AI Flow: Reverse Engineering

WEBVTT

00:00:01.958 --> 00:00:06.562
This is a three phase motor controller. A power connector, a bank of

00:00:06.582 --> 00:00:08.193
capacitors, six MOSFETs.

00:00:08.213 --> 00:00:13.284
A gate driver and a microcontroller in the middle, each turned 45 degrees.

00:00:13.304 --> 00:00:16.653
We have no design files in this flow. Just four photos.

00:00:17.216 --> 00:00:20.418
Turn it over, and the copper shows through the solder mask.

00:00:20.438 --> 00:00:25.275
Pours, fine tracks, gaps between them, and more than a thousand tiny domes

00:00:25.295 --> 00:00:27.638
where vias push up through the mask.

00:00:27.658 --> 00:00:30.706
Everything from here on is read from pictures like these.

00:00:31.289 --> 00:00:35.729
The job: find the parts and the blocks. Copy all the copper. Work out what

00:00:35.749 --> 00:00:40.429
can't be seen, propose a layer count, say how sure you are, and list the tests

00:00:40.449 --> 00:00:42.057
that would settle the rest.

00:00:42.077 --> 00:00:46.908
Then a harder bar. Put every piece of copper on a net. Make the layers match

00:00:46.928 --> 00:00:51.887
the photos. And keep going until confidence measures 90%, or say why it can't.

00:00:52.459 --> 00:00:57.078
This is AI Flow: Reverse Engineering. A Rust program does the measuring, and

00:00:57.098 --> 00:01:00.497
an AI supplies the judgment, like what a part is called.

00:01:00.517 --> 00:01:05.453
11 steps, from intake to report. Each one has a check that has to pass, and

00:01:05.473 --> 00:01:06.973
each one gets recorded.

00:01:07.592 --> 00:01:12.025
First, the photos. It finds the board edge in each one and straightens it.

00:01:12.045 --> 00:01:16.486
The bottom gets turned over and pinned to the top through 40 holes that both

00:01:16.506 --> 00:01:17.191
sides share.

00:01:17.211 --> 00:01:22.108
With one hole held out each time, they land within about 0.03 mm.

00:01:22.682 --> 00:01:28.538
Scale comes from the board itself. Header rows have standard pitches, 2 mm and

00:01:28.558 --> 00:01:29.140
2.54 mm.

00:01:29.160 --> 00:01:34.695
The driver chip's 6 mm body confirms which standard they are. That gives 46.6

00:01:34.715 --> 00:01:36.281
pixels per millimeter.

00:01:36.853 --> 00:01:42.912
Next, the parts. 137 of them, and 103 get placed by their own pads.

00:01:42.932 --> 00:01:49.055
Markings get read where they're legible, like this TI DRV8323S.

00:01:49.075 --> 00:01:53.601
Most small ceramics carry no marking at all, so their values just aren't in

00:01:53.621 --> 00:01:56.511
the photos. The flow says so, and doesn't guess.

00:01:57.084 --> 00:02:00.718
Silkscreen and circuit role sort them into 11 blocks.

00:02:00.738 --> 00:02:06.145
Power entry, the power stage, sensing, the logic supply, the gate driver and

00:02:06.165 --> 00:02:11.144
the microcontroller. Then CAN, AUX, the fan, motor temperature and the

00:02:11.164 --> 00:02:12.215
mounting holes.

00:02:12.785 --> 00:02:17.374
Now the hard part. Under solder mask, copper looks a little lighter than bare

00:02:17.394 --> 00:02:20.008
laminate, and thin dark lines mark the gaps.

00:02:20.028 --> 00:02:24.316
The reader follows those gaps, and the board comes apart into islands.

00:02:24.336 --> 00:02:28.208
Here's the published version next to this one. Fine tracks that used to be

00:02:28.228 --> 00:02:29.522
missing now come through.

00:02:29.542 --> 00:02:34.034
That's 828 pours and 2,588 tracks.

00:02:34.610 --> 00:02:39.082
Looking closely found a real defect. The dark side of each dome was being cut

00:02:39.102 --> 00:02:40.190
out of solid pours.

00:02:40.210 --> 00:02:45.056
So the reader learned what a dome's shadow looks like, and now those pours

00:02:45.076 --> 00:02:49.331
read solid. Domes with a hole beside them dropped from 396 to 68.

00:02:49.916 --> 00:02:54.713
Vias get a shading test. A real dome is lit on one side and shadowed on the

00:02:54.733 --> 00:02:57.603
other, in the same direction as all the rest.

00:02:57.623 --> 00:03:02.030
The published filter ringed silkscreen and missed most of the domes. The new

00:03:02.050 --> 00:03:03.020
one sits on them.

00:03:03.040 --> 00:03:08.575
1,329 kept. The top face shows none it can trust, so these all come from the

00:03:08.595 --> 00:03:12.010
bottom. A few are still missed along the edges.

00:03:12.586 --> 00:03:17.282
It doesn't stop at copper. Each pixel gets sorted by material: mask,

00:03:17.302 --> 00:03:20.334
silkscreen, metal, or a part sitting on top.

00:03:20.354 --> 00:03:25.516
Silkscreen, mask openings, exposed metal, holes and the outline all get read

00:03:25.536 --> 00:03:29.471
from the photos, then written into their own KiCad layers.

00:03:30.049 --> 00:03:34.533
All of it goes into a real KiCad project, as photographed, before anything

00:03:34.553 --> 00:03:38.488
gets guessed. Here it is over the top photo, and over the bottom.

00:03:38.508 --> 00:03:44.060
Every stage opens as an interactive board. Pick a net and all of it lights up:

00:03:44.080 --> 00:03:46.346
ground, the input rail, a phase.

00:03:46.926 --> 00:03:51.908
Then a separate check compares what KiCad draws with what the photos show, on

00:03:51.928 --> 00:03:54.052
tiles the reader wasn't tuned on.

00:03:54.072 --> 00:03:58.933
Green agrees. Red is drawn but not seen. Blue is seen but not drawn. Purple is

00:03:58.953 --> 00:04:01.436
hidden under a part, so it isn't scored.

00:04:01.456 --> 00:04:07.147
The bottom scores 0.87. The top, 0.82, on only about half the board, because

00:04:07.167 --> 00:04:08.725
parts cover the rest.

00:04:09.286 --> 00:04:13.776
Next, every piece of copper gets a net, and a record of how it got it. Pieces

00:04:13.796 --> 00:04:17.290
get stitched into conductors wherever no gap separates them.

00:04:17.310 --> 00:04:22.152
Green means a pad touches it. Blue, it's joined through a via. Yellow is

00:04:22.172 --> 00:04:25.325
inferred, orange only by group. Red has no net.

00:04:25.345 --> 00:04:30.748
Three quarters of the copper area now has direct evidence. But 47% of track

00:04:30.768 --> 00:04:33.929
length is still red, so that goal isn't met.

00:04:33.949 --> 00:04:38.335
A schematic comes out too. All 77 nets are still marked inferred.

00:04:38.916 --> 00:04:43.439
Now the connections nobody can see. The flow has its own router, and it uses

00:04:43.459 --> 00:04:44.515
every inner layer.

00:04:44.535 --> 00:04:49.151
Real vias pass through pours, so crossing copper from the photos is expensive,

00:04:49.171 --> 00:04:52.242
not forbidden. And the length crossed gets reported.

00:04:52.262 --> 00:04:57.792
At 6 layers, 45 of 253 connections stay open. The white crosses are where it

00:04:57.812 --> 00:05:00.347
got stuck, mostly at the two chips.

00:05:00.923 --> 00:05:03.850
That difficulty is how the layer count gets proposed.

00:05:03.870 --> 00:05:11.579
2 layers cross 454 mm of seen copper. 4 layers, 384.

00:05:11.599 --> 00:05:16.752
6 layers, just 11. 8, about 8. Past 6, more layers stop helping. So the

00:05:16.772 --> 00:05:17.772
proposal is 6.

00:05:18.342 --> 00:05:22.814
Confidence isn't self graded. Auditors who did none of the work judge random

00:05:22.834 --> 00:05:25.651
crops, and some of the claims are planted false.

00:05:25.671 --> 00:05:30.315
Pass one of those, and the whole sample gets thrown out. That actually

00:05:30.335 --> 00:05:31.980
happened here, on blocks.

00:05:32.000 --> 00:05:37.248
Identity clears 90. Vias, blocks and placement land around 60. Values are at

00:05:37.268 --> 00:05:40.437
34, because most small parts carry no marking.

00:05:40.457 --> 00:05:45.360
Copper scores 9, because through smooth green mask, an auditor mostly can't

00:05:45.380 --> 00:05:50.348
tell copper from bare board. Layers stop at 30 without outside evidence. And

00:05:50.368 --> 00:05:54.681
connectivity is 0, because KiCad finds more missing than expected.

00:05:54.701 --> 00:06:00.047
Overall is the lowest category, so the loop reports stalled, at 0. It did not

00:06:00.067 --> 00:06:04.716
reach 90. From photos alone, it can't: values, layers and nets need

00:06:04.736 --> 00:06:06.876
measurements on the real board.

00:06:07.452 --> 00:06:11.884
Whatever is still unknown gets a test. 119 of them, each saying what to

00:06:11.904 --> 00:06:16.211
measure, what result to expect, and what to change if it's different.

00:06:16.785 --> 00:06:21.462
We did find the real design. It went in a sealed folder as an answer key. The

00:06:21.482 --> 00:06:25.793
flow never reads it, the agents never see it, and only totals come out.

00:06:25.813 --> 00:06:32.884
Real vias went from 42% to over 95%. Vias found, from 26% to 75%.

00:06:32.904 --> 00:06:38.935
Copper match went from 61% to 67% on top, and from 80% to 89% on the bottom.

00:06:38.955 --> 00:06:40.846
And 6 layers is correct.

00:06:40.866 --> 00:06:46.150
Pin nets barely moved. 46% to 48%. That's the weakest result here.

00:06:46.718 --> 00:06:52.629
So this isn't a finished board. 45 connections stay open, and KiCad counts 441

00:06:52.649 --> 00:06:53.238
missing.

00:06:53.258 --> 00:06:58.560
Finer copper also made routing harder. New design rule errors at 6 layers went

00:06:58.580 --> 00:07:03.540
from 6 to 594. And these thresholds came from this one board, so a second

00:07:03.560 --> 00:07:05.109
board has to come next.

00:07:05.681 --> 00:07:09.822
Every stage stays in the flow window, so you can step back through the whole

00:07:09.842 --> 00:07:11.848
run and open any board along the way.

00:07:12.442 --> 00:07:19.318
From the first prompt to this point took about 13 hours of AI time in the main

00:07:19.338 --> 00:07:23.827
thread, with idle gaps cut out, plus 46 sub-agents.

00:07:23.847 --> 00:07:28.739
About 3.4 million output tokens and 634 million cache reads, across 1,811

00:07:28.759 --> 00:07:33.718
model calls. Next up: real measurements on this board, and a second board.