In the top of the device, there is a plastic cap holding the motor in place. I undid the three clips by squeezing the device to allow for a bit more wiggle room, then prying with a flathead screwdriver.

Under the plastic cap there is a rubber thingy, presumably there to reduce vibrations of the motor.


The chip on the motor PCB is a Fortior FU6831L "MCU Embedded and Configurable 3-Phase BLDC Motor Controller" according to the datasheet.

In the bottom of the unit, holding the USB-C charging port, there is another plastic cap. This one is also held in place by three clips. They were a bit more tricky to loosen, but a little brute force with a kitchen knife did the deed without damaging the plastic too much.

By pulling out the nest of wires, two Phillips screws are revealed, fixing the battery and main board assembly to the casing. One of them is visible in this photo:

Now we can pull the assembly out.

Unfortunately I forgot to take a good picture of the board before reassembly, but the main MCU is a Nuvoton N76E003AT20. If you zoom in you might see five exposed pads in a row, which I traced to the following pins on the MCU:

Which according to the datasheet does the following:

Pin 8[SDA] / TXD_1 / ICPDA / OCDDA / P1.6
Pin 18P0.2 / ICPCK / OCDCK / RXD_1 / [SCL]
Pin 4RST / P2.0
Pin 7GND
Pin 9VDD

And this is about how far I got before my fiancée "encouraged" me to re-assemble "her" new portable vacuum cleaner.

Re-assembly went pretty smooth, except that I had to remove the plastic push-button to seat the battery assembly correctly. After this was done, it was easy to click the button in place (with the spring in between).

Conclusion

I have no idea whether the exposed serial port can be used to read the built-in flash or not, and I'm clueless to whether the chip would let me flash a modified firmware to it, even if I knew what bits to change to enable the second speed mode...

If someone would like to experiment with their non-throttled version and manages to dump the firmware, please get in touch!