Multilayer PCB Reverse Engineering: Inner-Layer Imaging

A four-layer control board is a puzzle with two hidden faces. On a six- or eight-layer industrial board most routing is buried, and the outer layers are often just ground pour, a connector fan-out and decoupling capacitors. The parts that decide whether it works — plane splits, impedance-controlled pairs, a buried clock — sit on copper nobody photographed. PCB reverse engineering here is not a tracing exercise but an imaging, registration and inference problem, in that order.

Why layer count changes the method

On a two-layer board every net can be followed with a meter and a light box. Inner layers remove that certainty three ways:

• Nets disappear. A signal enters a via and leaves somewhere else. You know a connection exists but not its path, its reference plane, or what it runs beside.
• Planes carry the design. Their splits define return paths and much of the product’s EMC behaviour.
• The stackup sets the rules. A trace width means an impedance only once dielectric thickness is known, and that number is printed nowhere.

The first deliverable is not a netlist but a stackup.

Rebuilding the stackup first

Infer layer count and order before imaging; the imaging plan depends on both.

Reading the edge

A cross-section is the honest answer, but it costs a board. Cheaper: count copper layers on the routed edge under a stereo microscope, measure thickness, read the drill chart. A 1.6 mm eight-layer board on 0.1 mm prepreg has a characteristic rhythm of copper and dielectric. Vias that stop partway date the design; through-vias say the cheap process, which also sets the annular ring to expect.

The plane pair as a structural clue

Most industrial designs put ground and power on adjacent inner layers a fraction of a millimetre apart: a distributed capacitor, and a measurable one. Probe between the planes: a short means the same net, a few nanofarads means a genuine pair. Capacitance per square centimetre, over the dielectric constant you assume, gives thickness — enough to choose between 0.1 and 0.2 mm prepreg.

Imaging the inner layers

Three techniques, used in combination, because none is complete alone.

X-ray and CT

Micro-focus X-ray shows buried vias and plane outlines without touching the board. A CT reconstruction, sliced layer by layer, images each copper layer at a resolution limited by focal spot size and laminate scatter. It is the only method that leaves the board working.

Etch-back and controlled delamination

For fine geometry nothing beats removing the outer layers: mill or sand the surface flat, polish, photograph under a metallurgical microscope; or heat the board and peel the prepreg, which separates cleanly but destroys the assembly. Both are destructive, so with a single board image the outer layers first.

Stitching and scale

Inner layers are larger than any single frame at working magnification. Capture a grid with 20 percent overlap, stitch on fiducials, and record scale with a stage micrometer each session. A stitched image without a scale reference is a drawing, not data.

Layer-to-layer registration

This is where multilayer jobs quietly fail. A few hundredths of a millimetre of misregistration puts a via outside its pad, and the netlist acquires opens that do not exist.

Targets come first: fabricator coupons, panel fiducials, the drill pattern — most reliable, because it is on every layer and one drill file produced them all. Then compensate for distortion: laminates shrink anisotropically, and a delaminated layer scans at a different size. Fit an affine transform per layer — translation, rotation, independent X and Y scale — not one rigid shift. What survives is usually warp: set a tolerance and flag ambiguous vias for electrical verification.

The order that works

Any PCB reverse engineering pass follows the same sequence, and skipping a step costs more than repeating it:

1. Photograph both outer layers at high resolution before anything is heated or sanded.
2. Count layers at the edge, write the stackup down, thickness included.
3. X-ray the via field; classify through, blind and buried vias.
4. Image inner layers destructively only after step one is archived.
5. Register each layer with an affine transform and inspect the residuals.
6. Extract the netlist; confirm uncertain nodes by continuity on a second board if one exists.

Circuit Engineering Company Limited works on industrial boards of this kind — PLC racks, drive stages, switch-mode supplies — starting from the physical board and delivering editable data the client owns. Because inner-layer geometry drives everything downstream in PCB reverse engineering, the netlist goes into schematic recovery rather than being redrawn by hand, and layer images are archived against the reverse engineering workflow so a later revision can be compared instead of re-imaged.

Multilayer work rewards patience up front. A stackup guessed wrong makes every later measurement suspect; layers registered badly give a netlist that looks complete and is not. Image first, register honestly, verify electrically, and the copper tells you the rest.