If you have a failed industrial control board with no drawings, no vendor support, and a machine sitting idle, industrial control PCB reverse engineering gets you back a schematic, a Gerber set, a BOM, and — if you own the firmware — a readable image of the MCU code. From a single physical sample. A two-layer relay I/O card takes days; an eight-layer drive controller with fine-pitch BGAs takes considerably longer.
That is the whole offer. The rest of this page is how it actually works, what we need from you, and where the honest limits are.
Which industrial boards actually come through the lab
Industrial control hardware has a specific personality, and it shapes the work. These boards are old, they run hot, they carry mixed voltages, and the parts on them stopped being manufactured a decade ago. Typical jobs:
- PLC I/O and CPU cards — often four to six layers, heavy on optocouplers, transient suppressors, and address decode logic in a CPLD or GAL.
- VFD and servo drive control boards — a DSP or MCU section, isolated gate-drive stages, current-sense chains, and creepage clearances you must not “clean up” during redraw.
- Machine tool interface boards — encoder inputs, differential line receivers, and a lot of connectors whose pinout is the real deliverable.
- Furnace, press, and packaging-line controllers — thick copper for contactor drive, plus a small logic island.
- Process instrumentation cards — 4–20 mA loops, precision references, guard rings and ground splits that matter to the measurement.
- Legacy backplanes — low component count, high net count, and the fun of tracing buses across a large board.
Two things separate this from consumer board work. First, the safety-relevant geometry is part of the design: clearance between the mains side and the logic side, cutouts, and creepage paths follow the spacing philosophy in IPC-2221, and copying those distances faithfully matters more than making the layout pretty. Second, industrial boards are frequently conformal-coated or partially potted, which changes how we get at the copper.
What we actually do to your board, in order
1. Intake, photography, and net-count estimate
The board is logged, photographed under raking light at high resolution on both sides, and measured — outline, thickness, mounting hole positions, connector datum points. We count nets and components before quoting, because that number, not the board’s physical size, drives the hours.
2. Component identification
Every part gets read, and the ones with sanded or ambiguous markings get identified by package, in-circuit behavior, and role. Industrial boards are full of house-numbered parts and long-obsolete logic families. Custom magnetics — current transformers, drive transformers, common-mode chokes — get characterized rather than looked up, since no datasheet exists.
3. Non-destructive imaging
Outer-layer copper is scanned at high resolution. Vias, buried connections, and BGA ball assignments get X-rayed. On a coated board, the coating is removed locally with solvent or careful mechanical work in areas where we need optical clarity.
4. Layer separation on multilayer boards
Inner layers can’t be photographed through FR-4, so a spare board — or the board itself once the customer approves — is delaminated and each layer imaged separately. This is the step that makes a six-layer drive board slower than a two-layer I/O card. If you can send a second sample, even a burned one, keep it for this step and we keep your good board intact.
5. Netlist, then schematic
Copper images are vectorized into a net list, then the net list is verified electrically. On a board that still partially powers up, we buzz out continuity on a sample of nets with a meter and compare against the extracted list. Then the schematic gets drawn as a human reads it: power tree first, then isolation barriers, then the MCU and its peripherals, then the I/O channels. A netlist dump is not a schematic — pages get organized by function, nets get real names, and reference designators match the silkscreen.
6. Rebuild and verify
We generate a Gerber set with correct stackup, drill file, and impedance intent where it matters, fabricate a bare board, assemble it, and test it against the original. Board acceptability follows IPC-A-600 and IPC-6012 class expectations, and trace widths for the power sections are sanity-checked against IPC-2152 current tables rather than blindly copied — if the original ran a trace hot for twenty years, we tell you.
Our full step-by-step breakdown of the reverse engineering workflow covers each stage in more detail if you want to see the tooling behind it.
What to send us, and what comes back
You’ll get a straight answer faster if the first message contains these five things:
- Photos of both sides, whole board in frame, on a dark non-reflective background, in focus, with no glare across the silkscreen.
- Board dimensions in millimeters or inches, plus layer count if you know it, and whether the board is conformal-coated or potted.
- The main chip markings — MCU, DSP, CPLD, and any custom-marked ASIC — typed out as text, not just visible in the photo.
- One line on what you need: repair a few units, hold spares, migrate to modern parts, or restart production.
- Whether firmware is involved, and whether you have a hex file already.
What comes back from us before any money moves: a feasibility assessment naming the specific risk items on your board, a deliverable list, a lead time, and a price. Not “yes we can do it” — a note that says, for example, that the two 44-pin PLCCs on the logic side look like a house-marked EPLD and that reproducing their function is the schedule risk.
Choosing the deliverable depth you need
| What you need | Deliverables | When it fits |
|---|---|---|
| Board duplication only | Gerber, drill, stackup, BOM, pick-and-place | You just want identical spare cards built; the design will never change |
| Full schematic recovery | Hierarchical schematic, netlist, annotated BOM, plus the above | Repair diagnosis, safety review, or you plan to modify the circuit |
| Schematic plus obsolescence work | Above, plus part substitutions and a re-laid-out board | Key ICs are end-of-life and a straight clone can’t be built |
| Board plus firmware | Above, plus MCU code readout and verified programming of new units | You own the firmware and the source or hex file is gone |
If you’re weighing a straight duplication against a full electrical understanding of the circuit, the practical trade-offs are laid out in our comparison of PCB copy versus reverse engineering.
The honest limits on industrial control boards
Anyone who tells you every board is straightforward has not done many of them. Here is what genuinely makes an industrial job hard, and what can make it infeasible.
Programmable logic. A GAL, PAL, CPLD or FPGA on a PLC card holds behavior that is not visible in the copper. If the device’s security bit is set, the internal logic may not be recoverable, and we would then have to infer the function from bus timing and rebuild it — possible on simple address decoders, expensive on anything larger. We say so before you commit.
Read-protected microcontrollers. Firmware feasibility depends entirely on the specific part and its protection state. STM32 parts at RDP Level 1 behave very differently from Level 2. MSP430 devices with a blown JTAG fuse or an unknown BSL password are a different problem than ones without. AVR and 8051 derivatives depend on which lock bits are programmed. Anyone quoting a guaranteed outcome without knowing the exact die revision is guessing.
Fully potted assemblies. Epoxy-encapsulated drive modules can sometimes be excavated, sometimes not, and the excavation can destroy the only sample you have. One board and hard potting is the combination we most often decline.
Single damaged samples. A board with a blown trace, a cratered pad, or a burned-through inner layer means the missing net has to be reconstructed by reasoning about the circuit. Usually doable. Occasionally the missing information is genuinely gone.
Analog trim and calibration. Precision instrumentation cards often carry per-unit calibration constants in an EEPROM or in laser-trimmed resistors. Cloning the hardware does not clone the calibration; your rebuilt card will need recalibration against a reference.
On rights: you need to hold the rights to the design, or a legitimate maintenance interest in equipment you own, and comply with applicable IP law. Every project runs under NDA. Legitimate work in this space is repair, spares for out-of-production machinery, obsolescence migration, failure analysis, and recovering firmware you own but lost the source for — and that’s the work we take. If you want the reasoning spelled out, we cover the legal position on reverse engineering separately.
What drives the price and the schedule
No two industrial boards price the same, and layer count alone doesn’t tell you much. The real cost drivers:
- Net and component count — the single biggest factor, because tracing and verification scale with nets.
- Layer count and whether inner layers need separation — a six-layer board is not three times a two-layer board, it’s more.
- BGA and fine-pitch packages — X-ray work, ball mapping, and slower assembly.
- Coating or potting — extra prep hours before any imaging can start.
- Obsolete parts
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quoteRelated reading