E-bike controllers reach us the same way almost every time: a potted aluminium brick with no labels, twelve to eighteen MOSFETs clamped to a cast heatsink, and a harness where thick phase leads run alongside hair-thin Hall and throttle wires. When the supplier drops the model, every machine in that fleet becomes scrap unless somebody rebuilds the board. This article explains how we clone e-bike motor controller circuit board assemblies for exactly that situation, from depotting and imaging through BOM rebuild to dynamometer validation, including the traps that kill most first attempts.
Why an E-bike Controller PCB Is Not Just Another Power Board
The first misconception to clear away is bus voltage. A “48 V” pack is 54.6 V fully charged for a 13S configuration, and higher again under regen; a 36 V nominal pack tops out near 42 V, a 60 V pack near 67 V. Every MOSFET, bootstrap capacitor and bulk electrolytic must be rated for the fully charged pack plus overshoot, not the number on the brochure. Devices in the 68 V to 100 V class are typical, and getting this wrong turns validation into a fire.
Current is the second constraint. Commuter and city controllers run 15 A to 35 A continuous with peaks two or three times higher during acceleration; delivery scooters run higher still. That means 2 oz to 3 oz copper, phase nodes widened into solid pours, and above roughly 30 A, busbars or solder-flooded traces rather than etched artwork. Any rebuild starts with a cross-section measurement, because IPC width charts assume a temperature rise a sealed enclosure may not accept.
Everything lives on one substrate. A single controller handles the three-phase bridge, six complementary PWM channels with dead-time, a 5 V open-collector Hall bundle, a throttle input spanning roughly 1 V to 4.2 V, pedal-assist or torque pulses, brake cut-off, a speed sensor and often a UART link to the display. Millivolt-level analogue signals sit centimetres from nodes switching tens of amps. In a competent original layout the power return, analogue return and shunt reference join deliberately at one point — reproduce that topology rather than simply pouring copper.
Finally, the regulatory envelope. Electrically power assisted cycles placed on the European market are assessed against EN 15194, and North American practice commonly references UL 2849 for the drive system. Those approvals attach to the vehicle as placed on the market, never to an individual component, so whoever ships a replacement controller carries the re-verification burden. Our work is compliant reverse engineering and repair support for discontinued or legacy hardware where the owner holds rights to that design; the full workflow is outlined under our PCB reverse engineering services.
Depotting, Teardown, and Copper Imaging
Street-legal means waterproof, so most controllers are potted in silicone or polyurethane, or sealed with a gasketed shell. Silicone can often be softened and peeled with controlled heat; polyurethane and epoxy need solvent swelling or careful mechanical excavation, and every route risks lifting passives or cracking an MLCC. We depopulate only after imaging.
Mechanical details matter as much as electronics. MOSFET tabs are clamped to the enclosure through insulating pads, and pad material — silpad, aluminium oxide film, mica — plus the bushing keeping the screw off the drain tab sets both isolation and thermal resistance.
Imaging begins with scans of both sides at 2400 dpi or better, referenced to alignment fiducials. On a two-layer board, which most controllers are, we overlay top and bottom bitmaps semi-transparently and register every via. For the four-layer designs used in higher-end FOC controllers, the board is delaminated and each inner layer scanned separately, with registration checked against drill hits — see our notes on reverse engineering multilayer PCB stackups. Mask stripping then reveals copper hidden underneath.
The trap here is current handling invisible in the artwork. Phase runs are flooded with solder to raise cross-section; a scan shows the silhouette and tells you nothing about thickness. We cut and polish cross-sections, then measure foil weight under a microscope before committing numbers to a Gerber.
Netlist Recovery and Device Identification
Netlists come from combining registered images with exhaustive continuity probing, and the probing is not optional. Cost-driven layouts hide a great deal: traces run beneath components, pours that look like one plane are often split into power and quiet analogue returns meeting near the shunt, and ground vias are easy to miss optically. Every net gets buzzed out rather than trusted.
We map the power stage first, since it defines everything else: identify the three half-bridges, count how many devices sit in parallel per switch position, establish which phase node each feeds, and locate the bootstrap diode and capacitor supplying each high-side gate. Six devices means one per position, twelve means two, eighteen means three — that ratio reveals the original current target.
The controller MCU comes next. Typical parts here are Cortex-M3 devices such as the STM32F103 family and its pin-compatible equivalents, 8051-derived parts like the SinoWealth SH79F16x series, or dedicated BLDC chips. The signature is six complementary PWM outputs with programmable dead-time feeding three driver stages, plus ADC channels reading throttle, bus current and temperature. Programming access is usually unpopulated SWD pads beside the QFP; those nets belong in the netlist because that is how firmware gets loaded later.
The subnet most often mis-identified is current sensing, and three topologies circulate. The cheapest uses one low-side resistor — sometimes a length of resistance wire — between bridge negative and battery negative, so it only sees winding current while a low-side device conducts. Better designs put a shunt in each phase leg and amplify differentially. Some newer boards drop the external resistor and sample across a conducting low-side MOSFET, using RDS(on) itself as the sense element. Confusing them shifts current limiting by tens of percent: the controller either cuts out on every hill or lets the windings cook. Gate-loop practice is covered in our MOSFET gate drive circuit design notes, and the locked-firmware constraint below applies equally to our automotive ECU reverse engineering projects.
Rebuilding the BOM and the Schematic
Identification ranges from trivial to forensic. Power MOSFETs, the bridge driver, gate drive regulator, bulk capacitors and the MCU are usually legible enough to trace through distribution. The difficulty is the small-signal layer: SOT-23-5 and SOT-363 analogue parts — op-amps, comparators, references — frequently carry house marking codes that resolve to nothing publicly searchable. We identify them functionally: measure pin impedances, trace each connection, curve-trace the behaviour, match against documented pin-compatible substitutes, then verify on the bench before the part enters the BOM.
MOSFET substitution deserves its own warning. Selecting on VDS and RDS(on) alone is the classic failure. What governs whether a replacement works are total gate charge and gate-drain charge, which set the bootstrap energy needed per cycle; threshold voltage and its temperature coefficient, which drive shoot-through; and safe operating area, since start-up, stall and hill-climb put devices into linear conduction where RDS(on) tells you nothing. A larger die means more gate charge, and a well-intentioned upgrade can starve the bootstrap, cook small driver transistors, or cause false turn-on at high dv/dt.
Passives have their own traps. The electrolytic bank at the battery input absorbs ringing from pack harness inductance, so ripple rating and ESR matter more than nominal microfarads; collapsing several parts into one ceramic removes that damping. The shunt is usually a custom value with a specific tolerance and tempco, and tightening it moves where the current limit trips. Every BOM line should carry not merely a part number but the reason that part is there.
The schematic is then drawn net by net from the verified netlist and cross-checked against datasheet pinouts. A sanity pass catches most remaining errors: bootstrap diode orientation, Hall pull-ups to 5 V, throttle divider range, and a dead-time network where the driver datasheet requires one. A netlist can be internally consistent and still describe a board that never worked.
Prototype Fabrication and Functional Validation
When new Gerbers are generated, every copper measurement taken during teardown must be written into the fabrication notes explicitly. Most fabricators default to 1 oz inner layers and will happily “improve” a 2 oz requirement unless it is stated per layer. Specify outline within a fraction of a millimetre, and retain busbar slots, post positions, thermal relief patterns under MOSFET tabs and any exposed heatsinking pads. If the original relied on solder flooding, order the equivalent weight from the start.
Bring-up follows a deliberate ladder, because clones fail expensively. Start unpopulated beside the reference: AOI or X-ray comparison plus a bare-board netlist comparison catches misrouted traces before a part is at risk. Then apply bus voltage from a bench supply with the current limit set low and watch quiescent draw. Verify the rails next — around 15 V for gate drive, 5 V or 3.3 V for logic — because a wrong bootstrap rail is cheaper to find here than once the bridge is destroyed.
Only then does the motor go on a load bank or dynamometer, stepping from no-load through rated torque to stall and overload. We instrument case temperature per device, capture phase current on a probe, and inspect gate-source waveforms differentially to confirm no shoot-through or ringing at the switching edges. Steady-state thermal testing must run inside the original enclosure, since reproducing copper geometry does not reproduce the thermal interface when potting differs. A conducted and radiated emissions pre-scan against the original unit closes it out; phase lead ringing is almost always the dominant radiator, and we go deeper on that in our EMC-aware PCB reverse engineering write-up.
Common Pitfalls When You Clone E-Bike Motor Controller Circuit Board Assemblies
Copper assumptions. Treating a shiny phase run as 1 oz artwork because nothing else is specified. Measure the cross-section.
FET selection by RDS(on) alone. Ignoring gate charge, threshold drift and safe operating area either starves the bootstrap or lets the bridge cross-conduct.
Losing the current-sense topology. Switching between low-side and phase sensing silently moves the current limit and destroys the calibration.
Harness assumptions. Loom colours follow loose convention, not a standard. Buzz every wire to its pad before power: many controllers have no reverse-polarity protection, and reversing the pack destroys the bridge instantly.
Hall phasing. Both 60-degree and 120-degree placements circulate, and the mapping between Hall states, phases and rotor position is combinatorial. Wrong phasing gives cogging or a violent start.
Firmware expectations. Most manufacturers set flash read-out protection, so there is often no binary to hand over. Plan around a blank MCU.
Frequently Asked Questions
Is it legal to clone an e-bike motor controller circuit board?
Reversing hardware you own, or that you are authorised by the owner to maintain, is a legitimate route to keeping legacy and discontinued vehicles in service, consistent with ordinary spare-parts repair practice in most jurisdictions. What it does not transfer are third-party IP rights: a copied design cannot be marketed as another company’s product, and trademarked markings are not reproduced. Engagements are structured as compliant reverse engineering and repair support for legacy hardware, with ownership confirmation and an NDA up front.
Can you recover the original firmware?
Sometimes, and only where the client owns the board and is legally entitled to maintain it. Many parts in this class lock their flash. When extraction is not possible we deliver the hardware equivalent — verified netlist, Gerbers, BOM and populated prototypes — and characterise the surviving unit on the bench so the rights holder can port their own firmware.
Do you need a working sample?
One working reference is ideal, and a failed unit alongside a working one is better still, because netlist verification depends on continuity measurement rather than imaging. If only a dead board exists, layout and most of the netlist can still be recovered, but budget extra bench effort to rebuild damaged areas from datasheet behaviour.
Will the replacement be electrically identical?
The intent is functional equivalence within the tolerance of whatever substitutes were necessary. Where an obsolete part has no drop-in, we quantify the difference — thermal behaviour, switching loss, current limit, emissions — before you commit, rather than delivering a board that satisfies the netlist but misses the performance.
What about certification for the finished vehicle?
Type approval attaches to the vehicle as placed on the market, not to the component. If the controller changes, whoever places that bike on the market is responsible for re-assessment against EN 15194, UL 2849 or whatever the destination requires. We supply measured data, but we do not issue certificates.
A discontinued controller does not have to retire a fleet, and the fastest route back to service is usually a faithful rebuild of what already worked rather than an expensive redesign. If you need to clone e-bike motor controller circuit board assemblies, the deliverable is the same: verified Gerbers, a sourced BOM with every substitution documented, a readable schematic, and prototypes validated under real load. The workflow for other drive types is described in our motor control circuit board cloning guide, and units are built through our prototype production after circuit board reverse engineering line. When you are ready to move forward, request a reverse engineering quote and we will start by reviewing your sample.
