Power Supply PCB Reverse Engineering: Cost & Lead Time

A single-output flyback or linear supply on a two-layer board, fully populated and undamaged, is typically a few working days for schematic and Gerber recovery. A four-layer or six-layer switch-mode board with a planar transformer, a digital controller, potted magnetics and a burned primary side takes meaningfully longer and costs more. Price on power supply PCB reverse engineering is driven by layer count, copper weight, magnetics, and whether firmware is in scope — not by board outline area.

What actually drives the price on a power supply board

Power boards break the usual cost model that applies to logic boards. A 200 mm x 150 mm SMPS may carry only 90 components, but half the effort sits in five of them: the main transformer, the common-mode choke, the current-sense arrangement, the optocoupler feedback loop, and the controller IC.

Here’s what moves the quote up or down:

• Layer count and copper weight. Two-layer boards with 2 oz or 3 oz copper are straightforward electrically but slow to image cleanly — thick copper etches with rounded shoulders, and a wide pour that looks like one net often carries a slot or a deliberate thermal break you only see under angled light.
• Magnetics. A catalog part number on the transformer is a cheap day. An unmarked custom bobbin means winding analysis: turns count, wire gauge, interleaving order, tape layers, primary and secondary inductance, leakage inductance. That is destructive work on one sample and adds real hours.
• Control topology. A fixed-frequency current-mode controller with a TL431 reference is quick. A digitally controlled LLC or interleaved PFC stage with a DSP or MCU in the loop means the schematic alone doesn’t tell the story.
• Damage. A board that failed with a shorted MOSFET usually took out the gate drive resistors, the sense resistor and part of the trace. Carbonized FR-4 hides copper. If you can send a second, working sample, the price drops.
• Safety-critical layout data. Creepage and clearance across the isolation barrier, slot placement, and Y-cap positioning have to be captured dimensionally, not approximated. IPC-2221 spacing tables give the framework, but the original designer’s actual gaps are what you need reproduced.
• Deliverable set. Schematic only is one price. Schematic plus BOM plus Gerbers plus drill plus a verified assembled sample is another.

We publish the general framework for how reverse engineering cost is calculated, and it applies here with the magnetics and high-voltage sections weighted more heavily than component count alone would suggest.

Rough effort by board class

How long a four-layer switch-mode board really takes

Lead time is not linear with layer count. Going from two layers to four roughly doubles the imaging work, because the inner planes have to be exposed by controlled removal and scanned separately, then registered back to the outer layers using via and mounting-hole positions as datums. Power boards make this harder than logic boards because inner layers are often mostly copper pour with a few narrow signal escapes buried in them — you have to find the escapes, not just confirm the pour.

The realistic phases, in the order they happen:

1. Intake and photography. Both sides, high resolution, before anything is touched. Silkscreen, ink dots, rework wires, and factory trim marks get recorded because they’re gone after desoldering.
2. In-circuit measurement. Bulk cap values and voltage ratings, snubber RC values, sense resistor value, opto part number, controller marking. Anything that can be read while the board is intact gets read first.
3. Component removal and identification. Semiconductors come off, get measured or curve-traced where the marking is sanded or house-coded. Electrolytics get their date codes and ESR noted, since an obsolete series usually needs a modern equivalent chosen on ripple current and lifetime, not just capacitance.
4. Layer imaging and netlist build. Outer layers scanned, inner layers separated, nets rebuilt and cross-checked against a continuity map taken from the bare board.
5. Schematic drafting. Drawn as a power engineer would read it — primary side, isolation barrier, secondary side, feedback path, housekeeping supply — not as an auto-generated rat’s nest.
6. Magnetics characterization, if the transformer is custom.
7. Verification. Netlist compared point to point against the original board, then a rebuilt sample brought up on a variac with a current-limited primary and loaded across the specified range.

Steps 1 through 5 are where a quoted schedule can slip, and it’s nearly always step 4. If you want the full sequence in more detail, our step-by-step reverse engineering walkthrough covers the imaging and registration side.

What we need from you before quoting

Most quote delays come from missing information, not from difficult boards. Send this and you’ll usually get a feasibility answer, a lead time and a price without a second round of questions:

• Clear photos of both sides, whole board in frame, on a dark matte background, even lighting, no flash glare on the solder mask.
• Board dimensions and your best guess at layer count and copper weight.
• A close, readable shot of the controller IC marking and any MCU or DSP marking, plus the transformer label if it has one.
• Input and output ratings — AC or DC input range, output voltages, rated current per rail.
• One line on which deliverables you need: schematic only, schematic plus BOM, full Gerber and drill set for manufacturing, or a working built sample.
• Whether you have a second sample, and whether the board you’re sending is dead or functional.

What comes back is a feasibility assessment naming any part we expect trouble with, a lead time in working days, and a fixed price for the agreed deliverables. If we think a section can’t be recovered to a level you can build from, we say so before you ship anything.

Where power supply reverse engineering gets difficult

This is the part most service pages skip. Some cases are harder, and a few aren’t worth doing.

Potting and epoxy encapsulation

Sealed LED drivers and industrial auxiliary supplies are often fully potted. Depotting is chemical or thermal, and it damages components — expect to lose some parts and to need at least one sacrificial sample. On a small potted board the depotting can cost more than the tracing.

Custom and unmarked magnetics

Winding analysis destroys the transformer. If you only have one unit and it must keep working, we can measure inductances and turns ratios non-destructively and get you close, but a fully specified winding drawing needs a sample we’re allowed to take apart.

Digital control loops

When the compensation lives in code rather than in an RC network, the schematic gets you a board that powers up and does nothing useful. Recovering the controller image is a separate scope, feasible on some parts and not on others depending on the read protection state — an STM32 at RDP Level 2, for example, is a very different problem from one at Level 1, and older 8-bit parts with simple lock bits sit somewhere else again. We won’t promise a firmware read before seeing the actual chip marking.

Thermally destroyed boards

Where the primary side has burned through the substrate, the copper geometry in that area is gone. We reconstruct it from the surviving pads, the layer stackup and the current the trace has to carry — IPC-2152 gives a defensible basis for trace width — but that section is engineering reconstruction, not measurement, and we label it as such in the deliverables.

Component obsolescence

Recovering the design is often the easy half. Discontinued PWM controllers, specific opto part numbers with defined CTR bins, and long-obsolete electrolytic series all need substitution, and a substitution on the primary side changes loop behavior. Budget time for a bench validation pass rather than assuming a drop-in.

Legitimate use, and who owns what

The power supply work that comes through our lab is overwhelmingly maintenance and continuity: an obsolete PSU inside a machine tool that still has fifteen years of service life, a medical equipment supply whose original vendor closed, a design whose CAD files left with an engineer in 2011, or a failure analysis job where someone needs to know why the third batch of boards keeps blowing the same MOSFET. Component obsolescence drives a large share of it.

You need to hold the rights to the design you send us, or authorization from whoever does, and to comply with applicable IP law in your market. Every project runs under NDA, and the source board and files stay with the project. If you want the longer version of that discussion, we cover the legal position on reverse engineering separately.

FAQ

How much does it cost to reverse engineer a power supply PCB?

It depends on layer count, copper weight, whether the magnetics are custom, and which files you need — so we quote

Related reading

• Oct 2026Megawin IC Unlock | Families We Can Read
• Oct 2026NXP LPC54 Crack | Protection Levels & Recovery
• Oct 2026ELAN IC Unlock | Families We Can Read & Recovery