Flash e-bike Part 2 (disassembly)
In Part 1 of this series, I introduced the background of this particular exercise, and why we're embarking on it. With all that out of the way, let's dig in!
"Battery" removal
It's pretty clear that there's nowhere to stuff batteries and electronics other than in the frame. Further, the head tube prevents anything coming in from the top. The only way to get the guts out is from the back. This also implies that the back tire must be removed.
Aft frame connectors
In the image above, you can see the black plastic cover with two screw sockets. Within these sockets, there are security torx screws. Remove those screws, and the back cover comes off.
The first thing we see with the back cover off is the cellular antenna. It appears to have been manufactured by SkylineRF. Perhaps, at some point, we'll use the vector network analyzer to judge it mercilessly.
Moving on, we see two JULET connectors immediately visible, and there turns out to be a total of 4 similar connectors in this part of the bike. In addition, there are two bullet-type connectors between the battery and ESC, and three additional bullet connectors for the motor phases.
At the rear of the bike there are connectors for:
- Throttle to the ESC
- Power to the ESC
- Data/control/brake to the ESC
- Tail light
- Pedal assist sensor to ESC
- ESC to the motor (which is a combination of phase wiring, and hall effect sensors)
Forward frame connectors
Once we tag and disconnect all of those connectors, we're one step closer to removing the battery. Unfortunately, there is still something holding us back. At the front of the bike frame, below the LCD, there is the charge port and horn. In this screenshot from the manual, you can see what it looks like (I didn't take a photo). In the manual, there are philips-head screws, but my bike had more security torx screws.
Once the charge port is unscrewed, we can peak into the frame and see what's holding us up. The charge point is clearly wired into the battery, but we can also see that the horn, charge connector, and a mystery switch all have wires that go into the battery enclosure.
Once the charge port is removed, we can peer info the frame, and investigate what other connectors are remaining. To start, the LCD screen has two multi-wire harnesses and two micro-coax connectors that originate in the battery case. Further, there are JULET-style connectors for the two button clusters, brake levers, and the headlight. All told, the connections at the front of the bike are:
- LCD data connector 1
- LCD data connector 2
- LCD micro coax 1 (SMA male from the battery)
- LCD micro coax 2 (SMA female from the battery)
- Left brake handle
- Right brake handle
- Left button cluster
- Right button cluster
- Headlamp
Because the charging port assembly isn't connectorized, I opted to insert it into the frame as-is, and remove it along with the battery.
Battery disassembly and brief analysis
Once the battery was out of the bike, it was time to figure out what its deal really was. It was clear that there was somewhat more than just a battery in the large enclosure, but it wasn't at all obvious whether the "brains" of the bike were in the LCD module, or the battery pack.
It became obvious that the brains weren't in the LCD module. In the image above, I've opened the battery, and we're looking at the PCB in the front part. This is where the LCD cables, buttons, brakes, charging wire, etc. come in.
After having removed the mainboard, we can see the battery management system (BMS) PCB below it. Also, we can see some of the battery wiring. The charging wires come in, and we discover that the mystery button is wired to the BMS, not the mainboard. Finally, we can see that there's a switch that allows the mainboard to be powered completely off. I suspect this is for manufacturing. The mainboard consumes a lot of power, and it would be desirable for them to keep it off until right before delivery to the customer.
Now that we've gotten all the pieces out of the bike, and opened all the enclosures, we're finally in a position to diagram out how the bike works. They've designed it so that the "Battery" pack is really the core of the entire bike. Nearly every connection passes through this enclosure. The exceptions are the motor, pedal sensor, and throttle connections to the ESC.
While researching the bike, and reading the reviews, there was lip service paid to the notion of a replaceable battery. They'd say things like:
- Battery pack is not easily removable
- while the battery is technically removable, it’s not at all easy to do so
These statements are categorically false. There's no reasonable way to replace the battery. We'll get into this more in the battery post; there's no evidence that a spare battery even exists. As best I can tell, the battery pack was custom manufactured, and the supplier doesn't list the SKU on their website at all.
The only review that was honest about whether the battery was replaceable was electrified reviews, but it's buried in their comparator tool. "Replaceable battery: No."
Next steps
Now that we've got the bike disassembled, and understand how the components fit together, it's time to start digging into individual pieces of it. There will be a post investigating the battery management system (BMS), the electric speed controller (ESC), main board, and getting it to work with a 3rd party display. (sidebar: In the ebike world, a "display" is more like a controller; not only does it display facts about the bike, but it also has buttons for assist modes.)
It's a long shot, but I might spend some time reverse engineering deeper into the main board including the LCD display, and the head/tail lamps. The head and tail lamps are actually a fascinating case of over engineering on their own, but will require getting deep into the mainboard (this will make sense later).