28-Layer PCB Reverse Engineering: What Makes It Different
28 layer pcb reverse engineering requires micro-section analysis of a stackup that typically exceeds 3.5 mm total thickness, contains multiple buried and stacked via structures, and routes high-speed differential pairs on inner layers with ±7% impedance tolerance. Our engineers treat every 28-layer project as a controlled-impedance, high-density interconnect (HDI) recovery—because at this layer count, the margin for error on any single plane can cascade through the entire netlist.
Why 28 Layers? Typical Applications
Boards at this layer count appear most often in telecom backplanes, high-performance computing (HPC) switch cards, medical imaging processor boards, and military radar subsystems. The design usually dedicates 8–10 layers to ground and power planes, leaving 18–20 layers for signal routing—often split between stripline pairs for differential signaling at 10 Gbps or above.
When the OEM has discontinued a product or the original Gerber data is lost, 28-layer reverse engineering is the only path to reproduce or redesign the board. Compared to our standard PCB reverse engineering services, a 28-layer job adds roughly 60–80% more engineering hours due to the additional imaging passes, cross-section samples, and impedance verification steps.
How We Reverse Engineer a 28-Layer PCB: Step by Step
1. Incoming Inspection and X-Ray Mapping
Before any delamination, we X-ray the board at 5 µm resolution to map all via types—through-hole, blind (layers 1–4 or 25–28), buried (e.g., layers 8–14), and stacked microvias. This X-ray map becomes the master reference for via assignment during CAD reconstruction.
2. Layer-by-Layer Imaging
We delaminate and photograph each copper layer at 1200 DPI minimum. For 28 layers, this means 28 individual high-resolution scans plus alignment registration between every adjacent pair. Registration accuracy must stay within ±0.5 mil (0.0127 mm) or the via-to-pad connections on inner layers will misalign in the output Gerber.
3. Stackup and Dielectric Recovery
A polished cross-section at three board locations lets us measure each prepreg and core thickness to ±0.2 mil. Typical 28-layer stackups use a combination of 1080, 2116, and 7628 prepreg styles with core thicknesses ranging from 2 mil to 8 mil. We record dielectric constant (Dk) assumptions—usually 4.2–4.5 for standard FR-4, or 3.3–3.6 if the board uses Megtron 6 or similar low-loss laminates.
4. Netlist Extraction and Impedance Modeling
Every trace on every layer is vectorized and assigned to a net. On a 28-layer board, net counts commonly reach 8,000–15,000. We then model single-ended (50 Ω typical) and differential (100 Ω typical) impedance targets against the recovered stackup, adjusting trace width/spacing until simulation matches measured TDR values within ±5%.
5. BOM and Schematic Generation
Component identification follows—cross-referencing part markings, package dimensions, and pin-out verification. The schematic is back-annotated from the netlist, grouped by functional block (power, digital, analog, RF if present). This is particularly relevant for boards used in test and measurement equipment where mixed-signal integrity matters.
28-Layer Stackup: What We Typically Recover
| Layer | Function | Typical Trace/Space | Copper Weight |
|---|---|---|---|
| L1 (Top) | Signal / Component | 3.5/3.5 mil | 1 oz |
| L2 | Ground Plane | Flood fill | 1 oz |
| L3–L4 | Signal (Stripline) | 3.5/4.0 mil | 0.5 oz |
| L5 | Power Plane (3.3 V) | Split plane | 1 oz |
| L6–L12 | Signal / Ground pairs | 4.0/4.0 mil | 0.5 oz |
| L13–L14 | Power Planes (1.8 V, 1.2 V) | Split/flood | 1 oz |
| L15–L23 | Signal / Ground pairs | 4.0/4.0 mil | 0.5 oz |
| L24 | Power Plane (5 V / 12 V) | Split plane | 1 oz |
| L25–L26 | Signal (Stripline) | 3.5/4.0 mil | 0.5 oz |
| L27 | Ground Plane | Flood fill | 1 oz |
| L28 (Bottom) | Signal / Component | 3.5/3.5 mil | 1 oz |
Actual configurations vary. Some 28-layer designs use asymmetric stackups to route more signals near the top side where BGA escape routing is densest.
Which IPC Class Applies to Your 28-Layer Board?
At 28 layers, most boards fall under IPC Class 2 (dedicated service electronics) or IPC Class 3 (high-reliability). The class determines allowable defects in our output files—annular ring minimums, copper void tolerances, and registration accuracy. Class 3 boards require ≥2 mil annular ring on internal layers versus ≥1 mil for Class 2, and via fill voids must be under 25% by cross-section area.
Use the tool below to determine which IPC class your application requires:
PCB assembly
IPC Class Selector, Class 1, 2 or 3
Answer five questions about how the product is used and see which acceptance class fits, and what it changes in your design and your price.
How this is calculated
IPC-A-610 and IPC-6012 define three classes. Class 1 is general electronics where function at delivery is all that is required. Class 2 is dedicated service electronics, where continued performance matters but uninterrupted service is not critical, and it covers most industrial and consumer products. Class 3 is high reliability, where downtime cannot be tolerated and the equipment must work on demand.
The differences are concrete rather than philosophical. Class 3 requires 25 µm of barrel copper against 20 µm for Class 2, and a genuine 0.05 mm external annular ring where Class 2 permits a 90° breakout. Inspection is tighter, sampling plans are stricter, and more of the board gets looked at.
The common mistake is buying Class 3 as a reassurance. It typically adds 15 to 30 % to fabrication cost, and if your design has not been drawn with Class 3 spacing and pad sizes from the start, declaring it late simply produces yield failures at the fabricator. Choose it because the application requires it, then design to it.
If the selector returns Class 3, expect our engineering team to add an extra verification pass on every via structure and an additional cross-section sample per board quadrant—adding roughly 15–20% to project time but ensuring the recovered data meets high-reliability fabrication specs.
Common Failure Modes in 28-Layer Reverse Engineering
- Delamination damage on inner layers: Thin 2-mil cores between layers 12–16 can crack during separation. We mitigate this by using controlled thermal cycling rather than mechanical peeling.
- Buried via misidentification: A buried via spanning layers 6–10 looks identical in X-ray to one spanning 8–12 if dielectric thicknesses are similar. Cross-section verification at multiple locations resolves ambiguity.
- Impedance mismatch from unknown laminate: If the original laminate is Megtron 6 (Dk ≈ 3.4) but we model as standard FR-4 (Dk ≈ 4.2), trace widths in the output will be wrong by 15–20%. We TDR-test critical nets before finalizing.
- BGA escape routing errors: 0.8 mm pitch BGAs on 28-layer boards use dog-bone fanout through microvias. Missing a single via-in-pad connection can orphan an entire bus.
28-Layer vs. Adjacent Layer Counts
| Parameter | 24-Layer | 28-Layer | 32-Layer |
|---|---|---|---|
| Typical board thickness | 2.8–3.2 mm | 3.4–3.8 mm | 4.0–4.5 mm |
| Via types | Through + blind | Through + blind + buried | Through + blind + buried + stacked |
| Engineering hours (RE) | 120–160 h | 180–240 h | 250–350 h |
| Typical turnaround | 18–22 working days | 22–30 working days | 30–40 working days |
| Cross-sections needed | 4–6 | 6–10 | 10–14 |
| Impedance nets to verify | 50–100 | 80–150 | 120–200+ |
If your board reaches 32-layer territory, stacked microvia structures become almost universal, and the engineering scope increases substantially. Conversely, boards in the 24-layer range often avoid buried vias entirely, simplifying recovery.
Deliverables for a 28-Layer Project
- Gerber RS-274X files — all 28 copper layers, solder mask (top/bottom), silkscreen, paste, drill files (separate for each via span).
- ODB++ or IPC-2581 package — full stackup, netlist, and component placement in a single structured format.
- Schematic (PDF + editable source) — OrCAD, Altium, or KiCad format per client preference.
- Bill of Materials — manufacturer part numbers, alternates where available, and sourcing notes for obsolete components.
- Stackup drawing — layer-by-layer dielectric and copper specification matching the recovered cross-section data.
- Impedance report — modeled vs. measured values for every controlled-impedance net class.
Projects involving embedded controllers or FPGAs may also require firmware or configuration recovery as a separate workstream—especially when the board is part of an IoT or networked device.
Pricing Signals and Timeline
A 28-layer PCB reverse engineering project typically starts at $8,000–$14,000 depending on board area (up to 400 × 500 mm), component density, and IPC class. Boards with flex-rigid sections, RF shielding cans, or press-fit connectors add 10–25% to the base cost. Turnaround ranges from 22 to 30 working days for the full deliverable set. Rush service (15 working days) is available at a 40% premium.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewFrequently Asked Questions
Can you reverse engineer a 28-layer board from a single sample?
Yes, but we strongly recommend providing two samples. One is delaminated for imaging; the second is preserved intact for TDR impedance measurement, X-ray verification, and component reference. If only one sample is available, we perform all non-destructive testing first and document every step before delamination begins.
How do you verify buried via connectivity on inner layers?
We combine X-ray imaging at multiple angles with cross-section polishing at 3–5 locations per board quadrant. Each buried via span is confirmed by measuring the via barrel length in the cross-section and correlating it with the X-ray shadow depth. Ambiguous cases are resolved by continuity probing before the corresponding layers are separated.
What if the original laminate material is unknown?
We measure the dielectric constant using a split-post dielectric resonator on a coupon cut from a non-critical board area. This gives Dk accuracy to ±0.05, which is sufficient to select the correct laminate family (standard FR-4, mid-loss, or low-loss) and model impedance within ±3% of the original design intent.
Is 28-layer reverse engineering feasible for flex-rigid boards?
It is feasible but adds significant complexity. The flex sections typically carry only 2–4 layers, while the rigid sections hold the full 28-layer stackup. We handle each zone separately, recover the flex-to-rigid transition geometry, and deliver unified Gerber output. Expect 30–40% longer turnaround compared to a purely rigid 28-layer board. Flex PCB reverse engineering details cover the flex-specific process.
Do you support re-fabrication from the recovered data?
We deliver fabrication-ready files, but we do not operate a fab house. Our output has been successfully fabricated by major contract manufacturers (including Tier 1 shops in Asia, Europe, and North America) without modification. We can recommend qualified fabs for 28-layer builds if needed.
Related Services
- Motor control board reverse engineering — multi-layer power stage recovery
- LED driver PCB reverse engineering — mixed analog/digital board recovery
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote