Ultegra Di2 hacking

[Chiva]

http://fairwheelbikes.com/forum/viewtop ... 73#p100573

I just posted some pictures here.

[Chiva]

I ran into the same issue trying to use some very small batteries that will slip inside the frame near the bottom bracket of my Tarmac SL4. I connected my batteries through the battery mount (with alligator clips) and this does work, verifying that the ID chip is in the battery mount.

The mount itself is 24.5 grams without the easily removed hardware. It is much too big to go inside my frame and is glued together - I don't think it can be taken apart without cutting it up. It may be possible to remove the circuit board by destroying the plastic housing.

Besides the cludgy stock mount and saving battery weight (mine are 21 grams for the two) I would like to be able to play around with additional shifter switches. I connected an oscilloscope and the signals are evident on top of the battery voltage. I can't tell if it is actually a CAN signal - it says so in various places on the internet but it is difficult to tell if one person made this up and got copied. If so it would not be very difficult to hack.

Chiva, please keep us posted on dismantling the battery mount!

I don't know if this image will work.

Was the negative clip on the terminal the one closest to the frame? I just want to double check before I fry something:)

[di2diy]

I ran into the same issue trying to use some very small batteries that will slip inside the frame near the bottom bracket of my Tarmac SL4. I connected my batteries through the battery mount (with alligator clips) and this does work, verifying that the ID chip is in the battery mount.

The mount itself is 24.5 grams without the easily removed hardware. It is much too big to go inside my frame and is glued together - I don't think it can be taken apart without cutting it up. It may be possible to remove the circuit board by destroying the plastic housing.

Besides the cludgy stock mount and saving battery weight (mine are 21 grams for the two) I would like to be able to play around with additional shifter switches. I connected an oscilloscope and the signals are evident on top of the battery voltage. I can't tell if it is actually a CAN signal - it says so in various places on the internet but it is difficult to tell if one person made this up and got copied. If so it would not be very difficult to hack.

Chiva, please keep us posted on dismantling the battery mount!

I don't know if this image will work.

Was the negative clip on the terminal the one closest to the frame? I just want to double check before I fry something:)

[TurboKoo]

I believe the cpu is in the front derailleur but have not verified this.

I took off the front derailleur wire and it still worked.
Could the CPU be in adjusting block?

[jeffr]

In di2 there is no single 'cpu' or 'brain'. It's a distributed networked system with some processing capability at each point. Just like a bunch of computers on a LAN. They each tell the others what they are doing and broadcast commands and status. I suspect ui2 is the same.

[chipg]

Negative is closest to the frame/flat end. See di2diy's photo.

[Chiva]

Negative is closest to the frame/flat end. See di2diy's photo.

Thanks for your help in easing my paranoia di2diy and chipg. Much appreciated:) I have confidence now that when I solder those wires to the battery mount I'll be in business.

[kulivontot]

I would guess that you might just be seeing spikes in current on the battery line from turning on the motor as you activate the shifter. I really doubt that they'd put the communication superimposed upon battery lines. If shimano used an off-the-shelf battery authentication chip, then one could just make their own circuit after buying the same chip and use it with an aftermarket battery. Unfortunately, I would bet on shimano using either an unmarked, or proprietary authentication chip to prevent exactly what we're discussing. Until someone cuts apart the battery mount and verifies what's inside, we won't really know.

[chipg]

Since there are only two wires in the entire system they have clearly superimposed the signals on the power. This is not an unusual thing to do.

[chipg]

As suggested by did2iy, I just tried splicing into the circuit and powering up the battery holder (and everything else) from the round Shimano connector side. This doesn't work. Power needs to go through the battery holder from the battery side.

[di2diy]

As suggested by did2iy, I just tried splicing into the circuit and powering up the battery holder (and everything else) from the round Shimano connector side. This doesn't work. Power needs to go through the battery holder from the battery side.

After I posted that and thought about it I wanted to retract it, of course there must be some sort of diode in the circuit. Sorry about that.

[di2diy]

As suggested by did2iy, I just tried splicing into the circuit and powering up the battery holder (and everything else) from the round Shimano connector side. This doesn't work. Power needs to go through the battery holder from the battery side.

After I posted that and thought about it I wanted to retract it, of course there must be some sort of diode in the circuit. Sorry about that.

How about something like this

[chipg]

As suggested by did2iy, I just tried splicing into the circuit and powering up the battery holder (and everything else) from the round Shimano connector side. This doesn't work. Power needs to go through the battery holder from the battery side.

After I posted that and thought about it I wanted to retract it, of course there must be some sort of diode in the circuit. Sorry about that.

How about something like this

Yes but worth the try if it had worked. It looks like I will have to cut up the mount. I plan to wait a bit hoping that someone produces a board.

[Super_fast]

In di2 there is no single 'cpu' or 'brain'. It's a distributed networked system with some processing capability at each point. Just like a bunch of computers on a LAN. They each tell the others what they are doing and broadcast commands and status. I suspect ui2 is the same.

Exactly, in every part in the Ultegra DI2 group is a micro-controller so it can communicate with the other parts. The current Dura Ace shifters have no electronics in them, but the Ultegra shifter do have a small board with a micro-controller.

I posted on Fairwheelbikes some results of my measurements.

[Nimra]

Hi there,
I just wonder if there are any news?
Are there any little helpers out there for connecting individual 7.4 batteries?