Cost for medical device PCB reverse engineering is driven by five things: layer count, board area, component count, whether there are BGAs or potting, and whether firmware has to come out of a locked MCU. Lead time runs from a few days for a simple two-layer sensor interface board to several weeks for an eight-layer imaging control board with a shielded RF section. Send photos and a board description and you get a feasibility answer, a price, and a date — usually within a working day.
This page is written for the person who already has the board in hand: a biomedical engineer keeping a fleet of analyzers alive, or a product owner whose original layout files vanished with a contract design house that closed in 2013.
Why medical boards behave differently from ordinary industrial boards
Medical electronics carries design constraints that show up directly in reverse engineering work. Patient-connected front ends have creepage and clearance gaps that look wasteful until you realize they’re intentional — you cannot “tidy up” a reconstructed layout without breaking the isolation barrier. Optocouplers, isolation transformers, and Y-capacitors sit on that barrier, and the barrier has to survive into any recovered design.
Second, analog precision matters more than usual. An ECG front end, a pulse oximetry channel, a capnograph amplifier — these use guard rings, star grounds, and deliberately asymmetric copper pours. A netlist that’s electrically correct but geometrically sloppy will produce a board that boots and still fails at the microvolt level. So the reconstruction has to preserve trace geometry, not just connectivity.
Third, these boards tend to be old. Infusion pumps, ventilators, dental X-ray generators, and lab analyzers stay in service for fifteen or twenty years. That means obsolete parts, discontinued custom magnetics, and house-marked chips with the vendor’s own part number sanded onto the top.
Common medical board types we see
- Patient monitor motherboards and parameter modules (ECG, SpO2, NIBP, temp)
- Infusion and syringe pump motor control and door-sensor boards
- Ventilator valve driver and pressure sensor interface boards
- Dialysis machine I/O and pump control boards
- Lab analyzer stepper and photometer boards
- Dental and veterinary imaging generator control boards
- Ultrasound front-end and power distribution boards
- Surgical tool handpiece boards and ESU control boards
What actually happens to your board, in order
The sequence below is what a medical board goes through in the lab. Nothing here is exotic — it’s just careful work done in a fixed order so mistakes get caught.
- Intake and photography. High-resolution scans of both sides, plus macro shots of every marked part. Silkscreen, revision number, date codes, and any conformal coating are recorded before anything is touched.
- Coating assessment. Most medical boards are conformally coated — acrylic, urethane, or silicone. The coating type determines whether it comes off chemically, thermally, or mechanically, and that decision happens before a single component is removed.
- X-ray, when the board needs it. BGAs, QFNs with hidden thermal pads, and any board with buried vias get imaged so inner-layer connections and via structures are understood before delamination.
- Component identification. Every part is read, measured, or cross-referenced. House-marked parts get identified by package, pinout behavior, and in-circuit measurement — the honest answer sometimes is “this is a custom ASIC and it cannot be sourced.”
- Desoldering and layer separation. Parts come off in a mapped order. The bare board is then separated layer by layer, each copper layer scanned before the next is removed. This step is destructive and irreversible, which is why intake photography is thorough.
- Layout reconstruction. Copper images are aligned to the drill map and redrawn as a full stackup with pad stacks, clearances, and copper weights. Isolation gaps get measured and preserved, not approximated.
- Netlist and schematic capture. The netlist comes out of the reconstructed layout, then gets organized into a readable schematic — power tree, isolation barrier, analog front end, MCU section, connectors — instead of a single unreadable sheet.
- Verification. The reconstructed netlist is checked back against the original assembly with a continuity meter on a sampled set of nets, with 100% checks on power, ground, and every net crossing the isolation barrier.
Where the design will be re-manufactured, output is checked against IPC-A-600 and IPC-6012 acceptability criteria, and trace widths are sanity-checked against IPC-2152 current-carrying guidance rather than blindly copied. If the original designer under-sized a trace, you should know about it.
What drives the price up or down
We don’t publish a fixed price because the same “medical board” can mean a $40 thermistor interface or a 10-layer imaging controller. Here’s the honest mapping of complexity to effort.
| Board class | Typical example | Relative effort | Lead time character |
|---|---|---|---|
| 2-layer, through-hole and basic SMD | Sensor interface, keypad, door switch board | Lowest | A few days |
| 4-layer, moderate density, no BGA | Pump motor control, valve driver | Moderate | Around one to two weeks |
| 4–6 layer with isolation barrier and precision analog | ECG / SpO2 parameter module | High | Two weeks and up |
| 6–10 layer with BGA, blind or buried vias | Monitor motherboard, ultrasound front end | Highest | Several weeks |
| Any of the above plus locked MCU firmware | Board that won’t function without its original code | Separate scope | Assessed independently |
Other real cost factors: potted or epoxy-encapsulated sections, flex or rigid-flex sections that can’t be delaminated the same way as FR-4, boards larger than roughly a hand span (more scan tiling, more alignment work), and connectors or magnetics that need custom sourcing. If you want to see the general cost logic outside a medical context, our breakdown of how much PCB reverse engineering costs covers the same variables.
Cost goes down when you can send two identical boards. One gets sacrificed for layer separation, the other stays intact as a live reference for verification. That single decision removes the most tedious guesswork in the whole job.
Firmware: the part most people underestimate
A recovered layout and BOM gets you a blank board. If the original controller is a locked STM32, PIC18F, MSP430, or 8051 derivative, the board won’t do anything without its code. This is where most medical projects stall.
Feasibility depends entirely on the part and its protection state. STM32 devices behave very differently at RDP Level 1 versus Level 2. MSP430 parts with the JTAG fuse blown and no known BSL password are a different problem again. AVR and 8051 families rely on lock bits with widely varying implementations across process generations. None of these are guaranteed, and anyone telling you otherwise is guessing.
What we can tell you honestly, before you commit money: whether your specific part number and date code falls into a family we’ve worked with, what approach would apply, and what the realistic outcome range looks like. Send the exact chip marking — all lines of it, including the date code and the letter suffixes. On some families the difference between two revisions is the difference between feasible and not.
Legitimate use here means firmware you own but lost the source or hex for, equipment you maintain and need to keep in service, or a part going obsolete that forces migration. You need to hold the rights to the design, and complying with applicable IP and medical-device regulation is on your side; we work under NDA on every project.
What to send us, and what comes back
What we need from you
- Photos of both sides of the board on a dark, non-reflective background. Whole board in frame, in focus, taken square-on rather than at an angle.
- Board dimensions in mm, and the thickness if you can measure it with calipers.
- Layer count if you know it — if you don’t, say so, and we’ll determine it.
- The main chip marking, typed out exactly, plus a close-up photo. Same for any house-marked or unmarked parts.
- One line on deliverables: schematic only, schematic plus BOM, full manufacturing files, or files plus working boards.
- Any context you have. “This is the valve driver from a 2009 ventilator, one channel reads zero” changes how we approach verification.
What you get back
First, a feasibility read: what’s straightforward, what’s uncertain, and what we’d flag as risky. Then a price and a lead time. On the delivery side, the standard set is a layered layout file, Gerbers with drill data, a hierarchical schematic, a BOM with manufacturer part numbers and obsolescence notes, and a pick-and-place file if assembly follows. Testing and small-run builds can be added — the workflow is similar to what we run on power supply boards, where verification under load matters as much as the files.
Cases that are harder, and cases we’ll turn down
Being upfront about this saves everyone time.
- Fully potted modules. High-voltage sections in X-ray generators and defibrillator boards are often encapsulated in hard epoxy. Removal damages components and sometimes the copper underneath. Feasible sometimes, never quick, occasionally impossible.
- Custom ASICs and house-marked mixed-signal parts. We can identify the function and pinout behavior, but if a part was made for one OEM under a single-source agreement, there’s nothing to buy. The files will be correct
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quoteRelated reading