frp

link

frp

frp

IPhone 6 cannot found firmware version on it

There are a lot of case about iPhone 6 was been bent,  but that’s not the point of today. Today we are going to talk about the firmware of iPhone. The iPhone 6 cannot be found firmware on it after dropping. Because the rear cover was bent by dropping, but it still can work,  after we replace it, the firmware of “About iPhone” cannot be found.  It will take a lot of problems, we need to fix it.

1.  Disassemble the iPhone 6, remove the motherboard. Observing from the side face, we can find that the board bends. We presume that the baseband or the baseband power supply is pseudo soldering. Energizing it and turn it on to test the power supply. VREG_SMPS2_1V25, VREG_SMPS3_0V95 and VREG_SMPS4_2V075 are normal. Only VREG_SMPS1_0V90 has no voltage. The ZXW DONGLE circuit diagram of these voltages is shown in picture 1-1.

The test points of VREG_SMPS2_1V25, VREG_SMPS3_0V95 and VREG_SMPS4_2V075 in bitmap are shown in picture 1-2. They are all measured at the inductors around the baseband.

2.  According to experience, I cannot measure the baseband at CUP, which suggests that will cause no voltage on VREG_SMPS1_0V90. As the board bends slightly, we tear down the baseband and test it carefully, but I do not find any dropping pins. I continue to measure the diode data of I2C bus BB_EEPROM_SDA and BB_EEPROM_SCL that act as communication between baseband and baseband chip. The data is 650, which is normal. The circuit diagram of I2C bus is shown in picture 1-3.

3. Measure whether the communication circuits between CPU and baseband are normal or not. Use multimeter to measure the diode data that baseband flows to CPU signal circuits, the test points are shown in picture 1-4. We can find that the diode data of the two yellow points are infinite, as show in picture 1-5. They are the UART bus signals that run to CPU, named BB_CTS_L and BB_UART_RTS_L.

1-4

1-5

4. Tear down the CPU, and make sure whether it is pseudo soldering or disconnecting. After tearing it down and measuring, we find that the two solder pads are connecting to the yellow points in picture 1-5. So CPU is pseudo soldering. After reassembling CPU, we can find the firmware version in “about iPhone”.

1151 CPU Tool

1151 CPU Tool

Hardware Configuration Instruction

Download Link

iPhone Start Up Sequence

April 17, 2018

|

deegee

Operating Sequence of iPhone6/Plus Starting boot circuit

By deegee.

This post details the startup sequence of an iPhone.

Hopefully understanding such information will allow others to manage their diagnosis methods better than just pulling off IC after IC degrading the Logic Board with unnecessary heat .

My advice for testing is this:

1. First : Voltage Tests
2. Second : Readings / diode mode / ohms

I have never seen so many test readings floating about with no understanding of the results.

After all I would not teach you how to make your meter probes BEEP and then send you out doing Earth Fault Loop Tests
on energised circuits with an EFLI tester. Or insulation resistance tests.

If your voltage is there then leave well alone. If its not broke don't fix it. Rabbit hole springs to mind.

If you have say 1.79 volts on a 1V8 line then tolerance values state its OK.

If you have say 1.2v on a 1V8 line then you can get the probes out and investigate whats pulling the voltage down, partial short...

So here we go.....

iPhone6/6P :
There are 6 required stages for the operating sequence of the iPhone6/P starting circuit,and is as follows:

Supply Source: External to Internal / Charger / Battery

0. Sub - PP5V0_USB - PP_VCC_BATT - (VCC_MAIN is a generated voltage internally by the PMIC - U1202)

Either of the two voltages above allow the VCC_MAIN voltage to be generated by U1201.

Note : That if 1v8 standby is not present then VCC_MAIN will not be able to be generated.

Internal Sources

1. Standby - VCC_MAIN - VCC_BATT - PP1V8_ALWAYS

2. Trigger - BUTTON_TO_AP _HOLD_KEY_CONN_L

3. Clock - 24M CRYSTAL Y0201 / (in) 45_XTAL_24M_I --- (out) 45_XTAL_24M_O_R

4. Reset - RESET_1V8_L

5. Maintenance  - AP _TO_PMU_KEEPACT

STANDBY CIRCUIT:

The Sub/standby circuit is started when you see the APPLE LOGO Pre-stager displayed its working state
and starts AFTER powering on the Logic Board.

If the standby circuit does not work, it will cause no current reaction on the Logic Board after pressing the power button. 5V @ 0.01A

In the iPhone6/P standby circuit there are the following groups of standby voltage:

MAIN POWER SUPPLY:

PP _VCC_MAIN: In the iPhone circuit,this Power supply belongs to the Main group of power supplies.

The main power supply is generated internally U1201 and boosted or reduced by Tigris U1401, Q1403 is simply a switch and does not generate the voltage.

The Tigris IC is a switched mode battery charging / system power path management chip and works alongside the Tristar USB Controller.

Tristar has been covered in earlier posts so will leave out the drill down.....

Tigris: U1401

This is responsible for charging the battery but the AP-CPU handles the termination of the charging process.

The main power supply :

PP _VCC_MAIN: U1202 - 3.7~4.2V

The battery power supply :

PP_VCC_BATT: BATTERY SUPPLY

The main power supply of the power chip: U1202 is 3.7~4.2V @ C1220 (VCC MAIN)

If there is not 3.7-4.2V volts on C1220, then there is an issue with the battery power supply,
or the PMIC U1202 check to see if damaged or oxidised

PP1V8 ALWAYS : Pre - VCC_MAIN

The standby voltage:PP1V8_ALWAYS

PP VCC MAIN will not work if PPlV8_ALWAYS is not present.

If PP VCC MAIN voltage is not generated and there is no output,  I would then check to see if there is a PPl V8_ALWAYS output from the main power supply, if there is no PPl V8_ALWAYS main power supply, I would then check to see if we had battery voltage .

If the battery power supply is normal,then lack of PP1V8_ALWAYS be usually be caused by the PMIC being damaged or oxidised.

The standby voltage PP1V8_ALWAYS is output by PMIC - U1202,@ C1291? check ???

TRIGGER CIRCUIT: Power On Button

(BUTTON_TO_AP _HOLD_KEY_CONN_L)

The Boot trigger signal (BUTTON_TO_AP _HOLD_KEY_CONN_L)  -  PIN 2 J0801

 This 1.8V voltage is available after the Logic Board has powered up via the power button.

If 1.8V is not present,looking on this line I would check the inductor / filter FL0819 / 0809 for an open circuit.

The boot trigger signal 1v8 voltage is on PIN 2 of the FPC J0801

The first pin from the top left of the FPC can trigger the boot signal by pulling it down.

Example:

BUTTON_TO_HOLD_KEY_CONN_L: - PIN 2 / GROUND SHORT

The trigger signal switch line is BUTTON_TO_HOLD_KEY_CONN_L .

Its line connects to the PMIC U1202 / CPU via FL0819 / 0809 / R0314

If FL0819 / 0809 is damaged or open circuit then there is no switch line feed to the boot trigger circuit and the phone will not to be able to power up resulting in no (0.00a) current pull at all.

To test the power button trigger we can press the power button itself and check for any faults by testing both of the FL0819 for 1.8v

If there is 1.8V on the BUTTON_TO_AP_HOLD_KEY_L side of the C0810 but no voltage on the BUTTON_TO_AP_HOLD_KEY_CONN_L side of DZ0810, then it means that (FL0819/0809) is open circuit.

Boot trigger Power supplies:

After pressing the power button,the PMIC U1202 then outputs the following power supplies: (or is at least supposed to)

1) PP _CPU : - Main CPU - A8 Processor - power supply

2) PP1V8_SDRAM : - Main CPU - 1.8V power supply of the upper SDRAM(temporary storage) of the main CPU.

The topology of the CPU physical structure is a twin layer site application meaning one on top of the other,the lower part is the central processing unit.

3) PP1V2_SDRAM : - MAIN CPU - 1.2V power supply of the upper SDRAM of CPU

4) PP _VAR_SOC : - MAIN CPU - approximately 1V power supply for the main CPU

5) PPOV95 _FIXED _SOC : - MAIN CPU - about 0.95V power supply of the main CPU

6) PP1V8 : - MAIN CPU - 1.8V - 1.8V power supply of the main CPU and the hard disk

7) PP1V2 : - MAIN CPU- about 1.2V power supply of the main CPU

8) PP3VO_NAND : - 3V power supply of the hard disk

Now the above groups of power supplies are output, ONLY after the standby circuit is found to be in its correct working condition

So once the Power Button is pressed, the above voltages are output, of course only if the PMIC U1202 itself is in its correct working condition and not damaged.

Please note these voltages are not gospel as i have found a fully known good board to be 0.78 or so volts on a 1v line...

If for instance one line is down then I would check the line but if multiple channel outputs are down then I would check the PMIC itself.

Or is it the PMIC?

What are multiple output channels? Some PMIC chips have two or more channels that output separately into one final circuit.

Example : 5 channel output could be : 2 X DC-DC Step down/up channel outputs and 3 LDO channels.

Buck Output channels: Step Down Circuit

Example : You could have power along a line, lets just say PP_CPU line, that line has L1209,L1201 and more all individually outputting prior to the caps on that line and then they all join to the one line called PP_CPU. Allowing for a better load handling of the circuit.

• Lx channel out L1201 PP_GPU

So one channels output could be bad or the inductor L1201 could be damaged / open circuit and so on and when measured there is resistance and voltage on the line still all with a damaged output channel in fault condition. This will cause a reduction in the load capability and cause further damage and issues.

If there is no output we can check the inductors and capacitors for shorts or open circuit as this would cause no power supply on the step-down circuit from the PMIC.

The Buck output for the PP_CPU line is not directly connected and have protection mitigation with the inductors so if these are open circuit and damaged then no PP_CPU line voltage.

You can test the output channel by measuring Pin 1 on the L1201 that is also the same for the other inductors. Voltage here would show the PMIC is OK. If not then the PMIC could be a possible candidate for replacing but its usually the caps further on.

If the output channel is comprised of a single inductor and the inductor is damaged,it will cause no voltage output.

Where before multiple channels allow for a backup line of sorts, one goes down there's another 3 to carry the load, a single channel output with one inductor on the line will fail as no output, if open circuit or its involved in a cap short.
 

More on the circuits generated after starting up :

1. PP _GPU: This power supply is approx 0.9V and will not be present until the power button is pressed.

• No PP_GPU output:  

• The PMIC is damaged

• Temporary Storage Damage , pads oxidised

• Main CPU Damage, pads oxidised

• Hard disk Damage, pads oxidised

Fault analysis: PP _GPU power supply

I usually carry out an ohms test on that line which is about 35ohms approximately.

If all other voltages are normal allowing to boot and no PP_GPU voltage is present you can
carry out a restore to get confirmation of ERROR 4005 - CPU fault . Pads maybe?

Fault analysis: 24M crystal circuit (24M)

The Oscillation circuit is made up of both the CPUs internal circuit and the 24M crystal, together they allow
the CPU clock signal to be generated, without this signal in play the phone will not boot and will show
minimal boot leakage/consumption in amps after the power button is pressed, for example: 15-20ma maybe less...

Y0201 is the main clock oscillator: 24M

PIN 1: OUTPUT - 45_XTAL_24M_O_R

PIN 2: GND

PIN 3: INPUT - 45_XTAL_24M_I

PIN 4: GND

As stated elsewhere in one of my posts on SCL measuring you can measure the clocks working condition by measuring VOLTAGE on pins 1 & 3 for  0.5V-0.9V by taking a measurement from its local caps and / or resistor.

(you can find these on your own) with respect!

If you have voltage at frequency ie. PIN 1 : = 0.7V & PIN 3: = 0.7V (it doesn't matter if not exactly the same voltage) then the clock is working , no voltage and its either in off state or damaged.

The surrounding filtering caps can also fail the clock if damaged as will its resistor attached to the line.

More clocks......

RTC - not to be confused with the CPU Clock above..

The real-time clock circuit 32.768KHz - Y1200

iPhone6/P : 32.768KHz - Y1200

The Y1200 - 32.768KHz clock circuit in the iPhone6/P circuit is NOT involved in the boot sequence but can lead to multiple issues if it fails.

The RTC (Real time Clock) circuit is tied into the systems own clock time and if the RTC is down then
then devices internal clock time will not be accurately updated automatically, resulting in network issues, Sim -3G,
Firmware Update issues, Safari certificate issues, or in fact any other browsers certificates will fail to authenticate.
 

Fault analysis: RESET _1 V8_L  ( 1.8v)

Once the Logic Board has powered on and the triggering circuit,power supply outputs
and the clock circuit meet their working conditions (ie) are working correctly,then the PMIC U1202 will delay reset the CPU.

This signal is called : RESET_1V8_L

After starting up and triggering,it will jump to be low when the power chip resets CPU,and it returns to be the high level state(l.8V} finally.

Once the Logic Board has powered on and triggered, the reset line will go in a low state 0V when the PMIC initiates the RESET to the CPU.

This then returns back to a high level state of 1.8v.

If these working conditions are not correct then the phone will fail to boot

I would test this is working correctly first by voltage test as its fed from PP1V8 and should be 1.8v on both sides.

Example: PMIC------PP1V8 (1.8v) in |----R0206----| out (1.8v) RESET_1V8_L -------------CPU

           no voltage here = PMIC                   no voltage here = change resistor
          
A short circuit on this line can occur via the attached caps, namely C0201 which is theCPU side.

Check for corrosion also.
 

Fault analysis: Maintenance Signal (AP _TO_PMU_KEEPACT): U0201 - CPU - APPLICATION PROCESSOR:

Last of all we have the Maintenance Signal, this is responsible for instructing the PMIC to continue its job
of outputting its power supplies after the CPU has passed its self test - all working as it should.

AP _TO_PMU_KEEPACT:

This signal is generated by the CPU in a high level, normal state and sent to the PMIC.

To check this signal is simply a case of testing for 1.8v on the resistor R1387 live side, if at 0volts
then the CPU is having issues outputting its signal OR the signal is being pulled low by the PMIC resulting in the Maintenance signal being pulled low and it thinking its ready for power down after the Start-up and Trigger sequence.

So it powers the phone down...

This same principle of startup trigger and so on is replicated in most mobile phones and these steps can be applied to those also.

I Hope this helps a few,

Regards Dee

Regards Dee

#s3gt_translate_tooltip_mini { display: none !important; }