AIFlasherRepair OS

iPhone boot sequence

iPhone boot sequence: find the first stage that does not complete

Eight stages from main supply to running iOS, each with what you see on the bench when it works and when it stops. DC supply current, the USB mode and the panic log place the fault.

01

iPhone boot sequence: stage by stage, what you see, where it stops

Read the table top to bottom: the first stage that does not complete is where the fault is. Bench readings are on a DC supply at battery voltage.

StageWhat happensBench observation when it worksIf it stops hereNext pageSource
0 · Main supplyPP_BATT_VCC feeds PP_VDD_MAIN: through the Tigris MOSFET on iPhone 7 / 8 / X, through an inductor on iPhone 12.No current before pressing power.High current before the power prompt (reference for iPhone 7 from Repair Wiki: about 2 A or more): short on PP_VDD_MAIN (or PP_VDD_BOOST, backlight or speaker-amp boost lines). Compare with a known-good board of the same model.No Power

Source: Repair Wiki - How to fix an iPhone 7 that does not turn on · Repair Wiki - How to fix iPhone X that does not power on · iFixit Guide - Fix iPhone 12 won't turn on by infrared thermal imaging camera · Rossmann Group - Dead iPhone data recovery (DC supply current patterns)

1 · PMIC power-upThe PMIC brings up the power rails.Current starts after the power prompt and keeps climbing.Rossmann Group examples (model not stated): Rossmann Group examples (model not stated): Rossmann Group examples (model not stated): 0.15 to 0.25 A first reading with no progress: Tristar / Tigris; about 2 mA with a brief 30 mA peak: Tristar or PMIC.Charging / PMIC

Source: Rossmann Group - Dead iPhone data recovery (DC supply current patterns) · Rossmann Group - iPhone boot loop / stuck Apple logo (boot stages)

2 · CPU reset releasedThe PMIC releases the CPU reset (PMU_TO_SYSTEM_COLD_RESET_L in the iPhone 6s case).Rails stay up.All rails power up and down about every 50 ms, current flicking 0 to 3 mA: something makes the PMIC reset the CPU; check reset and I2C lines (Tristar replacement fixed one case).PMIC

Source: iFixit Answers - iPhone 6s: all power rails power up and down (PMU_TO_SYSTEM_COLD_RESET_L)

3 · Boot ROMThe CPU runs its immutable Boot ROM (hardware root of trust), which verifies the next stage.CPU executes; current moves on from the power-up value.Rossmann Group example (model not stated): Rossmann Group example (model not stated): 20 to 40 mA steady ("brain dead"): CPU cannot execute (broken coils above the CPU or CPU solder fracture). Boot ROM cannot load the next stage: DFU mode.NAND / Restore

Source: Apple Platform Security - Boot process for iPhone and iPad devices · Rossmann Group - Dead iPhone data recovery (DC supply current patterns)

4 · LLB → iBootA9 and earlier (iPhone 6s generation and older): Boot ROM verifies LLB, LLB verifies iBoot. Newer chips: Boot ROM verifies iBoot directly.—LLB or iBoot fails: recovery mode ("Connect to computer"); Update keeps data, Restore erases.Restore

Source: Apple Platform Security - Boot process for iPhone and iPad devices · Apple Support - iPhone 6s technical specifications (A9 chip) · Apple Support - If you can't update or restore your iPhone (recovery mode)

5 · StorageThe boot chain reads the OS from NAND; NAND rails per source: PP3V0_NAND (iPhone 6, 8); PP2V63_NAND, PP1V8_NAND, PP0V9_NAND (iPhone 11); PP3V0_NAND, PP0V9_NAND, PP1V8_IO (iPhone X).—0 → 320 mA → 0 → 1.4 A cycling: shorted capacitor on the NAND rail; iPhone 13 held at 1.9 A with a PP3V0 NAND short. CPU on but no valid OS on NAND: DFU, restore only.NAND

Source: Rossmann Group - iPhone DFU mode recovery (NAND rails, DFU vs recovery) · Rossmann Group - Dead iPhone data recovery (DC supply current patterns) · Repair Wiki - How to fix iPhone X that does not power on · iFixit Guide - iPhone 13 no power easy solution (PP3V0 NAND short)

6 · Kernel and iOSiBoot verifies and runs the kernel; iOS initialises its hardware (Apple logo).Rossmann Group example (model not stated): about 0.4 to 0.8 A at 3.8 to 4.0 V during a normal boot. An example only: judge against a known-good board of the same model.Logo loop: corrupted software (interrupted update) or a flex, IC or solder joint that stops a component initialising.Boot / Restart

Source: Apple Platform Security - Boot process for iPhone and iPad devices · Rossmann Group - Dead iPhone data recovery (DC supply current patterns) · Rossmann Group - iPhone boot loop / stuck Apple logo (boot stages)

7 · RunningThe CPU needs periodic sensor data after boot.Stays on.Restarts about every 3 minutes: a sensor is not reporting; the panic log names it.Panic Analyzer

Source: iPad Rehab - Troubleshooting iPhone reboot problems (missing thermal data, 3-minute loop)

The Secure Enclave also runs its own verified boot of sepOS (Apple Platform Security).

02

DC supply current patterns and what they mean

Connect the board to a DC supply at battery voltage and watch the current before and after the power prompt.

PatternReadingStalls atLikely causeSource
Normal boot (Rossmann Group example, model not stated)0.4-0.8 A @ 3.8-4.0 V—Healthy boot.

Source: Rossmann Group - Dead iPhone data recovery (DC supply current patterns)

Immediate limit (reference for iPhone 7 from Repair Wiki; Rossmann Group example)2 A+ before promptNever startsPP_VDD_MAIN short (shorted capacitor).

Source: Rossmann Group - Dead iPhone data recovery (DC supply current patterns) · Repair Wiki - How to fix an iPhone 7 that does not turn on

Immediate limit (iPhone 11 Pro case)3.1 ANever startsMain supply shorted to ground; capacitor C1200_K on the signal board.

Source: iFixit Guide - How to fix an iPhone 11 Pro that won't turn on (C1200_K)

Low start (Rossmann Group example, model not stated)0.15-0.25 ANo boot progressTristar / Tigris charging IC.

Source: Rossmann Group - Dead iPhone data recovery (DC supply current patterns)

Oscillating (Rossmann Group example; Repair Wiki iPhone X guide)0 → 320 mA → 0 → 1.4 APMIC restart loopShorted capacitor downstream of the PMIC on the NAND rail.

Source: Rossmann Group - Dead iPhone data recovery (DC supply current patterns) · Repair Wiki - How to fix iPhone X that does not power on

High hang (iPhone 13 case)1.9 ANo bootPP3V0 NAND capacitor short next to the NAND.

Source: iFixit Guide - iPhone 13 no power easy solution (PP3V0 NAND short)

Brain dead (Rossmann Group example, model not stated)20-40 mA steadyCPU cannot executeBroken coils above the CPU, or CPU solder fracture.

Source: Rossmann Group - Dead iPhone data recovery (DC supply current patterns)

Near zero (Rossmann Group example, model not stated)~2 mA, brief 30 mA peakUSB handshakeTristar or PMIC.

Source: Rossmann Group - Dead iPhone data recovery (DC supply current patterns)

Rapid flicker (iPhone 6s case)0-3 mA, ~50 ms cyclesCPU resetPMIC keeps resetting the CPU: reset / I2C lines; Tristar in one case.

Source: iFixit Answers - iPhone 6s: all power rails power up and down (PMU_TO_SYSTEM_COLD_RESET_L)

Values are the ones each source reports; a multimeter can miss fast cycles (the 6s case needed watching the supply). These are readings from the named cases, not pass/fail limits: compare with a known-good board of the same model.

03

What the computer sees: USB modes and IDs

The USB product ID tells which boot stage the phone reached; the AIFlasher desktop app reads it the same way libirecovery does.

ModeUSB product IDMeaningWhat you can doSource
Recovery0x1280 / 0x1281 / 0x1282 / 0x1283Reached LLB / iBoot; a later stage failed or recovery was forced.Update first (keeps data), then Restore (erases).

Source: libirecovery - libirecovery.h (USB product IDs of recovery / DFU modes) · Apple Platform Security - Boot process for iPhone and iPad devices · Apple Support - If you can't update or restore your iPhone (recovery mode)

DFU0x1227Boot ROM could not load the next stage; the CPU is powered but finds no valid OS.Restore only; storage (NAND) is the usual suspect when it will not restore.

Source: libirecovery - libirecovery.h (USB product IDs of recovery / DFU modes) · Apple Platform Security - Boot process for iPhone and iPad devices · Rossmann Group - iPhone DFU mode recovery (NAND rails, DFU vs recovery)

WTF0x1222Named in libirecovery; its meaning is not documented in the reviewed sources.—

Source: libirecovery - libirecovery.h (USB product IDs of recovery / DFU modes)

Port DFU0xf014Named in libirecovery; its meaning is not documented in the reviewed sources.—

Source: libirecovery - libirecovery.h (USB product IDs of recovery / DFU modes)

04

Stage finder: observation to boot stage

Pick the model and the symptom, answer the bench tests you have done. The result updates as you answer and lists its sources.

DC supply: near-zero current before pressing power?
After the power prompt, does current keep climbing towards the boot current of a known-good board of the same model?
Does a computer detect the phone at all (any mode)?
Does the Apple logo appear?
Does it stay on longer than 3 minutes?

05

Observations and their stage

06

Bench tests in order

TestIf yesIf noSource
DC supply: near-zero current before pressing power?—Stage 0: main-line short.

Source: Repair Wiki - How to fix an iPhone 7 that does not turn on · Rossmann Group - Dead iPhone data recovery (DC supply current patterns)

After the power prompt, does current keep climbing towards the boot current of a known-good board of the same model?—Stops early: stage 1 to 3 (PMIC, reset, CPU).

Source: Rossmann Group - Dead iPhone data recovery (DC supply current patterns)

Does a computer detect the phone at all (any mode)?Read the mode: DFU, Recovery or normal.—

Source: libirecovery - libirecovery.h (USB product IDs of recovery / DFU modes)

Does the Apple logo appear?Reached stage 6 (kernel).—

Source: Apple Platform Security - Boot process for iPhone and iPad devices

Does it stay on longer than 3 minutes?—Stage 7: missing-sensor watchdog.

Source: iPad Rehab - Troubleshooting iPhone reboot problems (missing thermal data, 3-minute loop)

07

Where each stage continues

08

After the repair: verify before handing over

  1. Current before the power prompt is near zero; boot current settles in the normal range.
  2. The phone passes the Apple logo and stays on well past 3 minutes.
  3. Record the stage, the readings and the fix in the dossier.

Source: Rossmann Group - Dead iPhone data recovery (DC supply current patterns) · iPad Rehab - Troubleshooting iPhone reboot problems (missing thermal data, 3-minute loop)

09

Using the stage table at the bench

Measure in the order the phone boots; stop at the first stage that does not complete.

  1. Visual inspection, then known-good parts, then DC supply current, then diode mode on the power rails, then injection with a thermal camera, then microsoldering.
  2. Use the computer: DFU, Recovery or normal mode tells which side of the boot chain was reached.
  3. After the logo, the panic log takes over from the current meter.

Source: Rossmann Group - Dead iPhone data recovery (DC supply current patterns) · Apple Platform Security - Boot process for iPhone and iPad devices

No per-rail voltages are published here: the reviewed sources give line names and current patterns, not rail values for named boards.

10

Common boot-sequence claims, checked

✗ DFU and Recovery are the same thing.

✓ Apple: Boot ROM failing to load the next stage gives DFU; LLB or iBoot failing gives Recovery. Recovery offers Update and Restore, DFU only Restore.

Source: Apple Platform Security - Boot process for iPhone and iPad devices · Rossmann Group - iPhone DFU mode recovery (NAND rails, DFU vs recovery)

✗ Move the NAND to a good board to recover the data.

✓ The data is encrypted with keys in the original board's Secure Enclave; on another board it is unreadable.

Source: Rossmann Group - iPhone DFU mode recovery (NAND rails, DFU vs recovery)

✗ A multimeter on the rails is enough to see a reset loop.

✓ In the iPhone 6s case the rails cycled about every 50 ms, too fast for a standard meter; watch the supply current.

Source: iFixit Answers - iPhone 6s: all power rails power up and down (PMU_TO_SYSTEM_COLD_RESET_L)

11

Case dossier

Stays in this browser tab. Copy it into your job card or WhatsApp. Readings are yours: record the known-good value from the same model.

Line / pin (from boardview)Known-good (same model)This board

Sources

Knowledge base 1.0 · 2026-10-01

Next: common faults database →
CallWhatsApp