Reverse Engineering a Circuit Board

A machine on your production floor stops working. The controller board inside it was designed by a company that no longer exists: no schematics, no source files, no spares. Or a legacy product you own has shipped for a decade on a board nobody at your company understands anymore, and its microcontroller just went obsolete. The same question comes up: can we take this board apart, figure out what it does, and rebuild it? In the United States the answer is usually yes — but the boundaries matter, and so does the price tag.

What US law actually permits

Reverse engineering a lawfully obtained product to learn how it works is generally permitted in the US, and trade secret law explicitly recognizes it: under the Defend Trade Secrets Act and the state-level Uniform Trade Secrets Act, a secret you derive by examining a product you bought is not misappropriated. Interoperability and repair are the strongest fact patterns of all — figuring out a connector pinout so your accessory can talk to a host, or recovering a schematic so a machine can be maintained.

The limits are just as real, and each one is a separate body of law:

• Patents. Studying a patented circuit is fine. Building and selling something that reads on a live claim is infringement, regardless of how you learned the design — independent development is not a defense against a patent the way it is against a trade secret. If you intend to ship, that is a freedom-to-operate question.
• Mask works. The Semiconductor Chip Protection Act protects an integrated circuit's layout. It exempts reverse engineering for analysis and teaching, but copying a mask work into your own silicon is not covered.
• Copyright in firmware. Extracting a binary from flash and loading the same image onto your board is copying software. Reading it to understand behavior, then writing your own, is a different act.
• Contracts. An NDA, a supply agreement, or a click-through license with a no-reverse-engineering clause can bind you where general law would not.
• Technical protection measures. Circumventing an access control that guards copyrighted code implicates Section 1201 of the copyright act. The exemptions — consumer device repair, some security research — are narrow and worth a lawyer's read before you defeat a read-protection fuse.

None of this makes reverse engineering a route to cloning a competitor's product. A clone lands on patents, design patents, trade dress, and firmware copyright at once, and produces a product with no defensible position of its own. The uses below are the ones that hold up.

The reasons that justify the cost

Obsolete or unsupported hardware

Industrial equipment routinely outlives its electronics. When a control board fails and no drop-in exists, recovering the schematic lets you build a modern replacement with current parts. It is the harder cousin of a component going end-of-life on a product you still ship: you are missing the design data as well as the part.

Failure analysis

Boards returning from the field with an unexplained failure sometimes have to be dissected — cross-sectioned, X-rayed, decapped — to find a cracked via, a voiding joint, or a counterfeit part. Anyone fighting fakes in the supply chain knows die-level inspection is often the only proof of what you received.

Competitive teardown for cost benchmarking

Building a BOM estimate from a competitor's product tells you what your target cost should be. You are not copying anything — you are learning that they got the job done with a four-layer board and a $1.10 microcontroller while you specified six layers and a $4 part.

Documenting a board you own

Plenty of companies ship a product whose original designer left years ago, with only Gerbers and no schematic. Recovering the design so it can be maintained and certified is housekeeping, not espionage.

How the work is actually done

The process scales with how much of the board you need to understand.

1. Non-destructive capture. High-resolution photography of both sides, a component inventory with markings recorded, and X-ray imaging to see inner-layer routing, BGA balls, and buried vias.
2. Delayering. Multilayer copies are ground or chemically etched down one layer at a time and scanned. Each board is consumed, so you need several.
3. Netlist extraction. The scanned copper is traced into a connectivity list — semi-automatically, then corrected by hand — and verified with a continuity tester.
4. Part identification. Sanded, relabeled, or house-numbered parts require electrical characterization or decapping, where the package is opened with acid or plasma so the die can be imaged.
5. Schematic recovery. The netlist becomes a readable schematic organized by function — power, clocking, analog front end, digital core. A netlist tells you what connects; a schematic tells you why, and that is where a human engineer earns the fee.
6. Rebuild and validation. The recovered design becomes a new layout that goes through a normal bring-up sequence and functional comparison against the original.

What it costs and when to skip it

As orders of magnitude: a simple two-layer analog or power board, photographed and traced, often runs $2,500–$8,000. A four- to six-layer mixed-signal board with a microcontroller and some unmarked parts is more like $15,000–$50,000 with delayering, decapping, and schematic cleanup included. Boards with FPGAs, custom ASICs, or protected firmware exceed that by a wide margin, and firmware is frequently what stalls the project entirely.

A useful rule: if the recovered design is only a starting point and you will redraw most of it anyway, a clean-sheet design guided by a teardown is cheaper and gives you IP you own. Reverse engineering pays when the exact behavior of the original must be reproduced — a controller that has to drop into an existing machine, or a legacy product where changing behavior means requalifying everything downstream. Either way, treat the recovered schematic as a real deliverable and keep it under version control. It is also a reminder worth carrying into your own designs, since the choice between trade secret and patent looks different once you know a circuit can be recovered from a purchased unit for a five-figure fee.

Projects House recovers schematics from undocumented boards, runs failure analysis on returned hardware, and redesigns obsolete control electronics with parts still in production. Tell us what board you are holding through the contact form.