Shimano Di2 modulation

[mark.s]

Yes, it is binary phase shifting with IF 1MHz and data rate at 500kbps. Data and carrier frequency are synced so it is quite easy to sample the data. I've written a simple octave file that does the demodulation, prints it out and shows the sample points in a plot.



Here is "repeat1", 0001100001000000001111110

Code: [Select]

import = csvread ("plc.txt");
import(:,1) = [];

all = import;

repeat1 = import(6000:7100);
repeat2 = import(51000:54000);
repeat3 = import(77600:78800);
repeat4 = import(103000:104650);

cmd = import(27500:30400);
reply1 = import(61000:64200);
reply2 = import(86950:89800);

ack1 = import(30500:31800);
ack2 = import(64300:65600);
ack3 = import(89800:91800);

signal = cmd;


threshold = 0.15;
sample_th = 0.05;


plot(signal)

receive = 0;
peakdetect = 0;
oldpeak = 0;
sync = 0;
threshold = 0.15;
data = zeros(1);
sampletime = zeros(1);
bitcount=1;

for i = [1:length(signal)]
  # got threshold value
  if (receive == 0 && signal(i) > threshold)
    peakdetect = 1;
  endif
 
  # finding peak
  if (peakdetect == 1 && signal(i) < oldpeak)
    peakdetect = 0;
    receive = 1;
    #Use next half wave as sample point. -1 for maximum
    sync = i+10-1;
  endif
 
  # receiving
  if (receive == 1 && rem(i-sync,40) == 0)
    sampletime(i)=0.1;
    if (signal(i) > sample_th)
      data(bitcount)=1;
      bitcount = bitcount+1;
    elseif (signal(i) < -sample_th)
      data(bitcount)=0;
      bitcount = bitcount+1;
    else
      receive=0;
      data
      data = zeros(1);
      bitcount =1;
    endif
  else
    sampletime(i)=0;
  endif
  oldpeak = signal(i);
endfor
hold on;
plot(sampletime);
hold off;


[Radiohead]

Thanks Mark.s!

I had given up on this project as I didn't get any further with it. I do not know whether I'll pick it back up as I've got my hands full for the foreseeable future. However it's still great to see that someone figures out the modulation type.

[avandalen]

Shimano Di2 SWCAN hack
I have developed my own electronic system to control an e-bike:
https://www.avdweb.nl/solar-bike/electronics/robust-two-wire-gnd-5v-current-controlled-bus-for-ebikes


I want to use the electronic shifting Alfine Di2 11-speed hub with the motor unit MU-UR500. But I don’t use any other Shimano parts, such as the Di2 battery, switch, junction box or display.

So, I have to control the motor unit by software myself. No one has hacked the Di2 system till now, so that's what I want to do.

Shimano Di2 uses its own, non-standard, CAN variant (probably SWCAN) in which the power supply and the CAN signal go together.

Who can lend me a complete system so I can hack the Di2?

[Henrikw]

@avandalen did you get any further on this. Im interested on the same thing.

[c0d3z3r0]

I got a Shimano SW-E6000 switch here, which I'd like to use for my custom eBike controller.
Ofc I could just get rid of the MCU inside and connect the buttons directly, but where's the fun then, eh?

What I know so far:
- The packaging says Di2, that's how I found this thread.
- Inside there's a 3.3V LDO and a MCU: 11XW marking
- The circuit looks very similiar to the SW-S705, just smaller package sizes
- I was able to power it with 5V and could see some weird AC waveforms on the oscilloscope, but they look different like Radiohead's
- Shimano references CAN bus a few times, e.g. https://bike.shimano.com/en-EU/technologies/component/details/steps/drive-unit.html
- There are two protocols, the older ACC and the newer Di2.
- Shimano support said StePs supports both protocols, that's why old and new components work. (Can't find the blog post anymore, but
- Since there's only two wires, Di2 might be SWCAN (that's what people say in other forums as well).
- OTOH there seem to be different protocols among Di2 components. There's a comment mentioning timed pulses https://carltonbale.com/shimano-di2-everything-you-need-to-know/comment-page-5/#canbus_protocol

I found this post in the German pedelec forum: https://www.pedelecforum.de/forum/index.php?threads/optimierung-von-shimano-steps-systemen-mit-den-emax-softwarewerkzeugen.51623/page-178#post-1596705

- That guy claims they have decapped, reverse engineered that chip:
  - It's a custom chip based on Renesas RX
  - The protocol is not "just simple CAN" but a "very special" proprietary protocol
  - At least that sounds like it is somehow similiar to CAN - maybe some modified SWCAN that can be implemented without dedicated transceiver?

This video confirms @mark.s's results. https://youtu.be/Dyn7XHsTmgI?t=530
Note beside: that guy is claiming there is no way that Di2 could be CAN + power over a single wire, but he's only talking about regular two-wire CAN, but completely ignoring SW-CAN and possible proprietary modifications of it. Also there ist DCAN500, which is CAN-over-Powerline.

I found reddit posts from people saying that they were able to simply use regular CAN modules (like mcp2515) on SWCAN busses. Might be worth a try :O



@Radiohead: Can you give some more details on how you powered your SW-S705 and connected your osci?

[c0d3z3r0]

I created schematics for the SW-E6000.  SW-E6000.pdf (112.88 kB - downloaded 17 times.)

Also, here are some of my measurements. I'm now relatively confident that this is PSK as well, but it still looks weird. Even when I attach to TP4  :/

Power line:




TP4:

[Radiohead]

@Radiohead: Can you give some more details on how you powered your SW-S705 and connected your osci?

I probed the circuit and found a circuit point where the AC signal of the supply was coupled onto a DC bias before entering the MCU. I used a complete system with the original battery which includes an inductor to provide a high impedance so the signal can be injected on the DC power supply. If you use a power supply a series inductor is required or the impedance will be to low to function.

- Since there's only two wires, Di2 might be SWCAN (that's what people say in other forums as well).

I'm not familiar with CAN-bus systems and I returned the Di2 system to it's owner so I
 can't help you any further. I had bought a cheap rtlsdr to take an attempt at decoding the signal but never got GNUradio working.

[c0d3z3r0]

If you use a power supply a series inductor is required or the impedance will be to low to function.

Ah well, there is one on the board, but maybe it's not enough 

[SteveThackery]

Crazy that derailleurs are still a thing in 2020.  Surely at some point it'll make more sense to use a motor/generator combination to transmit power from the crank to the rear wheel...

Can't get close to the efficiency of sprockets and a chain. Every percent counts on a bike.

You might have heard of the hydraulic system which was experimented with some years ago. The pedals drove a hydraulic pump, the fluid from which then drove a hydraulic motor in the rear hub.  Lots of advantages: the gear ratios can be implemented inside the hydraulic motor, so no external complications; the whole kit is clean, maintenance free, compact, etc.  It failed for one simple reason: poor efficiency compared with chain and sprockets.

I totally share your bogglement that derailleurs are still a thing.  I would describe them as an exceptionally well developed bad idea.  The idea of requiring extra-flexible chains so they will tolerate running on sprockets well out of line with each other shouts bodgery of the first order. And the lengths they go to, with bent teeth to pick up the chain and drag it across the sprockets... UGH!  It's horrible, horrible.

AND YET - when they are set up properly they work brilliantly, far better than they really should. 😄