Netlist to schematic

[drone84]

Hi,

I'm trying to revers engineer a 6 layer PCB from a HP protocol analyser and sanding down the PCB to get a scan of all the layer isn’t an option (too messy ). I desoldered all the IC, capa and resistor and made 2 "probe" with some RP2040 board, the idea is that all the RP2040 are controlled with computer that tell "set PR20040 0 pin 1 to high, everyone else look if you see a high signal somewhere”. The problem I’m having now is what to do with the data I’m generating (a netlist basically)?

Is there any software I can import a netlist (that i will generate myself) and end up with at least the IC and track name (see the last picture).

Best regards

[RoGeorge]

Before anything, search for the service manual of you HP instrument.  Old HP gear used to have complete schematics published in their service manuals.

[drone84]

Thanks for the advice, I should have started with that in the first place, the board is the CPU of a HP4954A unfortunately I can't fine the service manual for this instrument. Someone in the forum was looking for the HP4951/2 but they are different inside (smaller case) and didn’t have more luck with the HP4953A, the board rack stack look the same and also got the same issue => RAM board ravaged bay 2 leaking battery

https://www.eevblog.com/forum/testgear/hp-4952a-protocol-analyzer-service-manual/

After some more googleing it seem that Kicad got his schema file format documented.

[SiliconWizard]

Something I was looking for too when I was working on a schematic-less design entry tool (which would generate netlists), for which being able to generate a schematic from the netlist would have been a plus.

Yes, KiCad file formats are fully documented. The difficult part is that KiCad schematics have no concept of netlists. So you'd have to 1/ place symbols in the schematic to get something that makes some sense/minimize wiring maybe, and 2/ generate the wiring which is basically just connecting segments. That isn't a simple task at all. If you just "trivially" place each symbol in some kind of grid, and generate straight wires between pins, it will absolutely look like a mess and will be pretty hard to clean up manually in the schematic editor. But you can try. Definitely not a simple thing.

One thing I tried was using a graph tool such as graphviz: https://graphviz.gitlab.io/ , but last I checked it wasn't able to generate orthogonal graphs with node ports, so what you could get wouldn't look anything like a schematic. But also something you can try.

[RoGeorge]

Maybe the way to go is to connect all the wires according to graph identified on the PCB, then manually drag the cips and manually route the wires, just like when making a PCB.  So far, "Autoroute" never worked well enough for PCB making.

As for probing the board with by sending 1's with a raspberry, just as a side note, this was the purpose for which JTAG was invented:  https://www.fpga4fun.com/JTAG.html  If that damaged board happen to have a JTAG connector on it, you might use the JTAG to flip bits.

As for reversing the schematic, maybe it's no need to do that in order to restore the board.  I would try first to rewire the busses by soldering wire-wrapping wires ( https://duckduckgo.com/?q=wrapping+wire&iax=images&ia=images ) directly between the chip's pins, without trying yo rebuild each PCB trace.

Memory chips back then were not so fast, so impedance macing for PCB traces to memory chips was not so critical.  It will work with soldered wraping wires.

Of some help while reverse engineer the traces might be to look at the datasheet pinouts first, because memory chip have an address bus and a data bus, plus a few more control lines and the chips (roughly said) connected in parallel to these two busses.   In case there are good traces to another memory chip, that might be a hint how to rewire the corroded traces.

No matter the method, it will sink some time, might be easier to buy another defective instrument listed "for parts only", and make sure with the seller that the board of interest may be defective or incomplete, but with an intact PCB.

[Doctorandus_P]

At a guess it's got around 600 pins, that is a square matrix of 300*300 = 90000 possible connections, and if it takes 2s to manually beep out a single connection, that is already 50 hours of boring and error prone work. So you need all the help you can get.

I would probably add a few microcontrollers, Some to read signal connections, and one or more to send pulses on all it's output pins, so you can test a whole socket at the same time. As an extra you could write some extra software, to send connection data to a pc, so you only have to enter the IC number of the sockets being tested, and the connections get logged.

Another option is to use KiCad with it's PCB Editor / Place / Add Image feature. With that you can load images of the PCB and draw tracks over it. Combining different methods is good to verify yourself (Did you connect an A12 to an A13 in your schematic?) Your 6 layer PCB probably has a GND & power plane (or two GND planes, which is presumably better). That leaves 4 signal layers, so with photographs for top and bottom you already have around half the connections.

A lot of it will also be data and address buses, and working with labels works reasonably nice with them. A lot of the control signals can be guesstimated.