Ultegra Di2 hacking

Discuss light weight issues concerning road bikes & parts.
Chiva
Posts: 341
Joined: Sat Apr 03, 2010 11:05 pm

by Chiva


Chiva
Posts: 341
Joined: Sat Apr 03, 2010 11:05 pm

by Chiva

chipg wrote:I ran into the same issue trying to use some very small batteries that will slip inside the frame near the bottom bracket of my Tarmac SL4. I connected my batteries through the battery mount (with alligator clips) and this does work, verifying that the ID chip is in the battery mount.

The mount itself is 24.5 grams without the easily removed hardware. It is much too big to go inside my frame and is glued together - I don't think it can be taken apart without cutting it up. It may be possible to remove the circuit board by destroying the plastic housing.

Besides the cludgy stock mount and saving battery weight (mine are 21 grams for the two) I would like to be able to play around with additional shifter switches. I connected an oscilloscope and the signals are evident on top of the battery voltage. I can't tell if it is actually a CAN signal - it says so in various places on the internet but it is difficult to tell if one person made this up and got copied. If so it would not be very difficult to hack.

Chiva, please keep us posted on dismantling the battery mount!

I don't know if this image will work.

Image


Was the negative clip on the terminal the one closest to the frame? I just want to double check before I fry something:)

by Weenie


di2diy
Posts: 18
Joined: Mon Dec 05, 2011 9:02 am

by di2diy

Chiva wrote:
chipg wrote:I ran into the same issue trying to use some very small batteries that will slip inside the frame near the bottom bracket of my Tarmac SL4. I connected my batteries through the battery mount (with alligator clips) and this does work, verifying that the ID chip is in the battery mount.

The mount itself is 24.5 grams without the easily removed hardware. It is much too big to go inside my frame and is glued together - I don't think it can be taken apart without cutting it up. It may be possible to remove the circuit board by destroying the plastic housing.

Besides the cludgy stock mount and saving battery weight (mine are 21 grams for the two) I would like to be able to play around with additional shifter switches. I connected an oscilloscope and the signals are evident on top of the battery voltage. I can't tell if it is actually a CAN signal - it says so in various places on the internet but it is difficult to tell if one person made this up and got copied. If so it would not be very difficult to hack.

Chiva, please keep us posted on dismantling the battery mount!

I don't know if this image will work.

Image


Was the negative clip on the terminal the one closest to the frame? I just want to double check before I fry something:)
Attachments
bat.JPG
look at this

TurboKoo
Posts: 420
Joined: Wed Oct 29, 2008 7:55 pm

by TurboKoo

chipg wrote:I believe the cpu is in the front derailleur but have not verified this.


I took off the front derailleur wire and it still worked.
Could the CPU be in adjusting block?
Scott Foil
Shimano 9150
Shimano FCR-9100-P
Shimano C60 tubulars

jeffr
Posts: 518
Joined: Sun Oct 16, 2005 11:50 am
Location: Maui
Contact:

by jeffr

In di2 there is no single 'cpu' or 'brain'. It's a distributed networked system with some processing capability at each point. Just like a bunch of computers on a LAN. They each tell the others what they are doing and broadcast commands and status. I suspect ui2 is the same.

chipg
Posts: 7
Joined: Mon Nov 21, 2011 8:20 pm

by chipg

Negative is closest to the frame/flat end. See di2diy's photo.

Chiva
Posts: 341
Joined: Sat Apr 03, 2010 11:05 pm

by Chiva

chipg wrote:Negative is closest to the frame/flat end. See di2diy's photo.


Thanks for your help in easing my paranoia di2diy and chipg. Much appreciated:) I have confidence now that when I solder those wires to the battery mount I'll be in business.

kulivontot
Posts: 1170
Joined: Sun May 16, 2010 7:28 pm

by kulivontot

I would guess that you might just be seeing spikes in current on the battery line from turning on the motor as you activate the shifter. I really doubt that they'd put the communication superimposed upon battery lines. If shimano used an off-the-shelf battery authentication chip, then one could just make their own circuit after buying the same chip and use it with an aftermarket battery. Unfortunately, I would bet on shimano using either an unmarked, or proprietary authentication chip to prevent exactly what we're discussing. Until someone cuts apart the battery mount and verifies what's inside, we won't really know.

chipg
Posts: 7
Joined: Mon Nov 21, 2011 8:20 pm

by chipg

Since there are only two wires in the entire system they have clearly superimposed the signals on the power. This is not an unusual thing to do.

chipg
Posts: 7
Joined: Mon Nov 21, 2011 8:20 pm

by chipg

As suggested by did2iy, I just tried splicing into the circuit and powering up the battery holder (and everything else) from the round Shimano connector side. This doesn't work. Power needs to go through the battery holder from the battery side.

di2diy
Posts: 18
Joined: Mon Dec 05, 2011 9:02 am

by di2diy

chipg wrote:As suggested by did2iy, I just tried splicing into the circuit and powering up the battery holder (and everything else) from the round Shimano connector side. This doesn't work. Power needs to go through the battery holder from the battery side.

After I posted that and thought about it I wanted to retract it, of course there must be some sort of diode in the circuit. Sorry about that.

di2diy
Posts: 18
Joined: Mon Dec 05, 2011 9:02 am

by di2diy

di2diy wrote:
chipg wrote:As suggested by did2iy, I just tried splicing into the circuit and powering up the battery holder (and everything else) from the round Shimano connector side. This doesn't work. Power needs to go through the battery holder from the battery side.

After I posted that and thought about it I wanted to retract it, of course there must be some sort of diode in the circuit. Sorry about that.


How about something like this
Attachments
R11-1.JPG
battery on this end, any 7.4v 20c battery should work
R12.jpg
cut this from the mount, if it has the chip it should work

chipg
Posts: 7
Joined: Mon Nov 21, 2011 8:20 pm

by chipg

di2diy wrote:
di2diy wrote:
chipg wrote:As suggested by did2iy, I just tried splicing into the circuit and powering up the battery holder (and everything else) from the round Shimano connector side. This doesn't work. Power needs to go through the battery holder from the battery side.

After I posted that and thought about it I wanted to retract it, of course there must be some sort of diode in the circuit. Sorry about that.


How about something like this


Yes but worth the try if it had worked. It looks like I will have to cut up the mount. I plan to wait a bit hoping that someone produces a board.

Super_fast
Posts: 341
Joined: Tue Nov 01, 2005 9:36 am

by Super_fast

jeffr wrote:In di2 there is no single 'cpu' or 'brain'. It's a distributed networked system with some processing capability at each point. Just like a bunch of computers on a LAN. They each tell the others what they are doing and broadcast commands and status. I suspect ui2 is the same.


Exactly, in every part in the Ultegra DI2 group is a micro-controller so it can communicate with the other parts. The current Dura Ace shifters have no electronics in them, but the Ultegra shifter do have a small board with a micro-controller.

I posted on Fairwheelbikes some results of my measurements.

by Weenie


Nimra
Posts: 6
Joined: Mon Apr 15, 2013 7:25 am

by Nimra

Hi there,
I just wonder if there are any news?
Are there any little helpers out there for connecting individual 7.4 batteries?

Post Reply
  • Similar Topics
    Replies
    Views
    Last post