PS3 Syscon fan settings (Coordinate Graphs)

Cytology doesnt have a "getini" version of this ones ?, the list looks a bit incomplete without them
Code:
tshutdown getini [0, 1, 2, A, F, 14]
tshutdowntime getini
fanconmode getini [0-8]
I checked all again, it does have "tshutdown getini".

So... we have all this posible values, right ? (and the value "unknown" that is pointless, it just represents an "invalid" value)

fanconpolicy // 0=Full, 1=Auto, 2=Manual
fanconmode // 1=VaryTable, ?=VaryServo, 3=Minimun
Code:
fanconpolicy // 0=Full, 1=Auto, 2=Manual
fanconmode // 0=Full, 1=VaryTable & VaryServo, 2=Manual, 3=Minimun
fanconmode 1 depends on values in RAM

But the real question is... at which offset of the thermal config area is stored the "fanconmode" ? :rolleyes:
Im wondering if is missing it in your code struct (maybe is one of the bytes we are labeling as unknown?)... or there is something i dont understand related with this modes
It gets loaded from RAM, Idk where it is set.
 
I checked all again, it does have "tshutdown getini".
Nice, right now, in my oppinion the most notable missing one is "tshutdowntime getini", is a bit weird that there is no subcommand to read that time directly from the eeprom

Code:
fanconpolicy // 0=Full, 1=Auto, 2=Manual
fanconmode // 0=Full, 1=VaryTable & VaryServo, 2=Manual, 3=Minimun
fanconmode 1 depends on values in RAM

It gets loaded from RAM, Idk where it is set.
Hmm, the VaryTable & VaryServo probably have some relationship with the commands fanservo and fanservostat, the wiki is oflline right now but as far i remember they was mentioned as "does nothing"... but im wondering if it was not doing anything because whoever that tryed them was not adding the subcommands ("get" or "getini" etc...)

---------------
I noticed you also added a few more to the list in your previous post that worths to be commented
Code:
fantbl getselect [0-8]
This one is related with the value located at the end of each fantable named "select" in the code struct ? (inmediatly after the "policy" byte) ?
Have you tryed it with the subcommand "getiniselect" ? (specific to indicate that is reading it from the eeprom)
Also, have you tryed "getactive" ?, and "getiniactive" ?
This strings doesnt appears in the firmware dumps for retail, but dunno, maybe the firmware is patching them to make them availables, or are availables for you in cytology

---------------
Code:
diag fan_shutdowntime getini
This is the value you was commenting before, with a 10s delay to stop the fan after PS3 enters in standby, right ?
The interesting thing is the existence of the "getini" subcommand seems to indicate that this value could be stored in eeprom inside the "thermal config" area
Also, because is something generic (not specific for a fantable) it should be stored at the end of the thermal config, in the area named "special_section" of your code struct
Also, because is a "time" most probably is located next to the other "tshutdowntime" (both are times)
And finally... in the firmware strings, and in the UART terminal logs you posted the other day it can be seen it have a lenght of 1 byte

All and all... i guess is the "unknown0" in your code struct, located inmediatly after the "thermal_shutdown_time", and always =0x00 in all retail PS3 models (disabled for retails)
It smells like that, see how well it fits into the struct, it really looks like this is his natural position :)
Code:
struct special_section  {
	u16 thermal_shutdown_time;
	u8  unknown0;  // ? <-------------------------- fan_shutdown_time ?
	u8  initial_fan_duty;
	u8  initial_fan_time;
	...
	..
	.
 
Last edited:
Hmm, the VaryTable & VaryServo probably have some relationship with the commands fanservo and fanservostat, the wiki is oflline right now but as far i remember they was mentioned as "does nothing"... but im wondering if it was not doing anything because whoever that tryed them was not adding the subcommands ("get" or "getini" etc...)
fanservo just returns "Sorry, not suppoted." and fanservostat isn't available on Cytology.

I noticed you also added a few more to the list in your previous post that worths to be commented
Code:
fantbl getselect [0-8]
This one is related with the value located at the end of each fantable named "select" in the code struct ? (inmediatly after the "policy" byte) ?
I guess so.

Have you tryed it with the subcommand "getiniselect" ? (specific to indicate that is reading it from the eeprom)
Also, have you tryed "getactive" ?, and "getiniactive" ?
This strings doesnt appears in the firmware dumps for retail, but dunno, maybe the firmware is patching them to make them availables, or are availables for you in cytology
These are all not available. I double check everything by testing them and checking the firmware.

Code:
diag fan_shutdowntime getini
This is the value you was commenting before, with a 10s delay to stop the fan after PS3 enters in standby, right ?
The interesting thing is the existence of the "getini" subcommand seems to indicate that this value could be stored in eeprom inside the "thermal config" area
Also, because is something generic (not specific for a fantable) it should be stored at the end of the thermal config, in the area named "special_section" of your code struct
Also, because is a "time" most probably is located next to the other "tshutdowntime" (both are times)
And finally... in the firmware strings, and in the UART terminal logs you posted the other day it can be seen it have a lenght of 1 byte

All and all... i guess is the "unknown0" in your code struct, located inmediatly after the "thermal_shutdown_time", and always =0x00 in all retail PS3 models (disabled for retails)
It smells like that, see how well it fits into the struct, it really looks like this is his natural position :)
Code:
struct special_section  {
    u16 thermal_shutdown_time;
    u8  unknown0;  // ? <-------------------------- fan_shutdown_time ?
    u8  initial_fan_duty;
    u8  initial_fan_time;
    ...
    ..
    .
The special section differs between Cookie and Cytology, so it doesn't match.

That might be interesting, I found it in my notes, it maps the fantbl number to the thermal sensor id and the eeprom region:
Code:
Cytology
0 -> 0x00: 0x3B00 "1st BE Primary"
1 -> 0x01: 0x3B40 "RSX Primary"
2 -> 0x20: 0x3B80 "? (no name)"
3 -> 0x21: 0x3BC0 "? (no name)"
4 -> 0x02: 0x3C00 "XDR Primary"
5 -> 0x14: 0x3CC0 "SB"
6 -> 0x0F: 0x3C80 "GbE"
7 -> 0x0A: 0x3C40 "Air Intake"

Cookie OLD
0 -> 0x00: 0x3300 "1st BE Primary"
1 -> 0x01: 0x3340 "RSX Primary"
? -> 0x03: 0x3380 "BE VR"
3 -> 0x14: 0x33C0 "SB"
? -> 0x15: 0x3400 "EE+GS"

Cookie NEW
0 -> 0x00: 0x3300 "1st BE Primary" 
1 -> 0x01: 0x3380 "RSX Primary"
? -> 0x14: 0x3400 "SB"
To solve the ? on Cookie just need to do some testing (change a value in the region and try different fantbl numbers to find it). The missing numbers (like 8 on Cytology) are generated by the firmware and not read from the EEPROM.
 
fanservo just returns "Sorry, not suppoted." and fanservostat isn't available on Cytology.
Hmm, it could be one of the few cases where a syscon feature is available for retails but not for pre-retails... just because there was something related with it that was not ready for the PS3 release date
Im saying this because this commands exists even in the syscon firmware of the last superslim motherboard, as far i remember from what you wrote in wiki the first SW was missing them, but in SW2 they re-implemented one of them and in SW3 they reimplemented the other
Dunno, never minds, we are entering in tricky features and we have other more interesting things to comment :)

I guess so.
Ok,i was asking incase you had a 100% confirmation of it, but thats good enought for me
And yeah... even the syntax of the command (fantbl ---> select) looks similar to the other codenames, and it should be located inside each fantable

These are all not available. I double check everything by testing them and checking the firmware.
Ok, sorry for the brainstorming, it was just a blindshot :D

The special section differs between Cookie and Cytology, so it doesn't match.
Well, the point was that we have a unknown0 byte with value 0x00 in retails that seems to be inherited from pre-retails, the fact that is 0x00 means that is something otherway it would be 0xFF (that uses to represent an "erased" byte that never was written), sony likes it because exits up to the last superslim motherboard, actually that area of the struct had an important change specific for sherwoods (one more byte was added inmediatly after the unknown0) that created a displacement of the bytes that comes next to it
Actually... while thinking in this today i also thought maybe what they did was to increase the lenght of the "fan_shutdown_time" for sherwood to 2 bytes

That might be interesting, I found it in my notes, it maps the fantbl number to the thermal sensor id and the eeprom region:
Code:
Cytology
0 -> 0x00: 0x3B00 "1st BE Primary"
1 -> 0x01: 0x3B40 "RSX Primary"
2 -> 0x20: 0x3B80 "? (no name)"
3 -> 0x21: 0x3BC0 "? (no name)"
4 -> 0x02: 0x3C00 "XDR Primary"
5 -> 0x14: 0x3CC0 "SB"
6 -> 0x0F: 0x3C80 "GbE"
7 -> 0x0A: 0x3C40 "Air Intake"

Cookie OLD
0 -> 0x00: 0x3300 "1st BE Primary"
1 -> 0x01: 0x3340 "RSX Primary"
? -> 0x03: 0x3380 "BE VR"
3 -> 0x14: 0x33C0 "SB"
? -> 0x15: 0x3400 "EE+GS"

Cookie NEW
0 -> 0x00: 0x3300 "1st BE Primary" 
1 -> 0x01: 0x3380 "RSX Primary"
? -> 0x14: 0x3400 "SB"
Really interesting :encouragement:
Let me make an small change in the offsets to make it a bit more intuitive, im going to replace the "absolute offsets" by "relative offsets" (from the start of the thermal config area), reorder the cytology ones based in that offset, some notes, and the sherwoods
Code:
Cytology (fantbl = 0x40 size each)
0 -> 0x00: + 0x0 "1st BE Primary"
1 -> 0x01: + 0x40 "RSX Primary"
2 -> 0x20: + 0x80 "? (no name)"
3 -> 0x21: + 0xC0 "? (no name)"
4 -> 0x02: + 0x100 "XDR Primary"
7 -> 0x0A: + 0x140 "Air Intake"
6 -> 0x0F: + 0x180 "GbE"
5 -> 0x14: + 0x1C0 "SB"

Cookie OLD (fantbl = 0x40 size each)
0 -> 0x00: + 0x0 "1st BE Primary"
1 -> 0x01: + 0x40 "RSX Primary"
? -> 0x03: + 0x80 "BE VR"
3 -> 0x14: + 0xC0 "SB"
? -> 0x15: + 0x100 "EE+GS"

Cookie NEW (fantbl = 0x80 size each)
0 -> 0x00: + 0x0 "1st BE Primary" 
1 -> 0x01: + 0x80 "RSX Primary"
? -> 0x14: + 0x100 "SB"

Sherwood (fantbl = 0x70 size each)
0 -> 0x00: + 0x0 "1st BE Primary" 
1 -> 0x01: + 0x70 "RSX Primary"
? -> 0x14: + 0xE0 "?" // probably SB

Actually, your cytology have 8 fantables, if we multiply the fantable size of 0x40*8 we have the complete 0x200 bytes of the "thermal config" area used by the fantables... so the "special section" of the struct is not inside it
While thinking in what you said the other day, that the "thermal config" area in cytology is like "composed" by different pieces at runtime that are spreaded "here and there" inside the syscon firmware functions i was thinking... ok... but there is some point where the syscon firmware joins together all that datas and creates some kind of virtual "thermal config" area in RAM ?, i didnt asked you about it but now it comes ontopic
The point is... at this point we are able to generate a chunk of 0x200 bytes that represents exactly that therorethical "thermal config" area in your cytology RAM... because you can use the syscon commands that "prints" the hex values coverted to "human readable"... so we can do the conversion in opposite direction to recover the hex values, then in a hexeditor join them in his positions, etc... (and assume some of the bytes for the "active" and the not-used FF's)
After that we can check the eepcsum of the file in PC with your python script... and you can run the "eepcsum" command to compare them... and they should match
The experiment is a bit pointless (unless you find a good use for it, or to add it in the collection of thermal configs for wiki) but i guess it should work :)


To solve the ? on Cookie just need to do some testing (change a value in the region and try different fantbl numbers to find it). The missing numbers (like 8 on Cytology) are generated by the firmware and not read from the EEPROM.
The value needs to be written in the "thermal config" area or in other areas ? ("board config" area, etc...)
Im asking because it seems it needs to be made 3 times:
cookie_old = COK-001 or COK-002
cookie_new = SEM-001 or DIA-001 or DIA-002
sherwood = VER-001 or newer
 
Last edited:
Hmm, it could be one of the few cases where a syscon feature is available for retails but not for pre-retails... just because there was something related with it that was not ready for the PS3 release date
Well, Cytology and Cookie just use different commands, some aren't implemented on Cytology and some aren't implemented on Cookie, the latest Cytology syscon firmware is the latest Mullion firmware we have.

Actually, your cytology have 8 fantables, if we multiply the fantable size of 0x40*8 we have the complete 0x200 bytes of the "thermal config" area used by the fantables... so the "special section" of the struct is not inside it
The thermal config area is 0x300 bytes (https://twitter.com/MinaRalwasser/status/1214623683685310473/photo/1)
It can store 8 fan tables on the EEPROM but it does support 9 via the fantbl command, the last one isn't saved on the EEPROM, so this leaves 0x100 bytes for the special region.

While thinking in what you said the other day, that the "thermal config" area in cytology is like "composed" by different pieces at runtime that are spreaded "here and there" inside the syscon firmware functions i was thinking... ok... but there is some point where the syscon firmware joins together all that datas and creates some kind of virtual "thermal config" area in RAM ?, i didnt asked you about it but now it comes ontopic
It is there but non-continuous which means someone would need to reverse everything first.

After that we can check the eepcsum of the file in PC with your python script... and you can run the "eepcsum" command to compare them... and they should match
The eepcsum isn't implemented on Cytology.

The value needs to be written in the "thermal config" area or in other areas ? ("board config" area, etc...)
If you know e.g that table 0 ist at +0x00 and table 1 at +0x40 and you have four other tables and don't know which number they correlate to, just change one byte in one table at a time and print all the tables, that way you can identify which number belongs to the changed table.

I think that comparing all the cytology prototype firmwares might help, I'll get started with that. I know that many devs complained about the bad thermal management of the DEH-R series and Sony often tweaked that. Maybe I can build something that dumps the data from the firmware automatically. I didn't have a look at the only Cookie prototype firmware we have, maybe that references some unknown bytes.

- Edit: Added the fallback tables from the firmware, only the first 0x32 bytes of each table are used, the other values are stored somewhere else (I just filled it with FF).
 

Attachments

Last edited:
Doesnt surprises me that there was developers complaining about the thermal management of cytology firmwares, the values in that tables looks weird in many ways, if you are interested we can discuss them later, i can help you to create new tables, and i been thinking that you could create a custom syscon firmware v1.0.5c1 with them (or an automated script/tool to patch them permanently after the syscon firmware instalaltion)
I honestly think all the DECR-1000 owners should modify them, i been complaining about the retail thermal configs before but this is a new level of incompetence <facepalm icon here>

--------------
Anyway, the only thing that matters for me by now is to try to understand wich sensor is the "owner" of each table, how works the table identifyers, etc... by comparing them with your previous posts there is something that doesnt matches well, and im not sure why

The tables in v1.0.5c1.bin (and many other versions) has been "cloned", with this i mean... first they created the fantable for CELL and then they copypasted the values for the other tables (identical values for RSX and other sensors)
Basically... the values of the tables: 0,1,2,3 are identical... and 4 is unique
Code:
4D 73 99 CC FF FF FF FF FF FF 00 34 00 38 00 3C <--- relative offset 0x0
00 40 FF 7F FF 7F FF 7F FF 7F FF 7F FF 7F 00 00
00 31 00 35 00 39 00 3D 00 40 00 42 00 44 00 46
00 48 FF FF FF FF FF FF FF FF FF FF FF FF FF FF

4D 73 99 CC FF FF FF FF FF FF 00 34 00 38 00 3C <--- relative offset 0x40
00 40 FF 7F FF 7F FF 7F FF 7F FF 7F FF 7F 00 00
00 31 00 35 00 39 00 3D 00 40 00 42 00 44 00 46
00 48 FF FF FF FF FF FF FF FF FF FF FF FF FF FF

4D 73 99 CC FF FF FF FF FF FF 00 34 00 38 00 3C <--- relative offset 0x80
00 40 FF 7F FF 7F FF 7F FF 7F FF 7F FF 7F 00 00
00 31 00 35 00 39 00 3D 00 40 00 42 00 44 00 46
00 48 FF FF FF FF FF FF FF FF FF FF FF FF FF FF

4D 73 99 CC FF FF FF FF FF FF 00 34 00 38 00 3C <--- relative offset 0xC0
00 40 FF 7F FF 7F FF 7F FF 7F FF 7F FF 7F 00 00
00 31 00 35 00 39 00 3D 00 40 00 42 00 44 00 46
00 48 FF FF FF FF FF FF FF FF FF FF FF FF FF FF

4D 66 80 B3 CC FF FF FF FF FF 00 1B 00 1E 00 20 <--- relative offset 0x100
00 22 00 25 FF 7F FF 7F FF 7F FF 7F FF 7F 00 00
00 1A 00 1D 00 1F 00 21 00 23 00 25 00 27 00 29
00 2A FF FF FF FF FF FF FF FF FF FF FF FF FF FF
And syscon was displaying them like this (copyed from your previous posts)
> fantbl get 0
fantbl get 0
fancon No:00
P0: TempD:0.0(0x0000) - TempU:52.0(0x3400) duty:30%(0x4d)
P1: TempD:49.0(0x3100) - TempU:56.0(0x3800) duty:45%(0x73)
P2: TempD:53.0(0x3500) - TempU:60.0(0x3c00) duty:60%(0x99)
P3: TempD:57.0(0x3900) - TempU:64.0(0x4000) duty:80%(0xcc)
P4: TempD:61.0(0x3d00) - TempU:127.75(0x7fff) duty:100%(0xff)
P5: TempD:64.0(0x4000) - TempU:127.75(0x7fff) duty:100%(0xff)
P6: TempD:66.0(0x4200) - TempU:127.75(0x7fff) duty:100%(0xff)
P7: TempD:68.0(0x4400) - TempU:127.75(0x7fff) duty:100%(0xff)
P8: TempD:70.0(0x4600) - TempU:127.75(0x7fff) duty:100%(0xff)
P9: TempD:72.0(0x4800) - TempU:127.75(0x7fff) duty:100%(0xff)
> fantbl get 1
fantbl get 1
fancon No:01
P0: TempD:0.0(0x0000) - TempU:52.0(0x3400) duty:30%(0x4d)
P1: TempD:49.0(0x3100) - TempU:56.0(0x3800) duty:45%(0x73)
P2: TempD:53.0(0x3500) - TempU:60.0(0x3c00) duty:60%(0x99)
P3: TempD:57.0(0x3900) - TempU:64.0(0x4000) duty:80%(0xcc)
P4: TempD:61.0(0x3d00) - TempU:127.75(0x7fff) duty:100%(0xff)
P5: TempD:64.0(0x4000) - TempU:127.75(0x7fff) duty:100%(0xff)
P6: TempD:66.0(0x4200) - TempU:127.75(0x7fff) duty:100%(0xff)
P7: TempD:68.0(0x4400) - TempU:127.75(0x7fff) duty:100%(0xff)
P8: TempD:70.0(0x4600) - TempU:127.75(0x7fff) duty:100%(0xff)
P9: TempD:72.0(0x4800) - TempU:127.75(0x7fff) duty:100%(0xff)
> fantbl get 2
fantbl get 2
fancon No:02
P0: TempD:0.0(0x0000) - TempU:52.0(0x3400) duty:30%(0x4d)
P1: TempD:49.0(0x3100) - TempU:56.0(0x3800) duty:45%(0x73)
P2: TempD:53.0(0x3500) - TempU:60.0(0x3c00) duty:60%(0x99)
P3: TempD:57.0(0x3900) - TempU:64.0(0x4000) duty:80%(0xcc)
P4: TempD:61.0(0x3d00) - TempU:127.75(0x7fff) duty:100%(0xff)
P5: TempD:64.0(0x4000) - TempU:127.75(0x7fff) duty:100%(0xff)
P6: TempD:66.0(0x4200) - TempU:127.75(0x7fff) duty:100%(0xff)
P7: TempD:68.0(0x4400) - TempU:127.75(0x7fff) duty:100%(0xff)
P8: TempD:70.0(0x4600) - TempU:127.75(0x7fff) duty:100%(0xff)
P9: TempD:72.0(0x4800) - TempU:127.75(0x7fff) duty:100%(0xff)
> fantbl get 3
fantbl get 3
fancon No:03
P0: TempD:0.0(0x0000) - TempU:52.0(0x3400) duty:30%(0x4d)
P1: TempD:49.0(0x3100) - TempU:56.0(0x3800) duty:45%(0x73)
P2: TempD:53.0(0x3500) - TempU:60.0(0x3c00) duty:60%(0x99)
P3: TempD:57.0(0x3900) - TempU:64.0(0x4000) duty:80%(0xcc)
P4: TempD:61.0(0x3d00) - TempU:127.75(0x7fff) duty:100%(0xff)
P5: TempD:64.0(0x4000) - TempU:127.75(0x7fff) duty:100%(0xff)
P6: TempD:66.0(0x4200) - TempU:127.75(0x7fff) duty:100%(0xff)
P7: TempD:68.0(0x4400) - TempU:127.75(0x7fff) duty:100%(0xff)
P8: TempD:70.0(0x4600) - TempU:127.75(0x7fff) duty:100%(0xff)
P9: TempD:72.0(0x4800) - TempU:127.75(0x7fff) duty:100%(0xff)
> fantbl get 4
fantbl get 4
fancon No:04
P0: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P1: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P2: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P3: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P4: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P5: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P6: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P7: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P8: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P9: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
> fantbl get 5
fantbl get 5
fancon No:05
P0: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P1: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P2: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P3: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P4: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P5: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P6: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P7: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P8: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P9: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
> fantbl get 6
fantbl get 6
fancon No:06
P0: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P1: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P2: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P3: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P4: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P5: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P6: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P7: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P8: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P9: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
> fantbl get 7
fantbl get 7
fancon No:07
P0: TempD:0.0(0x0000) - TempU:27.0(0x1b00) duty:30%(0x4d)
P1: TempD:26.0(0x1a00) - TempU:30.0(0x1e00) duty:40%(0x66)
P2: TempD:29.0(0x1d00) - TempU:32.0(0x2000) duty:50%(0x80)
P3: TempD:31.0(0x1f00) - TempU:34.0(0x2200) duty:70%(0xb3)
P4: TempD:33.0(0x2100) - TempU:37.0(0x2500) duty:80%(0xcc)
P5: TempD:35.0(0x2300) - TempU:127.75(0x7fff) duty:100%(0xff)
P6: TempD:37.0(0x2500) - TempU:127.75(0x7fff) duty:100%(0xff)
P7: TempD:39.0(0x2700) - TempU:127.75(0x7fff) duty:100%(0xff)
P8: TempD:41.0(0x2900) - TempU:127.75(0x7fff) duty:100%(0xff)
P9: TempD:42.0(0x2a00) - TempU:127.75(0x7fff) duty:100%(0xff)
> fantbl get 8
fantbl get 8
fancon No:08
P0: TempD:0.0(0x0000) - TempU:27.0(0x1b00) duty:30%(0x4d)
P1: TempD:26.0(0x1a00) - TempU:30.0(0x1e00) duty:40%(0x66)
P2: TempD:29.0(0x1d00) - TempU:32.0(0x2000) duty:50%(0x80)
P3: TempD:31.0(0x1f00) - TempU:34.0(0x2200) duty:70%(0xb3)
P4: TempD:33.0(0x2100) - TempU:37.0(0x2500) duty:80%(0xcc)
P5: TempD:35.0(0x2300) - TempU:127.75(0x7fff) duty:100%(0xff)
P6: TempD:37.0(0x2500) - TempU:127.75(0x7fff) duty:100%(0xff)
P7: TempD:39.0(0x2700) - TempU:127.75(0x7fff) duty:100%(0xff)
P8: TempD:41.0(0x2900) - TempU:127.75(0x7fff) duty:100%(0xff)
P9: TempD:42.0(0x2a00) - TempU:127.75(0x7fff) duty:100%(0xff)
> tzone
tzone
00: 1st BE Primary
01: RSX Primary
02: XDR Primary
0A: Air Intake
0F: GbE
14: SB

And im going to copy the list of how the fantables are mapped, ordered by "relative offset"
Code:
Cytology (fantbl = 0x40 size each)
0 -> 0x00: + 0x0 "1st BE Primary"
1 -> 0x01: + 0x40 "RSX Primary"
2 -> 0x20: + 0x80 "? (no name)"
3 -> 0x21: + 0xC0 "? (no name)"
4 -> 0x02: + 0x100 "XDR Primary"
7 -> 0x0A: + 0x140 "Air Intake"
6 -> 0x0F: + 0x180 "GbE"
5 -> 0x14: + 0x1C0 "SB"

Im not sure who is the "owner" of each fantable, if we use the "relative offset" in the files you uploaded it doesnt seems to match because are "missing" some others intermediate fantables ?
As example... the table id 7 (mapped to tzone/sensor 0xA=Air intake and active in your console) should be located at relative offset 0x140... this would mean we need to "fill the gaps" with dummy tables in the files you uploaded (with the goal of representing that "virtual thermal config" area in RAM) ?

Edit:
Is hard to explain why it looks weird to me, but another example...
When you are running the "fantbl get" command with table id's 4,5,6 syscon is displaying zeroes, so in theory... this fantables 4,5,6 are a chunk of 0x40 bytes each filled with zeroes, and loaded from the "virtual config" area in syscon RAM, right ?
 
Last edited:
Doesnt surprises me that there was developers complaining about the thermal management of cytology firmwares, the values in that tables looks weird in many ways, if you are interested we can discuss them later, i can help you to create new tables, and i been thinking that you could create a custom syscon firmware v1.0.5c1 with them (or an automated script/tool to patch them permanently after the syscon firmware instalaltion)
I honestly think all the DECR-1000 owners should modify them, i been complaining about the retail thermal configs before but this is a new level of incompetence
Seems like they only had two variants, 0.8.4 and then the later one, earlier firmwares used a different style.
It's also interesting how the Cookie tables look (k fimwares).

Anyway, the only thing that matters for me by now is to try to understand wich sensor is the "owner" of each table, how works the table identifyers, etc... by comparing them with your previous posts there is something that doesnt matches well, and im not sure why

The tables in v1.0.5c1.bin (and many other versions) has been "cloned", with this i mean... first they created the fantable for CELL and then they copypasted the values for the other tables (identical values for RSX and other sensors)
Basically... the values of the tables: 0,1,2,3 are identical... and 4 is unique

Im not sure who is the "owner" of each fantable, if we use the "relative offset" in the files you uploaded it doesnt seems to match because are "missing" some others intermediate fantables ?
As example... the table id 7 (mapped to tzone/sensor 0xA=Air intake and active in your console) should be located at relative offset 0x140... this would mean we need to "fill the gaps" with dummy tables in the files you uploaded (with the goal of representing that "virtual thermal config" area in RAM) ?

Edit:
Is hard to explain why it looks weird to me, but another example...
When you are running the "fantbl get" command with table id's 4,5,6 syscon is displaying zeroes, so in theory... this fantables 4,5,6 are a chunk of 0x40 bytes each filled with zeroes, and loaded from the "virtual config" area in syscon RAM, right ?

Yes, this is all a bit weird, there're three dummy zero tables before the last table (so there're in total 8 tables, only for the c firmware). There's also no special area in RAM, the values are spread all over the place.
Fantable 8 is only stored in RAM, it has no mapping on the EEPROM.
 
Seems like they only had two variants, 0.8.4 and then the later one, earlier firmwares used a different style.
It's also interesting how the Cookie tables look (k fimwares).
Yep, i made a list while i was comparing the fantables
Code:
v0.8.4c8.bin (CRC32: 3D64DDB7)
------------
t0 = t2
t1 = t3
t4

v0.9.13k1.bin, v1.0.0k1.bin (CRC32: 291F74B1)
-------------
t0 = t1
t2 = t3 = t4


v0.9.9c1.bin, v0.9.14c1.bin, v1.0.1c1.bin, v1.0.3c1.bin, v1.0.4c1.bin, v1.0.4c2.bin, v1.0.5c1.bin (CRC32: 75D779D9)
------------
t0 = t1 = t2 = t3
t4

The "k firmwares" uses the same fan table struct than the others (and retail COK)
It starts with
Code:
u8 duty[0xA];
u16 TempU[0xA];
u16 TempD[0xA];
The weird thing in them is the fantables 0 & 1 uses always 100% duty, and very low values for TempU and TempD
In the practise it means you turn ON the console, and after 1 minute or so you have the fan at 100% speed (and is not going to decrease speed at any point of the session)
The thermal config in syscon firmwares v0.9.13k1 and v1.0.0k1 seems to be completly nerfed

Yes, this is all a bit weird, there're three dummy zero tables before the last table
Thats what i thought but... after adding the dummy tables the offsets you posted doesnt matches, this is the v1.0.5c1.bin you uploaded with the 3 dummy tables added
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  4D 73 99 CC FF FF FF FF FF FF 00 34 00 38 00 3C
00000010  00 40 FF 7F FF 7F FF 7F FF 7F FF 7F FF 7F 00 00
00000020  00 31 00 35 00 39 00 3D 00 40 00 42 00 44 00 46
00000030  00 48 FF FF FF FF FF FF FF FF FF FF FF FF FF FF

00000040  4D 73 99 CC FF FF FF FF FF FF 00 34 00 38 00 3C
00000050  00 40 FF 7F FF 7F FF 7F FF 7F FF 7F FF 7F 00 00
00000060  00 31 00 35 00 39 00 3D 00 40 00 42 00 44 00 46
00000070  00 48 FF FF FF FF FF FF FF FF FF FF FF FF FF FF

00000080  4D 73 99 CC FF FF FF FF FF FF 00 34 00 38 00 3C
00000090  00 40 FF 7F FF 7F FF 7F FF 7F FF 7F FF 7F 00 00
000000A0  00 31 00 35 00 39 00 3D 00 40 00 42 00 44 00 46
000000B0  00 48 FF FF FF FF FF FF FF FF FF FF FF FF FF FF

000000C0  4D 73 99 CC FF FF FF FF FF FF 00 34 00 38 00 3C
000000D0  00 40 FF 7F FF 7F FF 7F FF 7F FF 7F FF 7F 00 00
000000E0  00 31 00 35 00 39 00 3D 00 40 00 42 00 44 00 46
000000F0  00 48 FF FF FF FF FF FF FF FF FF FF FF FF FF FF

00000100  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000110  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000120  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000130  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00000140  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000150  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000160  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000170  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00000180  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000190  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001A0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001B0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

000001C0  4D 66 80 B3 CC FF FF FF FF FF 00 1B 00 1E 00 20
000001D0  00 22 00 25 FF 7F FF 7F FF 7F FF 7F FF 7F 00 00
000001E0  00 1A 00 1D 00 1F 00 21 00 23 00 25 00 27 00 29
000001F0  00 2A FF FF FF FF FF FF FF FF FF FF FF FF FF FF

Compare with this and tell me who is the owner of each table
All i can tell by now is that i dont know, because i dont see any strict rule to follow
Code:
Cytology (fantbl = 0x40 size each)
0 -> 0x00: + 0x0 "1st BE Primary"
1 -> 0x01: + 0x40 "RSX Primary"
2 -> 0x20: + 0x80 "? (no name)"
3 -> 0x21: + 0xC0 "? (no name)"
4 -> 0x02: + 0x100 "XDR Primary"
7 -> 0x0A: + 0x140 "Air Intake"
6 -> 0x0F: + 0x180 "GbE"
5 -> 0x14: + 0x1C0 "SB"

And remember, we need to consider this output too from UART
> tzone
tzone
00: 1st BE Primary
01: RSX Primary
02: XDR Primary
0A: Air Intake
0F: GbE
14: SB

Command "fantbl get" with id 0,1,2,3 was displaying this:
P0: TempD:0.0(0x0000) - TempU:52.0(0x3400) duty:30%(0x4d)
P1: TempD:49.0(0x3100) - TempU:56.0(0x3800) duty:45%(0x73)
P2: TempD:53.0(0x3500) - TempU:60.0(0x3c00) duty:60%(0x99)
P3: TempD:57.0(0x3900) - TempU:64.0(0x4000) duty:80%(0xcc)
P4: TempD:61.0(0x3d00) - TempU:127.75(0x7fff) duty:100%(0xff)
P5: TempD:64.0(0x4000) - TempU:127.75(0x7fff) duty:100%(0xff)
P6: TempD:66.0(0x4200) - TempU:127.75(0x7fff) duty:100%(0xff)
P7: TempD:68.0(0x4400) - TempU:127.75(0x7fff) duty:100%(0xff)
P8: TempD:70.0(0x4600) - TempU:127.75(0x7fff) duty:100%(0xff)
P9: TempD:72.0(0x4800) - TempU:127.75(0x7fff) duty:100%(0xff)

id 4,5,6 was displaying this:
P0: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P1: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P2: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P3: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P4: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P5: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P6: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P7: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P8: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)
P9: TempD:0.0(0x0000) - TempU:0.0(0x0000) duty:0%(0x00)

id 7,8 was displaying this:
P0: TempD:0.0(0x0000) - TempU:27.0(0x1b00) duty:30%(0x4d)
P1: TempD:26.0(0x1a00) - TempU:30.0(0x1e00) duty:40%(0x66)
P2: TempD:29.0(0x1d00) - TempU:32.0(0x2000) duty:50%(0x80)
P3: TempD:31.0(0x1f00) - TempU:34.0(0x2200) duty:70%(0xb3)
P4: TempD:33.0(0x2100) - TempU:37.0(0x2500) duty:80%(0xcc)
P5: TempD:35.0(0x2300) - TempU:127.75(0x7fff) duty:100%(0xff)
P6: TempD:37.0(0x2500) - TempU:127.75(0x7fff) duty:100%(0xff)
P7: TempD:39.0(0x2700) - TempU:127.75(0x7fff) duty:100%(0xff)
P8: TempD:41.0(0x2900) - TempU:127.75(0x7fff) duty:100%(0xff)
P9: TempD:42.0(0x2a00) - TempU:127.75(0x7fff) duty:100%(0xff)
 
Last edited:
Ok, i think i got it :victorious:
Im sorry to write this long walls of texts but there is no other way to do it because is needed to consider many details and the best way to have an overal understanding of them and how are related with each others is by showing all the info together, eventually we could condensate all this info an a small table in wiki

Anyway... the only solution i see is by locating the dummy tables in this positions
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  4D 73 99 CC FF FF FF FF FF FF 00 34 00 38 00 3C <--- table=0, zone=00, 1st BE Primary
00000010  00 40 FF 7F FF 7F FF 7F FF 7F FF 7F FF 7F 00 00
00000020  00 31 00 35 00 39 00 3D 00 40 00 42 00 44 00 46
00000030  00 48 FF FF FF FF FF FF FF FF FF FF FF FF FF FF

00000040  4D 73 99 CC FF FF FF FF FF FF 00 34 00 38 00 3C <--- table=1, zone=01, RSX Primary
00000050  00 40 FF 7F FF 7F FF 7F FF 7F FF 7F FF 7F 00 00
00000060  00 31 00 35 00 39 00 3D 00 40 00 42 00 44 00 46
00000070  00 48 FF FF FF FF FF FF FF FF FF FF FF FF FF FF

00000080  4D 73 99 CC FF FF FF FF FF FF 00 34 00 38 00 3C <--- table=2, zone=20, unknown
00000090  00 40 FF 7F FF 7F FF 7F FF 7F FF 7F FF 7F 00 00
000000A0  00 31 00 35 00 39 00 3D 00 40 00 42 00 44 00 46
000000B0  00 48 FF FF FF FF FF FF FF FF FF FF FF FF FF FF

000000C0  4D 73 99 CC FF FF FF FF FF FF 00 34 00 38 00 3C <--- table=3, zone=21, unknown
000000D0  00 40 FF 7F FF 7F FF 7F FF 7F FF 7F FF 7F 00 00
000000E0  00 31 00 35 00 39 00 3D 00 40 00 42 00 44 00 46
000000F0  00 48 FF FF FF FF FF FF FF FF FF FF FF FF FF FF

00000100  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <--- table=4, zone=02, XDR Primary
00000110  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000120  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000130  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00000140  4D 66 80 B3 CC FF FF FF FF FF 00 1B 00 1E 00 20 <--- table=7, zone=0A, Air Intake
00000150  00 22 00 25 FF 7F FF 7F FF 7F FF 7F FF 7F 00 00
00000160  00 1A 00 1D 00 1F 00 21 00 23 00 25 00 27 00 29
00000170  00 2A FF FF FF FF FF FF FF FF FF FF FF FF FF FF

00000180  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <--- table=6, zone=0F, GbE
00000190  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001A0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001B0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

000001C0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <--- table=5, zone=14, SB
000001D0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001E0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
This way it fits perfect with the info you published based in your RE about how are "mapped" the table id's -> to the tzones -> to the eeprom offsets
I modifyed a bit this list, but is the same you wrote in a different format
Code:
table -> zone(name)           +offset
0     -> 0x00(1st BE Primary) +0x0
1     -> 0x01(RSX Primary)    +0x40
2     -> 0x20(unknown)        +0x80
3     -> 0x21(unknown)        +0xC0
4     -> 0x02(XDR Primary)    +0x100
7     -> 0x0A(Air Intake)     +0x140
6     -> 0x0F(GbE)            +0x180
5     -> 0x14(SB)             +0x1C0

This way the info dsiplayed with the "fantbl get" commands fits too :)
0,1,2,3 <-------- valid table
4,5,6 <---------- dummy table
7 <-------------- valid table
8 <-------------- valid table (emulated, copyed from 7)

And when you run the "tzone" command to see which ones are enabled you are getting this
> tzone
tzone
00: 1st BE Primary <----- valid table
01: RSX Primary <-------- valid table
02: XDR Primary <-------- dummy table
0A: Air Intake <--------- valid table
0F: GbE <---------------- dummy table
14: SB <----------------- dummy table

In short... your syscon is doing the thermal control for CELL and RSX only (and the 2 unknowns from tzone 0x20 and 0x21)
And additionally... is doing another "special" thermal control for the "Air intake" tzone... but this worths to be explained in another post, i just realized about something very interesting related with it
 
Last edited:
How many fans have the DECR-1000 @M4j0r ?. I know it have 2 fans at the back, for CELL and RSX
Im asking this because the thermal configs you uploaded seems to indicate that the "air intake" table belongs to a third fan, and also the name "intake" means that is located at the frontal of the console
You know... the fans at the back are "pushing" the air out of the console (so cant be considered "intakes")

Im taking a look at some photos of the DECR-1000 and i cant see any fan in the frontal panel (im not sure about it i hope you will clarify it in the next post)... so im wondering if this is something inherited from other older PS3 prototype models
Do you know if there is some other prototype PS3 models with a fan in the frontal ?

--------------------------------
There is a concept we need to keep in mind when comparing the thermal config of retail PS3 models with the other non-retails
The syscon is a microcontroller that runs a "program" to calculate the fan speed, in retail PS3 models is made by monitoring the thermal sensors (multiple "inputs"), comparing them with the values from the "thermal config" area, and based on them it generates the fan speed (a single "output")

This is why in all the official thermal configs the speeds for a table are identical to the other tables, lets say...
If the CELL table have only 5 speeds with values 0x4D -> 0x73 -> 0x99 -> 0xCC -> 0xFF
Then the table for RSX, SB, etc... needs to have exactly the same speeds
The point is... in every "step" of the progression syscon is using several thermal sensors (multiple inputs) to generate the fan speed (a single output)
Sony never broke this rule, is a "must do" for everyone reading this and thinking in creating custom thermal settings for retail PS3 models

------------------
But... now look at this, from the files you uploaded @M4j0r
Code:
v0.8.4c8.bin (CRC32: 3D64DDB7)
------------
t0 = t2 (4 speeds 80 B3 CC FF)
t1 = t3 (4 speeds 80 B3 CC FF)
t7      (4 speeds 73 99 CC FF)

v0.9.9c1.bin, v0.9.14c1.bin, v1.0.1c1.bin, v1.0.3c1.bin, v1.0.4c1.bin, v1.0.4c2.bin, v1.0.5c1.bin (CRC32: 75D779D9)
------------
t0 = t1 = t2 = t3 (5 speeds 4D 73 99 CC FF)
t7                (6 speeds 4D 66 80 B3 CC FF)

See ?, it happens in both, the table 7 is intended to control a "special" fan, because his speeds are different
And is not only that are different speeds, the last version of that thermal config even have an additional fan speed for this special fan (the standard fan have 5 speeds... but the special fan have 6 speeds)

Also, take a look at the values of TempU in the table 7 of this "special fan"
Code:
4D 66 80 B3 CC FF FF FF FF FF 00 1B 00 1E 00 20
00 22 00 25 FF 7F FF 7F FF 7F FF 7F FF 7F 00 00
00 1A 00 1D 00 1F 00 21 00 23 00 25 00 27 00 29
00 2A FF FF FF FF FF FF FF FF FF FF FF FF FF FF
0x1B = 27ºC
0x1E = 30ºC
0x20 = 32ºC
0x22 = 34ºC
0x25 = 37ºC

So we can deduce the thermal sensor "assigned" to this fan is located in an area with a temperature a lot smaller than CELL/RSX
I guess the special fan is at the front of the console "pushing" air inside it, and the sensor is next to it... so the thermal sensor is meassuring the "ambient temperature"
 
Last edited:
The "k firmwares" uses the same fan table struct than the others (and retail COK)
It starts with
Code:
u8 duty[0xA];
u16 TempU[0xA];
u16 TempD[0xA];
The weird thing in them is the fantables 0 & 1 uses always 100% duty, and very low values for TempU and TempD
In the practise it means you turn ON the console, and after 1 minute or so you have the fan at 100% speed (and is not going to decrease speed at any point of the session)
The thermal config in syscon firmwares v0.9.13k1 and v1.0.0k1 seems to be completly nerfed
These are from COK-001/COK-001 prototype, seems like they just run it at 100% in the factory lol.

In short... your syscon is doing the thermal control for CELL and RSX only (and the 2 unknowns from tzone 0x20 and 0x21)
And additionally... is doing another "special" thermal control for the "Air intake" tzone... but this worths to be explained in another post, i just realized about something very interesting related with it
Zones 0x20 and 0x21 don't map to any real sensor, I guess they are either dummy or created on the fly, like fan table 8.

How many fans have the DECR-1000 @M4j0r ?. I know it have 2 fans at the back, for CELL and RSX
Im asking this because the thermal configs you uploaded seems to indicate that the "air intake" table belongs to a third fan, and also the name "intake" means that is located at the frontal of the console
You know... the fans at the back are "pushing" the air out of the console (so cant be considered "intakes")
It does have three in the front (radial fans which are under the hdds) and the two axial fans at the back:
Code:
> diag fan_info all
diag fan_info all
FanInfoBE: Duty 0 [%] Rev 0 [rpm]
FanInfoRSX: Duty 0 [%] Rev 0 [rpm]
FanInfoFRONT: Duty 0 [%] Rev 0 [rpm]
FanInfoREAR1: Duty 0 [%] Rev 0 [rpm]
FanInfoREAR2: Duty 0 [%] Rev 0 [rpm]
The FRONT Fan cools the SC, SS2, XDR and CP stuff.

But... now look at this, from the files you uploaded @M4j0r
Code:
v0.8.4c8.bin (CRC32: 3D64DDB7)
------------
t0 = t2 (4 speeds 80 B3 CC FF)
t1 = t3 (4 speeds 80 B3 CC FF)
t7      (4 speeds 73 99 CC FF)

v0.9.9c1.bin, v0.9.14c1.bin, v1.0.1c1.bin, v1.0.3c1.bin, v1.0.4c1.bin, v1.0.4c2.bin, v1.0.5c1.bin (CRC32: 75D779D9)
------------
t0 = t1 = t2 = t3 (5 speeds 4D 73 99 CC FF)
t7                (6 speeds 4D 66 80 B3 CC FF)

See ?, it happens in both, the table 7 is intended to control a "special" fan, because his speeds are different
And is not only that are different speeds, the last version of that thermal config even have an additional fan speed for this special fan (the standard fan have 5 speeds... but the special fan have 6 speeds)

Also, take a look at the values of TempU in the table 7 of this "special fan"
Code:
4D 66 80 B3 CC FF FF FF FF FF 00 1B 00 1E 00 20
00 22 00 25 FF 7F FF 7F FF 7F FF 7F FF 7F 00 00
00 1A 00 1D 00 1F 00 21 00 23 00 25 00 27 00 29
00 2A FF FF FF FF FF FF FF FF FF FF FF FF FF FF
0x1B = 27ºC
0x1E = 30ºC
0x20 = 32ºC
0x22 = 34ºC
0x25 = 37ºC

So we can deduce the thermal sensor "assigned" to this fan is located in an area with a temperature a lot smaller than CELL/RSX
I guess the special fan is at the front of the console "pushing" air inside it, and the sensor is next to it... so the thermal sensor is meassuring the "ambient temperature"
That's interesting, yes, I think it should be the air intake sensor.
 
Zones 0x20 and 0x21 don't map to any real sensor, I guess they are either dummy or created on the fly, like fan table 8.
Maybe are the thermal sensors inside the hdd's, all the hdd's have a thermal sensor and is posible to get his value with ATAPI commands as far i remember
Lot of time ago (with other people) we was trying to get the the hdd temperature in a retail PS3 from gameOS but we never figured how to do it
Maybe the DECR-1000 is doing it, and the syscon is not giving any name to them because are external sensors that doesnt belongs to the sony design... i mean... the thermal sensors inside the hdd's are not considered "system thermal sensors"
Other alternative is that are in the motherboard and belongs to the fans dedicated to the hdd's

It does have three in the front (radial fans which are under the hdds) and the two axial fans at the back:
Code:
> diag fan_info all
diag fan_info all
FanInfoBE: Duty 0 [%] Rev 0 [rpm]
FanInfoRSX: Duty 0 [%] Rev 0 [rpm]
FanInfoFRONT: Duty 0 [%] Rev 0 [rpm]
FanInfoREAR1: Duty 0 [%] Rev 0 [rpm]
FanInfoREAR2: Duty 0 [%] Rev 0 [rpm]
The FRONT Fan cools the SC, SS2, XDR and CP stuff.
3 fans in the front ?, 2 for the hdd's and 1 more common ?
The names doesnt match very well, "FanInfoFRONT1" and "FanInfoFRONT2" (for hdds) and "FanInfoFRONT" (common) would fit better
Dunno, just brainstorming
That's interesting, yes, I think it should be the air intake sensor.
At this point i would bet is it, is one (or several) of the fans in the front
The weird thing is syscon is "cloning" table 7 for 8... and this does a total of 2 fans or hdd's (but you said there are 3 fans in the front)
Dunno, just more brainstorming, from this point i cant deduce any more details from the DECR-1000 thermal configs
 
Maybe are the thermal sensors inside the hdd's, all the hdd's have a thermal sensor and is posible to get his value with ATAPI commands as far i remember
Lot of time ago (with other people) we was trying to get the the hdd temperature in a retail PS3 from gameOS but we never figured how to do it
Maybe the DECR-1000 is doing it, and the syscon is not giving any name to them because are external sensors that doesnt belongs to the sony design... i mean... the thermal sensors inside the hdd's are not considered "system thermal sensors"
Other alternative is that are in the motherboard and belongs to the fans dedicated to the hdd's
The tzone command doesn't list 0x20 and 0x21 and you can't read any temperature from them.
Syscon says these are invalid.

3 fans in the front ?, 2 for the hdd's and 1 more common ?
The names doesnt match very well, "FanInfoFRONT1" and "FanInfoFRONT2" (for hdds) and "FanInfoFRONT" (common) would fit better
Dunno, just brainstorming
The fans are under the hdds/bd drive and don't cool the hdds.
TMU-520_1-871-645-11_A.jpg

The weird thing is syscon is "cloning" table 7 for 8... and this does a total of 2 fans or hdd's (but you said there are 3 fans in the front)
Dunno, just more brainstorming, from this point i cant deduce any more details from the DECR-1000 thermal configs
Fantable 8 is also assigned to thermal sensor 0x0A (AirIntake).

--
This is the Cytology special_section: https://pastebin.com/MVvdAac5
 
Last edited:
This is the Cytology special_section: https://pastebin.com/MVvdAac5
Cool, i was really interested to take a look at that to see where is located the value "fan_shutdown_time" and im happy to see is close to the position i was speculating before
The structure of this special section is not exactly the same than retails... but yeah, is located after the "thermal_shutdown_time" :)

Btw, there are a couple of offsets at the end that seems to be misaligned:
0x3D60 + u8 = 0x3D61 (instead of 0x3D62)
0x3D6A + u16 = 0x3D6C (instead of 0x3D6B)
 
@M4j0r im reviewing some of the files uploaded by vyktor and i realized there is a line in the Dumping the SW NVS python script that is not printing the info correctly
See this image from a REX-001, is just printing "Version: S1E" (instead of the real version)
info1.jpg


Is this line in the python script
Code:
print('Version: ' + ps3.command('VER')[1][0])
Is better to use the command "version" instead of "VER", and it could be nice if you add another line to print the "revision"
Pretty much the same identifyers we are adding in the thermal config examples in the other wiki page
E.g. In REX-001 the dumping script should display this 2 values:
Code:
> revision
# Revision = 2468(09A4)

> version
# Sherwood Version = 2.21.0
 
Last edited:
@M4j0r im reviewing some of the files uploaded by vyktor and i realized there is a line in the Dumping the SW NVS python script that is not printing the info correctly
It's just meant to run any command to see if the connection is working, not to actually print anything useful.
I can change it as soon as I test something on a Sherwood syscon.

Btw, is this confirmed:
https://www.psdevwiki.com/ps3/index.php?title=HDMI&type=revision&diff=59232&oldid=28326 ?
I can't find any CEC handling code in the SW(1). That's probably also why they added the extra flash space to the SW2/SW3.
 
It's just meant to run any command to see if the connection is working, not to actually print anything useful.
I can change it as soon as I test something on a Sherwood syscon.
I was about to edit the python script in the wiki page in a noob way (just replacing the "VER" by "version") but this was not going to do a pretty printing (like the cleanup with the "split" you did in the CXRF), and i dont want to get in your steps so i prefered to mention it to you
The other info line i suggested to add with the "revision" is going to be handy too, that 2 identifyers are important

Btw, is this confirmed:
https://www.psdevwiki.com/ps3/index.php?title=HDMI&type=revision&diff=59232&oldid=28326 ?
I can't find any CEC handling code in the SW(1). That's probably also why they added the extra flash space to the SW2/SW3.
Well, in that edit i added several infos, the existence of the MN8647091A is confirmed here by @DoublesAdvocate
https://www.psdevwiki.com/ps3/index.php?title=MN8647091&diff=57358&oldid=55620
And the support in syscon firmware here (at least since SW2-301)
https://www.psdevwiki.com/ps3/Talk:HDMI

The existence of some CEC functions inside the sherwoods syscon firmwares... is because the syscon firmware contains a lot of functions related with HDMI and a lot of text strings that mentions the CEC word, i was not looking for it but it called my attention, that day i was burning my eyes in the hexeditor trying to find interesting strings in a few of the "full" syscon dumps samples you and zecoxao provided but right now im not sure if i was looking at a dump from a "SW series" i have a mess of files
Anyway, what i wrote about the CEC support is based on your files, so if you dont see any support in your "SW series" files is needed to revert that sentence to "support for CEC Commands since PS3 Slim models"
 
I have seen that VER in first place but didn't ask because I have understand that isn't a real command inside syscon. Would be nice to get each version or revision in first place if possible.
Rex 001 and Pqx001 have both MN8647091A, while NPX001 is Without A on the end
01ce1d1a69e5a223cabdbd3bbb59773a.jpg
3d8ed2886ad91bba6099fd5248bb2cb4.jpg
f64ca6f0684e984df220a1ebbc4eed47.jpg



And MSX001 is without A model.
c47b0c6fc1f92e3b456ebc5deaa2a1c0.jpg


Another Kte001 quick viewing is without A, another jsd001(3.50 minfirmware) without A.
 
Last edited:
The existence of some CEC functions inside the sherwoods syscon firmwares... is because the syscon firmware contains a lot of functions related with HDMI and a lot of text strings that mentions the CEC word, i was not looking for it but it called my attention, that day i was burning my eyes in the hexeditor trying to find interesting strings in a few of the "full" syscon dumps samples you and zecoxao provided but right now im not sure if i was looking at a dump from a "SW series" i have a mess of files
Anyway, what i wrote about the CEC support is based on your files, so if you dont see any support in your "SW series" files is needed to revert that sentence to "support for CEC Commands since PS3 Slim models"
There're definitely no CEC commands inside the SW-301 firmware and also Sony says that CEC is only supported on CECH-20XX+: https://manuals.playstation.net/document/en/ps3/3_15/settings/ctrlhdmi.html .

Rex 001 and Pqx001 have both MN8647091A, while NPX001 is Without A on the end
And MSX001 is without A model.
Another Kte001 quick viewing is without A, another jsd001(3.50 minfirmware) without A.
Normally the A suffix is used for chips from a better bin (which means extended specification), but Idk about Panasonic.
 
There're definitely no CEC commands inside the SW-301 firmware and also Sony says that CEC is only supported on CECH-20XX+: https://manuals.playstation.net/document/en/ps3/3_15/settings/ctrlhdmi.html .
Ok, i reverted that sentence in the HDMI page and also added a link to the official manual incase someone else have doubts about it

@vyktormvmpay25 thx, i updated the table in the HDMI page with the PS3 models you mentioned, updated the Panasonic MN8647091 and created a new page for the Panasonic MN8647091A with one of your photos :encouragement:

Btw, the photo of the REX-001 had lower quality but is interesting because it can be seen there are 8 lines that goes directly to the HDMI connector (pins# 10,12,14,16,18,20,22,24)
We dont have the pinout of that chip in wiki, but at least this 8 pins are easy, it could be interesting for repair purposes because sometimes the owner of the PS3 ripped off the HMDI connector by pulling laterally from the cable, it can be checked with a multimeter, also it seems the 8 lines goes throught 2*4 resistor arrays (or diode arrays), thats another thing easy to check incase of having a black screen
 

Similar threads

Back
Top