Switch with water damage noch longer starting, 1V3 Rail missing at Max77620

Nintendo Questions Nintendo Switch
1

Hey guys,

I have a Mariko switch in front of me that has a lot of water damage (maximum in the area of the Max77620).

After cleaning with isopropanol + inspection with a microscope, I noticed that the background flat cable is damaged (but can be fixed with a repair pad). The LCD connector had a bent pin, but I was able to straighten it under the microscope.

USB port is adequate after testing with the help of a breakout board.
The switch also charges the battery when connected to the power supply.

However, when measuring the Max77620, I noticed that the 1.3V rail is not present, the 1.0 rail is at approx. 0.8V, the rest looks ok.

When I connect the switch to the lab power supply with 4.2V via VBAT, it draws 0.046A.

Since I didn’t get any further with the information from Retrosix, I wanted to ask here if anyone else has any ideas.

Thank you very much.

2

I have an OLED with the same symptoms. I’m measuring 10 ohm from the 1.0V output to ground, and it sits at 0.85V when powered on. I’m assuming voltage is being pulled down by this partial short.

I’m also missing the 1.3V rail but perhaps it doesnt get far enough into the boot sequence to bring this one up yet.

Did you resolve your issue?

3

0.6V to 1.25V is all within range and is completely fine.(all dependent on the board revision and/or power saving) so don’t go down that rabbit hole. 1V35 bing missing could literally be anything unfortunately, the rail order changed when Mariko revs came about… could be EMMC, fuel guage, or pretty much anything else which should come up prior to this rail.

4

Oh - awesome - thank you! The 10 ohm resistance to ground though - that seems low? I don’t have another board for reference unfortunately.

So EMMC and fuel guage would be first contenders - I’ll have a look around that area.

5

Does seem a hair low, if i remember right I’d typically measure something like 20 something ohms on a Mariko rev (someone correct me if I’m remembering wrong), but might just be your meter or board variation. This was measured with black probe on ground right?

btw I am jumping to the conclusion that you have a Mariko Rev based on the missing 1V35 rail as it’s very common there, if it’s not a Mariko rev then you have a very rare fault and this changes what I mentioned above, if you can confirm.

Yeah they’d usually be my first port of call, might also wanna just provide some hi-res photos in good lighting front and back of the board, something might jjump out :slight_smile:

6

Ok so let me fill you in on the back story. This was a new Zelda OLED switch that my son purchased, and we were installing a picofly. Its the second one we have attempted to mod (first one was successfully modded) but we have attempted it via a different method.

The first one we removed the EMMC, soldered a pad strip to DAT0, and re-installed it. we soldered the CLK line to the via that is sort of hidden underneath the edge of the CPU shield.

This one though, my son purchased a little adapter that breaks out CLK, DAT0, CMD. You solder the adapter down, then the EMMC onto the adapter.

I reballed the adapter and soldered it down however I did not check for shorts (lesson learned). I solded the EMMC down and attempted to power it up. Nothing.

I checked for shorts (too late) and there was a short (0 ohm) across the VCC (may have been VCCQ though - I cant quite recall which of the caps around the EMMC I checked).

Pulled the board off, cleaned the pads and short was gone.

Now this little adapter didnt have all the EMMC pads on it - they left a few off where they ran traces out for CLK and CMD and what I think may have happened after reballing is that I may have missed a ball that had no pad and it would have migrated when reflowed and created a short.

We then found a project for a different adapter that had all the pads on it, modified it to bring out VCC and GND as well, and then had it made by JLC. Having all the EMMC pads made it easy to install the solder balls. No need to pluck out any extras!

Before installing it I took diode mode readings on all the EMMC pads on the motherboard (I have this in an excel file that I can share) so I could retest after soldering the adapter board down.

This time it all went well - I retested all the same points on the adapter after reflowing it onto the board - all pins connected and no shorts on the EMMC power rails VCC,VCCQ,VCCI (tested on the caps around the EMMC). Reballed the EMMC and tested it in an adapter, then soldered it down.

And that is where we are up to. Picofly gives short-long-short error.

What supplies VCCQ rail and the VCC for the EMMC? Are there any SMD fuses? I’m hoping somerthing other than the CPU has died due to a shorted power rail.

Thats when I found the low resistance and the low voltage and missing 1V3.

7

Oh and yes sorry - black probe to ground was used for resistance measurements.

8

Ah I see, in the case of OLED rev 10ohms on this rail might be about right (would make sense, effeciency generally goes up following each revision and as a result resistance to ground typically goes down) though perhaps someone can confirm.

So If I understand correctly, this is an intermediary board in which you place the EMMC on top of and then that onto the mainboard to breakout the needed minimum lines for the modchip? or is this one of those one which you slip in during reflow of the IC? and from what I can tell you’ve now pulled the EMMC off and attempted to reball it and put it back on the board now without this intermediary adapter right? if yes, how are you reballing the EMMC IC, stencils and paste, or preformed balls? When you say tested the EMMC in an adapter are we still talking about the intermediary board or a PC SD style adapter to ensure read/write functionality?

Either way, I think you have an EMMC related issue in some form or fashion, maybe the IC itself of maybe corruption of boot0/1. the latter case your going to need the modchip to recover from and in the first case your pretty stuck without a full EMMC backup.If you have a backup and/or you have the ability to read/write to the EMMC on PC then you have other options to potentially resolve boot0/1 issues without the modchip (which I’d reccommend doing without the modchip to begin with if your able to to take it out the equation, that includes the intermediary board)

failing that and if it’s case two, and assuming your confident enough to do this, I’d reball the EMMC and manually solder up a line to dat0 prior to placing the reballed IC, I’m pretty sure all other required lines are easily accessible elsewhere on the board (sorry not done this mod on an OLED myself so correct me anyone if I’m wronig) and then go from there.

Pretty sure @jkyoho guided someone on this recently so he’d know better than me

If were talking about the EMMC rails, then VCCQ = 1V8PDR and VCC = 3V3PDR, 1V8PDR is provided by the main PMIC Max77620 and I don’t remember if the OLED still uses the ENXX IC for 3V3PDR or some other IC variant, sorry been a while since I looked at an OLED.

Also worth noting, that it’s also possible the modchip is damaged in addition, hard to tell.

Hopefully @jkyoho can set me straight if I’m wrong on any of the above.

9

YES, 1.8v from the 77620H, and OLED has no ENXX ic but max77801,top side near ALC audio chip, to generates 3.3v from Vsys.
I would say emmc maybe bad, to do further test may require more tools like bench PSU and emmc programmer. In this case, put solder emmc back and check the board stage is only thing can do IMO.

10

At the moment the new adapter is installed (the one which I tested all the pins to ensure that there was continuity from adapter to motherboard before installing EMMC).

This is an intermediary adapter as you said.

I do have a full backup of the EMMC though as well. Its the original adapter that we thought may have done the damage with a loose ball causing a power rail short, not the adapter that is currently installed. This one is a much better design and reflowed nicely and was fully tested before the EMMC went down.

The EMMC was dropped into an adapter and put into the computer to verify that all partitions could be read after it was reballed.

The original EMMC is Hynix - we replaced it with a samsung part so the EMMC that is currently on the board is a blank one. We were going to restore the backup once picofly was running. I could also take it back off, and program it before reballing and reinstalling.

I will check the voltages around the EMMC caps and check that I have the 3V3 rail from the MAX77801 - perhaps that was damaged from the short and the EMMC is not powering up now?

Everything was reballed using preformed solder balls with a jig and stencil for placement. Flux the chip (spread it super thin), place all the balls using the stencil, remove the stencil (carefully!), reflow the solder balls with super low air speed initially till they set in position, reflux with high airspeed.

This is good info. Thank you all for your help so far :slight_smile:

11

Nice move, Hynix tends to shit out overtime/heat. I heard even blank emmc could boots to Hekate(never tried myself). Since you having short long short error(= No eMMC block 0 read (eMMC init failure?)), maybe checking intermediary adapter pads diode reading just in case?

12

Great :+1:

I guess these are an open source design and all specifications are laid out for you to order the correct board thickness etc from JLCPCB? I only mention this as I have seen just how sensistive these EMMC IC are to interference when deadbugging them, if you look at the EMMCs up close, on the underside of them you’ll see what I can only describe as voodoo faraday shielding trace layout (of course not the right terms I’m sure, not my area) but suffice to say, if the intermediary adapter isn’t doing this also, then your going to cause interference and possibly R/W errors, of course maybe not enough to cause it to not work, but thought I’d mention this.

I think if it were me, I’d be ruling things out and retracing my steps, so I’d probably remove the intermediary board and ensure I can still boot stock standard with the original EMMC or new EMMC with original data and then go from there.

Definately possible, back on the prior board revs ENXX IC was pretty resilient though, but perhaps MAX77801 is a bit more sensitive, so worth checking :slight_smile:

Good stuff :+1: Just double checking, amount of times I’ve heard “I just tinned it with my iron” so wanted to make sure :wink:

13

I’ve pulled the EMMC, and re-tested the adapter connection - that is all good. I’ll reball the EMMC and try again, after which I’ll try as you suggest - back tracing the steps and removing the adapter as well.

I do have a power supply (Siglent one) than I could use to power the board and check currents - I’ll have to read up on that procedure and what I should expect to see. Perhaps I’ll try that before pulling the adapter.

Thanks again for all the help.

14

An update on this. We wrote the backup to the blank samsung eMMC, reballed it, and re-installed it. Same error on the picofly (short-long-short).

Then we tried another picofly and got a different error - this time it was long-long-short (always reach BCT check).

Out of interest we installed a new RP2040 chip on the picofly that we were using originally (in case it was damaged) but that made no differnce (still the short-long-short error). Thats when we found it had incorrect resistor installed - it had a 470ohm on the clock. Swapped that out for 47 ohm and now that picofly was now consistent with the new one (long-long-short error).

So, we installed the low voltage mod (I2C bus wires), and whilst very unstable it was able to glitch and everything worked!

So the next thing we need to do is find a more stable setup for the mosfet for the glitch. We are running a single mosfet on the eMMC side of the board - we dont want it under the CPU shield if that can be avoided.

The flex boards seem to tap into 2 rails on the CPU - is that correct? And can these rails be tapped from the back side of the board. Anyone know what rails they are glitching?

Oh and BTW we had access to another OLED board took some resistance measurements on the 1V0 - it was the same (10 ohms).

Cheers,
Dean

15

if you have 470 ohm on CMD, you might also have dat0 and clk on 470 ohm as well. check them and replace accordingly.

glictching happens on the 0.8v rails for v2/oled

16

The two cap on Cpu being solder with the mosfet flex are in the same 0.8v rail .

17

A lot of this line termination / impedence matching is poorly understood by the modding community… not that I’m an expert or anything but what I’ll say is based on my limited knowledge is that some of the advice is either downright stupid / wrong to put it bluntly or some unrelated information has simply been misinterpreted and poor advice has been given based purely on the users coincidence, flukes and more often happy acidents resolving some other unrelated issue ie. use this resistor use that etc.

What I can tell you is, (relating back to what I mentioned earlier with EMMC sensitivity) is all the intermediary boards and flex’s I’ve seen for these sorts of mods are poorly designed and some actualy bypass / negate a lot of the inherhent “protections” put in place on the EMMC IC itself, you can see in a lot of the EMMC datasheets some strict requirements and guidelines for board design where they are connected which have been ommited by such devices. Remember these are incredibly high speed flash devices running at a blistering pace and introducing wires or PCB/s into the mix will in every circumstance introduce issues so the best you can do is just try to lessen them… Not sure if anythings changed in regard to the modchip landscape but if I recall they weren’t even level shifting I/O voltage to the EMMC last I checked which is going to inctroduce and almost double all outside interference or just generally have a negative effect.

IMO it would be better to simply tap off the only line you need from below the EMMC (afair) which is dat 0 with a single wire and then pickup the other required lines you need at destinations which are closer to the modchip (using a wire like this isn’t great in and of itself as it’s still going to act like an antenna but it’s better than what a lot of these PCBS/flexes I’ve seen are doing) , keep your lines as short as you possibly can and avoid crossing them, try to route your wires over a ground planes and definately avoid laying them over signal traces or anywhere near a crystal etc. consider employing an LC circuit at termination (ie. filter and caps on relevant I/O) instead of random resistors values which people have had “luck” with :slight_smile:

This is the rail we discussed right at the beginning, your boot CPU rail. This guy :point_down:

You could tap it direcly at the inductor sure, in theory it should be better to do so as your closer to the source… as far as I understand it the modchip is interfering with this rail in order to disrupt it ie: short it out if I recall during the “glitching” process which disprupts your boot CPU which enables the mod. But, I suppose this is also going to be very dependent on where your modchip and other wires are going :slight_smile:

18

Interesting - I’m guessing the reason then for tapping into the 1V0 at the SOC itself is to quickly drain any capacitance that is holding the rail up when glitching. Moving closer to the PMIC may actually not help because you are fighting all the capacitance on the board and around the SOC - unless the glitch time was increased? Something to look at. Picofly is open, so that could be worth experimenting with as we didnt want to have to open the SOC shield if we dont have to (no need to replace thermal paste it we dont pop the cover off).

A previous one that we modded we tried the mosfet next to the SOC (just a single one) but ended up moving it to the alternate location shown in the latest picofly documentation at that worked ok. Not for this board we are working on now however.

All the other resistors on the picofly are 47ohm - just this one which was 470. Odd. Perhaps I already replaced the others when we got the modules, but missed this one.

Good news is that when the glitch works (or fails, since we have the original software restored onto a samsung eMMC), the console works fine so the intermediary board doesnt seem to be causing any issues that I can see. It has plenty of shielding on the board. It does introduce long stubs on DAT0, CLK, CMD and that is where the termination resistors on the picofly come into play.

The adapter could definitely be improved though by using via-in-pad for the BGA connection - then all signals (other than DAT0, CLK,CMD) would just be 0.6mm + ball height longer - theyd just go straight down through the pad and onto the mainboard. JLCPCB do via-in-pad cheap now so that might be a nice thing to do for the next revision of the adapter :slight_smile:

19

No, there is probably somehwere in the region of hundreds of caps on this rail, some which are closer (and bigger) to the target and plenty of points which are further too. the reason why the solder points are on the SoC directly has nothing to do with anything other that this is what the original Switch modchip SX did and they wanted a space on the front of the board and didn’t bother to check elsewhere, the open source lot have basically cloned and maintained this installation procedure (though I’ve seen others opt for dirrent I/O and rail locations which is good) - unfortunately as you can imagine this dumb install location has caused the death of many Switch’s which weve seen here many a time as result.

Hopefully goes without saying that shorting out a capacitor (if that’s what I suspect is actually happening) aint the savviest of moves, not for the long term health of the cap due to the peak heat likely generated and stress but also not for the SoC itself given how sensitive it is… but like I say, that’s how it was developed by the SX modchip originally and seems everyone else has followed suit.

Seems to me a far better way (assuming my assumptions about the modchip operation are correct) would be isolating the inductor for this rail at the PMIC and instead installing it on the modchip board and simply controlling it’s output from there… then no need to short anything out at all, just turn it on/off or vary, whatever. but what do I know :smiley: or maybe if your a real clever clogs over the I2C bus. either way, all a bit pointless, these modchips are terribly designed anyway (if not really even a modchip at all but some dev board not intended for this purpose)