Move Motion Controller: Difference between revisions

From PS3 Developer wiki
Jump to navigation Jump to search
m (→‎ARM STM32F103 VBT6 Y (32bit MCU): alternate datasheet link)
(→‎Software Related Projects: tiny typo and grammar fix)
 
(68 intermediate revisions by 6 users not shown)
Line 1: Line 1:
[[Category:Hardware]]
== Move Hardware ==
[[CECH-ZCM1]] <small>([[CECH-ZCM1U]], [[CECH-ZCM1E]], [[CECH-ZCM1J]], [[CECH-ZCM1H]], [[CECH-ZCM1M]])</small><br />
 
MIC listings:
* [http://www.tele.soumu.go.jp/giteki/SearchServlet?pageID=jg01_01&PC=007&TC=N&PK=1&FN=281ul&SN=%94%46%8F%D8&LN=6&R1=*****&R2=***** 007WWCUL0522] June 29, 2010 ([[CECH-ZCM1J]])
* [http://www.tele.soumu.go.jp/giteki/SearchServlet?pageID=jg01_01&PC=007&TC=N&PK=1&FN=298ul&SN=%94%46%8F%D8&LN=7&R1=*****&R2=***** 007WWCUL0630] March 8, 2011 ([[CECH-ZCM1J]])
* [http://www.tele.soumu.go.jp/giteki/SearchServlet?pageID=jg01_01&PC=007&TC=N&PK=1&FN=275ul&SN=%94%46%8F%D8&LN=11&R1=*****&R2=***** 007WWCUL0489] March 30, 2010 ([[CECH-ZCM1J]] / [[CECH-ZCM1JD]])
 
Anatel:
* [http://sistemas.anatel.gov.br/sgch/HistoricoCertificado/Homologacao.asp?NumRFGCT=189210&idtHistoricoCert=85799 2090106223] 13/01/2012 ([[CECH-ZCM1M]])


== Move Hardware ==
*Main board reference
*Model nº
**'''YCON2_1.01''' (dissassembled photos ---> http://www.ifixit.com/Teardown/PlayStation-Move-Teardown/3594/1)
**CECH-ZCM1U (bought in ?)
**'''YCON2.5_1.03''' (different Bluetooth chip, different 2-axis gyro "PR425A 2117 AEWEP")
**CECH-ZCM1E (bought in europe)


Some photos of a dissassembled move controller ---> http://www.ifixit.com/Teardown/PlayStation-Move-Teardown/3594/1
*Note some components and testpoints (TP) are different between models.


=== ARM STM32F103 VBT6 Y (32bit MCU) ===
=== STM32F103 VBT6 Y (ARM Cortex-M3 32bit@72MHz SRAM20Kb FLASH128Kb RISC Microcontroller) ===
U19 <br />
U19 <br />
http://www.st.com/mcu/devicedocs-STM32F103VB-110.html
http://www.st.com/mcu/devicedocs-STM32F103VB-110.html
Line 14: Line 22:
http://www.st.com/stonline/stappl/st/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/DATASHEET/CD00161566.pdf
http://www.st.com/stonline/stappl/st/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/DATASHEET/CD00161566.pdf


=== Y5250H 2029 K8QEZ (Gyro?) ===
{| class="wikitable"
|-
! style="background-color:#DDDDDD;" | '''Reference''' !! STM32 (Device family) !! F (Procut type) !! 103 (Device subfamily)!! V (Pin count)!! B (Flash memory size) !! T (Package) !! 6 (Temperature range) !! Y (Options)
|-
| style="background-color:#DDDDDD;" | '''Description''' || STM32= ARM-based 32-bit microcontroller || F= general-purpose || 103= performance line || T= 36 pins <br /> C= 48 pins <br /> R= 64 pins <br /> V= 100 pins || 8= 64 Kbytes <br /> B= 128 Kbytes || H= BGA <br /> T= LQFP <br /> U= VFQFPN || 6= -40 to +85 ºC <br /> 7= -40 to +105 ºC || Unknown
|-
|}
 
*Firmware
**Board '''YCON2_1.01''' (STM32F103) Original Firmware Dump (region unknown) ---> http://www.eissq.com/ps3_move/files/1e93d333d39a9b0d43a47489503859a2-7.html
**Based on RTOS by eForce Co.,Ltd. (http://www.arm.com/community/partners/display_company/rw/company/eforce-co-ltd/)
 
*Firmware dump analisys (wrote by nico @ Kenn Sebesta blog)
Actually, there seems to be 3 vector tables:
8000000 (size 0x0040) NVIC vectors
8000800 (size 0x0094) Bootloader vectors
8002800 (size 0x0130) Application vectors
The subroutine at 8000040 seems to call either the bootloader reset vector (at 8000142) or the application reset vector (at 800016E).
The thing is, the shortened bootloader vectors (provided this is actually the bootloader code), does not contain any I2C or UART interrupt vectors, and only USB_LP_CAN_
RX0 vector seems to contain active code (as far as communication is concerned).
Seems like the CPU and Bluetooth module use some form of UART to communicate, is that correct ?
...
..
.
The first thing to look for is the base address of the BIN file in memory, and further what the memory map looks like. Kenn has already provided this info in his example project, but these can be extracted from the STM32 datasheet also. We know that the first byte of the BIN file maps to address 0x08000000 in memory. We know that internal SRAM start at 0x20000000.
Second thing is to locate the vectors table (see STM32 datasheet) and the reset vector, because it gives you the entry point of the firmware and other useful info. The vectors table is also relocatable in this case (register SBC_VTOR, STM32 programming manual page 134), so there may be multiple vectors tables (and there is).
The vectors table is actually a big jump table. I'm using the following trick to find other tables (be it vectors or switch / case jump tables). We know that addresses are 32 bit (ARM) and highest byte is always 0x08, so we can use a simple hex dump of the BIN file and search using the regular expression "08 .. .. .. 08" (dot meaning any single character). If you use a text editor with search results highlighting (vim for example), then jump tables just catch your eye. There are not so many of them. I used this technique to find the three vectors tables listed earlier. They're distinctive because of their first 32 bit word (0x20000400 which oughts to be the address of the stack top according to the STM32 datasheet).
The vectors table also provides you with pointers to interesting subroutines. If Bluetooth is what you're looking after, just follow IT vector number 39 (USART3) since we know thanks to Kenn that STM32 and Bluetooth chips communicate via UART number 3. Then try to figure out what the firmware should look like: when a Bluetooth output report is coming to the Move, an interrupt is generated in the STM32, the input report is fetched serially from the Bluetooth chip into some buffer (or ring buffer), and the buffer is parsed, either synchronously in the IT handler itself, or a message is sent from the IT handler to some lower priority task. Difficulty is to figure out the relevant tasks and to identify them in the disassembled code.
The jump tables trick can also be used to identify the code that parses Bluetooth output reports (faster). It's very likely that such a jump table is used to call a specific Bluetooth command handler for each Bluetooth command supported by the Move. In that case the jump table is a table of function pointers. The idea is to list the jump tables, then try to find one in the same region as the IT handler. The start address of the jump table should be present in some code that can be traced back to the IT handler. This provides info on how many Bluetooth commands are supported, which ones and eventually what they're doing (after a fair amount of disassembly, I admit).
 
*Bootloader
**STM32 Arm-Cortex bootloader: http://www.micromouseonline.com/2009/05/08/stm32-arm-cortex-bootloader/?doing_wp_cron=1348086547.3716659545898437500000
**Sony bootloader: ''there are two sections in the beginning that are blanketed by empty flash: one from 0x00000 to 0x006B7 and the other from 0x00800 to 0x027BB. My guess is that the first section is the NVIC table and that the second is a bootloader''. calibration data stored at last 0x800 bytes starting from 0x0001F800 ? (from Kenn Sebesta blog)
 
*JTAG programmer
3.3V and http://www.amontec.com/openocd.shtml compatible e.g: "bus pirate" https://www.sparkfun.com/products/9544
 
First of all, please save your original firmware image. Even if you don't plan to ever use your Move as a game controller again, this is a good test if your JTAG connection works. It's also supposed that the firmware contains device specific calibration values. If you replace your original firmware with firmware from another Move, it may not work as expected. Newer Moves may have code protection enabled. You can easiely disable code protection via OpenOCD but this will erase flash and make it impossibe to save the original firmware.
 
To make a dump of the original firmware run:
{{Keyboard|content=<syntaxhighlight lang="bash">
> dump_image my_original_move_firmware.bin 0x8000000 0x20000
dumped 131072 bytes in 6.391000s (20.028 kb/s)
</syntaxhighlight>}}
 
To write a dump run:
{{Keyboard|content=<syntaxhighlight lang="bash">
> flash write_image erase my_original_move_firmware.bin 0x8000000
auto erase enabled
wrote 131072 bytes from file myoriginal_move_firmware.bin in 10.704000s (11.958 kb/s)
</syntaxhighlight>}}
 
*Buses:
**3x USART (bluetooth @ 230,400 baud,...)
**2x SPI
**2x I²C (magnetometer,...)
**1x USB
**1x CAN
*Pinout
 
<div style="height:555px; overflow:auto">
{| class="wikitable"
|-
! Pin # !! Name !! Type !! 5v tolerant !! colspan="6" | Firmware Function !! colspan="3" | Move Board TestPoints !! Notes
|-
! colspan="4" | !! colspan="3" | ARM-Cortex !! Sony !! MoveCopter !! Others? !! YCON2_1.01 !! YCON2.5_1.03 !! Others ? !!
|-
! colspan="4" | !! Main !! Alternate !! Remap !! colspan="7" |
|-
| 1 || PE2 || I/O || {{yes}} || PE2 || TRACECK || {{no}} || TRACECK || || || TP21 || || ||
|-
| 2 || PE3 || I/O || {{yes}} || PE3 || TRACED0 || {{no}} || TRACED0 || || || TP22 || || ||
|-
| 3 || PE4 || I/O || {{yes}} || PE4 || TRACED1 || {{no}} || TRACED1 || || || TP23 || || ||
|-
| 4 || PE5 || I/O || {{yes}} || PE5 || TRACED2 || {{no}} || TRACED2 || || || TP24 || || ||
|-
| 5 || PE6 || I/O || {{yes}} || PE6 || TRACED3 || {{no}} || TRACED3 || || || TP25 || || ||
|- style="background-color:#DEDEDE;"
| 6 || V<sub>BAT</sub> || S || || V<sub>BAT</sub> || || || || || || Vcc || || || Supply for RTC and backup registers
|-
| 7 || PC13-TAMPER-RTC || I/O || {{no}} || PC13 || TAMPER-RTC || {{no}} || || || || SW10 || || || Connected to {{padcircle}}
|-
| 8 || PC14-OSC32_IN || I/O || {{no}} || PC14 || OSC32_IN || {{no}} || || || || SW11 || || || Connected to {{padcross}}
|-
| 9 || PC15-OSC32_OUT || I/O || {{no}} || PC15 || OSC32_OUT || {{no}} || || || || SW12 || || || Connected to {{padtriangle}}
|-style="background-color:#DEDEDE;"
| 10 || V<sub>SS_5</sub> || S || || V<sub>SS_5</sub> || || || || || || TP3 || || ||
|-style="background-color:#DEDEDE;"
| 11 || V<sub>DD_5</sub> || S || || V<sub>DD_5</sub> || || || || || || TP68 || || ||
|-style="background-color:#DEDEDE;"
| 12 || OSC_IN || I || || OSC_IN || || || || || || || || || Xtal 8MHz
|-style="background-color:#DEDEDE;"
| 13 || OSC_OUT || O || || OSC_OUT || || || || || || || || || Xtal 8MHz
|-style="background-color:#DEDEDE;"
| 14 || NRST || I/O || || NRST || || || || || || TP54/SW1 || || || Connected to ground through reset switch. Can also be used for '''JTAG NRST''' debugging
|-
| 15 || PC0 || I/O || {{no}} || PC0 || ADC12_IN10 || {{no}} || ADC12_IN10 || || || Gyro_y || || || Gyroscope Y-channel input
|-
| 16 || PC1 || I/O || {{no}} || PC1 || ADC12_IN11 || {{no}} || ADC12_IN11 || || || Gyro_x || || || Gyroscope X-channel input
|-
| 17 || PC2 || I/O || {{no}} || PC2 || ADC12_IN12 || {{no}} || ADC12_IN12 || || || Gyro_z || || || Gyroscope Z-channel input
|-
| 18 || PC3 || I/O || {{no}} || PC3 || ADC12_IN13 || {{no}} || ADC12_IN13 || || || Acc_y || || || Accelerometer Y-channel input
|-style="background-color:#DEDEDE;"
| 19 || V<sub>SSA</sub> || S || || V<sub>SSA</sub> || || || || || || || || ||
|-style="background-color:#DEDEDE;"
| 20 || V<sub>REF-</sub> || S || || V<sub>REF-</sub> || || || || || || || || ||
|-style="background-color:#DEDEDE;"
| 21 || V<sub>REF+</sub> || S || || V<sub>REF+</sub> || || || || || || || || ||
|-style="background-color:#DEDEDE;"
| 22 || V<sub>DDA</sub> || S || || V<sub>DDA</sub> || || || || || || || || ||
|-
| 23 || PA0-WKUP || I/O || {{no}} || PA0 || WKUP <br /> USART2_CTS <br /> ADC12_IN0 <br /> TIM2_CH1_ETR || {{no}} || WKUP || || || SW8 || || || Connected to {{padps}} Normally pulled to ground by 10kΩ
|-
| 24 || PA1 || I/O || {{no}} || PA1 || USART2_RTS <br /> ADC12_IN1 <br /> TIM2_CH2 || {{no}} || ADC12_IN1 || || || Acc_x || || || Accelerometer X-channel input
|-
| 25 || PA2 || I/O || {{no}} || PA2 || USART2_TX <br /> ADC12_IN2 <br /> TIM2_CH3 || {{no}} || || || || TP35 || || ||
|-
| 26 || PA3 || I/O || {{no}} || PA3 || USART2_RX <br /> ADC12_IN3 <br /> TIM2_CH4 || {{no}} || ADC12_IN2 || || || Acc_z || || || Accelerometer Z-channel input
|-style="background-color:#DEDEDE;"
| 27 || V<sub>SS_4</sub> || S || || V<sub>SS_4</sub> || || || || || || TP4 || || ||
|-style="background-color:#DEDEDE;"
| 28 || V<sub>DD_4</sub> || S || || V<sub>DD_4</sub> || || || || || || || || ||
|-
| 29 || PA4 || I/O || {{no}} || PA4 || SPI1_NSS <br /> USART2_CK <br /> ADC12_IN4 || {{no}} || || || || || || ||
|-
| 30 || PA5 || I/O || {{no}} || PA5 || SPI1_SCK <br /> ADC12_IN5 || {{no}} || || || || TP30 || || ||
|-
| 31 || PA6 || I/O || {{no}} || PA6 || SPI1_MISO <br /> ADC12_IN6 <br /> TIM3_CH1 || TIM1_BKIN || || || || || || ||
|-
| 32 || PA7 || I/O || {{no}} || PA7 || SPI1_MOSI <br /> ADC12_IN7 <br /> TIM3_CH2 || TIM1_CH1N || || || || || || ||
|-
| 33 || PC4 || I/O || {{no}} || PC4 || ADC12_IN14 || {{no}} || ADC12_IN14 || || || Gyro_7 || || || Gyroscope pin7. Constant 1.25V. Possibly a comparison feedback for the gyroscope?
|-
| 34 || PC5 || I/O || {{no}} || PC5 || ADC12_IN15 || {{no}} || || || || || || ||
|-
| 35 || PB0 || I/O || {{no}} || PB0 || ADC12_IN8 <br /> TIM3_CH3 || TIM1_CH2N || || || || || || ||
|-
| 36 || PB1 || I/O || {{no}} || PB1 || ADC12_IN9 <br /> TIM3_CH4 || TIM1_CH3N || ADC12_IN9 || || || Joystick_9 || || || Connected to {{padtrigger}} analog trigger. J9_2(ANALOG_Z)
|-
| 37 || PB2 || I/O || {{yes}} || PB2BOOT1 || {{no}} || {{no}} || || || || ||
|-
| 38 || PE7 || I/O || {{yes}} || PE7 || {{no}} || TIM1_ETR || || || || TP33 || || ||
|-
| 39 || PE8 || I/O || {{yes}} || PE8 || {{no}} || TIM1_CH1N || || || || || || ||
|-
| 40 || PE9 || I/O || {{yes}} || PE9 || {{no}} || TIM1_CH1 || || || || || || ||
|-
| 41 || PE10 || I/O || {{yes}} || PE10 || {{no}} || TIM1_CH2N || || || || EXT_3 || || || EXT connector Pin 3
|-
| 42 || PE11 || I/O || {{yes}} || PE11 || {{no}} || TIM1_CH2 || || PPM <br /> telemetry || || EXT_4 || || || EXT connector Pin 4
|-
| 43 || PE12 || I/O || {{yes}} || PE12 || {{no}} || TIM1_CH3N || Interrupt || || || Mag_14 || || || Magnetometer pin14. Interrupt to signal new sample ready
|-
| 44 || PE13 || I/O || {{yes}} || PE13 || {{no}} || TIM1_CH3 || || || || || || ||
|-
| 45 || PE14 || I/O || {{yes}} || PE14 || {{no}} || TIM1_CH4 || || || || || || ||
|-
| 46 || PE15 || I/O || {{yes}} || PE15 || {{no}} || TIM1_BKIN|| || || || TP34 || || ||
|-
| 47 || PB10 || I/O || {{yes}} || PB10 || I2C2_SCL <br /> USART3_TX || TIM2_CH3 || I2C2_SCL || || || Mag_15 || || || Magnetometer pin15 clock
|-
| 48 || PB11 || I/O || {{yes}} || PB11 || I2C2_SDA <br /> USART3_RX || TIM2_CH4 || I2C2_SDA || || || Mag_16 || || || Magnetometer pin16 data
|-style="background-color:#DEDEDE;"
| 49 || V<sub>SS_1</sub> || S || || V<sub>SS_1</sub> || || || || || || TP69 || || ||
|-style="background-color:#DEDEDE;"
| 50 || V<sub>DD_1</sub> || S || || V<sub>DD_1</sub> || || || || || || || || ||
|-
| 51 || PB12 || I/O || {{yes}} || PB12 || SPI2_NSS <br /> I2C2_SMBAl <br /> USART3_CK <br /> TIM1_BKIN || {{no}} || || || || || || ||
|-
| 52 || PB13 || I/O || {{yes}} || PB13 || SPI2_SCK <br /> USART3_CTS <br /> TIM1_CH1N || {{no}} || || || || || || ||
|-
| 53 || PB14 || I/O || {{yes}} || PB14 || SPI2_MISO <br /> USART3_RTS <br /> TIM1_CH2N || {{no}} || || || || || || ||
|-
| 54 || PB15 || I/O || {{yes}} || PB15 || SPI2_MOSI <br /> TIM1_CH3N || {{no}} || || || || || || ||
|-
| 55 || PD8 || I/O || {{yes}} || PD8 || {{no}} || USART3_TX || USART3_TX || || || BT_7 || || || Bluetooth pin7 transmitter
|-
| 56 || PD9 || I/O || {{yes}} || PD9 || {{no}} || USART3_RX || USART3_RX || || || BT_6 || || || Bluetooth pin6 receiver
|-
| 57 || PD10 || I/O || {{yes}} || PD10 || {{no}} || USART3_CK || || || || TP51 || || ||
|-
| 58 || PD11 || I/O || {{yes}} || PD11 || {{no}} || USART3_CTS || DIO || || || U6_6 || || || TPS63030 regulator enable
|-
| 59 || PD12 || I/O || {{yes}} || PD12 || {{no}} || TIM4_CH1 <br /> USART3_RTS || || || || || || ||
|-
| 60 || PD13 || I/O || {{yes}} || PD13 || {{no}} || TIM4_CH2 || || || || || || || Reacts slowly to USB plug. Logic LO when USB plugged in, HI when not.
|-
| 61 || PD14 || I/O || {{yes}} || PD14 || {{no}} || TIM4_CH3 || || || || || || || Reacts slowly to USB plug. Logic LO when USB plugged in, HI when not.
|-
| 62 || PD15 || I/O || {{yes}} || PD15 || {{no}} || TIM4_CH4 || || Servo1 || || M- || || || Rumble Motor -
|-
| 63 || PC6 || I/O || {{yes}} || PC6 || {{no}} || TIM3_CH1 || || Servo2 || || LED_R || || || Connected to LED_R
|-
| 64 || PC7 || I/O || {{yes}} || PC7 || {{no}} || TIM3_CH2 || || Servo3 || || LED_G || || || Connected to LED_G
|-
| 65 || PC8 || I/O || {{yes}} || PC8 || {{no}} || TIM3_CH3 || || Servo4 || || LED_B || || || Connected to LED_B
|-
| 66 || PC9 || I/O || {{yes}} || PC9 || {{no}} || TIM3_CH4 || DIO || || || R_39 || || || 1.25V???
|-
| 67 || PA8 || I/O || {{yes}} || PA8 || USART1_CK <br /> TIM1_CH1 <br /> MCO || {{no}} || DIO || || || BT_36 || || || Bluetooth pin36. Constant 85Hz PWM
|-
| 68 || PA9 || I/O || {{yes}} || PA9 || USART1_TX <br /> TIM1_CH2 || {{no}} || DIO || || || BT_15 || || || Bluetooth pin15. Varying TTL signal
|-
| 69 || PA10 || I/O || {{yes}} || PA10 || USART1_RX <br /> TIM1_CH3 || {{no}} || DIO || || || BT_14 || || || Bluetooth pin14. Very occasional, only really seen at startup. SPI chip select?
|-
| 70 || PA11 || I/O || {{yes}} || PA11 || USART1_CTS <br /> CANRX <br /> USBDM <br /> TIM1_CH4 || {{no}} || USBDM || || || TP26 || || || Connected through 2.1Ωresistor
|-
| 71 || PA12 || I/O || {{yes}} || PA12 || USART1_RTS <br /> CANTX <br /> USBDP <br /> TIM1_ETR || {{no}} || USBDP || || || TP27 || || || Connected through 2.1Ωresistor
|-
| 72 || PA13 || I/O || {{yes}} || JTMS/SWDIO || {{no}} || PA13 || JTMS || || || TP56 || || || Can also be used for '''JTAG SWDIO''' debugging
|-style="background-color:#DEDEDE;"
| 73 || N.C || || || || || || || || || || || || Not Connected
|-style="background-color:#DEDEDE;"
| 74 || V<sub>SS_2</sub> || S || || V<sub>SS_2</sub> || || || || || || TP70 || || ||
|-style="background-color:#DEDEDE;"
| 75 || V<sub>DD_2</sub> || S || || V<sub>DD_2</sub> || || || || || || TP39 || || ||
|-
| 76 || PA14 || I/O || {{yes}} || JTCK/SWCLK || {{no}} || PA14 || JTCK || || || TP57 || || || Can also be used for '''JTAG SWCLK''' debugging
|-
| 77 || PA15 || I/O || {{yes}} || JTDI || {{no}} || TIM2_CH1_ETR <br /> PA15 <br /> SPI1_NSS || JTDI || || || TP55 || || || Can also be used for '''JTAG JTDI''' debugging
|-
| 78 || PC10 || I/O || {{yes}} || PC10 || {{no}} || USART3_TX || DIO || || || TP38 || || ||
|-
| 79 || PC11 || I/O || {{yes}} || PC11 || {{no}} || USART3_RX || DIO || || || TP37 || || ||
|-
| 80 || PC12 || I/O || {{yes}} || PC12 || {{no}} || USART3_CK || || || || || || ||
|-
| 81 || PD0 || I/O || {{yes}} || OSC_IN || {{no}} || CANRX || || || || || || ||
|-
| 82 || PD1 || I/O || {{yes}} || OSC_OUT || {{no}} || CANTX || || || || || || ||
|-
| 83 || PD2 || I/O || {{yes}} || PD2 || TIM3_ETR || {{no}} || || || || || || ||
|-
| 84 || PD3 || I/O || {{yes}} || PD3 || {{no}} || USART2_CTS || || || || || || ||
|-
| 85 || PD4 || I/O || {{yes}} || PD4 || {{no}} || USART2_RTS || || || || TP36 || || ||
|-
| 86 || PD5 || I/O || {{yes}} || PD5 || {{no}} || USART2_TX || || || || SW13 || || || Connected to {{padsquare}}
|-
| 87 || PD6 || I/O || {{yes}} || PD6 || {{no}} || USART2_RX || || || || || || || Reacts slowly to USB plug. Logic LO when USB plugged in, HI when not.
|-
| 88 || PD7 || I/O || {{yes}} || PD7 || {{no}} || USART2_CK || DIO || || || || || || Reacts instantly to USB plug. Logic HI when USB plugged in, LO when not.
|-
| 89 || PB3 || I/O || {{yes}} || JTDO || {{no}} || TIM2_CH2 <br /> PB3 <br /> TRACESWO <br /> SPI1_SCK || JTDO || || || TP58 || || || Can also be used for '''JTAG JTDO''' debugging
|-
| 90 || PB4 || I/O || {{yes}} || JNTRST || {{no}} || TIM3_CH1 <br /> PB4 <br /> SPI1_MISO || JNTRST || || || TP59 || || || Can also be used for '''JTAG JNTRST''' debugging
|-
| 91 || PB5 || I/O || {{no}} || PB5 || I2C1_SMBAl || TIM3_CH2 <br /> SPI1_MOSI || || || || || || ||
|-
| 92 || PB6 || I/O || {{yes}} || PB6 || I2C1_SCL <br /> TIM4_CH1 || USART1_TX || || USART1_TX || || EXT_5 || || || EXT connector Pin 5
|-
| 93 || PB7 || I/O || {{yes}} || PB7 || I2C1_SDA <br /> TIM4_CH2 || USART1_RX || || USART1_RX || || EXT_6 || || || EXT connector Pin 6
|-
| 94 || BOOT0 || I || ? || BOOT0 || {{no}} || {{no}} || || || || || || ||
|-
| 95 || PB8 || I/O || {{yes}} || PB8 || TIM4_CH3 || I2C1_SCL <br /> CANRX || || || || SW15 || || || Connected to {{padselect}}
|-
| 96 || PB9 || I/O || {{yes}} || PB9 || TIM4_CH4 || I2C1_SDA <br /> CANTX || || || || SW14 || || || Connected to {{padstart}}
|-
| 97 || PE0 || I/O || {{yes}} || PE0 || TIM4_ETR || {{no}} || || || || SW9 || || || Connected to {{padmove}}
|-
| 98 || PE1 || I/O || {{yes}} || PE1 || {{no}} || {{no}} || || || || || || ||
|-style="background-color:#DEDEDE;"
| 99 || V<sub>SS_3</sub> || S || || V<sub>SS_3</sub> || || || || || || TP5 || || ||
|-style="background-color:#DEDEDE;"
| 100 || V<sub>DD_3</sub> || S || || V<sub>DD_3</sub> || || || || || || || || ||
|-
|}
</div>
 
=== STM LPR425AL (2-Axis Gyroscope) ===
The 2-axis gryoscope (likely an STM LPR425AL) is an analog sensor measuring rotation along the x- and y-axes
 
Is covered with a metal shield to avoid interferences (marked as 067S8 in some models), this makes his identification dificult
 
=== Y5250H 2029 K8QEZ (Z-Axis Gyroscope) ===
alt.no.: Y5250H 2005 4Y84AQ <br />
alt.no.: Y5250H 2005 4Y84AQ <br />
alt.no.: Y5250H 2024 GPECQ <br />
alt.no.: Y5250H 2024 GPECQ <br />
U14 <br />
U14 <br />


=== Kionix KXSC4 10227 2410 (Accelerometer) ===
=== Kionix KXSC4 (3-Axis Accelerometer) ===
[[Image:Kionix KXSC4 perspective.gif|400px|thumb|right| Kionix KXSC4 <br /> 3-Axis Accelerometer]][[Image:Kionix KXSC4 application squematic.jpg|800px|thumb|right| Kionix KXSC4 <br /> application squematic]]
alt.no.: Kionix KXSC4-XLU 90831 3909 <br />
alt.no.: Kionix KXSC4-XLU 90831 3909 <br />
alt.no.: Kionix KXSC4 10115 2010 <br />
alt.no.: Kionix KXSC4 10115 2010 <br />
alt.no.: Kionix KXSC4 10227 2410 <br />
U12 <br />
U12 <br />
http://www.kionix.com/


=== Texas Instruments BQ24080 (1-cell Li-Ion Charger) ===
Tri-Axis, 1.5g – 6g, Low Power Analog, 5x5x1.2mm DFN
alt.no.:BRO 01J PDH2 <br />
 
alt.no.:BRO 04K 0948 <br />
The KXSC4 is a high-performance, low-power, analog output tri-axis accelerometer. This  accelerometer is delivered in a 5 x 5 x 1.2 mm, 14-pin, DFN package with an operating temperature range of -40°C to +85°C.
U1 <br />
 
The KXSC4 has a full-scale output range of ±2g and operates from a 1.8 V to 3.6 V DC supply (factory-programmable).
 
*Features:
**Factory-programmable, internal low-pass filter
**Low current consumption: 0.05 µA in standby, 230 µA at full power
**Factory-programmable ±1.5g to ±6g range
**Supply voltage range: 1.8 V to 3.6 V
**Analog output
**Embedded features
***Motion detection
***Orientation detection: report changes in face up, face down, +/- vertical and +/- horizontal orientation
***Self-test function
**RoHS compliant
 
http://www.kionix.com/accelerometers/kxsc4
 
http://www.kionix.com/sites/default/files/KXSC4%20Product%20Brief.pdf
 
http://www.kionix.com/sites/default/files/KXSC4-2050%20Specifications%20Rev%203.pdf


=== TPS63030 (High Efficient Single Inductor Buck-Boost Converter) ===
*Pinout
alt.no.:CEE TI J 04P0 <br />
{| class="wikitable"
U6 <br />
|-
! Pin # !! Name !! Description !! Move Board Notes
|-
| 1 || GND || ''Ground''. ||
|-
| 2 || N.C || ''Not Connected Internally''. ||
|-
| 3 || N.C || ''Not Connected Internally''. ||
|-
| 4 || Vdd || ''Power supply input''. Decouple this pin to ground with a 0.1uF ceramic capacitor (C<sub>1</sub>). || Decoupled with capacitor C42
|-
| 5 || Reserved || '''Reserved''' (must be "Pulled-up to VDD" for normal operation). || Connected to pin 4
|-
| 6 || ST || '''Self Test''' ("Pulled-down to GND" = normal operation. "Pulled-up to VDD" = self-test mode). || Connected to ?
|-
| 7 || Enable || '''Enable pin''' ("pulled-up to VDD" = normal operation. "Pulled-down to GND" = standby). || Connected to ?
|-
| 8 || X output ||  '''X-channel analog output''' (Optional filter capacitor, C<sub>2</sub>). || Connected to MCU pin# '''24 (PA1)'''.
|-
| 9 || Y output || '''Y-channel analog output''' (Optional filter capacitor, C<sub>3</sub>). || Connected to MCU pin# '''18 (PC3)'''.
|-
| 10 || Z output || '''Z-channel analog output''' (Optional filter capacitor, C<sub>4</sub>). || Connected to MCU pin# '''26 (PA3)'''.
|-
| 11 || GND || ''Ground''. ||
|-
| 12 || N.C || ''Not Connected Internally''. ||
|-
| 13 || N.C || ''Not Connected Internally''. ||
|-
| 14 || GND || ''Ground''. ||
|-
|}


=== Cambridge Silicon Radio BC4RE A16U (Bluetooth transmitter) ===
*Output
U8? <br />
1.6V is the zero output. The accelerometers have a scale of about +0.250V increment for each "g". Assuming that the chip is able to go full scale from 0V to 3V, this gives an absolute output of +-6g (this range is a configuration programmable at factory)
http://www.csr.com/products/technology/bluetooth


=== AKM AK8974 (three-axis Electronic Compass -MEMS) ===
=== AKM AK8974 (3-Axis Magnetic Compass) ===
alt.no.:AKM8974 948D <br />
alt.no.:AKM8974 948D <br />
alt.no.:AKM8974 008F <br />
alt.no.:AKM8974 008F <br />
U13 <br />
U13 <br />
Asahi Kasei Microdevices http://www.akm.com/
There is no oficial documentation available about 8974 model, the most closer models (from 897 series) are 8973 and 8975
*8973
http://www.alldatasheet.com/view.jsp?Searchword=AK8973
*8974
Used in Nokia phones models: 2710c, 5730, 6210n, 6710, 6720c, 6720, C6-01, E72, N8-00, N86, N97, N97mini, and N9 MeeGo
http://memsblog.wordpress.com/2009/12/03/nokia-beats-apple-to-compass-in-phone/
*8975
http://www.asahi-kasei.co.jp/akm/en/product/ak8975bc/ak8975bc.html
http://chomikuj.pl/felixd/Mechatronika+%28Elektronika*2c+Mechanika*2c+Obwody+elektryczne%29/MPP+-+Mobilna+Platforma+Pomiarowa/Dokumentacje/Kompass+AKM+AK8975,1518811623.pdf
http://www.chipworks.com/seamark.aspx?sm=s4%3BDatedfl11%3BDevCategory12%3BMEMS+Devicesm12%3BReleaseMonthm10%3BDeviceTypefl10%3BReportCode12%3BEXR-0908-802&cw=detail2
http://www.chipworks.com/seamark.aspx?sm=s4%3BDatedfl11%3BDevCategory12%3BMEMS+Devicesm12%3BReleaseMonthm10%3BDeviceTypefl10%3BReportCode12%3BEXR-0908-802&cw=detail2


=== ALPS 503A 04C (Radio Module) ===
*Pinout
{| class="wikitable"
|-
! Pin # !! Name !! Description
|-
| 1 || ||
|-
| 2 || ||
|-
| 3 || ||
|-
| 4 || ||
|-
| 5 || ||
|-
| 6 || ||
|-
| 7 || ||
|-
| 8 || ||
|-
| 9 || ||
|-
| 10 || ||
|-
| 11 || ||
|-
| 12 || ||
|-
| 13 || ||
|-
| 14 || ||
|-
| 15 || ||
|-
| 16 || ||
|-
|}
 
=== ALPS 503A (Radio Module) ===
 
==== Cambridge Silicon Radio BC4RE A16U (Bluetooth transmitter) ====
U8?. Inside ALPS 503A BT module<br />
http://www.csr.com/products/technology/bluetooth


=== Li-Ion (Battery Pack) ===
*Pinout
4-168-108-01 / LIS1441<br />
<div style="height:555px; overflow:auto">
3.7V 1380 mAh <br />
{| class="wikitable"
(typ 1520mAh) <br />
|-
Charge Current: 1.4A <br />
! Pin # !! Name !! Description
Charge Voltage: 4.25V <br />
|-
| 1 || ||
|-
| 2 || ||
|-
| 3 || ||
|-
| 4 || ||
|-
| 5 || ||
|-
| 6 || ||
|-
| 7 || ||
|-
| 8 || ||
|-
| 9 || ||
|-
| 10 || ||
|-
| 11 || ||
|-
| 12 || ||
|-
| 13 || ||
|-
| 14 || ||
|-
| 15 || ||
|-
| 16 || ||
|-
| 17 || ||
|-
| 18 || ||
|-
| 19 || ||
|-
| 20 || ||
|-
| 21 || ||
|-
| 22 || ||
|-
| 23 || ||
|-
| 24 || ||
|-
| 25 || ||
|-
| 26 || ||
|-
| 27 || ||
|-
| 28 || ||
|-
| 29 || ||
|-
| 30 || ||
|-
| 31 || ||
|-
| 32 || ||
|-
| 33 || ||
|-
| 34 || ||
|-
| 35 || ||
|-
| 36 || ||
|-
| 37 || ||
|-
| 38 || ||
|-
| 39 || ||
|-
| 40 || ||
|-
|}
</div>


=== LED2 ===
=== LED2 (High Power RGB LED) ===
6 pins surface mounted RGB 2^24
6 pins surface mounted RGB 2^24


Line 61: Line 547:
**LED_R
**LED_R
**LED_4R5 (VDD line)
**LED_4R5 (VDD line)
=== TPS63030 (High Efficient Single Inductor Buck-Boost Converter) ===
alt.no.:CEE TI J 04P0 <br />
U6 <br />
=== Texas Instruments BQ24080 (1-cell Li-Ion Charger) ===
alt.no.:BRO 01J PDH2 <br />
alt.no.:BRO 04K 0948 <br />
U1 <br />
=== Li-Ion (Battery Pack) ===
4-168-108-01 / LIS1441<br />
3.7V 1380 mAh <br />
(typ 1520mAh) <br />
Charge Current: 1.4A <br />
Charge Voltage: 4.25V <br />


=== External Conectors ===
=== External Conectors ===
[[Image:Move controller connectors.jpg|400px|thumb|right| Move controller connectors]]


==== USB connector ====
==== USB connector ====
Line 77: Line 580:


==== Extension Connector ====
==== Extension Connector ====
Marked in the plastic as "ext" and refered as "extension connector" in the [[Move Sharp Shooter]] "Instruction Manual.pdf"
Marked in the plastic as "ext" and refered as "extension connector" in the [[Move Sharp Shooter]] and [[Move Racing Wheel]] "Instruction Manual.pdf"
 
8 pins custom made (exact alternative part not found yet)
 
This connector is used to communicate with the [[Move Sharp Shooter]] gun. The buttons, trigger, etc... of this gun can send signals to the move controller
 
{| class="wikitable"
|-
! EXT connector pin number <br /> (from left to right) !! Connected to main board !! MCU default firmware function !! sony firmware function <br /> (pinout remapped ?) !! MoveCopter firmware function <br /> (pinout remapped)
|-
| 1 || colspan="4" | 3.2v
|-
| 2 || colspan="4" | 3.2v
|-
| 3 || MCU pin 41 (PE10) || TIM1_CH2N ||  || {{no}}
|-
| 4 || MCU pin 42 (PE11) || TIM1_CH2 || || PPM output (input for the PC telemetry app)
|-
| 5 || MCU pin 92 (PB6) || I2C1_SCL || || USART1 TX (serial transmitter). Added to the project after D-lite manual
|-
| 6 || MCU pin 93 (PB7) || I2C1_SDA || || USART1 RX (serial receiver). Added to the project after D-lite manual
|-
| 7 || colspan="4" | GND
|-
| 8 || colspan="4" | GND
|-
|}
 
*Notes
**All the schematics and pinouts in "D-lite MoveCopter manual" and "Kenn Sebesta blog" related with this connector are taken directly from the main board (not from the external connector). The schematics explained in these pages are from an old model with different number of pins (some of them duplicated or displaced). There are at least 3 different board models where this pins are different, but in all models the lines are reordered at the "EXT connector" (and reduced to 8), all models has the same pinout externally explained here in wiki
**In MoveCopter bootloader several pins of MCU has been remaped, included 3 pins of "EXT connector" (for input/output data), and the 3 RGB lines from the LED + 1 line from the rumble motor (to controll 4 servo motors for the helices of the quadcopter)
 
Obsolete not-acurate notes
The connector is soldered in a "children board" identifyed as "connector board", is connected with the "main board" with a 12 traces ribbon cable (and 2 pressure connectors).
Only 4 lines of the ribbon cable are used for data signals (protected with a resistor and a diode in the children board) + 1 line for "ground" and 1 line for 3.2volts
I will upload a complete squematic of this sub-circuit later
 
==Software Related Projects==
 
===Move.Me===
Move.me is a software server application for the PS3 system that uses the PlayStation Move motion controller as an input device. Is designed for academic researchers, university instructors, college students, programming hobbyists, and HCI developers.
 
* https://us.playstation.com/ps3/playstation-move/move-me/
 
https://secure.webassets.scea.com/pscomauth/groups/public/documents/webasset/moveme-network-protocol_0223.pdf
 
http://ie.playstation.com/media/IO0_qmi1/moveme-userguide_0223.pdf
 
===PSL1GHT and libmove & homebrew===
* https://github.com/ps3dev/PSL1GHT/tree/master/samples/input/gemsample
* https://github.com/ps3dev/PSL1GHT/tree/master/samples/input/gemtest
* https://github.com/wargio/libmove
 
<!--// PS3 homebrew support for move controller by faking the device as a wireless mouse, there is no support for native firmware move modules/functions (yet) //-->
 
*Homebrew:
 
http://devram0.blogspot.it/2013/04/ps-seismograph-030.html
 
http://www.ps3hax.net/2013/01/released-ps-vibe-move-edition/
 
===The PS Move API===
Is a library to access the Sony Move Motion Controller via Bluetooth and USB directly from your PC (Linux, Mac OS X, Windows) without the need for a PS3. Mobile platforms are also supported (or planned): Support for MeeGo 1.2 Harmattan is already working, support for Android is in the works. The library is free software, released under a Simplified BSD License, so you can use it in both open source and proprietary closed-source applications, as long as you follow the license terms.
 
http://thp.io/2010/psmove/
 
Git repository: https://github.com/thp/psmoveapi
 
===Move On PC===
PS Move Motion Controller as input device on PCs and mobile devices
May 2012: We are participating in the Google Summer of Code. We will keep you updated about our progress here. The old code base will be archived in the Downloads section soon, and we will base our future MoveOnPC work on Thomas Perl's "PS Move API" project, but add support for tracking and computer vision to the library.
 
Blog: http://moveonpc.blogspot.com.es/
 
http://code.google.com/p/moveonpc/
 
===Move Framework for Windows===
With the Move Framework, you can integrate all the possibilities of motion tracking in your programs and games!. There are SDK's for C++ and C# developers. The project is no longer maintained
 
http://code.google.com/p/moveframework/ (src available with svn)
 
===Motion In Joy for Windows===
MotioninJoy is a driver, designed by a developer unconnected with Sony, intended to use all the features of the Sixaxis and Dualshock 3 controllers on a PC running Windows.
 
http://www.motioninjoy.com
 
http://www.motioninjoy.com/wiki/help
 
http://forums.motioninjoy.com/viewtopic.php?f=33&t=929
 
==Hardware Related Projects==
 
===Kenn Sebesta blog (PS3 Move hacking)===
http://www.eissq.com/ps3_move/
 
===D-Lite MoveCopter ===
"CopterControl bootloader" port for "Move controller"
 
Is a custom bootloader/firmware for the ARM STM32 microcontroller series. The installation is composed by the "bootloader" (move hardware specific, installed by JTAG) and the "flight firmware" (common for all STM32 microcontrollers, installed by USB)
 
The flight firmware is intended to stabilish a flying quadcopter using data from position sensors (like the gyroscopes and the 3-axis acelerometers in move)
 
http://vimeo.com/25983655
 
http://wiki.openpilot.org/display/Doc/D-Lite%27s+PS3+MoveCopter
 
http://forums.openpilot.org/topic/5526-coptercontrol-on-a-game-controller/


8 pins custom made ? (smaller than the Mini-B)
http://forums.openpilot.org/topic/5526-coptercontrol-on-a-game-controller/page__st__40#entry24579


The connector is soldered in a "children board" identifyed as "connector board", is connected with the "main board" with a 12 traces ribbon cable (and 2 pressure connectors). Only 4 lines of the ribbon cable are used for data signals (each line is protected with a resistor and a diode in the children board) + 1 line that seems to be common and is much more wide (probably volts or ground). The other lines are not used.
http://forums.openpilot.org/topic/5526-coptercontrol-on-a-game-controller/page__st__140#entry80016


*This connector is used to communicate with the [[Move Sharp Shooter]] gun. The buttons, trigger, etc... of this gun can send signals to the move controller
http://git.openpilot.org/changelog/~br=D-Lite%402fMoveCopter_MARG/OpenPilot


== Software Support ==
http://wiki.openpilot.org/display/CC/CopterControl+Home


=== Move In PS3 ===
http://wiki.openpilot.org/display/Doc/Ground+Control+Station+User+Manual
*PSl1ght supports move controller by faking the device as a wireless mouse, there is no support for native move modules/functions (yet)


=== Move In PC ===
http://www.openpilot.org/products/openpilot-coptercontrol-platform/
*Playstation Move Framework: http://code.google.com/p/moveframework/ (src available with svn)


http://forums.openpilot.org/topic/5526-coptercontrol-on-a-game-controller/page__st__140#entry81223


{{Console}}


[[Category:Peripherals]]
{{Peripherals}}<noinclude>[[Category:Main]]</noinclude>

Latest revision as of 01:22, 7 May 2023

Move Hardware[edit | edit source]

CECH-ZCM1 (CECH-ZCM1U, CECH-ZCM1E, CECH-ZCM1J, CECH-ZCM1H, CECH-ZCM1M)

MIC listings:

Anatel:

  • Note some components and testpoints (TP) are different between models.

STM32F103 VBT6 Y (ARM Cortex-M3 32bit@72MHz SRAM20Kb FLASH128Kb RISC Microcontroller)[edit | edit source]

U19
http://www.st.com/mcu/devicedocs-STM32F103VB-110.html

http://www.st.com/stonline/stappl/st/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/DATASHEET/CD00161566.pdf

Reference STM32 (Device family) F (Procut type) 103 (Device subfamily) V (Pin count) B (Flash memory size) T (Package) 6 (Temperature range) Y (Options)
Description STM32= ARM-based 32-bit microcontroller F= general-purpose 103= performance line T= 36 pins
C= 48 pins
R= 64 pins
V= 100 pins		 8= 64 Kbytes
B= 128 Kbytes		 H= BGA
T= LQFP
U= VFQFPN		 6= -40 to +85 ºC
7= -40 to +105 ºC		 Unknown
  • Firmware dump analisys (wrote by nico @ Kenn Sebesta blog)
Actually, there seems to be 3 vector tables:

8000000 (size 0x0040) NVIC vectors
8000800 (size 0x0094) Bootloader vectors
8002800 (size 0x0130) Application vectors

The subroutine at 8000040 seems to call either the bootloader reset vector (at 8000142) or the application reset vector (at 800016E).

The thing is, the shortened bootloader vectors (provided this is actually the bootloader code), does not contain any I2C or UART interrupt vectors, and only USB_LP_CAN_
RX0 vector seems to contain active code (as far as communication is concerned).

Seems like the CPU and Bluetooth module use some form of UART to communicate, is that correct ?
...
..
.
The first thing to look for is the base address of the BIN file in memory, and further what the memory map looks like. Kenn has already provided this info in his example project, but these can be extracted from the STM32 datasheet also. We know that the first byte of the BIN file maps to address 0x08000000 in memory. We know that internal SRAM start at 0x20000000.

Second thing is to locate the vectors table (see STM32 datasheet) and the reset vector, because it gives you the entry point of the firmware and other useful info. The vectors table is also relocatable in this case (register SBC_VTOR, STM32 programming manual page 134), so there may be multiple vectors tables (and there is).

The vectors table is actually a big jump table. I'm using the following trick to find other tables (be it vectors or switch / case jump tables). We know that addresses are 32 bit (ARM) and highest byte is always 0x08, so we can use a simple hex dump of the BIN file and search using the regular expression "08 .. .. .. 08" (dot meaning any single character). If you use a text editor with search results highlighting (vim for example), then jump tables just catch your eye. There are not so many of them. I used this technique to find the three vectors tables listed earlier. They're distinctive because of their first 32 bit word (0x20000400 which oughts to be the address of the stack top according to the STM32 datasheet).

The vectors table also provides you with pointers to interesting subroutines. If Bluetooth is what you're looking after, just follow IT vector number 39 (USART3) since we know thanks to Kenn that STM32 and Bluetooth chips communicate via UART number 3. Then try to figure out what the firmware should look like: when a Bluetooth output report is coming to the Move, an interrupt is generated in the STM32, the input report is fetched serially from the Bluetooth chip into some buffer (or ring buffer), and the buffer is parsed, either synchronously in the IT handler itself, or a message is sent from the IT handler to some lower priority task. Difficulty is to figure out the relevant tasks and to identify them in the disassembled code.

The jump tables trick can also be used to identify the code that parses Bluetooth output reports (faster). It's very likely that such a jump table is used to call a specific Bluetooth command handler for each Bluetooth command supported by the Move. In that case the jump table is a table of function pointers. The idea is to list the jump tables, then try to find one in the same region as the IT handler. The start address of the jump table should be present in some code that can be traced back to the IT handler. This provides info on how many Bluetooth commands are supported, which ones and eventually what they're doing (after a fair amount of disassembly, I admit).
  • JTAG programmer

3.3V and http://www.amontec.com/openocd.shtml compatible e.g: "bus pirate" https://www.sparkfun.com/products/9544

First of all, please save your original firmware image. Even if you don't plan to ever use your Move as a game controller again, this is a good test if your JTAG connection works. It's also supposed that the firmware contains device specific calibration values. If you replace your original firmware with firmware from another Move, it may not work as expected. Newer Moves may have code protection enabled. You can easiely disable code protection via OpenOCD but this will erase flash and make it impossibe to save the original firmware.

To make a dump of the original firmware run:

Type This
> dump_image my_original_move_firmware.bin 0x8000000 0x20000
dumped 131072 bytes in 6.391000s (20.028 kb/s)

To write a dump run:

Type This
> flash write_image erase my_original_move_firmware.bin 0x8000000
auto erase enabled
wrote 131072 bytes from file myoriginal_move_firmware.bin in 10.704000s (11.958 kb/s)
  • Buses:
    • 3x USART (bluetooth @ 230,400 baud,...)
    • 2x SPI
    • 2x I²C (magnetometer,...)
    • 1x USB
    • 1x CAN
  • Pinout
Pin # Name Type 5v tolerant Firmware Function Move Board TestPoints Notes
ARM-Cortex Sony MoveCopter Others? YCON2_1.01 YCON2.5_1.03 Others ?
Main Alternate Remap
1 PE2 I/O Yes PE2 TRACECK No TRACECK TP21
2 PE3 I/O Yes PE3 TRACED0 No TRACED0 TP22
3 PE4 I/O Yes PE4 TRACED1 No TRACED1 TP23
4 PE5 I/O Yes PE5 TRACED2 No TRACED2 TP24
5 PE6 I/O Yes PE6 TRACED3 No TRACED3 TP25
6 VBAT S VBAT Vcc Supply for RTC and backup registers
7 PC13-TAMPER-RTC I/O No PC13 TAMPER-RTC No SW10 Connected to Dualshock circle button
8 PC14-OSC32_IN I/O No PC14 OSC32_IN No SW11 Connected to Dualshock cross button
9 PC15-OSC32_OUT I/O No PC15 OSC32_OUT No SW12 Connected to Dualshock triangle button
10 VSS_5 S VSS_5 TP3
11 VDD_5 S VDD_5 TP68
12 OSC_IN I OSC_IN Xtal 8MHz
13 OSC_OUT O OSC_OUT Xtal 8MHz
14 NRST I/O NRST TP54/SW1 Connected to ground through reset switch. Can also be used for JTAG NRST debugging
15 PC0 I/O No PC0 ADC12_IN10 No ADC12_IN10 Gyro_y Gyroscope Y-channel input
16 PC1 I/O No PC1 ADC12_IN11 No ADC12_IN11 Gyro_x Gyroscope X-channel input
17 PC2 I/O No PC2 ADC12_IN12 No ADC12_IN12 Gyro_z Gyroscope Z-channel input
18 PC3 I/O No PC3 ADC12_IN13 No ADC12_IN13 Acc_y Accelerometer Y-channel input
19 VSSA S VSSA
20 VREF- S VREF-
21 VREF+ S VREF+
22 VDDA S VDDA
23 PA0-WKUP I/O No PA0 WKUP
USART2_CTS
ADC12_IN0
TIM2_CH1_ETR		 No WKUP SW8 Connected to Dualshock PS button Normally pulled to ground by 10kΩ
24 PA1 I/O No PA1 USART2_RTS
ADC12_IN1
TIM2_CH2		 No ADC12_IN1 Acc_x Accelerometer X-channel input
25 PA2 I/O No PA2 USART2_TX
ADC12_IN2
TIM2_CH3		 No TP35
26 PA3 I/O No PA3 USART2_RX
ADC12_IN3
TIM2_CH4		 No ADC12_IN2 Acc_z Accelerometer Z-channel input
27 VSS_4 S VSS_4 TP4
28 VDD_4 S VDD_4
29 PA4 I/O No PA4 SPI1_NSS
USART2_CK
ADC12_IN4		 No
30 PA5 I/O No PA5 SPI1_SCK
ADC12_IN5		 No TP30
31 PA6 I/O No PA6 SPI1_MISO
ADC12_IN6
TIM3_CH1		 TIM1_BKIN
32 PA7 I/O No PA7 SPI1_MOSI
ADC12_IN7
TIM3_CH2		 TIM1_CH1N
33 PC4 I/O No PC4 ADC12_IN14 No ADC12_IN14 Gyro_7 Gyroscope pin7. Constant 1.25V. Possibly a comparison feedback for the gyroscope?
34 PC5 I/O No PC5 ADC12_IN15 No
35 PB0 I/O No PB0 ADC12_IN8
TIM3_CH3		 TIM1_CH2N
36 PB1 I/O No PB1 ADC12_IN9
TIM3_CH4		 TIM1_CH3N ADC12_IN9 Joystick_9 Connected to Move trigger button analog trigger. J9_2(ANALOG_Z)
37 PB2 I/O Yes PB2BOOT1 No No
38 PE7 I/O Yes PE7 No TIM1_ETR TP33
39 PE8 I/O Yes PE8 No TIM1_CH1N
40 PE9 I/O Yes PE9 No TIM1_CH1
41 PE10 I/O Yes PE10 No TIM1_CH2N EXT_3 EXT connector Pin 3
42 PE11 I/O Yes PE11 No TIM1_CH2 PPM
telemetry		 EXT_4 EXT connector Pin 4
43 PE12 I/O Yes PE12 No TIM1_CH3N Interrupt Mag_14 Magnetometer pin14. Interrupt to signal new sample ready
44 PE13 I/O Yes PE13 No TIM1_CH3
45 PE14 I/O Yes PE14 No TIM1_CH4
46 PE15 I/O Yes PE15 No TIM1_BKIN TP34
47 PB10 I/O Yes PB10 I2C2_SCL
USART3_TX		 TIM2_CH3 I2C2_SCL Mag_15 Magnetometer pin15 clock
48 PB11 I/O Yes PB11 I2C2_SDA
USART3_RX		 TIM2_CH4 I2C2_SDA Mag_16 Magnetometer pin16 data
49 VSS_1 S VSS_1 TP69
50 VDD_1 S VDD_1
51 PB12 I/O Yes PB12 SPI2_NSS
I2C2_SMBAl
USART3_CK
TIM1_BKIN		 No
52 PB13 I/O Yes PB13 SPI2_SCK
USART3_CTS
TIM1_CH1N		 No
53 PB14 I/O Yes PB14 SPI2_MISO
USART3_RTS
TIM1_CH2N		 No
54 PB15 I/O Yes PB15 SPI2_MOSI
TIM1_CH3N		 No
55 PD8 I/O Yes PD8 No USART3_TX USART3_TX BT_7 Bluetooth pin7 transmitter
56 PD9 I/O Yes PD9 No USART3_RX USART3_RX BT_6 Bluetooth pin6 receiver
57 PD10 I/O Yes PD10 No USART3_CK TP51
58 PD11 I/O Yes PD11 No USART3_CTS DIO U6_6 TPS63030 regulator enable
59 PD12 I/O Yes PD12 No TIM4_CH1
USART3_RTS
60 PD13 I/O Yes PD13 No TIM4_CH2 Reacts slowly to USB plug. Logic LO when USB plugged in, HI when not.
61 PD14 I/O Yes PD14 No TIM4_CH3 Reacts slowly to USB plug. Logic LO when USB plugged in, HI when not.
62 PD15 I/O Yes PD15 No TIM4_CH4 Servo1 M- Rumble Motor -
63 PC6 I/O Yes PC6 No TIM3_CH1 Servo2 LED_R Connected to LED_R
64 PC7 I/O Yes PC7 No TIM3_CH2 Servo3 LED_G Connected to LED_G
65 PC8 I/O Yes PC8 No TIM3_CH3 Servo4 LED_B Connected to LED_B
66 PC9 I/O Yes PC9 No TIM3_CH4 DIO R_39 1.25V???
67 PA8 I/O Yes PA8 USART1_CK
TIM1_CH1
MCO		 No DIO BT_36 Bluetooth pin36. Constant 85Hz PWM
68 PA9 I/O Yes PA9 USART1_TX
TIM1_CH2		 No DIO BT_15 Bluetooth pin15. Varying TTL signal
69 PA10 I/O Yes PA10 USART1_RX
TIM1_CH3		 No DIO BT_14 Bluetooth pin14. Very occasional, only really seen at startup. SPI chip select?
70 PA11 I/O Yes PA11 USART1_CTS
CANRX
USBDM
TIM1_CH4		 No USBDM TP26 Connected through 2.1Ωresistor
71 PA12 I/O Yes PA12 USART1_RTS
CANTX
USBDP
TIM1_ETR		 No USBDP TP27 Connected through 2.1Ωresistor
72 PA13 I/O Yes JTMS/SWDIO No PA13 JTMS TP56 Can also be used for JTAG SWDIO debugging
73 N.C Not Connected
74 VSS_2 S VSS_2 TP70
75 VDD_2 S VDD_2 TP39
76 PA14 I/O Yes JTCK/SWCLK No PA14 JTCK TP57 Can also be used for JTAG SWCLK debugging
77 PA15 I/O Yes JTDI No TIM2_CH1_ETR
PA15
SPI1_NSS		 JTDI TP55 Can also be used for JTAG JTDI debugging
78 PC10 I/O Yes PC10 No USART3_TX DIO TP38
79 PC11 I/O Yes PC11 No USART3_RX DIO TP37
80 PC12 I/O Yes PC12 No USART3_CK
81 PD0 I/O Yes OSC_IN No CANRX
82 PD1 I/O Yes OSC_OUT No CANTX
83 PD2 I/O Yes PD2 TIM3_ETR No
84 PD3 I/O Yes PD3 No USART2_CTS
85 PD4 I/O Yes PD4 No USART2_RTS TP36
86 PD5 I/O Yes PD5 No USART2_TX SW13 Connected to Dualshock square button
87 PD6 I/O Yes PD6 No USART2_RX Reacts slowly to USB plug. Logic LO when USB plugged in, HI when not.
88 PD7 I/O Yes PD7 No USART2_CK DIO Reacts instantly to USB plug. Logic HI when USB plugged in, LO when not.
89 PB3 I/O Yes JTDO No TIM2_CH2
PB3
TRACESWO
SPI1_SCK		 JTDO TP58 Can also be used for JTAG JTDO debugging
90 PB4 I/O Yes JNTRST No TIM3_CH1
PB4
SPI1_MISO		 JNTRST TP59 Can also be used for JTAG JNTRST debugging
91 PB5 I/O No PB5 I2C1_SMBAl TIM3_CH2
SPI1_MOSI
92 PB6 I/O Yes PB6 I2C1_SCL
TIM4_CH1		 USART1_TX USART1_TX EXT_5 EXT connector Pin 5
93 PB7 I/O Yes PB7 I2C1_SDA
TIM4_CH2		 USART1_RX USART1_RX EXT_6 EXT connector Pin 6
94 BOOT0 I ? BOOT0 No No
95 PB8 I/O Yes PB8 TIM4_CH3 I2C1_SCL
CANRX		 SW15 Connected to Dualshock select button
96 PB9 I/O Yes PB9 TIM4_CH4 I2C1_SDA
CANTX		 SW14 Connected to Dualshock start button
97 PE0 I/O Yes PE0 TIM4_ETR No SW9 Connected to Move button
98 PE1 I/O Yes PE1 No No
99 VSS_3 S VSS_3 TP5
100 VDD_3 S VDD_3

STM LPR425AL (2-Axis Gyroscope)[edit | edit source]

The 2-axis gryoscope (likely an STM LPR425AL) is an analog sensor measuring rotation along the x- and y-axes

Is covered with a metal shield to avoid interferences (marked as 067S8 in some models), this makes his identification dificult

Y5250H 2029 K8QEZ (Z-Axis Gyroscope)[edit | edit source]

alt.no.: Y5250H 2005 4Y84AQ
alt.no.: Y5250H 2024 GPECQ
U14

Kionix KXSC4 (3-Axis Accelerometer)[edit | edit source]

Kionix KXSC4
3-Axis Accelerometer
Kionix KXSC4
application squematic

alt.no.: Kionix KXSC4-XLU 90831 3909
alt.no.: Kionix KXSC4 10115 2010
alt.no.: Kionix KXSC4 10227 2410
U12

Tri-Axis, 1.5g – 6g, Low Power Analog, 5x5x1.2mm DFN

The KXSC4 is a high-performance, low-power, analog output tri-axis accelerometer. This accelerometer is delivered in a 5 x 5 x 1.2 mm, 14-pin, DFN package with an operating temperature range of -40°C to +85°C.

The KXSC4 has a full-scale output range of ±2g and operates from a 1.8 V to 3.6 V DC supply (factory-programmable).

  • Features:
    • Factory-programmable, internal low-pass filter
    • Low current consumption: 0.05 µA in standby, 230 µA at full power
    • Factory-programmable ±1.5g to ±6g range
    • Supply voltage range: 1.8 V to 3.6 V
    • Analog output
    • Embedded features
      • Motion detection
      • Orientation detection: report changes in face up, face down, +/- vertical and +/- horizontal orientation
      • Self-test function
    • RoHS compliant

http://www.kionix.com/accelerometers/kxsc4

http://www.kionix.com/sites/default/files/KXSC4%20Product%20Brief.pdf

http://www.kionix.com/sites/default/files/KXSC4-2050%20Specifications%20Rev%203.pdf

  • Pinout
Pin # Name Description Move Board Notes
1 GND Ground.
2 N.C Not Connected Internally.
3 N.C Not Connected Internally.
4 Vdd Power supply input. Decouple this pin to ground with a 0.1uF ceramic capacitor (C1). Decoupled with capacitor C42
5 Reserved Reserved (must be "Pulled-up to VDD" for normal operation). Connected to pin 4
6 ST Self Test ("Pulled-down to GND" = normal operation. "Pulled-up to VDD" = self-test mode). Connected to ?
7 Enable Enable pin ("pulled-up to VDD" = normal operation. "Pulled-down to GND" = standby). Connected to ?
8 X output X-channel analog output (Optional filter capacitor, C2). Connected to MCU pin# 24 (PA1).
9 Y output Y-channel analog output (Optional filter capacitor, C3). Connected to MCU pin# 18 (PC3).
10 Z output Z-channel analog output (Optional filter capacitor, C4). Connected to MCU pin# 26 (PA3).
11 GND Ground.
12 N.C Not Connected Internally.
13 N.C Not Connected Internally.
14 GND Ground.
  • Output

1.6V is the zero output. The accelerometers have a scale of about +0.250V increment for each "g". Assuming that the chip is able to go full scale from 0V to 3V, this gives an absolute output of +-6g (this range is a configuration programmable at factory)

AKM AK8974 (3-Axis Magnetic Compass)[edit | edit source]

alt.no.:AKM8974 948D
alt.no.:AKM8974 008F
U13
Asahi Kasei Microdevices http://www.akm.com/

There is no oficial documentation available about 8974 model, the most closer models (from 897 series) are 8973 and 8975

  • 8973

http://www.alldatasheet.com/view.jsp?Searchword=AK8973

  • 8974

Used in Nokia phones models: 2710c, 5730, 6210n, 6710, 6720c, 6720, C6-01, E72, N8-00, N86, N97, N97mini, and N9 MeeGo

http://memsblog.wordpress.com/2009/12/03/nokia-beats-apple-to-compass-in-phone/

  • 8975

http://www.asahi-kasei.co.jp/akm/en/product/ak8975bc/ak8975bc.html

http://chomikuj.pl/felixd/Mechatronika+%28Elektronika*2c+Mechanika*2c+Obwody+elektryczne%29/MPP+-+Mobilna+Platforma+Pomiarowa/Dokumentacje/Kompass+AKM+AK8975,1518811623.pdf

http://www.chipworks.com/seamark.aspx?sm=s4%3BDatedfl11%3BDevCategory12%3BMEMS+Devicesm12%3BReleaseMonthm10%3BDeviceTypefl10%3BReportCode12%3BEXR-0908-802&cw=detail2

  • Pinout
Pin # Name Description
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

ALPS 503A (Radio Module)[edit | edit source]

Cambridge Silicon Radio BC4RE A16U (Bluetooth transmitter)[edit | edit source]

U8?. Inside ALPS 503A BT module
http://www.csr.com/products/technology/bluetooth

  • Pinout
Pin # Name Description
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

LED2 (High Power RGB LED)[edit | edit source]

6 pins surface mounted RGB 2^24

  • Soldered to the board with a ribbon cable (no connectors) with 4 lines marked as:
    • LED_B
    • LED_G
    • LED_R
    • LED_4R5 (VDD line)

TPS63030 (High Efficient Single Inductor Buck-Boost Converter)[edit | edit source]

alt.no.:CEE TI J 04P0
U6

Texas Instruments BQ24080 (1-cell Li-Ion Charger)[edit | edit source]

alt.no.:BRO 01J PDH2
alt.no.:BRO 04K 0948
U1

Li-Ion (Battery Pack)[edit | edit source]

4-168-108-01 / LIS1441
3.7V 1380 mAh
(typ 1520mAh)
Charge Current: 1.4A
Charge Voltage: 4.25V

External Conectors[edit | edit source]

Move controller connectors

USB connector[edit | edit source]

USB (Mini-B type) standard connector 5 pins

http://pinoutsguide.com/Slots/USB_pinout.shtml

Charging Station Pads[edit | edit source]

2 copper pads that are part of a little PCB with no traces that works as a support for the pads. Are soldered (no connectors) to the main board with 2 wires: black (ground) red (volts)

http://www.youtube.com/watch?v=TkPFKrlWWwk

Extension Connector[edit | edit source]

Marked in the plastic as "ext" and refered as "extension connector" in the Move Sharp Shooter and Move Racing Wheel "Instruction Manual.pdf"

8 pins custom made (exact alternative part not found yet)

This connector is used to communicate with the Move Sharp Shooter gun. The buttons, trigger, etc... of this gun can send signals to the move controller

EXT connector pin number
(from left to right)		 Connected to main board MCU default firmware function sony firmware function
(pinout remapped ?)		 MoveCopter firmware function
(pinout remapped)
1 3.2v
2 3.2v
3 MCU pin 41 (PE10) TIM1_CH2N No
4 MCU pin 42 (PE11) TIM1_CH2 PPM output (input for the PC telemetry app)
5 MCU pin 92 (PB6) I2C1_SCL USART1 TX (serial transmitter). Added to the project after D-lite manual
6 MCU pin 93 (PB7) I2C1_SDA USART1 RX (serial receiver). Added to the project after D-lite manual
7 GND
8 GND
  • Notes
    • All the schematics and pinouts in "D-lite MoveCopter manual" and "Kenn Sebesta blog" related with this connector are taken directly from the main board (not from the external connector). The schematics explained in these pages are from an old model with different number of pins (some of them duplicated or displaced). There are at least 3 different board models where this pins are different, but in all models the lines are reordered at the "EXT connector" (and reduced to 8), all models has the same pinout externally explained here in wiki
    • In MoveCopter bootloader several pins of MCU has been remaped, included 3 pins of "EXT connector" (for input/output data), and the 3 RGB lines from the LED + 1 line from the rumble motor (to controll 4 servo motors for the helices of the quadcopter)
Obsolete not-acurate notes
The connector is soldered in a "children board" identifyed as "connector board", is connected with the "main board" with a 12 traces ribbon cable (and 2 pressure connectors).
Only 4 lines of the ribbon cable are used for data signals (protected with a resistor and a diode in the children board) + 1 line for "ground" and 1 line for 3.2volts
I will upload a complete squematic of this sub-circuit later

Software Related Projects[edit | edit source]

Move.Me[edit | edit source]

Move.me is a software server application for the PS3 system that uses the PlayStation Move motion controller as an input device. Is designed for academic researchers, university instructors, college students, programming hobbyists, and HCI developers.

https://secure.webassets.scea.com/pscomauth/groups/public/documents/webasset/moveme-network-protocol_0223.pdf

http://ie.playstation.com/media/IO0_qmi1/moveme-userguide_0223.pdf

PSL1GHT and libmove & homebrew[edit | edit source]


  • Homebrew:

http://devram0.blogspot.it/2013/04/ps-seismograph-030.html

http://www.ps3hax.net/2013/01/released-ps-vibe-move-edition/

The PS Move API[edit | edit source]

Is a library to access the Sony Move Motion Controller via Bluetooth and USB directly from your PC (Linux, Mac OS X, Windows) without the need for a PS3. Mobile platforms are also supported (or planned): Support for MeeGo 1.2 Harmattan is already working, support for Android is in the works. The library is free software, released under a Simplified BSD License, so you can use it in both open source and proprietary closed-source applications, as long as you follow the license terms.

http://thp.io/2010/psmove/

Git repository: https://github.com/thp/psmoveapi

Move On PC[edit | edit source]

PS Move Motion Controller as input device on PCs and mobile devices May 2012: We are participating in the Google Summer of Code. We will keep you updated about our progress here. The old code base will be archived in the Downloads section soon, and we will base our future MoveOnPC work on Thomas Perl's "PS Move API" project, but add support for tracking and computer vision to the library.

Blog: http://moveonpc.blogspot.com.es/

http://code.google.com/p/moveonpc/

Move Framework for Windows[edit | edit source]

With the Move Framework, you can integrate all the possibilities of motion tracking in your programs and games!. There are SDK's for C++ and C# developers. The project is no longer maintained

http://code.google.com/p/moveframework/ (src available with svn)

Motion In Joy for Windows[edit | edit source]

MotioninJoy is a driver, designed by a developer unconnected with Sony, intended to use all the features of the Sixaxis and Dualshock 3 controllers on a PC running Windows.

http://www.motioninjoy.com

http://www.motioninjoy.com/wiki/help

http://forums.motioninjoy.com/viewtopic.php?f=33&t=929

Hardware Related Projects[edit | edit source]

Kenn Sebesta blog (PS3 Move hacking)[edit | edit source]

http://www.eissq.com/ps3_move/

D-Lite MoveCopter[edit | edit source]

"CopterControl bootloader" port for "Move controller"

Is a custom bootloader/firmware for the ARM STM32 microcontroller series. The installation is composed by the "bootloader" (move hardware specific, installed by JTAG) and the "flight firmware" (common for all STM32 microcontrollers, installed by USB)

The flight firmware is intended to stabilish a flying quadcopter using data from position sensors (like the gyroscopes and the 3-axis acelerometers in move)

http://vimeo.com/25983655

http://wiki.openpilot.org/display/Doc/D-Lite%27s+PS3+MoveCopter

http://forums.openpilot.org/topic/5526-coptercontrol-on-a-game-controller/

http://forums.openpilot.org/topic/5526-coptercontrol-on-a-game-controller/page__st__40#entry24579

http://forums.openpilot.org/topic/5526-coptercontrol-on-a-game-controller/page__st__140#entry80016

http://git.openpilot.org/changelog/~br=D-Lite%402fMoveCopter_MARG/OpenPilot

http://wiki.openpilot.org/display/CC/CopterControl+Home

http://wiki.openpilot.org/display/Doc/Ground+Control+Station+User+Manual

http://www.openpilot.org/products/openpilot-coptercontrol-platform/

http://forums.openpilot.org/topic/5526-coptercontrol-on-a-game-controller/page__st__140#entry81223


Controllers
Cables
Others
Retrieved from "http://www.psdevwiki.com/ps3/index.php?title=Move_Motion_Controller&oldid=71234"