PS3 Frankenstein PHAT PS3: CECHA with 40nm RSX

[RIP-Felix]

I am currently working up a voltage timeline that may help to identify if there is an issue with power that doesn't produce an error in the power sequence.

One of the things I have noticed from our Sabotage tests is that not all voltages do produce an error. We haven't been hooking up HDMI and AV to see if it's producing video or not (perhaps an oversight), but that would take much longer and this console was a GLOD to begin with. Who wants to Sabotage a working one!?

Anywho, there are a few voltages we have identified that produce GLOD like symptoms. Yesterday I produced something like 30 O-scope captures of a bunch of voltages. Then I organized each into groups (because many of them come on at the same time). Then I compared them to the SYSCON SW line. What I found is that it doesnt go sequentially down the list from SW_0 to SW_8. It mostly follows that order, but sometimes will start a voltage from a later switch at the same time as an earlier switch.

I am still scoping, organizing the data, and trying to make sence of it. But I'm hoping something useful comes from it. Of course it would mean that you will have to live probe you console to see if/when voltages become available.

 

[Workz_777]

I am currently working up a voltage timeline that may help to identify if there is an issue with power that doesn't produce an error in the power sequence.

One of the things I have noticed from our Sabotage tests is that not all voltages do produce an error. We haven't been hooking up HDMI and AV to see if it's producing video or not (perhaps an oversight), but that would take much longer and this console was a GLOD to begin with. Who wants to Sabotage a working one!?

Anywho, there are a few voltages we have identified that produce GLOD like symptoms. Yesterday I produced something like 30 O-scope captures of a bunch of voltages. Then I organized each into groups (because many of them come on at the same time). Then I compared them to the SYSCON SW line. What I found is that it doesnt go sequentially down the list from SW_0 to SW_8. It mostly follows that order, but sometimes will start a voltage from a later switch at the same time as an earlier switch.

I am still scoping, organizing the data, and trying to make sence of it. But I'm hoping something useful comes from it. Of course it would mean that you will have to live probe you console to see if/when voltages become available.

@RIP-Felix ...will adding the BD3504FVM-TR - Linear Regulator help with these issues? (You were talking about this component in one of David's live streams the other night).

 

[RIP-Felix]

@RIP-Felix ...will adding the BD3504FVM-TR - Linear Regulator help with these issues? (You were talking about this component in one of David's live streams the other night).

No.

The 40nm RSX can run on 1.2v fine. It'll just last longer with 0.95v.

 

[Workz_777]

No.

The 40nm RSX can run on 1.2v fine. It'll just last longer with 0.95v.

Ah i see, o.k

 

[_XBrD4shDOE_808_]

syscon have a reserved EEPROM region to configur the HDMI controller

Could it be that we are not just having a configuration problem then?

a huge amount of the syscon firmware is related with it

Could it be that we are not just having a configuration problem then?
This HDMI controller firmware, is there a way to rewrite it? because I have a theory, maybe when installing the patch to recognize the 40nm RSX, a possible misconfiguration may occur or the controller firmware has corrupted.

I also know that the patch was probably not made to modify this area in Syscon, but it's not something to doubt if it happens to be honest

 

[_XBrD4shDOE_808_]

Frankensteins made using Mod Orbis, did we have a report about this problem on HDMI too?
I don't know how many devices using this Mod were made too...

 

[RIP-Felix]

I'm pretty sure it is a hardware problem, unrelated to the mod.

The ORBIS modchip has been confirmed working on COK-001 by @botakompong. We reverted ALL the changes made to the SYSCON eeprom and then installed the ORBIS. It did the same thing. So it's not related to either mod.

Something else subsequently failed on those consoles and we just haven't found what it is yet. There is a lot of complexity and too many unknowns in busted consoles. Ideally you would perform this on a working console, but it's so risky that's not a good idea.

 

[sandungas]

Could it be that we are not just having a configuration problem then?

See the table at bottom of this page, dont take it literally because is still under research
https://www.psdevwiki.com/ps3/Talk:SC_EEPROM#Experimental_table
At offset 0x3A00 in mullion syscons there is a region named "HDMI/DVE Config" (unnofficial name, i dont know how accurate is that name)
...and inmediatly after it (offset 0x3B00) there is another region without name, is colored with grey because is always filled with FF on retail syscons (never used in retail PS3 models)
I was refereing to the second area, his location makes me think it could be used for HDMI/DVE too but this is just speculation (btw, DVE is the codename of the chip connected to the MultiAV port)
Anyway, in the frankenstein patches we are not writing in that areas

This HDMI controller firmware, is there a way to rewrite it? because I have a theory, maybe when installing the patch to recognize the 40nm RSX, a possible misconfiguration may occur or the controller firmware has corrupted.

I also know that the patch was probably not made to modify this area in Syscon, but it's not something to doubt if it happens to be honest

The main syscon firmware is not represented in the table of the link i posted (the table is EEPROM, and the firmware is not in the EEPROM)
The only way to modify the base syscon firmware is by using the official syscon patch format i was talking about here
https://www.psx-place.com/threads/f...cecha-with-40nm-rsx.28069/page-73#post-323038
Eventually someone could find a hack related with both things (either to configure HMDI/DVE chips, or to modify small bits of syscon firmware), but by now doesnt seems to be related with frankenstein patches

 

[squeept]

Jesus, good work guys! I just checked back in and noticed all the updates. For whatever reason, I could never get the ORBIS chips working, whether it was my source or something stupid I was doing, so this is huge news to me.

I'm currently incredibly busy in my personal life and will be probably until summer, then I can start cranking these out.

 

[RIP-Felix]

(btw, DVE is the codename of the chip connected to the MultiAV port)

DVE stands for Digital Video Encoder. Just an AV DAC.

The HDMI transmitter and DVE get most of the focus, but there is an Audio DAC as well. Theres a 7805 and 7809 in there too (very common voltage regulators). I'm only mentioning them because they're what grabbed my attention when I was looking at the service manual. I was like, "oh hey, a 7805. The regulator that's in my SNES, Atari2600, and almost everything. I wonder what it's powering?" So I looked up the datasheet and its an Audio DAC.

Again, what's my point? Well it stands to reason that the Audio should be nearby the HDMI/DVE section in FW. And since we're talking terminology, SONY may call this the "AV Backend." Which includes +1.5V_RSX_VDDIO and a few other voltages.

I don't know much about the FW or how to know what gets executed sequentially, but I may be able to help figure that out by putting the voltage timeline up. Maybe the order in which the come on mirrors the FW ommands. Someone will have to translate, cuz that's not my strong suit. Still working on the timeline tho.

 

[nCadeRegal]

Let me know when ready bud and I will send my a01 that is ylod and waiting for this.

Jesus, good work guys! I just checked back in and noticed all the updates. For whatever reason, I could never get the ORBIS chips working, whether it was my source or something stupid I was doing, so this is huge news to me.

I'm currently incredibly busy in my personal life and will be probably until summer, then I can start cranking these out.

 

[sandungas]

DVE stands for Digital Video Encoder. Just an AV DAC.

The HDMI transmitter and DVE get most of the focus, but there is an Audio DAC as well. Theres a 7805 and 7809 in there too (very common voltage regulators). I'm only mentioning them because they're what grabbed my attention when I was looking at the service manual. I was like, "oh hey, a 7805. The regulator that's in my SNES, Atari2600, and almost everything. I wonder what it's powering?" So I looked up the datasheet and its an Audio DAC.

Again, what's my point? Well it stands to reason that the Audio should be nearby the HDMI/DVE section in FW. And since we're talking terminology, SONY may call this the "AV Backend." Which includes +1.5V_RSX_VDDIO and a few other voltages.

I don't know much about the FW or how to know what gets executed sequentially, but I may be able to help figure that out by putting the voltage timeline up. Maybe the order in which the come on mirrors the FW ommands. Someone will have to translate, cuz that's not my strong suit. Still working on the timeline tho.

I cant find the components involved in the service manuals, but i guess that power line is related with the optical audio connector (TOSLINK), as far i remember in the PS3 slims there is a little squared component dedicated to it, located very close to the optical audio connector

I dont know if the other HDMI/DVE chips are dependant of it though... i mean... i dont know what happens if we "rip out" the chip dedicated to optical audio... maybe it would make HDMI/DVE to malfunction ?... dunno, but it worths to be checked

Good point mentioning this in relatioship with the syscon EEPROM layout, if there is some settings related with optical audio most probably are located together with the 2 regions i mentioned for HDMI/DVE stuff, the chip is tiny in PS3 slims and when i was trying to map the syscon pinouts i never took it in consideration (to see if there is some data channel or control signal for it) but is very probable that syscon can control it

 

[DeadEnd]

I'm not sure if it's been mentioned, but I have found one cause for errors 2120 and 3013. I'd like to thank whoever wrote the explanation in the devwiki https://www.psdevwiki.com/ps3/Syscon_Error_Codes#2120_.28HDMI.29

It my case it wasn't the fuse F6302 but a 5.6 ohm resistor R6345. I first noticed it had lost contact on one end. I touched it a little and it came off out of its place entirely. I have also tried to take the same one out of a spare board, but it nearly turned into dust as I touched it. It seems these little guys get a lot of stress with use.

 

[sandungas]

I'm not sure if it's been mentioned, but I have found one cause for errors 2120 and 3013. I'd like to thank whoever wrote the explanation in the devwiki https://www.psdevwiki.com/ps3/Syscon_Error_Codes#2120_.28HDMI.29

It my case it wasn't the fuse F6302 but a 5.6 ohm resistor R6345. I first noticed it had lost contact on one end. I touched it a little and it came off out of its place entirely. I have also tried to take the same one out of a spare board, but it nearly turned into dust as I touched it. It seems these little guys get a lot of stress with use.

View attachment 36530
View attachment 36531

Interesting, check that @RIP-Felix i guess it worths to be mentioned in wiki

At one side of the resistor R6345 there is +12V_MAIN (without any fuse in between PSU and the resistor), and at the other side is feeding IC6301 VCC (pin 24). So it seems you had IC6301 unpowered
The fuse F6301 is not knocking out IC6301... but his outputs (that later generates the +1.8V_RSX_FB)

As far i understand are 2 different behaviours, the resistor R6345 disables IC6301 completly. And the fuse F6301 keeps IC6301 alive but disables the line +1.8V_RSX_FB

 

[RIP-Felix]

It's significant that you are not just getting one 2120, but 10 of them. This is a different error combination. 10x A0202120 / 1x A0213013.

I'll have to look at my notes later, but we came across this in our sabotauge tests when we removed L6305, which selectively knocks out RSX_FBVDDQ. You can find the link to that in my signiture. We have seen these before in the thread, but were speculating about what they meant based on what eventually fixed it, or temporarily caused it to go away.

I have not rolled any of these new findings into the wiki yet. I've been off on a tangent, probing the voltages to see when they pop up on the timeline. It's all related, however. Just a bigger project. But I think I'm getting there.

 

[Pacorretaco]

It's significant that you are not just getting one 2120, but 10 of them. This is a different error combination. 10x A0202120 / 1x A0213013.

I'll have to look at my notes later, but we came across this in our sabotauge tests when we removed L6305, which selectively knocks out RSX_FBVDDQ. You can find the link to that in my signiture. We have seen these before in the thread, but were speculating about what they meant based on what eventually fixed it, or temporarily caused it to go away.

I have not rolled any of these new findings into the wiki yet. I've been off on a tangent, probing the voltages to see when they pop up on the timeline. It's all related, however. Just a bigger project. But I think I'm getting there.

Maybe this could be more relevant in the other thread but actually it is not that rare to get the
10x A0202120 + 1x A0213013 together.
I had another board like that and I remember other people reporting such combination too.
But I cant remember seeing or hearing about error 3013 "without" the 10x 2120 together. Even then, people sometimes may not notice that all those 11 errors are happening together and report them
separately.

As for the cause, well it can vary... F6302 and that area is involved, but ultimately is a CPU---Syscon communication error. We saw a couple of instances of clearly broken CPU, one where the die was completely crushed and cracked... with these errors.
In my board I still didnt really find the problem 100% after basic checks, but somebody had clearly heatgunned everything including the CPU... So I didnt dive so deep either... Maybe I should look again though.

 

[RIP-Felix]

I'm not sure if it's been mentioned, but I have found one cause for errors 2120 and 3013. I'd like to thank whoever wrote the explanation in the devwiki https://www.psdevwiki.com/ps3/Syscon_Error_Codes#2120_.28HDMI.29

It my case it wasn't the fuse F6302 but a 5.6 ohm resistor R6345. I first noticed it had lost contact on one end. I touched it a little and it came off out of its place entirely. I have also tried to take the same one out of a spare board, but it nearly turned into dust as I touched it. It seems these little guys get a lot of stress with use.

View attachment 36530
View attachment 36531

Did you by any chance record the bringup? I think more information might be seen in the specific error messages there.

That resistor is needed for input voltage sensing (trip-point) of the High-Speed Rail-To-Rail Output Video Amplifier (IC6301), a dual op-amp that produces RSX_FBVDDQ (On output 1). That resistor had the same effect as removing L6301 did in our sabotage tests. It knocked out FBVDDQ. That part can be seen at 1:09:09...

My guess is that the 3013 (BE error) is triggered because the CPU cannot initialize the VRAM over the IOIF0 port (CELL's interface with the RSX that allows high speed VRAM sharing & co-processing), since FBVDDQ is the RSX VRAM's voltage. Basically there's no power to the GPU RAM and the CPU is just saying it couldn't find it. That's old news to the GPU, which already said "my ram is dead" 10x times before the CPU stated the obvious.

 

[DeadEnd]

In bringup it showed A0202120 about 4 times. It was a fatal shutdown of course. I was gonna take a screenshot, but accidentally closed the terminal too soon . Sorry.

 

[RIP-Felix]

I just ran some numbers on SONY's VDDR voltage mod.

There are 2 other BD3504s in the COK-001 (IC6602 & IC6304). These ICs can have the output voltage selected with an external resistor network as describe previously in this thread and in the ICs datasheet. I talk about it in the VDDR mod section of my Frankenstein tutorial, so I'm not going over it again.

The BD3504's on the COK-001 I mentioned above produce 1.2V_EEGS_VDD_DIG and 1.5V_YC_RC_VDDA respectively, but the math works out to 1.23V and 1.53V. So Sony has designed these to output 0.3V more than the target voltage. Why?

The reason this concerns me is because the way @botakompong's documentation has it, we would be setting VDDR at 0.95V exactly. I take it that he, or his brother Kiaw, measured the resistors of official SONY refirbs to arrive at these numbers...

Kinda a mystery why the service manual numbers are 0.3v higher.

 

[DeadEnd]

0.03v difference, not 0.3v. Not a significant difference. Perhaps the resistors availability affected it a little bit.

.

I take it that he, or his brother Kiaw, measured the resistors of official SONY refirbs to arrive at these numbers...

I've been saying this the whole time. He didn't just create the modchip out of nothing. They simply analyzed the changes in the refurbished board