What Is Elevator Control PCB Reverse Engineering?
Elevator control PCB reverse engineering is the process of extracting a complete design package—schematic, Gerber fabrication files, and bill of materials—from an existing physical elevator controller board. It is used when the original manufacturer has discontinued the board, withheld documentation, or ceased operations entirely. Our engineers work from the bare board and its populated components to rebuild every copper layer, net connection, and component value so a functionally identical replacement can be fabricated and assembled.
Why Elevator Boards Need Reverse Engineering
Commercial and residential elevators are certified for 20–25 year service lives, but the control electronics inside them rarely last that long. A single failed main processor board from a 2005-era lift controller can ground an entire car, and the OEM may quote 14–20 weeks for a replacement—if they still stock it at all.
Common triggers we see:
- OEM discontinuation. Brands like Otis, Schindler, KONE, and ThyssenKrupp refresh controller platforms every 8–12 years. Older boards (e.g., Otis GECB, Schindler QKS9/11) become unavailable.
- Single-source lock-in. Proprietary CAN-bus or serial protocols mean generic boards cannot substitute without the original design data.
- Multi-car fleet standardization. Building managers with 4–8 elevators want a small stock of spares rather than depending on emergency OEM orders.
- Regulatory re-certification. EN 81-20/50 or ASME A17.1 compliance audits sometimes require documented schematics the owner never received.
Typical Elevator Control Board Characteristics
| Parameter | Common Range | Engineering Note |
|---|---|---|
| Layer count | 4–6 layers | Older relay-logic boards may be 2-layer; modern VVVF drive interfaces reach 6 |
| Board dimensions | 160 × 100 mm to 320 × 220 mm (Eurocard to custom) | DIN-rail or card-cage mounting common |
| Trace / space | 6/6 mil (0.15 mm) digital; 15/15 mil power | Mixed-signal layouts with high-current motor driver traces up to 3 oz Cu |
| Key ICs | Renesas H8/SH, NXP LPC, Freescale 68K, TI C2000 DSP | Many use mask-ROM or OTP MCUs—firmware recovery requires decap or ISP |
| Power section | IGBT gate drivers, 24 V / 110 V relay outputs | Creepage/clearance per IEC 60664-1 must be preserved in Gerber output |
| Connectors | DIN 41612, Molex Mini-Fit Jr, Phoenix COMBICON | Pin mapping to shaft encoder, door operator, and safety chain is critical |
| Conformal coating | Frequent (humidity in hoistways) | Must be chemically stripped before component-side imaging |
How We Reverse Engineer an Elevator Controller Board
Step 1 — Intake and Visual Inspection
We photograph every side at 1200 dpi, log connector pinouts, and note any field modifications (cut traces, bodge wires). Conformal coating is stripped with a micro-abrasive or solvent bath appropriate to the coating type (acrylic vs. silicone vs. urethane).
Step 2 — Component Cataloging (BOM Extraction)
Each component is identified by markings, package, and measured value. For elevator boards this often means decoding house-numbered ASICs or relabeled gate arrays—we cross-reference die photos and functional testing against known equivalents. A typical elevator main board carries 350–600 discrete components.
Step 3 — Layer-by-Layer Imaging
After desoldering all components, we scan each copper layer. For 4-layer boards, inner layers are exposed by controlled chemical etching or precision milling. Each layer is digitized at ≥2400 dpi and aligned to fiducials within ±0.5 mil (0.013 mm).
Step 4 — Schematic and Netlist Capture
Our engineers reconstruct the schematic by tracing every net from the Gerber artwork back through the component map. Elevator boards demand extra care around the safety chain (governor, door lock, pit switch, buffer) because a single missed net in that circuit can prevent re-certification.
Step 5 — Gerber Output and DRC
Final Gerbers are run through DRC against IPC-2221B Class 2 (minimum) or Class 3 when the client specifies. We deliver in Gerber X2, ODB++, or native Altium/KiCad format. Drill files, stackup specifications, impedance targets for CAN/RS-485 differential pairs, and solder-paste stencil data are included.
Step 6 — Firmware Recovery (If Authorized)
When the client owns the IP or has written authorization from the rights holder, we can attempt MCU readout via JTAG, ISP, or—where code-protection fuses are set—decapsulation and micro-probing. Success depends on the specific device; Renesas H8S parts with on-chip flash typically have a moderate recovery rate, while mask-ROM 68K devices require a different workflow. We always provide a feasibility assessment before quoting firmware work.
What Deliverables Do You Receive?
| Deliverable | Format | Included By Default |
|---|---|---|
| Schematic | PDF + native (Altium / KiCad) | Yes |
| Gerber fabrication set | Gerber X2 / RS-274X + Excellon drill | Yes |
| Bill of materials | Excel with MPN, manufacturer, package, alternates | Yes |
| Stackup drawing | Yes (≥4 layers) | |
| Assembly drawing + pick-and-place | PDF + CSV | Yes |
| Firmware binary | .hex / .bin | Only with IP authorization |
| Functional test procedure | Optional add-on |
Cost and Turnaround for Elevator PCB Reverse Engineering
Pricing depends on layer count, component density, and whether firmware recovery is needed. The ranges below reflect boards we have completed in the past 24 months:
| Board Complexity | Layers | Typical Cost (USD) | Turnaround (Working Days) |
|---|---|---|---|
| Simple relay/logic board | 2 | $600 – $1,200 | 7 – 10 |
| Mid-range processor board | 4 | $1,200 – $2,500 | 10 – 15 |
| VVVF drive interface / multi-MCU | 6 | $2,500 – $4,500 | 15 – 22 |
| Firmware recovery add-on | — | $300 – $1,500 | +5 – 10 |
Rush service (50% surcharge) can compress turnaround by roughly 40%. We provide a binding quote within 48 hours of receiving the board or high-resolution photos.
Challenges Specific to Elevator Control Boards
- Mixed high-voltage and logic. A single board may carry 300 V DC bus traces alongside 3.3 V MCU lines. Creepage distances must be captured accurately—our Gerber output preserves every clearance to IEC 60664-1 standards.
- Proprietary communication protocols. Many lift OEMs use non-standard CAN application layers or serial encodings for car-call, hall-call, and group-dispatch data. We document the physical interface (termination, baud rate, connector pinout) but protocol-level decoding is scoped separately.
- Safety-chain integrity. The series safety circuit (governor switch → door locks → pit switch → buffer switch → car-top emergency stop) is a hard compliance requirement. We flag every safety-chain net in the schematic and verify continuity against the physical board.
- Obsolete passives and connectors. DIN 41612 96-pin connectors and certain Schrack relay footprints are still available but with long lead times. Our BOM lists verified alternates sourced from Mouser, Digi-Key, and LCSC.
Who Uses This Service?
Elevator maintenance companies managing fleets of 50+ units are our most common clients. Independent elevator consultants, building management firms, and modernization contractors also use reverse-engineered documentation to source competitive bids for replacement boards rather than accepting sole-source OEM pricing.
The same methodology applies to related building-infrastructure electronics. We regularly handle building access control boards, HVAC controller reverse engineering, and surveillance system controller boards—all of which share the long-lifecycle, OEM-dependent supply chain problem.
Related Industry Board Recovery
Vertical-transport electronics sit within a broader category of safety-critical building and industrial control systems. If you manage equipment across multiple domains, our process is equally proven for inverter drive controller boards and railway signalling electronics, both of which share the mixed-voltage, safety-chain design patterns found in elevator controllers.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewCan you reverse engineer an elevator board without the original firmware?
Yes. The hardware reverse engineering—schematic, Gerber, and BOM—does not require firmware. You receive a complete fabrication package. Firmware recovery is a separate, optional service that requires proof of IP ownership or written OEM authorization. Many clients use the hardware package to have their own engineers rewrite application code for a modern MCU.
Will the cloned board pass elevator safety certification?
Our Gerber output preserves all original creepage, clearance, and trace geometry. However, certification (EN 81-20/50, ASME A17.1) is performed by a Notified Body or AHJ, not by the board manufacturer. We provide the documentation package—stackup, schematic, test points—that the certifier will request, and we can adjust the design to meet specific inspector requirements on request.
How do you handle boards with conformal coating or potting compound?
Conformal coatings (acrylic, silicone, urethane) are chemically stripped in a controlled bath. Potted assemblies are more complex—we use thermal cycling and mechanical decapsulation. Potting adds roughly 2–4 working days and $200–$500 to the project, depending on volume and compound hardness.
What information do you need to provide a quote?
At minimum: clear photos of both sides of the board, approximate dimensions, and the elevator make/model if known. If you can count the layer edges visible at the board profile, that helps. We return a binding quote within 48 hours. For faster assessment, ship the board directly—initial evaluation is free.
Do you support boards from Chinese elevator OEMs (Xizi Otis, STEP, Monarch)?
Yes. We routinely work with boards from Xizi Otis AS380-series drives, STEP integrated controllers, and Monarch NICE3000+ systems. Component sourcing is typically easier for these boards since many use standard STM32 or Infineon MCUs, which keeps cost and turnaround at the lower end of our range.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote