1, 2021

Bbowes9 said:

Did you loose any of the SMD's around the chip? They can be easy to knock off if you slip while delidding. I noticed one resistor that's a bit at an angle, but it might be just the way it flowed. I had a look at the schematic and it looks important (Goes to pin 23 of the clock generator. CLK1N. Which is the "Complementary side of open drain differential clock output. This open drain output needs an external resistor network." That's the wonky resistor and it's 3 brothers).

EDIT: That's 1.2v VDDIO. It may generate error 3032. I'm curious to see if that resistor is the cause, because we haven't previously characterized that error. It it is caused by a VDDIO PWR fail, that's useful to know. That whole section of errors is a bit of an unknown, but I suspect it's reserved for the various power's to the CPU/GPU. But unless we intentionally sabotage systematically to see what error it produces, we have to guess and wait..

Bbowes9 · Sep 1, 2021

RIP-Felix said:
Did you loose any of the SMD's around the chip? They can be easy to knock off if you slip while delidding. I noticed one resistor that's a bit at an angle, but it might be just the way it flowed. I had a look at the schematic and it looks important (Goes to pin 23 of the clock generator. CLK1N. Which is the "Complementary side of open drain differential clock output. This open drain output needs an external resistor network." That's the wonky resistor and it's 3 brothers).
View attachment 34783

sure enough that exact one you pointed out came off its contact, ill reattatch it and give an update (its hanging on by one point i got lucky)

lordpaladimo · Sep 1, 2021

RIP-Felix said:
Yes that might be what got corrupted!

If you got it wrong and changed something that you shouldn't have, the ckecksum won't match and the console will issues 3 beeps the moment you flip the power rocker on, instead of going to standby. You'll have to fix the checksum before it'll boot. Which I assume you did to gain internal access the first time. However, you should only have needed to fix one checksum mismatch (the byte we changed at 3961 01). If you had 2 mismatches, then that means you got it wrong and corrupted something. If you're sure you changed 3901 01 to 00 then you need to put back the way it was. On my A model (COK-001)...

EEP GET 3901 01 --> 00000000 BF

First, auth back into external mode (unplug DIAG). Type in EEP GET 3901 01. If it reads 00, then you definitely changed it and need to change it back to what it was before. What model is your console? We shouldn't assume it's always BF. It is on COK-001. I checked an EEPROM dump from another COK-001...View attachment 34774 ...so it doesn't vary between consoles of the same model. But someone here will need to confirm what that bit is supposed to be on the same model you have to be sure what it's supposed to be. In terms of Hexadecimals, B = 1011 in binary and F = 1111. Address 3900 has 16 bytes, 15/16 offsets are FF (1111 1111), except offset 01, where it's supposed to be BF (1011 1111). Each hexadecimal pair is a Byte. It contains 8 bits of Binary. That's not really relevant, it just clicked for me seeing it spelled out like this. Anyway, if you changed the hexadecimal "byte" to 00, then it would become (0000 0000). That would definately screw something up!

If you have a COK-001 then all you need to do is execute command EEP SET 3901 01 BF. Then confirm EEP GET 3901 01 returns 00000000 BF. Flip PWR rocker off, ground the Diag wire, and flip PWR rocker on. You should hear 3 beeps because the checksum doesn't match. AUTH into internal mode now. You'll have to fix the checksum again. This time maybe it'll work.

Rip-felix, Thx for help!

I executed the wrong command to go to internal mode. I don't remember, it was something like EEP SET 3901 01 00 or EEP SET 3691 01 00.
This command not return any errors.

Then I saw that I executed the wrong command and executed the right command: EEP SET 3961 01 00.

After that I did the whole procedure of correcting checksum and everything worked perfectly. Using diag on gnd, I went into internal mode and did all the tests.

I can turn on the console by the bringup command or the power button. The console also shuts down if I press the power button for 10 seconds.
My doubt is if the command I executed wrong spoiled something in the EEPROM that is preventing the console from booting. Is there any way I can check with another EEPROM and make the correction? My board is a COK-002.

Bbowes9 · Sep 1, 2021

A little update to this,

Bbowes9 said:
sure enough that exact one you pointed out came off its contact, ill reattatch it and give an update (its hanging on by one point i got lucky)

An update to this: I re-attached the resistor and seemed to still have the YLOD as before. I checked all around the CELL to make sure I didn't knock anything else off but can't seem to find anything.

edit: I'm getting two new codes for 2101 and 3034. I'm familiar with 3034 being the rsx but unfamiliar with the 2101. It's very possible the resistor could be the 3032 error like I had before.

SkaziChris · Sep 2, 2021

Hello everyone,

PS3 FAT, VER-001
Syscon: SW-301 (c) 2008
GPU: CXD2991EGB
CPU: CXD2990AGB

Condition:
Not starting up.
Three beeps + red diode blinking.
BT/WLAN logic board ripped off from mobo.

Done:
CPU & RSX IHS delid done.

ToDo:
Voltage measurements...

Syscon diag info:

Code:

> AUTH
Auth successful

> version
00000000
# Sherwood Version = 0.17.0


> eepcsum
00000000
# csum = 0xE083

> becount
F0000003
# [UCMD] Unknown command.

> BECOUNT
F0000003
# [UCMD] Unknown command.

> bringup
00000000
# [SSM] Bringup Start.
# [SSM] PS0 ok.
# [SSM] PS1 ok.
# [SSM] PS2 ok.

> shutdown
00000000
# [PowSeq] Error:9103
# [SSM] PS3 ng.
# [SSM] Cond/Fatal received, msg=24D0.
# [SSM] Fataldown Start.
# [SSM] Fataldown ok.
# (PowerOff State) (Fatal)
NG E00000E0
# [SSM] Clearfatal Start.
# [SSM] Clearfatal ok.
# (PowerOff State)


> bestat
00000000
# (PowerOff State)
# State = 00

> bsn
F0000003
# [UCMD] Unknown command.

> xdrdiag info
F0000003
# [UCMD] Unknown command.

> xdrdiag start
F0000003
# [UCMD] Unknown command.

> xiodiag
F0000003
# [UCMD] Unknown command.

> fandiag
F0000003
# [UCMD] Unknown command.

> csum
F0000006

> errlog
00000000
# CODE     CLOCK
# A0403034 FFFFFFFF
# A0404002 FFFFFFFF
# A0403034 FFFFFFFF
# A0404002 FFFFFFFF
# A0403034 FFFFFFFF
# A0404002 FFFFFFFF
# A0403034 FFFFFFFF
# A0404002 FFFFFFFF
# A0403034 FFFFFFFF
# A0404002 FFFFFFFF
# A0403034 FFFFFFFF
# A0404002 FFFFFFFF
# A0403034 FFFFFFFF
# A0404002 FFFFFFFF
# A0403034 FFFFFFFF
# A0404102 FFFFFFFF
# A0403034 FFFFFFFF
# A0404102 FFFFFFFF
# A0403034 FFFFFFFF
# A0404102 FFFFFFFF
# A0403034 FFFFFFFF
# A0404411 FFFFFFFF
# A0403034 FFFFFFFF
# A0404411 FFFFFFFF
# A0403034 FFFFFFFF
# A0404411 FFFFFFFF
# A0403034 FFFFFFFF
# A0404411 FFFFFFFF
# A0403034 FFFFFFFF
# A0404411 FFFFFFFF
# A0403034 FFFFFFFF

Assumptions:
Based on https://github.com/db260179/ps3syscon
A0403034, A0404402,A0404411 = Poor BGA solder connections for RSX ( you will see errors like - [POWERSEQ] Error : BitTraining RSX:RRAC:RX0:GLOBAL1:RX_STATUS )

... but I do not have that message:
"[POWERSEQ] Error : BitTraining RSX:RRAC:RX0:GLOBAL1:RX_STATUS"

Also, I see that the bringup sequence seems to be ok?

> bringup
00000000
# [SSM] Bringup Start.
# [SSM] PS0 ok.
# [SSM] PS1 ok.
# [SSM] PS2 ok.

Therefore, is it really due to bad BGA under RSX, or not?
Am I getting this right, that PS0, PS1, and PS2 would be the boot sequence stages?

RIP-Felix · Sep 2, 2021

lordpaladimo said:
My doubt is if the command I executed wrong spoiled something in the EEPROM that is preventing the console from booting. Is there any way I can check with another EEPROM and make the correction? My board is a COK-002.

I just confirmed with a stock COK-002 that has never been opened before...

Code:

>$ EEP GET 3901 01
00000000 BF

So yeah, execute EEP SET 3901 01 BF, log back into internal access mode to fix the checksum, and see if that was the problem.

Bbowes9 · Sep 2, 2021

a little sad to say but, i took a look at the RSX again and noticed a VERY small knick in the pcb, so i looked at it under a microscope and it looks like it could be a problem but im not sure.

RIP-Felix · Sep 2, 2021

SkaziChris said:
Hello everyone,

PS3 FAT, VER-001
Syscon: SW-301 (c) 2008
GPU: CXD2991EGB
CPU: CXD2990AGB

Condition:
Not starting up.
Three beeps + red diode blinking.
BT/WLAN logic board ripped off from mobo.

Done:
CPU & RSX IHS delid done.

ToDo:
Voltage measurements...

Syscon diag info:

Code:

> AUTH Auth successful > version 00000000 # Sherwood Version = 0.17.0 > eepcsum 00000000 # csum = 0xE083 > becount F0000003 # [UCMD] Unknown command. > BECOUNT F0000003 # [UCMD] Unknown command. > bringup 00000000 # [SSM] Bringup Start. # [SSM] PS0 ok. # [SSM] PS1 ok. # [SSM] PS2 ok. > shutdown 00000000 # [PowSeq] Error:9103 # [SSM] PS3 ng. # [SSM] Cond/Fatal received, msg=24D0. # [SSM] Fataldown Start. # [SSM] Fataldown ok. # (PowerOff State) (Fatal) NG E00000E0 # [SSM] Clearfatal Start. # [SSM] Clearfatal ok. # (PowerOff State) > bestat 00000000 # (PowerOff State) # State = 00 > bsn F0000003 # [UCMD] Unknown command. > xdrdiag info F0000003 # [UCMD] Unknown command. > xdrdiag start F0000003 # [UCMD] Unknown command. > xiodiag F0000003 # [UCMD] Unknown command. > fandiag F0000003 # [UCMD] Unknown command. > csum F0000006 > errlog 00000000 # CODE CLOCK # A0403034 FFFFFFFF # A0404002 FFFFFFFF # A0403034 FFFFFFFF # A0404002 FFFFFFFF # A0403034 FFFFFFFF # A0404002 FFFFFFFF # A0403034 FFFFFFFF # A0404002 FFFFFFFF # A0403034 FFFFFFFF # A0404002 FFFFFFFF # A0403034 FFFFFFFF # A0404002 FFFFFFFF # A0403034 FFFFFFFF # A0404002 FFFFFFFF # A0403034 FFFFFFFF # A0404102 FFFFFFFF # A0403034 FFFFFFFF # A0404102 FFFFFFFF # A0403034 FFFFFFFF # A0404102 FFFFFFFF # A0403034 FFFFFFFF # A0404411 FFFFFFFF # A0403034 FFFFFFFF # A0404411 FFFFFFFF # A0403034 FFFFFFFF # A0404411 FFFFFFFF # A0403034 FFFFFFFF # A0404411 FFFFFFFF # A0403034 FFFFFFFF # A0404411 FFFFFFFF # A0403034 FFFFFFFF

Assumptions:
Based on https://github.com/db260179/ps3syscon
A0403034, A0404402,A0404411 = Poor BGA solder connections for RSX ( you will see errors like - [POWERSEQ] Error : BitTraining RSX:RRAC:RX0:GLOBAL1:RX_STATUS )

... but I do not have that message:
"[POWERSEQ] Error : BitTraining RSX:RRAC:RX0:GLOBAL1:RX_STATUS"

Also, I see that the bringup sequence seems to be ok?

> bringup
00000000
# [SSM] Bringup Start.
# [SSM] PS0 ok.
# [SSM] PS1 ok.
# [SSM] PS2 ok.

Therefore, is it really due to bad BGA under RSX, or not?
Am I getting this right, that PS0, PS1, and PS2 would be the boot sequence stages?

When you execute bringup it'll start the console and error. The log will stop, but there is more information not displayed. Press enter and it'll display it. That's usually where the BitTraining part is.

Also note that the Sherwood power sequence is different than Mullion SYSCON's. First, not all 3034's have an associated BitTrainbing error. Second, the error you're getting has the same step number of the power on sequence as the rest of the 3034's we associate with RSX issues requiring a reball (40 3034). 40 is before the power sequence is finished. So while Sherwood bringup messegs are different, you can't rule the BGA out.

RIP-Felix · Sep 2, 2021

Bbowes9 said:
A little update to this,

An update to this: I re-attached the resistor and seemed to still have the YLOD as before. I checked all around the CELL to make sure I didn't knock anything else off but can't seem to find anything.

edit: I'm getting two new codes for 2101 and 3034. I'm familiar with 3034 being the rsx but unfamiliar with the 2101. It's very possible the resistor could be the 3032 error like I had before.

Time for console history/detective work. Please post powerstate, errlog, becount, and bringup. For bringup, hit enter...wait for YLOD and the log to stop...then hit enter again to see the rest of the log. These will help to piece together the console's history. Also, what work have you done on the console and what equipment do you have? Eg, a POS radioshack soldering iron or a good temperature controlled one? If the latter, what temp was it set to when you reattached the resistor?

The way your errors changed is interesting. Can you measure the resistance of those four resistors please? I'm curious if the one that got knocked is changed compared to the other one. These are 1% resistors, because their value sets an important voltage. When you use an iron to reattach a resistor you can burn it out of spec. Or the knock that had it hanging on by a thread might have done it. If the resistance is off significantly it could now see the VDDIO signal, but not have the right voltage. I have suspected that error 3034 is a VDDIO power failure. BGA defects on the RX/TX lines between the CPU/GPU, which are powered by VDDIO, are the usual cause of the 3034. However, there's a remote possibility that your 3032 became a 3034 because the resistance changed and VDDIO was affected.

However, if the errorlog shows a history of 3034's, then the current 3034 might predate the resistor that got knocked. In other words, we fixed the 3032 to reveal a 3034 that was already there. I know you said the console was working before deliding, but you didn't say if the console was sealed! As in, having never been worked on before. People do all kind of shady repairs and you may have receive one that had a false positive repair (heat gun trick or some such nonsense)! IDK, you didn't give us any details that could rule out previous shoddy work.

RIP-Felix · Sep 2, 2021

Bbowes9 said:
a little sad to say but, i took a look at the RSX again and noticed a VERY small knick in the pcb, so i looked at it under a microscope and it looks like it could be a problem but im not sure.

You'll get a BitTraining error during bringup if that nick caused a break in the RX/TX FlexIO lines (that's what those traces are). It looks like a surface scratch on the solder mask above TX1, not deep enough to bridge/break the copper. But if there is a BitTraining error that specifies RSX:TX1 or BE:RX1, then that's a real possibility. Clean it off with some IPA and inspect closer under the scope. Hopefully it's just the mask.

Bbowes9 · Sep 2, 2021

RIP-Felix said:
Time for console history/detective work. Please post powerstate, errlog, becount, and bringup. For bringup, hit enter...wait for YLOD and the log to stop...then hit enter again to see the rest of the log. These will help to piece together the console's history. Also, what work have you done on the console and what equipment do you have? Eg, a POS radioshack soldering iron or a good temperature controlled one? If the latter, what temp was it set to when you reattached the resistor?

The way your errors changed is interesting. Can you measure the resistance of those four resistors please? I'm curious if the one that got knocked is changed compared to the other one. These are 1% resistors, because their value sets an important voltage. When you use an iron to reattach a resistor you can burn it out of spec. Or the knock that had it hanging on by a thread might have don it. If the resistance is off significantly it could now see the VDDIO signal, but not have the right voltage. I have suspected that error 3034 is a VDDIO power failure. BGA defects on the RX/TX lines between the CPU/GPU, which are powered by VDDIO, are the usual cause of the 3034. However, there's a remote possability that your 3032 became a 3034 because the resistance changed and VDDIO was affected.

However, if the errorlog shows a history of 3034's, then the current 3034 might predate the resistor that got knocked. In other words, we fixed the 3032 to reveal a 3034 that was alread there. I know you said the console was working before deliding, but you didn't say if the console was sealed! As in, having never been worked on before. People do all kind of shady repairs and you may have recieve one. IDK, you didn't give us any details that could rule out previous shoddy work.

i will say the console was in fact sealed before opening it, no history of being worked on. i checked errorlogs beforehand and the only errors were that 3032 we were getting before.

I use a controlled heat soldering iron with various tips, and also have flux, a microscope, and a hot air station. The only work i have done on the console is the delid itself.

as for those 4 resistors, the 2 top resistors measure around 51.2 ohms while the bottom 2 measure 59.4 ohms so im assuming those are okay.

i took a look at both the bringup command and cleaned the spot up and took another picture under the microscope. needless to say it doesnt look to good.

Code:

bringup
[SSM] state: 0000 -> 0101
Bringup Mode #0 (0xFF)
[SSM] ssmCb_OnStartingBePowOn() called.
[SSM] First Boot.
[SSM] Bringup mode : syspm_stat=00000000/00000000
[POWSEQ] PowerSeq_Setup called.
[SSM] state: 0101 -> 0201
[POWSEQ] AV Backend Setup
[SSM] state: 0201 -> 0102
[SSM] state: 0102 -> 0202
[SSM] state: 0202 -> 0103
[SSM] state: 0103 -> 0203
[SSM] ssmCb_BeforeBeOn() called.
[SSM] state: 0203 -> 0104
Psbd_SbTransMode_Half:0x20e2
[POWERSEQ] Error : BitTraining BE:RRAC:BX0:BX:FLEXIO_ID
[SSM] state: 0104 -> 0304
[SSM] ssmCb_AfterBeOn2() called.
[SSM] PowSeq Fail : Detected !
[SSM] state: 0304 -> 0700
[POWSEQ] AV Backend Letup
[SSM] Shutdown mode : syspm_stat=00000000/00000000
[ERROR]: 0xa0402101
[ERROR]: 0xa0403034

SkaziChris · Sep 2, 2021

RIP-Felix said:
When you execute bringup it'll start the console and error. The log will stop, but there is more information not displayed. Press enter and it'll display it. That's usually where the BitTraining part is.

Also note that the Sherwood power sequence is different than Mullion SYSCON's. First, not all 3034's have an associated BitTrainbing error. Second, the error you're getting has the same step number of the power on sequence as the rest of the 3034's we associate with RSX issues requiring a reball (40 3034). 40 is before the power sequence is finished. So while Sherwood bringup messegs are different, you can't rule the BGA out.

Thank you for your reply - especially the "blank enter" part!

So here is how it looks - no bittraining error, but definitely a power sequence error...:

Code:

> AUTH
Auth successful
> bringup
00000000
# [SSM] Bringup Start.
# [SSM] PS0 ok.
# [SSM] PS1 ok.
# [SSM] PS2 ok.

>
F0000003
# [PowSeq] Error:9103
# [SSM] PS3 ng.
# [SSM] Cond/Fatal received, msg=24D0.
# [SSM] Fataldown Start.
# [SSM] Fataldown ok.
# (PowerOff State) (Fatal)
NG E00000E0
# [UCMD] Unknown command.

> errlog
00000000
# CODE     CLOCK
# A0403034 FFFFFFFF
# A0404002 FFFFFFFF
# A0403034 FFFFFFFF
# A0404002 FFFFFFFF
# A0403034 FFFFFFFF
# A0404002 FFFFFFFF
# A0403034 FFFFFFFF
# A0404002 FFFFFFFF
# A0403034 FFFFFFFF
# A0404002 FFFFFFFF
# A0403034 FFFFFFFF
# A0404002 FFFFFFFF
# A0403034 FFFFFFFF
# A0404002 FFFFFFFF
# A0403034 FFFFFFFF
# A0404002 FFFFFFFF
# A0403034 FFFFFFFF
# A0404102 FFFFFFFF
# A0403034 FFFFFFFF
# A0404102 FFFFFFFF
# A0403034 FFFFFFFF
# A0404102 FFFFFFFF
# A0403034 FFFFFFFF
# A0404411 FFFFFFFF
# A0403034 FFFFFFFF
# A0404411 FFFFFFFF
# A0403034 FFFFFFFF
# A0404411 FFFFFFFF
# A0403034 FFFFFFFF
# A0404411 FFFFFFFF
# A0403034 FFFFFFFF

> shutdown
00000000
# [SSM] Clearfatal Start.
# [SSM] Clearfatal ok.
# (PowerOff State)

> errpt
F0000003
# [UCMD] Unknown command.

> eepcsum
00000000
# csum = 0xE083

So,
A0404002 = RSX_SPI DI/DO ERROR
A0404102 + A0403034 = Poor BGA solder connections for RSX
A0404411 = ERROR ON RSX SPI (?)

Also, bits 1 and 2 are not shorted between CPU/RSX data rail.

More testing tomorrow...

I can also test some DIA-002 without RSX, and a couple of SEM-001.
Maybe I can find some ps3 slim mobos too.

RIP-Felix · Sep 2, 2021

Yeah, the resistors are fine. That's not it.

Okay, that story is consistent with a console that hadn't ever experienced an error before. I would still like to know the becount as that could give us an idea of how much time the console has been on and how it was used (eg, data center vs home user). It's not super relevent to this repair, but I'm recording these to get an average amount of use before YLOD. I need systems that haven't experience one (naturally) too. So far I estimate between 150-300 days. And no one posts about working consoles.

Here is the RSX substrate damage. I just tweaked the contrast and reduced the noise a bit.

It looks like the tool you used broke through the copper layer and exposed the FR-4 glass reinforced epoxy laminate beneath. Don't feel bad, I've nicked it before. I guess I was lucky I didn't destroy a trace. It took me a few times before I found a butter knife with the right amount of rigidity and bluntness to work. And a thick business card. @NSC-Modz method is safer. He cuts between the IHS/RAM using a razor blade. But this works too, if you use the right tool. It is nerve racking every time I do it, though...but I digress.

It looks like part of the trace is intact. I can't tell exactly, but I think the copper GND/trace were smashed together. If you can cut along the edge of the trace (easier said than done given how small we're talking about), then you might be able to restore separation. Or you could just replace the RSX with a 40nm RSX using the ORBIS mod chip and Frankenstein that monster.

Bbowes9 · Sep 2, 2021

RIP-Felix said:
Yeah, the resistors are fine. That's not it.

Okay, that story is consistant with a console that hadn't ever experienced an error before. I would still like to know the becount as that could give us an idea of how much time the console has been on and how it was used (eg, data center vs home user). It's not super relevent to this repair, but I'm recording these to get an average amount of use before YLOD. I need systems that haven't experiance one (naturally) too. So far I estimate between 100-150 days. And no one posts about working consoles.

Here is the RSX substrate damage. I just tweaked the contrast and reduced the noise a bit.
View attachment 34794
It looks like the tool you used broke through the copper layer and exposed the FR-4 glass reinforced epoxy laminate beneath. Don't feel bad, I've nicked it before. I guess I was lucky I didn't destroy a trace. It took me a few times before I found a butter knife with the right amount of rigidity and bluntness to work. And a thick business card. @NSC-Modz method is safer. He cuts between the IHS/RAM using a razor blade. But this works too, if you use the right tool. It is nerve racking every time I do it, though...but I digress.

It looks like part of the trace is intact. I can't tell exactly, but I think the copper GND/trace were smashed together. If you can cut along the edge of the trace (easier said than done given how small we're talking about), then you might be able to restore separation. Or you could just replace the RSX with a 40nm RSX using the ORBIS mod chip and Frankenstein that monster.

well interestingly enough, i believe i was able to get that knick back where it was supposed to be, as both those errors are now gone and replaced with a 3031 now. this is sure getting interesting.

as for the becount, here that is.

Code:

>$ becount
becount
Bringup : 921 times
Shutdown: 77 times
Power-on: 1day 21hour 36min 31sec

edit: here is the bringup command:

Code:

bringup
[SSM] state: 0000 -> 0101
Bringup Mode #0 (0xFF)
[SSM] ssmCb_OnStartingBePowOn() called.
[SSM] Bringup mode : syspm_stat=00000000/00000000
[POWSEQ] PowerSeq_Setup called.
[SSM] state: 0101 -> 0201
[POWSEQ] AV Backend Setup
[SSM] state: 0201 -> 0102
[SSM] state: 0102 -> 0202
[SSM] state: 0202 -> 0103
[SSM] state: 0103 -> 0203
[SSM] ssmCb_BeforeBeOn() called.
[SSM] state: 0203 -> 0104
[SSM] state: 0104 -> 0304
[SSM] ssmCb_AfterBeOn2() called.
[SSM] PowSeq Fail : Detected !
[SSM] state: 0304 -> 0700
[POWSEQ] AV Backend Letup
[SSM] Shutdown mode : syspm_stat=00000000/00000000
[ERROR]: 0xa0313031

RIP-Felix · Sep 2, 2021

Bbowes9 said:
well interestingly enough, i believe i was able to get that knick back where it was supposed to be, as both those errors are now gone and replaced with a 3031 now. this is sure getting interesting.

as for the becount, here that is.

Code:

>$ becount becount Bringup : 921 times Shutdown: 77 times Power-on: 1day 21hour 36min 31sec

edit: here is the bringup command:

Code:

bringup [SSM] state: 0000 -> 0101 Bringup Mode #0 (0xFF) [SSM] ssmCb_OnStartingBePowOn() called. [SSM] Bringup mode : syspm_stat=00000000/00000000 [POWSEQ] PowerSeq_Setup called. [SSM] state: 0101 -> 0201 [POWSEQ] AV Backend Setup [SSM] state: 0201 -> 0102 [SSM] state: 0102 -> 0202 [SSM] state: 0202 -> 0103 [SSM] state: 0103 -> 0203 [SSM] ssmCb_BeforeBeOn() called. [SSM] state: 0203 -> 0104 [SSM] state: 0104 -> 0304 [SSM] ssmCb_AfterBeOn2() called. [SSM] PowSeq Fail : Detected ! [SSM] state: 0304 -> 0700 [POWSEQ] AV Backend Letup [SSM] Shutdown mode : syspm_stat=00000000/00000000 [ERROR]: 0xa0313031

Yikes!

This console is starting to get annoying.

About becount. The difference between bringups and shutdowns suggest it started life as a data cruncher. Based on what I've seen 921 brignups is low. So that's consistent with a console that should still have a good BGA.

I hadn't seen a 3032 before, and now we have another new one. Interesting it's a 3031. I wonder if it being so close is significant.

Well, I think your going to have to start probing resistances and voltages. Inspect thoroughly and clean really good too.

vyktormvmpay25 · Sep 2, 2021

SkaziChris said:
Hello everyone,

PS3 FAT, VER-001
Syscon: SW-301 (c) 2008
GPU: CXD2991EGB
CPU: CXD2990AGB

Condition:
Not starting up.
Three beeps + red diode blinking.
BT/WLAN logic board ripped off from mobo.

Done:
CPU & RSX IHS delid done.

ToDo:
Voltage measurements...

Syscon diag info:

Code:

> AUTH Auth successful > version 00000000 # Sherwood Version = 0.17.0 > eepcsum 00000000 # csum = 0xE083 > becount F0000003 # [UCMD] Unknown command. > BECOUNT F0000003 # [UCMD] Unknown command. > bringup 00000000 # [SSM] Bringup Start. # [SSM] PS0 ok. # [SSM] PS1 ok. # [SSM] PS2 ok. > shutdown 00000000 # [PowSeq] Error:9103 # [SSM] PS3 ng. # [SSM] Cond/Fatal received, msg=24D0. # [SSM] Fataldown Start. # [SSM] Fataldown ok. # (PowerOff State) (Fatal) NG E00000E0 # [SSM] Clearfatal Start. # [SSM] Clearfatal ok. # (PowerOff State) > bestat 00000000 # (PowerOff State) # State = 00 > bsn F0000003 # [UCMD] Unknown command. > xdrdiag info F0000003 # [UCMD] Unknown command. > xdrdiag start F0000003 # [UCMD] Unknown command. > xiodiag F0000003 # [UCMD] Unknown command. > fandiag F0000003 # [UCMD] Unknown command. > csum F0000006 > errlog 00000000 # CODE CLOCK # A0403034 FFFFFFFF # A0404002 FFFFFFFF # A0403034 FFFFFFFF # A0404002 FFFFFFFF # A0403034 FFFFFFFF # A0404002 FFFFFFFF # A0403034 FFFFFFFF # A0404002 FFFFFFFF # A0403034 FFFFFFFF # A0404002 FFFFFFFF # A0403034 FFFFFFFF # A0404002 FFFFFFFF # A0403034 FFFFFFFF # A0404002 FFFFFFFF # A0403034 FFFFFFFF # A0404102 FFFFFFFF # A0403034 FFFFFFFF # A0404102 FFFFFFFF # A0403034 FFFFFFFF # A0404102 FFFFFFFF # A0403034 FFFFFFFF # A0404411 FFFFFFFF # A0403034 FFFFFFFF # A0404411 FFFFFFFF # A0403034 FFFFFFFF # A0404411 FFFFFFFF # A0403034 FFFFFFFF # A0404411 FFFFFFFF # A0403034 FFFFFFFF # A0404411 FFFFFFFF # A0403034 FFFFFFFF

Assumptions:
Based on https://github.com/db260179/ps3syscon
A0403034, A0404402,A0404411 = Poor BGA solder connections for RSX ( you will see errors like - [POWERSEQ] Error : BitTraining RSX:RRAC:RX0:GLOBAL1:RX_STATUS )

... but I do not have that message:
"[POWERSEQ] Error : BitTraining RSX:RRAC:RX0:GLOBAL1:RX_STATUS"

Also, I see that the bringup sequence seems to be ok?

> bringup
00000000
# [SSM] Bringup Start.
# [SSM] PS0 ok.
# [SSM] PS1 ok.
# [SSM] PS2 ok.

Therefore, is it really due to bad BGA under RSX, or not?
Am I getting this right, that PS0, PS1, and PS2 would be the boot sequence stages?

Ps0/1/2/3/4 are power stages. You missing PS3/4 that I assume is power for rsx side.
Edit
Can you please tell all points of resistance beside rsx as reference
http://s.go.ro/ax49drsu
First thing find some schematic on link then simple add
VDDC, fbvddq, vddio, vddr, yc-vddra, yc-vddio.
Use photo attached as reference.

This photo is to understand power lines, may get different values or very low under 2 ohms at some point, vddc is lower than anything. Reply with values.

Bbowes9 · Sep 2, 2021

RIP-Felix said:
Yikes!

This console is starting to get annoying.

About becount. The difference between bringups and shutdowns suggest it started life as a data cruncher. Based on what I've seen 921 brignups is low. So that's consistent with a console that should still have a good BGA.

I hadn't seen a 3032 before, and now we have another new one. Interesting it's a 3031. I wonder if it being so close is significant.

Well, I think your going to have to start probing resistances and voltages. Inspect thoroughly and clean really good too.

yeah im right there with you, it is getting annoying. i can say for certain the trace is fine on the RSX as ill show you in this post. im currently looking at if i knocked off another component by chance.

PS3 Fault finding YLOD with the SYSCON - First steps and Error reporting

Senior Member

Member

Member

Senior Member

Member

Forum Noob

Member

Member

Senior Member

Member

Senior Member

Senior Member

Senior Member

Member

Member

Senior Member

Member

Senior Member

Senior Member

Member

Similar threads