Electric power steering puts a high-current, safety-critical switching board in a sealed aluminium housing nobody outside the OEM supply chain documents. When it goes out of production or needs a second source, the practical route is to reverse engineer EPS control board assemblies into a manufacturable data package. It is not the same job as cloning a generic motor driver: the board carries tens of amps of phase current, resolves millivolt torque signals next to PWM switching nodes, survives load dump and cranking dips, and preserves a functional-safety architecture the vehicle depends on.
What Makes an EPS Control Board Different From a Generic Motor Driver
A brushless motor driver on a bench supply is a forgiving thing. An EPS control board is not, and four constraints decide how the work has to be approached.
Power. The module hangs on a 12 V nominal battery that is not 12 V for long. Cranking pulls it into single digits, and a jump start or load dump pushes it far the other way. Peak phase current on a column unit is in the tens of amps; a rack-mounted unit on a heavier vehicle demands more. That is why inner layers carry two to five ounce copper and why the power devices sit over thermal via arrays dumping heat into the aluminium housing. The housing acts as heat sink, mechanical reference and EMC reference at once, so its bonding points belong in the recovered documentation.
Signal integrity. Centimetres from the switching nodes, the acquisition front end handles the smallest signals on the board. The torque input may be a differential analogue pair at millivolt level, a SENT single-edge-nibble stream, or both on redundant channels. The angle channel may be a resolver with a kilohertz excitation and a low-amplitude sine/cosine return, or a TMR/GMR element with a digital output. These nets run as matched pairs over a quiet section, separated from the bridge by isolation slots and guard rings. When you redraw the board, the geometry of those nets matters as much as their connectivity. The same separation rules are covered in our notes on vehicle printed circuit board power integrity.
EMC. A steering module sits under the dash or on the rack with a harness running the length of the vehicle, so it is measured against CISPR 25 and ISO 11452 class requirements. Tight switching-node copper, a compact gate loop and a controlled common-mode path through the drain-to-housing capacitance are layout decisions the original designer made and that have to survive being copied. We treat this as part of the rebuild rather than a later fix, as set out in our write-up on EMC-aware PCB reverse engineering.
Functional safety. Loss of steering assist is a hazardous event, and steering functions are commonly developed to demanding ISO 26262 ASIL levels. On the board that shows up as a lockstep microcontroller supervised by an external window watchdog, two independent phase-current measurement paths, a hardware overcurrent trip that does not route through the MCU, and a phase-disconnect device that defines the safe state. A reconstruction that reproduces the assist function but drops the watchdog topology or the redundant current path has not reproduced the board.
Reverse Engineer EPS Control Board Assemblies: Teardown and Imaging Order
Intake comes first and it is cheap insurance. Record the part number, hardware and software index, connector pinout and vehicle application before the housing is opened, then photograph every face. If the unit still powers up, read it on the bench and capture CAN traffic and stored fault codes, which later tell you which sensor channels exist. The workflow is the one we use for automotive ECU reverse engineering, adapted for a module that also carries a power stage.
X-ray before anyone reaches for a cutter. A radiograph gives the layer count, the via structure, BGA voiding and bond wire condition, and it tells you whether the design uses packaged parts or bare die bonded to the substrate. That last case is common in high-volume steering electronics and it changes the plan: no package marking to read, and no debug header to find.
Opening the housing depends on the construction. A crimped lip can be milled away; silicone gel lifts or dissolves; a hard epoxy or filled polyurethane is another matter, because removing it can take solder mask and components with it. We ask for a second sample on any unit we suspect is hard-potted and say so at feasibility stage rather than afterwards.
Conformal coating is removed only where it blocks imaging, with the sensor connector and any calibration area masked. Components then come off under a logged thermal profile, bagged per side with orientation photographs, pin-one dots and polarity noted.
Imaging follows the standard multilayer PCB reverse engineering route. Outer layers are captured at 1200 dpi or better. Inner layers are exposed by progressive planar grinding with the removal logged at each step, or by X-ray computed tomography where the geometry justifies it. Either way at least three global fiducials per layer survive to the end, because registration drift across six or eight layers is what turns a clean board into a netlist with phantom shorts.
Reading the Power Stage and the Sensing Front End
With the layers registered, identification starts at the power chain and works toward the sensors, because the power chain anchors every other assumption.
The output stage is normally six low-RDS(on) MOSFETs in a three-phase bridge, fed by a DC-link bank of electrolytics paralleled with ceramics, driven by a gate-driver IC with bootstrap or charge-pump supply and dead-time control. Shunts sit in the phase legs, in the DC return, or both, and on a safety-rated board the current measurement is usually duplicated, sometimes with a disconnect device in the phase path. This is the same class of work as our motor control circuit board cloning projects, with less margin on the protection network.
Around it sits the control section: a lockstep microcontroller from one of the usual automotive families, an external window watchdog, the CAN or CAN-FD transceiver, a LIN interface on some units, and the supply chain that keeps logic alive through a cranking dip. The reverse battery device, the TVS array and the input filter are worth recording in detail; they are the parts that fail in service and the parts most often dropped when someone copies a board from a photograph.
The sensing front end is where EPS work earns its difficulty. Torque typically arrives as two redundant channels that the firmware cross-checks, so both must be recovered with the original polarity, gain and filtering, not just the net. Angle may come from a resolver, whose excitation and sine/cosine return need their amplitude and phase relationship preserved, or from a TMR/GMR element with a digital interface. Shunt traces are Kelvin-connected and carry millivolt signals across a switching environment; treat them as precision nets and do not let a convenient re-route shorten the sense leg.
Devices that cannot be identified by marking need a decision rather than a guess. X-ray inspection for die size and bond-pad arrangement, decapsulation to read under the laser ablation, and a pinout hunt on an expendable spare are all legitimate. Guessing a pinout from a package outline and building a prototype on it is not.
Rebuilding the Netlist, BOM and Schematic
Vectorised layer images become a netlist once pads are merged into copper regions and the drill map links every via to the layers it touches. Before the physical board is destroyed by grinding, the netlist is checked against continuity measurements on a second unit, and any net that fails to match is resolved on the bench rather than in CAD.
The BOM is more than a parts list. Each entry records package, value, tolerance and voltage rating, whether an AEC-Q100, Q101 or Q200 qualified part is required, and whether the original is still procurable. Where a marking is unreadable or the part is discontinued, the entry is flagged with the equivalent we would propose and the parameters that equivalent must meet, so the purchaser can make the call.
The schematic is then drawn in functional blocks rather than as one flat sheet: input protection and supply, DC-link, gate drive and bridge, current measurement, torque and angle acquisition, microcontroller and safety supervision, CAN and LIN, diagnostics. A stackup table travels with it, recording layer order, copper weight, dielectric thickness and the impedance of the controlled pairs, because a Gerber set without the stackup is not buildable to the original electrical behaviour.
Prototype Fabrication and Functional Validation
To reverse engineer EPS control board assemblies for a rack application, the thermal path has to be recovered along with the copper. Fabrication follows the stackup, not a house default: copper weight, the thermal via pattern under each power device and the surface finish go into the fabrication note. A board built with the recovered tracks but light copper and no via array will assemble, power up and then cook itself at sustained assist. Our notes on automotive PCB thermal management cloning cover the detail.
Assembly needs a profile developed for the mixed thermal mass: the power devices want enough soak to wet their thermal pads, while the fine-pitch BGA and the small-signal front end must not be over-exposed. X-ray after reflow confirms voiding under the power pads and the BGA.
Bench validation reproduces the vehicle signals. The torque channels are stimulated with a calibrated source across the working range, the resolver or angle element is excited and its output decoded, and the bridge is loaded with a dynamometer or a suitable motor load. Phase current, assist torque, ripple and MOSFET case temperature are recorded at the worst-case corner, then the input is stressed with cranking dip, load dump and reverse polarity injection.
Finally the safety path is exercised by fault injection. A phase short, a position mismatch, an overcurrent and a brownout should each produce the intended, timed transition to the safe state with the disconnect device doing what the original design intended. An EMC pre-scan before a production commitment is worth more than an EMC fix afterwards.
Pitfalls That Derail EPS Reverse Engineering Projects
- Copying the geometry but not the construction. Three-ounce inner layers and a thermal via array are not cosmetic; they are the reason the original survives.
- Recovering one torque channel of two. The cross-check is the point of the redundancy, and a board with one good channel will not behave like the original.
- Routing sense traces as ordinary copper. A shunt Kelvin connection that picks up shared return impedance changes the current reading.
- Assuming a clean 12 V. Input protection designed for nominal conditions does not survive cranking dips and jump starts.
- Removing potting on the only sample. If it is hard epoxy, plan for two units or accept the risk up front.
- Downgrading qualified parts. Commercial-grade substitutes in an AEC position fail early and unpredictably.
- Expecting the assist map to come free with the hardware. The boost curve and tuning constants live in firmware.
None of these are exotic. They are what happens when you reverse engineer EPS control board geometry from a photograph instead of a measured stackup.
Frequently Asked Questions
Can you reverse engineer EPS control board units that are fully potted?
Often yes, but it depends on the compound. Silicone gel usually lifts without damaging the substrate. Hard epoxy and filled polyurethane are riskier, and we normally ask for a second unit so that one can be sacrificed to destructive layer extraction if needed.
How many layers does a typical EPS module have?
Column-mounted modules are commonly four to six layers; rack or pinion units built for higher phase current are often six to eight or more, generally with heavier copper inside. We confirm the count by X-ray at intake rather than inferring it.
Is this legal?
We provide compliant reverse engineering and repair support for obsolete and legacy hardware, carried out on boards the customer owns and under the customer’s authorisation. Recovering or handling firmware, calibration data or vehicle encoding requires written proof of ownership or IP authorisation, and we ask for that before any such work begins.
What do I receive at the end of the project?
A data package: schematic, Gerber and drill files, stackup specification, netlist and an annotated BOM with qualification flags and obsolescence cross-references. Prototypes are built to validate that package.
Will a reconstructed board reproduce the original steering feel?
The hardware reconstruction recovers the power stage and the sensing chain the assist algorithm depends on. The boost curve and tuning constants sit in firmware, so matching the original feel means working from authorised firmware or re-tuning on the bench, which is a separate step from the board work.
If you need to reverse engineer EPS control board hardware for a discontinued column, pinion or rack module, our PCB reverse engineering services cover the full chain from X-ray and layer imaging through netlist recovery to validated prototypes, for hardware engineers and purchasers supporting out-of-production vehicles. Send clear photographs of the housing and both board sides, together with the part number and vehicle application, and we will come back with what layer imaging can recover and where the electrical risks sit. To start that assessment, request a feasibility review.
