PS3-HW This PS3 was thrown out of a building. I want to attempt an impractical repair.

Which Console are you inquiring about?
PlayStation 3 Slim CECH-2008B

khubik

Forum Noob
Hello PSX-Place.
One day, after coming back from McDonalds, someone threw a PS3 out of an apartment building.
No one came down to pick it up, so I thought this would be a fun experiment to see if there's something that can be salvaged from it.
It looked hopeless at first - the BD drive, PSU, exterior shell were totaled, however the hard disc survived and the board migh not actually be a lost cause since the only part of the board that experienced considerable delamination, breaking and possible multi-layer shorts is the area underneath the bluetooth module and I/O ports (but not the ports themselves).
This PS3 is a CFW-able Slim, CECH-2008B, DYN-001 board.
1780770064695.png
Since the damaged areas did ot contain any ICs, I proceeded to trim the board, removing the damaged parts. I know that this is a 6-layer board and trimming that is uncommon, but I made sure to sand the edge thoroughly, hopefully preventing the board layers from shorting.
1780770318015.png
1780524256535687 conv.jpg
After making sure that a limited nubmer of voltage lines (DC-DC converter output caps, voltage lanes that feed the Panasonic MN8647091 HDMI and CXM4027R video encoder chips, RSX and BE VCOREs (TOKINs and VRM outputs) were not shorted to ground and that any of the Vcores were not short to other power lanes, which would obviously kill the chips instantly, I tried to power the board.
I powered this board with an ATX power supply, following this guide.

Thankfully, there was no smoke. However, the bringup was unsuccessful. Syscon diag is as follows:
Code:
>$ bringup

00000000
OK 00000000
# [SSM] Bringup Start.

>$ shutdown

00000000
# [PowSeq] Error:8302
# [SSM] PS0 ng.
# [SSM] Cond/Fatal received, msg=24D0.
# [SSM] Fataldown Start.
# [SSM] Fataldown ok.
# (PowerOff State) (Fatal)
NG E00000E0
# [SSM] Clearfatal Start.
# [SSM] Clearfatal ok.
# (PowerOff State)

Press Ctrl+C to exit

>$ errlog
00000000
# CODE     CLOCK
# A0092124 FFFFFFFF
# A0092114 FFFFFFFF
# A0002024 FFFFFFFF
# A0902024 FFFFFFFF
# A0902024 FFFFFFFF
# A0902024 FFFFFFFF
# FFFFFFFF FFFFFFFF
...
# FFFFFFFF FFFFFFFF

These errors are, as far as I'm concerned, is either indicative of unresponsive HDMI/AV chips, or it's indicative of failure to provide analog voltages required to power them. I'm not too sure, I've read Felix's guide on the startup sequence but I'm still unsure if this error is being caused by abscence of/poor voltages produced on stage 09 and whether or not there errors are diagnostic at all in case of a board that's been abused like that...
I did check the I2C line between the Syscon and the HDMI, VCE chips, it appears to be continuious but it could be missing some pull-up, I don't think I know how to check for that at the moment.

I can say with confidence that Mitsumi 348A voltage regulator is outputting desired voltages for the Panasonic HDMI chip.
HDMI 3.3V <-> GND - ~3.4 kOhm
HDMI 1.2V <-> GND - ~3.2 kOhm
Across - killoohms range

About the VCE... not so sure. I can see a voltage spike on the output of the regulators on the back side of the board that feed this chip and I can confirm that they have continuity to the VCE power inputs however the console doesn't supply there voltages long enough for my multimeter to get a clear reading.
DVE_VCC1 <-> GND - 307 Ohm
DVE_VCC2 <-> GND - 86 Ohm
I'm almost positive that the square voltage regulator is of BD35287 family (datasheet) and that it produces 1.5v. Could DVE_VCC2 be +1.5V_RSX_VDDIO?
Not sure about the beefy VREG that produces DVE_VCC1. +3.3V_ANA perhaps?
1780657689059639 conv.jpg

Also, error 2114 is intermittent. I assume this is a clockgen error?
Voltage line above clockgen (test point) measures at around 387 Ohm to GND. I assume this is +1.5_AVCG_VDDIO?

I know this repair is WILDLY impractical, but I want to attempt it and keep this PS3 as a keepsake due the circumstances under which I found it.
That being said, what would be my next best course of action if I'm dead hard on bringing this board up and not scrapping it for a Frankenstein which I don't have the BGA rework station for?
I did some probing around the voltage supply of HDMI/VCE chips, I'm hoping to document it on PS3 dev wiki once I'm done with this board.
Thank you in advance for your help!

I've checked all the voltages on SW_08_A, B and CC according to COK and SEM service manuals, they seem to briefly appear and I'm positive they're not short to ground. Is it safe to assume the probem is probably occurring in tha later power stages, outside of POST step 09?

https://www.psdevwiki.com/ps3/Syscon_Error_Codes
I missed one possible explanation for my error codes.

A0A02024 Occurred in a KTE-001 with a failed Bluetooth/Wifi module step-up voltage converter. A0002024/A0002124/A0003001 occured when attempting to power without 12v connected. A0A02024 also recorded. When 12v was connected the same codes would occur at step no. 09 instead of 00. 2024 replaces HDMI encoder, 2124 replaces AV, completed.

Needs more sanding around the wi-fi chip? Missing feedback to syscon from the voltage regulator?

After reverse engineering the firmware, I'm positive that Error 8302 from PowerSeq is indicative of lack of response on I2C/SMBus from some chip that gets tested second. Snooping on the I2C line confirms this and reveals the following:
Code:
write to 0x69 ack data: 0x00
read to 0x69 ack data: 0x08 0x00
write to 0x69 ack data: 0x00 0x01 0x00
write to 0x69 ack data: 0x01
read to 0x69 ack data: 0x08 0xFE
write to 0x69 ack data: 0x01 0x01 0x02
write to 0x69 ack data: 0x02
read to 0x69 ack data: 0x08 0xB4
write to 0x69 ack data: 0x02 0x01 0xA0
write to 0x6C nak
I can confirm that 0x69 is the CDC971 TI reference clock generator.
When the line MK_I2C line (SDA0, SCL0) are short error 8301 is produced instead.
 
There are three clock generators that communicate with the Syscon over the MK_I2C (SDA0, SCL0) line:
Reference Clock generator (1): ICS 1493DG - Pin compatible wit TI 99CN2JT (CDC971)
RAM (XDR) Clock generator (2): ICS 9249AGLF - Pin compatible with TI 95C31LK (C5714)
RSX/BE/SB clock generator (3): Possible generic of ICS 9214DGLFT? (TI C5704A)
DYN-001 deviates from the leaked COK/SEM service manuals, unifying IC5002 and IC5003 into a single TSSOP-48 chip (2).

After more investigation, it was discovered that+2.5V_LREG_XCG_500_MEM was not making it to chip (2), causing a
# [PowSeq] Error:8302
on startup and an A0092114 error in the errlog.
Failure to communicate with the reference clock generator (1) would produce A0022124 instead.

However, I'm now experiening 2024, 2124, 3034 and 4403 errors; the board fails PowerSeq ps3 unless pressure is applied to CELL/BE which strongly suggest that the drop caused BGA failure. It can't be said for sure whether the impact resulted in cracked solder balls or damaged traces.
I also speculate that 2024/2124 errors are BGA in nature too so I'll have to desolder the chips and inspect the damage underneath. At that point, if none of the traces on the RSX itself are damaged, it might be worth trying to procure a back-compat PS3 with a bump failure.

I don't have a BGA rework station or a mastery to use one, so I'm putting this repair on indefinite hold unless I can procure a BGA rework station or find an alternate way to preheat the board and pull the chips cleanly with the limited reources that I have, and, in that regard, I'm open to suggestions.
I've thought about something as ridiculous as crafting a preheater table using clothes irons as heating elements, off-the-shelf thermal couples, DIY controller and an IR top heater meant for BGA rework stations (which is surprisingly cheap) but I doubt something like that is cost-effective and going to heat the board evenly. Then, there's also the need of making a jig to keep the board flat and steady.. sounds like a huge pain.
 

Similar threads

Back
Top