Telecom PCB reverse engineering is priced by layer count, board area, component count and how much RF or high-speed content sits on the board — not by a flat rate per board. A two-layer subscriber line interface or a simple power/alarm card is a few days and a modest fee. A twelve-layer line card with BGA switch fabric, controlled-impedance differential pairs and 800+ components runs weeks and costs an order of magnitude more. Send photos and we quote in a day or two.
Why telecom boards cost more than the layer count suggests
On a generic industrial control board, layer count is a decent proxy for effort. On telecom hardware it isn’t, and that catches purchasing managers off guard when they compare quotes.
The reason is that a telecom board carries geometry that has to be preserved, not just connectivity. A T1/E1 line interface, a SerDes link running to an SFP cage, a DSL front end, an RF chain on a base station board — these have length-matched differential pairs, deliberate reference plane assignments, and impedance targets that were tuned during the original design. Recovering the netlist is only half the job. Recovering the stackup, the dielectric thicknesses and the trace geometry that produced 100-ohm differential is the other half, and it takes measurement, not tracing.
So two boards with identical layer counts can differ by a factor of two or three in effort. A 6-layer power distribution card with fat copper pours is straightforward. A 6-layer VoIP gateway board with an SoC, DDR memory, magnetics and two Ethernet PHYs is not.
What actually drives the number on the quote
- Layer count and stackup complexity. Every inner layer has to be imaged separately after controlled delamination, then registered back to the drill pattern. Blind and buried vias, common on dense line cards, add a whole registration problem because via depth has to be mapped, not just via position.
- Board area. A 350 mm backplane costs more than a 100 mm daughtercard at the same layer count, simply because there is more copper to trace and more nets to verify.
- Component count and package mix. Fine-pitch BGAs need X-ray to resolve inner ball rows. A board with three BGAs and a couple of QFNs prices differently from one with 40 discretes and a QFP.
- Controlled impedance and RF sections. If the board has stripline, microstrip with defined reference planes, or coplanar waveguide feeding a connector, we measure dielectric thickness and copper weight per layer and document target impedances rather than guessing.
- Deliverable set. Gerbers and drill files alone is the cheapest tier. Gerbers plus BOM is more. Full schematic recovery with hierarchical sheets and net names is the most, because it requires an engineer to understand the circuit, not just transcribe it.
- Unmarked or laser-etched parts. Telecom vendors frequently sand or re-mark house-numbered ICs. Identification then becomes detective work: pinout behavior, package, decoupling pattern, position in the signal chain.
- Whether firmware is involved. A management controller or line-card supervisor whose hex file is gone is a separate scope of work with its own feasibility question.
How long a telecom board actually takes
Lead time on telecom PCB reverse engineering follows the same drivers as cost, but not proportionally. Layer separation and imaging is largely parallel work. Schematic interpretation is not — one engineer has to hold the whole circuit in their head, and that is the step that stretches.
| Board type | Typical scope | Relative lead time |
|---|---|---|
| 2-layer alarm, power or ring generator card | Gerber + BOM, simple schematic | Shortest — a few working days |
| 4-layer VoIP / ATA / modem board | Gerber + BOM + schematic, one or two ICs to identify | Roughly double the 2-layer case |
| 6–8 layer switch or PHY card | Impedance-documented stackup, BGA X-ray, full schematic | One to two weeks range |
| 10–16 layer line card or fabric board | Blind/buried via mapping, multiple BGAs, DDR routing | Meaningfully longer — plan in weeks |
| Large backplane / midplane | High net count, connector footprint accuracy critical | Driven by area more than layers |
Two things compress the schedule more than anything else. First, sending two identical boards instead of one — one gets sacrificed for layer separation while the other stays intact as a reference and, later, as the golden unit for comparison. Second, telling us up front which deliverables you actually need. Half the delay on rush jobs comes from scope changing at day five.
If you have a hard date, say so when you ask for the quote. Some telecom projects can be accelerated by running imaging and component identification in parallel with more people; some can’t, because the bottleneck is a single engineer reading a DDR bus. We’ll tell you which one yours is. Our general notes on rapid PCB reverse engineering turnaround cover how the expedite works in practice.
What happens to your board, step by step
Nothing here is exotic, but the order matters and the verification is where the value sits.
- Intake and documentation. High-resolution scans of both sides at known scale, board dimensions measured with calipers, every component reference and marking logged. Connector types and pin counts recorded before anything is removed — on telecom boards the connector footprint is often the hardest thing to recreate from memory.
- X-ray. Via structures, buried via depth, and BGA ball rows that are invisible from outside. This is also where we confirm whether the stackup uses sequential lamination.
- Component removal and identification. Parts come off in mapped order. Passives get measured, actives get identified by marking, package and circuit position. Magnetics — line transformers, common-mode chokes, isolation transformers — get turns-ratio and inductance measurements, because the marking rarely tells you enough.
- Layer separation and imaging. The bare board is delaminated layer by layer and each copper layer imaged and vectorized. Drill data is captured against a common datum so all layers register.
- Stackup and impedance measurement. Cross-section micrometry gives dielectric thicknesses and copper weights. Trace width and spacing on the differential pairs then gives you a defensible impedance target rather than a guess. IPC-2221 and IPC-2222 provide the design-rule framework we document against, and IPC-2152 is the reference for current-carrying trace sizing on the power sections.
- Netlist extraction and cross-check. The vectorized layers are stitched into a netlist. That netlist is then compared against continuity measurements taken on the intact second board. Mismatches get resolved before anything goes into a schematic.
- Schematic capture. Nets get named, sheets get organized by function — line interface, clocking, power, management, RF chain. A telecom schematic that reads as one giant flat page is not a usable deliverable, so we split it the way the original engineer would have.
- Output generation and review. Gerbers, drill files, IPC-2581 or ODB++ if you want it, BOM with manufacturer part numbers, pick-and-place, schematic PDF and native source. Bare boards are checked against IPC-A-600 and IPC-6012 class expectations for the product category.
What we need from you to quote it
A real quote takes about five minutes of your time to set up. Send:
- Clear photos of both sides, whole board in frame, on a dark background, with even lighting and no flash glare. Straight down, not at an angle.
- Board overall dimensions and, if you can measure it, board thickness.
- Markings on the largest ICs — the switch chip, PHY, SoC, or any house-numbered part.
- Layer count if you know it. If you don’t, say so; we’ll estimate from the photos and confirm at intake.
- One line on deliverables: Gerber only, Gerber plus BOM, or full schematic recovery.
- Whether any programmable device is involved and whether you still have the firmware.
What comes back is a feasibility assessment, a lead time, and a price. If something on the board makes us uncertain, we say what it is rather than padding the number. For borderline cases we’ll suggest a paid partial scope first — Gerber and BOM only — so you can see output quality before committing to full schematic work.
Honest limits on telecom hardware
Some telecom boards are harder than others, and a few cases are genuinely marginal.
Conformal coating and potting. Outside-plant and ruggedized cards are often coated. Removal is possible but it consumes time and occasionally damages silkscreen, which means silkscreen has to be reconstructed from position rather than read.
House-numbered ASICs. If a line card hangs on a custom ASIC that only that vendor ever bought, we can recover the board, the netlist and the schematic around it — but we cannot source the part, and we won’t pretend otherwise. Sometimes the honest answer is that a functional replacement means redesigning that block.
Very high layer count with sequential lamination. A 20-layer fabric board with stacked microvias is doable, but the registration work is exacting and the schedule reflects it. This is where having a second sacrificial board stops being a nice-to-have.
Firmware. If the board’s controller has read protection engaged, feasibility depends entirely on the specific part and its protection mechanism — STM32 RDP level, an MSP430 JTAG fuse or BSL password, lock bits on an 8051 derivative. Some are routine; some are not feasible with current techniques. We assess the exact part number before quoting, and we never guarantee a specific device can be read.
RF calibration data. Recovering an RF board’s layout does not recover per-unit calibration constants stored in EEPROM. That’s a separate conversation.
We work under NDA, and you’re responsible for hol
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote