• We have added an "AG" Registration date/Username profile option. If you add this upon signup we'll be able to verify faster thanks. (If already joined you can edit under profile settings.)

    If you had an account on OG1 you will need to re-register as this is a new start for all.

PSone PM-41 (2) A modchip problem

NeC5552

Refugee
Joined
Jun 8, 2019
Messages
6
Reaction score
2
AG User Name
NeC5552
AG Join Date
Nov 24, 2013
Sorry for being inactive, life got in the way, especially since I'm during exams. :(

Anyways, I did the mod and I can confirm it works. Machine doesn't skip anymore, although I did tweak the pot a bit just to be on the safe side.

Now I have a question though - is there a compatible variant for the older PM41? I have one that I've bought a lot of time ago and that one skips like hell, even after tweaking the pot on a known good laser. I tried moving pin 6 on the other side of the cap but then it wouldn't boot anything. Is it just me, or are the original PM41s really picky? PM41 (2)s are better though.
 

Trimesh

Refugee
Joined
May 30, 2019
Messages
43
Reaction score
34
AG User Name
Trimesh
AG Join Date
Jul 4, 2008
Sorry for being inactive, life got in the way, especially since I'm during exams. :(

Anyways, I did the mod and I can confirm it works. Machine doesn't skip anymore, although I did tweak the pot a bit just to be on the safe side.

Now I have a question though - is there a compatible variant for the older PM41? I have one that I've bought a lot of time ago and that one skips like hell, even after tweaking the pot on a known good laser. I tried moving pin 6 on the other side of the cap but then it wouldn't boot anything. Is it just me, or are the original PM41s really picky? PM41 (2)s are better though.
The wiring that's on the net for the original PM-41 board is has pin 5 of the PIC connected to WFCK, the same as the wiring on the earlier PU-22 and PU-23 boards. It was only the PM-41 (2) board that it was connected to RFCK. So if you have a PM-41 without the (2) then using the normal wiring should be OK - it's the same connection as the SCPH-900x.

My guess is that at some point just after the PM-41 (2) came out someone checked around with a scope looking for a point with 7.35kHz on it, and found the RFCK pin, not realizing it wasn't the same signal that was producing the 7.35kHz clock on the earlier models.

I have to admit I've always had the opposite experience - the PM41 seemed better than the PM41(2) to me.
 

GetTheKnife

Member
Joined
Jun 27, 2019
Messages
17
Reaction score
0
AG User Name
GetTheKnife
AG Join Date
Today
Sorry for being inactive, life got in the way, especially since I'm during exams. :(

Anyways, I did the mod and I can confirm it works. Machine doesn't skip anymore, although I did tweak the pot a bit just to be on the safe side.

Now I have a question though - is there a compatible variant for the older PM41? I have one that I've bought a lot of time ago and that one skips like hell, even after tweaking the pot on a known good laser. I tried moving pin 6 on the other side of the cap but then it wouldn't boot anything. Is it just me, or are the original PM41s really picky? PM41 (2)s are better though.
Awesome gonna try it too.
 

GetTheKnife

Member
Joined
Jun 27, 2019
Messages
17
Reaction score
0
AG User Name
GetTheKnife
AG Join Date
Today
The wiring that's on the net for the original PM-41 board is has pin 5 of the PIC connected to WFCK, the same as the wiring on the earlier PU-22 and PU-23 boards. It was only the PM-41 (2) board that it was connected to RFCK. So if you have a PM-41 without the (2) then using the normal wiring should be OK - it's the same connection as the SCPH-900x.

My guess is that at some point just after the PM-41 (2) came out someone checked around with a scope looking for a point with 7.35kHz on it, and found the RFCK pin, not realizing it wasn't the same signal that was producing the 7.35kHz clock on the earlier models.

I have to admit I've always had the opposite experience - the PM41 seemed better than the PM41(2) to me.
Btw, how did the people who made the diagram missed that on the pm41 2?
 

Trimesh

Refugee
Joined
May 30, 2019
Messages
43
Reaction score
34
AG User Name
Trimesh
AG Join Date
Jul 4, 2008
Btw, how did the people who made the diagram missed that on the pm41 2?
Well, as I said, my guess is that someone poked around the board with a scope and found that signal on pin 76 that looked like the one that the modchip wanted so they used it.

The reason I worked it it was wrong is that in the time between then and now the 5th edition of the PSone service manual has leaked, and that has the schematics for the -71 (AKA PM-41 (2)) board in it. This means you can find out what the official signal names are:
CDDSP_pinout.jpg


So the signal that's on pin 76 is actually called "DA07" - which sounds like part of the data bus for the digital audio out. But further down, you can see that pin 84 is marked "WFCK" - which is the signal that the modchip was being driven from on the previous board revisions.

Checking pin 76 with a scope, you can verify that it does indeed output a 7.35kHz clock signal, the same as WFCK, but - unlike WFCK, it's not synchronized with the disk rotation. So what is this signal? Well, the CXD2941R that's used in the PSone is a custom part and there is no datasheet available for it - but in the previous versions of the PlayStation the functions it carries our were performed by multiple separate chips - most of these also have no datasheet, but a few of them do. Specifically, the CXD2510 that was used in some of the early NTSC:J PlayStation models has a datasheet on the net, and we can look at that.

That contains a table with the pin functions which says, in part:

42 DA08 DA08 output when PSSL = 1. GFS output when PSSL = 0
47 DA07 DA07 output when PSSL = 1. RFCK output when PSSL = 0
42 DA06 DA06 output when PSSL = 1. C2PO output when PSSL = 0

So, if the DA interface is in serial mode (which is what the Playstation uses) than DA07 carries a signal called "RFCK" - but what is it?

In the notes at the bottom of the table, it tells you:

• RFCK is derived from the crystal accuracy, and has a cycle of 136µ

So it's a signal derived from the xtal oscillator, and has a frequency of about 7353Hz - which is the same as the nominal frequency of the WFCK signal - which explains the reason it was found on the DA07 pin. The reason for the interference is that it's not synchronized with the disc data so as the disc speed is adjusted by the servo the beat frequency between the xtal derived clock and the EFM PLL derived clock will be injected into the tracking servo, and this presumably will contain at least some energy that's in the audible range.

So IMO this misconnection is absolutely consistent with the noise that was coming from the optical pickup.
 

rama

Member
Joined
Jun 13, 2019
Messages
7
Reaction score
1
AG User Name
rama
AG Join Date
Dec 17, 2015
Awesome work there, Trimesh!
This is currently most likely wired wrong in every PM-41(2) in existence :p

I think (if I remember correctly) that RFCK and WFCK are also not the same phase, which will affect the modchip symbol output timing a little and reduce unlocking success rate.
 

GetTheKnife

Member
Joined
Jun 27, 2019
Messages
17
Reaction score
0
AG User Name
GetTheKnife
AG Join Date
Today
Well, as I said, my guess is that someone poked around the board with a scope and found that signal on pin 76 that looked like the one that the modchip wanted so they used it.

The reason I worked it it was wrong is that in the time between then and now the 5th edition of the PSone service manual has leaked, and that has the schematics for the -71 (AKA PM-41 (2)) board in it. This means you can find out what the official signal names are:
View attachment 2046

So the signal that's on pin 76 is actually called "DA07" - which sounds like part of the data bus for the digital audio out. But further down, you can see that pin 84 is marked "WFCK" - which is the signal that the modchip was being driven from on the previous board revisions.

Checking pin 76 with a scope, you can verify that it does indeed output a 7.35kHz clock signal, the same as WFCK, but - unlike WFCK, it's not synchronized with the disk rotation. So what is this signal? Well, the CXD2941R that's used in the PSone is a custom part and there is no datasheet available for it - but in the previous versions of the PlayStation the functions it carries our were performed by multiple separate chips - most of these also have no datasheet, but a few of them do. Specifically, the CXD2510 that was used in some of the early NTSC:J PlayStation models has a datasheet on the net, and we can look at that.

That contains a table with the pin functions which says, in part:

42 DA08 DA08 output when PSSL = 1. GFS output when PSSL = 0
47 DA07 DA07 output when PSSL = 1. RFCK output when PSSL = 0
42 DA06 DA06 output when PSSL = 1. C2PO output when PSSL = 0

So, if the DA interface is in serial mode (which is what the Playstation uses) than DA07 carries a signal called "RFCK" - but what is it?

In the notes at the bottom of the table, it tells you:

• RFCK is derived from the crystal accuracy, and has a cycle of 136µ

So it's a signal derived from the xtal oscillator, and has a frequency of about 7353Hz - which is the same as the nominal frequency of the WFCK signal - which explains the reason it was found on the DA07 pin. The reason for the interference is that it's not synchronized with the disc data so as the disc speed is adjusted by the servo the beat frequency between the xtal derived clock and the EFM PLL derived clock will be injected into the tracking servo, and this presumably will contain at least some energy that's in the audible range.

So IMO this misconnection is absolutely consistent with the noise that was coming from the optical pickup.
Wow, i'm gonna solder today to the spot you said, and gonna check if it reads some backups now well without reducing the laser resistance which I reduced from 1175 to 970. And will see if that noise goes away.
 

Trimesh

Refugee
Joined
May 30, 2019
Messages
43
Reaction score
34
AG User Name
Trimesh
AG Join Date
Jul 4, 2008
Awesome work there, Trimesh!
This is currently most likely wired wrong in every PM-41(2) in existence :p

I think (if I remember correctly) that RFCK and WFCK are also not the same phase, which will affect the modchip symbol output timing a little and reduce unlocking success rate.
Yeah, the names give you a fairly good idea of what's going on if you're familiar with the way that CD players work - these clocks are related to the subcode frames, and the subcode data is sampled at 1:24 compared with the DA data - since the subcode data is a single byte and the DA data is 4 bytes (16 bits/channel, stereo) then the subframe clock rate is 1/6 of the DA sample rate (so in this case, 44.1kHz / 6 = 7350Hz).

In a CD player DSP, there are two timing chains - one is clocked by the output of the EFM PLL (basically, the rate the raw data is coming from the disc) and is used to write to the buffer memory. The other is derived from the reference clock and is used to clock the data out of the chip and hence controls the timing of the reads from the buffer memory. The length of the buffer chain varies depending on the CD DSP design (for example, portable and car CD players have more buffering so they can tolerate shock events better), but the general idea is that the spindle servo adjusts the disc speed so that the read and write pointers are at about the same place in their respective blocks.

So basically "WFCK" is "subframe clock for buffer write" and "RFCK" is "subframe clock for buffer read" - and their phase will be completely unrelated. Since the signal that's being injected into the tracking circuit is on the CD playback side (I.E. the "buffer write") part, WFCK will be the correct signal to use since it's locked to the CD data rate.
 

rama

Member
Joined
Jun 13, 2019
Messages
7
Reaction score
1
AG User Name
rama
AG Join Date
Dec 17, 2015
Funny, I just thought about how RFCK and WFCK would work while jogging, and here's the explanation already.
Thanks!
I really enjoy reading these nice writeups, since I'm still contemplating that "simple" PSX ODE idea ;p

Anyway, when working on the PsNee modchip, I tried several methods to modulate the unlock symbols onto TE (for PU-22 +).
I had some success with generating the modulator frequency on the Arduino, but it was no comparison to using WFCK.
WFCK meant very good reliability, but now I wonder whether RFCK might be better :p

By the way, is the actual data transferred the same way as the subcodes?
(Kind of making WFCK, RFCK more like Write/ReadFrameClocK?)
 

Armadillo

New member
Joined
Jul 13, 2019
Messages
4
Reaction score
2
Hi, I moved the point on my pm41 (2) and it still chirps :(.

Mine has had no tweaks or anything to the laser, because other than the chirping, it always read the games fine, no worse than my 900x. Everything that loads on my 900x, loads on the psone. Opened it today, moved it from rfck to wfck and well, it still does it. Games all load fine, same as always, all perfect there, but I never had any issues with mine in terms of playback of discs, just the chirping.

Still the same, still makes this dumb noise https://instaud.io/zDF the second the laser focus. Disconnect the chip or point 6 and it's all quiet again.

Wonder if I should try a psnee or if mine is just forever cursed with a cricket noise.
 

Trimesh

Refugee
Joined
May 30, 2019
Messages
43
Reaction score
34
AG User Name
Trimesh
AG Join Date
Jul 4, 2008
Funny, I just thought about how RFCK and WFCK would work while jogging, and here's the explanation already.
Thanks!
I really enjoy reading these nice writeups, since I'm still contemplating that "simple" PSX ODE idea ;p

Anyway, when working on the PsNee modchip, I tried several methods to modulate the unlock symbols onto TE (for PU-22 +).
I had some success with generating the modulator frequency on the Arduino, but it was no comparison to using WFCK.
WFCK meant very good reliability, but now I wonder whether RFCK might be better :p

By the way, is the actual data transferred the same way as the subcodes?
(Kind of making WFCK, RFCK more like Write/ReadFrameClocK?)
The CD DSP normally assembles the subcode coming off the disc into a buffer and the read interface to that is under the control of the mechanism control MCU. Different chip vendors have different names for these signals, nut Sony use SCOR for the subcode sync indicator, SQSO/SQCK as data/clock for the Q subcode and SBSO/EXCK for the full subcode (all 8 channels) - these signals are all still present on the PSX CD DSP, EXCK is grounded and SBSO open, so the MCU can only read subcode Q over SQSO/SQCK.

The DA data is handled separately - it's either parallel or (as in the case of the PSX) sent over a serial interface. The Sony chips use a format that's similar, but not identical to, the I2S format used by Phillips - it also has 3 lines (LRCLK, BCLK and DATA), but the timing is slightly different. You basically have a stream of data, an associated clock and another clock that toggles on word boundaries and the current state of which indicates which channel the current data is for (the timing of this signal is slightly different between the Sony and Phillips formats - for the Philips format, the LRCLK transition is on clock edge of the final bit cell of the previous word, and Sony change it one bit cell later at the actual transition between the left and right words).

The signal coming out of the CD DSP is the raw data from the disk, but it's clocked out of the read side of the buffer memory by the crystal controlled timing chain, so it's not subject to any short-term rate variations based on the disc rotation. In a CD player, this data will normally drive the DAC directly, but in the case of the PSX it's fed into a CD interface chip - the primary purpose of this chip is to decode CD-ROM data formats and send the decoded data to the main CPU - but in the PSX it also contains a ADPCM decoder, volume control/pan logic and a rate converter with a 3x oversampled output. On the later models, these transport streams are connected internally inside the chips, so you can't reroute them - I think that at least the raw 48 bit slot stream from the CD DSP is still available on some testpoints, though.
 

GetTheKnife

Member
Joined
Jun 27, 2019
Messages
17
Reaction score
0
AG User Name
GetTheKnife
AG Join Date
Today
Hi, I moved the point on my pm41 (2) and it still chirps :(.

Mine has had no tweaks or anything to the laser, because other than the chirping, it always read the games fine, no worse than my 900x. Everything that loads on my 900x, loads on the psone. Opened it today, moved it from rfck to wfck and well, it still does it. Games all load fine, same as always, all perfect there, but I never had any issues with mine in terms of playback of discs, just the chirping.

Still the same, still makes this dumb noise https://instaud.io/zDF the second the laser focus. Disconnect the chip or point 6 and it's all quiet again.

Wonder if I should try a psnee or if mine is just forever cursed with a cricket noise.
Yep, I did the same yesterday and the noise is still persistent, I don't know what changed, it still requieres lower resistence on the laser to read a backup which I have to test every psx to see if the laser is good.
 

Armadillo

New member
Joined
Jul 13, 2019
Messages
4
Reaction score
2
Yep, I did the same yesterday and the noise is still persistent, I don't know what changed, it still requieres lower resistence on the laser to read a backup which I have to test every psx to see if the laser is good.
:(.

If it's not just me then, I will try a psnee on mine this week. I bought a compatible board and a cheap usbasp programmer to get it on there. Never programmed one before, but if it all goes well, I'll try that & see what happens.
 

Trimesh

Refugee
Joined
May 30, 2019
Messages
43
Reaction score
34
AG User Name
Trimesh
AG Join Date
Jul 4, 2008
That's kind of disappointing - everything else on the PM-41 (2) install matches the earlier ones, so I don't know what to suggest...
 

GetTheKnife

Member
Joined
Jun 27, 2019
Messages
17
Reaction score
0
AG User Name
GetTheKnife
AG Join Date
Today
:(.

If it's not just me then, I will try a psnee on mine this week. I bought a compatible board and a cheap usbasp programmer to get it on there. Never programmed one before, but if it all goes well, I'll try that & see what happens.
Nice, I will probably just use a ps1 9000x model until I get that too.

That's kind of disappointing - everything else on the PM-41 (2) install matches the earlier ones, so I don't know what to suggest...
Not really, it must be doing something better with the new connection since it's better, the noise probably is the chip itself, bad coded probably with the last revision of the motherboard?
 

rama

Member
Joined
Jun 13, 2019
Messages
7
Reaction score
1
AG User Name
rama
AG Join Date
Dec 17, 2015
Well, every late board design modchip injects very nasty pulses into the tracking error input into the CD chip.
These pulses basically drown the original signal with the unlock symbols, and this is the only known method to fool the CD controller MCU.
I guess what happens with the PU-41(2) is that for some reason, the CD system reacts worse to these pulses than on earlier revisions.
It could be different values on some passive components, or it could be a revised CD DSP software.

In any case, the noise should stop soon after the boot process (symbol injections) has finished.
The modchip should be idle (stealth) then, and no longer affect this circuitry, except for the small capacitive load the cable and modchip pin presents.
 

Armadillo

New member
Joined
Jul 13, 2019
Messages
4
Reaction score
2
@GetTheKnife

Psnee fixed it.





With psnee, it behaves like @rama said it should.

There is the chirping when it's on the sony boot logo and the playstation logo, but it seems less, but as soon as the game loads the chirping goes away :).

I used the corrected wfck point as well.

Not sure why the onechip does not behave like that. One chip chirps the whole time.

Oh well, psnee works great, so that's me fixed. There is enough room under the shield, although I had to remove the button on the pro mini clone as it was causing a little bump and pressing the shield would press the button. Without it though, fits great. I still put some insulation tape on the metal shield above it, just incase though. I'm aware the power wire is across the post hole in the photo, that's just the photo, I forgot to push it out the way before taking it. There is more than enough slack to push it down below the post when mouted in the case :).
 

Bad_Ad84

Staff member
Administrator
Joined
May 30, 2019
Messages
28
Reaction score
104
AG User Name
Bad_Ad84
AG Join Date
26/05/2011
Maybe the stealth of the onechip isn't working. Maybe move point 2 across to the resistor on the right?

Then if theory is correct, stealth works and chip disables after boot.
 

Armadillo

New member
Joined
Jul 13, 2019
Messages
4
Reaction score
2
I tried some anti-mod games when I had the one chip and they booted fine, so I assumed it was working, but now I read a lot of anti mod games disable the protection on pal consoles. So maybe not. I think @GetTheKnife still has the onechip in, so maybe they can try the next resistor along before swapping to a psnee.

After some more testing occasionally getting the odd failed boot with psnee (cd player), don't remember if I had any with onechip, but I didn't test it as extensivly because the chirp was annoying.

I think they have all been ntsc, so maybe bios patch failing occasionally or just console being fussy. Work 9/10 times, so good enough really and no issues once booted. Think I'd prefer the occasional fail, than 100% but the chirp.
 
Last edited:

rama

Member
Joined
Jun 13, 2019
Messages
7
Reaction score
1
AG User Name
rama
AG Join Date
Dec 17, 2015
Nice :)
I think one classic modchip had some kind of bug that would have it permanently drag down the TEI signal after injection.
This bug could explain the chirping.
PsNee boot success isn't 100% because of all the variables affecting internal timing.
It needs to see more use and a few tweaks still.
I think it's worse on PAL PSOne units, because there's more timing stuff required.

But yeah, once it runs, it is the much better method to do stealth / re-arming, since it actually "knows" what it's doing ;)
 
Top