Device: iPhone 12 Pro Max, A2411, iOS 16.5.1. Two boards in a sandwich: 820-01940 on top (CPU) and 820-01971 at the bottom (RF, baseband).
Symptoms: No Service. The Modem Firmware line in Settings > General > About was empty. No IMEI.
History: it came from another repair center. They had reballed the baseband CPU and the Wi-Fi IC. No change.
Result: fixed. Modem firmware is back, IMEI shows, signal, calls and mobile data work with a SIM. Face ID works. The Parts and Service History warnings are gone.
Cause: one shorted capacitor, C409_E, on the baseband 1.9 V supply PP_1V9_SMPS4. The baseband CPU was fine.
Part 1: what the phone showed
- Modem Firmware empty, no IMEI, No Service.
- Parts and Service History: Battery Service, Mobile Data Issue, Face ID Issue.
- Battery Service is a separate thing. The battery is at 80 % health with 1276 cycles. That is wear.
We did not restore or erase the phone first. With no modem there is no IMEI, and a phone with no IMEI can fail activation after a restore. The customer’s data would be gone too.
Part 2: why the first repair did not fix it
Modem Firmware empty means the main CPU can not talk to the baseband. There are three common reasons:
- no power on the baseband: a rail is missing or shorted
- a bad solder joint under the baseband CPU
- a broken connection between the two boards (the interposer)
The other repair center went straight to the chips and reballed the baseband CPU and the Wi-Fi IC. If the baseband has no power, a reball can not bring it back. It was the wrong diagnosis.
To reach those chips the two boards have to be separated. You can see it on the board edge: solder spots on the gold interposer wall from the earlier opening.
Every reball and every separation is another heat cycle for the board. On a sandwich board that is risky: pads can lift, small parts near the chip can move. This board went through reballs it did not need.
The right order is to measure first. Check the baseband power rails in diode mode before you touch any chip. It takes a few minutes. A rail with a dead short tells you the fault is a part on that rail, not a solder joint under a chip.
Part 3: finding the short
We separated the boards on the preheater and measured the baseband power rails on the bottom board in diode mode.
The baseband power chip is UBBPMU_E, a Qualcomm PMX55.
PP_1V9_SMPS4 (PMX55 buck S4, the 1.9 V baseband supply) read 0.4 to 0.7 mV. That is a dead short. The boardview diode value for this rail is about 378 mV.
Parts on this rail: PMX55 pins 133, 134 and 135, the coil L404_E, the caps C409_E, C431_E and C5902_E, the filter FL5921_E and the test pad PP4724_E.
We injected power into the rail and checked it with the thermal camera. One small part got hot: C409_E, the cap next to the coil under the PMX55.
We removed C409_E. The rail now reads 391 mV. The short is gone.
The cap on its own reads 0.2 mV between its two ends. A good cap reads OL. The short was inside the capacitor.
Part 4: the fix
- New capacitor on C409_E, same size and value.
- Interposer reballed in the stencil fixture, then the two boards bonded back together.
Test with a SIM:
- Modem Firmware 8.10.01, IMEI back
- signal, calls and mobile data work
- Face ID works again
- Parts and Service History: the Battery, Mobile Data and Face ID warnings are gone. In About, Coverage is now followed straight by Songs.
Serial, MAC, EID and IMEI numbers are blurred. The first and last digit are left so you can see it is the same phone.
Lessons
- Modem Firmware empty is not always the baseband CPU. Measure the baseband rails first.
- A dead short on a rail means a part on that rail. A thermal camera or rosin finds it.
- Every reball on a sandwich board is a risk. Reball only when the measurements point to a joint.
- Don’t restore an iPhone with no modem firmware before you know the cause.
With the right diagnosis this board needed one small capacitor and one re-bond. Measure first. It saves the board.