A failed battery management board can retire an entire EV pack. When the original BMS is out of production and the pack still has years of service left, the practical route back to a working asset is to clone EV battery management system circuit board hardware from a physical sample: recover the copper, identify the silicon, rebuild the schematic and BOM, then prove the copy behaves like the original under load. The work is part electronics and part forensics, and it fails in predictable ways. This is the method we use, and the details that decide whether a clone is trustworthy.
Why You Cannot Clone EV Battery Management System Circuit Board Hardware Like a Consumer Board
A BMS is not a logic board with a power supply bolted on. It is a measurement instrument that lives inside a high-voltage environment, and nearly every design decision on the board exists to stop those two facts from conflicting.
Start with the voltage domain. In a 400 V or 800 V pack, every net belongs either to the pack side or to the low-voltage side, and the barrier between them is the design. Creepage and clearance distances, milled slots in the laminate, conformal coat, the tracking index of the base material, the isolation transformers in an isoSPI chain, the isolated amplifier fronting the pack-current shunt — none of these are layout preferences.
Then consider what the board measures. Cell voltage is resolved to a millivolt or two across a stack that may hold ninety-six cells in series, so the input filter and the Kelvin connection to each cell tap are part of the measurement. Change the series resistor or filter capacitor and you have changed the reading, even though the board still switches on. Pack current is harder: a shunt of a fraction of a milliohm feeding an amplifier at hundreds of volts of common mode, where a few micro-ohms of asymmetry becomes a gain error that only shows at high current.
Power handling adds a third layer. These boards carry 2 oz to 4 oz copper on the power layers, back-to-back charge and discharge FETs, and a precharge path with its inrush resistor. Thermal relief geometry, via arrays under FET pads and copper weight are functional parameters: under-specify them and the clone passes bench tests and fails in a hot pack.
Finally, EMC and environment. Contactor opening, motor-drive switching and pyrofuse activation couple noise onto the pack harness, which is why the CAN interface is usually isolated, filtered and choked. The board must survive −40 °C to +85 °C or +125 °C, thermal cycling, vibration and humidity, so the original BOM leans on AEC-Q100 qualified parts. If the board sits in a safety-related function, any deviation needs a documented justification rather than a shrug.
Teardown and Imaging: Reading a Board Designed to Be Sealed
Assume you need two samples. One will be destroyed; the second stays intact as an electrical reference you can probe and compare against. Projects that start with a single board eventually reach a point where the only remaining reference is the one already ground away.
Photograph everything before cleaning: both sides, connector keying, silkscreen, date and lot codes, coat type. Coating removal is the first real risk. Acrylic coats soften with the right solvent, silicone swells and lifts, urethane needs heat plus solvent, and parylene usually yields only to plasma or careful mechanical removal. Potted assemblies are slower still, with a genuine chance of collateral damage that should be discussed before work starts rather than after.
Scanning comes next. A flatbed at high optical resolution, both sides, in overlapping tiles stitched afterwards, gives you the reference geometry everything else is checked against. Tall components produce parallax, so scan with the board flat or remove them first and record their positions. X-ray then answers what the surface cannot: BGA and QFN thermal pad voiding, inner-layer registration, via-in-pad structures, and the winding arrangement inside those small isolation transformers. On a 4- to 8-layer board, X-ray before delayering stops you destroying the only record of an inner layer you have not yet photographed.
Delayering proceeds layer by layer — mechanical grinding with progressively finer grit, or controlled chemical removal, depending on the laminate. Measure copper thickness early, because 2 oz and 4 oz foil etch at different rates and a process tuned for 1 oz erases fine geometry on a power layer. Trace widths down to a couple of mils are recoverable with patience and consistent lighting.
Net Tracing and Component Identification Around the AFE
Do not start at the connector and hope to arrive somewhere useful. Start at the analog front end, because the AFE dictates the topology of everything around it.
The common families in EV and ESS packs — LTC6811 and LTC6813, ADBMS1818, BQ79616, MC33771 and MC33772, ISL94208 — all have documented pinouts. Once you know which one you are looking at, the cell input ladder, balancing outputs, isoSPI pair and host SPI lines declare themselves. The cell connector then traces back through a series resistor and a capacitor to ground: that RC network is the input filter, and its values belong in the schematic.
The isolated communication path deserves its own pass. A daisy-chained pack uses a two-wire isoSPI link through small pulse transformers, often with a common-mode choke and termination nearby. Record the transformer part if it is marked; if it is not, measure the turns ratio and note an isolation rating you can defend. Get this wrong and the board talks happily on a bench with short leads, then drops messages once wired into a real pack.
Pack current sensing is next. Find the shunt — usually a four-terminal element, sometimes laser-trimmed with no readable marking — and follow the two sense traces to the amplifier. They must be symmetric and Kelvin-connected at the element; if the original routed them as a tight differential pair, that geometry is part of the accuracy. Then identify the amplifier type: an isolated sigma-delta modulator, a dedicated BMS current-sense IC, or a bidirectional amplifier behind an external barrier. Each implies different surrounding parts and a different calibration path.
Then map the high-voltage housekeeping: interlock loop, contactor drivers with their economiser networks, precharge resistor and relay, fuse and pyrofuse drive, isolation monitoring where present. Electrically simple, functionally critical.
Unmarked components are the normal case. Work from package, pin count, surrounding topology and measurement rather than marking codes, which are vendor-specific and frequently reused. In-circuit resistance readings mislead whenever a low-value part sits in parallel with a winding, so lift one end before committing a value. On a dead board, a curve tracer comparison against a known-good net finds shorted ceramics and leaky FETs faster than a multimeter.
Rebuilding the BOM and Schematic So It Survives Review
A recovered schematic is only useful if another engineer can review it without the board in front of them. Organise by function, not physical location: cell sensing and per-cell filter, balancing, AFE cluster, isoSPI chain, pack current path, interlock and contactor drive, isolated CAN, housekeeping supply. Each sheet stands alone, with named nets crossing the boundaries.
The bill of materials carries as much weight as the schematic. Every line needs a reference designator matched to the silkscreen, a manufacturer part number, value, tolerance, package, dielectric where relevant, and the AEC-Q100 grade appropriate to where the part sits. Where the original part is obsolete, list an alternative with its qualification grade and a note on what changes electrically. Shunts and FETs need derating stated explicitly, or the next engineer assumes the original margins.
The fabrication package is a separate deliverable. Copper weight per layer, dielectric thickness, impedance targets, via types, surface finish and any milled creepage slots belong in a stackup document rather than a fabricator’s inbox. Thick copper on inner power layers is a fabrication constraint, not a footnote — the approach in copying a multilayer PCB layer stackup applies directly.
A change report closes the package: every inferred region, substitution and unverified net, listed with its consequence. That is what lets a reviewer judge whether the reproduction is fit for purpose, and it is the difference between a professional deliverable and a folder of files. The same discipline is set out in restoring a schematic from a physical board.
Prototype, Bring-Up and Functional Validation
A clone is unproven until it has been powered in stages and compared against the original. Fabricate the bare board from the recovered Gerber data, assemble it from the recovered BOM, and resist the temptation to connect a real pack.
Start unpowered: continuity on every net, isolation resistance across the barrier, and a visual check that creepage distances match the drawing. Then bring up the low-voltage rail on a current-limited supply with no cells attached. Only once the housekeeping supply is clean should you attach a cell simulator — a resistor ladder or a programmable simulator — in place of the pack. Most wiring and polarity errors surface harmlessly at this stage.
Validation then proceeds block by block. Cell measurement accuracy is checked against a precision DMM at several points across the input range, not just one. Balancing current and duty cycle are measured per channel. Pack current is zeroed and then checked for gain at two or three points, watching offset drift. CAN traffic is captured and compared frame by frame against a log from the original board under the same stimulus. Contactor timing, precharge behaviour and interlock response are verified against the original.
Isolation gets a dedicated test at the barrier’s rated voltage, plus a check of slot width and coat coverage. Thermal behaviour is checked at rated balancing and pack current while a thermal camera compares hot spots against the original. If the board returns to a vehicle, an EMC pre-scan around contactor noise is worth the schedule, because that is where a substituted choke or a shifted filter corner shows up. The path from files to validated hardware follows moving from reverse-engineered data to prototype production.
Six Failure Modes That Sink a BMS Clone
- Creepage geometry tidied away in CAD. Someone “cleans up” a milled slot or narrows a barrier gap during redraw. The board passes continuity and fails a safety review.
- Asymmetric Kelvin sense traces. The two shunt traces are redrawn at different lengths or widths. The error is invisible at low current and obvious at 300 A.
- Wrong isolation transformer or a missing common-mode choke. Bench communication is perfect; pack-level communication corrupts under contactor transients.
- Copper weight and via arrays under-specified. The FET stage loses thermal margin, and the failure only appears after repeated high-current cycles.
- Non-qualified parts in the cell input filter. A commercial-grade resistor drifts with temperature and cell readings walk away from reality over the pack’s life.
- AFE configuration and calibration not recovered. The board measures correctly but protects at the wrong thresholds, or reports state of charge with an offset nobody characterised.
Two more are easy to overlook: conformal coat coverage on the high-voltage side, and the analog ground reference around the AFE, where a clone that joins planes the original kept separate will measure noise instead of cells. Power distribution is not incidental either — see power integrity on vehicle circuit boards.
FAQ
Can the board be cloned if the microcontroller is read-protected?
Usually yes. Gerber data, schematic, BOM and stackup come from the physical board and do not depend on firmware access. What cannot be guaranteed is identical behaviour, because protection thresholds and calibration constants may live in protected flash or in AFE one-time-programmable memory. Firmware work is a separate scope and requires documented authorisation.
Do you need a working sample?
Ideal, not mandatory. A dead board still yields full copper geometry and a complete BOM; what it cannot give you is a reference waveform or a known-good current calibration. Where it is damaged we reconstruct from surviving geometry and flag that in the change report.
How is an 800 V barrier handled?
As a design constraint from the first scan, not a cosmetic detail at the end. Creepage and clearance are measured on the board, slot geometry is reproduced as milled features, isolation components are identified by type and rating, and the prototype is tested at the barrier’s rated voltage before it goes near a pack.
Is this legal?
Reproduction is commonly undertaken for compliant reverse engineering of discontinued and legacy hardware, and for repair support where no replacement exists. It depends on ownership of the design or authorisation from the rights holder, and it is a question for your counsel in your jurisdiction. We work under NDA.
If you are holding a BMS board with no schematic and no supply chain behind it, the fastest way to learn whether it can be reproduced is to put it in front of engineers who have taken these boards apart before. Our PCB reverse engineering services cover the full path from teardown to validated prototype, and the method carries over to adjacent modules such as automotive ECU reverse engineering and EV flexible PCB design copying. To clone EV battery management system circuit board hardware for a legacy pack, send us the board for evaluation with clear photographs of both sides and the connector layout, and we will tell you what is recoverable before any work begins.
