Teardown: Orthofix SpinalStim

If you’ve ever had a particularly nasty fracture, your doctor may have prescribed the use of an electronic bone growth stimulator. These wearable devices produce a pulsed electromagnetic field around the bone, which has been shown to speed up the natural healing process in a statistically significant number of patients. That’s not to say there isn’t a debate about how effective they actually are, but studies haven’t shown any downsides to the therapy, so it’s worth trying at least.

Image from SpinalStim manual.

When you receive one of these devices, it will be programmed to only operate for a certain amount of time or number of sessions. Once you’ve “used up” the bone stimulator, it’s functionally worthless. As you might imagine, there’s no technical reason this has to be the case. The cynic would say the only reason these devices have an expiration date on them is because the manufacturer wants to keep them from hitting the second hand market, but such a debate is perhaps outside the scope of these pages.

The Orthofix SpinalStim you’re seeing here was given to me by a friend after their doctor said the therapy could be cut short. This provided a somewhat rare opportunity to observe the device before it deactivated itself, which I’d hoped would let me take a closer look at how it actually operated.

As you’ll soon see, things unfortunately didn’t work out that way. But that doesn’t mean the effort was fruitless, and there may yet be hope for hacking these devices should anyone feel like taking up the challenge.

Keeping it Simple

Since the SpinalStim is designed to produce an electromagnetic field around the spine, it’s not hard to guess that the foam-covered “back brace” contains some kind of coil. But being a high-tech medical device, you might imagine there’s some exotic materials or techniques involved. As it turns out, there isn’t.

Cutting the foam lining away from the brace in an operation not entirely unlike gutting a fish, we can see there’s nothing very special going on here. It’s just a dozen or so loops of two conductor insulated wire that’s held together with, as far as I can tell, painter’s masking tape.

It’s not even like they made a neat coil; pulling the rest off the foam off, there are areas where the wires overlap a bit. I would have thought they’d use some kind of flexible loom to hold the wires in place, but apparently the foam of the brace itself was considered enough to keep the wires flat.

Taking a close look at the four pin connector that goes into the back of the control unit, we can see that the wires have actually been twisted together and crimped to both conductors in the yellow cable. The loop itself is connected to another identical arrangement located on the other side of the brace by a wire hidden in one of the straps that holds them together.

Taking Control

With construction techniques not far removed from a grade school science project, I’ll admit the coils were something of a letdown. But luckily the Control Unit is a bit more interesting. As the SpinalStim has no patient-accessible settings, this device is simplistic in the extreme: just a single button to turn it on and off and a USB-B port for charging. It does however have a rather nice LCD display that indicates the battery level and how much treatment time is left. The screen is even backlit, which seems somewhat unnecessary, but is perhaps beneficial for elderly users who might have trouble seeing the display otherwise.

Both inside and out, the Control Unit is much closer to what I was expecting from a medical device. It’s got considerable heft thanks to internal battery pack, and the thick enclosure with o-ring seals is really quite impressive. Between all the wire you can pull from the coils and this beefy electronics enclosure, there’s a surprising amount of salvage value in this device already.

On the reverse side of the PCB, we can see a few interesting details. Chief among them are the dedicated programming headers for the device’s STM32 microcontroller and nRF Bluetooth Low Energy chipset. We usually have to hunt around for useful debug or programming interfaces, so to see them not only labelled but actually populated with pins is really a treat. We can also see the backup battery used to keep the device’s internal timer ticking even if the primary battery dies, and a bank of capacitors that are likely used to build up a charge to fire through the coil.

Peeling the firmware release sticker off of the microcontroller reveals it to be the very common STM32F103, and removing the board’s RF shield uncovers another chip Hackaday readers will likely be familiar with, the nRF51822. The presence of these well documented chips certainly bodes well for any potential reverse engineering or repurposing of the device.

An Investigation Cut Short

At this point, I was hoping to get the Orthofix SpinalStim hooked up to the oscilloscope and take a look at what kind of signal it was passing through the coil, but it was not to be. After putting the Control Unit back together, I’m now immediately greeted with an angry beep and an error message.

Unblock me you coward.

Just like the VeriFone MX 925CTLS payment terminal we looked at last year, it would seem the SpinalStim is designed to “self-destruct” once it’s been opened. I didn’t notice any obvious triggers like we saw in the VeriFone, but I’m assuming when I disconnected the battery it was enough for the device to realize something was amiss. This is probably designed to prevent users from trying to reset the device’s internal counter, which seems to have been a problem on older bone stimulators.

While I’m disappointed the SpinalStim swallowed its cyanide pill rather than submit to further interrogation, the hardware uncovered in the Control Unit certainly looks ripe for further hacking. We’ve seen medical devices reverse engineered to unlock new capabilities in the past, and while there might not be a huge demand for a FOSS bone growth simulator firmware, it seems the possibility is there for anyone who wants to free these devices from their arbitrary limitations.

33 thoughts on “Teardown: Orthofix SpinalStim

  1. Giving up way too easily. Should verify if controller is locked and if you can get into firmware. Or connect debugger and potentially trace down what branched the code to the error message.

    Would wager the firmware isn’t going to have any exotic defense mechanisms.

  2. Funny, I have 2 of these sitting here on my “When I have time” shelf. My mother has had a few back surgeries and they give her a new one every time. Glad I read this, now I know about the self destruct.

      1. Probably snake oil. I’ve been prescribed this stuff after knee injury. Basicaly it is overpriced placebo just to get your body more time to heal itself and then they claim the merits. They put my leg in such device in the hospital (device was not portable). I’ve been curious enough to test it using small neodimum magnet and it actualy slightly vibrated when it was close to the coil. Also smartphone magnetometer was able to capture the activity.

        But the device had small speaker making terrible screeching noise, which was designed to sound like the machine does something intense. That was a red flag for me, because such device if properly designed should make little to no noise. So this was just to increase the placebo effect and make the nurse go nuts…

        1. I can definitely see the possibility for nocebo effects when you have a therapeutic device that appears completely inert, even though it’s working properly. Or even just having difficulty distinguishing between a device that’s working and one that’s faulty or not switched on properly.

          Having some sort of obvious noise or vibration while it’s active may have no therapeutic value but it could be a simple and utterly safe way of eliminating those undesirable issues.

  3. I’m glad someone at least got this far on one of these. I broke my foot back in 2018 and thought I was gonna need one of these(but thankfully didn’t), which wasn’t good because the cost was insane and as luck would have it, our insurance was going away at the end of that month so if I ended up needing one, I was gonna hafta pay out of pocket. I started looking into hacking one of these and realized from what I’d read that really the big thing would be to get an idea of the waveform and frequency that way if the firmware were impenetrable, at least we could replicate the function with a microcontroller and some amplifier circuitry. It wouldn’t be ideal but it would make it more accessible.

  4. Check the mounting holes on the board. They are labeled AH 1-4. If there are any traces other than ground this may be the anti-tamper mechanism. See what is connected in the case.

    1. My guess would be something on the battery pack – a 5pin connector is excessive for ‘just a battery’. Bet at least one of the pins goes to the Nordic chip which is watching it while in (very low power) sleep – I suspect the backup battery has plenty enough to support that.

      1. The battery does have a five-pin connector, but it seems to use only three pins. Obviously + and -, and probably a resistive thermal sensor, forming a “stupid” battery pack. There are “smart” battery packs used in both medical equipment and IT equipment that come with an I²C-/SMbus-interface, so you need pins for +, -, clock, and data. And finally, there are “smart plus stupid” battery packs that offer both a simple resistive thermal sensor and an I²C-/SMbus-interface. Those packs obviously need five pins.

      2. Looks like I didn’t include the picture of it in any of the galleries, but there’s actually a little pinout chart on the battery label. Two negative wires, two positive, and one yellow for the NTC so the board can check the cell temperature while charging.

        Nothing inherently unusual about the wiring given the application, but the chip could absolutely be watching the NTC line to detect if the cable has been unplugged.

  5. Couldn’t someone just record the magnetic filed changes that it produces while in operation?
    I think some cheap (3axis?) compass module could make some nice representation how the magnetic field changes.
    Maybe a smartphone could do the same (for example android app: Science Journal)

    1. Depends on the frequency of the magnetic field. A lot of compass modules might go up to 10hz, but this thing could easily be operating in the khz or mhz range. An O-Scope on the wire would be useful but not really a mag sensor.

    1. Because elderly people have reduced bone density, reduced balance (this more prone to falls and breaks), and worse eyesight, compared both to the general population and their own younger selves.
      Thus they’re a good market for these, and will benefit from the backlit display.

      Young people can have various eyesight issues, but most of them aren’t helped by backlit displays, whereas older folks’ eyesight deterioration is more likely to benefit from a backlight.

  6. Whilst the usage-limit on the device could be a money-grab, most medical devices don’t have a usage-limit on them.

    I’d suspect they were worried about people overusing them. The studies probably showed benefits from one 15 mins session per day, for a month, or something, and there may be a worry that if someone uses it 24/7 they’ll give themselves cancer or something. Maybe studies showed overuse was an issue? Maybe wearing it too long can cause problems (backache from the weight, etc). Maybe they’re just worried because no one studied what happens if you use it 24/7.

    Or maybe there’s a risk people will repurpose it to self-medicate another patient for whom it’s not appropriate and who needs to go see a doctor. Or perhaps the params on the device are tweaked per-patient?

    However, given it probably just needs a re-config, or at worst a battery replacement, it’s disappointing if it can’t be returned for a deposit.

  7. I would be interested to know how statistically significant the number of people for whom the healing process was accelerated was, and what were the testing methodologies. A bone’s “healing process” sounds like the kind of thing that’s difficult to measure without many CT or MRI scans over the whole period of time.
    I wouldn’t be surprised if there’s a significant publication bias on something like this. Those studies not returning a positive result not getting published.

    1. Hi Shannon,
      The following is *my personal opinion*, which is based on decades of involvement in the medical devices industry. I have no personal relationship or conflicting interest with any manufacturer of devices for bone growth or the other fields mentioned below.
      The use of pulsed electromagnetic fields (PEMF) for bone healing was grandfathered by FDA in 1979 for treating non-union fractures. This means that these devices were available before FDA was chartered with evaluating and approving medical devices, so they keep on *clearing* them (*not approving* them) based on this grandfather provision even if they are snake oil as long as they aren’t shown to cause harm. This is what allows quack therapies that are 100% placebo like microcurrent cranial stimulation devices for pain/anxiety/insomnia/depression to be sold, and unfortunately sometimes even wastefully covered by insurance.
      One “cute” point that all of these “therapies” tout is the complete lack of adverse effects. In my view, this is the first piece of evidence that they are pure placebo, because interventions that have sufficient potency to do something to the body will cause at least some undesirable side effects. The lack of side effects is a clear predictor of no clinically-relevant effects at all.
      Also in my opinion, the objective evidence for non-invasive, magnetically-coupled bone healing stimulators is tenuous at best. On the other hand, I give a lot more credence to bone fusion enhancement with DC currents driven through bone from implantable bone stimulators. On the brain side, TDCS also causes significant changes, but I’m afraid that because of its simplicity is being severely misused by the hacking community.
      If interested in this seeing the actual data and evaluating the studies yourself, please search for “PEMF”
      Cheers,
      David

    2. The details of the effectiveness study for the Orthofix model I was given were in its user manual. From memory: More patients (something like 10-20%) had bone fusion by the X month mark (it was 6-12 months) with the treatment than without. Given enough time (i.e. 12-24 months) there was no difference in the percent of patients with successful fusion.

      As to why a backlight… it was useful when using the machine in the dark. I was asked to wear it for hours a day, and it was much more convenient to wear to bed, than to wear it around the house.

      Is it snake oil? Hard to say. I wasn’t worried about an electromagnet with such a small battery causing harm, so I went along with it.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.