Cost for automotive PCB reverse engineering is driven by five things: layer count, component density, whether there’s a BGA or QFN under a heat spreader, whether firmware has to come off the microcontroller, and which deliverables you actually need. A simple two-layer lamp or relay module is at the low end and usually turns around in days. A six- or eight-layer engine ECU with a potted section, a Renesas or Infineon MCU, and a full schematic plus BOM plus Gerber package is a multi-week project. Send photos and a chip marking and we can price it properly.
Why automotive boards cost more than they look like they should
An automotive board carries constraints you don’t see on a consumer PCB, and each one adds engineering hours. Conformal coating has to come off before you can probe anything, and it has to come off without lifting pads. Potting compound over a power section may hide a dozen components entirely. Automotive-grade parts often carry house-numbered or laser-marked codes instead of a readable manufacturer part number, so component identification becomes a research task rather than a lookup.
Then there’s the electrical environment. Reverse-battery protection, load dump clamping, 12 V and 48 V rails, CAN and LIN transceivers with their common-mode chokes and split terminations — these all have to be recovered exactly, because getting a TVS clamp voltage or a CAN termination wrong turns a working board into an intermittent one. On heavy-copper power sections we work back to a current-carrying estimate consistent with IPC-2152 rather than just copying the trace outline, so the reproduced board behaves the same thermally.
Board class matters too. Automotive assemblies are typically built to IPC-6012 Class 2 or Class 3 with the corresponding IPC-A-600 acceptability criteria, and if you’re going to build from our output, the stackup and annular ring recovery has to be good enough to hit that class. That’s slower than producing a “close enough” copy of a hobby board.
What actually happens to your board, in order
- Intake and photography. Both sides shot under diffuse light, high resolution, with a scale reference. Nothing is removed yet.
- Coating and potting removal. Selective, chemical or thermal depending on the material. This is the step most likely to reveal a surprise.
- Component identification. Every passive measured or read, every IC mapped to a real part number. Marking codes are cross-referenced against manufacturer decoders and, where the marking is proprietary, against pinout and behavior.
- X-ray, if there are BGAs or buried vias. This tells us ball count, ball pitch, and whether vias are through, blind, or buried before we commit to a stackup theory.
- Layer imaging. Outer layers scanned, then the board is delaminated and inner layers imaged one at a time. This is the irreversible step, and it’s why we ask about spare samples.
- Netlist reconstruction and continuity verification. The netlist pulled from the imaged layers is checked point-to-point against a second, intact board wherever one exists. Mismatches get resolved, not averaged.
- Schematic capture. Grouped into functional blocks a person can read — power input and protection, MCU and clocking, CAN/LIN, sensor front ends, drivers — not a spaghetti dump of nets.
- Deliverable generation and review. Gerber, drill, BOM, pick-and-place, schematic. A second engineer reviews before handover.
The engineer is mostly looking for three things during capture: nets that split under a component and rejoin (easy to miss, changes the topology), passive values that only make sense once you know the rail voltage, and any place where a via drops into a plane rather than a signal layer. Those three cause the majority of first-article failures when they’re missed.
How long a four-layer ECU takes versus a two-layer body module
Lead time scales with the number of independent things that have to be verified, not with board area. Here’s the realistic shape of it:
| Board type | Typical construction | What drives the schedule |
|---|---|---|
| Lamp driver, relay module, simple sensor board | 1–2 layers, mostly passives | Coating removal; a few days is normal |
| Body control module, door module, HVAC panel | 2–4 layers, one MCU, some drivers | Component identification and driver ICs |
| Engine/transmission ECU | 4–8 layers, fine-pitch QFP or BGA, potted power stage | Layer separation, potting, MCU firmware question |
| BMS or inverter control board | 4–8 layers, isolation barriers, heavy copper | Isolation clearance recovery, high-voltage layout rules |
| Instrument cluster / infotainment | 6–10 layers, HDI, multiple BGAs | Blind/buried via mapping, high-speed routing constraints |
Inner layers are the honest bottleneck. On a four-layer board with a fine-pitch BGA, each inner layer has to be imaged separately after delamination, and the BGA escape routing has to be traced ball by ball against the X-ray. That work doesn’t parallelize well. The same board without the BGA moves noticeably faster.
Firmware is the other schedule wildcard. If you need code off the microcontroller as well as the board files, that runs as a separate track with its own feasibility question, and the answer depends entirely on the specific part. It can finish faster than the board work, or it can be the thing everyone is waiting on.
What to send us, and what comes back
Send this and you’ll get a real quote instead of a range:
- Clear photos of both sides, whole board in frame, on a dark background. Focus on the silkscreen and the IC markings.
- Board dimensions in mm, and thickness if you can measure it.
- The main chip marking, typed out exactly as printed — including the suffix and the date code line.
- How many samples you have. One board means we work conservatively. Two or more means we can destructively image one and verify against the other, which is faster and more reliable.
- Which deliverables you need — one line is enough. Schematic only? Gerber for rebuild? Full turnkey with assembly?
- Any known symptom, if the board is dead. It tells us where to look first.
Back from us: a feasibility assessment naming any part or section we’re unsure about, a lead time, a price, and a list of exactly which files you’ll receive. If we think a section is unrecoverable, we say so in that first reply rather than discovering it halfway through. This is the same intake process we use for motor control board reverse engineering, where the power stage carries the same kind of thermal and isolation constraints.
Where automotive PCB reverse engineering gets hard, and where it stops
Some cases are genuinely difficult, and pretending otherwise wastes everyone’s time.
Cases that add cost but stay feasible
Thick potting over a power section — removable, but slowly and with risk to the parts underneath. House-marked ASICs where the function has to be inferred from surrounding circuitry. HDI stackups with stacked microvias, which need careful cross-sectioning to map correctly. Automotive connectors with proprietary keying, which we can dimension but which you may need to source from the original supplier.
Cases that are sometimes not feasible
A single, badly damaged board with burned traces and no second sample is the hardest situation in this business — if the copper is gone, the connectivity is gone with it. A custom ASIC or a gate array with no equivalent on the market can be documented but not reproduced. Secure elements and immobilizer-adjacent functions we generally decline outright. Boards with a fully unreadable, sanded-off top marking on the MCU sometimes resolve through pinout analysis and sometimes don’t.
On the firmware side, feasibility depends on the specific security mechanism, not on the vendor’s reputation. A part with a simple lock bit and one with a hardware-enforced permanent protection level are completely different problems. We evaluate the exact part number and tell you where it sits before you commit money. Comparable judgment calls come up in instrumentation board reverse engineering, where legacy test equipment often uses similarly locked custom silicon.
One practical note: we work for the party that holds the rights to the design — OEMs, tier suppliers, fleet operators maintaining equipment they own, and repair shops acting with the owner’s authorization. Confirming you have those rights is your responsibility, and every project runs under NDA.
Legitimate reasons people bring us automotive boards
Almost every project we take falls into one of four buckets. An out-of-production module is failing across a fleet and the original supplier no longer exists. A tier supplier lost the CAD archive in a system migration and needs the design back before the next production run. A component went end-of-life and the design has to move to a current part, which means recovering the schematic first. Or a board is failing in the field and failure analysis needs the actual netlist, not a guess.
Obsolescence is the biggest one by volume. A 20-year-old truck fleet doesn’t care that the transmission controller’s MCU stopped shipping in 2011 — it needs spares. Recovering the design lets you rebuild it, or redesign around a current part with the original behavior intact. We see the same pattern in LED driver board recovery, where discontinued controller ICs force a redesign that only becomes possible once the original circuit is documented.
FAQ
How much does automotive PCB reverse engineering cost?
It depends on layer count, component count, BGA presence, whether firmware is involved, and which files you need. A two-layer body module with fifty parts and a simple two-layer stackup is a fraction of the cost of an eight-layer ECU with a potted power stage. Send photos and the chip marking and we’ll quote the actual board rather than a bracket.
Can you recover the design if I
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote
Related reading
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote