ANT+ is a wireless protocol specifically designed for use with sensors, and has similar functionality in some respects to Bluetooth Low Energy. It’s found a place among various bicycle equipment manufacturers, to connect smartwatches, cycle computers and electronic gear shifters. Of course, as soon as something becomes a defacto standard someone has to start coloring outside the lines. In this case, Shimano went off book with their DI2 groupset, leaving [kwakeham] with a reverse engineering job on his hands.
[kwakeham] gives us a great example of how to approach reverse engineering. Researching the Shimano hardware by its FCC ID shows that the device communicates using an NRF24AP2 chip, common in ANT+ devices. The Shimano device is then opened, and a logic analyser attached to various test points until the SPI interface between the transceiver and microcontroller is found. At this point, it’s a simple matter of putting the hardware through its paces and capturing data until the protocol can be pulled apart, piece by piece.
The work is documented on Github for anyone wishing to interface with the Shimano DI2 groupset. Reverse engineering is a powerful skill, that can teach you about everything from Pokemon to botnets. Video after the break.
https://www.youtube.com/watch?v=25Kyh5im_ak&feature=youtu.be
Combine with a cadence meter to make it full automatic.
You could use cadence and gear position to calculate chain speed and optimize the shift speed for the fastest possible shift at any position. Power meter + cadence would make for excellent automatic shifting, more so than cadenc on it’s own.
Ooh, this could be used for automatic shifting and then we can replicate features from other e-shift systems. I like rohloff’s downshift on halt feature, it shifts down to a user-programmable gear when the bike comes to a stop (e.g. for traffic lights) so it’s easy to get going again. it wouldn’t work on the Di2 derailleur systems but iirc there’s an 11 speed hub gear offering.
>but iirc there’s an 11 speed hub gear offering.
Yup. There’s a Di2 Alfine 11 speed gear hub. There’s no Di2 Nexus (rim brake or roller brake) version of the hub, so you’re limited to disc brake frames.
There is Di2 8Speed Gear Hubs! Nexus or Alfine both work. and now there is the Nexus 5E with Di2.
Any idea about Shimano Steps system? Can I power a GPS Tracker from the Di2 Cable?
I didn’t know electric shifters for bicycles existed.
The most popular system has been commercially available for nearly 10 years now. Another vendor has offered wireless electric shifting for 3 years.
Wait…. electronic shifters? for road bicycles right? Is there really an efficiency gain from electronic shifters over regular cable shifters?
Note: i ride cross country so all of my electronics are decoupled from the frame.
Sigh…. yes. There isn’t an efficiency gain, except that it’s a new gimmick to sell bikes. When the battery goes dead, then you can’t shift and need to take it in to the dealer.
A new gimmick… that’s been in the market for 10+ years… sure.
Umm the battery is rechargeable.
…Or you just buy a new battery online (also, you do know they’re rechargeable, right?), pull out the seatpost, and swap them yourself. Or in the case of external battery units: just pull the battery out and put the new one in. Don’t talk about what you don’t understand, kid.
It’s not a gimmick. Mechanical cables SUCK. They stretch, just with normal use. They get gummed up with road grit. They rust. The freeze from water inside them. Joy is “my bike is in a low gear and won’t shift and I still have 20 miles to get home and now I can’t pedal hard enough to keep warm AND it’s going to take forever to get home.” 10 speed systems are pretty sensitive, and 11 speed systems are ridiculously so.
Electronic shifting systems are so good that the automatically detect failed shifts and recalibrate their adjustment. They can provide better shifting by optimizing the shift point for the rear derailleur for whatever position the front DR is in; the angle of the chain affects ideal final shift point. And the front DR can be automatically trimmed for the rear DR’s position.
The rear DR can purposefully overshoot the ideal resting place for a particular gear, in order to complete the shift faster, and then center itself in the proper resting position.
Integrated road shift levers are surprisingly complicated, even with excellent care they wear down and break (and in the case of Shimano, they are not serviceable – you’re expected to throw them away and buy new ones.) The electronic shifters are a set of buttons and the brake actuator – far simpler and lighter.
Wireless systems go even further by eliminating almost all cables, which reduces the total shift system weight even more, makes installation/service faster especially on aero bikes where cables are routed inside the frame and this takes much more time than external routing.
Don’t be silly. The battery lasts easily 3000km (depending on how much you shift) and is easy to charge. Electronic shifting is not a gimmick, as the system is faster and more accurate than manual. I have had Ultegra DI2 for three summers and it has worked perfectly every single gear change.
The electronic sifters have a few advantages. Faster with accuracy (humans can shift faster mechanically but misshifts constantly happen at those speeds, overshift, undershift, etc). They can apply more shifting force so they work significantly better under load (pedaling up a hill). They are immune to cable stretch and cable friction. They can more readily be adjusted on the fly while riding. They operate more repeatedly in poor conditions, and generally require way less maintenance than cables. Kind of gimmicky, but I won’t be going back to mechanical on main bikes.
My Samsung Galaxy has ANT+. Not sure why since it has BT as well.
As mentioned in the video, there is no BLE shifting profile. BLE compatibility in sports is still a joke. HRM is sorted almost. but Powermeters are still a mess. And with the rise of indoor cycling software BLE is a problem. You can only have one connection per sensor. So if you connect your bike stuff to your apple tv or computer for Zwift, you cannot connect it to a cycle computer or a phone at all. ANT and ANT+ (the plus is the sports controlled profiles) still amazingly own the sports market due to it’s higher quality documentation, free testing software, low entry level costs, and they don’t even have a document that threatens you if you don’t give the BLE consortium a lot of money (50k/year membership, 8k to list a certified device, about 40k to certify a device… ANT+ 1500/year or 0/year, 500 -1000 to certify a device). Bluetooth literally has a document that explains how they’ll go after you! Niche markets like cycling and sports sensors have a hard time playing in the ble field since it’s so far behind sadly. It’s where ANT was in cycling over 10 years ago.
Because ANT+ runs on the bluetooth chip; it’s just a bit of extra firmware for the radio module. Dynastream offers it for fairly cheap, and many phones even have ANT+ capable firmware but it’s not activated. Copying over the necessary libraries and tweaking one or two things gets you ANT+ on a slew of Nexus phones for example.
Just think of all the fun you can have hacking the competition- pineapples on a road course.
It isn’t wireless shifting.
Thinking outside the box…even if your not messing with their gears, being able to see the competition’s info (i.e. heart rate or power) could be enough to give you an advantage in a race.
ANT (and I think ANT+ as well) is even implementable on the cheap nrf24l01, did that in the past and I was able to communicate with my samsung smartphone. Never made anything out of it, let alone documenting it, but if anyone is interested I might be able to find the files.
I’d be interested, I picked up an adafruit feather that has a nRF52832 in it but haven’t found much around ANT+ code for it yet.
I thought I was worse at coding 5 years ago, but I was much more tidy :)
You probably have to convert the indentation from 4 to 2 spaces or something similar to make sense of the charts.
There was quite some work of reverse engineering here
https://github.com/vitomakes/ANT_on_NRF24L01/blob/master/nRF_ANT.c
This is a bit silly given you can buy ANT+ USB dongles for about $5, and there’s open source software to talk to it, including python libraries.
Wanting to know more about the actual electrical signalling (guess this is what shimano calls etube) i cut the cable on a SW-R600 Remote Satellite Shifter. There are two wires, red and black, inside the cable. Btw. the red wire goes to the centre of the little barrel connector. After some fiddling around i got half a result.
Setup: lab supply set to 7.4V, GND on black wire, 7.4V in series with 40 Ohm resistor to the red wire. Oscilloscope probe on the red wire.
With this i can see a series of three negative pulses (1V drop from supply) repeating every 37ms. The pulses are approx 1.5ms wide. There is no activity when i press a button or both buttons for that matter… All i can see is this repeating pattern. Nothing special on power up. It seems the button needs some kind of setup sequence in order to do anything.
I don’t own any other components than the button i took apart. It was brand spanking new out of the box. If whole system is distributed with intelligence in every component, i suppose a “used” button might have a configuration that makes it behave differently. Or the central “thingie” that the buttons connect to, sends a config on power up.
Would be really cool if anybody would probe a complete functioning system and share the results
Its known that the key electronics module in a Di2system is in the battery for the internal battery and in the battery mount for the external battery as updating the software on these modules is can brick the system, or make certain configurations unusable. At the launch of 11 speed Di2 it used to be possible to use an older 10speed groupset front mech with the newer 11 speed front mech. Shimano in one of the later battery module firmware updates stopped this, and it bricks the system so nothing functions, it is currently not possible to revert back to a previous level. This reverse engineering might be useful for those making custom systems. I Believe fairwheel bikes had a sequential shift system long before Shimano on the older 4 wire pre-canbus Di2 system.
Thanks for the video.
I think a really interesting application would be to make the rear derailleur positions configurable.
This could be used to shift old cassettes.
I personally still have some nearly new 9 speed and 10 speed cassettes. If the cog positions ( or at least the cog to cog distance could be adjusted a modern dI2 system could shift them without problems…
Does anybody know if Shimano even offers this right now, or if we have to wait for an open sourced reverse engineered software?
10 speed is possible so long as your rear mech is a 10-speed part and the front mech (if present) is of the same generation. (mixing 10s rear with a 11s-gen front was only possible with very old firmware).
For 9 speed, you’d have to at least reprogram the rear mech controller to drive the stepper less, but I don’t know how the mech tells the system whether an up or downshift is available, and which gear is current (the display unit can show the gear number). Easier to fit 11 speed.
there’s no video on youtube or files on Github :/
yeah would be interesting to see the documents as i would like to do the same with sram axs
As Shimano is still not going ANT+ and cancled the license with a company for shifting information, I was curious if we could get shifting information to build our own indicator/controls with help of small micro controller or Android APP.
I was looking for basic knowledge out there, not to invent the wheel twice.
Any chance to get the repo up and running or did the shimano craken come first?
Really sad to see that the github project and youtube videos were taken offline. Clearly this work was “getting somewhere” and someone sent “threats”. I would have loved to see the work done and some insigght on the protocol. Have 3 bikes with Di2 and I’d love to trouble-shoot issuse. Even if I have the latest hookup equipment, and the ability to dump the whole system’s diagnostics, Shimano is not making it readable (in .dat files)…. so some added frustration here (as one of my R.D. is randomly disappearing).
Here you can find how to hack di2 fw < 4.2.3 https://www.usenix.org/system/files/woot24-motallebighomi.pdf