See down below for completely shorted board.. there seems to be a few board problems.. one is poor capacitors and the other unknown short but can be got around.

I bought a couple of Gen 3 TC (2nd hand of course) as it turned out just before the Gen 4 came out. Actually got burned by the big price drop.
One had faults (it kept rebooting itself) but figured it was just another dead power supply.. but it wasn't.

The issue got progressively worse and I simply put it aside. Now that I have some time to look carefully I find the issue different .. completely.

There was nothing wrong with the power supply. I removed and replaced it regardless. I also found it used a samsung hard drive and swapped that out as well. Still no improvement.

Neither change made any difference.. so I have pulled it entirely to pieces..
I realised as long as ethernet wasn't actually plugged in it worked fine.. I could access it by wireless no trouble.
Not the first time I have seen dead capacitors on router cause ethernet problems.. linksys routers were always having this issue.
I thought the issue could be an on board power converter. This model has 4 of them, producing 1v 1.1v 1.8v and 3.3v (I think 1.1 should be 1.2 but I doubt it is the issue).
1.8v seemed to be the most used.. memory, processor and switch chip.
It was impossible to pick this up on a meter.. the fluctuation on the dc side was from 1.86 to 1.85v and I would have discounted it.
But it was clear on the scope that the power supply (5v to 1.8v converter) was suffering when the switch chip was turned on during boot.
And especially when I plugged in the ethernet cables it jumped to almost 0.3v ripple .. It is now about 0.1v which may explain why the voltage is set a little high.

Anyhow it is fixed.. the solution turned out to be fairly easy.
I soldered one of my normal Rubycon 1200uF Low Esr 6.3v caps across the 1.8v power supply.. this killed the bad ripple that was effecting the output of the supply.. I have now got it setup again.. doing TM backups and using both lan and wan cables..
The 1.8v converter supplies a lot more current than the others.







    When you remove the board, undo all the screws and the 3 posts that support the bottom cover.
    Carefully press in the steel spring clips (second one not pictured on other end of the steel frame) after you unplug the the rather tiny plug that goes to the LED.

    Lift the board over so you can see the bottom.











    The various power supply converters.

    There is a 1v on top, next to the board plug.
    Three on the bottom. Again adjacent to the board plug is 1.1v.
    Above it and just under the wireless card, 3.3v
    And just above the processor is the 1.8v.











    Well here is my fix.. crude maybe but it worked fine. Too much hash on the 1.8v line.
    Rather than try and remove and replace all those surface mount capacitors.. for which I do not have the equipment.
    I measured there is exactly enough room for the capacitor to fit. Solder gnd side to the gnd ring around the processor.
    And positive to the end of the inductor.. use enough heat to get a good solder joint but not excessive for the inductor to come off.
    I did resolder it with components leads as short as possible... but make sure the cap can sit flat to the board.
    I used a high grade 1200uF 6.3v I use for power supply repairs.. actual spec is not a big deal. Use a LOW ESR cap though.. >1000uF.. any motherboard one should be fine.
    If any of the silicon rubber heat sink materials come off carefully position them as you place it back.

Now something new.

    The next step in the journey.. since I had a faulty but possibly repairable Gen3 I was asked about serial and jtag.. well I have seen the port there under the power supply.
    Credit to Mikhail Emelchenkov
    He took up the suggestion and found Tx output on the board of the Gen2.
    The 20pin connector under the power supply includes serial port .. maybe two of them but one is not connected.
    Pins used are 11 Tx and 13 Rx. You can get 3.3v from pin 19 & 20. Gnd I just used the connector pad. (this is isolated in Gen1 and possibly Gen2 boards. )
    I glued in a piece of connector strip.. so once the cables were soldered no pressure would be put on the contacts..
    Those surface mount solder pads will come off if you breathe on them.
    I used 28AWG enamelled wire.. to make the connections.. it is more convenient to use than tinned copper being insulated, and this one is special enamel that comes off with soldering iron heat.
    This is as tiny as I would ever want to go.. the 20pins have 0.5mm spacing. You need to take huge care. A large magnifying glass.. and a lot of measurement to clear any shorts.
    Jtag is there as well but I am not really interested at the moment. It was hard enough to solder a couple of pins.. soldering 6 of them I think I would try and find the proper socket and solder that on.



BTW finding a suitable serial terminal on the Mac has been a pain. I used hyperterminal on XP PC and frankly it was far better than anything I could find that was easy to setup on the Mac.
I did find this one though.
http://www.furrysoft.de/?page=goserial
Still doesn't work as well as I think hyperterminal or putty does on a pc.. but at least it works.. zterm.. which was the only other terminal I could find that allowed me to set serial port correctly, 115200 8N1 no flow control, crashed the Mac at critical points. Don't go there.

What you get out of course is ttl - lv which need a usb to ttl or serial to ttl converter.
You can get them readily on ebay.. some do not need to be powered using 5v from the usb. That means you only need Rx Tx and Gnd.

In the meantime here is a taste of things to come.
With Root console access.. NetBSD is not dissimilar to Linux router firmware I am used to.
# l
total 65
drwxr-xr-x  15 root  wheel    512 Jan 18 21:58 .
drwxr-xr-x  15 root  wheel    512 Jan 18 21:58 ..
-r--r--r--   1 root  wheel     54 Mar 10  2011 .editrc
-r--r--r--   1 root  wheel   2002 Mar 10  2011 .profile
drwxr-xr-x   3 root  wheel    512 Jan 18 21:58 Library
drwxr-xr-x   4 root  wheel    512 Jan 19 07:26 Volumes
drwxr-xr-x   2 root  wheel    512 Mar 10  2011 bin
drwxr-xr-x   2 root  wheel  21504 Mar 10  2011 dev
drwxr-xr-x  10 root  wheel   1536 Jan 18 21:58 etc
drwxr-xr-x   3 root  wheel    512 Mar 10  2011 lib
drwxr-xr-x   3 root  wheel    512 Mar 10  2011 libdata
drwxr-xr-x   2 root  wheel    512 Mar 10  2011 libexec
drwxr-xr-x   5 root  wheel    512 Jan 18 22:00 mnt
drwxr-xr-x   2 root  wheel   1536 Mar 10  2011 sbin
drwxr-xr-x   2 root  wheel    512 Jan 18 21:58 tmp
drwxr-xr-x   7 root  wheel    512 Mar 10  2011 usr
drwxr-xr-x  11 root  wheel    512 Jan 18 21:58 var

# env
PWD=/etc
HOME=/
PATH=/sbin:/usr/sbin:/bin:/usr/bin
TERM=vt100
TERMCAP=vt100:snip snip.
USER=root
HOSTNAME=
LOGNAME=root
SHELL=/bin/sh

Here is a neat command..
# envstat
 Sensor temperature    MLB temperature          Fan speed     Fan duty-cycle
               degC               degC                RPM            integer
              39.50              44.00                  0               0.00

There is a pdf of the serial and bootloader output that I captured. Please download and read it but not post it elsewhere.
I am currently working on a modification Apple made in Gen 4 to turn on the fan..

# i2cctl r 0x18 0x00 32
0x77 0x2F 0x00 0x20 0x98 0x00 0x84 0x00 0xFF 0xFF 0x2C 0x27 0x00 0x00 0x00 0x00 0xFF 0xFF 0x00 0x00 0x50 0x00 0x7F 0x00 0x41 0x00 0x50 0x7F 0x34 0x50 0xFF 0xFF

A different day and time.. slightly different numbers. Some will be temperature measurements.
i# i2cctl r 0x18 0x00 32
0x77 0x2F 0x00 0x20 0x98 0x00 0xC7 0x00 0xFF 0xFF 0x2D 0x29 0x00 0x00 0x00 0x00 0xFF 0xFF 0x00 0x00 0x50 0x00 0x7F 0x00 0x41 0x00 0x50 0x7F 0x34 0x50 0xFF 0xFF

Ok, turning on the fan is as simple as resetting to default.
i2cctl w 0x18 0x00 11010100

So this command writes the first register 0x00 but you need to use binary value. (reads hex writes binary).
But the values are not stored.. any alteration is lost on reboot. I was thinking the values are written and held until a rewrite but it isn't so.
In fact the default value at turn on is what is causing the fan to run at power on.. several sec after boot the fan is turned off. this is the point when the processor writes the values to the fan chip.. shutting it off.
Turning the fan back on then just consists of writing the values to the fan chip again.. but we can do much more interesting things.

I still cannot see rpm of the fan in the evnstat command.

A1355 that is dead shorted.

I have received two A1355 within a couple of weeks that are not just having power issues like the above . they are dead shorted. Measuring with a meter across the main plug I get 0 ohms.. I have tried removing all the chips that use 5v and try to locate the short. Still not sure what is gone.
For the moment if you have a Gen 3 that fails.. measure the ohms across the board plug from +5v pin to Gnd.. if it is very low or 0 ohms consider it might be possible to repair albeit rather complex.

I have got it partially working again.. running a multi-output power supply constructed from 5 kis modules.. set to the correct voltage on each one to replace a main board supply.. then wired into the board. I need to get another good working one, and then I might have a chance to figure out what broke. But it has ended up a test of concept only. I removed each KIS module from its housing, and glued them to a scrap of pcb.. after removing all the components that are not required and the onboard voltage divider. I used multiturn pots as getting the right divider values is difficult.. and I used a 1K resistor to load each supply to set the voltage before I glued them to the board. Otherwise you will find it difficult and you don't want to start it up with voltage not set.

















Are you feeling lucky.. well are ya'

Burn it out.

With the help of Chris Fackrell in UK.. who has now also tested the method.. we have both burned out the short circuit.. So I will eventually get rid of the above method.. it is just for historical interest now.. and to remember the amount of effort this cost me.. plus the A1355 that died to provide life to others.

Chris used a motorcycle battery.. I used a pair of Li-ion batteries. So a power supply with voltage of between 4-6v and not switch mode.. that can supply several amps.
I would not start trying to short stuff without taking great care the right things get shorted the right way.. Just thinking an old speaker front panel cable or a CD sound cable from a computer, that will fit the TC power socket would be nice.. !
Remove hdd.. disconnect the top and fan.. and ethernet connections.. obviously the power supply out and disconnected.

Wire gnd to gnd and momentarily touch + side wire to the battery.. or power supply output.. a tiny spark and a bit of smoke will come out. The issue is exactly what I thought it would be .. ceramic capacitors.. the ones beside the hard disk drive marked C2987-2983.. it was a different one on each board. so this may happen again. Only with Delta power supplies so far. After putting the TC all back together it is all running fine.. you should wait a week or two unless you want to be on the bleeding edge to test this fix.

I will also post a pic up once I get a decent high resolution pic as the caps are really small.