i6 No WiFi + no IMEI + LSD = are RFFE2_DATA_BUFFER and RFFE2_CLK_BUFFER the problem?

[Alber_the_Learner]

HISTORY AND VISUAL INSPECTION

This is an iphone 6 with the history "does not connect to WiFi and No Service". It boots normal and there is no sign of water damage. Shields were never been removed, althought I found a rest of label in the back of one shield, indicating a repair. The USB port was changed once. The Display/LCD looks like original one (the metal in the back of the connectors still have the foam). There are two very tiny dents on the left corners of the housing. They are slightly scrashed. I then realized it has a LSD although the phone is booting normal.

TESTS DONE

• *#06# shows no IMEI
• No Sim (in the first testing before restoring, it was not recognezing the SIM)
• by several times, I got a blank screen as a result by going to SETTINGS. When the times Settings showed up normally, I checked:

1. WiFi was not grayed on, but It was not able to be toggled
2. Airplane On and Off okay
3. Cellular was grayd out
4. WiFi was N/D
5. IMEI was shown as well everything else, including Firmware Modem

ATTEMPTS DONE

1. Tried a Reset (Erase all Contents and Settings)
2. Then Sim was required and I activeted by passing trought iTunes

RESULTS

1. The carrier's name was recognized in the activation process trought iTunes
2. Celular is availabel to click on it
3. Now, I got NO SERVICE
4. No WiFi
5. No IMEI by dialing *#06#
6. I get access to settings and find the same info as before (IMEI, FIRMAWARE, etc), but WiFi is N/D

TROUBLESHOOTING

1. watched Jessa's excellent video: iPhone 6/6+ Searching No Service Signature Fault--BB_CPU Reball at https://www.youtube.com/watch?v=OwYyfWRAi2Y&t=122s
2. Checked on schematic which possible lines could be damage and is related to Baseband, and the are: RFFE2_DATA_BUFFER and RFFE2_CLK_BUFFER. Both lines go from U_BUFFER (RF5129) to UAT JUMPER (U5411_RF), passing underneath the screw hole which had the LSD
   
   RFFE2_CLK_BUFFER: Diode Mode Measuring: 355/1137 - a known good board 351/935
   
   RFFE2_DATA_BUFFER: Diode Mode Measuring: 340/1100 - a known good board 333/996
   
   U_BUFFER (RF5129): all input voltages are okay
3. WiFi chip: checked all input voltages and the Coil, all are fine.

MY CONCLUSION

Even thought I am very new about data lines troubleshooting, these possible damaged lines might be the problem for the missing IMEI and WiFi, because all are related to the Baseband area.

This does not look like to the classical signature failure as Jessa describes in her video.

The Diode Measurements looks fine for the Red probe to ground and Balck on the component. But the opposite (black on ground and red on the component) looks like different.

What I studied so far is that when the red is on ground and the measuring is lower than normal, there is a short somewhere in the line. When it is higher than normal, there is an open line. But I do not really understand to interpretate it when the black probe is on ground...

Can anyone explain me what it means? My guess it shows something wrong in the feedback way in the line...


NEXT STEPS FOR TRYING TO FIX IT

I won't go to dig at the screw hole now to make jumpers for avoiding messing it up since the phone is still booting, so the I2C1 lines are fine.

I will use a long jumper to connect the U_BUFFER (RF5129) to UAT JUMPER (U5411_RF), by jumpering the following pads:

• U_BUFFER-B3 to R0101-1 for rebuilding the RFFE2_CLK_BUFFER line
• U_BUFFER-B2 to R0101-2 for rebuilding the RFFE2_DATA_BUFFER line

ANY OTHER ADVICES?

[Jessa_the_Professa]

Your idea that this is lsd is worth ruling out although it is more likely to be baseband pmic or baseband cpu

[crea2k]

As wifi and baseband are both dead I would look for shorts on the lines betweeen the baseband and the wifi ic. I cant quite remember if they come directly from the wifi ic or the triplexor or what but iv seen a phone before that had one of the caps next to the wifi chip shorted that brought down the bb_cpu too

[crea2k]

PP_LDO13 goes from bb_cpu to U_GPSLNA then to F_TRI_RF (triplexer) and then to the wifi chip, so if any of those lines have a short it can bring down the lot. Iv only seen it once before, but its worth mentioning

[Alber_the_Learner]

Your idea that this is lsd is worth ruling out although it is more likely to be baseband pmic or baseband cpu

Just for clarifying what you meant (...English is not my first language!): you are saying it "does not hurt" to do the long jumper I was thinking to do (this is ruling out process), although you think that would not be the real problem, instead it should be the BB_CPU or BB_PMU.

And the question is why not? Because, if it was a really LSD damage, the other main lines underneath that screw hole would be damaged, including the I2C1 lines, which won't allow the phone to boot.

Am I correct in the interpretation, Jessa?

Thank you for the advice! I will skip that...

[Jessa_the_Professa]

Yes —that is what I said. I have never seen a case of LSD that affected just WiFi/cell service, but it is common for iPhone 6 to have searching no service from bb_cpu and bb_cpu also has WiFi lines. I would expect this to be either baseband cpu or pmic.

[Alber_the_Learner]

WIFI PROBLEM + FREEZING THE SCREEN ON SETTINGS

Just realized the botton right screw hole is damaged as well. I did not notice it before because there was a small piece of blue plastic that was covering it.

Coincidently, I also found out a recently (01/28) video posted by Jason from STS TELECON, which title is:

iPhone 6 - No WiFi after long screw repair: https://www.youtube.com/watch?v=XvUSGobplOo
3:15 - 4:40 -- Jason shows the same problem I have
7:38 - 8:11 -- he shows the traces area that is "spongy" and should be relaterd to WiFi
23:20 - 29:10 -- the traces repairing
31:07 -- he sumarizes what he did for repairing the WiFi after jumpering a couple of "unkown" broked lines. It would be worth to see his job of repairing on those traces in the first layer because they are not showed in the ZXW and they are supposed to be related to the capacity of WiFi turn on and off and also and related to the freezing the settings problem, which is part of my problem. When I have time, I will dig at that hole and will check if the same traces are damages and will come back here.


MISSING IMEI

Still have the IMEI problem, which should be related to the BB_PMU or BB_CPU, as Jessa mentioned above.

I have measured the BB_PMU voltages and got this:

PP_LDO1 = 1.22V
PP_LDO2 = 1.72V
PP_LDO3 = 1.79V
PP_LDO4 = 3.07V
PP_LDO5 = 0V (VREG_SIM 1.8V - studying the schematc, I realized it is normal to get 0V since the SIM is not inserted in. I put the SIM in the SIM tray holder and I got the 1.8V)
PP_LDO6 = 0V (it is an input LDO voltage to BB_CPU)
PP_LDO7 = 0V (it is an input LDO voltage to BB_CPU)
PP_LDO8 = 1.78V
PP_LDO9 = 2.04V
PP_LDO10 = 0.89V
PP_LDO11 = 1.79V
PP_LDO12 = 0.94V
PP_LDO13 = 0V (this is the input LDO voltage to BB_CPU and to U_GPSLNA, that you crea2k have mentioned)
PP_LDO14_RFSW = 2.68V

I did not check the following power lines because I did not remove the BB_CPU shield so far:

PP_VSW_S1 and VREG_SMPS1_0V90
PP_VSW_S2 and VREG_SMPS2_1V25 (VDD_L1)
PP_VSW_S3 and VREG_SMPS3_0V95 (VDD_L12)
PP_VSW_S4 and VREG_SMPS4_2V0 (VDD_L2_3 and VDD_L7_8_11 and VDD_L9)


PARCIAL CONCLUSION AFTER THIS MEASUREMENTS

None of the above 4 VSW rails and the 4 SMPS rails are direct involved for producing the missing LDO5, LDO6, LDO7 and LDO13 and LDO14_RFSW. So, the BB_PMU is damaged itself. It should be replaced before going further.


QUESTION

Before replacing the BB_PMU, should I check those 8 power lines? Or it does not matter since I have evidence that the BB_PMU is not generating some of the LDO voltages, speacilly the PP_LDO13?

[crea2k]

Im guessing you have checked the missing lines for shorts ?. It does sound like the bb pmic if they are all good.

[Alber_the_Learner]

Sorry, I skiped that! Actually, I made a mistake by not assuming possible parcial shorts on those lines! Thank you for reminding me at it!

DIODE MODE READINGS FOR THE MISSING LDO VOLTAGES

LDO5 = 374/1839
LDO6 = 660/1845
LDO7 = 556/1798
LDO13 = 403/1788
LDO14_RFSW = 732/1788

All those measurements compared to a known good board are okay!

[Alber_the_Learner]

Im guessing you have checked the missing lines for shorts ?. It does sound like the bb pmic if they are all good.

crea2k, Are you saying the BB_PMU looks good?

I am a little confused right now with those missing voltages:

PP_LDO6 = 0V (it is an input LDO voltage to BB_CPU)
PP_LDO7 = 0V (it is an input LDO voltage to BB_CPU - RADIO_BB)
PP_LDO13 = 0V (it is an input LDO voltage to BB_CPU)


If they are missing as input voltages to the BB_CPU, Is it wrong to conclude that the BB_PMU is damaged?

[Alber_the_Learner]

I found out an error on the Schematic!

In Baseband PMU (1 of 2) page 31 - it states the LDO14_RFSW is 5V.

IT IS WRONG! It is a 2.7V, according to page 29 (RADIO ANTENNA CONTROL).

And I confirmed this by checking it via a known good board!

[Alber_the_Learner]

As wifi and baseband are both dead I would look for shorts on the lines betweeen the baseband and the wifi ic. I cant quite remember if they come directly from the wifi ic or the triplexor or what but iv seen a phone before that had one of the caps next to the wifi chip shorted that brought down the bb_cpu too

I forgot to reply this... None of the caps are shorted in the WiFi chip area, at least full shorts.

But if there is a parcial short in the internal trace underneath the screw hole that enables WiFI, that one Jason shows us in his video and I mentioned it in a previous post? That could be a possible reason for shutting down the whole circuit (BB_PMU, WiFI and GPS)?

Thanks for the advice!

[crea2k]

Those readings look ok in theory, but without another board to compare to its hard to say for certain. None of them screams short though tbh, although there may be a partial short as I don't know what the readings are on a good board

[crea2k]

Didn't jessa post a baseband resistance map the other day on here ?

[Jessa_the_Professa]

Practical repair says that replacing the bb_pmic is faster than taking all those readings...at least that’s how I operate. For efficiency’s sake sometimes it is faster to rule out an variable by simply replacing an easily replaceable chip and then save the heavy duty diagnostics when you have no other options. On this phone fix the LSD, change bb_pmic, then see if you need to measure stuff