If you’ve ever had a particularly nasty fracture, your doctor may have prescribed the use of an electronic bone growth stimulator. These wearable devices produce a pulsed electromagnetic field (PEMF) around the bone, which has been shown to speed up the natural healing process in a statistically significant number of patients. That’s not to say there isn’t a debate about how effective they actually are, but studies haven’t shown any downsides to the therapy, so it’s worth trying at least.
When you receive one of these devices, it will be programmed to only operate for a certain amount of time or number of sessions. Once you’ve “used up” the bone stimulator, it’s functionally worthless. As you might imagine, there’s no technical reason this has to be the case. The cynic would say the only reason these devices have an expiration date on them is because the manufacturer wants to keep them from hitting the second hand market, but such a debate is perhaps outside the scope of these pages.
The Orthofix SpinalStim you’re seeing here was given to me by a friend after their doctor said the therapy could be cut short. This provided a somewhat rare opportunity to observe the device before it deactivated itself, which I’d hoped would let me take a closer look at how it actually operated.
As you’ll soon see, things unfortunately didn’t work out that way. But that doesn’t mean the effort was fruitless, and there may yet be hope for hacking these devices should anyone feel like taking up the challenge.
Keeping it Simple
Since the SpinalStim is designed to produce an electromagnetic field around the spine, it’s not hard to guess that the foam-covered “back brace” contains some kind of coil. But being a high-tech medical device, you might imagine there’s some exotic materials or techniques involved. As it turns out, there isn’t.
Cutting the foam lining away from the brace in an operation not entirely unlike gutting a fish, we can see there’s nothing very special going on here. It’s just a dozen or so loops of two conductor insulated wire that’s held together with, as far as I can tell, painter’s masking tape.
It’s not even like they made a neat coil; pulling the rest off the foam off, there are areas where the wires overlap a bit. I would have thought they’d use some kind of flexible loom to hold the wires in place, but apparently the foam of the brace itself was considered enough to keep the wires flat.
Taking a close look at the four pin connector that goes into the back of the control unit, we can see that the wires have actually been twisted together and crimped to both conductors in the yellow cable. The loop itself is connected to another identical arrangement located on the other side of the brace by a wire hidden in one of the straps that holds them together.
Taking Control
With construction techniques not far removed from a grade school science project, I’ll admit the coils were something of a letdown. But luckily the Control Unit is a bit more interesting. As the SpinalStim has no patient-accessible settings, this device is simplistic in the extreme: just a single button to turn it on and off and a USB-B port for charging. It does however have a rather nice LCD display that indicates the battery level and how much treatment time is left. The screen is even backlit, which seems somewhat unnecessary, but is perhaps beneficial for elderly users who might have trouble seeing the display otherwise.
Both inside and out, the Control Unit is much closer to what I was expecting from a medical device. It’s got considerable heft thanks to internal battery pack, and the thick enclosure with o-ring seals is really quite impressive. Between all the wire you can pull from the coils and this beefy electronics enclosure, there’s a surprising amount of salvage value in this device already.
On the reverse side of the PCB, we can see a few interesting details. Chief among them are the dedicated programming headers for the device’s STM32 microcontroller and nRF Bluetooth Low Energy chipset. We usually have to hunt around for useful debug or programming interfaces, so to see them not only labelled but actually populated with pins is really a treat. We can also see the backup battery used to keep the device’s internal timer ticking even if the primary battery dies, and a bank of capacitors that are likely used to build up a charge to fire through the coil.
Peeling the firmware release sticker off of the microcontroller reveals it to be the very common STM32F103, and removing the board’s RF shield uncovers another chip Hackaday readers will likely be familiar with, the nRF51822. The presence of these well documented chips certainly bodes well for any potential reverse engineering or repurposing of the device.
An Investigation Cut Short
At this point, I was hoping to get the Orthofix SpinalStim hooked up to the oscilloscope and take a look at what kind of signal it was passing through the coil, but it was not to be. After putting the Control Unit back together, I’m now immediately greeted with an angry beep and an error message.
Just like the VeriFone MX 925CTLS payment terminal we looked at last year, it would seem the SpinalStim is designed to “self-destruct” once it’s been opened. I didn’t notice any obvious triggers like we saw in the VeriFone, but I’m assuming when I disconnected the battery it was enough for the device to realize something was amiss. This is probably designed to prevent users from trying to reset the device’s internal counter, which seems to have been a problem on older bone stimulators.
While I’m disappointed the SpinalStim swallowed its cyanide pill rather than submit to further interrogation, the hardware uncovered in the Control Unit certainly looks ripe for further hacking. We’ve seen medical devices reverse engineered to unlock new capabilities in the past, and while there might not be a huge demand for a FOSS bone growth simulator firmware, it seems the possibility is there for anyone who wants to free these devices from their arbitrary limitations.
Giving up way too easily. Should verify if controller is locked and if you can get into firmware. Or connect debugger and potentially trace down what branched the code to the error message.
Would wager the firmware isn’t going to have any exotic defense mechanisms.
Yeah, there are the known vulnerabilities in STM32F103 code protection also https://blog.zapb.de/stm32f1-exceptional-failure/
This looks like the way to get into it. I’ll just have to read that like 300 more times but that board is on amazon and cheap. And I think I might know a guy that plays around with arduino. These devices are absolutely worth it. I really wish the comments were only about the hobby and learning instead of opinions of a device and steering others from following their aspirations.
Funny, I have 2 of these sitting here on my “When I have time” shelf. My mother has had a few back surgeries and they give her a new one every time. Glad I read this, now I know about the self destruct.
Did the devices help make the recovery better or is this just snake oil?
Probably snake oil. I’ve been prescribed this stuff after knee injury. Basicaly it is overpriced placebo just to get your body more time to heal itself and then they claim the merits. They put my leg in such device in the hospital (device was not portable). I’ve been curious enough to test it using small neodimum magnet and it actualy slightly vibrated when it was close to the coil. Also smartphone magnetometer was able to capture the activity.
But the device had small speaker making terrible screeching noise, which was designed to sound like the machine does something intense. That was a red flag for me, because such device if properly designed should make little to no noise. So this was just to increase the placebo effect and make the nurse go nuts…
I can definitely see the possibility for nocebo effects when you have a therapeutic device that appears completely inert, even though it’s working properly. Or even just having difficulty distinguishing between a device that’s working and one that’s faulty or not switched on properly.
Having some sort of obvious noise or vibration while it’s active may have no therapeutic value but it could be a simple and utterly safe way of eliminating those undesirable issues.
I love your answer @pelrun. I like that idea. This means my doctors are stealing 4 hours a day of wearing this. I wonder if it is actually used as a pseudo-psycolgy agent trying to prevent us from doing silly things like drive my John Deere off a cliff.
Hello, so I can attest to the benefits. 4 months after neck surgery, my bone was not growing fast enough to replace the cadaver bone temporarily put in. So my doctor prescribed me an orthofix 5055 for the neck and because my insurance wouldn’t cover the cost, I went to ebay. In 1 month it generated more bone than the 4 months prior. A few weeks later, the device self errored out. I didn’t get another one because I thought I’d be ok.
Well, 3 months later, the xray should no significant growth, definitely nothing like the previous xray comparison. So now I got another one off ebay and wearing it.
You can’t feel a difference, and if it weren’t for the xray, I thought it would be snake oil too. Enough to where I was willing to spring $2500 to buy one if I couldn’t find it on ebay.
Hope that helps.
I’ve been using a a DJO Spinalogic CMFV bone stim for 5 months. Bone growth is real, verified by xrays, and I feel great. Hack: Set your cell phone timer for 28 minutes. Turn on the DJO. Remove battery every 28 minutes. Repeat all day. This unit is programmed to deliver 30 min per day, for 6 months. If the 9v battery dies, the DJO allows the user to insert new batt and restart the treatment for that day. It will self destruct at the end of Day 180, according to manufacturer. I had spinal fusion surgery L3-L4-L5. Cleaned out my nerve passages at the same time. No more sciatia leg pain! No back pain! Surgeon justified the DME due to PT being old and obese. Med ins covered it. June2023
Wind a coil about 3″ in diameter and 5 turns. Connect to a high impedance scope probe and look at the induced field with the unit operating and on a person to load the field.
I’m glad someone at least got this far on one of these. I broke my foot back in 2018 and thought I was gonna need one of these(but thankfully didn’t), which wasn’t good because the cost was insane and as luck would have it, our insurance was going away at the end of that month so if I ended up needing one, I was gonna hafta pay out of pocket. I started looking into hacking one of these and realized from what I’d read that really the big thing would be to get an idea of the waveform and frequency that way if the firmware were impenetrable, at least we could replicate the function with a microcontroller and some amplifier circuitry. It wouldn’t be ideal but it would make it more accessible.
Check the mounting holes on the board. They are labeled AH 1-4. If there are any traces other than ground this may be the anti-tamper mechanism. See what is connected in the case.
My guess would be something on the battery pack – a 5pin connector is excessive for ‘just a battery’. Bet at least one of the pins goes to the Nordic chip which is watching it while in (very low power) sleep – I suspect the backup battery has plenty enough to support that.
The battery does have a five-pin connector, but it seems to use only three pins. Obviously + and -, and probably a resistive thermal sensor, forming a “stupid” battery pack. There are “smart” battery packs used in both medical equipment and IT equipment that come with an I²C-/SMbus-interface, so you need pins for +, -, clock, and data. And finally, there are “smart plus stupid” battery packs that offer both a simple resistive thermal sensor and an I²C-/SMbus-interface. Those packs obviously need five pins.
Looks like I didn’t include the picture of it in any of the galleries, but there’s actually a little pinout chart on the battery label. Two negative wires, two positive, and one yellow for the NTC so the board can check the cell temperature while charging.
Nothing inherently unusual about the wiring given the application, but the chip could absolutely be watching the NTC line to detect if the cable has been unplugged.
Couldn’t someone just record the magnetic filed changes that it produces while in operation?
I think some cheap (3axis?) compass module could make some nice representation how the magnetic field changes.
Maybe a smartphone could do the same (for example android app: Science Journal)
Depends on the frequency of the magnetic field. A lot of compass modules might go up to 10hz, but this thing could easily be operating in the khz or mhz range. An O-Scope on the wire would be useful but not really a mag sensor.
> beneficial for elderly users
Why specify “elderly” in this context?
Because eyesight degrades with age?
But non elderly people can have degraded eyesight.
Because they’re more likely to have broken bones, due to having all that time in retirement to go hang gliding, rock climbing, skydiving etc.
But non elderly people can have broken bones.
That’s okay, for those we can include a small sachet of capsaicin with the instructions to apply to eyes before use if they find the display too clear.
Because elderly people have reduced bone density, reduced balance (this more prone to falls and breaks), and worse eyesight, compared both to the general population and their own younger selves.
Thus they’re a good market for these, and will benefit from the backlit display.
Young people can have various eyesight issues, but most of them aren’t helped by backlit displays, whereas older folks’ eyesight deterioration is more likely to benefit from a backlight.
There’s room for a push button near the nRF chip. What could this be for ?
Maybe serial boot button?
Q6 looks like a SPI flash chip, this is likely where they store the settings.
A good guess, but a search for the number on the chip (FDMC 510P) seems to indicate it’s a MOSFET commonly used in smartphones/tablets to control the backlight. Presumably it’s pulling similar duty here.
I think you’ve already uncovered the reason for the high cost of U.S. medical care.
Whilst the usage-limit on the device could be a money-grab, most medical devices don’t have a usage-limit on them.
I’d suspect they were worried about people overusing them. The studies probably showed benefits from one 15 mins session per day, for a month, or something, and there may be a worry that if someone uses it 24/7 they’ll give themselves cancer or something. Maybe studies showed overuse was an issue? Maybe wearing it too long can cause problems (backache from the weight, etc). Maybe they’re just worried because no one studied what happens if you use it 24/7.
Or maybe there’s a risk people will repurpose it to self-medicate another patient for whom it’s not appropriate and who needs to go see a doctor. Or perhaps the params on the device are tweaked per-patient?
However, given it probably just needs a re-config, or at worst a battery replacement, it’s disappointing if it can’t be returned for a deposit.
The minimum dosage on this is 4 hours a day. I asked my doctor what’s the max, and he said to wear it as much as I could. Can’t over wear it.
It lasts about 8 hours on a single charge. Takes about an hour to charge. And so I wear it about 16 hours a day. Basically while I’m awake.
I’m a previous post, I shared that I’ve seen xray evidence of its effectiveness. Seen photos before wearing, after wearing, and then after not wearing. Huge difference.
Ugh, why stm and nrf? Why not just nrf.
Waveform information at: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5822965/
And this is why Hackaday is worth the time to read. Thank you!
Kill switches are why you do all the external operational tests you can think of before you open up enclosures.
I would be interested to know how statistically significant the number of people for whom the healing process was accelerated was, and what were the testing methodologies. A bone’s “healing process” sounds like the kind of thing that’s difficult to measure without many CT or MRI scans over the whole period of time.
I wouldn’t be surprised if there’s a significant publication bias on something like this. Those studies not returning a positive result not getting published.
Hi Shannon,
The following is *my personal opinion*, which is based on decades of involvement in the medical devices industry. I have no personal relationship or conflicting interest with any manufacturer of devices for bone growth or the other fields mentioned below.
The use of pulsed electromagnetic fields (PEMF) for bone healing was grandfathered by FDA in 1979 for treating non-union fractures. This means that these devices were available before FDA was chartered with evaluating and approving medical devices, so they keep on *clearing* them (*not approving* them) based on this grandfather provision even if they are snake oil as long as they aren’t shown to cause harm. This is what allows quack therapies that are 100% placebo like microcurrent cranial stimulation devices for pain/anxiety/insomnia/depression to be sold, and unfortunately sometimes even wastefully covered by insurance.
One “cute” point that all of these “therapies” tout is the complete lack of adverse effects. In my view, this is the first piece of evidence that they are pure placebo, because interventions that have sufficient potency to do something to the body will cause at least some undesirable side effects. The lack of side effects is a clear predictor of no clinically-relevant effects at all.
Also in my opinion, the objective evidence for non-invasive, magnetically-coupled bone healing stimulators is tenuous at best. On the other hand, I give a lot more credence to bone fusion enhancement with DC currents driven through bone from implantable bone stimulators. On the brain side, TDCS also causes significant changes, but I’m afraid that because of its simplicity is being severely misused by the hacking community.
If interested in this seeing the actual data and evaluating the studies yourself, please search for “PEMF”
Cheers,
David
The details of the effectiveness study for the Orthofix model I was given were in its user manual. From memory: More patients (something like 10-20%) had bone fusion by the X month mark (it was 6-12 months) with the treatment than without. Given enough time (i.e. 12-24 months) there was no difference in the percent of patients with successful fusion.
As to why a backlight… it was useful when using the machine in the dark. I was asked to wear it for hours a day, and it was much more convenient to wear to bed, than to wear it around the house.
Is it snake oil? Hard to say. I wasn’t worried about an electromagnet with such a small battery causing harm, so I went along with it.
So I just received one of these devices after my L3 through L5 fusion procedure. Mine has been programmed to be used/worn for 4 hours in a 24 hour period. I am part of a study group for a new implant spacer that is 3D printed Titanium that gets inserted between vertebrae in p[lace of discs, in which the 2 next to L4 were totally shot. I get x-rays every 4 weeks as part of this study for a 2 year period. Doc says I only need to use it for 9 months unless the x-rays show more advanced improvement.
So as I sit here at home working with this unibomber vest on, it shall be interesting to see if it actually makes a difference.
I hope it goes well for you. My wife just had a repair of her spinal fusion from last year. She had had her S1, L6, and L5 (she had an extra lumbar vertebrae) a few weeks ago. The previous fusion didn’t heal.
The surgeon wants to order one of these. He says he doesn’t know if they work and all most of the studies (at least with this bone stimulator) is done by the manufacturer. But it’s worth a shot just in case she is one of the lucky ones.
I’d be interested to see how this goes for you.
Good luck.
can anybody determine the ohm resistance of the coils?? What is the Ohm value of the coils? The PEMF is designed to work with .5 to 2 ohms.
Looks like .32 ohms, found from patent searches, can anyone verify this?? Thanks
Reminds me of another device used to “treat” pain – the Transcutaneous Nerve Stimulator. They used to let you leave them on as long as you needed them as they’re pretty harmless – designed to interrupt the nerve transmission of pain to the brain. A number of years ago they started writing “prescriptions” for their use for a certain amount of time and after that, they would shut down. I thought that was one of the most ridiculous things I’d ever heard. They’re certainly not addictive. The patient in enough pain will go through every setting to get any relief. I did mine. It became more of a distraction and more of an irritation than anything else. Not going to toss mine. Might need it yet again. Whatever the case, it’s worth a whole lot more than anything they can (wrongfully) shut off. There is no good reason they should be in control of a form of pain relief that has no negative side effects. It’s infuriating.
Is anyone here familiar with the Zimmer Biomet Orthopak Bone Growth Stimulator?? Can the timer on this device be deactivated?
I’ve never heard of it – hope someone else has.
Here is the most comprehensive study I found. March 12, 2020.
“Efficacy of Electrical Stimulation for Spinal Fusion”. Quality of evidence- moderate. 1184 articles screened-7 studied. Great variation in methods of treatment reported. Inconsistent results associated with treatment approach. Studies 1978-2017. 73% of patients aware of treatment – 32% then used electrical stimulation. “Significantly greater rates of successful fusion”
Personally I went through the process and do not believe it assisted my personal spinal fusion. Patients that do utilize electrical stimulation are probably more prone to utilize all their options of recovery and have a tendency to closely follow all recovery recommendations for their surgery.
I have a orthofix spinal stim that stop working as it is set up to do after a few months. Tried to sell it on ebay for parts but they do not allow it. Can it be turned back on ? Hate to throw it away.
you be can get a pre paid postage label and orthofix will recycle. I sent 2 one neck and one fusion vest back. They have lithium batteries that would harm environment soul and air if it is just dumped. They asked me if i would consider. i was happy to oblige.
I wore a belt similar to this ack in 2003 after two spinal fusions that year. The belt set off alarms in some stores and I would be stopped at the door. Insurance wouldn’t pay for it in Wisconsin so the company provided it with no charge. I am aware of people who have been involved in publising testimonials by themself or a patient they knew. It is quite a claim.
What is the wiring made of? Is it worth scraping the wiring?
Has anyone looked further into how to unlock the device? Such a shame a device that cost me $3500 be ause it was covered by insurance stops work after only 1 year
I’d love to see if my unit could be reprogrammed! Electromagnetic therapy is definitely beneficial for healing throughout the body. Wound healing to migraine pain therapy. How could I find someone willing to see if my unit could somehow be “resurrected”?? I’m about as untechnical as a human could be but certainly don’t want this investment to go to waste…
Is anyone here familiar with the Zimmer Biomet Orthopak Bone Growth Stimulator?? Can the timer on this device be deactivated?
I have been using the physio stim orthofix bone growth stimulator for 1 year 3 hrs per day it repaired my delayed union 2nd metatarsal bone fracture it started wrking in 5 weeks I did not need surgery. how can i keep this machine from Turning off in 3days I think it will auto shut down?