BGA PCB Reverse Engineering — Complete Process Guide
BGA PCB reverse engineering is the process of recovering pad geometry, via-in-pad structures, and inner-layer routing that sit entirely beneath ball grid array packages — areas invisible to standard optical inspection. Our engineers use a combination of 2D/3D X-ray imaging, controlled chemical de-layering, and cross-sectioning to reconstruct Gerber files and netlists with pad-pitch accuracy down to 0.4 mm. Boards with 4–16 layers carrying BGAs in the 0.5–1.27 mm pitch range are the most common projects we handle, with typical turnaround of 8–15 working days depending on layer count and BGA density.
Why BGA Boards Are Harder to Reverse Engineer
On a QFP or SOIC board, every pad and trace is optically accessible once the component is removed. A BGA changes the equation in three ways:
- Hidden pad field. A 400-ball BGA at 0.8 mm pitch occupies roughly 16 × 16 mm, yet all solder connections are underneath the package. Removing the BGA risks lifting pads — especially on thin 0.8 mm substrates or boards using non-filled vias.
- Via-in-pad and dog-bone fanout. High-pin-count BGAs almost always use via-in-pad (filled and capped) or dog-bone escape routing. These vias connect to inner layers that standard surface scanning cannot reach.
- Thermal pad and ground plane ambiguity. Large exposed-pad BGAs (common on FPGA and SoC packages) often tie to internal copper pours through arrays of thermal vias. Distinguishing signal vias from thermal vias requires cross-sectional data, not just top-down imaging.
The result: a 10-layer board with three BGA sites can easily take 2–3× the engineering hours of an equivalently complex board using only peripheral-lead packages.
How We Perform BGA PCB Reverse Engineering
Step 1 — Non-Destructive X-Ray Mapping
Before any component removal, we X-ray each BGA site at 5–10 µm resolution. This captures the pad array, via positions, and first-layer escape routing while the solder balls are still in place. On boards with stacked or package-on-package (PoP) BGAs, we use oblique-angle X-ray or CT scanning to separate the upper and lower die maps. This step alone can identify 60–80 % of the BGA fanout topology.
Step 2 — Component Removal and Pad Inspection
We remove BGAs using controlled hot-air rework (peak 245–260 °C for lead-free) with preheated bottom-side IR to minimize board warpage. After removal, residual solder is cleaned with flux-core wick at 320 °C tip temperature. Pad integrity is inspected under 30× stereo microscopy. If a pad lifts — which happens on roughly 3–5 % of aged or moisture-damaged boards — we document the location and cross-reference against the X-ray data to recover the connection.
Step 3 — Layer-by-Layer Imaging
With BGAs removed, the outer layers are scanned at 1200–2400 DPI optical resolution. Inner layers are exposed through controlled chemical stripping (FeCl₃ or ammonium persulfate, depending on copper weight) or precision mechanical grinding. Each layer is photographed, registered to fiducials, and digitized into CAD. For boards using high-Tg laminate materials, we adjust etch chemistry and dwell times to avoid delamination of the resin system during stripping.
Step 4 — Netlist Extraction and Via Stitching
This is where BGA boards demand the most manual verification. Each via-in-pad must be traced from its surface pad through every inner layer to its termination. On a 12-layer board with a 676-ball BGA (1.0 mm pitch), that means tracking 400+ signal vias across up to 10 routing layers. We use continuity probing on a sacrificial board copy to validate net assignments that are ambiguous in imaging alone.
Step 5 — Gerber Output and Design Rule Verification
Final Gerber/ODB++ files are checked against IPC-2221B spacing rules and the original board’s apparent design rules (trace width, clearance, annular ring). We run a full DRC and deliver a cross-referenced BOM, schematic (if ordered), and a pad-map overlay document specific to each BGA site.
What BGA Pitches and Package Types Can We Handle?
| BGA Pitch | Typical Ball Count | Fanout Style | Layer Requirement | Difficulty |
|---|---|---|---|---|
| 1.27 mm | 100–256 | Dog-bone, single-layer escape | 4–6 layers | Standard |
| 1.0 mm | 256–676 | Dog-bone + via-in-pad hybrid | 6–10 layers | Moderate |
| 0.8 mm | 300–900 | Via-in-pad (filled/capped) | 8–12 layers | High |
| 0.65 mm | 400–1156 | Via-in-pad, stacked microvias | 10–16 layers | High |
| 0.5 mm | 200–784 | Via-in-pad, HDI any-layer | 8–14 layers (HDI) | Very High |
| 0.4 mm | 100–500 | Microvia-only, coreless substrate | 10–16+ layers | Very High |
Package-on-package (PoP) assemblies — common in mobile AP boards — add another dimension. We treat the top and bottom packages as separate extraction tasks, then merge the netlists. Boards using rigid-flex construction with BGA sites on the rigid sections require special handling at the flex transition zones.
Cost and Lead Time for BGA Reverse Engineering
Pricing depends on three variables: layer count, number of BGA sites, and minimum pitch. Below are representative starting ranges — final quotes require board inspection.
| Board Profile | Estimated Cost (USD) | Lead Time (Working Days) |
|---|---|---|
| 4–6 layer, 1–2 BGAs ≥ 1.0 mm pitch | $600 – $1,200 | 7 – 10 |
| 8–10 layer, 2–4 BGAs, 0.8 mm pitch | $1,200 – $2,500 | 10 – 15 |
| 12–16 layer HDI, 3+ BGAs ≤ 0.5 mm pitch | $2,500 – $5,000+ | 15 – 25 |
| PoP / stacked-die BGA add-on | +$400 – $800 per site | +3 – 5 |
If your project is time-critical, our expedited reverse engineering service can compress lead times by 30–40 % with prioritized X-ray and imaging slots.
Common Failure Modes and How We Mitigate Them
- Pad lift during BGA removal. Risk increases on boards older than 10 years or those stored in humid environments. Mitigation: pre-bake at 125 °C for 4–8 hours before rework; use low-force vacuum nozzle lift-off instead of manual tweezer extraction.
- Solder mask over via-in-pad misread. Filled-and-capped vias can look like solid pads under optical inspection. X-ray cross-reference eliminates this ambiguity.
- Micro-via stack miscount. On HDI boards, stacked microvias connecting layers 1→2→3 are difficult to distinguish from staggered microvias (1→2, offset 2→3). We use microsection cuts on a sacrificial sample board to confirm stack geometry.
- Thermal via vs. signal via confusion. Resolved by resistance measurement: thermal vias connect to continuous copper pours (near-zero resistance to ground), while signal vias show characteristic impedance loading.
Applications: Where BGA PCB Reverse Engineering Is Most Needed
BGA-intensive boards appear across nearly every high-density electronics segment. The most frequent requests we receive involve:
- Legacy telecom and networking equipment — carrier-grade routers and switches with end-of-life FPGA and ASIC BGAs. See our work on test and measurement board recovery for similar complexity profiles.
- Industrial motor drives and power converters — DSP and gate-driver BGAs on motor control PCBs where the OEM no longer supports the hardware.
- Medical imaging and defense electronics — boards with 14+ layers, multiple 0.65 mm pitch FPGAs, and strict documentation requirements.
- LED and power electronics — driver ICs in WLCSP or small-pitch BGA on metal-core or LED driver substrates where thermal pad mapping is critical.
What You Receive
- Complete Gerber RS-274X or ODB++ file set (all copper layers, solder mask, silkscreen, drill files)
- BGA pad-map overlay document (PDF + DXF) showing pad numbering, via assignments, and escape routing per BGA site
- Bill of Materials with manufacturer part numbers, package descriptions, and BGA ball-count verification
- Schematic (optional, quoted separately) with net names matched to BGA pin functions
- Stackup report: measured layer thicknesses, dielectric constants (if impedance-controlled), copper weights
Can you reverse engineer a board without removing the BGA?
Partially. X-ray imaging captures pad positions and first-escape routing without removal. However, full inner-layer trace recovery still requires de-layering, which means the BGA must come off at least one sample board. If you have only one board, we X-ray first, then remove BGAs with maximum care to preserve pad integrity.
What if my BGA uses via-in-pad with no dog-bone escape?
Via-in-pad designs are standard on 0.8 mm pitch and below. Our process handles filled, capped, and unfilled via-in-pad. The main challenge is confirming via fill material (conductive vs. non-conductive epoxy) and whether the via is a through-hole, blind, or buried microvia. Cross-sectioning resolves all three.
How many sample boards do you need?
We recommend a minimum of two identical boards — one for non-destructive X-ray and electrical probing, one for destructive de-layering and cross-sectioning. With only one board, we can still complete the project, but turnaround increases by 2–3 days because we must sequence non-destructive steps before any destructive work.
Do you support 0.4 mm pitch micro-BGA and WLCSP packages?
Yes. Wafer-level chip-scale packages (WLCSP) at 0.4 mm pitch require our highest-resolution X-ray (5 µm) and are quoted on a per-site basis. Expect a cost premium of roughly 40–60 % over 0.8 mm pitch BGA work due to the tighter imaging and digitization tolerances involved.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote