PS3 Frankenstein PHAT PS3: CECHA with 40nm RSX

[DeadEnd]

Continuing with a bit more digging on the voltage regulator used in the mod. I checked again the IC that we are taking out of slim boards and the pinout marked by @botakompong was this one.



The logo on the chip is Microchip technologies (used to be called Micrel), but I for the life of me could not find a regulator that would have the same package or pinout under their brand. But I came across something that has a very similar pinout - IC3502, Mitsumi MM1761KHBE (I'm not saying this is the IC in slim, I'm only hinting it would be of a similar type of IC.)


As you can see it can produce voltage that is close enough to 0.95 v. By the way this is a FlexIO Core voltage supply, so it has to be fixed output (it is fixed from BD3520 as well, but we are just ignoring it by placing our own regulator instead of the mosfet).

 

[RIP-Felix]

Hello guys!

I've posted pictures and measurements for voltage divider at GSCLKI and VDDR "official" voltmod on a separate thread: https://www.psx-place.com/threads/r...s-replacement-ylod.25260/page-213#post-311094 and https://www.psx-place.com/threads/r...s-replacement-ylod.25260/page-214#post-311124

R2001 is gone, R2002 is 15 kΩ, but value doesn't matter much because w/o R2001, R2002 becomes a pull-down resistor for GSCLKI, no more voltage divider.

I can confirm that diagonal resistor is indeed 10 kΩ, and it's also a pull-down resistor connected to GND plane.

VDDR controller is BD3504FVM, but it's hard to measure R1/R2 values while resistors are soldered to PCB. Measurements that I made look incorrect. I'll try to make a measurements with LCR meter, maybe it will make any difference, but I'm not going to desolder R1/R2, sorry, too much pain in the ass. Also I'll try to measure actual VDDR and post results later.

Knowing real VDDR and that LDO controller is BD3504FVM is enough to deduce R1/R2.

As for PWRGOOD modification, it's hard to measure R6111 and R6112 without desoldering them because NCP5318FTR2G own internal resistance comes into play. For me R6111 is 7.4 kΩ and R6112 is 4 kΩ, but, again, measurements most likely incorrect. But resistors look like they have indeed been resoldered.

View attachment 35018

As you already pointed out, resistors in circuit cannot be measured accurately. I was curious if the math made any kind of sense if I plugged in your numbers, but take the result with a grain of salt! To that effect...

R1 = R6216 (1571) = VFB/GND
R2 = R6222 (1354) = VFB/VS
R1'= R6214 (1241) = VD/GND
R2' = R6219 (1237) = VD/Vin

Vout = VFB ( [R1' + R2] / R1' ), where VFB is 0.65v.
Vout = 0.65 ( [1241+1354] / 1241) = 1.36v_VDDR

When you get around to measuring the Vout we'll know if that predicted 1.36v is total BS or not. Regardless the number isn't ludicrous. It's not too far off from 1.2v, what it's supposed to be with no modification. The question is, did they restore 1.2v using a D3504 and why? Seems pointless to change it if they were just going to set the voltage to the same value.

 

[nonosto]

The console I'm talking about here is PS3#7 (90nm RSX/CPU, reballed, tantalum). I was talking about it here because I was trying to make the point that some components run different. In this case I thought my CPU ran hotter than others. But that now seems it was probably the Indium foil I was using didn't fill in the imperfection on the Heatsink very well.

To answer your question, I doubt you have a 40nm RSX. Mine doesn't get that hot. 65nm is possible, yes.

To find out, install @M4j0r's pre-compiled build of PS3 Advanced Tools. It should give SYSCON information that can be used to find out.

• DL the PKG to USB and plug into PS3 as normal. Since your console is jailbroken already I assume you know how to instal packages.
• After installing, launch PS3 Advanced tools. Go left (end of the list) to "Get SYSCON Info."
  
• It'll generate a TXT file on the root of your USB.
  
• Post the log here.

Sony's method replaces the SYSCON chip so it's SYSCON FW version should be different. If it's not, your console is stock.

thx, my log:

Spoiler

Firmware Version: 4.86 (50715)
Platform ID: Cok14
Hardware Config: 00000000FFFFFFFF
Syscon Fimware Version: 0B8E.0001000000000006 (0001000000000006)

Bringup Count: 1602, Shutdown Count: 1553
Runtime: 25 Days, 13 Hours, 53 Minutes, 41 Seconds

Error Log
01: A0801004 Tue Sep 15 18:32:50 2015
02: A0801004 Tue Sep 15 16:49:15 2015
03: A0801004 Sun Jun 14 16:06:19 2015
04: A0801004 Mon Sep 8 18:26:29 2014
05: A0801004 Sat May 31 13:29:49 2014
06: A0801004 Wed Jan 29 17:07:11 2014
07: A0801004 Sun Dec 22 09:28:35 2013
08: A0801004 Sat Jul 13 17:37:48 2013
09: A0801004 Sat Jul 13 17:35:03 2013
10: A0801004 Sat Jul 13 16:58:33 2013
11: A0801004 Fri Jun 28 17:05:17 2013
12: A0801004 Mon Jun 24 18:18:46 2013
13: A0801004 Fri Jun 21 18:15:06 2013
14: A0801004 Tue Jun 19 16:55:35 2012
15: A0801004 Wed Jun 13 17:38:12 2012
16: A0801004 Sun Jan 1 09:41:55 2012
17: A0801004 Sun Feb 28 15:09:47 2010
18: A0801004 Fri Dec 11 16:02:54 2009
19: A0801004 Wed Dec 2 16:52:33 2009
20: A0801004 Tue Dec 1 15:32:15 2009
21: A0801004 Sun Nov 29 07:39:44 2009
22: A0801004 Fri Nov 27 17:18:44 2009
23: A0801004 Thu Nov 26 16:37:22 2009
24: A0801004 Thu Nov 19 17:09:48 2009
25: A0801004 Sun Nov 15 15:17:16 2009
26: A0801004 Tue Nov 10 16:01:12 2009
27: A0801004 Sat Nov 7 17:36:42 2009
28: A0801004 Thu Nov 5 16:18:13 2009
29: A0801004 Thu Aug 27 16:22:49 2009
30: A0801004 Mon Aug 3 16:09:10 2009
31: A0801004 Wed Jul 8 16:48:27 2009
32: FFFFFFFF Sat Jul 4 18:00:02 2009

 

[RIP-Felix]

With modded R1(R6207)=10kΩ and R2(R6205)=27kΩ, Vlower would be 0.6379V for 0.95V VDDC - about 0.3 V difference. I think, if Sony has really done this mod, the reason for it was to have less tight tolerance for PWRGOOD signal after they found out what resource heavy games can do to voltage ripple on both CELL/BE and RSX. So it should also be beneficial to standard Phats. But it's definitely not a prerequisite for RSX replacement.

That is an interesting hypothesis. Just to show the math for those wondering and to work through it myself...

Stock:
R1 = R6207 (15K)
R2 = R6205 (20K)

Vlower = [VOUTNoLoad / 2] x [ (R1 + R2) / R2] = [1.1810v / 2] x [ (15,000 + 20000) / 20000] = 1.03v
Vupper = VOUTNoLoad +100 = 1.1810v + 0.1v = 1.28v

@botakompong's Picture
R1 = R6207 (10K)
R2 = R6205 (27K)

Vlower = [VOUTNoLoad / 2] x [ (R1 + R2) / R2] = [1.1810v / 2] x [ (10,000 + 27000) / 27000] = 0.81v
Vupper = VOUTNoLoad +100 = 1.1810v + 0.1v = 1.28v

To be clear, this only lowers the amount the voltage can drop below nominal. The upper limit stays the same. So what @botakompong suggests lowers the allowable voltage drop.

That controller is part of VDDC and the 1002 errors we tend to see associated with bad NEC/TOKIN bulk filter caps may be voltage drop's triggering PowerGood. If bulk filtering isn't sufficient, the voltage drops below threshold, triggering PWRGOOD. Perhaps that's the mechanism behind the 1002 error. If it is, then instead of allowing 100mV drop this would allow 300mV drops! I wonder what potential consequence that has for system stability though. Could it cause freezes or artifacting? GLOD? I'm not sure this would be a good idea, but I need to do more research on the function of this controller. And if that is exactly what SONY did in refurbished units, then perhaps they decided it was fine to relax the threshold.

 

[RIP-Felix]

thx, my log:

Spoiler

Firmware Version: 4.86 (50715)
Platform ID: Cok14
Hardware Config: 00000000FFFFFFFF
Syscon Fimware Version: 0B8E.0001000000000006 (0001000000000006)

Bringup Count: 1602, Shutdown Count: 1553
Runtime: 25 Days, 13 Hours, 53 Minutes, 41 Seconds

Error Log
01: A0801004 Tue Sep 15 18:32:50 2015
02: A0801004 Tue Sep 15 16:49:15 2015
03: A0801004 Sun Jun 14 16:06:19 2015
04: A0801004 Mon Sep 8 18:26:29 2014
05: A0801004 Sat May 31 13:29:49 2014
06: A0801004 Wed Jan 29 17:07:11 2014
07: A0801004 Sun Dec 22 09:28:35 2013
08: A0801004 Sat Jul 13 17:37:48 2013
09: A0801004 Sat Jul 13 17:35:03 2013
10: A0801004 Sat Jul 13 16:58:33 2013
11: A0801004 Fri Jun 28 17:05:17 2013
12: A0801004 Mon Jun 24 18:18:46 2013
13: A0801004 Fri Jun 21 18:15:06 2013
14: A0801004 Tue Jun 19 16:55:35 2012
15: A0801004 Wed Jun 13 17:38:12 2012
16: A0801004 Sun Jan 1 09:41:55 2012
17: A0801004 Sun Feb 28 15:09:47 2010
18: A0801004 Fri Dec 11 16:02:54 2009
19: A0801004 Wed Dec 2 16:52:33 2009
20: A0801004 Tue Dec 1 15:32:15 2009
21: A0801004 Sun Nov 29 07:39:44 2009
22: A0801004 Fri Nov 27 17:18:44 2009
23: A0801004 Thu Nov 26 16:37:22 2009
24: A0801004 Thu Nov 19 17:09:48 2009
25: A0801004 Sun Nov 15 15:17:16 2009
26: A0801004 Tue Nov 10 16:01:12 2009
27: A0801004 Sat Nov 7 17:36:42 2009
28: A0801004 Thu Nov 5 16:18:13 2009
29: A0801004 Thu Aug 27 16:22:49 2009
30: A0801004 Mon Aug 3 16:09:10 2009
31: A0801004 Wed Jul 8 16:48:27 2009
32: FFFFFFFF Sat Jul 4 18:00:02 2009

That SC firmware version indicates a stock factory syscon chip. 0B8E = CXR713120-201GB. So it can't be a "frankie." They would have to replace the SYSCON chip to do it. Maybe you got luck and have a binned 90nm like at @DeadEnd and @M4j0r were talking about earlier.

Hey @M4j0r, any chance you can add the VIDbin check to your PS3 Advanced Tools log? Might be neat to know.

 

[nonosto]

thx what's a binned 90nm?

 

[RIP-Felix]

...The vidbin is the binning of the chip. It's only really used on 90nm. 2 means good, 3 is regular. 0 means no binning and 1 is invalid.

If this is referring to the process of binning processors, then some chips are more efficient off the assembly line than others, due to small variances in manufacturing. Sometimes you get chips that are particularly cool and others are particularly hot. If they dont pass quality standards they get put in the scrap "bin." But on the other end of the spectrum there are particularly well performing chips that run very efficient and cool. They get put into a premium bin. Prototype consoles, developer units, marketing samples, will often get this bin. Basically you put them into consoles to show off the product to influencers to puff up the hype before launch, because it'll perform better than the actual product. Put your best foot forward kind of a thing. And if you're super lucky, you might get one in a production unit.

I've read of people returning CPU's one after another until they get one that can overclock well. A dick move, but some people will stop at nothing to eek out those last few MHz.

 

[nonosto]

...The vidbin is the binning of the chip. It's only really used on 90nm. 2 means good, 3 is regular. 0 means no binning and 1 is invalid.

Hey @M4j0r, any chance you can add the VIDbin check to your PS3 Advanced Tools log? Might be neat to know.

for the moment any method for check vidbin?

 

[M4j0r]

Hey @M4j0r, any chance you can add the VIDbin check to your PS3 Advanced Tools log? Might be neat to know.

I might add that, but that requires lv1 peek, so it'll only work on CFW. The tool itself also works on >= 3.55 OFW.

thx what's a binned 90nm?

@RIP-Felix already explained it, but you can think of it as different classes.
A little example: The Nvidia Gefore RTX 3080, 3080 Ti and 3090 all use the same chip, but from different bins. The 3090 gets a better chip than the 3080 Ti.
These chips are manufactured on a wafer (a disc). The better chips are in the middle, but there're of course less chips near the middle of the circle than on the outside. So you'll end up with less good chips. That's why the more powerful gpus are more expensive.
Sony only uses 2 bins for the 90nm RSX (3: consumer grade and 2: extended specification grade).

for the moment any method for check vidbin?

You can dump lv1 and then search for the rsx version string.
A few examples (for 90nm, 65nm, 40nm, 28nm):

rsx:      b08 500/650 vpe:ff shd:3f  [AP0008286:1:1:14:e:b:2:11:1][39:2:1:1:1:3:1][0:0:0]
rsx:      rsx65 a06 500/650 vpe:ff shd:6f  [AP0015079:1:1:b:14:14:2:5:2][1c:0:2:0:1:2:0][2:1:0]
rsx:      rsx40 a01 500/650 vpe:ff shd:3f  [NN3108-17:0:4:11:c:3:6:0:1][28:0:a:0:1:0:1][1:1:0]
rsx:      rsx28 a01 500/650 vpe:ff shd:3f  [NHP016-10:0:4:a:18:3:6:0:2][22:0:0:2:1:0:0][3:0:0]

The second value within the second set of the square brackets is the bin. (so for the examples it's 2, 0, 0 ,0).

 

[nonosto]

thx very much

 

[lcferrum]

And here is your VDDR from Sony-refurbished Frankenstein.



So it's 0.95V and matches RSX voltage.

MOSFET is the same as on stock - SI4688DY.



So the difference is only in VDDR controller, which is BD3504FVM, and it's resistors. Feel free to choose any R1/R2/R1'/R2' values that produces needed 0.95V.

I might add that, but that requires lv1 peek, so it'll only work on CFW. The tool itself also works on >= 3.55 OFW.

Yeah, it's good have a simple way to check VIDbin. Maybe also add PVR check?

 

[nonosto]

I succeded to dump lv1.bin, how to open/read it for check the VIDbin?

 

[devbug_mind]

Another unique discovery was have made the other day is that not all 90nm are created equal. There are better chips that can actually run a lot cooler than your average stock RSX. Here is one example of an unopened CECHB01 console with RSX temperature under load.

View attachment 35011

We did some digging in the code (thanks to @M4j0r ) and turns out it's got an RSX chip from bin 2, which is a rare occurrence and usually reserved for prototypes. I can imagine they are longer lasting as well and swapping it may be unnecessary.

I'm wondering which fan model is inside that PS3 CECHB01 console. I came across a thread here of a PS3 fan comparison which shows the fan that cools the console best and this happens to be the model D14F-12BS1 01H1. I tested this myself and the consoles that had cooler temperatures were the two DECR-1400A dev kit units, a CECHA00 and a CECHB00 unit from the original PlayStation factory in Japan with the same fan model. The other CECHA00/01 units showed higher temperatures (but good) and had a different fan model.

 

[Shawn Shakir]

Would the mod still work without changing the voltage regulator? I have a few consoles i'm willing to test out with and also do have equipment for reballs and stuff. I just don't currenlty have any slims to take the component from to place on a COK001/002.

 

[DeadEnd]

Would the mod still work without changing the voltage regulator? I have a few consoles i'm willing to test out with and also do have equipment for reballs and stuff. I just don't currenlty have any slims to take the component from to place on a COK001/002.

It will work,but it might hurt your RSX. Not sure by how much.

 

[lcferrum]

BTW, note squeept's answer regarding state of my TOKINs. He says that he saw less noisy TOKINs causing problems. I think this indirectly confirms that Sony lowered PWRGOOD signal thresholds for both CELL and RSX VRMs on refurbished mobos.

 

[lcferrum]

Would the mod still work without changing the voltage regulator? I have a few consoles i'm willing to test out with and also do have equipment for reballs and stuff. I just don't currenlty have any slims to take the component from to place on a COK001/002.

You can try to source BD3504FVM to replace VDDR controller instead.

 

[DeadEnd]

I've put one modchipped CEHC04 up on ebay if anyone's interested. Didn't want to mention the orbis mod itself though, because I already failed to get buyers locally due to very little modchip pubilicity and people probably being cautious or not having a clue what it was for.

 

[Srassyfrass]

I've put one modchipped CEHC04 up on ebay if anyone's interested. Didn't want to mention the orbis mod itself though, because I already failed to get buyers locally due to very little modchip pubilicity and people probably being cautious or not having a clue what it was for.

I have a feeling it's going to hit a pretty high price. I'll probably bid myself but it's probably going to quickly get out of my price range. What a bad time to have no money!

 

[atreyu187]

I've put one modchipped CEHC04 up on ebay if anyone's interested. Didn't want to mention the orbis mod itself though, because I already failed to get buyers locally due to very little modchip pubilicity and people probably being cautious or not having a clue what it was for.

What's the link? Been waiting to see one of these go for sale.