Lab 6 Report: Black Boxes

Abstract

The purpose of this laboratory experiment was to reverse-engineer the schematics of an unknown circuit contained within an enclosure. Various circuit analysis techniques were used to determine the configuration of the circuit elements contained inside. Following the analysis, the proposed circuit was entered into a simulation program, and the results were verified. It was determined that Box 3 contained an RC circuit, and Box 4 an RRL circuit.

Introduction

The process of reverse engineering a electronic device is firmly rooted in the personal computer revolution of the 1980s. Compaq Computer Corporation's cloning of the original IBM PC BIOS is probably the most famous example. By treating the IBM PC BIOS as a black box, Compaq engineers applied test inputs and measured the outputs of the IBM chip, and made guesses at what was inside the chip until they had themselves built a equivalent that performed identically, all the while without breaking copyright laws. This development was hugely profitable for Compaq, and resulted in the existence of a variety of PC-compatible systems. The same engineering process was applied to the mystery circuit boxes in this laboratory experiment.

Each mystery box had two inputs and outputs, and had the general configuration as indicated below:

The impedances Z1 and Z2 were unknown, and could consist of one or more resistors, capacitors, and inductors. (Boxes 3 and 4 were known not to contain OP-Amps). By measuring plain resistance, inductance, and capacitance between the various inputs and outputs with a multimeter, and then performing some transient analysis, the mystery circuits for boxes 3 and 4 were discovered.

Theory

No theoretical ideas nor equations were necessary for this lab other than the formulas for tau:

L

For an RC circuit, =R⋅C For a RL circuit, =

R

Procedure

For each mystery box, the DC resistance between terminals 1-3, 2-3, 2-4, 3-4, and 1-4 were measured with a standard multimeter and recorded. The same procedure was repeated with capacitance measurements, and also for inductance. For the transient analysis, a 1.0 kHz square wave was applied to the input terminals 1-2, and the resulting output waveform was recorded. Noting that both output signals exponentially decayed with respect to the input, it was assumed that both circuits contained either inductors or capacitors, and thus the appropriate time constants were measured.

Results

(Note: the terminal numbers are different for boxes 3 and 4) Black Box #3 Configuration:

Note that a negative inductance suggests the existence of a capacitor between terminals 2 and 4. Refer to the attached waveform printout for the transient analysis results. The time constant determined from the output waveform is given here:

63% of 1.319 V peak-to-peak = 0.83 V. Vmin = -0.637 Therefore, the time constant occurs at 0.193 volts.  = RC = 136.0 sec

Black Box #4 Configuration:

Terminals	Resistance	Capacitance	Inductance
1, 2	2.28 k 	12.9 nF	-0.69 H
3, 4	1.97 k 	0 nF	 0 H
2, 4	0.314 k 	0.24 F	�  H
1, 4	 k 	0 nF	 0 H
2, 3	2.28 k 	12.9 nF	- 0.07 H

The time constant for this circuit (calculated in the same way as box 3) is:  = 116.0 sec

Discussion

Looking at the data acquired for box 3, it was determined that the mystery circuit was as follows:

Observing that negative inductances were measured between terminals 3-4, 1-4, and 2-3, it became clear that there could not be an inductor in the Z2 position in the circuit. Since a capacitance of 49.6 nF was measured between both terminals 2-3 and 34, it was assumed that Z2 was simply a capacitor of 49.6 nF. Since all the DC resistance measurements were 0 except between terminals 1-3 and 1-4, it was clear that Z1 was a resistor. The measurement between terminals 1-3 was taken to be the resistance, to bypass the capacitor between terminals 3-4. As a result, it was determined that Z1 was a resistor of 2.23 k Ohms. This hypothesis agreed with the results obtained from the transient analysis. Looking at the output waveform, we determined that there could not possibly be another resistor in series with the capacitor. If there had been, the waveform's rising edge voltage at t=0 (the point at which the square wave goes high) would not have been 0 but rather some other value because the two resistors would have acted as a voltage divider. Since the voltage at t=0 for the output was 0 like the square wave input, there could be no second resistor in series with the capacitor. Measuring the time constant confirmed the hypothesized values for the resistor and capacitor:

 130  S

C == ≈50 x 10⁻⁹ =50 nF

R 2.23 k

Entering the hypothesized circuit into Multisim and applying a simulated square wave with the same properties resulted in the same output signal, thus confirming the analysis of the black box circuit. (Refer to the attached simulation waveform.)

The reverse engineering of this black box was somewhat more involved than for box 3. The first conclusive observation from the data was that the string of circuit elements from terminals 1-2 was equivalent to 2-3, since the DC resistance, inductance, and capacitance between those two sets of terminals was the same. Next it was assumed that the Z1 inductance was simply the measured 300 ohm resistor. Noting that the transient analysis showed an exponential decay starting at t=0 (where t=0 is the rising edge of the square wave input), it was deduced that a reactive circuit element had to be in the Z2 position. However, a capacitor would result in an exponential growth on the waveform, and would start at 0 volts at t=0 since the voltage across a capacitor cannot change instantaneously. Therefore, the reactive component was determined to be an inductor since at t=0 the output voltage was equal to the input. Had there been only an inductor in parallel with the output terminals, the voltage across the output would have decreased all the way to 0 volts by the end of the square wave period because the inductor would become a short circuit. However, the voltage decayed to some non-zero constant, suggesting that a voltage divider was acting to keep the output voltage above 0 volts. Assuming that there was a resistor in series with the inductor, the DC resistance data from teriminals 2-3 and 1-3 indicated that there indeed was a 2 k Ohm resistor as part of the Z2 impedance. It was impossible to measure the inductance of the inductor directly, since the circuit's configuration did not give access to two terminals of the inductor itself. In order determine the inductance, the time constant was used:

LL

= =116  sec= L=0.266 H

R 2.3 k

Simulating the proposed circuit with Multisim resulted in the same output waveform, thus confirming our hypothesis.

Conclusion

That the simulation results concurred with the proposed circuits for the two black boxes confirme that the hypotheses were indeed correct. As a result, the black boxes were successfully reverse-engineered without disassembly, and an equivalent circuit was now be constructed without having broken any copyrights that may or may not have been in place on the boxes. In summary, the reverse engineered circuits are: