REVERSE ENGINEERING PER LA RIPARAZIONE DI SCHEDE ELETTRONICHE Luca Corli Key Account Manager Seica S.p.A.
Nell'industria elettronica si definisce normalmente con reverse engineering "il processo di ricostruzione dei principi di funzionamento di un dispositivo o apparato attraverso l'analisi della struttura e del suo funzionamento". Nel campo del collaudo automatico di schede elettroniche, dove per la generazione di un programma di test vengono normalmente richiesti schemi e dati CAD relativi, ove questi non siano disponibili un processo di reverse engineering può risultare utile per estrarre informazioni (netlist) da una scheda campione, sufficienti per realizzare un programma di collaudo esaustivo con tasso di copertura accettabile. Tale programma, che può essere preparato in tempi molto brevi e senza richiedere una conoscenza approfondita della scheda, potrebbe risultare estremamente utile per riparare schede guaste provenienti dal campo o "filtrare" le schede funzionanti di un lotto di produzione. Lo strumento migliore agli scopi suddetti è un ATE a sonde mobili di tipo "double side", equipaggiato con opportuni strumenti hardware/software,che combinando ispezione ottica e tecniche di test orientate alle net, consente di eseguire sia le operazioni di reverse engineering che il collaudo vero e proprio delle schede.
Reverse engineering for board test Why reverse engineering for test Net oriented flying probe testing methods How to do reverse engineering for test Best flying probe architecture for reverse engineering
Reverse engineering for board test Why reverse engineering for test Net oriented flying probe testing methods How to do reverse engineering for test Best flying probe architecture for reverse engineering
How to use a flying probe tester to rebuild the netlist (and the partslist) and allow the test of an electronic board where documentation is missing?
To prepare a flying probe test program, CAD data are normally mandatory and a reasonable set of documentation (golden sample, BOM, schematics) of the UUT is normally requested
CAD data, BOM, schematics are easily available for new boards coming from production today, but some or all of them could be missing for aged boards coming from the field
If CAD data are not available the flying probe tester misses mandatory information to generate a standard test program like: TPs XY coordinates netlist (UUT electrical network) partslist (components values, tolerances)
If CAD data are not available: targets XY coordinates can be learned directly on the flying prober netlist can be extracted directly by the flying prober partslist is not necessary to run net oriented test methods
Can we make a flying prober test program without CAD data, schematics, BOM and just using a golden sample?
Reverse engineering for board test Why reverse engineering for test Net oriented flying probe testing methods How to do reverse engineering for test Best flying probe architecture for reverse engineering
P1 P2 FNODE is a powerful testing method to learn dynamic impedance of an unkown bipole, where pin 1 is a single net of the UUT and pin 2 is a reference net (typically GND)
Since every bipole on the UUT is unknown, an autolearn process on a golden sample UUT is mandatory to understand each bipole behaviour on a wide frequency range During learning process a sine waveform sweep is injected on P1 while P2 is connected to ground of the waveform generator Typical input signal amplitude is 0.2 V to work under p-n junctions threshold, avoid non-linear distorsion and skip guarding need FNODE output is the current flowing into the bipole: current module and current phase angle are the measurements stored in the test program for each net UUT is not powered up during FNODE test
GND
GND
GND
GND
GND
GND
GND
GND
GND
GND
GND
GND
GND
Can be generated without CAD data There is no need of manual debug (fully automatic) Can do a FULL shorts test (better coverage than traditional adjacency test) In case of CAD data available FNODE is useful to skip many ICT measurements (to reduce test time by keeping the same coverage)
MODE 1: EN_FORCE_TEST (default) A GND Force Low and High (possible overdrive) IC VCC No need of autolearn from golden sample UUT PWMON measures the current needed to force 0 logic and 1 logic on each net when the UUT is powered UP: over the threshold the system indicates a possible faults on the net Current limit: 250 ma Threshold typ.: 120 ma
Vectorless method for IC testing with UUT powered up Can be generated without CAD data There is no need of manual debug (fully automatic) Independent from UUT booting conditions at power up
Reverse engineering for board test Why reverse engineering for test Net oriented flying probe testing methods How to do reverse engineering for test Best flying probe architecture for reverse engineering
Put the golden sample UUT on the prober and learn the entire image of the board by using a digitizer option based on integrated CCD cameras
5 4 1 2 3 6 7 8 9 10 11 12 13 14 Working online (with ATE CCD camera) or offline (remote PC with saved images) learn all XY coordinates of all TPs (pads, pins, vias, etc..) present on the UUT images
If our main goal is to test the board only, we could learn targets on one side only (assuming the UUT is fully accessible on that side) UUT bottom side If our main goal is to rebuild schematics, we must learn all TPs, vias, pads, pins XY coordinates on both sides of the UUT UUT bottom side UUT top side
GND TP must be manually declared into the test program before to proceed to the next step
Run the netlist learning process to assign a unique net name to all targets belonging to the same net and obtain a single TP for test
During netlist learning the tester will perform the following operations: Autodebug and then Run FNODE algorithm on every single target learned Create different groups containing all targets with identical signature Run single continuity measurement on all pairs of targets within each group, to check if they really belong to the same net or not
4 3 1 1 2 5 5 6 7 8 9 10 11 11 After the netlist learning process, the targets belongings to the same net have finally the same net name and a unique TP for each net will be selected for next test operations
After the netlist learning process we are ready to go with net oriented testing methods like FNODE and PWMON, because we have XY coordinates for our targets and a netlist of the UUT (we only miss component information at this stage)
Learn analog signature on all TPs (one for each net) with FNODE method
RUN FNODE to detect possible shorts and analog failures on boards to test
Connect a cable to power up the UUT after identifying VCC and GND inputs
Run PWMON algorithm to detect possible digital faults on ICs
Manually insert components in the test program to create a partslist and allow to rebuild schematics
Once the partslist has been introduced, the tester can export CAD data in EDIF 200 format, readable by a specific software to print schematics
Print schematics by using a suitable software able to accept EDIF 200 format in input
A typical board repair operation consists on replacing one or more components An ATE system often indicates test results as PASS or FAIL and in this case it shows many errors even if there is a single fault on the board. The DES module of Seica suggests which component to replace first, by merging information of all techniques performed in the test program run
Components are sorted from the most probable defective to the least one
Need component information to address the user toward the component to replace Can be used also with FNODE and PWMON (they are not component oriented methods) if component descriptions have been entered into the test program Mostly useful when many testing methods are combined in a single test program Very powerful also for user smart analysis of the faults (guided diagnostic offline)
Reverse engineering for board test Why reverse engineering for test Net oriented flying probe testing methods How to do reverse engineering for test Best flying probe architecture for reverse engineering
A flying probe vertical architecture ensures a double side probing with UUT flat: no vibrations and no warpage mean best positioning accuracy!
The probers with horizontal architecture and mobile probes on both sides can t keep the UUT flat because of the force of gravity and they have many problems of measurement stability/accuracy due to the UUT vibrations!
Vibrations are larger on horizontal UUT than vertical UUT when probed on both sides at the same time!
Flying probers can be a nice tool not only for test but also for reverse engineering Flying probers need specific features and measurement algorithms to perform reverse engineering on electronic boards Flying probers need net oriented testing methods to allow UUT test without partslist, and only using XY coordinates and netlist coming from reverse engineering first step operations