Electric bikes are a fantastic way to commute and enjoy the outdoors, but many riders find themselves wanting a little extra speed. If you’re curious about pushing the limits of your e-bike and achieving faster speeds, this DIY guide explores how one enthusiast successfully modified their NCM Venice + e-bike. Please note that modifying your e-bike can have implications for warranty and regulations, so proceed with caution and understanding of the risks involved.
Understanding E-bike Speed Limits
Electric bikes in many regions come with factory-imposed speed limits to comply with regulations. These limits are often programmed into the bike’s controller, restricting the motor’s assistance beyond a certain speed, typically around 25 km/h (15.5 mph) or 32 km/h (20 mph). While these limits are in place for legal and safety reasons, some riders seek ways to bypass them to unlock the full potential of their e-bike’s motor.
Reverse Engineering the NCM Venice + E-bike
This project focuses on the NCM Venice + 48V e-bike, equipped with a Das-Kit C7 display and a Lishui controller. The stock display settings offer limited customization, preventing users from easily adjusting parameters like speed limits. Undeterred by these limitations, the author embarked on a journey to understand and modify the communication between the display and the controller to achieve higher speeds.
To begin, the cables connecting the display and controller were carefully examined. Using tools like an oscilloscope and a logic analyzer, the author meticulously mapped out the cable functions and pin assignments. This process revealed that the display and controller communicate using digital messages at 9600 baud, 3.3Volt TTL levels. By intercepting and analyzing these messages, the communication protocol could be deciphered.
Decoding the Communication Protocol
The investigation revealed a structured exchange of data between the display and the motor controller. The display sends 12 bytes of data to the controller approximately 10 times per second, and the controller responds with 10 bytes. This constant communication loop is essential for the e-bike’s operation. Key bytes within these messages were identified:
- Bytes 0 & 1: Always “3A 2C” – likely a start frame or identifier.
- Byte 2: Support level indicator (Eco, Normal, Power).
- Byte 3: Drive level, ranging from pushing aid to assist levels 1-6.
- Byte 4: Final speed – notably, this byte indicated a speed limit of 26km/h (0x1A).
- Byte 8: Checksum for data integrity.
The controller’s response messages also contained valuable information, including motor current, cycle time (related to speed), and motor running status.
Modifying the Controller with a Microcontroller
With a solid understanding of the communication protocol, the next step was to manipulate the messages sent to the controller. A Teensy microcontroller was employed to intercept and modify the data stream from the display. By reprogramming the Teensy, the author could alter specific bytes in the messages before they reached the controller.
For example, by modifying Byte 4 (the speed limit byte), the author successfully tricked the controller into allowing higher speeds. Selecting support level two on the display, the modified system sent a message to the controller indicating a much higher maximum speed (36km/h).
No Comments