Tschicki
.
Hi there!
This is my first post here! I’ve been a long-time lurker around this forum and finally decided to post some progress on my latest project, as I think it might also help other people working on PS2s.
What is this project about?
It is about creating a PS2 system with minimal size and component count for portabalizing.
Why am I working on this project?
I love doing battery powered electronics as a hobby and I am often working on emulation consoles based on Raspberry Pis in my spare time.
So, at the end of 2020 I started working on another portable featuring the new RPi CM4 and a PCIe SSD. Half a year later, the housing design was almost done and the mainboard was ready for a first prototyping run. Of course, that was just about the time when the component shortage hit, and all of a sudden there were no more USB C PD controllers, no more STM32, and most importantly: no more CM4s. After another 6 months of searching components, I got frustrated and gave up on the project.
Electronics as a hobby is no fun without building circuits, so I had to search for alternative projects that did not require new ICs. That’s where the idea of reverse engineering a PS2 started to materialize, as PS2 slims are available for 10 bucks and they already contain most components. Why a PS2? That was my first console as a kid and to this day it is still my favorite console, I have so many good memories playing those games.
I was thinking about whether or not to start that project for quite a while, but in April of this year I finally convinced myself to tackle it.
Overview:
Before I felt confident enough to set requirements for the project, I had to analyze and modify a working 79004 mainboard to get to know the architecture. From time to time also testing FMCB and playing games on it to verify the stability of the modded system (too much playing and not enough analyzing TBH…). I also studied the wonderful PS2 trimming guide and Mister M’s board scans & worklog to get a better understanding of the board. Huge thanks for making that information public, that saved a lot of time!
Knowing a bit more about the system's architecture, I had to set a few requirements for my project to keep me focused in the ~3h I have per week:
Following that method, I derived some tasks to work on from the requirements above:
On top of that, the new old stock is very expensive. In an offer I got, the BOM cost for most chips on the mainboard was around 70 bucks and that did not even include the system clock PLL (next candidate for replacing...) and the BIOS chip. Compare that to the 10 bucks for a used console.
So that made me thinking about buying 90004 consoles with broken disk drives, as they are dirt cheap and nobody seems to like them, because of their limited softmodding capabilities.
After comparing the 79004 and 90004, it seems that they are virtually identical hardware-wise, just the BIOS is different.
So, I decided to put another requirement to my list:
PS2 mini memory card
I spent 2 hours of my life trying to reverse engineer an 8MB memory card from Sony. The one I took was based on a CXD9585BR MagicGate ASIC.
The circuit I came up with should also work with other ASIC revisions, but I haven’t tested that yet. The only real difference I noticed comparing it to other memory card revisions is that on some of them, pin 24 is grounded and on some it’s left floating. On the board I made using the CXD9585BR, I left it floating.
The circuit is pretty straight forward, the only components required from an existing card are the ASIC and the flash. The flash can probably also be bought and programmed with an existing file system, but I haven’t bothered yet. All other components can be bought new, the trickiest one to find was the voltage supervisor driving the reset line. An LM809M3-2.63 did the job in the end. The board itself is a bit bigger than the flash itself (the flash is on the bottom layer) and it’s just a simple 4-layer module for testing. The final module will probably look different, but the circuit is functional.
Here some pictures of the design:
Slim memory card socket
Because I hate cutting the controller/memory card port into pieces to get a single socket for a memory card, I had the idea of making a custom socket. That also enables me to make the socket a bit thinner in the process. I came up with a pretty cool little socket by misusing some TE 1447360-8 as contacts. It can be flat with the PCB and just needs a small 3D printed piece (that can be integrated into a housing to save space) as locking mechanism. The whole assembly is actually half as thick as the actual memory card.
It survived at least 100 mating cycles already, but I think it still needs some work. I would like to make the PCB thinner, so the contacts are not that close to their min working range + a cover around the contacts would be nice to give them a bit more protection.
Reprogrammable BIOS
That was an adventure. I have spent the last 3 months to get that working. First thing to find out was the correct pinout of that ROM, so I dumped a ROM from a donor board as reference, took a couple of shift registers and an ESP32 to build a circuit that can read the chip and print the contents to the console.
I also got some inspiration from the SCPH-7000 service manual and was hoping that the pinout would be identical. And surprise, it mostly is. At that point, only pins 12, 13, 14 and 15 were mystery pins to me. And was do we do with mystery pins? Yes, disconnect and see whether or not it still works. Not only was I able to read the contents of the chip correctly in that process, I also found out that you can disconnect pins 1, 12, 13, 14, 15 + the upper data byte and the chip still outputs the correct data. To be on the safe side, I pulled pin 1 up and pulled pins 12, 13, 14 and 15 down. The upper data byte can be left floating I guess.
That eliminated all my uncertainties about driving the ROM and the only pins required are OE, D0-D7 and A0-A21. That’s perfect for retrofitting an OTS flash. I also verified the functionality on a 79004 mainboard after removing all those pins.
So, the next step was to choose a suitable replacement. After hooking up the logic analyzer, I knew that the OE LOW time was min. 120ns and assuming that the PS2 latches the data in the center of the pulse (just assuming, because the interface is asynchronous), I would need an access time of MAX 60ns. That is quite fast, as most parallel flash chips today are only rated at 70ns+. Then I ordered 3 chips that were available (thank you chip shortage):
Long story short, the MX29LV320ETTI-70G and the S29JL032J60TFI010 did not work, probably because they are just too slow (as expected, kind of). The MX29LV320ETTI-70G only showed a black screen and the S29JL032J60TFI010 did boot, even into FMCB, but the firmware had some weird bugs, as if some bits were flipped while reading. To try and compare the speeds, I piggybacked the original ROM on top of the new ones and left the data pins disconnected. The logic analyzer showed a clear win for the original ROM regarding the access time.
Then came my last try with the S29PL064J55BFI070. It was a bit more difficult to do the testing, because it’s a BGA-48 chip and its 4Mx16 instead of the 4Mx8 the PS2 needs. To be on the safe side, I’ve written a little program that inserts 8 zeros in the high byte of every address in the dumped 79004 BIOS to make the file 4Mx16. Flashing it involved a ratsnest of wires, because cheap me refused to buy the BGA-48 adapter for the TL866.
The fact that the S29PL064J55BFI070 is apparently not listed in the supported flash chips did not make it easier. But all that effort was worth it, IT BOOTS, the patient is alive. The PS2 90004 boots into FMCB and can play games from USB and ethernet. That means it works, at least for the sample size of 1 that I’ve got. Let's hope for now that I did not just get a good batch of flash chips and that it will also work on others.
And I’m not soldering another one anytime soon. I have 3 chips left and when trying to order more after that success, they were sold out; 39-week leadtime - thank you chip shortage. 3 chips for the next 39+ weeks, that flash will most likely be incorporated in a module I can reuse, in case there is no replacement for it.
PLEASE, if anyone can give any hints or suggestions on where to buy the S29PL064J55BFI070, or an equivalent alternative, I would really appreciate that. Because that is the only flash with 55ns access time that I was able to find.
Ethernet
I think the picture says it all. Not very exciting. I replaced the transformer inside the ethernet jack with something you can actually buy today (Würth 749013011A). The circuit is now similar to the one found on the GH-061-51 mainboard. I verified it by playing my favorite PS2 game Okami for far too long via SMB. The only thing I hate about the transformer I used is the height – that thing is like a skyscraper, but it will do for now.
Modified mainboard and reverse engineering
Oh, that poor GH-062-12 had to go through A LOT. I started removing components until the console didn’t boot and ended up with most components removed. Also desoldered and resoldered most passives to get the values. The power supply is now composed of 5 buck converters from amazon for 5V, 3V5, 2V5, 1V75 and 1V25. What? You’re asking why the 1V25 one is so huge and taped to the board? Because its predecessor couldn’t handle the load and released some magic smoke during an intense NFSMW session.
On that board you can also see the mini memory card in action, flashed with FMCB and ready to go. The audio codec was also successfully swapped with the CS4335-KSZ from mouser.
Not much more to tell about that board, so I will give you and overview of the schematics. I tried to make them as easy to read as possible, but there is still some room for improvement.
Layout of the mainboard (first prototype)
The board is currently 80x80mm in size and features 6 layers for improved signal integrity. I went with the following stackup: SIG – GND - PWR/SIG - PWR/SIG – GND - SIG at 1,6mm. The prepreg in the center is the thickest to reduce coupling between the 2 PWR layers.
The connectivity of the layout should be identical to my stripped-down mainboard, but I’m still in the process of cross checking the connections. The first prototype only provides the core functionality for booting, that means EE, GS, DSP, Mechacon, BIOS chip, ethernet PHY and the system clock PLL. The video DAC, audio codec, power management, connectors for USB gamepads, memory cards, ethernet will be external and are connected using ffcs. Currently, the board still includes the new flash, but I will mount it on a module for the upcoming prototypes, until I can source them reliably. The boards will most likely be manufactured at Aisler, as the price is reasonable at 14€ per piece (6 layers!!) and they are manufactured in Europe.
In parallel to the mainboard, I am also designing the video+audio relocation to test the first prototype. That enables me to take that circuitry off the mainboard and to swap it with a custom video processor later. I wasn’t sure whether or not that relocation would work, as the pixel clock is quite high at ~55MHz and I left the terminations only on the mainboard.
That’s easy to find out though, I can just make a small adapter to connect to an existing console and connect my video relocation from there. Then I have a known working video output for the new mainboard design. The board is 90% prototyped and almost ready for testing. Stupid me just forgot to order the small ffc socket, the LDOs and some caps. I could hook it up like this, but I’ll wait until I have all the parts. In the following picture you can see the current status of the board:
Prototyping the mainboard
Hopefully soon! I have most of the reballing equipment and most components ready. Any recommendations for good flux?
What’s keeping me from ordering the boards:
I could continue writing about the progress for another couple of pages, but I think I'll have to stop it here. Looking at that big chunk of text, I should have probably started posting my progress earlier. Hopefully it's not too hard to read, but I hope that might help some people with their PS2 projects. I would also like to apologize in case some of the pictures are messed up, I have honestly never posted on a forum before. Also sorry in case some things are hard to understand, I'm not a native english speaker in the end, but I'm trying my best.
I will try to keep the thread updated when there is notable progress to report.
This is my first post here! I’ve been a long-time lurker around this forum and finally decided to post some progress on my latest project, as I think it might also help other people working on PS2s.
What is this project about?
It is about creating a PS2 system with minimal size and component count for portabalizing.
Why am I working on this project?
I love doing battery powered electronics as a hobby and I am often working on emulation consoles based on Raspberry Pis in my spare time.
So, at the end of 2020 I started working on another portable featuring the new RPi CM4 and a PCIe SSD. Half a year later, the housing design was almost done and the mainboard was ready for a first prototyping run. Of course, that was just about the time when the component shortage hit, and all of a sudden there were no more USB C PD controllers, no more STM32, and most importantly: no more CM4s. After another 6 months of searching components, I got frustrated and gave up on the project.
Electronics as a hobby is no fun without building circuits, so I had to search for alternative projects that did not require new ICs. That’s where the idea of reverse engineering a PS2 started to materialize, as PS2 slims are available for 10 bucks and they already contain most components. Why a PS2? That was my first console as a kid and to this day it is still my favorite console, I have so many good memories playing those games.
I was thinking about whether or not to start that project for quite a while, but in April of this year I finally convinced myself to tackle it.
Overview:
Before I felt confident enough to set requirements for the project, I had to analyze and modify a working 79004 mainboard to get to know the architecture. From time to time also testing FMCB and playing games on it to verify the stability of the modded system (too much playing and not enough analyzing TBH…). I also studied the wonderful PS2 trimming guide and Mister M’s board scans & worklog to get a better understanding of the board. Huge thanks for making that information public, that saved a lot of time!
Knowing a bit more about the system's architecture, I had to set a few requirements for my project to keep me focused in the ~3h I have per week:
- the new mainboard shall be able to run games from USB/Ethernet
- the original layout shall be simplified and the component count minimized
- it shall feature an embedded miniaturized FMCB memory card
- it shall feature a compact memory card slot that is compatible with original memory cards
- it shall feature a custom gamepad interface with at least 1 gamepad
- it shall feature more advanced video output by directly reading the parallel RGB on the video DAC
Following that method, I derived some tasks to work on from the requirements above:
- design and test a miniaturized version of an original PS2 memory card to get me in the mood of reverse engineering
- design and test a slim memory card socket for original memory cards
- remove all unnecessary components from a working 79004 mainboard, so only the core components are left that are required to boot and to test the console
- reverse engineer that modified 79004 mainboard and create readable schematics + optimize the BOM
- do the layout of the mainboard in a modular manner to simplify testing
- design and test an ethernet transformer circuit for the ethernet PHY, based on OTS magnetics
- design and test a compact power management system that powers the mainboard and runs off batteries
- design and test a custom board to handle gamepad inputs (probably starting with PS2+)
- design and test a video processor for an external display that deinterlaces and scales the parallel RGB of the PS2
On top of that, the new old stock is very expensive. In an offer I got, the BOM cost for most chips on the mainboard was around 70 bucks and that did not even include the system clock PLL (next candidate for replacing...) and the BIOS chip. Compare that to the 10 bucks for a used console.
So that made me thinking about buying 90004 consoles with broken disk drives, as they are dirt cheap and nobody seems to like them, because of their limited softmodding capabilities.
After comparing the 79004 and 90004, it seems that they are virtually identical hardware-wise, just the BIOS is different.
So, I decided to put another requirement to my list:
- I shall be able to source the components from either a 79004 or a 90004 console.
- replace the original BIOS ROM with a reprogrammable one to support 90004 hardware. And boy that was fun, more later.
PS2 mini memory card
I spent 2 hours of my life trying to reverse engineer an 8MB memory card from Sony. The one I took was based on a CXD9585BR MagicGate ASIC.
The circuit I came up with should also work with other ASIC revisions, but I haven’t tested that yet. The only real difference I noticed comparing it to other memory card revisions is that on some of them, pin 24 is grounded and on some it’s left floating. On the board I made using the CXD9585BR, I left it floating.
The circuit is pretty straight forward, the only components required from an existing card are the ASIC and the flash. The flash can probably also be bought and programmed with an existing file system, but I haven’t bothered yet. All other components can be bought new, the trickiest one to find was the voltage supervisor driving the reset line. An LM809M3-2.63 did the job in the end. The board itself is a bit bigger than the flash itself (the flash is on the bottom layer) and it’s just a simple 4-layer module for testing. The final module will probably look different, but the circuit is functional.
Here some pictures of the design:
Slim memory card socket
Because I hate cutting the controller/memory card port into pieces to get a single socket for a memory card, I had the idea of making a custom socket. That also enables me to make the socket a bit thinner in the process. I came up with a pretty cool little socket by misusing some TE 1447360-8 as contacts. It can be flat with the PCB and just needs a small 3D printed piece (that can be integrated into a housing to save space) as locking mechanism. The whole assembly is actually half as thick as the actual memory card.
It survived at least 100 mating cycles already, but I think it still needs some work. I would like to make the PCB thinner, so the contacts are not that close to their min working range + a cover around the contacts would be nice to give them a bit more protection.
Reprogrammable BIOS
That was an adventure. I have spent the last 3 months to get that working. First thing to find out was the correct pinout of that ROM, so I dumped a ROM from a donor board as reference, took a couple of shift registers and an ESP32 to build a circuit that can read the chip and print the contents to the console.
I also got some inspiration from the SCPH-7000 service manual and was hoping that the pinout would be identical. And surprise, it mostly is. At that point, only pins 12, 13, 14 and 15 were mystery pins to me. And was do we do with mystery pins? Yes, disconnect and see whether or not it still works. Not only was I able to read the contents of the chip correctly in that process, I also found out that you can disconnect pins 1, 12, 13, 14, 15 + the upper data byte and the chip still outputs the correct data. To be on the safe side, I pulled pin 1 up and pulled pins 12, 13, 14 and 15 down. The upper data byte can be left floating I guess.
That eliminated all my uncertainties about driving the ROM and the only pins required are OE, D0-D7 and A0-A21. That’s perfect for retrofitting an OTS flash. I also verified the functionality on a 79004 mainboard after removing all those pins.
So, the next step was to choose a suitable replacement. After hooking up the logic analyzer, I knew that the OE LOW time was min. 120ns and assuming that the PS2 latches the data in the center of the pulse (just assuming, because the interface is asynchronous), I would need an access time of MAX 60ns. That is quite fast, as most parallel flash chips today are only rated at 70ns+. Then I ordered 3 chips that were available (thank you chip shortage):
- MX29LV320ETTI-70G at 70ns; probably not working
- S29JL032J60TFI010 at 60ns; could be close
- S29PL064J55BFI070 at 55ns; might be promising
Long story short, the MX29LV320ETTI-70G and the S29JL032J60TFI010 did not work, probably because they are just too slow (as expected, kind of). The MX29LV320ETTI-70G only showed a black screen and the S29JL032J60TFI010 did boot, even into FMCB, but the firmware had some weird bugs, as if some bits were flipped while reading. To try and compare the speeds, I piggybacked the original ROM on top of the new ones and left the data pins disconnected. The logic analyzer showed a clear win for the original ROM regarding the access time.
Then came my last try with the S29PL064J55BFI070. It was a bit more difficult to do the testing, because it’s a BGA-48 chip and its 4Mx16 instead of the 4Mx8 the PS2 needs. To be on the safe side, I’ve written a little program that inserts 8 zeros in the high byte of every address in the dumped 79004 BIOS to make the file 4Mx16. Flashing it involved a ratsnest of wires, because cheap me refused to buy the BGA-48 adapter for the TL866.
The fact that the S29PL064J55BFI070 is apparently not listed in the supported flash chips did not make it easier. But all that effort was worth it, IT BOOTS, the patient is alive. The PS2 90004 boots into FMCB and can play games from USB and ethernet. That means it works, at least for the sample size of 1 that I’ve got. Let's hope for now that I did not just get a good batch of flash chips and that it will also work on others.
And I’m not soldering another one anytime soon. I have 3 chips left and when trying to order more after that success, they were sold out; 39-week leadtime - thank you chip shortage. 3 chips for the next 39+ weeks, that flash will most likely be incorporated in a module I can reuse, in case there is no replacement for it.
PLEASE, if anyone can give any hints or suggestions on where to buy the S29PL064J55BFI070, or an equivalent alternative, I would really appreciate that. Because that is the only flash with 55ns access time that I was able to find.
Ethernet
I think the picture says it all. Not very exciting. I replaced the transformer inside the ethernet jack with something you can actually buy today (Würth 749013011A). The circuit is now similar to the one found on the GH-061-51 mainboard. I verified it by playing my favorite PS2 game Okami for far too long via SMB. The only thing I hate about the transformer I used is the height – that thing is like a skyscraper, but it will do for now.
Modified mainboard and reverse engineering
Oh, that poor GH-062-12 had to go through A LOT. I started removing components until the console didn’t boot and ended up with most components removed. Also desoldered and resoldered most passives to get the values. The power supply is now composed of 5 buck converters from amazon for 5V, 3V5, 2V5, 1V75 and 1V25. What? You’re asking why the 1V25 one is so huge and taped to the board? Because its predecessor couldn’t handle the load and released some magic smoke during an intense NFSMW session.
On that board you can also see the mini memory card in action, flashed with FMCB and ready to go. The audio codec was also successfully swapped with the CS4335-KSZ from mouser.
Not much more to tell about that board, so I will give you and overview of the schematics. I tried to make them as easy to read as possible, but there is still some room for improvement.
Layout of the mainboard (first prototype)
The board is currently 80x80mm in size and features 6 layers for improved signal integrity. I went with the following stackup: SIG – GND - PWR/SIG - PWR/SIG – GND - SIG at 1,6mm. The prepreg in the center is the thickest to reduce coupling between the 2 PWR layers.
The connectivity of the layout should be identical to my stripped-down mainboard, but I’m still in the process of cross checking the connections. The first prototype only provides the core functionality for booting, that means EE, GS, DSP, Mechacon, BIOS chip, ethernet PHY and the system clock PLL. The video DAC, audio codec, power management, connectors for USB gamepads, memory cards, ethernet will be external and are connected using ffcs. Currently, the board still includes the new flash, but I will mount it on a module for the upcoming prototypes, until I can source them reliably. The boards will most likely be manufactured at Aisler, as the price is reasonable at 14€ per piece (6 layers!!) and they are manufactured in Europe.
In parallel to the mainboard, I am also designing the video+audio relocation to test the first prototype. That enables me to take that circuitry off the mainboard and to swap it with a custom video processor later. I wasn’t sure whether or not that relocation would work, as the pixel clock is quite high at ~55MHz and I left the terminations only on the mainboard.
That’s easy to find out though, I can just make a small adapter to connect to an existing console and connect my video relocation from there. Then I have a known working video output for the new mainboard design. The board is 90% prototyped and almost ready for testing. Stupid me just forgot to order the small ffc socket, the LDOs and some caps. I could hook it up like this, but I’ll wait until I have all the parts. In the following picture you can see the current status of the board:
Prototyping the mainboard
Hopefully soon! I have most of the reballing equipment and most components ready. Any recommendations for good flux?
What’s keeping me from ordering the boards:
- Verifying the functionality of the video DAC relocation
- Designing a reusable module for my precious flash
- Finishing cross-checking the design with the real deal
I could continue writing about the progress for another couple of pages, but I think I'll have to stop it here. Looking at that big chunk of text, I should have probably started posting my progress earlier. Hopefully it's not too hard to read, but I hope that might help some people with their PS2 projects. I would also like to apologize in case some of the pictures are messed up, I have honestly never posted on a forum before. Also sorry in case some things are hard to understand, I'm not a native english speaker in the end, but I'm trying my best.
I will try to keep the thread updated when there is notable progress to report.