PS3 Frankenstein PHAT PS3: CECHA with 40nm RSX

The quote I was expecting after looking in to it, if I remember correctly when I was actually talking to a few companies back in the day, was a "one off" would be about 2 or 3 K if it even worked. And that was for their "simple" models where they didn't have to customize it too much to fit around components right next to the chip. As he said, with high speed circuits that kind of stuff tends to get dicey. They don't squiggle those traces on the board for nothin'.

And that only cuts out like 1/3 of the problem since there's still bump and die failures.

No passive method cools more than I think about 60? watts (on like a ~1cm die size) due to thermodynamics is weird. That doesn't even give us a PS4!

I just want one to test chips like I have ZIF sockets on my Atari 2600 test rig. Something simple like that to make sure I'm not wasting time.

edit: just saw you meant designing that from the start. Don't know. Some of the same reasons but probably mostly they don't want you messing with stuff. As a "repair person" I actually oppose most "right to repair" ideas because holy god the horrors I've seen from people trying to fix shit. I want it harder to repair so people stop committing genocide against electronics because they found a screwdriver that fit. Now imagine YOU being forced to pay for those warranty repairs....
 
Last edited:
They already do that and we've all been paying for it.
That's what tamper evident devices are for (voiding warranty repair obligations). SONY uses stickers and security bits. PC manufactures weasel out of warranty repairs by using a case switches that count the number of times it releases. You can't open it without it counting up in BIOS. All these do is make it harder for people to do basic and necessary maintenance, like blowing out dust and replacing thermal compound.

They should either design it to last such that it never needs to be opened and do as you say and make it impossible to open (acoustically weld it shut)! Or make it easy to repair, provide easy to understand routine maintenance instructions with the console, and offer resources to repair shop to do their job. ATARI did this with the Atari2600. They had service manuals with troubleshooting flowcharts, part numbers, reference voltages and oscilloscope measurements, everything you need! Then all changed in the 80-90s and became anticonsumee and anti-repairman. They were allowed to plan your devices death for profit, protected from lawsuit by torte reform and relaxed industry regulations. Now they want your console, refrigerator, microwave, dishwasher, phone, laptop and dookicky to die, so you'll have to buy another one. They ajdust design goals to make devices las just beyond the warranty period (if required to offer one). So long as it doesn't present a physical danger to life or "other property" (like burn down you house), they can get away with anything. The only concern they have now, is PR. The XB360 died too early and too often. The backlash caused a billion dollar recall. They pushed the profit dial too far. SONY barely got away with the PS3, honestly they're lucky. That's what happens when you let industry regulate itself. They make decisions for themselves not for consumers. The incentive structure is toxic.

And don't tell me they didn't know. If that's true their engineers are negligent. EE CAD software allows them to build exact software replicas and benchmark them. They can input the physical and electrical constants, solder chemistry, pad chemistry, thermal parameters, airflow characteristics, and etc. Then they can simulate the mean thermal cycles to failure. The computer literally spits out death date for the console! They can tweak the design to get the balance right. And they are not tweaking it for maximum reliability. More like minimum liability and maximum profit. Reliability it low on their design goals.
And if I'm wrong about this, then SONY should hire me. I can make them BILLOINS...lol!
 
Okay I was able to find a 40nm CECHA of my own as well.
When it first arrived I honestly thought I was wrong and it was just a 90nm RSX due to the power measurements I got on the XMB which seemed to be almost identical to the power measurements I got on my 90nm CECHA. (this would confirm my suspicion about the RSX not really being utilized on the XMB when I did the 28nm vs 40nm power test) @sandungas
I didn't tear it down although I did confirm it through a wattage test using a regular 90nm CECHA and a disc copy of GT6.
GT6 first race on brands hatch:
40nm CECHA - 170-177W
90nm CECHA - 191-203W
I also took a photo of the more system info page
20210125_175646.jpg
 
Just got one buspirate 3,6v and want to test but link is down https://www.sendspace.com/file/es86dh .
I wold like to have that Syscon Flasher.exe or i can use terra term or realterm and how? I may be able to help with more tests but without files needed may leave this aside.
Edit
Figured with putty , may report with dumps if works well
 
Last edited:
DoublesAdvocate said:
Okay I was able to find a 40nm CECHA of my own as well.
Click to expand...
Thats another frankie ?, the twin brothers separated at born :D
DoublesAdvocate said:
When it first arrived I honestly thought I was wrong and it was just a 90nm RSX due to the power measurements I got on the XMB which seemed to be almost identical to the power measurements I got on my 90nm CECHA. (this would confirm my suspicion about the RSX not really being utilized on the XMB when I did the 28nm vs 40nm power test) @sandungas
Click to expand...
Right now i dont understand the implications of this new test, can you post a link to that previous conversations or make a resume to refresh a bit what we was discussing ?
 
M4j0r said:
Yes, build id 0F38 is used on COK-001 refurbs, the version is v1.5.1k2, the rom suffix is 304. It has already been dumped.
What's still missing is 0F29/303 which is also v1.5, and the 0C16/202 + 0D52/203 firmwares (https://pastebin.com/EXDxPQ0y)
Click to expand...
Right now im wondering if the SYS_CON_FIRMWARE_01050002.pkg (for softID 0F29) belongs to another refurbished COK-001, but it should be a diferent repair, either:
-A RSX replacement (different than the one found in the frankensteins discussed in this thread)
-A CELL replacement
-A SB replacement

----------------
And btw, until today i thought this was a bit like a hack but not fully supported by sony
I mean... i know is official, but i thought it was something made only in a specific official repair center, just because someone from the official repair center figured it, but not made globally
lets say... i thought this could be something specific from a official repair center in indonesia only (or something like that)

But right now im thinking this is something made globally in all repair centers, it seems at some point sony advised all repair centers to do it, this is why there is a syscon PKG specific for it included in retail firmwares...because is a lot more common than we thought
We just found a couple of "specimens" using it, but i bet there are hundreds
 
Last edited:
sandungas said:
Right now im wondering is the SYS_CON_FIRMWARE_01050002.pkg (for softID 0F29) belongs to another refurbished COK-001, but it should be a diferent repair, either:
-A RSX replacement (different than the one found in the frankensteins discussed in this thread)
-A CELL replacement
-A SB replacement
Click to expand...
It's probably just an earlier version (2009 vs 2010), since CELL and SB (pinout incompatible) can't be replaced with newer parts.
But right now im thiniing this is something made globally in all repair centers, it seems at some point sony advised all repair centers to do it, this is why there is a syscon PKG specific for it included in retail firmwares...because is a lot more common than we thought
We just found a couple of "specimens" using it, but i bet there are hundreds
Click to expand...
Yes, this has been officially supported by Sony, but it's weird since they could've just included the patches into the firmware. Also why did they release patches for these rare firmwares but not for the more common prototype firmwares? I looked at the patches and they're only "security" related (some RTC fix and restricting the UART interface), so the system works completly fine without the patches.
 
M4j0r said:
It's probably just an earlier version (2009 vs 2010), since CELL and SB (pinout incompatible) can't be replaced with newer parts.
Click to expand...
Hmm, ok, thats a good theory, so:
COK-001, softID=0F29, build=303... is the first revision of the frankenstein
COK-001, softID=0F38, build=304... is the second (and final) revision of the frankenstein

The goal of both was the same (to replace the original RSX manufactured at 90nm by a RSX with 40 nm), but the first revision had some kind of problem in the base syscon firmware (0F29)... and the only solution they found was to create a new base syscon firmware (0F38)

If thats true, it could be interesting to find a CECHA with the first revision of the frankenstein to try to figure why they did a second revision... it could be something related with a critical vulneravility... or maybe it was a bad implementation (a bad idea... or a mistake) and we should consider them faulty

M4j0r said:
Yes, this has been officially supported by Sony, but it's weird since they could've just included the patches into the firmware.
Click to expand...
Because it was a big problem, not fixable with a syscon patch :D

Ok, i got you now... i guess is because at that time there was already some frankensteins returned to normal users, the SYS_CON_FIRMWARE_01050101.pkg was included in the retail PUP, but they was not sure if all the frankeinsteins had the syscon patch installed (so they was not able to remove the SYS_CON_FIRMWARE_01050101.pkg from the retail PUP's)

They could have "integrated" the SYS_CON_FIRMWARE_01050101.pkg into the syscon base firmware, but this was not going to allow them to remove the SYS_CON_FIRMWARE_01050101.pkg from the PUP anyway

M4j0r said:
Also why did they release patches for these rare firmwares but not for the more common prototype firmwares? I looked at the patches and they're only "security" related (some RTC fix and restricting the UART interface), so the system works completly fine without the patches.
Click to expand...
I guess is because the PS3 prototypes are not "covered" by the "software update support" used in retails
Lets say... if someone had a prototype and there was some problem with it, the only support from sony was to send the machine to them... and they was going to send you a different PS3 model (not a prototype)
 
Last edited:
sandungas said:
Hmm, ok, thats a good theory, so:
COK-001, softID=0F29, build=303... is the first revision of the frankenstein
COK-001, softID=0F38, build=304... is the second (and final) revision of the frankenstein

The goal of both was the same (to replace the original RSX manufactured at 90nm by a RSX with 40 nm), but the first revision had some kind of problem in the base syscon firmware... and the only solution they had was to build a new base syscon firmware

If thats true, it could be interesting to find a CECHA with the first revision of the frankenstein to try to figure why they did a second revision... it could be something related with a critical vulneravility... or maybe it was a bad implementation (a bad idea... or a mistake) and we should consider them faulty
Click to expand...

I thought that maybe 0F29/303 only adds support for the 65nm RSX.

I guess is because the PS3 prototypes are not "covered" by the "software update support" used in retails
Lets say... if someone had a prototype and there was some problem with it, the only support from sony was to send the machine to them... and they was going to send you a different PS3 model (not a prototype)
Click to expand...

Sony does include updates for the prototype BD drives (300R, 301R, 303R) though. And since these syscon patches are "security" updates they should've included them also in the retail firmwares. By removing the Sony patch you actually can bypass the complete syscon patch update procedure and just overwrite (or read) the patch over UART, that's the first thing they patched.
 
DoublesAdvocate said:
Okay I was able to find a 40nm CECHA of my own as well...
Click to expand...
Congrats! That is awesome. Looking forward to seeing the motherboard! Hi-res please, we need see if this one matches the CG reset mod and VRM. If they changed the VRM on yours too, this would confirm the change is necessary. I'm particularly interested now, since the 40nm consoles all used different VRM than BC models. Maybe there's a connection. Exciting!
 
DoublesAdvocate said:
Okay I was able to find a 40nm CECHA of my own as well.
When it first arrived I honestly thought I was wrong and it was just a 90nm RSX due to the power measurements I got on the XMB which seemed to be almost identical to the power measurements I got on my 90nm CECHA. (this would confirm my suspicion about the RSX not really being utilized on the XMB when I did the 28nm vs 40nm power test) @sandungas
I didn't tear it down although I did confirm it through a wattage test using a regular 90nm CECHA and a disc copy of GT6.
GT6 first race on brands hatch:
40nm CECHA - 170-177W
90nm CECHA - 191-203W
I also took a photo of the more system info pageView attachment 30380
Click to expand...
where you get that thing ? japan order ? did u do specific way to get that ?
 
You must log in or register to reply here.

Similar threads

Back
Top