Reverse Engineering 101 – I’ve got the power: Finding Power Nodes

 In the previous article different techniques were discussed on how to find “signal return path” or ground nodes on an unfamiliar board without any schematics. In this article the goal is to show techniques for finding power planes, traces and nodes.
- Locate the main power input, any board shall be powered using one of the following sources:

• AC/DC wall adapter.
• Direct 110V/60Hz or 220V/50Hz AC mains.
• Stepped-down AC input.
• Battery-powered, with or without charging circuitry.

In the case of a wall adapter, then the output voltage is probably noted on it.
- Locate the power supply circuitry: power supplied from the adapter or AC mains will go into a power supply circuitry for rectification, filtering, stepping-up or -down, and distribution, identifying the main components of this circuit will depend on the type of input power:

- For DC input power via an AC/DC wall adapter, the power can be directly supplying function circuitry without a power supply/management circuitry. In this case it is easy to measure the voltage using a DMM.

In the case of a sophisticated system such as a computer motherboard, multiple DC voltages are required to power different circuits on the board such as 3.3V, 5V, 12V, -5V, now you must track the input power going to the power management section of the board, it is important to identify what type of power management is used, such as:

• Linear Voltage Regulator.
• Low Dropout Regulator.
• DC-DC converter (Buck, Boost, Buck-Boost type).
• Zener diode-based voltage regulation.

Identify the input and output(s) of the power management circuit from the datasheets of the components used, make sure to measure and document the voltage at the output pins.
After powering off the system, you can use the continuity tester to trace the power distribution to other parts of the board.  
o    For direct 110V/60Hz or 220V/50Hz AC mains or stepped-down AC input, the power must be rectified and filtered off ripples, so, look for a step-down transformer, a full-wave bridge rectifier, or a simple two-diode full-wave rectifier in case of center-tapped step-down transformer is used. Sometimes a single-diode half-wave rectifier is used instead in inexpensive products, though not very common.
Once you have identified the rectified output location on the board, use the DMM or continuity tester (in a similar fashion mentioned in the previous point) to trace the power distribution to different components.
o    For battery-powered systems, identify whether the batteries used are disposable or rechargeable type.

• For disposable batteries, it is easy to identify the output voltage and track power input traces for disposable batteries as voltage is noted on commercially available batteries.
• For rechargeable batteries, identify whether the battery charging circuitry is part of the power management system or not. Once identified, trace the battery wiring to the board, again, use the continuity tester or DMM to trace power distribution to different components.

-    Locate special function integrated circuits and check their datasheets for power input pins, usually it is called VDD, VCC, AVDD, Vs, Vin, or a similar acronym. Measure the voltage at these pins and compare it to measured voltage from the power supply circuitry.

Reverse Engineering 101 - All roads lead to Rome: Finding the return path

 When examining any electrical system, even a simple two wire chord, it is essential to identify the return path of the electric current, which is the circuit ground in case of DC or neutral in case of AC. To do so with circuit boards without a schematic or a system seen for the first time there are few tips the reader can follow such as:

• Look for standard connectors such as USB, RS-232/485, barrel jack connector, DC power input connector such as terminal blocks...etc., all these connectors have a “ground” pin noted in the connector’s standard that can be identified easily, and usually it is connected to the circuit board common ground plane/traces.

• Look for power management components such as voltage regulators, LDOs, DC-DC converters and their controllers, battery BMS, full-wave rectifiers, decoupling capacitors, from the datasheet you can identify the ground pin and using the DMM’s continuity tester you can trace it to the circuit board’s ground.
• From the IC datasheet try to identify the ground pin in any of the integrated circuits on the circuit board, ICs such as processors, logic circuits, timing, silicon oscillators have a ground pin connect to the board’s ground.
• Look for LED indicators, as they can be directly connected to ground but that varies between different designs (especially when current-sink LED driver is used, the LED isn’t connected directly to ground).
• Avoid discrete components to some extent as some of them might not have a direct connection to the signal return path such as inductors and power MOSFETs in some DC-DC converter designs.
• Tracing ground through analog components that operates from a dual power supply (+/- power supply) must be done carefully to avoid confusing the board’s ground with the negative power supply.

In the picture below of D-Link DIR-615 WIFI router main board, you can easily trace the ground plane through the barrel power connector, the copper pour on the board's top layer, or the ground pin of any of the integrated circuits show, and maybe through the indicator LEDs depending on the their connection to corresponding GPIO pins as current-source or current sink.

 

USB 2.0 (top left), USB-C (top right), and RS-232 (bottom left) Connector’s Pinout

 (All figures from Wikipedia)

D-Link DIR-615 WIFI Router main board