Editing Move Motion Controller

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
[[Category:Hardware]]
== Move Hardware ==
== Move Hardware ==
[[CECH-ZCM1]] <small>([[CECH-ZCM1U]], [[CECH-ZCM1E]], [[CECH-ZCM1J]], [[CECH-ZCM1H]], [[CECH-ZCM1M]])</small><br />
*Model nº
**CECH-ZCM1U (bought in ?)
**CECH-ZCM1E (bought in europe)


MIC listings:
Some photos of a dissassembled move controller ---> http://www.ifixit.com/Teardown/PlayStation-Move-Teardown/3594/1
* [http://www.tele.soumu.go.jp/giteki/SearchServlet?pageID=jg01_01&PC=007&TC=N&PK=1&FN=281ul&SN=%94%46%8F%D8&LN=6&R1=*****&R2=***** 007WWCUL0522] June 29, 2010 ([[CECH-ZCM1J]])
* [http://www.tele.soumu.go.jp/giteki/SearchServlet?pageID=jg01_01&PC=007&TC=N&PK=1&FN=298ul&SN=%94%46%8F%D8&LN=7&R1=*****&R2=***** 007WWCUL0630] March 8, 2011 ([[CECH-ZCM1J]])
* [http://www.tele.soumu.go.jp/giteki/SearchServlet?pageID=jg01_01&PC=007&TC=N&PK=1&FN=275ul&SN=%94%46%8F%D8&LN=11&R1=*****&R2=***** 007WWCUL0489] March 30, 2010 ([[CECH-ZCM1J]] / [[CECH-ZCM1JD]])


Anatel:
=== ARM STM32F103 VBT6 Y (32bit MCU) ===
* [http://sistemas.anatel.gov.br/sgch/HistoricoCertificado/Homologacao.asp?NumRFGCT=189210&idtHistoricoCert=85799 2090106223] 13/01/2012 ([[CECH-ZCM1M]])
 
*Main board reference
**'''YCON2_1.01''' (dissassembled photos ---> http://www.ifixit.com/Teardown/PlayStation-Move-Teardown/3594/1)
**'''YCON2.5_1.03''' (different Bluetooth chip, different 2-axis gyro "PR425A 2117 AEWEP")
 
*Note some components and testpoints (TP) are different between models.
 
=== STM32F103 VBT6 Y (ARM Cortex-M3 32bit@72MHz SRAM20Kb FLASH128Kb RISC Microcontroller) ===
U19 <br />
U19 <br />
http://www.st.com/mcu/devicedocs-STM32F103VB-110.html
http://www.st.com/mcu/devicedocs-STM32F103VB-110.html
Line 26: Line 18:
! style="background-color:#DDDDDD;" | '''Reference''' !! STM32 (Device family) !! F (Procut type) !! 103 (Device subfamily)!! V (Pin count)!! B (Flash memory size) !! T (Package) !! 6 (Temperature range) !! Y (Options)
! style="background-color:#DDDDDD;" | '''Reference''' !! STM32 (Device family) !! F (Procut type) !! 103 (Device subfamily)!! V (Pin count)!! B (Flash memory size) !! T (Package) !! 6 (Temperature range) !! Y (Options)
|-
|-
| style="background-color:#DDDDDD;" | '''Description''' || STM32= ARM-based 32-bit microcontroller || F= general-purpose || 103= performance line || T= 36 pins <br /> C= 48 pins <br /> R= 64 pins <br /> V= 100 pins || 8= 64 Kbytes <br /> B= 128 Kbytes || H= BGA <br /> T= LQFP <br /> U= VFQFPN || 6= -40 to +85 ºC <br /> 7= -40 to +105 ºC || Unknown
| style="background-color:#DDDDDD;" | '''Description''' || STM32= ARM-based 32-bit microcontroller || F= general-purpose || 103= performance line || T= 36 pins <br /> C=48 pins <br /> R= 64 pins <br /> V= 100 pins || 8= 64 Kbytes <br /> B= 128 Kbytes || H= BGA <br /> T=LQFP <br /> U=VFQFPN || 6= -40 to 85 ºC <br /> 7= -40 to 105 ºC || Unknown
|-
|-
|}
|}
*Firmware
**Board '''YCON2_1.01''' (STM32F103) Original Firmware Dump (region unknown) ---> http://www.eissq.com/ps3_move/files/1e93d333d39a9b0d43a47489503859a2-7.html
**Based on RTOS by eForce Co.,Ltd. (http://www.arm.com/community/partners/display_company/rw/company/eforce-co-ltd/)
*Firmware dump analisys (wrote by nico @ Kenn Sebesta blog)
Actually, there seems to be 3 vector tables:
8000000 (size 0x0040) NVIC vectors
8000800 (size 0x0094) Bootloader vectors
8002800 (size 0x0130) Application vectors
The subroutine at 8000040 seems to call either the bootloader reset vector (at 8000142) or the application reset vector (at 800016E).
The thing is, the shortened bootloader vectors (provided this is actually the bootloader code), does not contain any I2C or UART interrupt vectors, and only USB_LP_CAN_
RX0 vector seems to contain active code (as far as communication is concerned).
Seems like the CPU and Bluetooth module use some form of UART to communicate, is that correct ?
...
..
.
The first thing to look for is the base address of the BIN file in memory, and further what the memory map looks like. Kenn has already provided this info in his example project, but these can be extracted from the STM32 datasheet also. We know that the first byte of the BIN file maps to address 0x08000000 in memory. We know that internal SRAM start at 0x20000000.
Second thing is to locate the vectors table (see STM32 datasheet) and the reset vector, because it gives you the entry point of the firmware and other useful info. The vectors table is also relocatable in this case (register SBC_VTOR, STM32 programming manual page 134), so there may be multiple vectors tables (and there is).
The vectors table is actually a big jump table. I'm using the following trick to find other tables (be it vectors or switch / case jump tables). We know that addresses are 32 bit (ARM) and highest byte is always 0x08, so we can use a simple hex dump of the BIN file and search using the regular expression "08 .. .. .. 08" (dot meaning any single character). If you use a text editor with search results highlighting (vim for example), then jump tables just catch your eye. There are not so many of them. I used this technique to find the three vectors tables listed earlier. They're distinctive because of their first 32 bit word (0x20000400 which oughts to be the address of the stack top according to the STM32 datasheet).
The vectors table also provides you with pointers to interesting subroutines. If Bluetooth is what you're looking after, just follow IT vector number 39 (USART3) since we know thanks to Kenn that STM32 and Bluetooth chips communicate via UART number 3. Then try to figure out what the firmware should look like: when a Bluetooth output report is coming to the Move, an interrupt is generated in the STM32, the input report is fetched serially from the Bluetooth chip into some buffer (or ring buffer), and the buffer is parsed, either synchronously in the IT handler itself, or a message is sent from the IT handler to some lower priority task. Difficulty is to figure out the relevant tasks and to identify them in the disassembled code.
The jump tables trick can also be used to identify the code that parses Bluetooth output reports (faster). It's very likely that such a jump table is used to call a specific Bluetooth command handler for each Bluetooth command supported by the Move. In that case the jump table is a table of function pointers. The idea is to list the jump tables, then try to find one in the same region as the IT handler. The start address of the jump table should be present in some code that can be traced back to the IT handler. This provides info on how many Bluetooth commands are supported, which ones and eventually what they're doing (after a fair amount of disassembly, I admit).
*Bootloader
**STM32 Arm-Cortex bootloader: http://www.micromouseonline.com/2009/05/08/stm32-arm-cortex-bootloader/?doing_wp_cron=1348086547.3716659545898437500000
**Sony bootloader: ''there are two sections in the beginning that are blanketed by empty flash: one from 0x00000 to 0x006B7 and the other from 0x00800 to 0x027BB. My guess is that the first section is the NVIC table and that the second is a bootloader''. calibration data stored at last 0x800 bytes starting from 0x0001F800 ? (from Kenn Sebesta blog)
*JTAG programmer
3.3V and http://www.amontec.com/openocd.shtml compatible e.g: "bus pirate" https://www.sparkfun.com/products/9544
First of all, please save your original firmware image. Even if you don't plan to ever use your Move as a game controller again, this is a good test if your JTAG connection works. It's also supposed that the firmware contains device specific calibration values. If you replace your original firmware with firmware from another Move, it may not work as expected. Newer Moves may have code protection enabled. You can easiely disable code protection via OpenOCD but this will erase flash and make it impossibe to save the original firmware.
To make a dump of the original firmware run:
{{Keyboard|content=<syntaxhighlight lang="bash">
> dump_image my_original_move_firmware.bin 0x8000000 0x20000
dumped 131072 bytes in 6.391000s (20.028 kb/s)
</syntaxhighlight>}}
To write a dump run:
{{Keyboard|content=<syntaxhighlight lang="bash">
> flash write_image erase my_original_move_firmware.bin 0x8000000
auto erase enabled
wrote 131072 bytes from file myoriginal_move_firmware.bin in 10.704000s (11.958 kb/s)
</syntaxhighlight>}}


*Buses:
*Buses:
**3x USART (bluetooth @ 230,400 baud,...)
**5x UART
**2x SPI
**3x SPI
**2x I²C (magnetometer,...)
**2x I2S
**1x USB
**2x I2C
**1x CAN
**USB
*Pinout
**CAN
 
<div style="height:555px; overflow:auto">
{| class="wikitable"
|-
! Pin # !! Name !! Type !! 5v tolerant !! colspan="6" | Firmware Function !! colspan="3" | Move Board TestPoints !! Notes
|-
! colspan="4" | !! colspan="3" | ARM-Cortex !! Sony !! MoveCopter !! Others? !! YCON2_1.01 !! YCON2.5_1.03 !! Others ? !!
|-
! colspan="4" | !! Main !! Alternate !! Remap !! colspan="7" |
|-
| 1 || PE2 || I/O || {{yes}} || PE2 || TRACECK || {{no}} || TRACECK || || || TP21 || || ||
|-
| 2 || PE3 || I/O || {{yes}} || PE3 || TRACED0 || {{no}} || TRACED0 || || || TP22 || || ||
|-
| 3 || PE4 || I/O || {{yes}} || PE4 || TRACED1 || {{no}} || TRACED1 || || || TP23 || || ||
|-
| 4 || PE5 || I/O || {{yes}} || PE5 || TRACED2 || {{no}} || TRACED2 || || || TP24 || || ||
|-
| 5 || PE6 || I/O || {{yes}} || PE6 || TRACED3 || {{no}} || TRACED3 || || || TP25 || || ||
|- style="background-color:#DEDEDE;"
| 6 || V<sub>BAT</sub> || S || || V<sub>BAT</sub> || || || || || || Vcc || || || Supply for RTC and backup registers
|-
| 7 || PC13-TAMPER-RTC || I/O || {{no}} || PC13 || TAMPER-RTC || {{no}} || || || || SW10 || || || Connected to {{padcircle}}
|-
| 8 || PC14-OSC32_IN || I/O || {{no}} || PC14 || OSC32_IN || {{no}} || || || || SW11 || || || Connected to {{padcross}}
|-
| 9 || PC15-OSC32_OUT || I/O || {{no}} || PC15 || OSC32_OUT || {{no}} || || || || SW12 || || || Connected to {{padtriangle}}
|-style="background-color:#DEDEDE;"
| 10 || V<sub>SS_5</sub> || S || || V<sub>SS_5</sub> || || || || || || TP3 || || ||
|-style="background-color:#DEDEDE;"
| 11 || V<sub>DD_5</sub> || S || || V<sub>DD_5</sub> || || || || || || TP68 || || ||
|-style="background-color:#DEDEDE;"
| 12 || OSC_IN || I || || OSC_IN || || || || || || || || || Xtal 8MHz
|-style="background-color:#DEDEDE;"
| 13 || OSC_OUT || O || || OSC_OUT || || || || || || || || || Xtal 8MHz
|-style="background-color:#DEDEDE;"
| 14 || NRST || I/O || || NRST || || || || || || TP54/SW1 || || || Connected to ground through reset switch. Can also be used for '''JTAG NRST''' debugging
|-
| 15 || PC0 || I/O || {{no}} || PC0 || ADC12_IN10 || {{no}} || ADC12_IN10 || || || Gyro_y || || || Gyroscope Y-channel input
|-
| 16 || PC1 || I/O || {{no}} || PC1 || ADC12_IN11 || {{no}} || ADC12_IN11 || || || Gyro_x || || || Gyroscope X-channel input
|-
| 17 || PC2 || I/O || {{no}} || PC2 || ADC12_IN12 || {{no}} || ADC12_IN12 || || || Gyro_z || || || Gyroscope Z-channel input
|-
| 18 || PC3 || I/O || {{no}} || PC3 || ADC12_IN13 || {{no}} || ADC12_IN13 || || || Acc_y || || || Accelerometer Y-channel input
|-style="background-color:#DEDEDE;"
| 19 || V<sub>SSA</sub> || S || || V<sub>SSA</sub> || || || || || || || || ||
|-style="background-color:#DEDEDE;"
| 20 || V<sub>REF-</sub> || S || || V<sub>REF-</sub> || || || || || || || || ||
|-style="background-color:#DEDEDE;"
| 21 || V<sub>REF+</sub> || S || || V<sub>REF+</sub> || || || || || || || || ||
|-style="background-color:#DEDEDE;"
| 22 || V<sub>DDA</sub> || S || || V<sub>DDA</sub> || || || || || || || || ||
|-
| 23 || PA0-WKUP || I/O || {{no}} || PA0 || WKUP <br /> USART2_CTS <br /> ADC12_IN0 <br /> TIM2_CH1_ETR || {{no}} || WKUP || || || SW8 || || || Connected to {{padps}} Normally pulled to ground by 10kΩ
|-
| 24 || PA1 || I/O || {{no}} || PA1 || USART2_RTS <br /> ADC12_IN1 <br /> TIM2_CH2 || {{no}} || ADC12_IN1 || || || Acc_x || || || Accelerometer X-channel input
|-
| 25 || PA2 || I/O || {{no}} || PA2 || USART2_TX <br /> ADC12_IN2 <br /> TIM2_CH3 || {{no}} || || || || TP35 || || ||
|-
| 26 || PA3 || I/O || {{no}} || PA3 || USART2_RX <br /> ADC12_IN3 <br /> TIM2_CH4 || {{no}} || ADC12_IN2 || || || Acc_z || || || Accelerometer Z-channel input
|-style="background-color:#DEDEDE;"
| 27 || V<sub>SS_4</sub> || S || || V<sub>SS_4</sub> || || || || || || TP4 || || ||
|-style="background-color:#DEDEDE;"
| 28 || V<sub>DD_4</sub> || S || || V<sub>DD_4</sub> || || || || || || || || ||
|-
| 29 || PA4 || I/O || {{no}} || PA4 || SPI1_NSS <br /> USART2_CK <br /> ADC12_IN4 || {{no}} || || || || || || ||
|-
| 30 || PA5 || I/O || {{no}} || PA5 || SPI1_SCK <br /> ADC12_IN5 || {{no}} || || || || TP30 || || ||
|-
| 31 || PA6 || I/O || {{no}} || PA6 || SPI1_MISO <br /> ADC12_IN6 <br /> TIM3_CH1 || TIM1_BKIN || || || || || || ||
|-
| 32 || PA7 || I/O || {{no}} || PA7 || SPI1_MOSI <br /> ADC12_IN7 <br /> TIM3_CH2 || TIM1_CH1N || || || || || || ||
|-
| 33 || PC4 || I/O || {{no}} || PC4 || ADC12_IN14 || {{no}} || ADC12_IN14 || || || Gyro_7 || || || Gyroscope pin7. Constant 1.25V. Possibly a comparison feedback for the gyroscope?
|-
| 34 || PC5 || I/O || {{no}} || PC5 || ADC12_IN15 || {{no}} || || || || || || ||
|-
| 35 || PB0 || I/O || {{no}} || PB0 || ADC12_IN8 <br /> TIM3_CH3 || TIM1_CH2N || || || || || || ||
|-
| 36 || PB1 || I/O || {{no}} || PB1 || ADC12_IN9 <br /> TIM3_CH4 || TIM1_CH3N || ADC12_IN9 || || || Joystick_9 || || || Connected to {{padtrigger}} analog trigger. J9_2(ANALOG_Z)
|-
| 37 || PB2 || I/O || {{yes}} || PB2BOOT1 || {{no}} || {{no}} || || || || ||
|-
| 38 || PE7 || I/O || {{yes}} || PE7 || {{no}} || TIM1_ETR || || || || TP33 || || ||
|-
| 39 || PE8 || I/O || {{yes}} || PE8 || {{no}} || TIM1_CH1N || || || || || || ||
|-
| 40 || PE9 || I/O || {{yes}} || PE9 || {{no}} || TIM1_CH1 || || || || || || ||
|-
| 41 || PE10 || I/O || {{yes}} || PE10 || {{no}} || TIM1_CH2N || || || || EXT_3 || || || EXT connector Pin 3
|-
| 42 || PE11 || I/O || {{yes}} || PE11 || {{no}} || TIM1_CH2 || || PPM <br /> telemetry || || EXT_4 || || || EXT connector Pin 4
|-
| 43 || PE12 || I/O || {{yes}} || PE12 || {{no}} || TIM1_CH3N || Interrupt || || || Mag_14 || || || Magnetometer pin14. Interrupt to signal new sample ready
|-
| 44 || PE13 || I/O || {{yes}} || PE13 || {{no}} || TIM1_CH3 || || || || || || ||
|-
| 45 || PE14 || I/O || {{yes}} || PE14 || {{no}} || TIM1_CH4 || || || || || || ||
|-
| 46 || PE15 || I/O || {{yes}} || PE15 || {{no}} || TIM1_BKIN|| || || || TP34 || || ||
|-
| 47 || PB10 || I/O || {{yes}} || PB10 || I2C2_SCL <br /> USART3_TX || TIM2_CH3 || I2C2_SCL || || || Mag_15 || || || Magnetometer pin15 clock
|-
| 48 || PB11 || I/O || {{yes}} || PB11 || I2C2_SDA <br /> USART3_RX || TIM2_CH4 || I2C2_SDA || || || Mag_16 || || || Magnetometer pin16 data
|-style="background-color:#DEDEDE;"
| 49 || V<sub>SS_1</sub> || S || || V<sub>SS_1</sub> || || || || || || TP69 || || ||
|-style="background-color:#DEDEDE;"
| 50 || V<sub>DD_1</sub> || S || || V<sub>DD_1</sub> || || || || || || || || ||
|-
| 51 || PB12 || I/O || {{yes}} || PB12 || SPI2_NSS <br /> I2C2_SMBAl <br /> USART3_CK <br /> TIM1_BKIN || {{no}} || || || || || || ||
|-
| 52 || PB13 || I/O || {{yes}} || PB13 || SPI2_SCK <br /> USART3_CTS <br /> TIM1_CH1N || {{no}} || || || || || || ||
|-
| 53 || PB14 || I/O || {{yes}} || PB14 || SPI2_MISO <br /> USART3_RTS <br /> TIM1_CH2N || {{no}} || || || || || || ||
|-
| 54 || PB15 || I/O || {{yes}} || PB15 || SPI2_MOSI <br /> TIM1_CH3N || {{no}} || || || || || || ||
|-
| 55 || PD8 || I/O || {{yes}} || PD8 || {{no}} || USART3_TX || USART3_TX || || || BT_7 || || || Bluetooth pin7 transmitter
|-
| 56 || PD9 || I/O || {{yes}} || PD9 || {{no}} || USART3_RX || USART3_RX || || || BT_6 || || || Bluetooth pin6 receiver
|-
| 57 || PD10 || I/O || {{yes}} || PD10 || {{no}} || USART3_CK || || || || TP51 || || ||
|-
| 58 || PD11 || I/O || {{yes}} || PD11 || {{no}} || USART3_CTS || DIO || || || U6_6 || || || TPS63030 regulator enable
|-
| 59 || PD12 || I/O || {{yes}} || PD12 || {{no}} || TIM4_CH1 <br /> USART3_RTS || || || || || || ||
|-
| 60 || PD13 || I/O || {{yes}} || PD13 || {{no}} || TIM4_CH2 || || || || || || || Reacts slowly to USB plug. Logic LO when USB plugged in, HI when not.
|-
| 61 || PD14 || I/O || {{yes}} || PD14 || {{no}} || TIM4_CH3 || || || || || || || Reacts slowly to USB plug. Logic LO when USB plugged in, HI when not.
|-
| 62 || PD15 || I/O || {{yes}} || PD15 || {{no}} || TIM4_CH4 || || Servo1 || || M- || || || Rumble Motor -
|-
| 63 || PC6 || I/O || {{yes}} || PC6 || {{no}} || TIM3_CH1 || || Servo2 || || LED_R || || || Connected to LED_R
|-
| 64 || PC7 || I/O || {{yes}} || PC7 || {{no}} || TIM3_CH2 || || Servo3 || || LED_G || || || Connected to LED_G
|-
| 65 || PC8 || I/O || {{yes}} || PC8 || {{no}} || TIM3_CH3 || || Servo4 || || LED_B || || || Connected to LED_B
|-
| 66 || PC9 || I/O || {{yes}} || PC9 || {{no}} || TIM3_CH4 || DIO || || || R_39 || || || 1.25V???
|-
| 67 || PA8 || I/O || {{yes}} || PA8 || USART1_CK <br /> TIM1_CH1 <br /> MCO || {{no}} || DIO || || || BT_36 || || || Bluetooth pin36. Constant 85Hz PWM
|-
| 68 || PA9 || I/O || {{yes}} || PA9 || USART1_TX <br /> TIM1_CH2 || {{no}} || DIO || || || BT_15 || || || Bluetooth pin15. Varying TTL signal
|-
| 69 || PA10 || I/O || {{yes}} || PA10 || USART1_RX <br /> TIM1_CH3 || {{no}} || DIO || || || BT_14 || || || Bluetooth pin14. Very occasional, only really seen at startup. SPI chip select?
|-
| 70 || PA11 || I/O || {{yes}} || PA11 || USART1_CTS <br /> CANRX <br /> USBDM <br /> TIM1_CH4 || {{no}} || USBDM || || || TP26 || || || Connected through 2.1Ωresistor
|-
| 71 || PA12 || I/O || {{yes}} || PA12 || USART1_RTS <br /> CANTX <br /> USBDP <br /> TIM1_ETR || {{no}} || USBDP || || || TP27 || || || Connected through 2.1Ωresistor
|-
| 72 || PA13 || I/O || {{yes}} || JTMS/SWDIO || {{no}} || PA13 || JTMS || || || TP56 || || || Can also be used for '''JTAG SWDIO''' debugging
|-style="background-color:#DEDEDE;"
| 73 || N.C || || || || || || || || || || || || Not Connected
|-style="background-color:#DEDEDE;"
| 74 || V<sub>SS_2</sub> || S || || V<sub>SS_2</sub> || || || || || || TP70 || || ||
|-style="background-color:#DEDEDE;"
| 75 || V<sub>DD_2</sub> || S || || V<sub>DD_2</sub> || || || || || || TP39 || || ||
|-
| 76 || PA14 || I/O || {{yes}} || JTCK/SWCLK || {{no}} || PA14 || JTCK || || || TP57 || || || Can also be used for '''JTAG SWCLK''' debugging
|-
| 77 || PA15 || I/O || {{yes}} || JTDI || {{no}} || TIM2_CH1_ETR <br /> PA15 <br /> SPI1_NSS || JTDI || || || TP55 || || || Can also be used for '''JTAG JTDI''' debugging
|-
| 78 || PC10 || I/O || {{yes}} || PC10 || {{no}} || USART3_TX || DIO || || || TP38 || || ||
|-
| 79 || PC11 || I/O || {{yes}} || PC11 || {{no}} || USART3_RX || DIO || || || TP37 || || ||
|-
| 80 || PC12 || I/O || {{yes}} || PC12 || {{no}} || USART3_CK || || || || || || ||
|-
| 81 || PD0 || I/O || {{yes}} || OSC_IN || {{no}} || CANRX || || || || || || ||
|-
| 82 || PD1 || I/O || {{yes}} || OSC_OUT || {{no}} || CANTX || || || || || || ||
|-
| 83 || PD2 || I/O || {{yes}} || PD2 || TIM3_ETR || {{no}} || || || || || || ||
|-
| 84 || PD3 || I/O || {{yes}} || PD3 || {{no}} || USART2_CTS || || || || || || ||
|-
| 85 || PD4 || I/O || {{yes}} || PD4 || {{no}} || USART2_RTS || || || || TP36 || || ||
|-
| 86 || PD5 || I/O || {{yes}} || PD5 || {{no}} || USART2_TX || || || || SW13 || || || Connected to {{padsquare}}
|-
| 87 || PD6 || I/O || {{yes}} || PD6 || {{no}} || USART2_RX || || || || || || || Reacts slowly to USB plug. Logic LO when USB plugged in, HI when not.
|-
| 88 || PD7 || I/O || {{yes}} || PD7 || {{no}} || USART2_CK || DIO || || || || || || Reacts instantly to USB plug. Logic HI when USB plugged in, LO when not.
|-
| 89 || PB3 || I/O || {{yes}} || JTDO || {{no}} || TIM2_CH2 <br /> PB3 <br /> TRACESWO <br /> SPI1_SCK || JTDO || || || TP58 || || || Can also be used for '''JTAG JTDO''' debugging
|-
| 90 || PB4 || I/O || {{yes}} || JNTRST || {{no}} || TIM3_CH1 <br /> PB4 <br /> SPI1_MISO || JNTRST || || || TP59 || || || Can also be used for '''JTAG JNTRST''' debugging
|-
| 91 || PB5 || I/O || {{no}} || PB5 || I2C1_SMBAl || TIM3_CH2 <br /> SPI1_MOSI || || || || || || ||
|-
| 92 || PB6 || I/O || {{yes}} || PB6 || I2C1_SCL <br /> TIM4_CH1 || USART1_TX || || USART1_TX || || EXT_5 || || || EXT connector Pin 5
|-
| 93 || PB7 || I/O || {{yes}} || PB7 || I2C1_SDA <br /> TIM4_CH2 || USART1_RX || || USART1_RX || || EXT_6 || || || EXT connector Pin 6
|-
| 94 || BOOT0 || I || ? || BOOT0 || {{no}} || {{no}} || || || || || || ||
|-
| 95 || PB8 || I/O || {{yes}} || PB8 || TIM4_CH3 || I2C1_SCL <br /> CANRX || || || || SW15 || || || Connected to {{padselect}}
|-
| 96 || PB9 || I/O || {{yes}} || PB9 || TIM4_CH4 || I2C1_SDA <br /> CANTX || || || || SW14 || || || Connected to {{padstart}}
|-
| 97 || PE0 || I/O || {{yes}} || PE0 || TIM4_ETR || {{no}} || || || || SW9 || || || Connected to {{padmove}}
|-
| 98 || PE1 || I/O || {{yes}} || PE1 || {{no}} || {{no}} || || || || || || ||
|-style="background-color:#DEDEDE;"
| 99 || V<sub>SS_3</sub> || S || || V<sub>SS_3</sub> || || || || || || TP5 || || ||
|-style="background-color:#DEDEDE;"
| 100 || V<sub>DD_3</sub> || S || || V<sub>DD_3</sub> || || || || || || || || ||
|-
|}
</div>
 
=== STM LPR425AL (2-Axis Gyroscope) ===
The 2-axis gryoscope (likely an STM LPR425AL) is an analog sensor measuring rotation along the x- and y-axes
 
Is covered with a metal shield to avoid interferences (marked as 067S8 in some models), this makes his identification dificult


=== Y5250H 2029 K8QEZ (Z-Axis Gyroscope) ===
=== Y5250H 2029 K8QEZ (Gyro?) ===
alt.no.: Y5250H 2005 4Y84AQ <br />
alt.no.: Y5250H 2005 4Y84AQ <br />
alt.no.: Y5250H 2024 GPECQ <br />
alt.no.: Y5250H 2024 GPECQ <br />
U14 <br />
U14 <br />


=== Kionix KXSC4 (3-Axis Accelerometer) ===
=== Kionix KXSC4 10227 2410 (Accelerometer) ===
[[Image:Kionix KXSC4 perspective.gif|400px|thumb|right| Kionix KXSC4 <br /> 3-Axis Accelerometer]][[Image:Kionix KXSC4 application squematic.jpg|800px|thumb|right| Kionix KXSC4 <br /> application squematic]]
alt.no.: Kionix KXSC4-XLU 90831 3909 <br />
alt.no.: Kionix KXSC4-XLU 90831 3909 <br />
alt.no.: Kionix KXSC4 10115 2010 <br />
alt.no.: Kionix KXSC4 10115 2010 <br />
alt.no.: Kionix KXSC4 10227 2410 <br />
U12 <br />
U12 <br />
http://www.kionix.com/


Tri-Axis, 1.5g – 6g, Low Power Analog, 5x5x1.2mm DFN
=== Texas Instruments BQ24080 (1-cell Li-Ion Charger) ===
alt.no.:BRO 01J PDH2 <br />
alt.no.:BRO 04K 0948 <br />
U1 <br />


The KXSC4 is a high-performance, low-power, analog output tri-axis accelerometer. This  accelerometer is delivered in a 5 x 5 x 1.2 mm, 14-pin, DFN package with an operating temperature range of -40°C to +85°C.
=== TPS63030 (High Efficient Single Inductor Buck-Boost Converter) ===
alt.no.:CEE TI J 04P0 <br />
U6 <br />


The KXSC4 has a full-scale output range of ±2g and operates from a 1.8 V to 3.6 V DC supply (factory-programmable).
=== Cambridge Silicon Radio BC4RE A16U (Bluetooth transmitter) ===
 
U8? <br />
*Features:
http://www.csr.com/products/technology/bluetooth
**Factory-programmable, internal low-pass filter
**Low current consumption: 0.05 µA in standby, 230 µA at full power
**Factory-programmable ±1.5g to ±6g range
**Supply voltage range: 1.8 V to 3.6 V
**Analog output
**Embedded features
***Motion detection
***Orientation detection: report changes in face up, face down, +/- vertical and +/- horizontal orientation
***Self-test function
**RoHS compliant
 
http://www.kionix.com/accelerometers/kxsc4
 
http://www.kionix.com/sites/default/files/KXSC4%20Product%20Brief.pdf
 
http://www.kionix.com/sites/default/files/KXSC4-2050%20Specifications%20Rev%203.pdf
 
*Pinout
{| class="wikitable"
|-
! Pin # !! Name !! Description !! Move Board Notes
|-
| 1 || GND || ''Ground''. ||
|-
| 2 || N.C || ''Not Connected Internally''. ||
|-
| 3 || N.C || ''Not Connected Internally''. ||
|-
| 4 || Vdd || ''Power supply input''. Decouple this pin to ground with a 0.1uF ceramic capacitor (C<sub>1</sub>). || Decoupled with capacitor C42
|-
| 5 || Reserved || '''Reserved''' (must be "Pulled-up to VDD" for normal operation). || Connected to pin 4
|-
| 6 || ST || '''Self Test''' ("Pulled-down to GND" = normal operation. "Pulled-up to VDD" = self-test mode). || Connected to ?
|-
| 7 || Enable || '''Enable pin''' ("pulled-up to VDD" =  normal operation. "Pulled-down to GND" = standby). || Connected to ?
|-
| 8 || X output ||  '''X-channel analog output''' (Optional filter capacitor, C<sub>2</sub>). || Connected to MCU pin# '''24 (PA1)'''.
|-
| 9 || Y output || '''Y-channel analog output''' (Optional filter capacitor, C<sub>3</sub>). || Connected to MCU pin# '''18 (PC3)'''.
|-
| 10 || Z output || '''Z-channel analog output''' (Optional filter capacitor, C<sub>4</sub>). || Connected to MCU pin# '''26 (PA3)'''.
|-
| 11 || GND || ''Ground''. ||
|-
| 12 || N.C || ''Not Connected Internally''. ||
|-
| 13 || N.C || ''Not Connected Internally''. ||
|-
| 14 || GND || ''Ground''. ||
|-
|}
 
*Output
1.6V is the zero output. The accelerometers have a scale of about +0.250V increment for each "g". Assuming that the chip is able to go full scale from 0V to 3V, this gives an absolute output of +-6g (this range is a configuration programmable at factory)


=== AKM AK8974 (3-Axis Magnetic Compass) ===
=== AKM AK8974 (three-axis Electronic Compass -MEMS) ===
alt.no.:AKM8974 948D <br />
alt.no.:AKM8974 948D <br />
alt.no.:AKM8974 008F <br />
alt.no.:AKM8974 008F <br />
U13 <br />
U13 <br />
Asahi Kasei Microdevices http://www.akm.com/
There is no oficial documentation available about 8974 model, the most closer models (from 897 series) are 8973 and 8975
*8973
http://www.alldatasheet.com/view.jsp?Searchword=AK8973
*8974
Used in Nokia phones models: 2710c, 5730, 6210n, 6710, 6720c, 6720, C6-01, E72, N8-00, N86, N97, N97mini, and N9 MeeGo
http://memsblog.wordpress.com/2009/12/03/nokia-beats-apple-to-compass-in-phone/
*8975
http://www.asahi-kasei.co.jp/akm/en/product/ak8975bc/ak8975bc.html
http://chomikuj.pl/felixd/Mechatronika+%28Elektronika*2c+Mechanika*2c+Obwody+elektryczne%29/MPP+-+Mobilna+Platforma+Pomiarowa/Dokumentacje/Kompass+AKM+AK8975,1518811623.pdf
http://www.chipworks.com/seamark.aspx?sm=s4%3BDatedfl11%3BDevCategory12%3BMEMS+Devicesm12%3BReleaseMonthm10%3BDeviceTypefl10%3BReportCode12%3BEXR-0908-802&cw=detail2
http://www.chipworks.com/seamark.aspx?sm=s4%3BDatedfl11%3BDevCategory12%3BMEMS+Devicesm12%3BReleaseMonthm10%3BDeviceTypefl10%3BReportCode12%3BEXR-0908-802&cw=detail2


*Pinout
=== ALPS 503A 04C (Radio Module) ===
{| class="wikitable"
|-
! Pin # !! Name !! Description
|-
| 1 || ||
|-
| 2 || ||
|-
| 3 || ||
|-
| 4 || ||
|-
| 5 || ||
|-
| 6 || ||
|-
| 7 || ||
|-
| 8 || ||
|-
| 9 || ||
|-
| 10 || ||
|-
| 11 || ||
|-
| 12 || ||
|-
| 13 || ||
|-
| 14 || ||
|-
| 15 || ||
|-
| 16 || ||
|-
|}


=== ALPS 503A (Radio Module) ===
=== Li-Ion (Battery Pack) ===
 
4-168-108-01 / LIS1441<br />
==== Cambridge Silicon Radio BC4RE A16U (Bluetooth transmitter) ====
3.7V 1380 mAh <br />
U8?. Inside ALPS 503A BT module<br />
(typ 1520mAh) <br />
http://www.csr.com/products/technology/bluetooth
Charge Current: 1.4A <br />
 
Charge Voltage: 4.25V <br />
*Pinout
<div style="height:555px; overflow:auto">
{| class="wikitable"
|-
! Pin # !! Name !! Description
|-
| 1 || ||
|-
| 2 || ||
|-
| 3 || ||
|-
| 4 || ||
|-
| 5 || ||
|-
| 6 || ||
|-
| 7 || ||
|-
| 8 || ||
|-
| 9 || ||
|-
| 10 || ||
|-
| 11 || ||
|-
| 12 || ||
|-
| 13 || ||
|-
| 14 || ||
|-
| 15 || ||
|-
| 16 || ||
|-
| 17 || ||
|-
| 18 || ||
|-
| 19 || ||
|-
| 20 || ||
|-
| 21 || ||
|-
| 22 || ||
|-
| 23 || ||
|-
| 24 || ||
|-
| 25 || ||
|-
| 26 || ||
|-
| 27 || ||
|-
| 28 || ||
|-
| 29 || ||
|-
| 30 || ||
|-
| 31 || ||
|-
| 32 || ||
|-
| 33 || ||
|-
| 34 || ||
|-
| 35 || ||
|-
| 36 || ||
|-
| 37 || ||
|-
| 38 || ||
|-
| 39 || ||
|-
| 40 || ||
|-
|}
</div>


=== LED2 (High Power RGB LED) ===
=== LED2 ===
6 pins surface mounted RGB 2^24
6 pins surface mounted RGB 2^24


Line 547: Line 77:
**LED_R
**LED_R
**LED_4R5 (VDD line)
**LED_4R5 (VDD line)
=== TPS63030 (High Efficient Single Inductor Buck-Boost Converter) ===
alt.no.:CEE TI J 04P0 <br />
U6 <br />
=== Texas Instruments BQ24080 (1-cell Li-Ion Charger) ===
alt.no.:BRO 01J PDH2 <br />
alt.no.:BRO 04K 0948 <br />
U1 <br />
=== Li-Ion (Battery Pack) ===
4-168-108-01 / LIS1441<br />
3.7V 1380 mAh <br />
(typ 1520mAh) <br />
Charge Current: 1.4A <br />
Charge Voltage: 4.25V <br />


=== External Conectors ===
=== External Conectors ===
[[Image:Move controller connectors.jpg|400px|thumb|right| Move controller connectors]]


==== USB connector ====
==== USB connector ====
Line 580: Line 93:


==== Extension Connector ====
==== Extension Connector ====
Marked in the plastic as "ext" and refered as "extension connector" in the [[Move Sharp Shooter]] and [[Move Racing Wheel]] "Instruction Manual.pdf"
Marked in the plastic as "ext" and refered as "extension connector" in the [[Move Sharp Shooter]] "Instruction Manual.pdf"
 
8 pins custom made (exact alternative part not found yet)
 
This connector is used to communicate with the [[Move Sharp Shooter]] gun. The buttons, trigger, etc... of this gun can send signals to the move controller
 
{| class="wikitable"
|-
! EXT connector pin number <br /> (from left to right) !! Connected to main board !! MCU default firmware function !! sony firmware function <br /> (pinout remapped ?) !! MoveCopter firmware function <br /> (pinout remapped)
|-
| 1 || colspan="4" | 3.2v
|-
| 2 || colspan="4" | 3.2v
|-
| 3 || MCU pin 41 (PE10) || TIM1_CH2N ||  || {{no}}
|-
| 4 || MCU pin 42 (PE11) || TIM1_CH2 || || PPM output (input for the PC telemetry app)
|-
| 5 || MCU pin 92 (PB6) || I2C1_SCL || || USART1 TX (serial transmitter). Added to the project after D-lite manual
|-
| 6 || MCU pin 93 (PB7) || I2C1_SDA || || USART1 RX (serial receiver). Added to the project after D-lite manual
|-
| 7 || colspan="4" | GND
|-
| 8 || colspan="4" | GND
|-
|}
 
*Notes
**All the schematics and pinouts in "D-lite MoveCopter manual" and "Kenn Sebesta blog" related with this connector are taken directly from the main board (not from the external connector). The schematics explained in these pages are from an old model with different number of pins (some of them duplicated or displaced). There are at least 3 different board models where this pins are different, but in all models the lines are reordered at the "EXT connector" (and reduced to 8), all models has the same pinout externally explained here in wiki
**In MoveCopter bootloader several pins of MCU has been remaped, included 3 pins of "EXT connector" (for input/output data), and the 3 RGB lines from the LED + 1 line from the rumble motor (to controll 4 servo motors for the helices of the quadcopter)
 
Obsolete not-acurate notes
The connector is soldered in a "children board" identifyed as "connector board", is connected with the "main board" with a 12 traces ribbon cable (and 2 pressure connectors).
Only 4 lines of the ribbon cable are used for data signals (protected with a resistor and a diode in the children board) + 1 line for "ground" and 1 line for 3.2volts
I will upload a complete squematic of this sub-circuit later
 
==Software Related Projects==
 
===Move.Me===
Move.me is a software server application for the PS3 system that uses the PlayStation Move motion controller as an input device. Is designed for academic researchers, university instructors, college students, programming hobbyists, and HCI developers.
 
* https://us.playstation.com/ps3/playstation-move/move-me/
 
https://secure.webassets.scea.com/pscomauth/groups/public/documents/webasset/moveme-network-protocol_0223.pdf
 
http://ie.playstation.com/media/IO0_qmi1/moveme-userguide_0223.pdf
 
===PSL1GHT and libmove & homebrew===
* https://github.com/ps3dev/PSL1GHT/tree/master/samples/input/gemsample
* https://github.com/ps3dev/PSL1GHT/tree/master/samples/input/gemtest
* https://github.com/wargio/libmove
 
<!--// PS3 homebrew support for move controller by faking the device as a wireless mouse, there is no support for native firmware move modules/functions (yet) //-->
 
*Homebrew:
 
http://devram0.blogspot.it/2013/04/ps-seismograph-030.html
 
http://www.ps3hax.net/2013/01/released-ps-vibe-move-edition/
 
===The PS Move API===
Is a library to access the Sony Move Motion Controller via Bluetooth and USB directly from your PC (Linux, Mac OS X, Windows) without the need for a PS3. Mobile platforms are also supported (or planned): Support for MeeGo 1.2 Harmattan is already working, support for Android is in the works. The library is free software, released under a Simplified BSD License, so you can use it in both open source and proprietary closed-source applications, as long as you follow the license terms.
 
http://thp.io/2010/psmove/
 
Git repository: https://github.com/thp/psmoveapi
 
===Move On PC===
PS Move Motion Controller as input device on PCs and mobile devices
May 2012: We are participating in the Google Summer of Code. We will keep you updated about our progress here. The old code base will be archived in the Downloads section soon, and we will base our future MoveOnPC work on Thomas Perl's "PS Move API" project, but add support for tracking and computer vision to the library.
 
Blog: http://moveonpc.blogspot.com.es/
 
http://code.google.com/p/moveonpc/
 
===Move Framework for Windows===
With the Move Framework, you can integrate all the possibilities of motion tracking in your programs and games!. There are SDK's for C++ and C# developers. The project is no longer maintained
 
http://code.google.com/p/moveframework/ (src available with svn)
 
===Motion In Joy for Windows===
MotioninJoy is a driver, designed by a developer unconnected with Sony, intended to use all the features of the Sixaxis and Dualshock 3 controllers on a PC running Windows.
 
http://www.motioninjoy.com
 
http://www.motioninjoy.com/wiki/help
 
http://forums.motioninjoy.com/viewtopic.php?f=33&t=929
 
==Hardware Related Projects==
 
===Kenn Sebesta blog (PS3 Move hacking)===
http://www.eissq.com/ps3_move/
 
===D-Lite MoveCopter ===
"CopterControl bootloader" port for "Move controller"
 
Is a custom bootloader/firmware for the ARM STM32 microcontroller series. The installation is composed by the "bootloader" (move hardware specific, installed by JTAG) and the "flight firmware" (common for all STM32 microcontrollers, installed by USB)
 
The flight firmware is intended to stabilish a flying quadcopter using data from position sensors (like the gyroscopes and the 3-axis acelerometers in move)
 
http://vimeo.com/25983655
 
http://wiki.openpilot.org/display/Doc/D-Lite%27s+PS3+MoveCopter
 
http://forums.openpilot.org/topic/5526-coptercontrol-on-a-game-controller/


http://forums.openpilot.org/topic/5526-coptercontrol-on-a-game-controller/page__st__40#entry24579
8 pins custom made ? (smaller than the Mini-B)


http://forums.openpilot.org/topic/5526-coptercontrol-on-a-game-controller/page__st__140#entry80016
The connector is soldered in a "children board" identifyed as "connector board", is connected with the "main board" with a 12 traces ribbon cable (and 2 pressure connectors). Only 4 lines of the ribbon cable are used for data signals (each line is protected with a resistor and a diode in the children board) + 1 line that seems to be common and is much more wide (probably volts or ground). The other lines are not used.


http://git.openpilot.org/changelog/~br=D-Lite%402fMoveCopter_MARG/OpenPilot
*This connector is used to communicate with the [[Move Sharp Shooter]] gun. The buttons, trigger, etc... of this gun can send signals to the move controller


http://wiki.openpilot.org/display/CC/CopterControl+Home
== Software Support ==


http://wiki.openpilot.org/display/Doc/Ground+Control+Station+User+Manual
=== Move In PS3 ===
*PSl1ght supports move controller by faking the device as a wireless mouse, there is no support for native move modules/functions (yet)


http://www.openpilot.org/products/openpilot-coptercontrol-platform/
=== Move In PC ===
*Playstation Move Framework: http://code.google.com/p/moveframework/ (src available with svn)


http://forums.openpilot.org/topic/5526-coptercontrol-on-a-game-controller/page__st__140#entry81223


{{Console}}


{{Peripherals}}<noinclude>[[Category:Main]]</noinclude>
[[Category:Peripherals]]
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps3/Move_Motion_Controller"