Secured MCU Breaker Experts!

Archive for the ‘PCB Design’ Category

Identify the circuit board track pattern dissipation and layout circuit board track pattern logically:

For distinguish of ground plane, power supply circuit and signal circuit, also require engineer to have related power supply, circuit connection, circuit board layout and PCB Reverse Engineering knowledge. How to distinguish these different kinds of circuit can rely on component connection situation, copper thickness and feature of electronic product.

During the process of PCB layout & PCB Clone, in order to avoid the cross line, large bulks of ground signal can be applied on the ground plane, different circuit can use different colors to help distinguish one another, also specified symbol can use on specified components, can even separate unit circuit and draw them. And finally can integrate them together.

Forty seconds after a part is connected, it has already told you which of four situations you are in: the array was never programmed, the array is protected, the read is addressing the wrong place, or the die is damaged. The information is in the pattern of the returned words, and it is available before any money is spent and before any package is opened.

On an OTP part this triage is more valuable than on a flash part, because nothing can be undone. There is no erase that resets the experiment, no second attempt at a different protection state, and no way to try again after a wrong guess about the device profile. Get the signature right and the job is one of three known engagements; get it wrong and the part may be destroyed proving it.

Four signatures, one table

The third row is the one that causes the most wasted work, because a repeating cycle looks like data to a tool that only counts bytes. It is the read path returning a fixed value in response to every address, and it happens on units that are protected and on units whose read timing is wrong.

The part in numbers

1024 words of twelve-bit program memory in two pages, 25 bytes of RAM, twelve I/O pins, thirty-three instructions, no interrupts, and a configuration word carrying the watchdog enable and the protection fuses. The A suffix denotes a revised die of the same architecture, specified for a higher clock and a wider supply window.

Two of those facts shape the triage. The single entry point means a good read always begins with a decodable instruction at address zero, which is the cheapest possible test. The two-page split means a read can be good for the first 512 words and wrong afterwards, which produces a signature that looks like damage and is usually a page-bit problem in the fixture.

All ones: the ambiguous signature

A blank OTP array reads as all ones, and so does a part whose data pin is not connected. The distinction is made by the configuration word: a blank part returns an unprogrammed configuration word, and a part with an open connection returns nothing coherent at all or fails identification.

There is a third case that catches people. A part that was programmed and then exposed to a bulk erase command on a programmer that believes it is a flash device will return all ones while the die is perfectly good. On a true OTP device the erase does not exist, so this happens only when the operator selected the wrong device profile, which is also the most common cause of the other signatures.

The correct response to all ones is not to conclude the part is blank. It is to read the configuration word, then read a second time with a different address order, and only then to report.

All zeros and repeating words

A clamped or shorted data bus reads as all zeros. So does a device whose read is being answered by the protection logic rather than by the array, on the parts where the protection pulls the output low rather than high.

The discriminator is the address. A bus fault produces the same value at every address including the configuration word and the calibration word at the top of the map. A protection artefact usually stops at the top of the array, because the configuration word is read through a different path and still returns its real contents.

So: read the config word. If it is plausible while the array is uniformly zero, the array is protected. If both are zero, suspect the fixture.

Plausible but wrong

The fourth signature is the cruel one, because it looks like success. The image decodes for a while, produces recognisable MOVLW and GOTO sequences, and then degenerates. Three causes dominate.

The first is an offset. A read that begins one word late produces an image in which address zero holds what should be at address one, and the first instruction no longer decodes to a jump. This is trivially detectable and therefore rarely missed.

The second is a page-bit problem. On a 1024-word part the upper page needs a status bit set before it can be read, and a fixture that never sets it returns page zero again at every address above 511. The image then looks like a program that repeats itself exactly once, which is not a thing real firmware does.

The third is the wrong device profile. A profile written for a 512-word part returns the first 512 words correctly and fills the rest with a constant. A profile written for a 2048-word part returns 1024 real words followed by 1024 words of fiction.

A triage order that takes ten minutes

Read the configuration word. It is small, it is outside the array, and it usually answers even when the array does not.

Read address zero and check that it decodes. If it does not, the read is misaddressed and everything downstream is worthless.

Read the last word of each page and compare against the first word. Identical values at four widely separated addresses are a fixture artefact, not code.

Count how many distinct values appear in the first sixty-four words. Real firmware produces more than a dozen; a protection artefact produces two or three.

Then, and only then, decide between the three engagements: a read, a die-level job, or a diagnostic report that says the part is fine and the fixture is not.

For the moment after triage, when the image has to become a file, PIC16C57 heximal file extraction covers the container arithmetic. For the protection model behind the second signature, PIC16C56 code copying explains what the fuses do and do not block. And for the same triage on a part with twice the array, PIC16C57C firmware is the direct comparison.

FAQ

Can an OTP part return to the blank state? No. Once a word is programmed the bits are fused. A programmer that reports an erase on this device has the wrong profile selected.

Is a repeating pattern always protection? Nearly always, but check the address range first. A pattern that stops at the configuration word is protection; one that continues through it is a fixture problem.

What does a dead die look like? Mixed data with stuck bits: the same word returning with one bit always high regardless of address. That is not recoverable by re-reading, and it is the one signature that justifies opening the package as the next step.

The short version

Four patterns, four conclusions, ten minutes. Read the configuration word first, verify address zero, compare widely separated addresses, and count distinct values. The signature decides whether the job is a read, a die-level recovery or a report that says the part was never the problem.

2 Different Amplifier

Different amplifier can only magnify the D-VALUE of 2 signals, but won’t magnify general voltage signal. If design job of different amplifier and Printed Circuit Board aren’t reasonable, when signal level in the low status, general voltage will generate a small differential interference signal. Due to the high input impedance of different amplifier, any parameter imbalance on input point will bring much great interference to circuit. Therefore, during the printed circuit board design process, it has to ensure physical structure of amplifier complete symmetry.

There is a leakage resistance exist in the input point of different amplifier, it can take an effect of imbalance voltage deviation. Designer can solve this problem through add protective device on the input circuit, protective device can circle the signal wire, if it can keep the same voltage with 2 input signal low level, as a result of that, positive resistance value will increase. This device can ensure signal source terminal and protector keep the same voltage with low level of signal source.

High gain DC amplifier generally being used to amplify small signal. When crystal transistor or DC amplifier being soldered on PCB Board, thermocouple will be formed between copper layer and component lead, therefore will occur different AC voltage, it will has interference signal against amplifier. In order to keep the minimum temperature fluctuation rate around DC amplifier INPUT point, and remain the balance, we suggest to separate INPUT point with part to avoid the influence caused by air flow.

In the analog circuit PCB Board, signal circuit can fulfill a variety of functions, such as signal input, feedback, output and provide standard signal. Therefore, refers to different applications, signal circuit must be optimized through different ways. However, there is an commonly known principle that in all the analog circuit PCB Board, signal circuit should be as short as possible, that is because the longer signal circuit, the more chances it can involve inductance and capacitor, that is the last thing PCB design engineer want to see. But the fact is impossible to make all the signal circuit to its shortest level. Therefore we have to take the most readily having interference signal circuit layout into account.

Below signal circuit layout need particular attention during PCB layout:

1> High frequency oscillator / amplifier;

2> Multi-level amplifier, especially with high output power;

3> High gain DC amplifier;

4> Minor signal amplifier;

5> Differential amplifier;

If we choose to use auto layout, till which level it can support? Such as how many layer it can be? What frequency it can achieve?

All the PCB designers I have ever encountered prefer to choose layout PCB manually, because they say the auto-layout don’t have good result compare with layout manually. From my point of view, IC layout is more difficult and complicate than PCB layout, but why IC layout can use auto-layout nor PCB?

Precisely speaking, no matter auto-layout or manual-layout, there should be a principle ahead, that is: rule driven. Those designers who claim that auto-layout is not good because most of the rules are still embedded in their mind, and haven’t yet integrate into the design, so the auto-layout won’t achieve their requirement.

Frankly speaking, the rule set up for auto-layout can’t be achieve 100%, so after PCB Layout finish, we still need to modify it manually.

So there is a balance among here, if the time you spend on integrate the rule into software has already longer than the time have been taken for PCB layout manually, it is not necessary to make auto-layout.

So few designers auto-layout high frequency, because almost every line of high frequency PCB has restriction, so if we need to add rule to each network, there surely more time we need to spend than manually layout.

Most commonly Resistor package datasheet of PROTEL SE

Resistor: AXIAL0.3-AXIAL0.7, 0.4-0.7 stands for resistor length, normal version is AXIAL0.4.

PROTEL SE DIODE package datasheet

Ceramic capacitor: RAD0.1-RAD0.3, 0.1-0.3 stands for size of capacitor, normal version is RAD0.1;

Electro: RB.1/.2-RB.4/.8, .1/.2-.4/.8 means the value of capacitor. Normal if below 100uF will use B.1/.2,100uF-470uF choose RB.2/.4, larger than 470uF use RB.3/.6.

Diode: Diode 0.4-Diode 0.7, and 0.4-0.7 means the length of diode, normally use Diode 0.4: RB .1/.2.

Integrated Circuit: DIP8-DIP40, 8-40 means the quantity of pins, 8 pins stand for DIP8.

PROTEL SE SMD resistor

0603 stands for the package size, no relations with concrete value;

But the package size and power do have some relationship as below:

0201 1/20W
0402 1/16W
0603 1/10W
0805 1/8W
1206 1/4W

The relations among capacitor size and package see as below:
0402=1.0×0.5
0603=1.6×0.8
0805=2.0×1.2
1206=3.2×1.6
1210=3.2×2.5
1812=4.5×3.2
2225=5.6×6.5

Refers to the component package we have mentioned before, except those components inside the DEVICE.lib database, components in other databases are all have fixed package format, that is because components in the library has different kinds of format: take the transistor as reference, it is one of the most commonly used components, in the DEVICE.lib database there is only simple difference between NPN and PNP. Actually, if it is 2N3055 of NPN, then it probably TO-3, if it belongs to 2N3054 of NPN, then it probably TO-66 or TO-5, also for CS9013 we have TO-92A, TO-92B, TO-5, TO-46, TO-52.

Another one is capacitor, in the database of DEVICE, it can be simply called as RES1 & RES2, no matter is could be 100Ω or 470KΩ, they could be the same. As for circuit board, it can use has no relation with OHM value, just depends on power value of the resistor to decide if we choose 1/4W or 1/2W, and all of them can use AXIAL0.3 component package. If the power value larger than normal we can choose AXIAL0.4, AXIAL0.5 etc. now we list most commonly used component package as below for your reference:

Resistor and non-polarity double end component: AXIAL0.3-AXIAL1.0

Non-polarity capacitor: RAD0.1-RAD0.4

Polarity capacitor: RB.2/.4-RB.5/1.0

Diode: DIODE0.4 and DIODE0.7

Component package means the cosmetic performance and soldering point location on the circuit board when it is being assembled, it is definitely space concept. So different components can use same package, same components do have possibility to apply different package. Like Resistor, has traditional DIP package, these kinds of components usually have large size, circuit board must be drilled before assemble, after drilling and insert the components, pass through solder tin oven or manual soldering, the cost could be high, updated designs are all applied small size SMD component, this type of package don’t need drill hole, use stainless stencil as silkscreen to pour solder tin onto surface of circuit board and then place SMD component on it for assembly.

Most common component package datasheet:

RES1，RES2，RES3，RES4；feature is axial series;
RAD：cap; feature is RAD-0.1 to RAD-0.4

Electro; feature is RB.2/.4 to RB.5/1.0
Potentiometer：pot1,pot2；feature is VR-1 to VR-5
Diode：feature is diode-0.4 (low power）diode-0.7 (high power）
Triode：common feature is to-18, to-22(high power triode）to-3(high power NPN）
Regulated power supply has 78 and 79 series；78 series include 7805，7812，7820, etc.
79 series has 7905，7912，7920 etc.
Most common package include TO-126h and TO-126v
Rectifier bridge：BRIDGE1,BRIDGE2: package feature D series（D-44，D-37，D-46）

The design of schematic diagram should use SCHEMATIC DIAGRAM design system of PROTEL98 or PROTEL99SE to draw a schematic diagram, it is the foundation of circuit board design project. During this process, designer should take advantage of all kinds of drawing tools and edit functions provided by software, the process is see below:

1. Start-up: open up PROTEL98 schematic diagram editor:

Click “Start” bottom, and choose PROTEL98 inthe “Program”.

2. Install circuit drawing dimension and layout

User can install the dimension, orientation and grid size of drawing and title.

3. Place necessary components on the schematic diagram

User select the necessary components from database and place them onto the right place according to circuit schematic diagram requirement, as well as modification.

4. Layout the components which have been placed

Use line and signal to connect all the components on platform to constitute a complete schematic diagram

5. Modify components after PCB layout

In order to ensure the schematic diagram’s preciseness and aesthetic, components location need to be modify through delete, move and adjust drawing size, feature and orientation.

6. Save file and print output

Save schematic diagram which has been edited and print it out for file.

1>    Analyze circuit diagram and understand the greatest power consumption;

2>    Confirm the highest allowed working temperature of component surface, it depends on the component itself and isolated environment.