Flying Prober for Reverse Engineering

By: Bernd Hauptmann, General Manager, Seica Germany
( 1 Nov 2009 )

In the electronic industry, reverse engineering is normally defined as the process of discovering the technical construction of a device, object, or system through the analysis of its structure, function and operation. In regards to electronic board test, in the context of automatic test equipment (ATE), if the documentation normally required in order to generate a test program (for instance, CAD data, schematics and bill of materials) are missing, a reverse engineering process based on a “golden” sample board can be used to discover the technical contruction of the device under test (DUT) or unit under test (UUT).

With this process, Seica can recreate enough information (netlist) to generate a comprehensive test program with reasonable test coverage. This program, generated in a very short time and without requiring complete knowledge of the functions of the UUT, can be very helpful when repairing faulty boards coming from the field, or when used, can filter good and bad boards from an unknown batch of boards. Seica’s Aerial M4 double-sided flying probe tester – equipped with a suitable set of dedicated software tools – can be the best solution to perform both reverse engineering and circuit testing. When combined with visual inspection capabilities, it is possible to generate net-oriented vectorless test methods as well.

THE PROBLEM
How can a flying probe tester be used to rebuild the netlist, generate a BOMs and output a schematic? After the documents and files are created, how can a double-sided prober be used to test an electronic board where no data was previously provided?

To prepare a traditional flying probe test program, CAD data is normally mandatory together with a reasonable set of documentation (golden sample, BOM, schematics) of the UUT. With this information, which is almost always readily available in the case of currently manufactured products, the automatic test program generator (ATG) automatically creates the program, applying the appropriate measurement techniques included in the software platform. The situation may be completely different in the case of boards coming from older delivered products when returned from the field and must be repaired. In cases where business company acquistions or plant closures have resulted in “lost data files,” the documentation is often partly or even completely unavailable.

THE SOLUTION.
The Aerial M4 system features several software tools developed for the reverse engineering market. If the CAD data is not available, then important information is missing, such as the XY coordinates of the test points (TP), the net list (electrical network of the UUT), and finally the BOMs (values and tolerances). This, at first, may seem an insurmountable obstacle to the creation of a useful test program.

The XY target coordinates for the individual test points can be directly learned by the cameras available on each side of a double-sided flying rrober. Seica has developed several manual and automatic routines that allow for the speedy identification of XY locations using the built in AOI system. Once these coordinates are known, then the net list can be directly extracted from the flying prober with the help of special measurement methods. With these so-called “net-oriented test methods,” a parts list is not necessary. Only a golden board is required.

Seica employs a proprietary dynamic impedance measurement method called Fnode, which acquires the net signature of an analog bi-pole. This test method is used to measure the dynamic impedance of an unknown bi-pole, where pin 1 is a single net of a UUT and pin 2 is a reference net (typically GND).

Since each bi-pole of the UUT is unknown, an “autolearn” of the golden board is used to acquire the behavior of the bi-pole over a broad frequency range. A signal generator applies a frequency sweep (Figure 2) to pin 1 while pin 2 is connected to GND (Figure 1). The typical input signal amplitude is 0.2V to be below the P-N transition threshold and to avoid nonlinear distortions as well as to avoid guarding (electrically isolating the net environment to do an individual measurement on a single component). The FNODE measures the current which flows into the bi-pole and in each case the amplitude and the phase for each net is stored by the test program. FNODE is a purely passive measurement procedure, with no power on the UUT.

Figure 2 shows an Fnode response typical signal waveform. The green line is the voltage applied between the net under test and ground, and the magenta line is the current signature of the net. The advantages of Fnode are easily summarized: it is a purely passive measuring procedure, can be generated without CAD data, and no manual debug is necessary. The autolearn process runs completely automatically and creates a full shorts test with higher fault coverage than the traditional adjacency test. In addition, many in-circuit measurements can be eliminated without decreasing test coverage. This procedure utilizes a DSP-based multi-function instrument that digitizes the generated and measured signals. The acquired data enable the almost simultaneous execution of multiple, high speed tests, because all of the test models are “hardware emulated”, substantially increasing test throughput.

Once the analog signatures have been acquired during the Fnode procedure, it is still needed to acquire the signatures/functions of the digital components. The power monitor (PWMON) technique enables this acquisition. The UUT is powered on during this procedure, and the current needed to produce logic 0 or logic 1 on each node (input pin of a digital component) is measured. In this way, the threshold is learned and the system can recognize a possible error on a net. Using this method a “golden board” is not necessary although it is recommended.

The advantages of PWMON can be summarized as follows: it is a vectorless method to test ICs in a powered up condition and can be generated without CAD data. It does not require manual operations since it is a fully automatic procedure and it is independent of the UUT initialization conditions (when the UUT is powered on).

SEQUENCE OF OPERATIONS
The first step is the acquisition of the image of the UUT using the digitizing software module. The golden board is clamped in the flying prober and with the help of the integrated CCD cameras and the digitizer option, an entire board image is scanned. Once the board image has been acquired, the user can define, either on-line in the system or off-line on a remote PC, the XY target coordinates of all test points (pads, pins, vias, etc.) using a simple point and click procedure or some of the more sophisticated automatic software algorithms.

If the main goal is only to test the UUT, it is sufficient to define the target coordinates only on one side (assuming that all nodes can be accessed from one side). If the goal is to recreate the schematics of the UUT, then all of the XY coordinates of TPs, vias, pads and pins on both sides of the UUT must be defined. Subsequently, the GND test point must be identified manually before proceeding to the next step (Figures 3 and 4).

Now, the “netlist learning” process on the flying prober can be started, which assigns a unique net name to each target point, belonging to the same net, and to define only one TP for each electrical node.

During “netlist learning” the test system performs the following operations: “Autodebug” then the Fnode procedure on each individual target point. Afterwards, different groups are built, which have the identical signature. Continuity tests for each pair of targets belonging to the same group are separately made subsequently in order to make sure that they belong to the same net or not. After the “netlist learning” processes the targets have the same net name belonging to the same net and only one TP per net is fixed for the next test operation (Figure 5).

READY FOR ELECTRICAL TEST
After the netlist learning process, we can begin with the net-oriented test methods such as Fnode and PWMON, since we know the XY coordinates for our target coordinates and the UUT netlist (only the component information is missing at this point). The next step is to learn with the “Fnode Autodebug” the analog signatures of all TPs (one for each net) with the Fnode method. With the “Fnode run” procedure, short-circuits and similar errors on the UUT are detected.

At this point we have addressed the analog part of the UUT, and now we turn to testing the digital components. Once the GND and VCC inputs have been identified on the UUT, we can connect a cable and supply the requiremed voltages. The PWMON procedure can be started to detect possible digital faults on the ICs. Figure 6 shows a board powered up in the Aerial M4.

To continue the reverse engineering process and recreate the technical documentation (i.e., part list and schematics), the component information must be entered into the test program. Once we have entered the part list, the test system can export the CAD data into an EDIF 200 format, from which with special software tools the schematics can be generated and printed out (Figure 7).

CONCLUSION
Flying probers are not only a flexible tool for board test, but can be very useful in reverse engineering both for test and for recreating the technical documentation of the UUT. The Aerial M4 flying prober is equipped with specific software and hardware characteristics and algorithms which enable the generation of a comprehensive test program without CAD data or BOMs. The unique software tools and mechanical capabilities of the flying prober allow the facilities for assigning test points and entering component information so that a full data package can be generated for future production builds, field repairs, or contractual obligations.

Click here for the illustrations:

Figure 1, Figure 2, Figure 3, Figure 4, Figure 5, Figure 6, Figure 7