EV Charger PCB Reverse Engineering — What It Delivers and Why It Matters
EV charger PCB reverse engineering is the process of extracting a complete set of manufacturing files — Gerber data, bill of materials, schematic, and netlist — from an existing Level 2 or Level 3 (DC fast-charge) charging station circuit board. It enables hardware teams to reproduce, repair, or redesign charger electronics when original documentation is unavailable, a supplier has gone out of business, or a product needs localization for a new market. Our engineers routinely handle boards carrying 400–1000 V DC bus rails, GaN/SiC power stages, and CAN / PLC communication interfaces that make these assemblies distinctly different from commodity power supplies.
Why Do Engineers Need EV Charger Board Recovery?
Charging infrastructure is scaling faster than many OEM support programs. Three scenarios dominate the requests we receive:
- Legacy fleet maintenance. Early-generation AC chargers (2012–2018) often use controllers from vendors that have pivoted or closed. Without schematics, field repair is guesswork.
- Second-source production. A CPO (Charge-Point Operator) owns the design IP but lost the original Gerber package after a contract manufacturer change. Reverse engineering recovers those files from a known-good sample.
- Localization & redesign. Adapting a 480 V / 60 Hz North American DC charger for a 400 V / 50 Hz European or Asian grid requires understanding every protection circuit and control loop — data that only lives on the board itself.
What Makes EV Charger Boards Technically Challenging?
Compared to general industrial controllers, EV charger PCBs carry several design features that increase reverse-engineering complexity:
| Feature | Typical Spec | RE Challenge |
|---|---|---|
| High-voltage isolation | 2.5–4 kV creepage, reinforced insulation per IEC 61851 | Thick-copper pours, wide clearance slots obscure low-voltage trace routing underneath |
| Layer count | 4–8 layers (power stage); up to 10 layers (DC fast-charge main board) | Inner-layer imaging requires controlled delamination; 2 oz+ copper complicates cross-section |
| Power semiconductors | SiC MOSFETs (e.g., Wolfspeed C3M series), GaN HEMTs, IGBT modules | Custom gate-driver networks, thermally coupled via planes — net extraction must preserve thermal path data |
| Communication buses | CAN 2.0 B, ISO 15118 PLC, Modbus TCP, OCPP over Ethernet | Mixed-signal routing with EMC-critical trace geometry; impedance must be captured, not just connectivity |
| Safety MCU | Dual-core lockstep (e.g., TI TMS570, Infineon AURIX) | Read-protected flash; firmware recovery requires authorized IC unlock |
| Conformal coating | Silicone or polyurethane, 25–75 µm | Must be chemically stripped without damaging silk-screen legends or fine-pitch QFN pads |
These factors push EV charger projects into a higher complexity tier than typical inverter board reverse engineering, though the power-stage methodology overlaps significantly.
Step-by-Step EV Charger PCB Reverse Engineering Process
1. Intake & Feasibility Assessment
We photograph the board at 20 MP+ resolution, catalog every component marking, and assess layer count with a backlight test or micro-section of a sacrificial edge coupon. For boards with potted modules (common on 50 kW+ DC chargers), we determine whether de-potting is viable without destroying critical components. Turnaround for feasibility: 1–2 working days.
2. Component Removal & High-Resolution Scanning
All SMD and through-hole parts are desoldered, cataloged by reference designator, and cross-referenced against distributor databases to build the BOM. The bare board is scanned at 1200–2400 DPI per layer. On 6+ layer boards, we use controlled chemical or mechanical delamination to expose each inner copper layer individually.
3. Gerber Reconstruction
Scanned images are vectorized in CAM software (typically PADS or Altium). Our engineers manually verify every via, pad, and copper pour against the physical board. Trace widths on high-current paths (often 100–200 mil / 2.5–5 mm for 32 A AC stages) are measured with calibrated tools to ±0.5 mil accuracy. Controlled-impedance pairs for CAN-H / CAN-L differential lines are noted with target impedance (typically 120 Ω ±10%).
4. Schematic Capture & Netlist Verification
The Gerber netlist is imported into schematic capture. We organize the design into functional blocks — PFC stage, DC-DC converter, relay/contactor drive, MCU control, communication interface, metering (CT / shunt), and user interface. Each block is verified against known reference designs and datasheet application circuits. A DRC and ERC pass confirms electrical consistency.
5. Firmware & IC Recovery (When Authorized)
If the customer owns the original IP and provides proof of authorization, we can attempt readout of protected MCUs. Safety-critical charger MCUs (AURIX TC2xx, TMS570) use tiered protection; success depends on the specific lock level. We provide a realistic feasibility assessment before any attempt. All IC work is performed under NDA with ownership verification — see our compliance and authorization policies.
6. Deliverable Package & Validation
The final package includes Gerber RS-274X (or ODB++), a component-level BOM with manufacturer part numbers and substitutes, a hierarchical schematic (PDF + native source), and a netlist comparison report. On request, we fabricate a validation prototype and run functional tests including hi-pot (per IEC 61851-1 / UL 2594 requirements) before releasing files.
How Much Does EV Charger PCB Reverse Engineering Cost?
Cost depends on board size, layer count, component density, and whether firmware recovery is needed. The table below gives representative ranges based on recent projects:
| Board Type | Layers | Component Count | Typical Cost (USD) | Turnaround |
|---|---|---|---|---|
| Level 2 AC charger control board | 4 | 150–300 | $600 – $1,200 | 8–12 working days |
| Level 2 AC charger power stage | 4–6 (2 oz Cu) | 80–200 | $800 – $1,500 | 10–14 working days |
| DC fast-charge main controller | 6–10 | 400–800 | $1,800 – $4,500 | 14–22 working days |
| DC fast-charge power module (single) | 4–6 (4 oz Cu) | 60–150 | $900 – $2,000 | 10–15 working days |
| HMI / display board | 2–4 | 100–250 | $400 – $900 | 6–10 working days |
Firmware or FPGA bitstream recovery adds $300–$1,500 depending on the target device. Multi-board charger systems (controller + power module + HMI) receive bundled pricing — typically 15–20% below the sum of individual boards.
Common EV Charger Chipsets We Encounter
Knowing the silicon ahead of time helps us estimate feasibility faster. Chips we see repeatedly on charger boards include:
- Main MCU: STM32F4 / F7 series, TI TMS320F28x DSP, Infineon AURIX TC2xx, NXP S32K1
- PLC modem (ISO 15118): Qualcomm QCA7000 / QCA7005, Lumissil (formerly ISSI) IS31AP2030
- Gate drivers: Silicon Labs Si823x, Broadcom ACPL-33x, TI UCC2152x
- Power switches: Wolfspeed C3M0075120K, Infineon IMZ120R045M1, ON Semi NTH4L022N120M3S
- Metering AFE: ADE9000, MCP3914, CS5490
If your board uses a chip not listed here, send clear photos of the IC markings and we will confirm support within one business day.
Who Benefits from This Service?
Our EV charger PCB reverse engineering clients include charge-point operators managing fleets of 500+ units, EVSE startups pivoting from a reference design to a custom platform, and contract manufacturers who need to onboard production without the original design house. The same methodology applies to adjacent power-electronics equipment — teams working on UPS power-conversion boards or welding machine power controllers face similar high-voltage, high-current reverse-engineering challenges.
Limitations & Honest Caveats
- Potted power modules: Fully potted IGBT/SiC modules (e.g., Semikron MiniSKiiP) cannot always be de-potted without destroying the DBC substrate. We will flag this at feasibility.
- Encrypted firmware: If the MCU uses AES-256 secure boot with no known bypass, firmware recovery may not be possible. We never guarantee 100% success on locked ICs — only an honest assessment.
- Safety certification: Our deliverables are manufacturing files, not a certified product. The customer is responsible for re-certification (UL, CE, etc.) if the recovered design is used in a new product.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewFrequently Asked Questions
Can you reverse engineer a DC fast charger with multiple stacked power modules?
Yes. We treat each power module as an individual board and reverse engineer them in parallel. A typical 150 kW charger with three 50 kW modules yields three identical Gerber sets plus one controller board set. Bundled pricing applies, and total turnaround is usually 18–25 working days depending on layer count and copper weight.
Do I need to send a working board, or can you work from a damaged sample?
A damaged board is acceptable for Gerber, BOM, and schematic extraction as long as at least 90% of the copper and components are intact. Burned or delaminated areas may require a second sample for cross-verification. Firmware readout does require a functional MCU — if the chip is destroyed, we cannot recover code from it.
How do you handle the high-voltage safety requirements specific to EV chargers?
We document all safety-critical design features — creepage distances, isolation barriers, fuse ratings, varistor placement, ground-fault detection circuitry — in a separate safety-notes appendix delivered with the schematic. This gives your compliance team a head start on re-certification. We do not, however, perform the certification testing itself.
Is it legal to reverse engineer an EV charger PCB I purchased?
In most jurisdictions, reverse engineering hardware you own for interoperability, repair, or maintenance is lawful. We require proof of board ownership or written authorization from the IP holder before starting any project. For firmware extraction from protected MCUs, additional authorization documentation is mandatory. Review our authorization and trust framework for details.
What file formats do you deliver?
Standard deliverables include Gerber RS-274X (or ODB++ on request), BOM in Excel with MPN, description, and package columns, schematic in PDF and native Altium/KiCad/PADS format, and a netlist (IPC-D-356). Drill files are supplied in Excellon format. We can also export pick-and-place centroid files for automated assembly.
Related Reverse Engineering Services
EV charger electronics share design DNA with many power-conversion and embedded-control platforms. If you manage a mixed equipment fleet, you may also need recovery services for packaging line control boards, access control system electronics, or other industrial assemblies. Browse our full PCB reverse engineering service catalog to see the complete range of board types we support.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote