@Tinhead, how did you manage to reverse engineer the schematics? Looks like a very difficult task,
well it is dificult, but everything is just question of time and/or knowledge.
did you have to depopulate the board first?
Typically it this depends on tool you have, the actual PCB and the reason why you doing reversing.
In case of the DSO i unpopulated few things to validate my boundary scan results or
to reduce the chance of an error (with cont. checker/buzzbox you can get wrong values sometimes),
later as i was ready with raw schematics i unpopulated most passive parts to make the schematics really complette.
Or did you use a buzzbox method?
sure, when possible or no other way available
What tools are used?
Continuity checker - it must be always a good one (low voltage!!!). Everything below 0.7V is ok,
i'm using one with 0.4V capable of driving 0.5mA max.
Boundary scan software (evt. hardware too) - there are few good tools,
however i'm using Universal Scan from Ricreations (
http://www.universalscan.com/) .
It is not that expensive (850$ only, if you compare to other products you will see it is cheap!).
I remember the trial version was working without any restrictions, so you might use this as well for 30days?
The hardware you need to use Universal Scan -Y For all kind of (mostly ARM, it works e.g. with memories too)
chips Amontec JtagKey or Key2 (original, clone will not work with Universal Scan!), for FPGAs/CPLDs the specific
one form Xilinx or Altera (well or Digilent).
JTAG/Debugger tools - i have a complette set : Ulink V2 and Pro (which i got with MDK), H-JTAG Pro USB (i love it, much better
than the crap J-Link from Segger and their crap j-flash software), Amontec JTAGKey and Key2, Renesas FoUSB/R8a, Cypress
IceCube/MiniProg1/3, MSP430FET, STM ST-Link1/2 (actually from STM dev boards but STM is having anyways cheap tools),
Xilinx/Actel/ALTERA JTAG cables (clones only), Atmel JTAGs (ICE MKII clone, ICE3 ordered), OpenJTAG (from 100ask.net),
puhh did i miss one? probably. You don't need of course so many tool, however it is very handy to have a way to
program/debug or scan a chip. For the DSO i've used for boundary scan only Altera JTAG cable and Amontec JTAGKey2.
For NAND and testing of some S3C2440 SoC features H-Jtag Pro USB. For sure you might ask now for what reason
i need ISP/Debugging tolls, well it might be sometimes easier to code something to simulate a situation to get some results
from a chip attached to known chip (you can't just connect 32 port generators, 64 port LA without getting crazy, a few line
in code are easier and tracable!).
Stereo Microscope - sure you can work without but it is easier to have it.
DMM, DSO, Signal Generator and even sometimes Spectrum Analyzer.
Datasheets, bsdl files (in case you use boundary scan, believe me once you understood what they
doing and how they working you will never ever wish to work without)
When you decide to unpopulate parts then of course proper tools like good IR Reworkstation
(it can be cheap china thing, but you probably will have to modify a bit), set of small universal stencils,
reballing tolls, ChipQuick SMD1 (a lot of that!!) , tons of IPA (Isopropyl alcohol), Kimtech kimwipes (they are just the best)
well the typical things.
Is it possible to leave the board populated and achieve good results?
sure, with proper tools no doubt. Even with enough time (mostly for studing datasheets!!!) and only continuity checker
you might achieve very good results. However sometimes you will have at least to unsolder one or more pins
(to disable in hard way a chip). For all kind of passive components you will have for sure unpopulate them to get
exact values (analog part definitely, digital not necessary - datasheet/app note are mostly what exact enough).