i6 No WiFi + no IMEI + LSD = are RFFE2_DATA_BUFFER and RFFE2_CLK_BUFFER the problem?

[Alber_the_Learner]

Coming back to this board...

I changed the BB_PMU as Jessa suggested and I got these:

	Before		After Changing BB_PMU
	V	Diode Mode	Volts	Diode Mode	good board
PP_LDO6	0V	654	0V	644	630
PP_LDO7	0V	556	1.8V	546	530
PP_LDO13	0V	402	2.94V	400	440

I was able to enable WiFi and I got connected to my WiFi router althougt I realized the signal was very low - not normal. Later I broke the longest anntena when I pulled it out from the board, I am assuming it was already broken and that maybe explains the low signal WiFi connection.

Before changing the BB_PMU, I was not able to enable WiFi, and in the Settings>About, WiFi was N/D. After changing, WiFi was showing its mac address normally.

The IMEI was shown in the Settings/About but when dialing the *#06# it was missing and I still had the seaching problem when a SIM card was inside. At least, I think one problem was solved...

After a few minutes testing the WiFi, I dissasembled the board out from the housing and I took new measurements on BB_PMU. I got surprised when I found out it was missing the PP_LDO7 and PP_LDO13 (0 volts again).

I checked at the caps of REG_SMPS1_0V90, VREG_SMPS2_1V25, VREG_SMPS3_0V95 eVREG_SMPS4_2V0 and all of them were 0V.

The phone seems to boot normally on the DCPS reaching up to 1A or so but it does not really boots because I got stuck in the Apple Logo and I guess the reason for this behavior might be the BB_PMU has not been told to be activated by the main CPU or BB_CPU.

My assumption is I got the phone bricked right after I was browsing on the web and decided to do a RESET NETWORKING SETTINGS.

I know that trying to recovery the phone on iTunes won't work and I will get an error (I think error -1) because the phone does not recognize its IMEI.

What should I do first?

1) put a new BB_PMU (to see if I get back it to working all the output voltages)
2) then reball the BB_CPU

or

1) reball the BB_CPU
2) than check if BB_PMU would be back to produce its output voltages
3) if not, put a new BB_PMU

or

1) look for anything else first before doing any of the above?

[Jessa_the_Professa]

Didn't you already change bb_pmu? If not, change it. If so, then reball bb_cpu. We have no idea what voltages are required out of bb_pmu at what time, with what carrier, with what network settings, with what type of cellular connection (3G, 4G, LTE) etc. That is all just way too many variables. Practical repair says "bb_pmu, bb_cpu, trashcan"

[Alber_the_Learner]

Back to this board... I know, I am very slow on this... just learning!

I changed the BB_PMU and I think I did it right!

Now, I got the phone "booting" on DCPS reaching until 1A or so, but the phone is stuck in the Apple Logo while I DCPS shows a fluctiation amperage range from 0.2 to 0.8A.

I checked the LDO voltages and there is 0V for almost all of them. So, BB_PMU is not working properly.

Then I checked if the BB_PMU was getting its input voltages and I found out the PP_VCC_MAIN is fluctuation from 3.5 to 3.9V. It's not stable while in the DCPS the amperage goes crazy from 02 up to 0.8A and down and up...

My assumptions are:

1) when I put heat on the board I probably damaged the Tigris internally, that's why Tigris is not producing a straught 4.2V for PP_VCC_MAIN... Am I right in my conclusion?

2) but If Tigris is okay? I don't want to change Tigris if it is not a necessary and add a variable if the fault is in another place. Could be a shorted line? PP_VCC_MAIN is fine in Diode Mode measuring 357 (a good one is 361).

What should I do now?

[crea2k]

What would happen to the input voltage if the power supply had a load beyond the spec of its output current ?. Now that's another possibly.

[Alber_the_Learner]

Thanks for your comment! but I think that's not the case...

[Jessa_the_Professa]

whenever a system changes after you do a step, the next step is to undo that step. take off your bb_pmic and see if the system returns to how it was. An iPhone 6 can boot with no bb_pmic as long as software is not corrupted. Heat is unlikely to damage a chip--remember they got on there to begin with by heat. But nudging does damage chips, as does heat on underfilled chips.

[Alber_the_Learner]

I removed the BB_PMU and nothing changed. I got the phone "booting" on DCPS reaching until 1A or so, but the phone is stuck in the Apple Logo while I DCPS shows a fluctiation amperage range from 0.2 to 0.8A.

[Alber_the_Learner]

My guessing is that Tigris is bad since it is responsable for allowing the PP_BATT_VCC to be converted into the PP_VCC_MAIN through the Active Diode Mosfet Q1403.

And what tells me that would be the possibility is this: when I have the DCPS set in 4V plugged into the board, I have a steady 3.99V on any cap in the PP_VCC_MAIN. But when I prompt to boot, I have the fluctuating 3.5V to 3.9V on the VCC_MAIN.

[Alber_the_Learner]

I removed Tigris and I did some measuments:

On DCPS without prompting to boot: 0A consumption and a steady 0.03V on any cap of PP_VCC_MAIN.

On DCPS prompting to boot: I have a fluctuating amp consumption from 0A to 0.131A, zero to 0.131A and on the PP_VCC_MAIN cap I have quite the same fluctuating range from 3.6V to 3.9V.

Before putting back a new Trigis, I am trying to come to on of the following conclusion:

1) Getting the same voltage fluctuatinig previous behavior it tells me nothing changed. So, if the Tigris was really bad, then it is now acting like no Trigris on board.

2) If I put back the Tigris and get the same fluctuation voltage behavior on the Main, then Tigris was not bad and probably the problem is with the Mosfet Q1403.

3) If I put back the Tigris and the I get a steady 4V on the PP_VCC_MAIN, we found the issue!

Let's see what's happening next...

[Alber_the_Learner]

Hummm, I found out a crack on one of the Q1403 corners... maybe it was not Tigris... Let's see...

[Alber_the_Learner]

With the new Tigris, on DCPS prompting to boot consumption looping every other 3 seconds: 0A - 0.042 - 0.096 - 0.099 (lasting longer) - 0.093 - 0.092 - 0.093 - 0.122 - 0A and again and again...

Next step, change the Q1403 Mosfet... but I don't have a new one... I will harvest it from a donor board...

[Alber_the_Learner]

I changed the Mosfet (I used a mosfet from a 5c donor board - Q5) and still the same behavior... I am lost now... help me out!

[Jessa_the_Professa]

Under what mechanism would Tigris have come to be damaged? Tigris only gets damaged from electrical damage from bad chargers, heat at bbpmic can’t hurt Tigris, only nudging it.

taking off Tigris made no sense here, I see that you had some logic about vccmain-batt vcc through the mosfet, but you could have just laid a wire connecting vccmain and batt vcc to rule that out.

something is making your pmic reset itself. In my experience the only time I’ve ever gotten one like that to stop doing that was finding a fault on an i2c1 line—cracked vibrator motor.

Tool #1 is CRISP CLOSE visual exam. You should have seen a crack on q1403. It makes me worried that you have shield removal damage of vibrator motor or something. Look very closely for nuances!

[Alber_the_Learner]

Thank you Jessa for all your advice and I also thank you @crea2k!

1) Where can I jumper the vcc_main and batt _vcc without taking Tigris off?

2) Besides a possible fault on the I2C1 line (I will look for that - btw, the U1400 vibe chip looks fine!), could the fault be also in the I2C0 line?

I am asking that because when replacing Tigris and the Q1403, I exposed twice that area with heat. And later, I realized that I did not even removed at least the original resine laid on the top of Tristar.... and I am suspecting that it could be possible I nudged the Tristar since it has underfill resine under it. I am wondering If a I2C0 fault can produce that same result on DCPS preventing PMIC to work properly, I should try to replace Tristar, in case I nudged it, just for ruling that out...

[crea2k]

If you look on the schemetic batt vcc and vcc main go all over the board, so can be jumpered off and caps that sit on that line

[Alber_the_Learner]

Thank you! I thing I got confused with Jessa's suggestion because of the case when you have a short on VCC_MAIN and get the mosfet heating up, masking where the real short is, and then you take the mosfet off and make a jumper on the VCC_MAIN to BATT_VCC to see where the short is... I misundertood what Jessa suggested...

[Alber_the_Learner]

something is making your pmic reset itself. In my experience the only time I’ve ever gotten one like that to stop doing that was finding a fault on an i2c1 line—cracked vibrator motor.

Guys, remember I said in one of the first posts that I believe there is a LSD on both right and left botton screw hole? In the right one there are these two lines:

AP_BI_I2C1_SDA
AP_BI_I2C1_CLK

If those lines are really cutted off, that would be the reason for not allowing the phone to have that behavior, right? Instead of the Vide Motor Jessa sugestted - in my inspection it looks fine...

[Alber_the_Learner]

Here are the screw hole pics...