Non-destructive Reverse Engineering of PCB to Schematic - Page 1
Forum section: electronics / testgear

author: Kinkless Tetrode
author_rank: Regular Contributor
timestamp: August 13, 2019, 09:02:18 am
content: I have been unsuccessful in searching for the schematics and service manuals for some of the equipment that I have been trying to repair. It would be a great benefit if it were possible to at least generate a schematic that comes somewhere close to what is actually on the boards.Doing something like this on complex multilayer surface mount boards is likely to be impractical. And I imagine that this would really only work for the traditional one or two sided through-hole circuit boards. But I would start by identifying each of the components on the board, then identify the inputs and the outputs, and then painstakingly recreate the individual connections by hand with a continuity tester. Definitely, a brute-force process. Though what I'm thinking of is a manual labor-intensive process, I can imagine, with enough effort, the process could be automated by image processing and perhaps a bit of machine learning.Has anyone ever successfully, and non-destructively, reverse engineer a printed circuit board to produce a reasonable schematic of the components on the board? With a group effort, it would be possible to recreate rough schematics for the much of the test equipment we have that are missing schematics and service manuals. Even a rough schematic is better than nothing at all. Any ideas?

author: digsys
author_rank: Unknown
timestamp: August 13, 2019, 09:56:44 am
content: I used to do a lot of that years ago, and only started again recently .. but will likely quit doing it. It is an intense amount of work, and in my case, where I get paid for it, can be worth it. Even so, it takes a lot out of you - currently stuck on 2 projects (hopefully the last 2).In the past though, when it looked a mess, I'd simple figure out what the heck the item did, and make a new one, using my standard base modules / components. It worked out a lot easier and quicker in the end. It depends on what you are dis-assembling though.

author: tautech
author_rank: Super Contributor
timestamp: August 13, 2019, 10:03:06 am
content: Quote from: Kinkless Tetrode on August 13, 2019, 09:02:18 amYou must have some really obscure stuff not to be able to find service manuals for them.Mind listing them ?In the sticky in the Repair board there's a great list of manual resources, have you searched through all of them ?https://www.eevblog.com/forum/repair/repair-documents-and-links-sticky-me-please-mods/msg478132/#msg478132

author: Berni
author_rank: Super Contributor
timestamp: August 13, 2019, 10:10:38 am
content: Yep lots of people have done such reverse engineering.Usually this is a desperate last resort when fixing something. Its quite a bit of work for larger boards, so you usually don't do it unless you have no other choice. You can get pretty far with just flowing traces visually. It helps to take a good high res photo of the board so that you can draw and mark things on the PCB on a computer. It also lets you overlay the top and bottom sides of the board digitally to make visual tracing easier. But when traces go under components you gotta continuity test those out.What i do is draw a schematic on paper with a pencil while i trace things out. This schematic always ends up incredibly messy so after a while i might take a new piece of paper and redraw everything in a layout that makes more sense.This sort of reverse engineering tends to be easier if the board mostly contains ICs since you can just draw them as big blocks and check the datasheet for a pinout to see how that thing should connect as a sanity check. Tidying up the schematic becomes more challenging when its a board that's mostly analog and discrete transistors. Its difficult to tell exactly what each part of the circuit does so the schematic becomes a huge spaghetti mess. You usually need to have a decent understanding of analog to be able to recognize the transistor configurations like current sources, mirrors, diff stages, followers, gain stages, biasing circuits etc.. So it might take another schematic redrawing step to get things all sorted out. But in the end you hopefully do get a schematic that makes sense.

author: tinhead
author_rank: Super Contributor
timestamp: August 13, 2019, 11:11:03 am
content: Quote from: Kinkless Tetrode on August 13, 2019, 09:02:18 amsure, i reversed lot of things, here on eevblog you can find e.g. Tekway/Hantek DSOs (6 layer PCB, full schematics/parts values), PrimeSense Kinect Dev Kit (Virtex 5, 6 or 8 layers, don't remember anymore, full schematics/90-95% parts), some programming devices etc. Sometimes i do only partially, sometimes full, depends on needs. Generally reversing is nothing special, you need only some tools (jtag, scan, measure, unsolder/solder, oven, IR rework, stencils, spares), general understading for technology and time.

author: luma
author_rank: Regular Contributor
timestamp: August 13, 2019, 12:19:56 pm
content: This is commonly done and you can findguides to the processin the usual places. There are alsoloadsofplacesoffering to do it for you as a service.Non-destructive is the tricky bit - you're going to want to pull all the components off of the surface for even moderately-complex boards. With care, one could re-assemble after the process if you needed the board back in working order once completed.

author: KaneTW
author_rank: Frequent Contributor
timestamp: August 13, 2019, 12:32:52 pm
content: Quote from: tautech on August 13, 2019, 10:03:06 amI feel like the polar opposite holds. Equipment that has available service manuals is rare and far between.

author: Gyro
author_rank: Super Contributor
timestamp: August 13, 2019, 12:56:43 pm
content: Quote from: Berni on August 13, 2019, 10:10:38 amThat technique has mostly taken over from the lightbox for single and double sided. For older, simpler, boards though, a bright light behind the board can still work passably well.

author: Kinkless Tetrode
author_rank: Regular Contributor
timestamp: August 13, 2019, 10:59:08 pm
content: Quote from: tautech on August 13, 2019, 10:03:06 amSure, I have a LeCroy Model 9100 Arbitrary Function Generator that works most of the time. I have scoured the net with no luck so far. There are others who have been looking for a service manual for the 9100 with no luck either on the LeCroy owner groups. I asked LeCroy documentation support and they said others have asked about it also but they said they have no information on it and our best bet would be eBay. It’s as if LeCroy purged the literature on their obsolete equipment following their merger with Teledyne. It’s a nice piece of equipment and I did find a LeCroy advertisement for it from 1987 in the magazine for the CERN particle accelerator consortium, and it is mentioned in a few scientific research papers on Google Scholar, but other than that it is as if the thing never existed. It must have been targeted to a very specific and small market.I also have a Kenwood CS-5400 100 MHz 3-channel oscilloscope that is just as an enigma as the LeCroy for a service manual. Operator User manual is no problem, but I have no schematics or SM for either of these items.Quote from: tautech on August 13, 2019, 10:03:06 amThanks for the sticky link. Lots of good resources in there and a great bookmark for future reference.

author: Kinkless Tetrode
author_rank: Regular Contributor
timestamp: August 13, 2019, 11:08:10 pm
content: Quote from: digsys on August 13, 2019, 09:56:44 amThat’s sounds like what I expect if I attempted doing it. It would be a long term project for sure. And since I use the equipment, unless It breaks, I wouldn’t want to do anything destructive to reverse engineer it.

author: Kinkless Tetrode
author_rank: Regular Contributor
timestamp: August 13, 2019, 11:14:54 pm
content: Quote from: Berni on August 13, 2019, 10:10:38 amThanks, Berni. This is exactly the process that I have in mind to reverse engineer to a schematic. Having a basic idea of how the circuit works and what it does would go along way to arriving at a reasonable schematic. But no getting around labor required though.

author: Kinkless Tetrode
author_rank: Regular Contributor
timestamp: August 13, 2019, 11:18:03 pm
content: Quote from: tinhead on August 13, 2019, 11:11:03 amSounds like you’ve done quite a bit of RE on PCBs. How did you manage to handle dealing with multilayered boards?

author: Kinkless Tetrode
author_rank: Regular Contributor
timestamp: August 13, 2019, 11:21:12 pm
content: Quote from: luma on August 13, 2019, 12:19:56 pmThanks for the link. Yes, the non-destructive part is crucial. I wish to avoid breaking it whilst figuring out how it works on a functional piece of kit.

author: tautech
author_rank: Super Contributor
timestamp: August 14, 2019, 12:49:53 am
content: Quote from: Kinkless Tetrode on August 13, 2019, 10:59:08 pmYour Google Fu has failed you, from this find:https://qaget.info/?q=lecroy+awg+9100+series+service+manual&spid=2olvlinnz4b23hbk18oh9&sub_id=manual_semrushLook here: lecroy awg 9100 series service manualI downloaded yesterday, it worked!Only you need to register...https://access.funlizard.net/signup/?ad_domain=look.utndln.com&ad_path=%2Foffer&prod=722&ref=5172556&q=lecroy%20awg%209100%20series%20service%20manual&spid=2olvlinnz4b23hbk18oh9&sub_id=manual_semrush&sf=file_download&adserver=1.3.7-with-key-update&m=all&s=download&lid=0dbccbf7-30e7-4c59-a28a-104ea7740377&lid_hash=aeac359e2f66eff83720f92c094689d6&session_id=6395a1f0508523b35f118920c5e758fb&header_languages=%5B%22EN%22%5D&_sign=7077c5b89b927ba0ac58afb6c704d5e4&_signt=1565743737&lng=EN&country=NZI haven't tried it so you're on your own to see if the link is active and file is OK.

author: james_s
author_rank: Super Contributor
timestamp: August 14, 2019, 01:53:33 am
content: I've done it quite a bit. Usually I start by taking a high res picture of both sides of the board, enlarge them and flip one so they overlay correctly and then I pick a starting point and mark the traces on the printed photo as I go. Typically the schematic will then get several drafts, or sections of it anyway as I organize parts into logical arrangements. Even simple structures like a bridge rectifier made out of diodes can look almost unrecognizable if it's drawn strangely.For some boards I have to remove some components or do careful detective work with a multimeter. Other times I've xrayed a board to see hidden features or reverse engineer epoxy potted assemblies.

author: Kinkless Tetrode
author_rank: Regular Contributor
timestamp: August 14, 2019, 01:54:43 am
content: Quote from: tautech on August 14, 2019, 12:49:53 amWow, fast, thanks! My compliments on your search engine talent! Yes, google has clearly failed me.I just took at look at that link and I'd definitely jump on the download if it didn't require a credit card, that "will not be charged", as a prerequisite to the "free" registration.Hmm... Being the paranoid type, I think I'll have to reluctantly await for the service manual to surface via more traditional channels.But I do appreciate the effort!

author: Kinkless Tetrode
author_rank: Regular Contributor
timestamp: August 14, 2019, 02:02:59 am
content: Quote from: james_s on August 14, 2019, 01:53:33 amGreat idea. I like the idea of overlaying the back side over the front to match up the component nodes and traces. I'll definitely give that a try.You have X-ray'd boards?! That's hardcore...and very cool. Perhaps an MRI would be necessary to RE multilayered boards.Did using x-rays show any useful detail?

author: vk6zgo
author_rank: Super Contributor
timestamp: August 14, 2019, 04:29:58 am
content: Back in the day, we occasionally came across equipment with no known source of schematics.The approach was usually that of determining what it did, then having a look at available schematics from either different models from the same manufacturer, or from other manufacturers .The old ("how does Philips do it?") trick!)It is amazing how often very similar circuit configurations occur.Another way, especially with circuits that use specialised ICs, is to look up the device application notes.All of these tricks have the effect of creating "islands" of known circuitry, from which you can more readily trace the remaining areas.Tracing "from scratch" is a lot harder!

author: Berni
author_rank: Super Contributor
timestamp: August 14, 2019, 05:18:59 am
content: Quote from: Kinkless Tetrode on August 14, 2019, 02:02:59 amYep for double sided boards the overlay photo of both sides helps a lot. But most of the reason i take a photo is so that i can doodle on the board to mark stuff. It makes tracing easier if you have some points of reference on the board like ground and supply nets, or with big boards marking off what you already drawn to the schematic so that you don't draw it again by accident.And there is 3D xray equipment out there. In medical they call it a CT scan or CAT scan. Its a process that takes lots of xray photos from different angles and merges them together into a 3D volume. Similar machines are available for industrial/research use where they can have resolutions in micrometers. But obviously such a machine doesn't come cheep.Oh and MRI wouldn't work for a PCB since that looks for hydrogen atoms and metal things mess it up because they bounce the RF signal around.

author: james_s
author_rank: Super Contributor
timestamp: August 14, 2019, 04:01:22 pm
content: Quote from: Kinkless Tetrode on August 14, 2019, 02:02:59 amIt can take a bit of tweaking the kVp and exposure time but yes, it's possible to get a very nice image of the traces although parts like ICs that have leadframes inside block the traces under them. Standard medical diagnostic film has a double sided emulsion and the intensifier cassettes use a large grain phosphor that sacrifices detail in order to minimize required exposure. Mammo film and cassettes are single sided and much finer grain. For the ultimate level of detail industrial radiography film directly exposed without a phosphor can image the bond wires inside things like SC70 transistors, especially using a tube with a fine focal spot.A significant advantage of imaging inanimate objects is they don't move around and they don't get cancer so you can take a really long exposure or multiple exposures to get good results with even a small low power fixed anode tube.

author: tv84
author_rank: Super Contributor
timestamp: August 14, 2019, 04:12:07 pm
content: Some examples of Rigol MSO5000 PCB xrays:https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg2085517/#msg2085517They weren't done with reverse-eng in the mindset. So, as others have said, the machine could be tweaked more to provide useful information.It's an enterprise of time and patience.PS: Please don't bash. This was only a PoC and I think it could get much better if we dedicate the necessary time to it, even in a multilayer environment.

author: wraper
author_rank: Unknown
timestamp: August 14, 2019, 04:19:00 pm
content: Quote from: tautech on August 13, 2019, 10:03:06 amIt's true only for old boat anchors. But for newer stuff, even if they exist, often are so complete that as well might not exist at all. As for schematic, you can only dream to get it.

author: Mechatrommer
author_rank: Super Contributor
timestamp: August 14, 2019, 04:29:02 pm
content: Quote from: tautech on August 14, 2019, 12:49:53 amsee attached for what i received by clicking both links above... we can pretty much type anything in google "<insert your model> service manual" and it will provide a link to another "download manager.exe", when downloaded and run (after antivirus check passed) it will come out with all shit of advertisements, suggestions to another link or driver or anything annoying, and then download another exe and the last thing you know is antivirus warned you that a cookie/malware installed in your history/temp directory in HDD.why on earth when if i ask for a pdf manual, i got a manager exe link? if you can find me service manual (not user manual) for lecroy sda3000 and dda5005/6000 dso in pdf form i will pay $10 each. there used to be a paid site (http://www.servicemanual.ws) where i can download service manuals for many stuffs (i mostly looked for canon lenses and camera service manuals) for dirt cheap like $10 for 100 pdf download but the site is gone. i will pay and download for $10/pdf if its worth a repair, but give me plain pdf please, not exe that links to something else, nor a live stream tv subscription nor a protection scheme suggestion shit (i'm talking to the internet).