PCB Reverse-Engineering

[Singapura]

Ever heard or tried reverse-engineering printed circuit boards without schematic diagrams?

You might want to take a look at the following website for more information or tips:

http://visio-for-engineers.blogspot.sg/

[Bloch]

First this is more an AD page than blog.

That is this book ?


>PCB Reverse-Engineering


Why are some thing on transistors and DOS ?


Show us some pages there you are teaching PCB reverse engineering

[Singapura]

Hi Bloch

Thanks for replying. Sorry that my blog appears to you as an AD.
There are stuffs that I shared in my blog which I'm currently backdating from when I started journaling and organizing them into a book.
If you click on the April and May 2014 archives, or under the Categories section, these should bring you to the pages containing useful information and illustrations.

Thanks for visiting and giving your feedback.

[Singapura]

By the way, the sample preview pages on my book in Amazon are not within my control.

As for the DOS stuff mentioned in one of the appendices, it's with regard to creating a DOS environment (DOSBox or Microsoft Virtual PC) in order to run a free DOS program that decodes JEDEC fuse map files into Boolean equations, if you're wondering...

Hope that clears up a bit on your questions. Thank you.

[Fraser]

@Singapura

Welcome to the EEVBlog 

I do quite a lot of PCB reverse engineering out of necessity as so many manufacturers refuse to release schematic diagrams due to IPR concerns. I was working on a very expensive thermal camera a couple of years ago. It used a MC68340 micro processor that I was not familiar with. I ended up reverse engineering the whole embedded computer PCB and bought an ATARI 520ST (MC68000) on which to practice diagnostic techniques ! The thermal camera was basically an ATARI ST configuration with some additional I/O and a co-processor    That was a very difficult reverse engineering task as the PCB was quite complex and there were many hidden interconnections within the layers.

The cameras PCB was 6 layers and populated with a mixture of VLSI, FPGA and common 74ALS series chips. On another PCB (video processing co-processor) I had to contend with three 250+ pin fine pitch FPGA's

As you know, creating a BoM was one of the first steps and fortunately for me the camera used commercial off the shelf components with no custom chips, unlike many specialist test equipment like that of HP and Tek. The data sheets were of great assistance as the camera manufacturer tended to follow the application note design..... always nice to see as it helps to speed up the reverse engineering process.

I used a clever piece of equipment from Wavetek to assist in finding the interconnections through continuity. It is called the Wavetek  SF10  and it uses a stainless steel brush for identifying the area of a connection and then a sharp point to localise it to a specific IC pin. A very useful bit of kit IMHO.

I posted about it here:

https://www.eevblog.com/forum/testgear/wavetek-sf10-short-finder-a-very-useful-tool-if-you-can-find-it/

I use the following equipment when reverse engineering a multi layer PCB:

1. Fluke 87III multimeter with fast continuity response
2. Wavetek SF10
3. Toneohm 850 inductive short tracer and MilliOhm meter
4. Non contact cable tracer and injector
5. Opti-Visor magnifier headset
6. Video Microscope
7. Light panel (to illuminate PCB)
8. Torch for detailed PCB inspection
9. X-Ray (high resolution imaging of PCB)
10. Thermal imaging camera
11. Mk1 eyeball 
12. A lot of time 

And of course a PC with access to the WWW for chip research and documentation of the reverse engineering process.

I like the fact that you have taken the trouble to detail PCB reverse engineering techniques in a book and hope it does well for you. Would there be the possibility of an EEVBlog discounted edition as the membership here would make an excellent study group.

I attach a (low res) picture of the thermal camera microprocessor PCB that I reverse engineered. The schematic diagram is covered by ITAR and so is unavailable for public release.

Aurora

[Singapura]

Hi Aurora

Thanks for your hospitality and nice gesture.

I'm impressed with the array of equipment and accessories you have to help you in the reverse engineering work! Given the complexity of the PCBs you work on, there is no doubt that any additional equipment that helps to speed up and ease the process is a great asset to have. Unfortunately, not every engineer has the luxury of owning these invaluable tools, much less to even attempt the kind of board you're dealing with.

I have done quite a fair bit of reverse engineering on boards as varied as you, as well as whole unit comprising multiple PCBs encased. It's challenging yet gratifying at the same time, and it always give a sense of satisfaction and achievement when it's completed, despite the grilling process we subject ourselves too, isn't it? Sometimes my colleagues would look at my work, shake their heads and give me the kind of look, like you know, you're one crazy guy to even consider this option.

Anyway, after 15 years of doing PCB reverse engineering (besides my primary job scope of test program development and engineering solutions support, including re-hosting of legacy systems for customers and building custom test jigs and text benches), I thought it'll be good if I can document my experience which is why I ended with the book. However, in writing it I did consider the common equipment that most electronic and repair engineers possess as well as the basic skills that'll enable them to have a good start in this demanding discipline. For your case, I do not foresee that my book will serve to advance your skill or knowledge in a big way. However, if you intend to use my book as a guide or reference to aid you in documenting your own experience, and hopefully to write your own on this subject, possibly as an advanced version, then I suppose it might help cut down a lot of preparation work and time.

The pricing of my book was a bit high, unfortunately higher than what I'd like it to be, primarily because it's full-color and uses a better grade paper which CreateSpace charged a premium, and being a non-US resident from a country without tax treaty with US, I am subjected to double taxation. But I am considering an electronic book (ebook) version which Amazon distributes via the Kindle channel, so if there is enough interest for a non-print version, I might just take it up. The pricing will most certainly be much lower than the printed one. Let me warn you that due to the large amount of photos and illustrations (300dpi) the size of the file will be huge (in excess of 50MB).

Once again, it's a pleasure to meet you and to know there are like-minded engineers doing this seemingly impossible but important task.

Cheers!
Singapura

[Fraser]

Hi Singapura,

Great to hear your story on the book.

My father looked into publishing a book last year and, like yourself, found it to be a very expensive exercise when paper format is chosen. I applaud your determination to continue through to a final paper based release.

eBook format would likely make the book far more accessible and affordable for many users BUT you have the issue of piracy to consider. sad though it is, there are many who will steal your book rather than pay you a fair sum for your efforts. eBooks make this a very easy theft unless you employ appropriate protection in some form. I am not enlightened on how an eBook is protected but presume there are ways that it may be done. For info, an eBook would be my first choice if it lowered the cost of ownership as I just retired  With regard to file size, 50MB is not unmanageable in many countries these days. My Logic analyser software that I updated last night was 70MB in size. In this age of downloading films across the internet, file sizes have increased greatly and in many countries fast broadband makes them a relatively quick download event.

With regard to my reverse engineering capabilities, like yourself, I have been forced to teach myself and work out how best to approach the problems that are inevitable when undertaking such a challenge.  I enjoy repairing equipment and reverse engineering designs as they are like a puzzle that needs to be solved....some people do crosswords and SUDOKU to challenge their mind, I do electronics repair and investigation 

With regard to the sample case that I mentioned, namely the thermal camera, I had a great incentive to succeed in reverse engineering the PCB. The camera is an AGEMA (FLIR) PM570 and it was new in its case. It had been found faulty when a warehouse was cleared and was likely a customer return. I paid £1000 for it but its original cost was $56000 from FLIR    As it was mint, I was determined to repair it and keep it for myself rather than attempt to sell it on for profit. When you want to repair something for yourself I feel there is even greater motivation to succeed   

Some background on the FLIR PM570 thermal camera.... this was the first FLIR uncooled Microbolometer thermal imaging camera to market and was a flagship model. It is built to last and put up with abuse. A truly superb design that has become a firm favourite in industry. It has a 320x240 resolution and 60fps refresh making it suitable for all manner of civilian and non-civilian uses. The camera was so popular that it was upgraded with faster processors and better microbolometers throughout the long PM series 'reign' I own examples of all generations (1 through 3). 

When I first opened the camera I was pleasantly surprised by its well designed clamshell format that positioned the two main boards in opposite halves of the case, with flexible ribbons between. Unlike some designs you did not end up with a pile of PCB's falling out on the bench when the case was opened ! Initial impressions of the PCB's was Oh Dear, high levels of integration and custom VLSI. I was, however, wrong. The unit contains two independent computers. One for the whole system management and one for the image processing required to tame a microbolometer. Both PCBs were in fact populated with the common commercial products of Motorola, Altera and Cypress and not custom VLSI. The overall system management board appeared the likely cause for the fault which was 'Failure to boot'. 

I contacted every FLIR service agent that spoke English in an attempt to gain any information on the AGEMA/FLIR thermal camera inner workings and boot sequence. All were sworn to secrecy under FLIR NDA's and ITAR restrictions on design information release. I found one who was willing to give me a tiny bit of help and some price quotes for parts. He advised that the problem was either the power supply module or the  LiCO board (MC68340 based system control). This sounded plausible. The LiCo was most likely and would cost £5000 + fitting + programming the OS into flash + camera calibration (essential as cal data resides on this board) The total cost.... likely to be around £7000 
As the engineer said..."you buy a Mercedes, you pay Mercedes spares prices". The engineer was not allowed to supply me with ANY technical details, not even the expected voltages coming out of the power supply module ! He did talk to me in general terms though, which is more than I can say for all the other service agents around the world. He explained that the service centres just identify and replace PCB's, then do calibration. They do no component level repair and I doubt that the chap even had schematics beyond PCB interconnection diagrams and voltage / waveform test points for diagnostics.

So with regard to repairing the faulty LiCo board, I was definitely on my own. As I stated, I created a BoM and tracked down the datasheets for every chip used on the LiCo. I had not worked on a MC68000 based computer before but knew the normal basic tests that may be carried out on any embedded computer. I did the usual checks on power supplies, clocks, address & data busses, and specific control/flag lines. The MC68340 was in HALT due to a critical error and that was all that could be determined.

I bought books on MC68000 series embedded computer design and studied its operation and design principles. Its a pretty smart processor and the MC68340 is just a MC68000 with some addons for interfacing to the outside world and memory. After thoroughly studying MC68000 architecture I purchased an old Atari520 ST to on which to practice logic analyser based diagnostics. It was very easy to create a HALT condition  In truth I did not really need the ATARI computer as I was also cutting my teeth on the LiCo board to see exactly what was happening where and when. I had the full service manual for the ATARI 520ST though and that was helpful. It became clear that I needed to reverse engineer the whole LiCo PCB as there were many possible causes of the HALT condition. A key pint to note is that the LiCo board would not work unless all other boards were connected to it (an important point that will be explained later)

I started reverse engineering the LiCo PCB by first placing the board on a photocopier and enlarging the image onto A3 paper. This gave me an excellent view of the PCB component identifiers and also visible tracks. It was a 6 layer PCB though 

My colleagues at work saw my A3 images and when told what I was intending to do, said, "you are mad....just give up on it and chuck the camera in the bin" ! Such a negative attitude    I had an advantage over them though.... many years of component level repair experience. They just saw a PCB packed with tiny components, I saw a PCB with many interconnected blocks that interact and form a sort of code that just needs to be unravelled. Nothing to be scared of. You just need to deal with it logically and in small sections to prevent yourself becoming overwhelmed 

I had lots of the large A3 images so that I could scribble notes on them etc. Very handy.
For me the next step was to take all of the knowledge that I had gained from the datasheets, application notes, books on MC68000 computer architecture and the Atari 520ST schematics to connect all the various chips together in my own configuration, guided by logic. It isn't that hard as thankfully computers normally contain the same basic elements and have similar needs in order to work. I will not bore the readership by detailing all of them. I ended up with a block diagram/schematic that had all of the chips on the LiCo board interconnected in a logical manner that would form a viable computer.

It was then just a case of using simple tools to confirm expected interconnections between chip pins, and where the expected interconnection did not exist, finding where it went instead. That may sound easy but it is not when you are dealing with FPGA's. They act as Glue logic connecting many different ICs together in a unique fashion. Much time was spent working out which chips were servicing, and being serviced by, the FPGA's. The Wavetek SF10 was invaluable in this exercise as I could quickly work out which FPGA was involved with a chip pin that I was investigating. It did still take many evenings of work under the magnifying glass though !

I ended up with an accurate schematic of the IC interconnections and overall block diagram of the whole LiCo board  Once seen in this format it was not daunting at all and I restarted my investigation into the failure to boot.

Now the killer blow..... I could find no reason for the LiCo board to not boot. I even fitted new SMD DRAM just in case it was some weird RAM issue. No, still no boot. Now remember I mentioned that the LiCo would not work unless all other boards were connected to it ? There is a good reason for that. The LiCo effectively checks that all boards are present and operational as a sort of limited initial self test. Well what was actually happening was that the LiCo was not receiving a correct response from the other computer board and so it went into critical failure (HALT) mode and stopped the Boot sequence before it got properly started. The MC68340 would attempt a restart but fail on HALT. I had been chasing a fault on the wrong PCB 

In my defence, as I had no access to technical info on the start sequence or camera firmware, I was not to know that the MC68340 was checking on the other computer and expecting an 'OK' response. As far as I was concerned the MC68340 would boot and report any issues with its video processor board. That was not the case at all.

SOOOOOOO back to square one..... an embedded computer that fails to boot, but this time it was the video processor and not the LiCo ..... more reverse engineering 

Fortunately the video processing board is nowhere near as densely populated as the LiCo. It is a dedicated image processing unit so has a relatively simple architecture. The bad news was that it contained three huge >250 pin FPGA's    Each was programmed at boot but could in itself prevent correct boot, that would HALT the LiCo board ! There were also some key communication and data lines running between the LiCo computer and the video processor. Each needed to be identified and its ability to cause a HALT condition assessed.

Long story cut very short, I reverse engineered the video processing Board with little difficulty as it was a basic embedded computer design, just with specialist I/O. It has its own SRAM and Flash ROM so is independant of the LiCo for booting purposes. It was not booting because a 74ALS244 buffer that sits between the CPU and one of the FPGA's had a failed gate. The FPGA's were not being programmed and the CPU was stuck.

A new $0.50 74ALS244 was fitted and the $56000 camera was fully operational 

This task took many weeks and much dedication as I was doing it in brief sessions after work in my evenings. It would have been far better to dedicate a decent period of uninterupted time to the task as the human mind can tune into the design and not need to 're-learn' it after a break.

All good fun and I got a real thrill out of getting the camera to boot correctly after a long period of fault induced sleep. She's a beauty and I shall be keeping her.

I attach some pictures of another of my cameras... the PM575 which looks the same as the 570 in all but colour (the 570 is black). The open case images are from a PM695 that I was working on. Note the clam shell design and flexible interconnects between sides.

As you can see, I like my hobby 

Best Wishes

Aurora

[Singapura]

Hi Aurora

Thanks for your compliment, encouragement and great sharing on your exploit on the FLIR thermal camera adventure. It's always refreshing to read and feel the experience of someone who shared the same passion as myself. I couldn't agree more with you that PCB reverse engineering is like doing jigsaw puzzle and as the schematic diagrams begin to take shape, the greater the excitement and gratification, which is why I liken it to an art, one in which only those who put their mind and heart into can really appreciate and derive satisfaction.

From what I can tell through your narration of your attempt on the FLIR PM570, you certainly know your craft as an electronic engineer and will go to great lengths to finish what you set out to do, which is an essential trait for anyone who's thinking about taking up PCB reverse engineering. I reckoned I might have taken almost the same steps you did apart from buying the Atari 520 ST and creating those large A3 size images of the internal PCBs. I prefer to use Visio to create those PCB artwork to facilitate creating of BOM and collecting the necessary datasheets as a preliminary preparatory task. I believe by going through such exercises, I will become more acquainted with the PCBs I am working on.

Attached are some artwork of one of the units I worked on, the first is a front view with the panel cover removed, the second is the rear view with the connector slots in which the PCBs are plugged into, and the third is the layout diagram of the solder side of one of the PCBs, which is showcased in my book under advanced topics where I discuss about using Visio's layering technique.

I can identify with your enthusiasm and love for electronics, which has become your life-long learning and hobby. Kudos to your dad to for his desire to write a book. Perhaps after you get hold of a copy of my book, it might rekindle the fire in him to start the exciting journey, who knows?

Singapura

[Singapura]

By the way, what you said about the risk of distributing ebook is also my main concern, which is why I decided on printed book in the first place. I will have to check with CreateSpace and some other regarding ebook piracy issues before I decide if I want to go ahead with it.

Thanks for highlighting it as a good reminder. Much appreciated! 

[Fraser]

@Singapura,

Totally agree on the Atari. It was an unnecessary step that was driven by my desire to test a new 32 channel logic analyser on a working MC68000 based computer. In all honesty it added little to the investigation in the end. I mentioned it because I sometimes think outside the box, exploring possible aids to understanding a designs operation. The Atari was really just a physical version of what I has read in the reference books.

The photocopy of the PCB is a technique I have used a lot as it is fast and aids my less than perfect eyesight when wishing to have an overview of the PCB. It also allows me to mark IC pins as they are traced or to highlight pins that are of specific interest. I have also used the large i.mages the create hand drawn PCB component layout diagrams. Your Vision approach to creating the drawings is far more sophisticated and an approach that I will try. I already have Visio loaded on my main PC as I use it for block diagrams.

Best Wishes

Fraser

[mikeselectricstuff]

A new $0.50 74ALS244 was fitted and the $56000 camera was fully operational

One important lesson for both repair and reverse engineering - First try the things that are easy to try first, even if they aren't very probable faults.
Where there are very simple devices like HCMOS, it can be worth spending a little time running round all the pins with a scope to see if the signals make sense.
Ditto simple analogue parts like opamps.

Quite often when digital chips fail, their outputs or inputs will show intermediate voltages between rails, and can be easy to spot on a scope. Similarly opamp outputs will tend to hit rails if things aren't right.

[Fraser]

@mike
Good advice indeed. In my case it was less simple though. The buffer chips had a failed input that was fed from one of the monster FPGA chips. I was unable to predict what what should be happening on that pin and it stayed low. The FPGA was actually unprogrammed due to the fault so was very unpredictable anyway. The fault was an input on the buffer that was low at all times. I could have used a pulser on the pins to stimulate some activity but with an FPGA connected to the pins I was a little cautious. This was a learning experience on these cameras and I now know them well so all the effort was not in vain. You are totally right about checking the easy bits first though. I have even resorted to changing chips without testing them if it is faster and safer than proding around a circuit looking for errors. DRAM would be a typical case where I might do such.

I must say I like the topic of this thread. I am not sure that reverse engineering has been discussed in much detail before ?

[Fraser]

@Singapura,

I have just ordered your book through Amazon.co.uk and look forward to receiving it in due course. I feel sure that I will learn from your experience and look forward to seeing how you are using Visio. Thanks for putting the effort into authoring such a book and I hope it is very successful.

Whilst talking of reverse engineering PCB's I thought I would tell you my nightmare scenarios when attempting to do such.

I have opened up sophisticated equipment and found the PCB has been sanitised. By sanitised I mean that either it has been covered in opaque varnish coating or worse still, all of the important IC identification details have been ground off or laser erased  When I see this, my heart sinks. I am left to work out or guess what the IC is and its purpose before even starting the search for suitable candidates. This seems common practice on some Chinese equipment and the teardowns of DSO's on this forum provide plenty of examples. Fortunately an oscilloscope is a well understood topology and the architecture of many Chinese DSO's is similar. As such I always hunt for data or PCB pictures of other similar products in the hope that they have not erased the IC's used in a similar area of the design. a classic case is the DSO input channel IC's and the ADC chips. The clever members on this forum have often identified the anonimised chip by its location in the circuit and possible function, leading to a likely candidate from one of the well known manufacturers like Analogue Devices. This is where a forum such as this is invaluable. There are many very knowledgeable people here. If an anonimised chip cannot be identified, I am left with pin monitoring to establish the inputs and outputs, plus likely functionality of the IC. For simple gates and amplifiers this is relatively easy, but when you meet a complex VLSI chip things get more difficult to say the least. In such cases I tend to treat the IC as just a black box and detail its inputs and outputs. Once the reverse engineering of the schematic is complete it is sometimes possible to work out the blocks functionality. FPGA's are a classic case of a 'black box' as the configuration is not normally available or extractable in any meaningful way. The 'Resin Blob' IC's are also quite common in Chinese equipment. No clue is given to the identity so it must be extrapolated from the measured functionality. Multi layer PCBs can make this even more difficult as not all die connections can be seen or probed.

Another pet hate of mine is the PCB that contains lots of glue logic and little else. As the chips are configured in a format only known to the manufacturer, you basically have a schematic with 'black boxes' connecting to other 'black boxes'. Little help in working out whether the board is working correctly or not. At least with discrete logic chips and chips for which datasheets exist you can work out the functionality and correct states that should be seen.

Anyway, I have waffled on enough so I will finish here.

Best Wishes

Fraser

[Singapura]

Hi Fraser (Aurora)

Thanks for your kind support!

Yes, I feel the same way you do when face with anonymised components (especially ICs) i.e. have their markings erased or covered with tough opaque compounds, as well as resin blob multi-pin unknowns (usually hybridized custom parts). I mentioned this in the footnote of my book under legal and copyright issues, commenting that some OEMs go so far as to use programmable logic devices or embedded designs with security bit protection, or even produce their own ASIC or proprietary components,  in-house or out-sourced, just to be sure that there is no way to reproduce a functional copy of their product but to go back to them for repair. It's understandable for the protection of their design and business, but can also be a sword that cuts both way in that customers may then opt for COTS to prolong their investments on the systems they're purchasing, unless the OEM happens to be the sole proprietor of certain ground-breaking technology or the expert designer house of that particular system.

Even if such obstacles are not an issue to contend with (i.e. not present on the PCB), one may still find certain design challenging because the hardware designer intentionally used peculiar approach in circuit topologies that defy conventional knowledge. PCB reverse engineering is more of an iterative as well as incremental process in which one constantly make adjustments and even major changes to the schematic's interconnectivity as it takes shape, and more of the inter-relatedness between components are discovered. So besides having a resolute spirit that is needed to see one through the tough exercise, some degree of being able to visualize and a sense of artistic proportion are invaluable too.

In my humble opinion, basic preparation such as gathering the necessary datasheet and information of components present, ascertaining the identity of the parts and creating a BOM for quick reference and keeping tabs, acquainting with the PCB layout and establishing a strategy, etc. will help greatly to reduce time and effort when the real work begins.

No matter what, doing reverse engineering on a PCB is always a pleasurable challenge that stimulates our engineering mind and curiosity, and once you have it figured out and pieced up, it's like Sherlock Holmes solving a mystery case - the satisfaction is immensely gratifying.

Do leave me your frank review at Amazon after you've received and gone through the book. Much appreciated!

Cheers!
Singapura

[Fraser]

@Singapura,

It will be a pleasure to provide feedback on your book. As you have already highlighted, I have gone a little further than your books target audience in terms of my analytical equipment inventory so I will keep that in mind. The basic process will be the same however and your use of Visio greatly interests me.

I am also minded to start a new thread that details companies who are willing to provide the public with schematic diagrams fro their equipment. Some will do so for free whilst others choose to sell a complete service manual for a nominal charge (cost of production).

Examples of such friendly companies are Hameg, Digimess (Ex. Grundig) and Thurlby Thandar Instruments (TTi). I have found that it is always worth contacting a companies support agents and advising them that I wish to repair their product myself and request a schematic or service manual. It can save a lot of reverse engineering if they agree to help 

As an example I bought a Hameg 200MHz HM-2005 oscilloscope recently. From past experience I knew that Hameg will release schematics to the public. Hameg used to include the schematic in their user manuals but that ceased when R&S bought them. I contacted Hameg customer support and requested the schematic diagram. It was sent to me by return email. A great company to deal with.

I will advise when I have the book in my hands 

Best Wishes

Fraser

[albert22]

Thanks you guys for your useful insights. The SF10 seems like a wonderful aid. For me one key point in rev eng. is to assign component names to everything on board. If there is not a silkscreen or it is incomplete. I do that by taking a photo of the board and then tracing the outline of each component using powerpoint. This is not very tedious because you can copy and paste the outlines of similar components. Then I print only the outlines to have a clean layout of the board. Where I can assign names with a pencil to correlate them to the schematic.
In some smps I had to unsolder the transformers because its windings were almost a short.
As you say it is very rewarding and a opportunity to learn new things, as you try to match the datasheets and app circuits with the actual implementation.
Regards

[Singapura]

Hi Albert22,

You are right to note the importance of assigning reference designations (R, L, C, D, U, etc.) to unmarked components before doing PCB reverse engineering. I am quite surprised that you use Microsoft Powerpoint to create the PCB layout from a photo-shoot of the board, considering its drawing tools are quite basic. But I guess if your aim is to name the components without caring too much for its artwork then that's fine.

I'm a perfectionist which is why I opted for Visio to do the job because it allows me to create pretty complex and nice component symbols for both the layout and schematics with ease, and working on the PCB with a beautiful layout artwork in a way inspires me better. There were instances where I photocopied the PCB (provided it is flat enough without those irregular, protrusive components), grayscale and lighten it, and use it as reference to place my Visio symbols over the component locations, which is much faster. Of course, you need to take care to scale the photo correctly for accurate placement, as well as the perspective errors associated with scanning.

My book also discussed this issue on unmarked components in chapter 2. Attached is an artwork of another PCB from a payload control and logic unit that I worked on. Hope it'll inspire you to upgrade to a better drawing tool for your future RE endeavors. For me, Visio is the way, unless you have the time to pick up an EDA tool to master its intricacies and steep learning curves, with the intention to reproduce the PCB. RE is a tough and laborious undertaking, and good artwork serves to document your hard work as well as professional portfolio.

Singapura

[Singapura]

Oh, before I forget, reasons for having a PCB layout in print and electronic form:

1. Proper documentation of the PCB, including missing reference designators and additional data you might care to put in, such as the BOM side by side for quick reference.
2. Ease of locating specific components since it is in electronic form and therefore searchable even across multiple pages (Visio supports multi-page drawings).
3. Facilitate marking  (highlighting) of probed points to allow you to view your progress and cut down on repetitive probing, saving time and reducing wear or possible damage to the PCB.

See attached photo (also included as a 300dpi picture in my book) for an idea what I just said above.

[Fraser]

Just arrived from Amazon.co.uk

Very nice quality book with very good paper and excellent image quality

 

Sat in my conservatory enjoying the rare British Sun, perfect for a quick browse of the book 

Aurora

[albert22]

Singapura
Thank for your advice. You get very nice layouts indeed. I use powerpoint because it is very simple and it is installed in most of the PC that I use. BTW OpenOffice would do it too. With the photo on the background, my outlines are very crude, just rectangles circles and ellipses.  Once I get the printout I continue using only pencil and lots of paper.
I also used photocopies years ago when there were no digital cameras or scanners. Punctured the photocopy at each pin and then sketched the components by hand on the other side of the paper.
For detailed documentation and pcb I use Altium. Although not for RE. A drafted schematic serves me well for repair or learning what is going on.
Regards

[Singapura]

Hi Aurora

Wow! I feel excited just knowing that someone as experienced as you in RE are reading my book! And seeing the book in print brings a sense of joy to my heart too...

Yeah, the weather in UK tends to be overcast most of the time, so having good sun to enjoy is rare indeed! When I was in UK about 10 years ago, I remembered seeing a man walking his dog in the light rain on my way to a business meeting.

Hope you'll enjoy my style of writing (I tried to make it as engaging and narrative as I could without losing the engineering focus) as well as the content of the book.

Singapura

[Singapura]

Just to revisit the idea of distributing my book in e-format. After doing a bit of researching at the CreateSpace forum and hearing from other self-publishing authors, the risk of piracy is too much to take for the nine-months of hard work I put in, so I've decided to stick with the printed form of distribution on CreateSpace eStore and Amazon (US and UK).

The price of the printed book may be a little high, but its reasonable considering it is full-colored and uses good quality paper with 300 dpi resolution photos and illustrations. On top of that, I'm also giving away freebies that are downloadable at my website, some of which are supplements to my book which I'd like to include in but didn't because that would make the price too high no one will want to buy or afford it.

The latest is an ebook containing 152 pages of prefixes and suffixes of IC part numbers from 90 semiconductor manufacturers, which I've just put in my blog for download. It is in rar format and freely downloadable but you'll need the password to access the content, of course. (see attached snapshots)

So, Aurora, if you're following this post, you may want to go get your copy. I'm almost done with the through-hole layout  Visio stencils for DIP (300, 400, 600), PGA, and ZIP packages (ICs, footprints and sockets) totaling 210 symbols. Once they're ready I will also put up in a separate page for download.

That's my way of saying thanks to those who support my effort in writing my first book, and to add value for their money. 

[Fraser]

@Singapura,

Yes I am monitoring this thread 

I have not had much spare time to delve deeply inside your book (relations staying with us at the moment) but what I have read is most excellent and I congratulate you on your excellent writing style. Very easy to read and a true accomplishment in the form of this book.

Your kind gift of Visio art to purchasers of the book is most welcome and a path that I wish other book authors would follow. I have had many books with a CD included but the very fact that such is present bumps the price up in the UK as it ceases to be a VAT free book and becomes software adding 20% to the price !

When I look at the work that you have put into this book, I feel the asking price is more than justified and, as you have stated, publishing a book with such quality paper and images is not cheap.

I am having a bot of a book 'moment' and have also purchased the Art of Electronics today. That book is a little larger than yours at 1000+ pages and has a retail price of £60, but it currently has a far greater production run.
 
It will be in good company sitting along side your book in my lab library 

Best Wishes

Fraser

[Singapura]

Hi Aurora

Glad to hear that you're enjoying my book thus far, and for understanding the constraint imposed on the price. I've actually approached a publisher prior to doing it on CreateSpace and the cost of printing a copy was almost double I immediately scrapped the idea. I've done quite a bit of homework in order to ensure my potential readers get the best quality at the most reasonable price, so thank you for your kind remarks.

I guess the years of doing repair and reverse-engineering, and having to write service and failure analysis reports had in some way sharpened my ability to express the accumulated knowledge in written form. In fact, the book went through a number of revisions in the course of writing - at times while I was working on a later chapter, some flashbacks would occur in my mind about certain earlier topics that are related and I'd go back to re-read and revise those sections with additional illustrations just to make the flow of thoughts better and more coherent. And yes, I took great pains to do and re-do the photos and artworks so they'll appear nice on print.

Though my book is considered complete in itself in terms of the fundamentals of RE, indirectly I still treat it as a work in progress by supplying my readers with complementary materials and works, something like an after sales support, as much as I can, in the form of free downloads on my website and blog. This is one way to offset the cost of the book and to make it available in the shortest possible time (which still took me almost a year). I'm sure my readers will love to have such surprises and bonuses instead of thinking that their entitlement ends with the sale of the book.

I have a copy of The Art of Electronics too, albeit it's the second edition. I think your copy is the third and latest edition available on Amazon. It's a classic and must-have reference of every electronic engineer.

Wishing you a wonderful time of bonding with your family and relatives during their stay with you. Cheers!

Singapura

[Singapura]

Just put up the through-hole IC layout symbols (210 shapes in six stencils) on my website blog for buyers of my book to download at:

http://www.visio-for-engineers.com/blog/through-hole-layout-symbols

These include DIP-300, DIP-400, DIP600, DIP-SKT, PGA and ZIP packages.
The DIP packages include six different types (four plastic, one ceramic and one hermetical ceramic) plus two footprints (component and solder side).
They will be made available for purchase at $24.95 for the general public at a later date on my website store section.

[Fraser]

Excellent 

Thank you 

Fraser

[cdev]

Are there techniques in your book which can be approached without expensive equipment? (besides a good analog scope and multimeter)  Or home-made instruments.

[Singapura]

@cdev

Nice to hear from you!

When writing my book, I had in mind the most basic tools that any electronics engineer or repair technician has in his or her possession. My emphasis is twofold:

1. Strategy (steps) for different types of board
2. Visio-related instructions and examples on creating PCB layouts and schematics, including advanced topics like layering, smartshapes, and deciphering PAL devices.

Basically, the book content is organized into the following six chapters:

1. Pre-requisites - What you need to know as a minimum requirement.
2. Preparation work - Things (data) to get ready beforehand.
3. PCB layout - Technique for drawing the mechanical and layout of a PCB.
4. Schematic entry - Reconstructing the electrical diagram of a PCB.
5. Advanced topics - Additional techniques.
6. What next? - Some suggestions and pointers to further your learning.

You can go over to my website (www.visio-for-engineers.com) in the Blog section to view the posts for some idea.

Ps: Is that a Brocoliflower (a cross between broccoli and cauliflower) for your avatar photo? 

[Fraser]

I was wondering the same about the Avatar. I have eaten one of those but have no idea what it is 

I can also confirm that the book is perfect for hobbyists as well as professionals. I have built up a collection of reverse engineering equipment but the book provides the all important techniques to approach, what can be, a daunting task. I already have Visio but it is not essential and readers should not be put off this book because of the Visio content. Readers can adapt what they learn to their own needs. 

In many cases, reverse engineering is more about the logical approach rather than how many clever pieces of equipment you have. I believe it would be fair to say that the essential tools for the task are datasheets for all IC's, A good magnifying glass/microscope and a decent multimeter with fast responding continuity. Avoid multimeters with slow continuity response as they are VERY frustrating to use and slow you down. I use a Fluke 87III and, though relatively expensive, I recommend it as a quality product with great continuity response. You can brush the probe over some IC pins and immediately hear any 'hits' when continuity tracing. 

I have dipped in and out of this excellent book and can heartily recommend it to all. Money very well spent on a well written and produced book. Mine came from Amazon and is actually printed by them. I showed the book to my father, who has a background in Aero engineering (Rolls Royce) and he was very impressed with it, both in terms of writing style and overall quality. For me that was quite an endorsement as he is, like me, is a perfectionist 

I also recommend Visio to anyone who needs to draw technical diagrams. My copy came from Microsoft as part of their employer partner program, so only cost £10. It is worth checking if your employer or college have a similar partner agreement with Microsoft as it will save you a lot of money.

Aurora

[Singapura]

Hi Aurora

Thanks for the kind comments and review of my book. Would appreciate if you could put it up in the Amazon review, if possible. 

There's nothing more satisfying than to know that my readers enjoy the content of the book as much as I enjoyed writing it. There were days when I went to bed after completing halfway through a topic, but not wanting to make my wife worry for the late nights I put in, just to give her some assurance and good sleep, but ideas and words would still be flowing through my mind while I drifted into dreamland.

Hearing such good review from an experienced engineer like you, with a double endorsement from your dad who's also in engineering (aero-engineering... I mean, wow! I've had a short stint of three years part time in the aerospace subsidiary of my parent company and I admire the kind of knowledge and skill sets these engineers were involved in) just makes me feel that the one-year of sweat and hard work has been worth it all! I can't wait to share your review with my wife who had been very supportive and understanding; I'm sure she'll be very delighted too!

You sum it up well what PCB reverse-engineering is all about. In any engineering discipline, an equipment however sophisticated and powerful, is just a tool to help the engineer get the job done. How it can be effectively used to its full potential will depend on the engineer's mastery of its operation and functions, as well as the engineer's grasp and approach to the task on hand. The tool is only as good as the craftsman.

I'm sure other aspiring engineers following this thread will readily appreciate your recommendations of the essential tools required for taking up the challenge to do PCB reverse engineering. I hope they'll also see the power and versatility of Microsoft Visio and consider giving it a go. (There's a 60-day trial copy downloadable from Microsoft website.)

Singapura

Ps: My wife cooked that brocoliflower once for dinner; I thought it tasted kinda raw and told her I still like them original than in the hybrid form. (grin!)

Pps: I'm also in the process of collating a comprehensive SMD code e-reference (500+ pages) which I'll make available (hopefully before end April) for free to buyers of my book, along with the freebies that are already available for download on my website. So keep a look out in my blog!

[Fraser]

I have just left a short, high level, review of the book on Amazon.co.uk. It is going through the approval process so should appear soon. It basically says....buy it !    I am certainly glad that I did so.

Aurora

[all_repair]

I have just left a short, high level, review of the book on Amazon.co.uk. It is going through the approval process so should appear soon. It basically says....buy it !    I am certainly glad that I did so.

I was waiting for your verdict last few days.  Just placed my order, Singapura probably live a few streets round my block, yet I have to get the thumb up from UK and get the book shipped from the US.

[Singapura]

Hi Aurora

Thank you so much for your strong endorsement and support!

I was delighted to see the five star review you posted on Amazon.co.uk and shared it with my wife who's current on official business in Thailand. She was so elated! 

I'm not sure if your review will be reflected in Amazon.com (US). If it's not too much trouble, hope you can do me an additional favor by posting it there too. To date most of the orders are from the US but I have yet to see a review from my readers there. Besides UK, there's also an order from Amazon.de which is pretty encouraging to me.

@all_repair, you live in Singapore too? Didn't expect a fellow citizen to be this active on EEVblog. What a nice surprise!

PCB reverse engineering is quite a niche discipline in the electronics arena, so I don't really expect my book to become a best seller like novels that appeal to global readership, just the community of electronic engineers who're interested in this subject. But so far after nearly two months the book has garnered a relatively good response, in fact above my expectation. In the process I made some nice friends, people of similar profession and passion from across the oceans. It's a wonderful and rewarding journey being a first-time author! 

Singapura

[Singapura]

Just to announce that I have put up another bonus ebook for downloading free to all who purchase my book.
Here's the link:

http://www.visio-for-engineers.com/blog/another-bonus-ebook

It's an SMD Codes Reference Book containing over 500 pages and nearly 24000 code references to help in identifying small SMD devices with markings, for repair as well as reverse engineering purposes.

Thanks again to all my supporters out there. Cheers! 

[Fraser]

Thank you 

Aurora

[dds737]

Here was mentioned Wavetek SF10 tool, here is link on ebay for this relatively difficult to find tool:

http://www.ebay.de/itm/121630331225

Regards,

dds737

[Fraser]

@dds737,

Great find   

These are getting very hard to find so you have to take advantage of such opportunities when they appear.

Thank you 

Aurora

[dds737]

You're welcome. Looking forward to buy your book next month :-)

Regards,

dds737

ed

[Fraser]

For those unaware of the Wavetek/Meterman/Fluke SF10, here is a post I made some time ago, complete with internal pictures.

https://www.eevblog.com/forum/testgear/wavetek-sf10-short-finder-a-very-useful-tool-if-you-can-find-it/msg258070/#msg258070

Aurora

[Fraser]

I have just finished reading this book from cover to cover.

I am pleased to report that it is a most excellent read that is written in a style that is friendly and engaging. It covers its topics very well and with excellent pictorial support.

I have been reverse engineering PCB’s for all of my 40 years working with electronics, 27 of those years were in the professional world. I would be the first to admit that I am self-taught, and have improved my techniques with practice rather than formal training. I have a large array of diagnostic equipment that helps me in my reverse engineering challenges, but many are just luxuries or ‘time-savers’.

My need to reverse engineer PCB’s has normally been driven by the lack of OEM schematics and the presence of an expensive piece of equipment that requires repair. I have normally undertaken limited reverse engineering of a PCB in order to identify key areas of interest, in pursuit of a fault. This scenario normally results in a pile of hand drawn schematics, or partial schematics, from which I am able to diagnose the fault and its cause. In more recent cases I have reverse engineered whole PCB’s ‘for the record’ rather than just the repair. That is to say, I wanted a decent schematic as reference material for future needs, and not just the present situation. This has paid great dividends when repairing the FLIR PM Series thermal cameras that I collect and repair.

The schematic diagrams for FLIR PM series thermal cameras are protected under ITAR regulations, making it a Federal Offence for the OEM to release them to the public. My only option was to draw my own.  Having the schematics of one sample camera (the PM570) has enabled me to service and repair several others in the series with ease as they all have very similar PCB's.  If I had not properly documented the original reverse engineering work on the PM570 I would have had to repeat it on each subsequent ‘patient’. I am getting older and the memory isn’t what it used to be, so good documentation is even more important these days.

Having read this book, I realise that I am still in the ‘Dark Ages’ when it comes to documentation. I always work in pencil on paper and had not used VISIO in any part of the process. This book has shown me how useful a technical drawing package can be in producing decent documentation and also for mapping progress. The use of the layers option is an excellent idea. I already own VISIO so I will be using the techniques detailed in the book during my next reverse engineering challenge.

The reverse engineering process is well explained in the book and covers most of the techniques that I employ.  It will not make you a master ‘Reverser’ over night as that comes only with practice on a lot of different 'patients'. It does provide the knowledge that is needed to take on such a task however.  One skill that is essential in RE work is that of being methodical. Poor method and a ‘flitting’ here and there approach leads to errors, confusion and missing data. The challenge of reverse engineering a modern PCB should not be underestimated, but then it should not be feared either. Correct approach and patience will pay off. I get a real kick out of completing an RE task and then reviewing the whole 'picture' via the schematic. Some designs are things of beauty whilst others are, to be frank, 'Dogs'.

I was pleased to see that the book clearly identified the limitations that exist when reverse engineering a PCB. If a complex IC is a custom part or its ID cannot be cross referenced to a datasheet, you are basically stuffed when it comes to detailing the contents of the silicon die. As stated, however, you can treat it as a ‘black box’ and document its connectivity. It may also be possible to identify its function when the whole schematic has been drawn and live testing is carried out on its pins. The book details the challenges of the PAL, GAL, and high density programmable arrays such as those from Lattice etc. Glue logic is common on modern PCB's but does not stop the schematic making sense as the interconnectivity needs of the other IC's on the board is often understood.

Well I think I have written enough here, but if you are new to PCB reverse engineering, or even if you already have some experience, this is a great read that I am happy to recommend. It is obvious that a lot of effort has gone into writing it, and the fact that the author continues to release free additional useful material via his web site is testament to his commitment to his readers.

I hope  others will support this Gentleman's efforts by purchasing this book.

Aurora
(Fraser)

[Fraser]

Wavetek, Meterman, Fluke SF10

For info.... I spoke with the Dutch ebay seller referenced earlier and can confirm that he has sold all of his SF10 stock. This tool is a 'nice to have' and is not essential to PCB RE work. The book details alternatives such as the 'magic carpet' and 'golden finger' techniques.

If you can get your paws on an SF10 at a reasonable price I do recommend it as a very useful addition to the PCB RE tool inventory. Expect to pay around 30 Euros / $30 for one.

Aurora

[Singapura]

Hi Aurora (Fraser)

I am truly flattered by your more than excellent review of my book. I am also deeply humbled to know that someone of your engineering caliber and years of experience in this very specialized discipline (compared to your 40 years, I'm 10 years your junior!) took the time and effort to go through my book. I'm just lost for words to express my appreciation and indebtedness, because the greatest honor any reader can accord to an author is to read it from cover to cover and shower his work with high appraisal, all the more when it's to a first-time author! Never in my mind have I imagined that it would have garnered such a positive endorsement and praise from an established engineer like yourself, when I set out to write the book over a year ago. The lonely hours of labor and sweat have been worth the while!

Each time I read about your experience in PCB reverse engineering, it's like re-living part of my experience through the flashbacks of similar bits and pieces you've shared. Are we crazy or what to even consider the RE option? Most of my colleagues still think so, but there was an old engineer (about 13 years my senior) who's so intrigued when he saw my works he asked me to share my experience and teach him how to use Visio. Like you, he used to sketch the layout and schematic by hand. Since then, he had created his own collection of Visio drawings of the PCBs and power supplies which he repaired and worked on. Recently he reached retirement age (I felt kinda sad he had to go) but before leaving he told me the most enjoyable part of his 40 over years career was learning to use Visio and doing RE.

It goes to show that RE is not just for brave, young engineers, but something that is do-able (to some extent) for those who're willing to give it a try. It's definitely an enriching journey for those who've done it and will do more than give you a better appreciation for the design behind the artwork.

Cheers! 

Singapura (Keng Tiong)

[Fraser]

@Singapura,

I just tell it how it is....and your book is a great read 

I should explain that I started repairing radio's at the age of 7. I had progressed from an educational electronics 'Radionics' kit from Philips after learning all I could about transistor based circuits etc. In those days of no internet, I had no access to schematics for the radios so I had no choice but to RE the PCB's. Thankfully radios used single sided PCB's in those days and they were relatively easy 'patients' to work on. I used to either repair neighbours radios or beg scrap units from the local electronics emporium. I ended up working Saturdays for that shop when I hit my teenage years. That was how I learnt a great deal about different popular electronic components and their specifications.
I had moved on from Radios quite quickly and started to repair TV's and VCR's. That required a higher level of reverse engineering as the PCB's were more complex. I remember saving up to buy a service manual for a specific Ferguson VCR. I wanted it because it had a reputation for being one of the best written service manuals available at the time. It contained masses of background information on how the circuits worked and fault identification techniques. I actually managed to find a broken VCR of the correct model as well, so could practice the fault finding techniques on it. The VCR was a victim of a lightning 'near-miss' so was basically heavily damaged....great as a learning experience and I eventually repaired it after much effort. That service manual taught me a lot about VCR design principles and enabled me to reverse engineer other brands of units as well. I find that a prior understanding of the equipment design principles is very helpful in RE work. Computers are an obvious example of such. Once you know that a computer requires a CPU, ROM, RAM and some form of I/O, all connected via a databus and address bus, it is relatively simple to RE the heart of such a unit. It is the peripheral parts specific to the computers role that can take some decyphering !

In my professional role I was required to read schematics and to repair equipment for which no schematics were available. I was also required to design electronic solutions so I had a pretty good understanding of various equipment principles. My training as a Merchant Marine Radio Officer prepared me well as we were expected to be able to keep all the ships electronic systems working, or if not, finding a work around. A job where you have to think on your feet and sometimes invent solutions with limited resources. A great preparation for what followed in my career with the Government. I met chaps who would say that they would not attempt to repair a piece of equipment unless they had undergone the OEM training and had the service manuals.... IMHO a defeatist attitude. I would either hunt for schematics of similar equipment to give me an idea of the principles and/or RE the PCB's. There are times when OEM training is essential to avoid harm to the equipment or users of such, but I found such cases to be rare.

For me, reverse engineering PCB's was often just part of my normal repair technique and did not occur in isolation. I had to understand the circuit in order to repair it and that required RE techniques to a greater or lesser degree. I am always sad when people ask what is wrong with a circuit that has obvious 'burn-up' damage. I expect them to reverse engineer the circuit around the damaged component before asking such questions. That should tell them what the components purpose is and what may have lead to its destruction. RE is a very useful skill to have.

I have also met the 'you are mad' comments from colleagues who are overwhelmed by the thought of reverse engineering a PCB. They did not go to Maritime College though and some lack the confidence and attacking attitude that I have to such challenges.

I was known for my NASA quotes at work when a problem occurred....namely "lets work the problem and find a solution". I very much like the NASA engineers approach. Apollo 13 being a perfect example of working a problem to a successful conclusion. Giving up at the first hurdle or endless procrastination will not solve the problem !   

All the Best with the book sales

Aurora
(Fraser)

[atferrari]

I enjoyed reading this up to here! 

Not trying to compare myself with any of you both, at all, my most valid expereince doing RE was creating a partial schematic of a ??850 EPSON printer. The copies available in the Web, they are all just badly scanned ones. I was fortunate that the service manual was available, albeit poorly adpated to .pdf. 

The idea was to use both movements (printer head and cylinder scrolling) for a small winding machine.

Once I got a clear idea of the functionality (at my level of interest) I did the required surgery, by eliminating the micro in charge and the accompanying logic IC (kind of monster decoder) replacing them with a 18F452 (or maybe 18F4520).

I enjoyed the journey and learnt lot of things. BTW, I found amazing the fine details of design, some of them explained in the manual.

[Fraser]

@atferrari,

I have experienced similar challenges where the available schematics are just too poorly produced to provide useful data. Very frustrating !

I might be able to RE a complex PCB but I cannot write a program for a PIC (Yet!) 

I have just started to teach myself 'C' language programming for PIC's as that is something that I skipped over in my career, but I want to understand and practice in retirement.

The good news is that anyone with a methodical mind and a basic understanding of electronic components can RE a PCB. It just takes time and practice. Sometimes it is not even necessary to understand the functions of the VLSI chips as a fault may lie in a more basic part of the circuit such as the RESET line management or power supply.

I would not recommend trying to RE a 6 layer PCB as a first attempt though, It could get very frustrating !

Aurora

[atferrari]

@atferrari,

I have experienced similar challenges where the available schematics are just too poorly produced to provide useful data. Very frustrating !

I might be able to RE a complex PCB but I cannot write a program for a PIC (Yet!) 

I have just started to teach myself 'C' language programming for PIC's as that is something that I skipped over in my career, but I want to understand and practice in retirement.

The good news is that anyone with a methodical mind and a basic understanding of electronic components can RE a PCB. It just takes time and practice. Sometimes it is not even necessary to understand the functions of the VLSI chips as a fault may lie in a more basic part of the circuit such as the RESET line management or power supply.

I would not recommend trying to RE a 6 layer PCB as a first attempt though, It could get very frustrating !

Aurora

I abandoned learning C (difficulty in understanding pointers on the first try). Still using Assembler, currently with the 18F family.

BTW, thinking of those that you managed to repair, could you give an informal list starting with the most frequent causes of failure?  Sorry, it is pure curiosity from my part.

[Fraser]

I was considering writing a post on thermal camera repair but realised that they are little different in many ways to any other digital camera technologies. I have just retired and I am considering options for maintaining a small hobby budget income. One option is as a specialist repairer of items like thermal cameras. Most repair shops avoid such as no service information is available. I have experience of the technology and the tools for working on them. I am not a calibration centre though so I will leave that to others. I have already been offered 'casual' work in this area with significant financial incentives.
With that in mind I do not really want to go into too much detail on common faults in these technologies as that kinda puts me out of a job 

Aurora

[atferrari]

I was considering writing a post on thermal camera repair but realised that they are little different in many ways to any other digital camera technologies. I have just retired and I am considering options for maintaining a small hobby budget income. One option is as a specialist repairer of items like thermal cameras. Most repair shops avoid such as no service information is available. I have experience of the technology and the tools for working on them. I am not a calibration centre though so I will leave that to others. I have already been offered 'casual' work in this area with significant financial incentives.
With that in mind I do not really want to go into too much detail on common faults in these technologies as that kinda puts me out of a job 

Aurora

OK, no intention to ruin anyone's business. 

In fact I had in mind all the gear that you had in your hands. And, BTW, to be honest, at this very moment I have the slightest idea what a termal camera is.    From what I recall, lot of people talks about them in this forum. Have to look at to know...

[atferrari]

One is enough - moderator please delete.

[Fraser]

@atferrari,

No worries and no harm in asking 

I am not doing any repair work at this exact point in time as I need to recover from an illness but I am busy reading some great technical books and learning about PIC programming. I still have to do chores around the house as well  Sadly that leaves me little energy for 'play' in the home lab.

Best Wishes

Aurora

[Singapura]

To address @dds737's link to the Wavetek SF10 continuity meter which @Aurora had confirmed with the ebay Dutch seller that this item is sold out, here's a link to an article in EDN Magazine of a D-I-Y Milli-Ohm Squawker that functions somewhat similarly which anyone who's interested in RE can build:

http://www.edn.com/design/pc-board/4430376/Milliohm-Squawker-great-at-finding-shorts-and-reverse-engineering-PCBs

Functional description and schematic diagram (with accompanying component part numbers) are provided, so should make an interesting project for RE hobbyist or enthusiast.

Singapura 

[Fraser]

I have just bought a new patient that is in need of some TLC. It's a FLIR E2 thermal imaging camera that will not complete its boot sequence. This sounds like a case where I will do some reverse engineering of the design to establish exactly what is, or is not, doing what it should at start 

These FLIR cameras use multi layer PCB's so they can be a tad challenging but that makes them all the more fun for me. The camera sold for a song as it is faulty, so not too much money is at stake. The pay-off for me if I reverse engineer it and repair the fault is not just increased equipment value, it will also be the satisfaction of recovering such a nice piece of equipment from the 'grave', and the knowledge gained in the process. It also helps that I collect such cameras so I will then have a working example in my collection 

I cannot wait for the new 'patient' to arrive. Hopefully next week.

Aurora 

[Singapura]

@Aurora

The fault sounds very much like the FLIR PM570 thermal camera which you mentioned in your sixth post, but I'm sure there are other possible causes for failing to complete the boot sequence. Still, with your experience in the repair of FLIR camera equipment, I'm sure you'll be able to restore the new 'patient' of yours to full working condition.

Have fun and let us know the outcome! 

Cheers!

Singapura

[tautech]

General questions on trace/via/plane continuity testing.

Aurora's Wavetek SF10 continuity meter with the whiskers sounds like a fine piece of kit, but what are the voltages and currents that it uses?

What are the limits of continuity voltages and currents that a populated PCB can safely suffer?
We see V limits for device pins in datasheets, do you restrict continuity tests to these voltages?
What test voltages would we consider as "safe"?

My questions stem from this thread from last year:
https://www.eevblog.com/forum/testgear/multimeter-with-low-continuity-test-voltage/msg475506/#msg475506

[Fraser]

@tautech,

For info the SF10 has the following specs:

Voltage across probes: 0.5V

Current source maximum : 100uA

Continuity threshold: 10 Ohms

I would consider these specs to be very safe. The SF10 was designed to work with electronics.  An electricians continuity tester is often capable of delivering higher voltages and currents and so is not a good choice.

For continuity testing you want the p.d across the probes to be less than the normal switch on bias point for a silicon semiconductor. i.e. less than 0.6V. You also want the source current to be as low as feasible to avoid any thermal dissipation issues in a component that is sensitive to the probes p.d. 100uA is very safe. The threshold of continuity should be as low as reasonable for a continuity tester. It is not helpful if a continuity tester indicates continuity when in fact a low value resistor is in circuit (pull up resistor or load resistor) rather than a direct PCB track link. I would prefer the threshold to be around 1 Ohm but 10 Ohms is half of many multimeter thresholds, so the SF10 is not too bad in this respect.

If designing a continuity tester, you need to consider bias voltage effects and junction power dissipation if biased on. A pulsed continuity tester will have a lower dissipation in a junction depending upon PRF. Dealing with Germanium junctions can be a challenge with a continuity tester as only 0.2V is needed to bias such junctions on. This needs to be considered when using such a continuity testing tool.

Finally, a decent continuity tester should have a very fast response so a pulse stretcher may be needed. A slow responding continuity tester is a pig to use as it slows down the whole RE process as you have to wait after each probe move, rather than scan the probe along the component pins as you can with the SF10 and a Fluke 87 III multimeter.

As a hint, any continuity function that uses an old fashioned mechanical 'buzzer' as its sound generator is unlikely to be very good ! They are just too slow in responding.

Hope this helps a little.

Aurora

[tautech]

@tautech,
Hope this helps a little.

Aurora

 

[Fraser]

I have started a thread on the FLIR E2 that I will be repairing.

It can be found here:

https://www.eevblog.com/forum/testgear/flir-thermal-camera-for-teardown-my-latest-patient-the-e2/msg669563/#msg669563

As it turns out I may not need to reverse engineer this cameras PCB's as the fault is due to fluid contamination and it will just need some TLC to sort it out. However, note the procedure that I followed before disassembly..... a methodical approach is needed, just like when reverse engineering, in order to collect as much useful data as possible before opening the case.

Aurora

[Singapura]

@Aurora

Thanks for the link and the really interesting read on your exploit on the FLIR E2 camera! 

I have to confess that thermal imaging is something quite unfamiliar to me, though I have colleagues who do installation and maintenance work for one of the infrared temperature sensor product by another subsidiary of my company. I see them using a heat source to calibrate the camera every time they power up the unit to test or troubleshoot.

In terms of PCB repair, thermal imaging does come in handy sometime to help detect hot spots on faulty PCBs when they're powered up for a while, though the result may still be subjected to interpretation because some PCBs are hot due to the nature of design and operation, and unless there's a good PCB to reference, it can be quite ambiguous in some cases, at best.

Anyway, I am glad I learned quite a lot (and I mean a lot) from your sharing on this field of equipment repair. Enjoyed it thoroughly especially your interaction with other engineers who are knowledgeable on this subject as well. Keep it up!

Cheers! 

Singapura

[Fraser]

Hi Singapura,

Yes I had some fun playing with the FLIR E2 camera. I was pleased to get some life out of it on the first day  . It is still unwell and in need of some TLC however. I expect to be reverse engineering the DC-DC converters in an effort to identify which serve what components and to find suitable test points for detecting excess noise on their outputs. Its minor reverse engineering really but with such high density PCB's and many potentially failing capacitors, its worth the effort. If the supply rails to the microbolometer and its associated ADC are OK, I will need to delve deeper into the design in order to spot where the noise issue starts in the signal path.

I have had to take a rest from the E2 for the moment as I have other duties taking priority. I am looking forward to diving back into it though  It is a pretty decent thermal camera in terms of its performance but as you will have read, its physical construction leaves much to be desired. I admire fine engineering and it makes me sad to see a good electronic design let down by poor implementation of the mechanical aspects, such as case ergonomics or PCB mounting etc.

That E2 thread went further than I had originally intended. It is risky to provide an insight into ones thinking processes, especially when suffering from the brain fogging CFS. I do not think I made too many mistakes this time though   

On another topic.

I have VISIO 2010 on my desktop computer and I decided it would be good to have a version of VISIO for mobile use. I just purchased an original boxed copy of VISIO Standard 2003 complete with its serial number for £29. It arrived today so I will soon be able to work with VISIO whilst away from home 

I did look at the later versions but they are still commanding quite high prices on Ebay. The 2003 version should be fine for my limited needs anyway.

I will post in this thread if I start reverse engineering the E2 PCBs or any other device that passes across my lab bench.

Aurora

[Singapura]

@Aurora

Haha... I guess it's not uncommon for engineers like us to experience CFS on and off, especially when we get too focused with some on-hand technical issues that have us intrigued and challenged at the same time. I agree with you that many good electronic equipment designs are let down by their mechanical counterparts in the bid to cut cost by the manufacturers, which is why these days equipment don't last as well as they used to...

The standard version of VISIO is actually sufficient if like me, you prefer to create your own shapes and symbols instead of relying on the stencils that come with the software. Visio 2003 is a decent pick if you only use it for drawings and some simple shapesheet manipulation, but if you ever go deeper in the more advanced stuff like data connectivity (linking shapes to data, displaying data graphically, etc.), Visio 2007 or higher is better.

Like you said, the 2003 version should be fine for your current needs anyway. When you've played enough with Visio and decide to do move on to higher ground, you can always upgrade to a newer version.

Cheers! 

Singapura

[Fraser]

Hi Singapura,

I do have VISIO 2010, but it is installed on my main desktop computer so not so useful when on the move  or wanting to work elsewhere in the house. I actually bought VISIO 2010 as part of Microsofts partner discount scheme with my employer. They charged me only £8 

I will use the 2003 version for less demanding tasking 

Best Wishes

Aurora

[dds737]

Could be a possible to do cheap prototype of SF10 short finder  case which is made of ABS plastic, or does this prototyping  cost fortune?

thanks.

[Fraser]

I thought about posting the reverse engineered schematic of the SF10 but in this scenario (intention to clone) that would in fact be IPA theft so I cannot do it. I have posted images of the PCB however. Tat is as far as my moral compass will let me go though.

The would not be expensive to copy but the production of the stainless steel brush might be challenging ? I have been thinking how I can replace such when it becomes to bent out of shape. No solution yet.

I believe FLUKE own the rights to the SF10. And yes I am scared of FLUKE's lawyers 

I may be able to post some decent hints at the way the design works, and which chips do what, though     I'll take a look at my SF10.

Aurora

[helius]

Perhaps a conductive brush like these ones: http://www.kita-mfg.com/pro_nanotech_e.html
could be used?

[dds737]

I thought about posting the reverse engineered schematic of the SF10 but in this scenario (intention to clone) that would in fact be IPA theft so I cannot do it. I have posted images of the PCB however. Tat is as far as my moral compass will let me

I think  if you copy pcb layout it would be IP theft, but if you rearrange schematics, pcb layout , it will be okay. Maybe I'm 100  percent wrong, but just my thoughts..


Similar  discussion here:

http://meta.electronics.stackexchange.com/questions/3366/reverse-engineering-and-intellectual-property

[Singapura]

@helius

The nanotech brush looks pretty cool but at slightly below $50 a piece it's quite expensive.
According to the brochure, it's completely made of stainless steel, from the shaft to the brush and its holder, much like the Wavetek Meterman SF10.

@dds737

Aurora has his point and concern when it comes to IPA. It's one thing to reverse engineer a piece of PCB for one's knowledge and enrichment, it's another thing altogether to put it on public domain and get yourself into possible legal trouble.

For a more in-depth understanding into this copyright issues, a good article can be found in the paper written by David C. Musker at http://www.jenkins.eu/articles-general/reverse-engineering.asp which he presented at "Protecting & Exploiting Intellectual Property in Electronics", IBC Conferences, on June 10, 1998.

If you're game enough, you might want to consider building one of those milliohm squawker short or continuity finder I mentioned in post #50. The link contains photos and schematic diagram - good for a prototyping weekend project.

@Aurora

Thanks for the thot. Would certainly love to see your work on the SF10 (private viewing maybe...).   

[kaveendra]

Clear photocopies, Nice pencil, Quality eraser, Good set of eyes and perseverance together will be the best tools for the job! Sure its not easy, but it works almost all the time 

[Fraser]

Patience and perseverance combined with a decent methodical approach is the key to solving many 'puzzles. What I like about this book is that it explains these methodology well and, in my case, opened my eyes to a new way to document my RE work.

One of the major challenges that I meet these days are higher integration of IC's meaning less visibility of the 'circuit' FPGA's etc become 'black boxes' on my diagrams. As for BGA chips, I admit I do not desolder them and have to either 'best guess' the connectivity (if a datasheet is available) or treat them as black boxes as well. Sometimes my X-Ray machine can show the pcb tracks and where they terminate on the chip but the image can get very confusing on multi layer PCB's.

The Chinese like to erase the identity of key IC's in an effort to prevent IPA theft (there is a joke in there somewhere!) and that can make reverse engineering such PCB's a challenge. Much time is spent viewing data sheets, looking for possible identities using the pin-out and likely function as as an aid. Lots of patience needed.   

I have always used the photocopy/scanner method to capture and enlarge images of PCB's so that I can annotate them. Thanks to this book I have now decided to learn VISIO and document my work using that tool. I am still on paper and pencil at the moment though 

Aurora

[Singapura]

I was quite hearten to find a positive review from another reader who purchased my book on the Amazon store website. Given that I'm a first time author, to receive such compliments from two self-taught experienced engineers in this field is certainly a great encouragement to me, and once again affirmed that the efforts spent in writing the book has not been in vain.

http://www.amazon.com/review/R1ZW81ZU1X3OKZ/ref=cm_cr_dp_title?ie=UTF8&ASIN=1499323441&channel=detail-glance&nodeID=283155&store=books

[Fraser]

@Singapura,

I am pleased to read that someone else appreciates your efforts 

I am presently bobbing about on the North Sea somewhere between the UK and Oslo but thanks to the marvel of modern technology I can still keep in touch with the EEVBlog..... Sat in the glorious sun on the rear of a cruise ship reading the EEVBlog on my netbook.....life is good 

BUT, no electronics to play with     I feel sure that I am getting withdrawal symptoms !

I am currently reading up on how to use SketchUp so that I can design some parts for my recently acquired UP! Mini 3D printer, then there is more reading on programming in 'C' for PIC micro-controllers... that should keep me sane    I should have brought that FLIR E2 and some basic reverse engineering tools.... mind you that might have scared other passengers into thinking I was up to no good 

Best Wishes from the North Sea

Fraser

[Singapura]

Hi Fraser

Enjoying your cruise and relaxing under the warm sun while catching up on some technical reading... that sounds pretty cool to me.

Yeah, the positive review couldn't have come at a better time too, considering the sale of the book has not been good lately, to the point I was wondering if this topic of RE is too niche to find enough readership in the electronic engineering market. I was even considering to remove my book off the shelf and move on to something more worthwhile. After all, I've fulfilled my dream of being an author so there is no regrets.

On hand I have created a few more stencils and I'll probably put it up on my blog for free download to my readers, once I find the time to clean and organize them.

Hope you'll pick up useful skills (SketchUp, 3D Printing, C for embedded programming, etc) that will spice up your engineering life and passion.

Cheers! 

[Fraser]

@Singapura,

Sorry to hear that sales have not been as high as your efforts deserve. Sadly you may be correct in saying that RE is a niche activity. I have met many fellow techs who do not practice it as it takes too long and if they cannot find a schematics they declare equipment BER. Very sad state of affairs really as I was taught to repair, not to give up at the first hurdle 

Have you advertised your book on other forums ? It is worthy of greater circulation and it may just need some time for its existence to be recognised. I wonder what an advert on Dave's EEVBlog home web page costs ?

A mention on web sites dedicated to hacking would do no harm either as hackers work on both software and hardware reverse engineering. Hack-a-day ?

Worst case scenario would be the release as an ebook as already discussed. The lower cost (?) may encourage more sales but with the risk of piracy. Its a difficult call to make, and so may be worth keeping the paper format for a while longer.

I hope for greater sales in the coming months. I am happy to support your book in any way that I can.

All the Best

Fraser
(Aurora)

   

[Galenbo]

Is there still no program for reverse engineering a PCB?
Take 2 pictures of the pcb, and the program generates the schematic.

For 4+ layers, the program tells you step by step where to measure continuity.

...?

[Fraser]

Not that I am aware of. Automated RE normally consists of many continuity checks using a multi probe head and X-Y bed, all driven by an automated test routine. Very expensive equipment. Sadly a visual image cannot predict the path of PCB tracks on higher density PCB's where they pass under other components such as chips etc.

The human brain is a good puzzle solver and you would really need some AI to replicate the brains analytical capabilities. Muti layer PCB's are hard for a human brain to analyse without a great deal of reference to device data sheets, X-Ray images of the PCB, many continuity tests and, in some cases, destruction of the PCB, layer by layer to reveal the pattern for imaging. I am not sure how a computerised solution using just images could solve such a puzzle. 

Sadly, much RE work is often done to steal design ideas  or to make clones. In such cases expensive automated machinery, or large RE teams, are justified. The DIY RE market for hobbyists is very small in comparison.

Aurora

[Singapura]

@Galenbo

Aurora was right on the mark!

The fastest way to reverse engineer a multi-layer PCB is using the flying probe (FP); but you'll need to first digitize the board to get the X-Y coordinates of all the solder pads to facilitate auto-probing and learning, then use the netlist generation software of the RE option that comes with the FP machine to re-create the connectivity and translate the results to schematics. The FP machine alone is costly (>$100K) and one that can do probing on both sides will be even costlier; the RE software is usually opitional and not included with the basic package.

I've visited a company that sells very high resolution flatbed scanner for RE purposes. Their approach is to sacrifice a PCB using a meticulous process, peeling off layer by layer and scanning each layer, then superimpose the scan images and feed to their software to re-construct the board's gerber data.

Both of these methods are mentioned as alternative approaches to the manual approach which I advocated in my book. After all, if your intention is to do a partial or quick RE on an ad hoc basis for troubleshooting purposes, then it makes no sense to invest in an expensive equipment or to sacrifice your customer's PCB. And as Aurora mentioned, the human brain is a good puzzle solver. If I may add on to his statement - the best equipment is only as good as the engineer that uses it.

Doing RE may not be easy, in fact it is hard work. But the rewards are great and the skills and knowledge that one gleans from this discipline stays with him or her for life. Once you go through that baptism of fire, you'd think that there's nothing you can't possibly do or too intimidating for you to take on, as far as electronics is concerned.

Have a go and give it your best shot! (Warning: you might just fall in love with it!) 

Cheers!
Singapura

[Singapura]

@Aurora

Thanks for your encouraging words and recommendations. It warms my heart to know there are like-minded engineers who appreciate and support my hard work. Knowing you through this forum has been one of the most rewarding find since writing my book.

It's unlikely that I will go the ebook approach. There's already a link online that presumably states my book is available for download but when I clicked on it to check it out, it's just another gimmick to obtain personal data and email and requires you to pay for subscription to their download services, without the assurance that the book is really there for the take. Why anyone would go through the trouble, take personal risk and get spammed in his or her email, instead of just spending straight money to buy a book from a trusted source with peace of mind, is beyond me.

And as I mentioned in the About the Author page of my book, if this first venture into book writing is sustainable, I will consider writing more books to share my experience in other areas, such as test program development, PCB troubleshooting, and even writing technical documentation (which I've learned through documenting Thales' mine hunting system on the Organization, Intermediate and Depot levels). Otherwise, I'll have to drop the idea and move on to other more worthwhile things.

But it's a pleasure to have known you, Fraser. It certainly is. 

Singapura

[Galenbo]

... The FP machine alone is costly (>$100K) and one that can do probing on both sides will be even costlier; the RE software is usually opitional and not included with the basic package.

I've visited a company that sells very high resolution flatbed scanner for RE purposes. Their approach is to sacrifice a PCB using a meticulous process, peeling off layer by layer and scanning each layer, then superimpose the scan images and feed to their software to re-construct the board's gerber data.
...

So after all, it is done with "some pictures" as I taught. :-)
Thanks for all the detailed info.

[Singapura]

@Galenbo

The scan image approach is by no means easy as the PCB has to be stripped bare of all components first, and if it is a multi-layer board, it must be sacrificed i.e. peel off layer-by-layer carefully, a task that requires skill and steady hands, especially if the board is very dense and contains many hidden or buried vias, which is quite a challenge in itself. Tell me if any customer is prepared to let you do that to their last piece of spare PCB!

From what I gather from the company, they only produce the gerber files in order to facilitate re-production of the bare board. To re-construct the schematic diagram involves another tedious task of identifying and assigning the various component footprints to the gerber data in a CAD-CAM software like CAMtastic, then converting and importing it to the PCB layout design file format of a target CAE tool such as Altium Designer, cross-referencing the parts to Altium's schematic library symbols (ICs with multi-parts can be tricky), before you can back-annotate to create the draft schematic of the PCB.

It may sound simple but actually quite a number of processes are involved after importing the gerber and NC drill data, such as layer type assignments, board stack-up and drill sets, netlist extraction (the success of this step depends on the accuracy of the preceding steps mentioned), handling split plane sections (if nested planes are present, your CAE software may not even support it!), etc. Even when the draft schematic is generated, you still need to do a physical electrical connectivity check with another good PCB to verify the accuracy.

So besides the learning curve involved in using the CAE software, you need to have a good understanding of PCB structural designs to carry out the steps outlined above. There is no quick fix like an automated one-click solution that converts gerber data straight to schematic solution. Even for a simple double-sided PCB, I find that doing the manual way is still the fail-safe and most effective approach.

Singapura

[briselec]

I recently had to reverse engineer the operator console in the attached photo so I could connect a new system to it. Try sticking that in your scanner.
I started by tracing out the simpler sections and drawing it out in gschem. Once I knew the address, data and control bits and had some idea how they were used I connected a beagle bone black and ran test code to work out the finer details. You can't see them in the photo but there are a number of CPLDs so tracing connections would have only got me so far.

[Fraser]

@briselec,

Nice work 

You have highlighted my main weakness when reverse engineering a PCB. I am not a skilled coder so when I see a CPLD or FPGA chip I have to treat it like a block that takes data in and produces data out. I can often work out what the in and out data is for but as to what happens inside the chip.....that is lost to me. CPLD or FPGA combined with BGA format are the stuff of nightmares fro me and so modern electronics is becoming harder and harder to fully reverse engineer. This is how the manufacturers like the situation of course as they are keen to protect their IPA and make non official repair or adaption difficult.

With computers on a chip these days, there is often little to be learnt from the PCB. The clever stuff is the firmware /OS and any on chip DSP. As these mat be protected behind ASIC fire walls there is little that can be learnt about their internal configuration  PCB reverse engineering may be a dying art due to the advances in technology and greater integration of chips but thankfully there is plenty of need for it at the moment as the equipment needing repair is often more than a decade old 

Like in the world of Software Designed radio, it seems to me that many modern electronics solutions are becoming more and more software defined and less and less based on many discrete IC blocks as was traditional.

Aurora

[fugro]

Aurora
I have spent a couple of hours this afternoon reading with interest your history of reverse engineering and being suitably impressed.  Earlier today I posted a question about a PM675 on another section of the forum, but which was specifically addressed to you.  Unfortunately I am not equipped at home to follow up your extremely interesting studies on RE and do not have the time or resources to do this at work either.  The PM675 is part of my firms investigative equipment and went faulty about a year ago. That was when I was first introduced to the EEVBlog and I believe we had some communications on the subject. Due to pressure of work I had to relegate the camera to our repair shelves and it is only now, when I found myself free of work pressure, did I dig it out  to have another try at resolving the problem.
Having reached a point of frustration, I searched around on the forum and came across the conversations on RE and was so interested that I am afraid I have neglected some of the other work I should have been doing today.
 If you ever get around to taking up thermal camera repairs, as you suggested you might, let me know and I will let you have a stab at our PM675. Having successfully followed the tear down procedures and checked what I could with a DMM and an analogue scope, I have decided to reassemble it and return it to it the shelf where it has rested for the past year. 
 I don't know in which part of the UK you reside, but I am probably not too far from you and, as you have resolved the circuitry of everything in the camera, it would be a doddle for you to repair it.
 

[dds737]

Can somebody shed more light on these two RE tools:

[1]https://www.eevblog.com/forum/eda/chinese-made-quickpcb2005-software/msg582651/#msg582651

[2]https://github.com/unixdj/depcb

[amirtebyan]

Hi everyone
I'm working on a multi layer pcb ( 6 layer in this case). I used imaging method using medical CT and CBCT to discover pcb inner layers. The problem is that after reconstruction CT data the tracks of inner layer are not clear and Recognizable. Can anyone help me what point is missing?

Sent from my SM-N920C using Tapatalk

[Singapura]

Hi Fraser and friends

It's been a long time since I re-visited this post. Just to notify you that I've just completed collating and editing an eBook containing various integrated circuit packages and their dimensions which you can reference to create your own Visio layout drawings. There are a total of 109 different drawings, ranging from the standard DIP, SOJ, SOP, SSOP, TSOP to the BGA, uBGA, QFP, LQFP and PLCC, etc.

Please go to my website where you can download it. Of course, you need the password from my book to unlock and unzip.

http://www.visio-for-engineers.com/downloads.html

Have a great week! 

Ps: For those of you who've given reviews for my book, kindly email me to claim the extra goodies which I've announced at:

http://www.visio-for-engineers.com/blog/rewards-for-reviews
http://www.visio-for-engineers.com/blog/additional-rewards

My email can be found in my book on page xii.

Cheers! 

[Fraser]

Hiya,

Great to hear from you again  I hope all is well with you and yours. Thank you for releasing yet more helpful material to us.

I am back to repairing thermal cameras since my health returned to relatively normal. I have had to reverse engineer several parts of PCB's as no schematics are available to the public. Having even just a block diagram of an equipment really helps when tracking down the cause of a fault.

I need to practice with Visio though as I an still using a pencil and paper for speed. I have installed a Dell 'All in One' PC at the rear of my lab bench so that I can view schematics whilst working on equipment. Little steps at the moment while my health continues to improve.

I am finding that modern electronics is using more and more FPGA technology and this does make reverse engineering a challenge in terms of documenting useful detail. I have been working on a FLIR TAU thermal camera and the chip count is very low thanks to an FPGA. Sadly that means much of the workings of the unit are buried inside a chunk of plastic and silicon. Progress !

Best wishes

Fraser

[Fraser]

The FLIR Tau thermal camera that I am working on consists of a microbolometer PCB that contains only voltage regulators and a main PCB that is mostly a FPGA and some memory chips ! Lots of 0402 discrete resistors and capacitors though !

The block diagram is somewhat simple !

Fraser

[Singapura]

Hi Fraser

Sorry to hear about your health issue. Hope you'll get better soon!
Glad to know that you're still doing reverse-engineering.

The board should be manageable if not for the BGA chip which can be quite a challenge...
Care to share how you derive the block diagram without the schematics?

[Fraser]

No problem.

With such a unit I research all of the IC's on the board to determine their needs and I/O ports. A thermal camera is basically a single board computer with ADC inputs and DAC outputs. The FPGA does the clever signal processing and has to be treated as a 'processing block' combined with a microprocessor to control the camera. As a SBC it will have the normal component parts. Namely :

Multiple Power Supply rail generation and regulation
Monitor IC controlling power on RESET and monitoring a supply rail
The 'microprocessor' (FPGA in the TAU)
ROM for the firmware and Calibration files
RAM for the OS to use

Plus the following application specific parts....

ADC for conversion of input to a format useable by the microprocessor
DAC for conversion of the data to a human friendly format.

Communications between the various IC's can be determined from the data sheets. Examples are serial or parallel data busses, Address busses, RESET and handshaking lines. The Block diagram for such a simple architecture is relatively easy to create without even tracing every interconnection. Logic dictates the topology.

The TAU uses an FPGA as its microprocessor, the ROM is an SPI Flash chip and the RAM is an SDRAM chip. The Reset management and power rail monitoring is carried out by a dedicated IC designed for such tasks. Power supply rails are derived from a single 5V source and are created using common Boost / Buck converters. Power rails are 1V2, 1V8, 2V5, 3V3, 3V6 and 12V0. The input ADC resides inside the microbolometer ROIC and sends parallel data to the microprocessor. The DAC is a VIdeo DAC IC designed to convert parallel digital data into a composite video image for a conventional TV monitor or EVF.

The data sheets for the chips tell you most of what you need to know about the various IC power supply and data needs. Sample circuits also show the likely design that has been employed in the product. The TAU uses the recommended circuits around the Boost / Buck converters and Video DAC stage.

The only real mystery is what is going on inside the FPGA. Fortunately I have worked on many thermal cameras that did not use such high integration so I know what the FPGA must achieve and the elements that must exist within it.

From a manufacturer point of view, the FPGA is an excellent way to make reverse engineering of a product harder in in order to reduce the chances of clones being produced.

Thermal cameras like the TAU are a hybrid device in that they use some basic hardware building blocks to capture and display the images, but it is the magic that occurs in the firmware that is really important. The software takes some pretty ugly image data and processes it to produce the nice clean images with which we are familiar.

Fraser

[Singapura]

Hi Fraser

Wow! Thank you for the clear and concise description of the process in creating the block diagram.

Though it looks straightforward enough to the casual reader, it comes with years of working on thermal cameras to be able to spell out the steps involved, like as it's a matter of fact.
Your experience and expertise shines through as a testimony to your labour and hard work in this endeavour, and I salute you for that!

By the way, please email me to get the Visio artwork for the power supply module (see attached figure) which I highlighted in the end of Chapter 3 of my book.
Hopefully it will enable you to learn more of the tricks in creating technical illustrations using Visio.

Cheers and to your full recovery in health!

[Iron Downey]

You can get Schematic and Gerber data from PCB Reverse-Engineering. If you want BOM as well, then you can do PCBA Reverse-Engineering. All you need to do is to send a sample of the PCB board or the PCBA board to the guy who can do the job for you. It's simple. More complicated the board is, more expensive.

[Jane]

Very interesting thread.
@Fraser:
As I can see you are a real expert in reverse engineering.
I have a device that also consists FPGA and that device can not boot up successfully.
When I check a log file I can see teh device  restarts because it can not initialize OLED LCD of that device.
The log says that FPGA can not initialize OLED. I used another OLED but the problem persists. Do you think that FPGA is faulty or just an IC around  failed to communicate with that FPGA?
 ( I think that FPGA is being flashed on a fly from a flash memory that is a part of that device.)
Do you have any hint how to try to repair the problem?
Thank you

[Singapura]

Hi Jane

Is the FPGA Altera or Xilinx type? Some FPGAs are pre-programmed (electrically erasable) and some are configured upon boot-up (RAM-based). If there is a configuration PROM near it, it's likely to be the latter.

While it's possible that the FPGA may have a bad logical cell array (LCA) that cause the failure, it is good to check the PROM content first to see if the config data is OK (that is, if you have a spare good one to compare, or the hex file).

If you have already eliminated the OLED LCD, and the PROM content is good, chances are the FPGA may be faulty.

[Jane]

Thank you for your reply.
Can you please be more specific what you mean by configuration PROM ?
Thank you

[helius]

For a FPGA to run the intended design, it has to be able to load the bit pattern called the configuration that sets it up for that design. Sometimes this configuration is stored in a Flash memory on the FPGA itself, but other parts have no non-volatile memory, and require the configuration to be reloaded each time the hardware is reset.
The chips with non-volatile configuration memory are mostly made by Microsemi (formerly Actel). Lattice also has some non-volatile chips. The chips that require external configuration rom are made by Xilinx or Altera. Typically they use a special device called a 'Quad SPI' or QSPI flash that have distinctive part numbers.
http://www.xilinx.com/Attachment/QSPI_FLASH_support_guide_rev1.0.pdf

[Jane]

That FPGA is  Xilinx XC3S400A.
Is there any clue how to check if that FPGA is already programmed or is it done on a fly( during booting process) ? And then  can I simply replace that FPGA?( That is BGA type)
Thank you for your feedback

[helius]

XC3S400A is a Spartan 3A, and is volatile memory only. There is nothing stored inside when it is powered off, so it can be replaced.
The chip may have an underfill added during assembly, which increases the difficulty of removal.

[Jane]

@helius:Thank you for your reply. That FPGA XC3S400A (being rather hot) could be a culprit for the device not booting properly. But there can  also be a problem in a memory ( or its voltage) that provides data for that FPGA.
Do you have any idea how to start with that repair? Shall I replace that FPGA and check if that solve the problem? Or is there any smarter way?

[technotronix]

Can I see inner traces of boards with internal power and ground planes with x-ray techniques in reverse engineering?

[Fraser]

Simple answer is yes, providing you have a decent high resolution X-Ray machine and components do not obscure what you want to see.

Fraset

[Singapura]

Dear friends

This is just a notice to inform those who may have visited my website www.visio-for-engineers.com occasionally.
My lease with the web-hosting service will be due in about three months.
I'm not sure if I want to renew the lease after it expires.

So I decided to create a Facebook Page and try managing it for the moment.
You can find the link here: https://www.facebook.com/artofpcbreverseengineering/

Thanks for your kind support and understanding. Have a great day!

Cheers!

[cdev]

You could likely find a standard host for VERY little ($5 or less) a month to do virtual hosting, or even a VPS for very little. ($15 or less) You could also likely host a site yourself using a small server like a Raspberry Pi and upload your IP address when it changed.. (if you use a ISP that serves out dynamic IP addresses).


The situation varies, but having a web site doesnt need to be expensive.

[gbyleveldt]

Hey guys,

I recently got this book and as I progressed through it, was pointed to the Author's website to download the various footprints and symbols. Turns out the site was shut down two days ago (Grrrr); any idea on how to get hold of the files? I quickly scanned bookface as suggested earlier but didn't see anything obvious, although I don't venture much to that side of the internets if I can help it.

[Singapura]

Hi gbyleveldt

Sorry to have caused you disappointment.
You can email me at the address provided on the same page (third paragraph) and I'll send you the files.

My blog has migrated to Blogger at: visio-for-engineers.blogspot.sg

Cheers!
Singapura

[gbyleveldt]

Thanks Keng, we did make contact

[Singapura]

Dear friends

Just a reminder for those who have bought my book but did not manage to download the freebies that accompany the book.
You can email me at ngkt@engineer.com with proof of purchase and I'll send them to you.
Also, there are additional rewards if you submit a review on my book on Amazon.

Thanks and have a great day!

Cheers!
Singapura