Motor control PCB reverse engineering is usually priced off four things: layer count, component count, whether the power stage and gate drives have to be characterized, and whether firmware in the control MCU or DSP is part of the job. A simple two-layer speed controller with a through-hole MCU is a short job. A six-layer servo drive with a TMS320 DSP, current-sense amplifiers, and a resolver front end is a meaningfully longer one. Send photos plus the board dimensions and we can tell you which side of that line you’re on.
Why motor control boards cost more than they look like they should
From the outside, a motor drive board looks straightforward: a rectifier, a bulk cap, six IGBTs or MOSFETs, a gate driver, and a microcontroller. The trap is everything between those blocks.
Motor control layouts carry three electrically separate zones on one piece of laminate — high-voltage DC bus, isolated gate drive, and low-voltage logic. Reverse engineering the copper is only half the work. The other half is documenting where isolation barriers sit, which optocouplers or digital isolators cross them, and how the creepage and clearance gaps were laid out. Get that wrong on a rebuild and you either fail hipot or you fail in the field.
Then there’s the copper itself. Heavy-copper pours on the DC bus and phase outputs are often 2 oz or heavier, and the phase nodes fan out into wide irregular polygons rather than clean traces. Tracing a 3 mm-wide pour that runs under a capacitor bank and disappears into an inner plane takes more time per net than tracing a signal trace on a logic board. IPC-2152 is the reference we use when we have to sanity-check whether a recovered geometry can actually carry the current the drive is rated for.
Finally, motor control boards are frequently field-returned units. Blown MOSFETs, cratered shunt resistors, burned gate resistors, and lifted pads all mean the board in front of the engineer is not the board as designed. That’s recoverable, but it adds inspection time and sometimes requires a second sample.
The parts that eat the schedule
- Gate drive networks. Each half-bridge has its own bootstrap diode, gate resistors, sometimes split source/sink resistors, a Zener clamp, and a desat sense line. Six of them, all nearly identical, all needing individual verification because one leg is often different.
- Current sensing. Shunt-plus-differential-amp, Hall sensor, or current transformer — each implies a different filter chain and a different scaling calculation you have to work out from resistor values.
- Feedback interfaces. Encoder, resolver, or sensorless back-EMF sensing. Resolver front ends with excitation drivers are the slowest of the three to document.
- Snubbers and protection. RC snubbers, TVS diodes, MOVs, and NTC inrush limiters are small parts with unmarked values that often need measurement, not reading.
- Buried planes. On a four- or six-layer drive board, the mid-layers usually split into isolated islands rather than one solid ground. Each island has to be imaged and outlined separately.
What a realistic lead time looks like by board class
We don’t publish a fixed day count, because a quote that ignores your specific board is worthless. What we can give you is the relative ranking, which is what most people actually need when they’re planning a repair window or a production restart.
| Board class | Typical example | Relative effort |
|---|---|---|
| 2-layer, through-hole | Single-phase fan or pump speed controller, TRIAC or simple PWM | Shortest — copper is visible from both sides, few hidden nets |
| 2-layer, mixed SMD | Brushed DC drive with 8-bit MCU and discrete H-bridge | Short, but component identification adds a step |
| 4-layer BLDC / PMSM controller | 3-phase inverter, gate driver IC, STM32 or PIC control | Moderate — inner layers need separation and imaging |
| 4–6 layer servo drive | DSP control, encoder/resolver interface, isolated comms | Long — dense fine-pitch parts, multiple isolation domains |
| 6+ layer with BGA | Multi-axis drive, FPGA or SoC, high-speed feedback bus | Longest — X-ray on the BGA, careful net-by-net verification |
| Any of the above + firmware | Locked MCU/DSP holding the control loop | Runs in parallel, but feasibility has to be assessed first |
Two things stretch the schedule more than layer count does. One is potting — a lot of industrial drive control cards are conformal-coated or fully potted, and getting the resin off without destroying fine traces is slow, manual work. The other is a board that arrives with damage in the exact area you need to read.
What drives the price, item by item
If you want to estimate before you ask, weigh these in roughly this order:
- Layer count. Every added layer means another delamination step, another set of scans, and another pass of net reconciliation. Going from two layers to four is a bigger jump than going from four to six.
- Board area and net count. A 300 mm × 200 mm drive card with 900 components costs more to document than a 60 mm × 40 mm controller with 80.
- Package types. QFN and 0402 passives are fine. Fine-pitch BGA under the DSP means X-ray imaging of the hidden ball pattern before any net tracing can be trusted.
- Deliverable set. Gerbers alone is one price. Gerbers plus a full hierarchical schematic plus a BOM with sourceable part numbers is another. Add functional verification on a rebuilt sample and it’s another step again.
- Unmarked and custom parts. Motor control boards love laser-marked house-number chips, custom magnetics, and sanded-off gate driver ICs. Identifying those by function and pinout is analysis work, not lookup work.
- Firmware. Whether code readout is needed at all, and which family the controller belongs to, changes both the price and the risk profile.
For a broader view of how these same factors play out across other board types, our page on what reverse engineering a board typically costs breaks the drivers down without a specific application in mind. If your board is more of a stand-alone inverter or amplifier stage than a control card, the notes on drive-stage board recovery are closer to your case.
Firmware in the control MCU: when it matters and when it doesn’t
Plenty of motor control jobs need no firmware work. If you’re rebuilding an obsolete board and you still have the hex file or you can rebuild from source, we recover the hardware and you flash it. Done.
The hard version is when the source and the binary are both gone — the engineer retired, the contractor closed, the build server died — and the only copy of the control loop lives inside a locked microcontroller on the board. Common ones we see on motor control hardware are STM32F1 and F4 parts, PIC18F and dsPIC33, C2000-family TMS320 DSPs, and older 8051 derivatives on legacy VFDs.
Feasibility depends entirely on the specific part and how it was configured. On STM32 parts, RDP Level 1 and RDP Level 2 are very different problems. On MSP430 designs, whether the JTAG fuse was blown and whether a BSL password was set changes the whole approach. On 8051 and AVR derivatives, which lock bits were programmed matters. We assess this before quoting rather than after, and we tell you when the honest answer is “probably not on this part.”
We work on the assumption that you hold the rights to the design you’re asking us to document — recovering your own lost firmware, keeping out-of-production equipment running, migrating off an obsolete controller. You’re responsible for that, we run everything under NDA, and we don’t take jobs that look like someone else’s product.
Exactly what to send us, and exactly what comes back
Most quote requests stall because the photos aren’t usable. Here’s what actually gets you an answer the same working day:
- Photos of both sides, whole board in frame, shot straight down on a dark non-reflective background. Even lighting, no flash glare on the solder mask.
- Close-ups of the control MCU or DSP marking, the gate driver IC, and any part where the top marking is worn or laser-etched.
- Board dimensions in mm, and your best guess at layer count if you know it.
- Motor and drive ratings — voltage, phase count, current, motor type. This tells us what the power stage has to be, which helps us scope the analog side.
- One line on deliverables: Gerbers only, Gerbers plus schematic, full package with BOM, or full package plus working samples.
- Whether the sample works. A functioning board can be probed live and verified against measurement; a dead one can’t.
What comes back is a feasibility read on the specific board, a lead time, and a price for the deliverable set you asked for. If we think one deliverable tier is a waste of your money — for example, a full schematic when all you need is a manufacturable Gerber set — we’ll say so.
What the engineer is actually doing
Sample intake and photo documentation first, then component identification and measurement of every passive we can read in circuit. Desolder and catalog. Scan the outer layers, then separate and image the inner layers one at a time, aligning each against the drill pattern. Rebuild the netlist, then reconcile it net by net against continuity measurements on the bare board — that reconciliation step is where errors get caught, and it’s the step cheap vendors skip. Schematic capture last, organized into functional blocks: bus and rectifier, gate drive per phase, current sense, control, feedback, comms.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote