datasheets.com EBN.com EDN.com EETimes.com Embedded.com PlanetAnalog.com TechOnline.com   UBM Tech
UBM Tech

Milliohm Squawker great at finding shorts and reverse engineering PCBs

-May 23, 2014

Beeping continuity testers have been around for a long time, but for PCB reverse engineering purposes they leave a lot to be desired. They respond to a “short circuit” of several ohms whereas one would much prefer to discriminate PCB trace and test probe resistance of less than 1Ω to avoid false alarms.

Then one would want the beep tone pitch to indicate a few milliohms of ∆R, to determine which side of a closed relay contact, transformer winding, fuse, or low-resistance current sense resistor is actually connected to the net of interest, especially when the copper traces are hidden under components.

When you are rapidly sweeping a wire broom across a PCB to find common net points, no time delay can be tolerated; the beep must sound instantly, and be extended to a noticeable duration. Secondary requirements are low current drain for long battery life, low test voltage, to avoid biasing semiconductor junctions, immunity to 50-60Hz pickup, tolerance to ESD and charged capacitors, and headphone operation to avoid sonically annoying colleagues in the lab or office environment (really, this thing sounds like a scalded cat).

A wire broom?

The fastest way to find all the points connected to a single net to which a clip has been attached at one point is to sweep a broom probe across the rest of the PCB while listening for the squawks. The probe (Figure 1a) uses very fine (3 mil) phosphor bronze bristles to avoid physical damage to small surface-mount components. Pogo pins zero in on the specific device pins once the general areas are located with the broom, and are useful for their gold plating and sharp points, minimizing contact resistance. Their telescoping sections are soldered together to avoid adding unwanted ∆R movement to the measurement. Use multi-point pogo pins; you are less likely to accidentally skewer your hand than with a single-point one, while still making good low-resistance contact. If needed, a single-point pogo pin can be used on a separate probe attachment that lies flat on the bench for very fine-pitch surface mount IC pins, but be careful – these are very sharp.

 

Figure 1a  Broom and radial pogo pin

 

Figure 1b  Axial pogo pin at opposite end

 

To make the probes easy to handle while sweeping, you can use coiled cords – in this case, the four AWG26 conductors in the cord are paralleled to minimize resistance. The stationary probe can use a banana plug to attach to various sizes and types of grabber clips. Periodic alcohol cleanings will minimize the ∆R variations caused by the banana plug connection.

A typical reverse engineering setup is shown below (Figure 2).

Figure 2  A blue-box Milliohm Squawker fits nicely under an ergonomic microbench which raises the BUT (board under test) to close-up magnifying-visor eye level, with schematic capture software display in the same plane of view.

 


 

Figure 3  The Milliohm Squawker schematic (TinyCAD drawing)

The 9V battery is regulated to 5V for the low-level analog circuits. R4 sets the probe test current at 1mA, and R3 limits the test voltage to 10mV. R2 adds to the test lead resistance to ensure a positive offset voltage for U2, which is compensated by trimpot R8. This is necessary since U2 uses a single supply; its offset could be negative, and the test lead resistance is compensated later with other circuitry.

C3 removes 50-60Hz AC stray pickup, but discharges instantly into a short at the test probes for fast response. R5, D1, D2, & D4 clamp ESD and any voltages from charged BUT capacitors. U2 is a low-level comparator chosen for low current consumption and low input offset voltage, but is fast enough to respond to a broom sweep pulse of 1ms. It is available only in surface mount, so if one builds this with leaded components, an adapter board is needed. You can experiment with other fast low-power low-offset op-amps; I chose the LTC6240 simply because it responded fast enough in the LTspice simulation.

Trimpot R8 sets the beep threshold resistance: 1Ω is a good choice based on the long thin traces of a typical PCB. Neglecting U2’s input offset voltage, 1mV at U2’s negative input sets the threshold for the 1mA test current at 1Ω probe + R2 + PCB trace resistance. R8 can be set for different thresholds if desired.

A probe voltage of less than 1mV causes U2 to trigger the 100ms monostable U3A. This serves to extend the beep so it will be noticed during a fast broom sweep. U3A enables the U3B VCO, which drives the speaker with a 4% duty cycle. During idle (no beep) periods, U3B holds speaker driver transistor Q1 off; the low duty cycle ensures Q1 is mostly off so to minimize battery current drain. R14 isolates speaker current pulses from the battery to prevent any interaction between the speaker current and low-level analog circuits. C6 provides the current peaks necessary to drive the speaker to a reasonable loudness.

If headphones only are used, then Q1 will not be necessary; U3B can drive the headphones directly (a weakness in this speaker circuit is that even when headphones are used, there is current wasted through the volume control. Since most of the time the Squawker is quiet, I ignored this battery-wasting problem.)

The final version was built with SMT on a PCB with a solid ground plane, so I got away with sending the speaker return current through the plane. However, if you build this on vectorboard, keep the speaker return current separated from the low-level analog ground system with its own return path directly to the battery. The initial solderless breadboard version had all sorts of problems related to this.

U4A and U4B provide the tone pitch vs. ∆R feature. Capacitors C7 and C8 were found to be unnecessary in the PCB version, and are shown here as a 'just in case of trouble', CYA move. The 0-1mV across the probes is amplified by U4A, whose gain is set by trimpot R16. Normally, R16 is kept fully clockwise for minimum gain; I have found this to be quite adequate for easily distinguishing pitch tone changes down to 5mΩ ∆R. Trimpot R16 can be set for higher gain if it is ever necessary to increase the ∆R resolution; so far, I have not found this to be necessary. Do not overdo it – U4A can saturate on input offset if the gain is set too high.

U4B and front panel adjustment R20 let the user “zoom in” to the ∆R range of interest. U4B drives the VCO U3B control input to set the beep pitch. R20 sets the ∆R measurement window and adjusts out the resistance of the test probes, banana plug attachments, and BUT trace resistance. Start by shorting the probes together and tune R20 until the beep just starts to rise from its lowest pitch. A few more milliohms between the probes will cause a further increase in the beep pitch. If your circuit sniffing finds long BUT traces, readjust R20 to accommodate the increased trace resistance and lower the beep pitch back into its linear measurement range.

Eventually, you may reach a point where your net of interest ends in closed relay contacts or a transformer winding. Both sides of these will produce a beep, but the side with the lower pitch (lowest resistance) is where your net under test is connected.

You must hold the pogo pins firmly on the test points for minimum contact resistance. Note that temperature changes of the pogo pins will also result in pitch changes, so if you have just soldered the BUT or installed a new pogo pin onto the probe assembly, give them time to stabilize to room temperature. Also, do not touch the pogo pins during use. The warmth of your fingers will change the resulting beep pitch.

 

Also see:

Loading comments...

Write a Comment

To comment please Log In

FEATURED RESOURCES