PS3 Fault finding YLOD with the SYSCON - First steps and Error reporting

[N3Star]

I already have reflown it 2 times, well to be honest first time I soldered it I slightly knocked it while the solder was still melted and it shifted. One hour of way too excessive cursing on my clumsiness later I have reballed it and then reflown it again (reflow was after 3034).
Now that I think of it I did the 65nm with slightly smaller thermocouple, that was able to go under the substrate; the one I have now cannot do that, at least with lead-free solder. I probably have reworked it with new one being under the RX/TX pins - my TC needs to be on the back left side, closer to CELL, that might have messed things up. Pads on that mobo are probably begging me to stop reworking it, but I have to try again, at least BE is still at ~3ohms.

Also, kind of a off-top question, but do You guys rework RSX with IHS still on top of it? I tried delidding 40nm GPU when it was already delsoldered and I had to leave it on, because I couldn't even stick anything between RAMs and IHS. Even after soldering it delid was an absolute nightmare compared to 65/90nm RSXs.

Well, today I took off the RSX aaaand... one of Nx or Px solder balls was just missing. I just hope that's the only thing wrong with it, mobo besides these little resistors on which RSX sits looks like new, looks promising so far.

 

[RIP-Felix]

I'm pleased to see everyone is using the syscon codes and diagnosing their problems. This is encouraging to see! I was able to ready your posts and just agree with your analysis. That's refreshing!

 

[RIP-Felix]

Edit : Ok I found what's wrong with the PS3... I'm sad to see that:

RSX was glued too... No scratches

That's BS man!

I too got a CPU delid damaged CPU from a YLOD console I bought off ebay (PS3 #11). Seller didn't disclose that! They just blobbed solder mask over the scratched traces, slapped the thing together and sold it "as is." It wen't down the Frankenstein path on this console and am pretty confident in the 40nm RSX install, but the CPU is borked.

I do have a good CPU on a board that has destroyed RSX BGA pads. So I might try my hand at a chipset swap. I can salvage the CELL, SYSCON, and NAND from the donor and transplant them in to PS3 #11. That's the complete married chipset. If the reballs and QFP soldering goes well, it should work. It's just a PITA and most techs call it a day if they have to go to such lengths to revive a console.

 

[N3Star]

This board is a REAL pain. This time:
[SSM] state: 0000 -> 0101
Bringup Mode #0 (0xFF)
[SSM] ssmCb_OnStartingBePowOn() called.
[SSM] First Boot.
[SSM] Bringup mode : syspm_stat=00000000/00000000
[POWSEQ] PowerSeq_Setup called.
[SSM] state: 0101 -> 0201
[POWSEQ] AV Backend Setup
[SSM] state: 0201 -> 0102
[SSM] state: 0102 -> 0202
[SSM] state: 0202 -> 0103
[SSM] state: 0103 -> 0203
[SSM] ssmCb_BeforeBeOn() called.
[SSM] state: 0203 -> 0104
>$
Psbd_SbTransMode_Half:0x21e2
[POWERSEQ] Error : BitTraining RSX:RRAC:RX3:GLOBAL1:RX_STATUS
[SSM] state: 0104 -> 0304
[SSM] ssmCb_AfterBeOn2() called.
[SSM] PowSeq Fail : Detected !
[SSM] state: 0304 -> 0700
[POWSEQ] AV Backend Letup
[SSM] Shutdown mode : syspm_stat=00000000/00000000
[ERROR]: 0xa0404432
[ERROR]: 0xa0403034
[POWSEQ] PowerSeq_Letup called.
[SSM] state: 0700 -> 0600
(PowerOff State) (Fatal)

Really.
You've got to be kidding me.
This RSX is dead after my delid, really small scratch that I thought was just soldermask.

 

[RIP-Felix]

Really.

You've got to be kidding me.
This RSX is dead after my delid, really small scratch that I thought was just soldermask.

Unfortunately the only place to fit a tool under the RSX to pry the IHS off is directly overtop the SPI lines connecting the RSX/CELL. And RX3 is right there in the middle.

When I first delidded an RSX I used a flathead screw driver. I placed a business card underneath to try an protect the substrate, but the screwdriver dug through the card and into the RSX. I lucked out and missed any traces, but ever since I've used a butter knife. It's my special butter knife. Has a rounded tip, not those pointy serrated tips. It's blunt/rounded on both edges, so it can't dig in. And it's just thin enough to fit underneath with a business card, but thick enought to have prying force without bending.

Honestly, the RSX is the hardest to delid. I really don't reccomend it.

 

[N3Star]

Unfortunately the only place to fit a tool under the RSX to pry the IHS off is directly overtop the SPI lines connecting the RSX/CELL. And RX3 is right there in the middle.

When I first delidded an RSX I used a flathead screw driver. I placed a business card underneath to try an protect the substrate, but the screwdriver dug through the card and into the RSX. I lucked out and missed any traces, but ever since I've used a butter knife. It's my special butter knife. Has a rounded tip, not those pointy serrated tips. It's blunt/rounded on both edges, so it can't dig in. And it's just thin enough to fit underneath with a business card, but thick enought to have prying force without bending.

Honestly, the RSX is the hardest to delid. I really don't reccomend it.

I use probably same butter knife as you, but this was my first touch of the 40nm chip, I've read that it was harder, but not THAT much, I mean the IHS literally flew up and hit the celling, so it went about 1.5 meters up. I was just not prepared for that. Next time I won't even try delliding, I mean for frankestein it's gonna be cooled rather well either way.

 

[Saaif88]

Anyway, what you can do now is to use the command "clearerrlog" to revert the changes, this is going to fill the errorlog area with FF

Yeah, that works just fine, no problems, but I still can't get the PS3 to actually add anything to the errlog by itself.

Btw, what kind of problem have that PS3 ?, im reading your posts but you never mentioned it

This is just a standard YLOD. Push the power button, 3 beeps after 1-2 seconds, and it turns back off. I was going to replace the caps, but it seems like something else is going on. Either that, or the SYSCON itself is damaged. I find it strange though, because this PS3 looks like its in great shape. There's no corrosion or damage at all from what I can see. Maybe I'll take another look at it at some point in the future. Regardless, thanks so much for your help!

 

[vyktormvmpay25]

Ok I am in the process of how the hack to reduce vddr voltage in dia001 and dia002?
One thing to say about 40nm rsx in normal slim board, pin suppose to go on R2504 is tied to ground. That pin in cok001 /002 is pulled up with another pin , that place for resistance is disappeared in slims and directly to ground (took me 1 hour to find it [emoji23])
Anyway in dia001 vddr is 1,2 v and dia002 is 1,0v. How do you guys suggest that we should do it?

Dia001 ic type D35231, dia002 D35230.
I've swapped ic's and got dia001 down for 1,0v but I would prefer not to do that anymore as is that type of ic with gnd pad hard dame to remove it.
One thing is that both seem not to affected if 10k is diagonal or 0 ohms in diagonal. Both still boots. Only dia001 needs that 10k removed to get started. On dia002 10k resistance not placed from factory like rest boards after this.
Not much data to this https://www.psdevwiki.com/ps3/Talk:Regulators
I will try to create dividers, I know how should work but I'll need suggest datasheet for this ic vreg driver whatever it is.
Edit
Found my answer to not desolder
https://s.go.ro/a1caw03s
Well I have to as they are fixed rates package types.
Still need something as Hson8 package type for replacement

 

[N3Star]

I give up.


(PowerOff State)
[SSM] state: 0000 -> 0101
Bringup Mode #0 (0xFF)
[SSM] ssmCb_OnStartingBePowOn() called.
[SSM] Bringup mode : syspm_stat=00000000/00000000
[POWSEQ] PowerSeq_Setup called.
[SSM] state: 0101 -> 0201
[POWSEQ] AV Backend Setup
[SSM] state: 0201 -> 0102
[SSM] state: 0102 -> 0202
[SSM] state: 0202 -> 0103
[SSM] state: 0103 -> 0203
[SSM] ssmCb_BeforeBeOn() called.
[SSM] state: 0203 -> 0104
Psbd_SbTransMode_Half:0x21e2
[POWERSEQ] Error : BitTraining RSX:RRAC:RX3:GLOBAL1:RX_STATUS
[SSM] state: 0104 -> 0304
[SSM] ssmCb_AfterBeOn2() called.
[SSM] PowSeq Fail : Detected !
[SSM] state: 0304 -> 0700
[POWSEQ] AV Backend Letup
[SSM] Shutdown mode : syspm_stat=00000000/00000000
[ERROR]: 0xa0404432
[ERROR]: 0xa0403034
[POWSEQ] PowerSeq_Letup called.
[SSM] state: 0700 -> 0600
(PowerOff State) (Fatal)

New RSX, not delidded, all resistances on mobo normal.
At this point I'm afraid that the pcb has some kind of a internal problem.

EDIT: Now that I think of it, what's going to happen if the resistor mod under RSX was performed incorrectly? I think I read somewhere what error code would show up, but I can't find it now.
EDIT2: Nah, I caveman-ed through it - just scaratched the via, 10Kohm to ground. At the same time I delided it, this time not even a scratch on it. I don't know at this point whether I should just give up and put this RSX on different board or reflow it, reball maybe, put a tantalum as the NECs near the RSX have bulged - I feel like this won't help it, even though it takes a long time to YLOD, something like 4 seconds; SYSCON doesn't lie though.

 

[Cypha]

This one is for delid the ps3 that u fixed with the nectokins is still working flawlessly i checked the error codes and was all 1002 which is quiet rare for the uk version as always buy ones which comes with the error 3034 and i Think with the uk one is that people let it overheat causing the solder cracks or frying-the cpu or gpu depending which one dies first as when i buy fully working ones for voltage testing and ohms reading across multiple to get a average or correct readings they always start to get loud fast as of no thermal paste being changed and pads

 

[N3Star]

Well, I must have been cursed at some point.
I resoldered the RSX onto another board aaaand it works! Sort-of. Kinda looks like a GLOD, but at the same time it might be corrupted OS, I don't know what was done to this board, but when I got it it had no back RSX NECs. Don't know why, but after a few seconds from powering on I can hear a beep, exactly same as when it's powering on, no display at all, not even synchronization clock on video output.
Previous board then is probably toast, I saw all pads soldered, only hope is that it had some bridge, but kind of unlikely if you ask me.

 

[cryptblood1986]

PS3 Slim 2000 series with error log:
===================================
ERR 00: 00000000 A0801200 FFFFFFFF
ERR 01: 00000000 A0093003 FFFFFFFF
ERR 02: 00000000 A0801200 FFFFFFFF
ERR 03: 00000000 A0801200 FFFFFFFF
ERR 04: 00000000 A0801200 FFFFFFFF
ERR 05: 00000000 A0801200 FFFFFFFF
ERR 06: 00000000 A0801200 FFFFFFFF
ERR 07: 00000000 A0022010 FFFFFFFF
ERR 08: 00000000 A0022110 FFFFFFFF
ERR 09: 00000000 A0093003 FFFFFFFF
ERR 10: 00000000 A0093004 FFFFFFFF
ERR 11: 00000000 A0093004 FFFFFFFF
ERR 12: 00000000 A0022110 FFFFFFFF
ERR 13: 00000000 A0093003 19C7CC23
ERR 14: 00000000 A0093003 19C5867E
ERR 15: 00000000 A0022110 19C58677
ERR 16: 00000000 A0022010 1961CF50
ERR 17: 00000000 A0022010 19619FDE
ERR 18: 00000000 A0093003 193464E5
ERR 19: 00000000 A0093003 192BABFA
===================================

I've changed the nec caps. Haven't tested the unit yet.
2010 and 2110
I checked f6001 and got continuity. Can someone circle where else to check?

 

[squeept]

@RIP-Felix Where should I be depositing my diagnostic sheets? This thread? DM you? I'm still working on layout and readability, but am I missing anything else useful?

Unfortunately for you, I'm no longer entering all the data in to a spreadsheet myself as I think I've got enough data points for my own conclusions, so anyone mining data will need to enter their own data from the pictures. These are just to aid me in diagnostics, answer questions for discerning buyers, and to staple to receipts in my filing.

Spoiler

 

[RIP-Felix]

here is fine. I have a spreadsheet that shows which page I left off on. So when I eventually circle back to updating things I'll start where I left off and find these posts.

 

[squeept]

here is fine. I have a spreadsheet that shows which page I left off on. So when I eventually circle back to updating things I'll start where I left off and find these posts.

Right on. Am I missing anything that anyone needs data on? Since I've written my own service manual for the syscon in a format that makes it easy for me to read without mixing things up, I have no problem doing internal mode just to grab a little extra data now. And I now include pictures of the the diagnostic sheet on the listing for each system, so it's no trouble at all to throw them all up here too.

Has the bit training stuff yielded any results that are useful in terms of repairs that wouldn't be otherwise obvious through other diagnostics, not be impossible to use to differentiate BGA defect versus bump defect, and occur commonly enough that I wouldn't just put it in the miscellaneous troubleshooting box when needed?

 

[marciolsf]

Has the bit training stuff yielded any results

Not really, that I remember… @RIP-Felix is keeping track of the distribution of errors, and none of the errors are more common than the others. For my 3034, I traced nearly every test point and component that makes that signal, and every voltage/resistance matched spec.There's probably one or two points left I want to test, but I bet it'll come back to cracked solder balls regardless.

edit: to be clear, felix figured out how to track down bit training errors to specific points in the rsx. I've tracked the solder point corresponding to BitTraining BE:RRAC:RX0:GLOBAL1:RX_STATUS, and then I made my way back from there. Turns out it's a single ball joint (and in my case, no amount of pressure test managed to reconnect it.)

 

[marciolsf]

I went down a rabbit hole today, thanks to a twitter thread discussing psn plus and psn now, which revealed the tidbit that sony is using Zego BCU-100 rackmount servers to run the ps3 portion of the ps now service (https://en.wikipedia.org/wiki/Zego). It has some differences from a regular cecha01, but apparently, it's good enough for sony to stream ps3 out of it. M4j0r actually alluded to it several pages ago (and you even quote him on your power control topology post), but at the time I didn't think much of it. Here's another article, this one with a picture, even -- https://www.engadget.com/2008-08-14...into-zego-bcu-100-video-rendering-system.html

Just out of curiosity, I poked around the internet to get more information about interesting device, and voila! Found the service manual for it. @RIP-Felix if you haven't seen it, I think you might want to -- at 228 pages, it goes into a lot of detail about the hardware layout, seemingly more than the standard ps3 service manual we've been using. I mostly just glossed it through so far, but I thought I'd pass it on to the rest of the group.

 

[vyktormvmpay25]

I added this few days ago to my storage as well. I was curious about vddr ic for rsx but didn't find something compatible for vddr. I was surprised they use only 08v for vddc.

 

[squeept]

I think I've got my diagnostic sheet where I like it. I changed "power supply" to "PSU" so it would fit then uploaded it. Feel free to change it up to your liking. I'll throw it in my sig, too.

https://www.squeept.com/junk/diagnosis.xls

Hopefully that can save even more of those perfectly working TOKINs! For me, having all of that info at a glance has certainly taken a lot of the guesswork out of picking which RSX chips to throw in the trash.

edit: print in landscape mode and it will fill a page nicely (at least on my Windows PC using Open Office).

#2

Spoiler

 

[RIP-Felix]

I love that you're including a screenshot of this in your eBay listing. I saw you are finally back at it. I see a reball and a 65nm frankie up for sale. High price, but I'm curious to see if it sells. 2 year warranty is pretty epic. You do lean pretty heavily on your credentials, so maybe you can convince someone yours is worth a premium. I'm not saying it isn't worth that...IDK really.

AFAIK @DeadEnd's is the only one that's been sold, for around $800. But who knows what they're worth. The market will decide and I guess it makes sense to start high and lower the price if it doesn't sell.

When I really start thinking about the amount of time and money I've put in before having any sort of sucess with reballing, let alone a frankie, $800 seems fair. And I would need to sell many before breaking even.

OTH I would like to see the prices fall to a more affordable point where more people can enjoy these consoles. We know how to do it now. It's just a matter of cranking them out and competing with each other.