• Please review our updated Terms and Rules here

PCB Reverse Engineering

1944GPW

Veteran Member
Joined
Apr 26, 2011
Messages
761
Location
Brisbane, Australia
Now if anyone can suggest how to trace wires that disappear into a thick cable harness containing many wires all the same colour when those traced wires don't appear to come out anywhere that I can get a test probe to, that would be a great help
Studying your console innards photo I couldn't see any part that looked inaccessible but it's only a single lo res photo. If I had to probe behind some plate or such I'd try using a length of soft tie wire as a bendy probe and hook the meter probe to that. If I really couldn't find a bare wire trace I'd clip an alligator meter lead on a sharp sewing needle and push the point through the insulation, I don't think it would leave much of a discernable mark.
 

Hugo Holden

Veteran Member
Joined
Dec 23, 2015
Messages
4,183
Location
Australia
Now if anyone can suggest how to trace wires that disappear into a thick cable harness containing many wires all the same colour when those traced wires don't appear to come out anywhere that I can get a test probe to, that would be a great help. Oh for a simple flat PCB to analyse!
There are two ways to do it. one usual way which requires a continuity check to the metal core of the wire at each end.

There is another way than can avoid this. With high frequency AC from a radio test RF generator (in the range above 100kHz, say at 1MHz) with audio frequency modulation (1kHz), you can couple via the connection at one end, and only the plastic insulation anywhere along that wire, with a clip that clips onto the insulation, and feed that to the antenna input of a transistor radio. The clip, metal wire core and insulation between, acts as a fraction of a pF gimmick capacitor and it its easy to detect which wire it is in the loom that has the signal on it.

Thinking about this, it could be a method to detect on boards where long tracks end up, with a connection at one end, a small insulated probe tip over the tracks , done with a low level injection of maybe 50mVpp modulated RF, so that no semiconductors conduct and its harmless to the board. A probe tip about 1 to 1.5mm diameter with paint insulation over its end should work, or just a polished end to put over the pcb coating, which acts as the dielectric for the gimmick capacitor.

The Telecom techs use a system, but I'm not sure of the details it may just use a square wave at audio frequencies. Or their system may require a metal contact at each end, hence you need a connection at both ends of the particular wire to perform the test, but I am not sure, you could look up their method. I know the method I suggested with the RF generator and transistor radio works, because I have done it to locate some wires on a long loom.
 
Last edited:

1944GPW

Veteran Member
Joined
Apr 26, 2011
Messages
761
Location
Brisbane, Australia
Thinking about this, it could be a method to detect on boards where long tracks end up, with a connection at one end, a small insulated probe tip over the tracks , done with a low level injection of maybe 50mVpp modulated RF, so that no semiconductors conduct and its harmless to the board. A probe tip about 1 to 1.5mm diameter with paint insulation over its end should work, or just a polished end to put over the pcb coating, which acts as the dielectric for the gimmick capacitor.
Isn't this exactly what the HP547A current tracer probe does? I have one, but not used it yet. CuriousMarc did a video on it a while back.
EDIT thinking about it, you are suggesting high frequency RF detection so I suppose it's not the same.
 
Last edited:

Hugo Holden

Veteran Member
Joined
Dec 23, 2015
Messages
4,183
Location
Australia
Isn't this exactly what the HP547A current tracer probe does? I have one, but not used it yet. CuriousMarc did a video on it a while back.
EDIT thinking about it, you are suggesting high frequency RF detection so I suppose it's not the same.
I thought that tool was to locate low R shorts on some track locations finding shorts in a faulty board, not to find where a wire or track leads to some normal higher R place like an IC ouput or input, so it would not help much, compared to the modulated RF method I suggested for finding where tracks end up in a normal board. All you need to do it is a cheap radio RF test generator, and a transistor radio with an antenna input jack.
 

RobS

Experienced Member
Joined
Sep 28, 2012
Messages
274
Location
Kent, England
Actually I have just had a complete short circuit occur in my control panel and as the power lines to the lights are inaccessible underneath all the wires to the switches I have had to break apart the cable harness and cut the power line at intervals to isolate the fault. Hopefully all that I have damaged in the process is the aesthetic appearance of the wiring.

I can recall that in my school days I suggested to a fellow student who was a stage hand in the school theatre that to find a break in a long power cable he should try using a capacitance tester to measure the capacitance of the two ends of the cable. Much to my surprise it worked and he was able to cut and salvage the valuable cable very near the break, for which he thanked me.
 

hideehoo

Experienced Member
Joined
Aug 4, 2015
Messages
106
Location
Prior Lake, MN
Recently did this with a blank (fortunately) Ferguson Big Board PCB.


Started with Kicad 7 (and I've done tons of work in Kicad for several version now), but found Sprint Layout (~$50) to be a much more flexible solution when you're just trying to do a 1:1 replica without an underlying schematic. Missed a few connection in the first go around, but nothing a few bodge wires couldn't take care of and easily fixed in the next version.
 

Hugo Holden

Veteran Member
Joined
Dec 23, 2015
Messages
4,183
Location
Australia
Recently did this with a blank (fortunately) Ferguson Big Board PCB.


Started with Kicad 7 (and I've done tons of work in Kicad for several version now), but found Sprint Layout (~$50) to be a much more flexible solution when you're just trying to do a 1:1 replica without an underlying schematic. Missed a few connection in the first go around, but nothing a few bodge wires couldn't take care of and easily fixed in the next version.
Those Big Boards look very nice.
 

pbirkel@gmail.com

Veteran Member
Joined
Apr 7, 2013
Messages
943
Location
Silver Spring, MD, USA
When I did the Taylor Wilson, no thought of pcb software or Kicad was involved. It was all old school drawing and circuit theory.

If I wanted to actually manufacture pcb's though, I would draw what I documented into Kicad. The simple reason being, it is cheaper. In the past I had simply sent my .jpg images of the pcb to the software house and they transcribed it, but of course that attracted an engineering fee from the pcb company.

With regard to hidden traces, I found this out with the Type 'N Talk replica (see attached images). The photos I had of the original pcb, concealed the tracks under the IC's & sockets.

But, I found I could resolve all of them, from the position of the tracks entering the periphery of the IC socket.
Well, I've finished this task to my satisfaction, that being a credible schematic with some traceability to the PCB although I didn't bother to document the power rails. I spent about two weeks getting to this point, although at least a third of that time went into learning how to reasonably efficiently use KiCAD including building some new symbols that were required -- principally DIP resistors/networks. Also some fraction of time went into backtracking and rework as I better appreciated how to tackle the task and lay out the schematic in a reasonably understandable manner. It took a while to get the feel of the KiCAD pan-zoom interface but eventually I developed sufficient muscle-memory to not have to think much about it :->.

KiCAD v7 was certainly a major aid, both in terms of preparing the schematic and in terms of forward-engineering the netlist into PCB tracks that could be used for both visual verification and end-to-end pin-specific continuity tests. It also was a great help in understanding the emerging circuit design and thus catching "surely that connection isn't right" mistakes that irregularly cropped up. Similarly it helped in predicting "must be there" traces that were otherwise difficult to identify.

This particular PCB was probably more of a worst-case test than I had originally anticipated. For the 80's era it was quite dense with quite a number of complex under-component traces. While no vias were found under ICs, quite a few were hidden by the 26 switches and mounting bars of the 32 LEDs. I ended up having to define more than 170 TPs to document vias and establish netlists. Ouch!

A complication that I was unable to avoid with my limited photo equipment was an inability to register front and back photos. To accomplish this would require both significant depth-of-field and a distant focus point so as to limit spherical distortion. I was able to accomplish a fair job in a single photo for the backplane after a bit of perspective correction in Gimp, which I used as my reference PCB positioning. Still, there were spherical distortions resulting from the relatively close camera positioning required to get good trace resolution. The front side required stitching together three photos and ended up with quite a bit of non-uniform distortion throughout, precluding much in the way of quality registration. Unfortunately Gimp doesn't support a general rubber-sheet transformation based on both interior and perimeter control points, so acquiring distortion-free images is critical.

Excepting in the limited case of short components (e.g., all-SMD devices) a flat bed scanner won't produce good *focused* images, although it's certainly linear and thus free of perspective and spherical distortions when a good image can be obtained. A naked PCB is the perfect use-case; these sorts of legacy populated PCBs are pretty much worse-case given their high components.
 
Top