Your Bill of Materials Passes and Your Board Is Still Wrong: Topology vs Parts

Mostafa Dhouib·September 4, 2026·7 min read

Your Bill of Materials Passes and Your Board Is Still Wrong: Topology vs Parts

The short answer. You put two current-limit resistors in series for redundancy, which is correct design. Then a footprint error, an assembly mistake, or a layout that pulled the wrong way places those same two resistors in parallel. Both are the right value. The bill of materials is correct. Every part inspection passes. And your current limit has gone from 2.4 megohms to about 600 kilohms, roughly doubling the current, turning a shortfall of 1.6 times into three and a half. The failure is not in the parts. It is in the topology, and nothing in your incoming checks looks at topology.

There is a category of hardware defect that survives every quality process a normal organisation runs, and it survives them for a structural reason: the processes verify components, and the defect is not in a component.

What the checks actually verify

Walk through what a competent inspection chain confirms.

The bill of materials lists the correct parts. Incoming inspection confirms the parts received match the bill. Automated optical inspection confirms a component of roughly the right size and marking is present at each designator and reasonably placed. Electrical test confirms nets are continuous and not shorted.

Every one of those is a statement about parts and connectivity. None of them is a statement about whether the resulting circuit does what you intended.

Two correct resistors in parallel are two correct resistors. Present, correct value, correctly soldered, electrically connected. There is nothing for a parts-based check to object to.

The specific failure

The design intent is a redundant current limit: two resistors in series, so that a single open-circuit failure cannot remove your limiting. That is good, deliberate safety design, and the reasoning behind it is sound.

Series, those two produce roughly 2.4 megohms of limiting. That number is what makes your injected current safe and what your entire margin calculation assumes.

Place them in parallel and you get about 600 kilohms. A factor of four in the wrong direction, so the current roughly doubles.

Now carry that through a margin that was already thin. If your reference amplifier could sink about 0.5 microamps and the design needed 0.8, you were already 1.6 times over what the part can physically do, with every component at nominal on a good day. Double the current and that becomes roughly three and a half times over.

The device does not work. Nothing in the parts is wrong.

Why it is invisible until bring-up

Three properties make this class particularly dangerous.

It passes on paper. Someone reviewing the bill of materials sees two resistors of the correct value, and the requirement was two resistors of that value. The review is satisfied and it was not careless, it was answering the question it was given.

It passes in the plant. Optical inspection sees two components present in two locations. Whether those locations are wired in series or in parallel is a property of the copper, not of the placement, and the placement is what the camera evaluates.

It sails through electrical test. Continuity and shorts checks confirm nets connect. A parallel arrangement is a perfectly continuous, unshorted net. It is simply the wrong net.

So the defect reaches bring-up wearing a costume that satisfies every gate it passed through, and it detonates when the actuator fires for the first time in the assembled system. Which is exactly the moment when everyone reaches for coupling, shielding, and grounding, and spends a week in the wrong place.

The general shape

The reason this is worth generalising rather than treating as a resistor anecdote: your checks verify the parts, and the failure is in the relationships between them.

That sentence describes a large fraction of the failures I get called into, across layers that have nothing to do with each other.

Every step of an agent chain is correct and the composition produces nonsense. Every component of a system has a valid termination proof and the composition never terminates. Every call is bounded and the system of calls is not. Every engineer's schematic is right and the loop between them kills the device.

Component-level verification cannot detect a relationship-level defect. That is not a shortcoming of any particular process, it is a statement about what the process is looking at, and the fix is always the same in shape: verify the relationship explicitly, because nothing that verifies the parts will do it for you.

How to actually catch it

Four checks, in order of cost.

Verify topology in review, not just values. Review the netlist for the safety-critical paths specifically, asking what is in series with what. A schematic review that confirms the presence of two resistors has not reviewed the circuit. Trace the current path node by node and state the effective impedance out loud.

Design so the error is impossible or obvious. Where you can, use footprints that cannot be populated in the wrong topology, or place the two elements far enough apart that a layout error is visually obvious. Making a mistake impossible beats detecting it, and this costs nothing at design time.

Add one functional measurement that depends on the topology. This is the highest-yield item. A production test that measures the actual limiting impedance, or the actual current under a known stimulus, catches every version of this class, including the ones you did not anticipate. Parts checks verify what you specified; a functional check verifies what you built. One measurement of the real quantity is worth several inspection steps.

Rerun your margin calculation under single-fault and under this specific mis-assembly. You already run it with one limiter open, because that is the failure you designed for. Run it again with the two limiters in parallel. It takes minutes and it tells you whether this defect is survivable or fatal, which determines how hard you work to prevent it. The return-path margin calculator has a fault multiplier for exactly this case.

The question to put in your review

For every safety-critical passive network on the board: what does this measure if it is assembled in the most plausible wrong way, and would any test we run notice?

If the honest answer is that nothing would notice, add the functional measurement. It is one line in a test plan, and it is the difference between finding this on a bench and finding it in the field.

FAQ

Why does my board fail when all the parts are correct? Because inspection verifies parts and connectivity, not topology. Two correct resistors placed in parallel instead of in series are still two correct resistors, present and soldered, so the bill of materials, optical inspection, and continuity tests all pass while the circuit does something different from what you designed.

How much does a series-to-parallel resistor error change things? Two 1.2 megohm resistors in series give 2.4 megohms of limiting; in parallel they give about 600 kilohms, a factor of four, so the current roughly doubles. Applied to a design already 1.6 times over what the amplifier could sink, that becomes about three and a half times over.

Why don't standard quality checks catch topology errors? Because each check answers a parts question. The bill of materials review confirms the right components were specified, optical inspection confirms components are present and placed, and electrical test confirms nets are continuous and unshorted. A wrong-but-continuous net satisfies all three.

How do I catch a topology error before production? Review the netlist for safety-critical paths asking what is in series with what, design footprints so the wrong topology is impossible or visually obvious, add one production measurement of the actual limiting impedance or current, and rerun your margin calculation with the mis-assembly as an explicit fault case.

Is this specific to hardware? No, and that is why it is worth generalising. Component-level verification cannot detect a relationship-level defect, which is the same reason every agent step can be correct while the chain produces nonsense, and every call can be bounded while the system of calls is not.