IPhone 11 Pro and 11 Pro Max Panic Log and 3-Minute Reboot

🔒 This article is maintained by PhoneRepair.biz's automated research assistant and checked against public sources. Last reviewed: 2026-07-01. Spotted a mistake? Report an error on the talk page — or just edit the article. Suggestions from readers are reviewed before going live.

Recovery at a glance
Difficulty	Intermediate (log reading) to Advanced (board-level rework)
Risk to data	Low for non-invasive diagnosis; Moderate once flex/board rework begins
Time estimate	30–90 min for a flex swap; several hours for microsoldering
Storage type	Apple NAND over PCIe (NVMe / "ANS2"), hardware-encrypted (FBE)
Device state	Device powers on and boots to iOS but kernel-panics and reboots roughly every ~3 minutes; logs are readable between reboots
Key tools	Precision screwdrivers, spudgers, microscope, OEM/OEM-pull flex parts, multimeter (diode mode), 3uTools/iMazing/libimobiledevice

The iPhone 11 Pro and 11 Pro Max (Apple A13, model numbers A2160/A2215/A2217 and A2161/A2218/A2220, depending on region) are frequent victims of the so-called "3-minute reboot loop": the phone boots normally, runs for two to three minutes, then kernel-panics and restarts, repeating indefinitely. On this generation the overwhelming cause is not a failing CPU or NAND — it is iOS's thermal-monitoring daemon (thermalmonitord) losing contact with one of the model's required sensors. When a mandatory sensor stops responding — because a flex is damaged, unplugged, water-corroded, or replaced with an aftermarket part that omits the sensor — the userspace watchdog times out and forces a panic-and-reboot as a safety measure. This article documents the model-specific panic tokens, the enforced sensor/component list, and the diagnosis-and-repair workflow.

Overview

iOS runs a background daemon, thermalmonitord, that continuously polls a distributed array of temperature/pressure sensors so the SoC can throttle or shut down if any region overheats. A userspace watchdog requires thermalmonitord to "check in" successfully at regular intervals. If even one required sensor in the array fails to answer, thermalmonitord cannot report a healthy state, the watchdog eventually fires, and the kernel panics with a message naming the missing sensor. Because it takes roughly 2–3 minutes after boot for the watchdog to conclude the sensor is truly dead, the phone appears to reboot "every three minutes."

The fix is almost always to restore the missing sensor, i.e. replace or re-seat the specific flex cable or component that carries it — not to touch the CPU or storage. From a data-recovery standpoint, curing the reboot loop is often the enabling step: a device that stays booted can be backed up or extracted normally (with the passcode), whereas a device rebooting every three minutes cannot.

Applies to

Brand / models: Apple iPhone 11 Pro and iPhone 11 Pro Max. Closely related behaviour on the iPhone 11 (non-Pro) and other models, but the enforced-sensor set and flex layout differ — see iPhone Thermal Sensor Panic Reference.
SoC: Apple A13 Bionic (APL1W85 / T8030).
Storage: Apple-controlled NAND flash over PCIe, exposed to iOS as an NVMe namespace (the "ANS2" storage subsystem). Data is hardware-encrypted.
OS & encryption: iOS 13 through current builds. File-Based Encryption (FBE) with per-file keys, wrapped by keys held in the Secure Enclave Processor (SEP) and gated by the user passcode. The required-sensor list can change between iOS versions — a device stable on an older build can start looping after an update, and vice-versa.
Required device state: Device must power on and reach iOS at least briefly. If the phone does not boot at all, or panics before Springboard, this article does not apply — see iPhone Will Not Boot Panic Diagnosis.

Risk to data

Non-invasive diagnosis (reading panic logs, backing up between reboots) carries essentially no risk to data. Always start here.
No user data is stored in the flex cables or sensors. Replacing a charging-port, power-button, or volume/mic flex does not touch the user partition. Swapping these parts is data-safe when done cleanly.
Point-of-no-return warnings:
- Do not erase, restore, DFU-restore, or "Update/Restore" in Finder/iTunes to "fix" a reboot loop. On A13 with FBE, a restore/erase destroys the file keys and the data is permanently unrecoverable. This is the single most common way technicians turn a trivial sensor fault into total data loss.
- Battery / board rework risk: Once you are heating connectors, replacing the battery, or reworking pads, you accept the normal microsoldering risks (lifted pads, torn traces, damaged connectors). None of these are reversible.
- SEP is unforgiving: Do not attempt to swap the logic board's paired components (SEP, NAND, or the board itself) between phones. Any pairing mismatch can brick the device or wipe the effaceable storage.
If the data matters, image/back up the device first, during a stable window, before any physical work.

Tools and materials required

Pentalobe P2 and tri-point Y000 drivers, Phillips #000, plastic/nylon spudgers, tweezers.
Display/adhesive tools and replacement waterproof adhesive.
Stereo microscope (for connector inspection and any board work).
Multimeter with diode mode (sensor-line continuity/short testing).
A computer with 3uTools, iMazing, or libimobiledevice (idevicecrashreport) to pull panic logs, plus iDeviceLogAnalyzer/panic-log parser (optional but convenient).
Known-good OEM or OEM-pull parts for elimination testing: charging-port (dock) flex, power-button/volume flex, and battery. Aftermarket parts that omit the sensor are the usual cause, so test with OEM.
For board-level work: hot-air/soldering station, flux, low-temp solder, boardview + schematic for the exact model (verify designators against a trusted boardview — do not assume they match another model).

Prerequisites and safety

Obtain the device owner's consent (see Legal note).
Photograph the panic log and note the exact tokens before opening the phone.
Static-safe workspace; disconnect the battery before removing/replacing any flex.
If there is any sign of liquid ingress (corrosion, tide marks under the speaker grille or on flex connectors), treat as water damage — the fault may be corrosion on a sensor line or codec, not just a broken flex.
Charge state: if the battery data is not being read (no battery percentage shown), a bad/aftermarket battery can itself be the missing thermal source.

Step-by-step procedure

Capture the panic log (do this first, non-invasively). On the device: Settings → Privacy & Security → Analytics & Improvements → Analytics Data. Scroll to the newest file beginning with panic-full and open it. Alternatively pull all panics over USB with 3uTools ("Toolbox → iDevice logs"), iMazing, or idevicecrashreport -e . from libimobiledevice.
Read the panic string. The signature of this fault is a thermalmonitord watchdog panic. A representative iPhone 11 Pro Max log reads:
panicString: "userspace watchdog timeout: no successful checkins from thermalmonitord ... service returned not alive ... current 3bfffffffffff, mask 1ffffffffffff, expected 1ffffffffffff. SD: 1 BC: 1 RC: 0 BS: 1, Missing sensor(s): mic2"
The decisive field is Missing sensor(s): <name>. That token names the failed sensor and points directly at the flex/component to service. (The current vs expected bitmask shows which bit failed to set; you do not need to decode it — the sensor name is explicit on this generation.)
Map the sensor token to the component. On iPhone 11 Pro / 11 Pro Max the sensors most often reported missing, and their carriers, are:
{| class="wikitable"

! Panic token !! What it is !! Typical carrier on 11 Pro / 11 Pro Max |- | Prs0 || Barometric pressure sensor || Charging-port (dock) flex |- | Mic1 || Bottom microphone (also a thermal check-in source) || Charging-port (dock) flex |- | Mic2 || Secondary microphone/sensor || Power-button/volume flex — on some 11 Pro Max units the volume/flash/microphone (upper-left) flex; confirm which flex from the log token plus the boardview |- | TG0B / battery gas-gauge || Battery pack thermal / fuel-gauge report || Battery + its gas-gauge line |}

Sensor-to-flex assignment can shift with iOS updates and differs from the non-Pro iPhone 11 — always trust the log token over any table.
Reproduce and confirm. Note the uptime before reboot (~2–3 min) and confirm the same "Missing sensor(s)" token appears across multiple recent panics. A single one-off panic of a different type (e.g. an SoC-hot or SMC panic) is a different fault — see Troubleshooting.
Elimination test with a known-good part. Before ordering, temporarily fit an OEM/OEM-pull flex (or battery) for the implicated sensor and boot. If the reboot loop stops and the log stops naming that sensor, you have confirmed the culprit.
Inspect the connector and lines under the microscope. Look for widened/bent pins, corrosion, or liquid residue on the flex connector and its board-side FPC. On water-damaged boards the sensor's I²C/analog lines (and the associated audio codec) can be corroded even when the flex itself is fine.
Replace the implicated flex with a quality OEM part. The most common root cause on this model is an aftermarket charging-port flex that physically omits Prs0 or Mic1; the phone then loops no matter how many times the "new" part is fitted. Use OEM, OEM-pull, or a vendor that QC-inspects for the sensor. Fit new waterproof adhesive on reassembly.
If replacing the flex does not clear the token (sensor still reported missing), the fault is on the board side of that sensor's path: probe the connector pads in diode mode for opens/shorts, inspect NTC/thermistor and I²C lines, and check the audio codec / PMU node that aggregates the reading. Identify designators from the correct boardview for this exact model — do not fabricate or borrow pad numbers from another board. Rework/replace the corroded component.
Reassemble, boot, and let it run past the previous reboot window (5–10 min minimum) before declaring success.

Verifying the result

Device stays booted well beyond the previous ~3-minute failure window; ideally leave it running 30+ minutes.
Pull a fresh panic log: no new thermalmonitord watchdog panics, and no "Missing sensor(s)" entry.
Battery percentage displays and updates (confirms battery/gas-gauge data is being read).
Microphone(s) associated with the fixed flex work in Voice Memos / a call test (confirms the sensor's flex is genuinely functional, not merely tricking the check-in).
Barometer/altimeter reads plausibly (a sensor test app) if Prs0 was the fault.

Success rate and limitations

High success when the log names a single sensor and the fault is a flex or a bad aftermarket part — replacing the correct OEM flex resolves the great majority of 3-minute reboot cases on this model.
Lower success when there is board-level corrosion (water damage into the speaker grille/connectors), multiple missing sensors, or damage to the codec/PMU aggregation node — these require microsoldering and may not be economically viable.
What this does NOT recover / cannot do:
- It does not decrypt or bypass the passcode. iPhone 11 Pro uses FBE with keys held in the SEP. Stopping the reboot loop lets a passcode-holder back up or use the phone normally; it grants no access to encrypted user data without the passcode.
- Forensic reality on A13: the classic checkm8 bootrom exploit does not apply to A13 (it covers A5–A11). A separately disclosed A12/A13 SecureROM issue ("usbliter8," publicly disclosed 2026-06-18) is very new; even a working bootrom foothold only enables BFU (Before-First-Unlock) acquisition — a limited set of files whose keys are not tied to the passcode. Complete-protection data stays encrypted until the passcode is entered. Treat any such tooling as immature and verify independently.
- Activation Lock / FRP is unaffected. Fixing the panic loop does nothing to remove Activation Lock; a device you cannot sign into remains locked to its Apple ID by design. This article does not cover, and you should not attempt, anti-theft-bypass on hardware you do not own.

Common pitfalls and troubleshooting

"I replaced the flex and it still loops." The replacement is aftermarket and also lacks the sensor, or the missing-sensor token is actually on a different flex (e.g. log says Mic2 but you swapped the charging-port flex, which carries Mic1/Prs0). Re-read the token.
Token persists after a genuine OEM flex. Fault is board-side: corroded connector pads, broken NTC/I²C line, or a damaged codec/PMU node aggregating that sensor. Move to diode-mode probing and microsoldering.
Panic is NOT thermalmonitord. Other panics loop this model too and mean different things:
- AppleSocHot / "sochot" — SoC over-temperature. Can be a genuine short pulling heat, or NTC/thermal-sense damage; investigate power rails, not just flexes.
- AOP PANIC – prox / PressureController — Always-On Processor sensor fault, classically after water damage.
- SMC / SMC assertion panic — power/top-board subsystem (iPhone X and later).
- ANS2 / nvme / Kernel data abort — storage or board-power faults; a different (and more data-risky) class entirely.
No battery percentage shown → suspect the battery/gas-gauge as the missing thermal source before chasing flexes.
Back-glass repair triggered it. The dock/charging-port flex on 11 Pro / Pro Max sits near the rear glass and is easily nicked during back-glass swaps — a very common self-inflicted cause of a post-repair Mic1/Prs0/Mic2 panic.
Do not "just restore it." Restoring to clear the loop erases the FBE keys and destroys the data — see iPhone Data Loss From Restore.

Legal and consent note

Only work on devices you own or are explicitly authorised to service, and record that authorisation. Reading panic logs, replacing flex cables, and booting the device are ordinary repair/data-recovery actions when done with the owner's consent. Do not use any of this to circumvent Activation Lock, iCloud, or passcode protection on a device that is not yours; anti-theft bypass on third-party hardware is unlawful in most jurisdictions and outside the scope of this knowledge base. When performing data recovery for a client, follow chain-of-custody and applicable privacy law.

Sources

PhoneRepair.biz is a free community knowledge base. Data recovery and board-level repair carry a real risk of permanent data loss — when the data matters, back up any raw dump before modifying a device and consider a professional lab. Only work on devices you own or have documented authorization to service. See PhoneRepair:Legal notice.