What Is RF PCB Reverse Engineering?
RF PCB reverse engineering is the process of extracting complete manufacturing data—Gerber/ODB++ files, a schematic netlist, and a bill of materials—from an existing radio-frequency printed circuit board. Unlike standard digital boards, RF designs demand that every trace width, gap, via transition, and ground-plane cutout be captured with enough precision to preserve characteristic impedance (typically 50 Ω ± 2 Ω) across operating bands from hundreds of MHz to 40 GHz+. Our engineers use cross-sectioning, 2D X-ray laminography, and network-analyzer verification to ensure the recovered design performs identically to the original.
Why RF Boards Are Harder to Reverse Engineer
A 4-layer FR-4 digital board can tolerate ±2 mil trace-width error with no functional impact. An RF board operating at 5.8 GHz on Rogers RO4350B (εr 3.66 ± 0.05) cannot. A 1-mil deviation in a 12-mil microstrip shifts impedance by roughly 3 Ω—enough to push return loss past −10 dB and degrade a filter passband.
Key RF-Specific Challenges
- Substrate identification: RF boards use Rogers, Taconic, Isola Astra, Arlon, or PTFE-based laminates with dielectric constants from 2.2 to 10.2. Mis-identifying the laminate invalidates every impedance calculation.
- Tight trace/space: Coupled-line filters and Lange couplers may require 3/3 mil trace/space accuracy; grounded coplanar waveguide (GCPW) structures need gap dimensions within ±0.5 mil.
- Via fencing and stitching: Ground-via arrays around transmission lines suppress parallel-plate modes. Missing a single via row can create a resonance notch inside the passband.
- Shielding cans and RF cavities: Soldered-down shields must be removed without damaging underlying components or traces, then their footprints and grounding pads documented.
- Mixed dielectrics: Many RF assemblies combine a Rogers RF core with FR-4 digital layers in a hybrid stackup using mixed dielectrics, requiring per-layer material mapping.
Our RF PCB Reverse Engineering Process
Step 1 — Incoming Inspection & Substrate Analysis
We photograph both sides at 2400 DPI, then perform a cross-section on a sacrificial coupon (or a non-critical board edge) to measure layer count, copper weight, dielectric thickness, and prepreg type. A dielectric-constant spot check using a split-post resonator at 10 GHz confirms the laminate family. If the board uses Rogers high-frequency materials, we match the specific grade (RO3003 vs. RO4003C vs. RO4350B) because their εr and loss tangent differ meaningfully.
Step 2 — Layer-by-Layer Imaging
Outer layers are optically scanned. Inner layers are captured via controlled chemical de-lamination or micro-CT X-ray (resolution down to 5 µm). For boards with blind/buried vias—common in compact RF front-end modules—X-ray laminography maps via stacks without physical destruction.
Step 3 — Transmission-Line Geometry Extraction
This is where RF reverse engineering diverges from standard work. Our CAD team identifies every transmission-line structure—microstrip, stripline, GCPW, edge-coupled pairs—and records trace width, gap, ground clearance, and reference-plane distance. We run a 2.5-D field solver (Polar Si9000 or equivalent) against the measured stackup to verify that extracted geometries hit the target impedance.
Step 4 — Schematic & BOM Recovery
Active and passive RF components are cataloged: part markings, package dimensions, pad geometry. Unmarked MMICs or bare-die devices are identified through S-parameter measurement on a network analyzer up to 26.5 GHz. Passives in 0201 or 01005 packages are measured on an LCR bridge at the board’s operating frequency, not just at 1 kHz—because a 2.2 pF capacitor at 1 kHz may behave as 1.8 pF at 2.4 GHz due to parasitic series inductance.
Step 5 — Gerber Output & Verification
Final Gerber/ODB++ files include impedance-controlled layers flagged with target Z₀, differential impedance, and stackup notes. We provide a DFM-ready package that any RF-capable fabricator can quote directly. Where possible, we fabricate one verification board and compare S₂₁/S₁₁ against the original on a VNA.
Grounded Coplanar Waveguide (GCPW) — Calculator
GCPW is the most common transmission-line topology on modern RF PCBs because it offers good isolation, easy impedance control, and compatibility with surface-mount transitions. Use the calculator below to check how trace width, gap, and substrate height interact for your target impedance. This is the same model our engineers reference during extraction.
PCB design
Grounded Coplanar Waveguide Calculator
The practical RF structure above a few GHz: side grounds plus a plane below. Less sensitive to neighbours than a plain microstrip.
How this is calculated
Grounded coplanar waveguide is solved from two elliptic integral ratios, one for the coplanar gaps and one for the coupling to the bottom plane, combined into an effective dielectric constant. The last row shows what the same trace would measure as a plain microstrip, which is usually a much higher impedance.
It only works if the side pours are stitched down to the bottom plane along their entire length, at a spacing under a twentieth of a wavelength at the highest frequency of interest. An unstitched pour is a resonant slot, and it will show up as a sharp notch in your insertion loss exactly where you cannot afford one.
How to read the result: Enter your measured trace width (W), gap to coplanar ground (G), substrate height (H), and dielectric constant (εr). The tool returns characteristic impedance (Z₀). If Z₀ falls outside 50 Ω ± 3 Ω for a standard RF line, double-check your dielectric constant—substrate mis-identification is the most common error we see in customer-supplied data.
What Does RF PCB Reverse Engineering Cost?
Pricing depends on layer count, substrate complexity, component density, and whether VNA verification is included. The table below reflects our typical ranges for RF-specific work.
| Board Complexity | Layer Count | Substrate | Price Range (USD) | Lead Time (Working Days) |
|---|---|---|---|---|
| Simple RF module (LNA, PA, filter) | 2 | Rogers / PTFE | $1,200 – $2,500 | 8 – 12 |
| Multi-band transceiver front-end | 4 | Rogers + FR-4 hybrid | $2,800 – $5,500 | 10 – 15 |
| Phased-array antenna tile | 6–10 | Rogers / Taconic + prepreg | $5,000 – $12,000 | 14 – 22 |
| Radar / EW module with cavities | 8–16 | Mixed PTFE / polyimide | $8,000 – $18,000+ | 18 – 30 |
VNA verification adds $600–$1,500 depending on frequency range. Boards using PTFE or ceramic-filled substrates cost more because de-lamination is slower and material identification requires additional dielectric testing.
Deliverables You Receive
| Deliverable | Format | Details |
|---|---|---|
| Fabrication files | Gerber RS-274X / ODB++ | Impedance-controlled layers annotated; stackup drawing included |
| Schematic | PDF + Altium / KiCad / OrCAD source | Hierarchical, net-named, RF signal paths highlighted |
| Bill of materials | Excel / CSV | MPN, value at frequency, package, alternates where available |
| Stackup specification | Layer materials, thicknesses, copper weights, εr values | |
| Impedance report | Simulated Z₀ per transmission line vs. target, field-solver screenshots | |
| VNA comparison (optional) | Touchstone .s2p + PDF overlay | S₁₁/S₂₁ original vs. clone, DC to max operating frequency |
Industries and Applications We Support
RF PCB reverse engineering serves teams maintaining or redesigning high-frequency hardware across multiple sectors:
- Telecommunications: Base-station PAs, duplexers, tower-mounted amplifiers. See our broader communication board reverse engineering capabilities.
- Defense & radar: Legacy radar receiver modules, EW sub-assemblies, IFF transponders where OEM support has ended.
- Test & measurement: Signal-generator output stages, spectrum-analyzer front-ends, and VNA test-port boards—often built on exotic laminates with tight tolerances. Our test and measurement board recovery service covers these in depth.
- IoT & wireless: 2.4 GHz / 5 GHz radio modules, LoRa front-ends, UWB anchor boards where the original design house is no longer available.
- Satellite & space: Ka-band feed networks, GPS LNAs on space-qualified laminates.
Common Failure Modes in RF Reverse Engineering
Transparency matters. Here is what can go wrong and how we mitigate it:
- Substrate mismatch: Using FR-4 parameters for a Rogers board shifts every impedance. We always cross-section and measure εr directly.
- Parasitic coupling from via placement: Omitting via-fence geometry creates cavity resonances. We capture every via, including non-functional stitching vias.
- Component value drift at frequency: A 10 nH inductor at 100 MHz may self-resonate at 2 GHz. We measure passives at or near operating frequency.
- Shield-can removal damage: Hot-air removal can lift pads. We use low-temperature solder-paste reflow with controlled profiles.
How to Get Started
Send us clear photos (top, bottom, edge profile) and any known specs—frequency band, impedance targets, laminate type if known. Our team provides a free feasibility assessment within 48 hours, including a firm quote and timeline. If you need a full-service partner for non-RF layers as well, our experienced reverse engineering team handles mixed-signal and digital sections in parallel.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewCan you reverse engineer an RF board without destroying it?
In most cases, yes. We use X-ray laminography and optical scanning for inner-layer capture, which is non-destructive. A small edge coupon may be cross-sectioned for dielectric verification, but the functional board remains intact. For 2-layer RF boards, the process is entirely non-destructive.
What frequency range can you support?
Our standard process covers DC to 26.5 GHz with full VNA verification. For boards operating up to 40 GHz (Ka-band), we use waveguide-based test fixtures and can arrange 67 GHz verification through partner labs. Millimeter-wave boards above 40 GHz require case-by-case evaluation.
Do you identify the exact laminate grade, or just the family?
We identify the specific grade whenever possible—e.g., RO4350B vs. RO4003C—because their loss tangent and εr differ (3.66 vs. 3.55). Identification uses cross-section measurement, split-post dielectric testing, and visual/tactile comparison against reference samples. In rare cases where two grades are indistinguishable, we note both and recommend the fabricator confirm with the laminate supplier.
How accurate are the recovered impedance values?
On a well-preserved board with known laminate, our extracted geometries typically reproduce Z₀ within ±1.5 Ω of the original at frequencies up to 18 GHz. Above 18 GHz, tolerance widens to ±2.5 Ω due to increased sensitivity to surface roughness and etch variation. We provide a full impedance simulation report with every project.
Can you handle RF boards with embedded components or LTCC?
Embedded passives (thin-film resistors, embedded capacitors) are recoverable through cross-section and impedance measurement. LTCC (low-temperature co-fired ceramic) modules are significantly harder—we can extract external geometry and S-parameters, but internal conductor layers in LTCC require destructive micro-CT analysis. We provide a feasibility assessment before committing to LTCC work.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote