7 Jan
2015
7 Jan
'15
2:35 p.m.
Does anyone have any past experience reverse engineering an existing
de-populated PCB into a scan, netlist, or similar? Any lessons learned
positive or negative?
I have a AT&T 3B2 310/400 main board that is beyond salvaging into a
working system. A previous owner has also removed the socketed parts
including the Western Electric chip set. I'm unable to find working
schematics of most of the 3B2 cards and main boards. So I'm considering
bulk de-populating the remainder of the board in an oven and trying to
derive a schematic from it. It's a fairly large board but appears to be
100% through hole. I roughly estimate it contains ~3500 through holes.
And guessing it is 6-10 layers. Thus running it through a single vector
x-ray machine would not be very useful.
I've brain-stormed several ways it can be done from de-laminating the
board, building a 2D bed of nails armature, mirroring the board holes on
a new mated PCB with 3 dozen FPGAs, etc, etc. But I'm seeking advice
from those who've done it already.
Thanks,
-Alan
7 Jan
7 Jan
2:55 p.m.
On 1/7/15 2:35 PM, Alan Hightower wrote:
I'm seeking advice
from those who've done it already.
I've used a circuit beeper or an ohmmeter lots of times. Tony has even more
experience
than me. Logically, you form a block diagram of the functional blocks and data paths,
trace those, then begin filling in the clocks and address decoders. You can generally
come up with a map of the buffers for the address and data buses pretty quickly, then
trace back things like chip select decoders.
You don't need to strip the board to do this.
9:57 p.m.
Does anyone have any past experience reverse
engineering an existing
de-populated PCB into a scan, netlist, or similar? Any lessons learned
positive or negative?
I've always done it by hand (and you don't need to depopulate the board).
What you need is a continuity tester (which is not fooled by diode junctions),
a pen and paper, and a lot of (pleasant) time.
Start by removing anything that might fool the continuity tester. Switches,
obviously, inductors, low value resistors, relays, etc. For 2-lead axial
components, I just lift one end.
Then make a list of all the ICs and sections on the board. So you end up with
a list something like
U1 a b c d e f '04
U2 6264
U3 '138
U4 6809E
U5 a b c d '02
...
Now start from something that is either recognisable, or which is going to be used in one
way. Obviously
find power and ground first. Then, in the case of the above list of ICs, I would start
with the 6809E CPU,
since that will find address and data buses. Trace from there to the clock and reset
circuits, on to
bus buffers and memory. As you find each IC/section, cross it off the list so you
don't do the same bit
twice.
Boards with recognisable LSI ICs (microprocessors, I/O devices, etc) are relatively easy
in that such
devices are used in essentially one way so you don't have too much to think about. Big
boards of
TTL or worse big boards of diodes/transistors are a lot worse. A 7400 NAND gate or a
2N3904
transistor can be used in so many different ways.
I find that you get about 5 ICs (no matter what the complexity) on an A4 sheet of paper on
average.
It's relatively easy to trace connections (just buzz them out with the continuity
tester), the trick is
producing a readable schematic. This means (a) drawing bits so they are recognisable (a
trivial
example being a pair of cross-coupled NANDs making an SR flip-flop) and (b) using
sensible
names for signals. I find you have to really understand the unit to do this, which helps a
lot with
future repairs. So the time is invested rather than wasted.
Anyway, when you have finished, feel free to make the schematic unreadable by redrawing it
in a CAD
system.
-tony
8 Jan
8 Jan
12:53 a.m.
On Wed, Jan 7, 2015 at 10:57 PM, tony duell <ard at p850ug1.demon.co.uk> wrote:
and a lot of (pleasant) time.
I don't find it all that pleasant, but at least there's a sense of
accomplishment
when I'm done.
Anyway, when you have finished, feel free to make the
schematic unreadable by redrawing it in a CAD
system.
I just did that for the PSE Pacer CPU card. Is it unreadable?
http://www.brouhaha.com/~eric/retrocomputing/pse/pacer/pac-mp-001.pdf
11:34 a.m.
and a lot of
(pleasant) time.
I don't find it all that pleasant, but at least there's a sense of
accomplishment
when I'm done. > Anyway, when you have finished, feel free to make
the schematic unreadable by redrawing it in a CAD
> system.
I just did that for the PSE Pacer CPU card. Is it
unreadable?
http://www.brouhaha.com/~eric/retrocomputing/pse/pacer/pac-mp-001.pdf
I don't know why, but I find CAD diagrams with components one colour and wires
a different colour to be very irritating.
-tony
11:43 a.m.
----- Original Message -----
From: "tony duell" <ard at p850ug1.demon.co.uk>
Sent: Thursday, January 08, 2015 2:34 PM
> Anyway, when you have finished, feel free to make
the schematic
> unreadable by redrawing it in a CAD
> system.
I just did that for the PSE Pacer CPU card. Is it
unreadable?
http://www.brouhaha.com/~eric/retrocomputing/pse/pacer/pac-mp-001.pdf
I don't know why, but I find CAD diagrams with components one colour and
wires
a different colour to be very irritating.
-tony
----- Reply -----
+1
Also very hard to print on a B&W printer...
12:30 p.m.
On 01/08/2015 11:34 AM, tony duell wrote:
I don't know why, but I find CAD diagrams with
components one colour and wires
a different colour to be very irritating.
My personal gripe is with the schematic diagrams that look like visual
netlists--ICs with terminal points marked, but no or few actual wires
drawn. Downright hell trying to figure out how the thing works.
Anent this, does anyone know of a good software package that converts
netlists to honest schematics? I know that there's one for pSPICE, but
I'd like one that can take a plain old test file and do the drawing.
Sort of a troff for schematics...
--Chuck
12:45 p.m.
My personal gripe is with the schematic diagrams that look like visual
netlists--ICs with terminal points marked, but no or few actual wires
drawn. Downright hell trying to figure out how the thing works.
It's difficult. Long 'wires' that go from one side of the schematic to the
other
can be very hard to follow too. I think it helps if the schematic is drawn as a
set of functional blocks with the inputs and outputs given sensible names.
But anybody who draws an SR flip-flop as anything other than a pair of
NANDs (or NORs) with the obvious cross coupling shown as wires is
going to get a LART... (OK, a cross-coupled AND and OR is OK if applicable).
Taste in schematics is obviously a very personal thing, but in general I find the
modern CAD-produced schematics to be a lot harder to follow, for many reason
than the older ones.
-tony
6:35 p.m.
I appreciate all the input from folks. With 3600 though holes and at
least 4 layers, I'm afraid I will make mistakes using any manual method
like ohm tracing without a check or balance. With so many permutations
and little personal knowledge about the WE chipset, I'm sure I will miss
an occasional trace that shoots to the other side of the board. I'm also
worried that I might generate a false positive keeping most of the
components wired. Something akin to body diodes (yes I know this isn't
CMOS). Here is a wiki photo of the board for reference:
http://en.wikipedia.org/wiki/3B_series_computers#mediaviewer/File:3b2-300-m…
As I said the board isn't very useful in it's current state. So I will
start by dropping the components off and removing the solder mask with a
sanding pen. I've had good luck in the past photo transferring a scanned
image of the board into eCAD with contrast enhancement. That will at
least get me the top and bottom layers with good accuracy. If manual
tracing of inner layers proves to laborious, I'll revisit automated
methods.
To add to Chuck's question, I've thought about that too. With the open
nature of KiCAD and Eagle file formats, it should be straight forward to
generate a schematic from a text netlist (or even IPC-D-356). Especially
since both contain definitions for the referenced schematic symbols. eg
you can synth a 'generic' DIP-16-U<n> symbol to go with that yet to be
defined part in any library.
Thanks again.
On 2015-01-08 03:53, Eric Smith wrote:
On Wed, Jan 7, 2015 at 10:57 PM, tony duell <ard at
p850ug1.demon.co.uk> wrote:
Links:
------
[1]
http://www.brouhaha.com/~eric/retrocomputing/pse/pacer/pac-mp-001.pdf
and a lot of (pleasant) time.
I don't find it all that pleasant, but at least there's a sense of
accomplishment
when I'm done.
Anyway, when you have finished, feel free to make
the schematic unreadable by redrawing it in a CAD system.
I just did that for the PSE Pacer CPU card. Is it unreadable?
http://www.brouhaha.com/~eric/retrocomputing/pse/pacer/pac-mp-001.pdf [1]
10:06 p.m.
I appreciate all the input from folks. With 3600
though holes and at
least 4 layers, I'm afraid I will make mistakes using any manual method
like ohm tracing without a check or balance. With so many permutations
and little personal knowledge about the WE chipset, I'm sure I will miss
an occasional trace that shoots to the other side of the board. I'm also
worried that I might generate a false positive keeping most of the
components wired. Something akin to body diodes (yes I know this isn't
CMOS). Here is a wiki photo of the board for reference:
It would actually worry me more if a computer was tracing the connections
(as you suggest) rather than a person. A clueful person will spot obvious
errors, like outputs linked together, lines with nothing driving them, circuits
that could never be enabled, etc. I suspect a computer could be got to
flag the more obvious ones, but not all. And you are much more likely
to spot errors as you go than by looking over the diagrams afterwards.
I mentioned using a good continuity tracer that is not fooled by diodes. This
will handle any parasitic junctions in ICs, etc. If you get to know the instrument
you will not have problems from false positives.
-tony
9 Jan
9 Jan
6:53 a.m.
On 1/8/15 6:35 PM, Alan Hightower wrote:
I appreciate all the input from folks. With 3600 though holes and at
least 4 layers, I'm afraid I will make mistakes using any manual method
like ohm tracing without a check or balance. With so many permutations
and little personal knowledge about the WE chipset, I'm sure I will miss
an occasional trace that shoots to the other side of the board.
Looking at the picture, it isn't that hard to decompose what's there into
functional blocks. At that density, the PC layout guy will have kept the
parts that are closely related together. You have an expansion bus interface
on the left with bus buffering, HD controller, UART, floppy interfaces and a
DMA controller for it on the top, processor upper right, four eproms, so there
is a 32 bit data bus, and some sort of memory interface coming out the bottom.
Get the SYS V driver sources and headers from Seth, that will tell you what the
interrupts and DMA channels are hooked to and where the peripherals are mapped.
Start with the CPU and trace the address and data bus paths. You don't need to
buzz out every pin, just identify what buffer is connected to what and start
ticking off the ICs from the top board layout out through the peripherals,
expansion bus, and memory bus. Once that's done, you'll have decoders, state
machines and glue logic which should be functionally associated with one of
the big blocks. It doesn't look like there are many bipolar proms or PLA/PALs
I see one 82S153 sequencer near the CPU, but Signetics parts (82S100, 105, 153)
don't have protection fuses.
I have one document that I haven't put on line yet that I think describes the
expansion bus, I'll try to get that uploaded today.
Is there a description somewhere of what the various 3B2 CPU boards had on them
or what the memory board looks like?
It's a drag the guy on eBay wants so much for the docs they've listed.
8:12 a.m.
New subject: Reverse engineering vintage PCBs (wrt: 3B2 main board schematics)
There are actually twelve Signetics '153 PLAs, two registered 16R4s, and
a custom 18-pin ASIC that doesn't have a part number at all. So some
info will need to be derived through inference. Just the 12
combinatorial parts alone will need to be de-soldered to pull either
fuses or an observed truth table. So much programmable logic on the
board and the high density complicates functional level tracing. Memory
is actually on the left and the expansion bus is on the bottom. Power
comes down through the bottom back-plane from the PSU.
Manual is doable. It's just time consuming. The nice thing is all
components are layed out on a perfect 100 mil grid. I already have a
perfect board layout in eCAD with correct offsets for 100% of the 4,009
holes, including 7 mounting holes, just by looking at the board. I was
hoping to find someone on cctalk with a short-cut, beyond the
traditional methods I had already considered and you have echoed, for
doing the rest. I'm still looking at using a friend's home brew CNC step
table and a couple pogo pins to automate net-list creation. But we'll
see. I have a few more boards beyond the main board that I will trace
in-circuit by hand before I do the main board; for practice. Most option
cards are essentially complete 80186 PCs on each card! (PORTS, EPORTS,
QIC TAPE, StarLAN NAU, etc). AT&T must have reused the 80186 design on
everything for NRE cost reasons.
There doesn't seem to be any archived copy of the AT&T 305-490 "3B2
Computer Technical Reference Manual" anywhere nor any indication if it
included board schematics. Beyond that, I cannot find a hint of anything
previously archived that would have schematic level information on any
3B2 computer. That's why I'm doing this.
I know of Seth's work. I pulled ROM images for him which started me down
this rabbit hole! Otherwise my 3B2s would be quietly rusting in the
basement!
Thanks for the feedback.
On 2015-01-09 09:53, Al Kossow wrote:
On 1/8/15 6:35 PM, Alan Hightower wrote:
I appreciate all the input from folks. With 3600
though holes and at least 4 layers, I'm afraid I will make mistakes using any manual
method like ohm tracing without a check or balance. With so many permutations and little
personal knowledge about the WE chipset, I'm sure I will miss an occasional trace that
shoots to the other side of the board.
Looking at the picture, it isn't that hard to decompose what's there into
functional blocks. At that density, the PC layout guy will have kept the
parts that are closely related together. You have an expansion bus interface
on the left with bus buffering, HD controller, UART, floppy interfaces and a
DMA controller for it on the top, processor upper right, four eproms, so there
is a 32 bit data bus, and some sort of memory interface coming out the bottom.
Get the SYS V driver sources and headers from Seth, that will tell you what the
interrupts and DMA channels are hooked to and where the peripherals are mapped.
Start with the CPU and trace the address and data bus paths. You don't need to
buzz out every pin, just identify what buffer is connected to what and start
ticking off the ICs from the top board layout out through the peripherals,
expansion bus, and memory bus. Once that's done, you'll have decoders, state
machines and glue logic which should be functionally associated with one of
the big blocks. It doesn't look like there are many bipolar proms or PLA/PALs
I see one 82S153 sequencer near the CPU, but Signetics parts (82S100, 105, 153)
don't have protection fuses.
I have one document that I haven't put on line yet that I think describes the
expansion bus, I'll try to get that uploaded today.
Is there a description somewhere of what the various 3B2 CPU boards had on them
or what the memory board looks like?
It's a drag the guy on eBay wants so much for the docs they've listed.
7:54 a.m.
New subject: Reverse engineering vintage PCBs (wrt: 3B2 main board schematics)
On 1/9/15 8:12 AM, Alan Hightower wrote:
There doesn't seem to be any archived copy of the
AT&T 305-490 "3B2
Computer Technical Reference Manual" anywhere nor any indication if it
included board schematics. Beyond that, I cannot find a hint of anything
previously archived that would have schematic level information on any
3B2 computer. That's why I'm doing this.
In post-processing the I/O bus spec, I see there is a block diagram of the CPU
board in there
9:11 a.m.
New subject: Reverse engineering vintage PCBs (wrt: 3B2 main board schematics)
On 1/9/15 8:12 AM, Alan Hightower wrote:
I was
hoping to find someone on cctalk with a short-cut, beyond the
traditional methods I had already considered and you have echoed
Well, excuse the hell out of me for expressing interest.
I'll get back to real work now.
10:13 a.m.
New subject: Reverse engineering vintage PCBs (wrt: 3B2 main board schematics)
Did not mean to offend... sorry.
On 2015-01-09 12:11, Al Kossow wrote:
On 1/9/15 8:12 AM, Alan Hightower wrote:
I was hoping to find someone on cctalk with a
short-cut, beyond the traditional methods I had already considered and you have echoed
Well, excuse the hell out of me for expressing interest.
I'll get back to real work now. 
8 Jan
8 Jan
1 p.m.
On Wed, Jan 07, 2015 at 05:35:29PM -0500, Alan Hightower wrote:
Does anyone have any past experience reverse
engineering an existing
de-populated PCB into a scan, netlist, or similar? Any lessons learned
positive or negative?
Your many-layer board is far too complex for this wheeze, but back when I was
actually doing electronics for a living, a board I needed to reverse-engineer
was a two-layer affair and so I chucked it onto the office photocopier and
cranked up the enlarger. After a few rounds of re-copying the empty board, I
had several A3 sheets that had high contrast and were big enough to annotate
with components (from inspecting a populated board) and their values. From
there, it became reasonably simple to draw a proper schematic.
3586
days inactive
3588
days old
15 comments
7 participants
participants (7)
-
abuse＠cabal.org.uk -
aek＠bitsavers.org -
alan＠alanlee.org -
ard＠p850ug1.demon.co.uk -
cclist＠sydex.com -
mhs.stein＠gmail.com -
spacewar＠gmail.com