Antminer S9 – Firmware Downgrade Issues

Photograph the control-board silkscreen. Open the chassis lid, take a clear phone photo of the `BHBxxxxx` identifier or `BB-based` marking. Write the revision down. This single step prevents ~`60%` of bricked downgrades, because the wrong image for the wrong revision is the single most common cause of a dead flash. Don't skip it because the miner "looks the same" as one you flashed last year — S9 SE and S9k shipped with different control boards under identical external chassis.

Verify current firmware version before attempting anything. SSH with `ssh root@<miner-ip>` (password `root` or `admin`) and run `cat /etc/bmminer.conf | grep -i version`, or read it from the web UI status page. Screenshot it. Later, if the flash silently no-ops, you'll need this baseline to know whether anything changed. If SSH isn't enabled on your firmware, pull the version from the web UI's Miner Status → Firmware Version field.

Download from Bitmain's official portal only. Go to `service.bitmain.com/support/download`, pick your model, match the hardware revision from Step 1, download the image + SHA-256 checksum if provided. Never trust forum-reposted S9 firmware — community-modified images are one of the top three causes of soft-bricked control boards in our repair queue. If the specific version you want isn't on the portal, it's either end-of-life or was pulled for a known defect — both are reasons to skip it.

Attempt the web-UI upgrade once, document the exact error. Upload via Firmware Upgrade → Browse → Flash. Wait. If it fails, copy the error text verbatim. `signature verify failed` means signing boundary, `version is lower` means rollback counter, both mean you need `microSD` recovery next. "Upgrade successful" but an unchanged version string means the upgrade silently didn't apply — usually a corrupt download; re-download and retry once more.

Factory reset before flashing if things got weird. Hold the Reset button for `5` seconds (the button is only live in the `2–10` minute post-boot window; outside that, nothing happens). Wait `4` minutes for auto-restart. This clears stale pool config and admin password that can interfere with post-flash boot. Not strictly required, but cheap insurance.

Prepare an industrial-grade `microSD`. `8 GB` or `16 GB` — do not use larger, Bitmain images fail on `32 GB+` cards on some revs. SanDisk High Endurance, Samsung PRO Endurance, or a purpose-labeled "Industrial" card. Format `FAT32` full-format (not quick) on a laptop. Consumer no-name cards work for one flash and die three months later from log-partition wear; skip them entirely.

Write the image with balenaEtcher or Win32DiskImager. Drag-and-drop of `.img` files does not produce a bootable card — you need a block-level write. Etcher verifies after write; enable that option. If the verify fails, the card is bad — pull it and use a different one. Don't retry verify failures; writing a marginal card means flashing a corrupt recovery, which hard-bricks the CB.

Power off at the breaker, insert card, power up. The flash takes `5–7` minutes on an S9. CB LED will pulse, ethernet link may bounce, fans will spin. Do not interrupt. Do not pull the card until the miner is idle for `60+ seconds` and the LED has settled into its normal boot pattern. Pulling mid-write is the single fastest way to brick an S9 CB. After settle, power off, remove card, power up clean.

Confirm the flash. Verify version string via SSH or the web UI status page. Confirm pool config is accessible (if it shows `TEST` and can't be changed, go to Step 10). Confirm all three hashboards appear and BMMiner is hashing. Back up the working `microSD` image for next time — if the card works, it's cheap insurance to keep a known-good `.img` on your laptop.

If post-flash state is `TEST`-pool locked, upload the per-control-board "dedicated firmware" from Bitmain's portal for your exact silkscreen revision. This is a second-stage flash that unlocks the pool UI. Documented at `support.bitmain.com/hc/en-us/articles/21427190625945`. Almost nobody finds it because Bitmain buries it under "Factory firmware problem handling" — but it's the official fix.

Flash [DCENT_OS](https://d-central.tech/dcent-os/) instead of downgrading stock. D-Central's open-source Antminer firmware — the Mining Hackers' path — ignores Bitmain's signing game, gives you per-chip HW% and autotuning, runs underclocked-and-undervolted profiles that make a post-halving S9 economically viable as a space heater, and is maintained publicly ([GitHub](https://github.com/DCentralTech/DCENT_OS)). Alternatives: Braiins OS+ (battle-tested on S9, SD-card-reversible trick lets you pop the card out to revert to stock instantly), LuxOS, Vnish. All four break out of the signing-boundary trap and all four are a bigger upgrade than any Bitmain downgrade you were trying to do.

Clean the `microSD` socket. Power off, pull card, saturate a cotton swab in `99%` isopropyl, gently clean contact fingers inside the slot, blow out with a duster, let dry `60 seconds`. Reinsert a freshly written card. On 6+ year old S9s the push-push contact mechanism tarnishes and a flash that "should work" fails at random bytes. This is the cheapest Tier-3 fix we perform at the D-Central bench.

UART-verified flash. Solder or alligator-clip a `CP2102` or `FT232RL` USB-to-TTL at `3.3 V` to the 4-pin CB debug header (`TX/RX/GND/3V3` — revision-dependent pinout, confirm before connecting — `TX` lines can spit garbage on boot if you mismatch polarity). Open a serial terminal at `115200 8N1`. Flash. Watch the U-Boot and kernel log scroll. Any CRC, signature, or rootfs mount error shows up here in plain text — this is how you turn a "won't boot" into a specific diagnosis.

Cross-flash a known-good older Bitmain stock image. If your goal was to downgrade to a specific pre-signing build (e.g. for a stratum-compatibility reason), use the `microSD` physical-flash path with that image. The rollback counter lives in the rootfs, not in a persistent one-way fuse — meaning a full `microSD` re-image bypasses it. This is technically against Bitmain's intent and voids the (already-expired) warranty on every S9 in the field.

Document + reverse. If the downgrade didn't solve the original problem (pool connect, hashrate, autotune crash), re-flash forward to the latest known-good, screenshot the working config, and write up what you did. Half the "downgrade fixed my S9" reports on Reddit are placebo — the reboot alone cleared a runtime state. If you didn't measure before and after, you don't know.

When to stop DIY. UART shows no output on a confirmed-good adapter → SoC or DDR fault, not firmware. Web-UI + `microSD` + UART + DCENT_OS all fail → control board is hardware-dead (possibly `eMMC` corruption on S9 SE / S9k late revs). At that point, [book a D-Central ASIC Repair slot](https://d-central.tech/services/asic-repair/) — we have the bench fixtures to rescue or replace the CB.

What D-Central does at the bench. Silkscreen identification, UART-verified flash across all known-good image versions for that revision, `microSD` slot reflow or socket replacement, `eMMC` re-image via JTAG where the board supports it, control-board swap from our salvaged-grade inventory when the SoC is toast. Per-chip HW% verification via DCENT_OS before we ship the miner back. Anti-static packing and a written note of what we did.

Ship safely. Antistatic bag around the entire control board (or the whole miner if you don't want to disassemble). Double-box with `5 cm` of foam every side. Include observed symptoms, all firmware versions you tried, photos of the silkscreen and any visible damage, and your contact — it cuts diagnostic time, which cuts your bill.