How a Printed Circuit Board Is Made: Laminate to Assembled Board

A printed circuit board is made by turning sheets of copper clad glass epoxy laminate into patterned copper layers, pressing those layers together with resin impregnated glass cloth, drilling and copper plating holes to connect the layers, and coating the result with solder mask and a solderable finish. A second factory, or a second line, then prints solder paste onto the bare board, places components with machines, melts the solder in a reflow oven, inspects and tests the assembly, and usually loads its first firmware.

That is two industries working from one set of digital files. Fabrication is a chemistry and plating business that produces a bare board; assembly (PCBA) is a placement and soldering business that produces a working module. Both follow IPC standards (IPC now calls itself the Global Electronics Association), and both are places where a supply chain can be attacked: counterfeit parts, leaked or altered design files, and firmware loaded on the factory floor.

This post walks the whole route from a stack of laminate to a tested, flashed board. It sits underneath our earlier explainers on how semiconductors are made, how a home router is made and how a rack server is made: the chips come from the fab, the board is what wires them together.

Key takeaways

• A rigid PCB is mostly glass epoxy laminate (the FR-4 family), copper foil, prepreg, solder mask, legend ink and a thin surface finish on the pads.
• Designs reach the factory as Gerber layer files plus drill data, or as one IPC-2581 or ODB++ model, together with a BOM and a placement file.
• Multilayer fabrication is image, etch, inspect, laminate, drill, desmear, metallise, plate, mask, finish and electrically test. HDI boards add laser drilled microvias and repeated lamination.
• Assembly is paste printing and inspection, pick and place, reflow, optional wave or selective soldering, then AOI and X-ray.
• Firmware is first written either into chips before placement or in system through JTAG, SWD or SPI during test.
• IPC Class 1, 2 and 3 set progressively stricter acceptance criteria for the same process.
• EU RoHS pushed the industry to lead free tin silver copper solder, whose eutectic sits near 216 C in NIST's calculated phase data against about 182 C for tin lead, so reflow runs hotter and laminates must be tougher.
• The integrity risks are counterfeit parts, leaked or altered design data, unapproved substitutions and untrusted factory firmware. HBOMs, counterfeit avoidance rules and supply chain risk frameworks from CISA, NIST and the US Department of Defense exist to manage them.

What is a PCB made of?

Strip a typical rigid board back to its materials and you find six things: a reinforced dielectric, copper, bonding resin, a protective polymer, ink and a thin finish on the exposed pads. Each has a job, and each has its own supply chain.

The laminate: woven glass and epoxy (FR-4 and its relatives)

The base material of most rigid boards is copper clad laminate: woven fibreglass cloth impregnated with epoxy resin, cured flat, with copper foil bonded to one or both sides. "FR-4" is a grade name from the old NEMA laminate grades, where FR stands for flame retardant. In practice FR-4 is a family rather than one material. Laminate suppliers sell dozens of FR-4 class products that differ in glass style, resin system, filler, glass transition temperature (Tg) and decomposition temperature (Td).

The numbers that matter to a board designer are:

• Glass transition temperature (Tg). Above Tg the resin softens and expands much faster through the board's thickness. Standard FR-4 sits around 130 to 140 C and high Tg products at 170 C or more; lead free assembly made high Tg and high decomposition temperature (Td) materials far more common.
• Dielectric constant (Dk) and loss tangent (Df). These set signal speed and loss. Fast serial links and radio boards use low loss blends or PTFE and ceramic filled laminates, sometimes only on outer layers in a "hybrid" stack.
• Z axis expansion (CTE). When the board heats it grows in thickness and pulls on the copper barrels of plated holes; too much expansion cracks barrels, a classic latent failure.

Flexible circuits replace the glass epoxy with polyimide film, and rigid flex boards combine both. Metal core boards, common in LED lighting, bond a thin dielectric to an aluminium or copper base to pull heat away.

Copper foil

Copper arrives as foil, either electrodeposited (plated onto a drum and peeled off) or rolled annealed (more ductile, preferred for flex). Thickness is given as weight per square foot: 1 oz copper is about 35 micrometres, half ounce about 17.5 and 2 oz about 70. Low profile foils exist for high frequency work, where surface roughness adds loss.

Prepreg and cores

A multilayer board is built from cores (fully cured laminate with copper on both sides) and prepreg (glass cloth impregnated with partially cured, "B-stage" resin). During lamination the prepreg resin melts, flows into the gaps between etched copper features, wets the next layer and then fully cures. Prepreg is the glue and the insulation between cores.

Solder mask

Solder mask is the coloured coating that covers copper everywhere except where parts will be soldered. Most boards use liquid photoimageable (LPI) mask: coated over the panel, exposed, developed to open the pads and cured. It stops solder bridging, protects copper and adds insulation. The thin mask "dam" between fine pitch pads is one of the tightest tolerances in fabrication.

Silkscreen or legend

The legend is the ink that prints reference designators, polarity marks and outlines, now usually by inkjet. It has no electrical function but matters for assembly, rework and traceability, because serial number fields and date codes often live there.

Surface finish

Bare copper oxidises quickly, so exposed pads get a surface finish before shipping. The choice affects solderability, shelf life, flatness for fine pitch parts and cost.

How does a design reach the factory?

A board starts as a schematic: the logical description of which pins connect to which. The designer then creates a layout, placing component footprints on a defined layer stack and routing copper traces, planes and vias between them. Open source tools such as KiCad and a range of commercial electronic design automation (EDA) suites all follow this same flow.

Rules first: design rule checks

Before anything leaves the design tool, two automated checks run. The electrical rule check (ERC) looks at the schematic for mistakes such as unconnected inputs or outputs driving each other. The design rule check (DRC) compares the layout against a set of physical constraints: minimum trace width and spacing, annular ring around drilled holes, hole to copper clearance, solder mask expansion, silkscreen over pads, courtyard overlaps and unrouted nets.

Those constraints come from two places. Generic ones come from design standards: IPC-2221, the "Generic Standard on Printed Board Design", gives tables such as minimum electrical clearance between conductors at a given voltage, and IPC-2222 covers rigid organic boards. IPC-2221 is at revision C, dated December 2023. Current capacity was treated in more detail by IPC-2152 (first published in 2009), which the association's revision table now lists as no longer maintained. Specific constraints come from the fabricator's capability sheet: smallest trace and space, minimum drill, aspect ratio, mask web. A design can pass generic rules and still fail a particular factory's process window.

Fabrication data: Gerber, drill, IPC-2581, ODB++

The design is exported as fabrication data. There are two families of format.

Layer by layer formats. Gerber is the long standing de facto standard, maintained by Ucamco, which publishes the specification for free. Its official site describes it as the backbone of the electronics fabrication industry, and the current specification revision is 2024.05 (published in 2024, following 2023.08). A Gerber file describes a single image: the copper on one layer, the solder mask openings on one side, the legend, or the board outline. Gerber X2 added attributes so each file can say what it is ("top copper", "plated drill") and what each object is for. Gerber X3 adds component information for assembly. Holes are usually described in a separate drill file; KiCad's documentation, for example, says it can write drill data in either Excellon or Gerber X2 format, and a fabrication drawing or "read me" carries the stack up, material, finish, class, impedance requirements and tolerances.

Single file product models. IPC-2581, which its consortium now also calls IPC-DPMX (Digital Product Model Exchange), was developed by IPC in 2004 and is described by the consortium as an open, bidirectional, neutrally maintained format; the current revision is C, dated November 2020. It is an XML format that carries the whole product in one file: layer images, drill, stack up, netlist, bill of materials and component placement. ODB++ is an older proprietary but widely supported intelligent format that does the same job. The advantage of a single model is consistency. A loose set of Gerbers, a drill file, a PDF drawing and a spreadsheet can contradict one another; a single model removes some of that room for error.

For assembly the factory also needs:

• the bill of materials (BOM): manufacturer part numbers, approved alternates, quantities and reference designators;
• the placement or centroid file: X, Y, rotation and side for every part;
• solder paste layer data to cut the stencil;
• the assembly drawing, test specification and any programming instructions for firmware.

Factory engineering: CAM, DFM and panelisation

When the data arrives, the fabricator's computer aided manufacturing (CAM) engineers run a design for manufacturability (DFM) review, compensate copper widths for etch loss, add thieving copper to balance plating, design test coupons and step the board into a production panel with tooling holes, fiducials and breakaway rails. Ambiguities go back as engineering questions. For security this matters: the factory edits a working copy of your design, which is normal, and you only know what changed if you review what comes back.

How are multilayer boards fabricated?

A four layer board is the easiest way to picture the process. It has two inner layers on a single core, prepreg on each side, and outer copper foil on top and bottom. A twelve layer server board or a 20 plus layer accelerator board repeats the same steps with more cores.

1. Inner layer imaging

Cores are cut to panel size, cleaned and coated with dry film photoresist. The pattern is exposed through phototools or by laser direct imaging (LDI), which writes straight from CAM data and can scale for material movement. Developer washes away the unexposed resist, leaving resist over the copper that should stay.

2. Etch and strip

An etching line sprays chemistry (acidic cupric chloride is common for inner layers) that dissolves the exposed copper. The remaining resist is then stripped, leaving bare copper traces and planes. Because etchant also attacks sideways, CAM data widens traces slightly in advance; this is "etch compensation".

3. Inner layer AOI

Every inner layer is scanned by automated optical inspection (AOI) and compared against the CAM data. This is the last chance to find an open or short on an inner layer cheaply. Once it is laminated inside a board, a defect is permanent.

4. Oxide or bond treatment

The smooth copper surface is chemically roughened and treated (a "black oxide" or, more often now, an oxide alternative) so prepreg resin bonds to it. Poor bonding shows up later as delamination during reflow.

5. Layup and lamination

Cores, prepreg sheets and outer copper foil are stacked in the right order, registered by pins or optical alignment, and loaded into a lamination press. Heat and pressure, often under vacuum, melt the prepreg resin, let it flow and then cure it. The result is a single solid panel with inner copper sealed inside.

6. Drilling

Holes are drilled with CNC spindles and carbide bits, often through several stacked panels, with X-ray machines locating inner layer targets to correct for shift. Back drilling removes unused via stubs on high speed boards.

7. Desmear and metallisation

Drilling smears melted resin across the inner copper exposed in the hole wall. Desmear (typically a permanganate chemical process, or plasma for some materials) removes it so the plated copper can connect to every layer. The hole walls are then made conductive: a thin layer of electroless copper (or a direct metallisation process based on carbon, graphite or conductive polymer) is deposited on the glass and resin of the wall.

8. Outer layer imaging and plating

Photoresist is applied to the outer layers and imaged, but this time the resist covers the copper that will be removed. The panel then goes through electrolytic copper plating, which builds up copper on traces, pads and inside the holes to the specified thickness. A thin tin layer is plated on top as an etch resist. (Some shops plate the whole panel first and pattern afterwards; the principle is the same.)

9. Outer layer etch

The plating resist is stripped, the unwanted base copper is etched away (alkaline etchant does not attack the tin), and the tin is stripped. What remains is the final outer copper pattern, connected through plated holes to the inner layers.

10. Solder mask, finish and legend

Solder mask is coated, imaged, developed and cured. The chosen surface finish is applied to exposed copper. The legend is printed. Some boards also get carbon ink, peelable mask or gold plated edge connector fingers at this point.

11. Electrical test

Every bare board is electrically tested for opens and shorts against the netlist. High volume work uses a dedicated bed of nails fixture; prototypes and lower volume work use flying probe testers, whose moving probes need no custom fixture. Failed boards are scrapped or repaired according to the class and the customer's rules.

12. Profiling, final inspection and coupons

Boards are routed out of the panel, V scored, or left in arrays with breakaway tabs. Final inspection checks dimensions, bow and twist, mask registration and finish. For high reliability work, test coupons from the panel are microsectioned to check hole copper thickness, plating voids and layer registration. IPC-A-600 shows acceptable and rejectable conditions; IPC-6012 sets qualification and performance requirements for rigid boards.

Vias, microvias and HDI

A via is a plated hole that connects layers. There are four kinds you will see in a fabrication drawing:

High density interconnect (HDI) boards are built by sequential lamination: a core is made, thin dielectric and copper are added on each side, microvias are laser drilled and plated, and the cycle repeats. Microvias can be stacked or staggered. Via in pad, under BGA pads, needs the hole filled and plated over flat, otherwise solder wicks into it. Each extra lamination cycle adds cost and reliability risk.

How is a board assembled?

Assembly turns a bare board into a working module. Most modern boards are dominated by surface mount technology (SMT), with a few through hole connectors or power parts.

Solder paste printing and SPI

A laser cut stainless steel stencil is aligned over the board and a squeegee pushes solder paste (tiny solder spheres in flux) through its openings onto the pads. Stencil thickness and aperture size set how much solder each joint gets. Solder paste inspection (SPI) then measures the height, area and volume of every deposit in 3D, because many SMT defects start at the print.

Pick and place

Placement machines pick parts from reels, trays or tubes with vacuum nozzles, check them with cameras, and place them at the centroid file coordinates, correcting position against fiducial marks. Feeder setup is verified against the BOM, often by barcode, because a wrong reel in a feeder is a classic error and a point where an unauthorised substitute can enter.

Reflow soldering

The populated board travels through a reflow oven with multiple heating zones. A reflow profile has four phases: preheat, a soak where flux activates and temperatures even out, reflow above the alloy's liquidus where joints form, and controlled cooling. NIST's calculated phase diagrams put the tin lead eutectic at about 182 C (the handbook figure is 183 C) at roughly 62 percent tin, and the tin silver copper ternary eutectic at about 216 C at roughly 3.7 percent silver and 0.85 percent copper. Common lead free pastes (the SAC family, such as SAC305 with 3 percent silver and 0.5 percent copper) sit close to that ternary eutectic, so the whole profile runs roughly 35 C hotter than it did for tin lead. Double sided boards go through reflow twice.

Through hole parts: wave and selective soldering

Through hole connectors and large parts are inserted by machine or by hand. On a board that is mostly through hole, wave soldering passes the underside over a standing wave of molten solder. On a mostly SMT board, selective soldering uses a small programmable fountain or laser to solder each through hole joint without disturbing nearby SMT parts. Hand soldering is still used for odd parts and rework.

Inspection: AOI and X-ray

After reflow, automated optical inspection (AOI) checks that every part is present, oriented correctly and has the right visible fillets. Packages that hide their joints, such as BGAs and QFNs, need automated X-ray inspection for voids, bridges, head in pillow defects and missing balls. IPC-A-610 is the visual acceptance standard; IPC J-STD-001 sets the process and material requirements for soldered assemblies.

Cleaning, coating and depaneling

Depending on the flux and the product, boards may be cleaned to remove flux residue, then conformally coated (acrylic, silicone, urethane or parylene) to resist moisture and contamination. Boards built in arrays are separated by routing, sawing or laser.

How are boards tested, and where is firmware first flashed?

Testing happens at three levels, and they catch different faults.

Where firmware is first written

A board with a microcontroller, a system on chip or a flash memory needs code before it can do anything. Factories use three main approaches:

1. Pre-programmed parts. Flash chips or microcontrollers are programmed in sockets before placement, by a distributor, a specialist house or the assembler, so the reels arrive already carrying an image.
2. In system programming (ISP). The part is placed blank and programmed on the board through JTAG, Serial Wire Debug (SWD), SPI pins for serial flash, or a vendor bootloader over UART or USB, often on the ICT or functional test station.
3. Two stage provisioning. A test image is loaded for functional test and later replaced by the production image, sometimes at a more trusted site, where device identities, certificates and keys may be injected and secure boot fuses blown.

This step is where the board and its software supply chain meet. Whoever controls the programming station controls what the device runs on day one. Our posts on the home router and the rack server describe how provisioning, signing and secure boot work for those products in more detail.

What do IPC classes 1, 2 and 3 mean?

IPC acceptability and performance standards define three product classes. The same IPC-A-610 or IPC-6012 document applies to all three; what changes is how strict the acceptance criteria are.

Two practical notes. First, a class has to be called out on the drawing or purchase order, along with which standard applies; "build to IPC" is not a specification. Second, there are additional addenda for special environments (automotive, space and military, medical), which tighten Class 3 further for those uses.

The IPC standards map

IPC sells most of these documents; its public pages give the scope and revision, while the text itself is paid. Treat the public descriptions as the authority for what each document covers and the purchased text as the authority for numbers.

How does lead free RoHS change the process?

The EU Restriction of Hazardous Substances Directive, now Directive 2011/65/EU (often called RoHS 2), restricts hazardous substances in electrical and electronic equipment placed on the EU market. According to the European Commission, it currently restricts ten substances: lead, cadmium, mercury, hexavalent chromium, polybrominated biphenyls (PBB), polybrominated diphenyl ethers (PBDE) and four phthalates (DEHP, BBP, DBP and DIBP). The four phthalates were added to Annex II by Commission Delegated Directive (EU) 2015/863. Annex II sets the maximum concentration values, and a long list of time limited exemptions in Annexes III and IV covers uses where no substitute is yet practical. The Commission's own timeline gives the key dates: the first RoHS Directive entered into force on 27 January 2003, the recast Directive 2011/65/EU on 21 July 2011 (member states had to transpose it by 2 January 2013), it was amended on 15 November 2017, and on 7 December 2023 the Commission finalised a review and proposed a targeted amendment.

For PCB manufacturing the most visible effect was the move away from tin lead solder. That changed the process in several ways:

• Hotter assembly. Tin silver copper alloys melt about 35 C above eutectic tin lead. A University of Cambridge teaching package on phase diagrams makes the same point from the materials side: tin lead was chosen for its low eutectic melting point, and electronics has been moving to copper, tin and silver based systems.
• Tougher laminates. Boards must survive several hotter reflow cycles without delaminating or cracking barrels, which pushed designs to higher Tg and Td materials.
• New finishes. Tin lead HASL gave way to lead free HASL, ENIG, OSP, immersion silver and immersion tin.
• New failure modes. Pure tin finishes can grow tin whiskers that short adjacent leads, and hotter reflow raised the risk of moisture damage in plastic packages, so storage and baking rules matter more.

RoHS also changed the paperwork. Assemblers track material declarations per part, and the bill of materials became a compliance record as well as a build list. That same record is the starting point for a hardware bill of materials.

Step table: raw laminate to tested, flashed board

What are the supply chain integrity risks?

A printed circuit board passes through many hands: laminate makers, fabricators, component manufacturers, distributors, brokers, programming centres, assemblers and test houses. The US government has spent two decades building rules around this, mostly for defence electronics, and the same ideas apply to anyone buying hardware.

Counterfeit and recycled components

The most documented risk is counterfeit parts. The US Defense Federal Acquisition Regulation Supplement clause 252.246-7007 defines a counterfeit electronic part as an unlawful or unauthorised reproduction, substitution or alteration that has been knowingly mismarked, misidentified or otherwise misrepresented as an authentic, unmodified part from the original manufacturer. It defines a "suspect" counterfeit part as one where credible evidence, including visual inspection or testing, gives reasonable doubt that it is authentic. The clause requires covered contractors to keep an acceptable counterfeit electronic part detection and avoidance system, and says failing to do so can lead to disapproval of the contractor's purchasing system. A companion clause, DFARS 252.246-7008, sets a sourcing order: buy parts that are still in production from the original manufacturer, its authorised suppliers, or suppliers that buy only from those sources, and fall back to other suppliers only under additional controls.

Counterfeits include recycled parts pulled from scrap and remarked, parts remarked to a higher grade or later date code, escaped rejects, clones and outright fakes. SAE AS5553 sets requirements for counterfeit electronic parts avoidance, detection, mitigation and disposition for organisations that design and assemble electronic hardware.

The practical controls are straightforward to describe and hard to do well: buy from the original manufacturer or its authorised distributors, keep traceability back to the manufacturer for every lot, screen parts from any other source (visual inspection, X-ray, decapsulation, electrical test), quarantine suspects, and report them.

Design data leakage and tampering

The fabrication and assembly data set is a complete recipe for your product, and it travels: to the fabricator's CAM system, a stencil maker, an assembler and a test fixture builder. The risks are theft and cloning, and, more subtly, modification. An altered Gerber, a swapped placement entry, a changed BOM line or an extra part would be hard to spot on a finished board. The defence is mostly process: controlled data exchange, version control of released data, comparing what comes back with what was sent, and first article inspection.

Unauthorised changes and substitutions

Not every change is malicious. A fabricator may substitute a laminate it considers equivalent, an assembler may fit an alternate when a part is short, a programming centre may load last week's image. Each should need written approval, because undocumented substitutions break the link between what you think you shipped and what you shipped, which is the link a hardware bill of materials preserves.

Firmware loaded on the factory floor

The first image a board ever runs is loaded at the factory, often by a third party, on equipment you do not control. If that image is wrong or modified, every unit carries it. Controls include signing the production image and verifying its signature before and after programming, enforcing secure boot so the device itself rejects unsigned code, reading back and hashing what was written, and logging which image went onto which serial number. NIST's guidance on hardware enabled security (NIST IR 8320) treats the physical platform as the first layer of a layered approach to platform security, with a hardware root of trust as the anchor for verifying firmware.

Trusted suppliers for defence electronics

For US defence systems, the Department of Defense runs trust and assurance programmes for microelectronics, and its Defense Microelectronics Activity (DMEA) is the office known for accrediting trusted suppliers. (We could not reach the DMEA website while writing this, so check its current accreditation categories directly before relying on them.) The electronics industry has a parallel, voluntary route: IPC-1791 (revision D, November 2023) sets requirements for trusted electronic designers, manufacturers and assemblers, and IPC-1792 (first published November 2022) is a standard for cybersecurity management in the manufacturing supply chain. Most commercial buyers will never use an accredited trusted supplier, but the controls those programmes require (controlled data, traceable material, cleared staff, inspected handoffs) are a good checklist.

What do hardware BOM practices check?

CISA's "Hardware Bill of Materials (HBOM) Framework for Supply Chain Risk Management", published on 25 September 2023, gives a consistent naming method for component attributes, a format for describing different types of components, and guidance on which HBOM information is appropriate for which purpose. The framework groups HBOM use cases into three categories: compliance (internal, industry, customer and government rules), security (exposure to known vulnerabilities or to untrusted entities and locations) and availability (exposure to world events and lack of supplier diversity). Its taxonomy sorts data fields into categories such as HBOM header information, finished good product details, entity name and location, component part information and details, and production details. One limit matters for boards: CISA says the framework records basic information about firmware associated with components, such as its provider, but stops short of a framework for examining that firmware's provenance. That gap is where a software bill of materials picks up. In practice an HBOM for a board assembly answers questions like:

• Which manufacturer, part number and revision is fitted at each reference designator, and from which authorised source did each lot come?
• What origin, date code and lot apply?
• Which components carry firmware, and which version was loaded at the factory?

NIST SP 800-161 Rev. 1, "Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations" (May 2022, updated November 2024), is the broader framework that tells organisations how to manage supplier risk across hardware, software and services. IPC-1782 (revision B, October 2023) adds a manufacturing view: it defines traceability data that fabricators and assemblers capture so a defect or suspect lot can be traced to every affected board. Our posts on HBOM versus SBOM, the CISA HBOM framework and combining hardware and software in one bill of materials for IoT devices go deeper into the formats.

Step by step: release a board design package you can verify later

The commands below use KiCad's command line tool, kicad-cli, because it is open source and documented. Commercial EDA suites have equivalent batch exports. The goal is a released package whose every file is reproducible from tagged source, hashed, signed and compared before anything goes to a factory. None of these commands modify hardware.

1. Run electrical and design rule checks and fail on errors.

# Schematic electrical rules check
kicad-cli sch erc --output out/erc.rpt --severity-error --exit-code-violations board.kicad_sch

# Layout design rules check, including schematic parity
kicad-cli pcb drc --output out/drc.rpt --schematic-parity --severity-error --exit-code-violations board.kicad_pcb

Load the fabricator's capability rules into the board's design rules before running DRC, so the check reflects the real process window.

2. Export fabrication outputs from a clean, tagged commit.

git status --porcelain   # must print nothing
git tag -s hw-rev-B -m "Board revision B release"

mkdir -p out/fab out/assy
kicad-cli pcb export gerbers --output out/fab/ board.kicad_pcb
kicad-cli pcb export drill --output out/fab/ board.kicad_pcb
kicad-cli pcb export ipc2581 --output out/fab/board-ipc2581.xml board.kicad_pcb

3. Export assembly outputs: placement and bill of materials.

kicad-cli pcb export pos --format csv --units mm --side both --output out/assy/board-pos.csv board.kicad_pcb
kicad-cli sch export bom --output out/assy/board-bom.csv board.kicad_sch

4. Hash and sign the release package.

cd out
find fab assy -type f -print0 | sort -z | xargs -0 sha256sum > SHA256SUMS
gpg --armor --detach-sign SHA256SUMS
cd ..
zip -r board-rev-B.zip out

Send the manifest and its signature with the package, and keep a copy. When engineering questions come back, or when a factory returns modified working data, you can say exactly which file you sent.

5. Check the BOM against approved sources before kitting.

# Every line must have a manufacturer part number; list the ones that do not
awk -F',' 'NR>1 && $0 !~ /MPN/ {print NR": "$0}' out/assy/board-bom.csv | head

The exact column names depend on your BOM template. The point is to block release when a line has no manufacturer part number, because a blank line invites the factory to choose a part for you.

6. Verify the production firmware image before it goes to the programming station.

sha256sum firmware-1.4.2.bin
gpg --verify firmware-1.4.2.bin.asc firmware-1.4.2.bin

Record the hash in the programming instructions and in the HBOM, and ask the factory to log the hash it read back from each programmed device.

7. Compare first articles against the released data.

When the first boards arrive, check the fitted part markings, the board revision in the legend, the firmware version reported by the device and, where you have them, the factory's AOI and programming logs, against the signed release. A first article inspection is the cheapest point to catch a substitution.

Common mistakes

• Sending loose files with no single source of truth. Gerbers, a drill file, a PDF drawing and a spreadsheet from different dates will eventually disagree. Use IPC-2581 or ODB++ where the factory supports it, or at least a signed manifest and a tagged release.
• Not calling out a class and the governing standards. "Build to IPC" is not a requirement. State IPC-6012, IPC-A-610 and J-STD-001 classes on the drawing and purchase order.
• Designing to generic rules only. Load the fabricator's capability sheet into DRC.
• Choosing laminate by "FR-4" alone. For lead free assembly specify Tg, Td and Z axis expansion so a substitute that delaminates in reflow cannot slip in.
• Leaving BOM lines open. Blank or "or equivalent" lines invite substitutions. Approve alternates explicitly and buy shortage parts only with screening.
• Treating factory programming as a black box. Specify the image by hash, require signature verification and read back, and keep logs per serial number.
• Skipping first article inspection, or assuming bare board test proves the assembly. Bare board test finds only copper opens and shorts.
• Forgetting the software on the board. Bootloaders, firmware and the open source components in them need the same inventory and patching discipline as the parts.

FAQ

What material is a PCB made of?

Most rigid boards use FR-4 class laminate: woven glass cloth bonded with flame retardant epoxy and clad in copper foil. Multilayer boards add prepreg between layers, solder mask, legend ink and a surface finish on the pads. Flexible boards use polyimide film.

What is the difference between PCB fabrication and PCB assembly?

Fabrication makes the bare board: copper layers, insulation, plated holes, mask and finish. Assembly solders components onto it, inspects and tests it and often programs its firmware, usually at a different factory.

What files does a PCB manufacturer need?

Gerber layer files, drill data and a fabrication drawing with stack up, material, finish, class and tolerances, or one IPC-2581 or ODB++ file carrying all of that. Assembly also needs the BOM, the placement file, paste data for the stencil and programming and test instructions.

What are IPC Class 2 and Class 3?

Acceptance classes in standards such as IPC-6012 and IPC-A-610. Class 2 covers dedicated service products such as most commercial and industrial hardware. Class 3 covers products that must work on demand with no tolerated downtime, with stricter criteria for plating, hole fill, joints and inspection.

Why is most solder now lead free?

The EU RoHS Directive and similar rules restrict lead in most electrical and electronic equipment, so the industry moved to tin silver copper alloys that melt roughly 35 C hotter than tin lead. That needed hotter reflow, tougher laminates and new finishes.

How is firmware put on a new circuit board?

Either the chip is programmed before placement, or it is programmed in place through JTAG, SWD or a SPI header during in-circuit or functional test. Many products load a test image first and the production image, keys and certificates later.

How do you detect counterfeit electronic components?

Buy from original manufacturers or authorised distributors, keep traceability for each lot, and screen anything else with visual inspection, X-ray, decapsulation and electrical test. US defence contractors must run a detection and avoidance system under DFARS 252.246-7007.

Can a PCB be tampered with during manufacturing?

In principle yes: design files can be altered, parts substituted and firmware changed at the programming station. The defences are signed release data, approved alternates only, authorised sourcing, first article inspection, firmware signing with secure boot and per serial number logs.

Fix it without waiting for upstream

A finished board is only half of the product. The bootloader, firmware, drivers and the open source libraries compiled into them are software, built from dependencies that publish fixes on their own schedule, and those builds are where Safeguard's fit is direct; the copper, solder and components themselves are outside what Safeguard analyses.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

Safeguard does not inspect boards, screen components, analyse firmware binaries or generate an HBOM. Where it helps is in the software repositories that produce a board's firmware and tooling: the source trees, the open source dependencies and the container images used to build them.

The first demo is a real Safeguard CLI session. You ask it to fix a vulnerable dependency, it reads the finding and the advisory, asks before each command, edits the manifest, runs the install and the tests with your approval, and pushes nothing on its own. The same flow applies to a firmware repository or a factory test tool written in Python or Node that pins an outdated library.

Click through it at your own pace, or open it full screen.

The second demo sets up the local runner on your own machine, approves it with a device code, and scans from the terminal. Hardware teams often keep firmware source and build containers on internal machines; running the scan locally keeps that code where it is.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and lets you choose which tools Claude can use. A hardware engineer could then ask about the components and versions in a firmware project from the same assistant used to review design notes.

Click through it at your own pace, or open it full screen.

To try it on your own firmware repositories, download Safeguard and follow the CLI documentation.

Quick check

Sources

• IPC document revision table, Global Electronics Association
• IPC standards overview, Global Electronics Association
• IPC-2581 (IPC-DPMX) Consortium
• Gerber format, Ucamco
• KiCad 9.0 PCB Editor documentation
• KiCad 9.0 command line interface documentation
• RoHS Directive, European Commission
• Pb-Sn system phase diagram, NIST Metallurgy Division
• Ag-Cu-Sn system phase diagram, NIST Metallurgy Division
• Phase diagrams of solder systems, NIST
• Phase Diagrams and Solidification teaching package, DoITPoMS, University of Cambridge
• The Glass Transition in Polymers teaching package, DoITPoMS, University of Cambridge
• Hardware Bill of Materials (HBOM) Framework for Supply Chain Risk Management, CISA
• A Hardware Bill of Materials Framework for Supply Chain Risk Management (PDF), CISA
• NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices
• NIST IR 8320, Hardware-Enabled Security
• DFARS 252.246-7007, Contractor Counterfeit Electronic Part Detection and Avoidance System
• DFARS 252.246-7008, Sources of Electronic Parts
• SAE AS5553, Counterfeit Electronic Parts; Avoidance, Detection, Mitigation, and Disposition

Last reviewed: 23 October 2026. IPC standard revisions and RoHS exemptions change over time; check the standards bodies and the European Commission for current versions before writing a specification.