0
\$\begingroup\$

I'll preface this by saying I'm a software engineer by trade and have very little EE knowledge.

In the software world, one can take all the bits that make up a file and generate a hash for a file. When the same hash algorithm is used, the hash of a file with identical contents is always the same.

I've always wondered whether or not something like this would be possible for physical circuit boards (not design files).

It seems to me that some combination of electrical/physical measurements ought to generate a unique identifier.

  • This identifier could be used to make sure the board wasn't tampered with.
  • One could independently verify the components of the board by reconstructing it and making sure the "hashes" match.

Is there any fundamental reason why something like this isn't possible? Is there any work being done in this area?

\$\endgroup\$
12
  • 2
    \$\begingroup\$ Are you talking about physical boards or design files? Can you edit your question to make it more clear? \$\endgroup\$ – mkeith Aug 26 '20 at 3:47
  • 7
    \$\begingroup\$ For the same reason you can't hash a physical object. Too many degrees of freedom. Also, take the same measurement twice. Do you expect to get the same number twice? Let alone between two different copies of a boards with two different measuring instruments? Real objects have tolerances. Not to mention you can't get at inner layers to make measurements. Even if you could, how would you practically achieve this? Sticking the PCB on a coordinate measurement machine? What if there are curved traces? And if in file form, what's wrong with just hash checking the Gerber file? \$\endgroup\$ – DKNguyen Aug 26 '20 at 3:48
  • 3
    \$\begingroup\$ No I don't think you could possibly test all the possibilities of a non-trivial circuit with digital chips in it that are "black boxes". Imagine a back door that is only triggered by a very long special sequence, thousands of bits or more. It's worse than cracking a cipher because a faster computer won't help, you have to wait for a response from the system. \$\endgroup\$ – Spehro Pefhany Aug 26 '20 at 5:22
  • 2
    \$\begingroup\$ At the start of my career, 1977, I worked with a digital test machine made by Fluke, called the Trendar. As logic boards were getting to the dizzying complexities of 100 MSI chips, and functional test was becoming difficult, they simply threw a bunch of pseudo-random waveforms at a known good board, and compared the outputs with boards under test. Worked reasonably well for small boards, but wouldn't scale to larger ones, just too much buried logic remained unexercised. Hash the design files, yes, absolutely. Hash the behaviour of the board, problematic in the extreme. \$\endgroup\$ – Neil_UK Aug 26 '20 at 5:24
  • 2
    \$\begingroup\$ @DAS However, 100% Tested means they are tested to make sure they do everything they are supposed to do, not that they won't do something they're not supposed to do in response to something they are not supposed to respond to (like a backdoor). That would literally impossible. It'd be easier to dissect the circuit and do it analytically, which is not impossible but next to impossible. \$\endgroup\$ – DKNguyen Aug 26 '20 at 5:40
2
\$\begingroup\$

It is not possible to do a unique hash like you suggest, however there are test methods to verify a PCB functions as it is supposed to be, this is to ensure components are all there and aren't swapped around during manufacture. Normally used to factory test a board.

It is possible to get signatures from a digital board, we used to do that in the 80's mainly for primitive computers back then, you would pull the CPU , plug it into a "NOP" fixture, and the CPU would cycle through all 65536 addresses, then you would take a probe, and it would show a different 4digit number when you poked in different places , if the signature was wrong you were close to the fault. This wasn't as useful as originally thought and has fallen out of favour.

What we do now is use JTAG , and you would generally plug the board into some sort of fixture. JTAG allows you to chain many digital IC's together with only 4wires, and you can program any device, verify it , or read and write to any physical pin. See https://en.wikipedia.org/wiki/JTAG , but there is no "Unique hash" , but there will be a unique signature for each test file that is run, about as close as we can get.

\$\endgroup\$
1
  • 1
    \$\begingroup\$ The main terms for that JTAG based solution is the scan-chain which all chip internals which support JTAG test access as well, as stated the chains of several chips can be chained too. Also you can use boundary scan to examinate the circuits connected to the chips do some extend. this indeed enables you to test huge portions of modern electronics with just a bunch of pins and some stimulus signals. So here teradyne.com/inline-ict-solutions you can find a incircuit test machine... things like that are used in any decent production line. \$\endgroup\$ – schnedan Aug 26 '20 at 14:27
1
\$\begingroup\$

Many processors do provide unique serial number identifiers, including 128 or 256 bit encryption of the firmware based on the serial number. But this is mainly for the purpose of securing the firmware. If you tried to run firmware that was encrypted with another serial number it would fail to boot etc. However to do this for every component is going to be difficult, costly and practically impossible for the actual physical PCB. You could embed and RF ID chip in the PCB and verify it's a particular PCB, but more difficult to ascertain if somebody, say, had cut a signal line, or had added a short-circuit on a pin, somewhere on a chip externally ... So in brief, you can secure the core components and uniquely identify them (mostly), such as microprocessors that support unique identifiers and encryption/decryption of application code, but generally to extend this to all other components on a PCB will not be possible unless the component manufacturer provides the means for digitally identifying a component on a PCB (via some UI system), and allowing for probing for a UI via a simple bus system, so that eventually all components on a board could be accounted for by each of their UIs ... Doing this for every resistor, capacitor, transistor, diode etc would be possible, but beyond the scope of most consumer or even industrial / medical electronics...

\$\endgroup\$
1
\$\begingroup\$

A standard method to check both populated PCAs and unpopulated PCBs is to use a flying probe machine.

This is a sort of robot that has two or more spring loaded, pointed probes that can be moved independently in multiple axis under software control.

This generates a matrix of complex impedances vs frequency (some machines can also measure voltages and apply currents) between node to N x node connections.

The input to this is a map of test point/pad locations and expected result from a 'golden' (i.e. known good) sample.

If you do this for an unpopulated board you get a form of hash as any changes in the internal tracing or external pad locations would cause a different impedance map, i.e. a different hash.

Such a test would necesserily not be very good at picking up subtle changes, e.g. different materials, silkscreen changes, material batch and process variations. Such a hash would be considered functional, grey or fuzzy.

For a populated board this is more complicated.

The board can be powered or unpowered but any impedance map or voltage map will very much depend on the type of circuit and any parasitics will complicate the answer.

Some machines can even perform signal analysis and JTAG but even that may not be enough.

I have used this to some success in the past to do end of line testing on assembled PCAs but any failures (or any passes for that matter) have to be taken with a pinch of salt.

For that reason I'd not really consider it a true 'hash'.

\$\endgroup\$
3
  • \$\begingroup\$ flying probe is a solution for smaller production quantities... it's a bit slow and such not cheap enought \$\endgroup\$ – schnedan Aug 26 '20 at 14:29
  • \$\begingroup\$ If you want the same function but faster, use a bed of nails and a multi-channel impedance analyser. Less flexible as you can only use it for one design. \$\endgroup\$ – Jason M Aug 26 '20 at 14:33
  • 1
    \$\begingroup\$ If you want to prove a board is genuine (rather than it works) you could embed an ID chip into the layer build up. It would be costly unless you volumes are very high as the die needs to be thinned before assembly. See "Chip in Polymer" \$\endgroup\$ – Jason M Aug 26 '20 at 14:54
1
\$\begingroup\$

I'm going to go out on a limb and say that this is not feasible.

  1. Circuit boards can have many layers, sometimes a dozen or more. Some of those layers will be solid metal ground planes. Even with an X-ray camera, I don't think you could get a good image of the inner layers. So physical measurement of all the traces on a finished board is out.

  2. Integrated circuits have the same problem, but more so. It is not possible to fully map out a complex IC without destroying it in the process.

  3. Even if we ignore #2, IC manufacturers do not want customers to rely on an exact hardware revision of a product. Products are sold to meet datasheet specs. Manufacturers are (and should be) free to implement minor quality and yield improvements without forcing customers to know which silicon revision(s) they're getting in their next order.

  4. For similar reasons, manufacturers of assembled products usually do not want to publish a bill of materials. Without one, it is often difficult or impossible to even identify every IC on a board, which would rule out any hashing scheme.

  5. By the same logic as #3, even electrical "hashing" of a bare circuit board could be problematic. The exact resistances, inductances, and capacitances of the traces may vary from board to board. Doing a full DC test probably wouldn't be too hard (although there are N^2 possible hole combinations to consider if you want to look for extra traces). AC testing seems much harder.

So if you want to test design integrity (as opposed to datasheet functionality), I think you're out of luck. You could probably make something like a hash for individual layers of a circuit board, but I can't think of a viable way to test for deliberate alterations performed at the factory.

\$\endgroup\$
4
  • \$\begingroup\$ Re your point 5 , "flying probe testing" pcbcart.com/article/content/… is quite common for bare PCB manufacture, It doesn't add a real lot to the cost, I get it on all my PCB's manufactured in China. Flying probe can also be done on assembled PCB's. And several PCB assemblers offer video inspection, that reads part numbers, and checks for correct orientation and also tombstones and head in pillar defects. re: point 1, Xray testing is regular used on computer PCB's to ensure all the solder balls are attached. \$\endgroup\$ – BobT Aug 28 '20 at 1:53
  • \$\begingroup\$ Your point 3 is a very good one , every time you do a new PCB run you will probably tweak a few things. I've got small projects, and upto serial number 2000 on one of them, with 17 revisions of the PCB , and more than 26 revisions of the BoM, (we've gone around the alphabet once), so there are 26 variants with different "hash tags" that all fit on the same 6 screw holes, take the same connectors, and control 3 motors. The firmware also has a similar number of revisions, all making subtle improvements to solar charging profiles and boost functions. \$\endgroup\$ – BobT Aug 28 '20 at 2:01
  • \$\begingroup\$ @BobT The testing you're describing is fine for quality control, but I'm not sure it would detect someone deliberately tampering with the design. Adding AC coupling between two lines or putting a high-impedance tap on an existing signal could easily pass open/short testing, and a substitute IC could be completely undetectable under normal circumstances. \$\endgroup\$ – Adam Haun Aug 28 '20 at 2:51
  • \$\begingroup\$ I agree with you, it depends what one expect the "hash" to be used for, Simple counterfeits and forgeries can usually be discerned by eye , if you have a good board to compare to, Counterfeit components are always a big concern, once I ordered some assorted wire on reels from Mouser, and one was completely wrong, just a simple re-reeling mistake I imagine, anyway I flagged it as a "possible counterfeit" and wow did that get a big response!, \$\endgroup\$ – BobT Aug 28 '20 at 3:03
0
\$\begingroup\$

I like the idea of a QR code or something similar that carries an image of the board and you could potentially use image recognition software or AR to overlay the board and validate the traces and components for a % match. It'd have to be relatively low definition to be compatible with most PCB manufacturers silk screening tech.

There's an Aussie startup called Laava that create unique, serial number like images that allow a user to validate that a product is real and not counterfit. Perhaps something like that would make sense? https://www.laava.id

\$\endgroup\$
1
  • 1
    \$\begingroup\$ PCB assemblers regularly use video methods to check component values and solder joints, However you raise an interesting point, about counterfeit detection, one could use a steganography approach with how you put the tracks down, put subtle kinks and changes in width, and subtle variations in the silkscreen around components, And subtle font variations in the text, anybody copying it would ignore all those subtle cues. \$\endgroup\$ – BobT Aug 28 '20 at 2:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.