Move Motion Controller

Move Hardware

CECH-ZCM1 (CECH-ZCM1U, CECH-ZCM1E, CECH-ZCM1J, CECH-ZCM1H, CECH-ZCM1M)

MIC listings:

• 007WWCUL0522 June 29, 2010 (CECH-ZCM1J)
• 007WWCUL0630 March 8, 2011 (CECH-ZCM1J)
• 007WWCUL0489 March 30, 2010 (CECH-ZCM1J / CECH-ZCM1JD)

Anatel:

• 2090106223 13/01/2012 (CECH-ZCM1M)

• Main board reference
  • YCON2_1.01 (dissassembled photos ---> http://www.ifixit.com/Teardown/PlayStation-Move-Teardown/3594/1)
  • YCON2.5_1.03 (different Bluetooth chip, different 2-axis gyro "PR425A 2117 AEWEP")

• Note some components and testpoints (TP) are different between models.

STM32F103 VBT6 Y (ARM Cortex-M3 32bit@72MHz SRAM20Kb FLASH128Kb RISC Microcontroller)

U19
http://www.st.com/mcu/devicedocs-STM32F103VB-110.html

http://www.st.com/stonline/stappl/st/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/DATASHEET/CD00161566.pdf

Reference	STM32 (Device family)	F (Procut type)	103 (Device subfamily)	V (Pin count)	B (Flash memory size)	T (Package)	6 (Temperature range)	Y (Options)
Description	STM32= ARM-based 32-bit microcontroller	F= general-purpose	103= performance line	T= 36 pins C= 48 pins R= 64 pins V= 100 pins	8= 64 Kbytes B= 128 Kbytes	H= BGA T= LQFP U= VFQFPN	6= -40 to +85 ºC 7= -40 to +105 ºC	Unknown

• Firmware
  • Board YCON2_1.01 (STM32F103) Original Firmware Dump (region unknown) ---> http://www.eissq.com/ps3_move/files/1e93d333d39a9b0d43a47489503859a2-7.html
  • Based on RTOS by eForce Co.,Ltd. (http://www.arm.com/community/partners/display_company/rw/company/eforce-co-ltd/)

• Firmware dump analisys (wrote by nico @ Kenn Sebesta blog)

Actually, there seems to be 3 vector tables:

8000000 (size 0x0040) NVIC vectors
8000800 (size 0x0094) Bootloader vectors
8002800 (size 0x0130) Application vectors

The subroutine at 8000040 seems to call either the bootloader reset vector (at 8000142) or the application reset vector (at 800016E).

The thing is, the shortened bootloader vectors (provided this is actually the bootloader code), does not contain any I2C or UART interrupt vectors, and only USB_LP_CAN_
RX0 vector seems to contain active code (as far as communication is concerned).

Seems like the CPU and Bluetooth module use some form of UART to communicate, is that correct ?
...
..
.
The first thing to look for is the base address of the BIN file in memory, and further what the memory map looks like. Kenn has already provided this info in his example project, but these can be extracted from the STM32 datasheet also. We know that the first byte of the BIN file maps to address 0x08000000 in memory. We know that internal SRAM start at 0x20000000.

Second thing is to locate the vectors table (see STM32 datasheet) and the reset vector, because it gives you the entry point of the firmware and other useful info. The vectors table is also relocatable in this case (register SBC_VTOR, STM32 programming manual page 134), so there may be multiple vectors tables (and there is).

The vectors table is actually a big jump table. I'm using the following trick to find other tables (be it vectors or switch / case jump tables). We know that addresses are 32 bit (ARM) and highest byte is always 0x08, so we can use a simple hex dump of the BIN file and search using the regular expression "08 .. .. .. 08" (dot meaning any single character). If you use a text editor with search results highlighting (vim for example), then jump tables just catch your eye. There are not so many of them. I used this technique to find the three vectors tables listed earlier. They're distinctive because of their first 32 bit word (0x20000400 which oughts to be the address of the stack top according to the STM32 datasheet).

The vectors table also provides you with pointers to interesting subroutines. If Bluetooth is what you're looking after, just follow IT vector number 39 (USART3) since we know thanks to Kenn that STM32 and Bluetooth chips communicate via UART number 3. Then try to figure out what the firmware should look like: when a Bluetooth output report is coming to the Move, an interrupt is generated in the STM32, the input report is fetched serially from the Bluetooth chip into some buffer (or ring buffer), and the buffer is parsed, either synchronously in the IT handler itself, or a message is sent from the IT handler to some lower priority task. Difficulty is to figure out the relevant tasks and to identify them in the disassembled code.

The jump tables trick can also be used to identify the code that parses Bluetooth output reports (faster). It's very likely that such a jump table is used to call a specific Bluetooth command handler for each Bluetooth command supported by the Move. In that case the jump table is a table of function pointers. The idea is to list the jump tables, then try to find one in the same region as the IT handler. The start address of the jump table should be present in some code that can be traced back to the IT handler. This provides info on how many Bluetooth commands are supported, which ones and eventually what they're doing (after a fair amount of disassembly, I admit).

• Bootloader
  • STM32 Arm-Cortex bootloader: http://www.micromouseonline.com/2009/05/08/stm32-arm-cortex-bootloader/?doing_wp_cron=1348086547.3716659545898437500000
  • Sony bootloader: there are two sections in the beginning that are blanketed by empty flash: one from 0x00000 to 0x006B7 and the other from 0x00800 to 0x027BB. My guess is that the first section is the NVIC table and that the second is a bootloader. calibration data stored at last 0x800 bytes starting from 0x0001F800 ? (from Kenn Sebesta blog)

• JTAG programmer

3.3V and http://www.amontec.com/openocd.shtml compatible e.g: "bus pirate" https://www.sparkfun.com/products/9544

First of all, please save your original firmware image. Even if you don't plan to ever use your Move as a game controller again, this is a good test if your JTAG connection works. It's also supposed that the firmware contains device specific calibration values. If you replace your original firmware with firmware from another Move, it may not work as expected. Newer Moves may have code protection enabled. You can easiely disable code protection via OpenOCD but this will erase flash and make it impossibe to save the original firmware.

To make a dump of the original firmware run:

> dump_image my_original_move_firmware.bin 0x8000000 0x20000
dumped 131072 bytes in 6.391000s (20.028 kb/s)

To write a dump run:

> flash write_image erase my_original_move_firmware.bin 0x8000000
auto erase enabled
wrote 131072 bytes from file myoriginal_move_firmware.bin in 10.704000s (11.958 kb/s)

• Buses:
  • 3x USART (bluetooth @ 230,400 baud,...)
  • 2x SPI
  • 2x I²C (magnetometer,...)
  • 1x USB
  • 1x CAN
• Pinout

Pin #	Name	Type	5v tolerant	Firmware Function						Move Board TestPoints			Notes
				ARM-Cortex			Sony	MoveCopter	Others?	YCON2_1.01	YCON2.5_1.03	Others ?
				Main	Alternate	Remap
1	PE2	I/O	Yes	PE2	TRACECK	No	TRACECK			TP21
2	PE3	I/O	Yes	PE3	TRACED0	No	TRACED0			TP22
3	PE4	I/O	Yes	PE4	TRACED1	No	TRACED1			TP23
4	PE5	I/O	Yes	PE5	TRACED2	No	TRACED2			TP24
5	PE6	I/O	Yes	PE6	TRACED3	No	TRACED3			TP25
6	VBAT	S		VBAT						Vcc			Supply for RTC and backup registers
7	PC13-TAMPER-RTC	I/O	No	PC13	TAMPER-RTC	No				SW10			Connected to
8	PC14-OSC32_IN	I/O	No	PC14	OSC32_IN	No				SW11			Connected to
9	PC15-OSC32_OUT	I/O	No	PC15	OSC32_OUT	No				SW12			Connected to
10	VSS_5	S		VSS_5						TP3
11	VDD_5	S		VDD_5						TP68
12	OSC_IN	I		OSC_IN									Xtal 8MHz
13	OSC_OUT	O		OSC_OUT									Xtal 8MHz
14	NRST	I/O		NRST						TP54/SW1			Connected to ground through reset switch. Can also be used for JTAG NRST debugging
15	PC0	I/O	No	PC0	ADC12_IN10	No	ADC12_IN10			Gyro_y			Gyroscope Y-channel input
16	PC1	I/O	No	PC1	ADC12_IN11	No	ADC12_IN11			Gyro_x			Gyroscope X-channel input
17	PC2	I/O	No	PC2	ADC12_IN12	No	ADC12_IN12			Gyro_z			Gyroscope Z-channel input
18	PC3	I/O	No	PC3	ADC12_IN13	No	ADC12_IN13			Acc_y			Accelerometer Y-channel input
19	VSSA	S		VSSA
20	VREF-	S		VREF-
21	VREF+	S		VREF+
22	VDDA	S		VDDA
23	PA0-WKUP	I/O	No	PA0	WKUP USART2_CTS ADC12_IN0 TIM2_CH1_ETR	No	WKUP			SW8			Connected to Normally pulled to ground by 10kΩ
24	PA1	I/O	No	PA1	USART2_RTS ADC12_IN1 TIM2_CH2	No	ADC12_IN1			Acc_x			Accelerometer X-channel input
25	PA2	I/O	No	PA2	USART2_TX ADC12_IN2 TIM2_CH3	No				TP35
26	PA3	I/O	No	PA3	USART2_RX ADC12_IN3 TIM2_CH4	No	ADC12_IN2			Acc_z			Accelerometer Z-channel input
27	VSS_4	S		VSS_4						TP4
28	VDD_4	S		VDD_4
29	PA4	I/O	No	PA4	SPI1_NSS USART2_CK ADC12_IN4	No
30	PA5	I/O	No	PA5	SPI1_SCK ADC12_IN5	No				TP30
31	PA6	I/O	No	PA6	SPI1_MISO ADC12_IN6 TIM3_CH1	TIM1_BKIN
32	PA7	I/O	No	PA7	SPI1_MOSI ADC12_IN7 TIM3_CH2	TIM1_CH1N
33	PC4	I/O	No	PC4	ADC12_IN14	No	ADC12_IN14			Gyro_7			Gyroscope pin7. Constant 1.25V. Possibly a comparison feedback for the gyroscope?
34	PC5	I/O	No	PC5	ADC12_IN15	No
35	PB0	I/O	No	PB0	ADC12_IN8 TIM3_CH3	TIM1_CH2N
36	PB1	I/O	No	PB1	ADC12_IN9 TIM3_CH4	TIM1_CH3N	ADC12_IN9			Joystick_9			Connected to analog trigger. J9_2(ANALOG_Z)
37	PB2	I/O	Yes	PB2BOOT1	No	No
38	PE7	I/O	Yes	PE7	No	TIM1_ETR				TP33
39	PE8	I/O	Yes	PE8	No	TIM1_CH1N
40	PE9	I/O	Yes	PE9	No	TIM1_CH1
41	PE10	I/O	Yes	PE10	No	TIM1_CH2N				EXT_3			EXT connector Pin 3
42	PE11	I/O	Yes	PE11	No	TIM1_CH2		PPM telemetry		EXT_4			EXT connector Pin 4
43	PE12	I/O	Yes	PE12	No	TIM1_CH3N	Interrupt			Mag_14			Magnetometer pin14. Interrupt to signal new sample ready
44	PE13	I/O	Yes	PE13	No	TIM1_CH3
45	PE14	I/O	Yes	PE14	No	TIM1_CH4
46	PE15	I/O	Yes	PE15	No	TIM1_BKIN				TP34
47	PB10	I/O	Yes	PB10	I2C2_SCL USART3_TX	TIM2_CH3	I2C2_SCL			Mag_15			Magnetometer pin15 clock
48	PB11	I/O	Yes	PB11	I2C2_SDA USART3_RX	TIM2_CH4	I2C2_SDA			Mag_16			Magnetometer pin16 data
49	VSS_1	S		VSS_1						TP69
50	VDD_1	S		VDD_1
51	PB12	I/O	Yes	PB12	SPI2_NSS I2C2_SMBAl USART3_CK TIM1_BKIN	No
52	PB13	I/O	Yes	PB13	SPI2_SCK USART3_CTS TIM1_CH1N	No
53	PB14	I/O	Yes	PB14	SPI2_MISO USART3_RTS TIM1_CH2N	No
54	PB15	I/O	Yes	PB15	SPI2_MOSI TIM1_CH3N	No
55	PD8	I/O	Yes	PD8	No	USART3_TX	USART3_TX			BT_7			Bluetooth pin7 transmitter
56	PD9	I/O	Yes	PD9	No	USART3_RX	USART3_RX			BT_6			Bluetooth pin6 receiver
57	PD10	I/O	Yes	PD10	No	USART3_CK				TP51
58	PD11	I/O	Yes	PD11	No	USART3_CTS	DIO			U6_6			TPS63030 regulator enable
59	PD12	I/O	Yes	PD12	No	TIM4_CH1 USART3_RTS
60	PD13	I/O	Yes	PD13	No	TIM4_CH2							Reacts slowly to USB plug. Logic LO when USB plugged in, HI when not.
61	PD14	I/O	Yes	PD14	No	TIM4_CH3							Reacts slowly to USB plug. Logic LO when USB plugged in, HI when not.
62	PD15	I/O	Yes	PD15	No	TIM4_CH4		Servo1		M-			Rumble Motor -
63	PC6	I/O	Yes	PC6	No	TIM3_CH1		Servo2		LED_R			Connected to LED_R
64	PC7	I/O	Yes	PC7	No	TIM3_CH2		Servo3		LED_G			Connected to LED_G
65	PC8	I/O	Yes	PC8	No	TIM3_CH3		Servo4		LED_B			Connected to LED_B
66	PC9	I/O	Yes	PC9	No	TIM3_CH4	DIO			R_39			1.25V???
67	PA8	I/O	Yes	PA8	USART1_CK TIM1_CH1 MCO	No	DIO			BT_36			Bluetooth pin36. Constant 85Hz PWM
68	PA9	I/O	Yes	PA9	USART1_TX TIM1_CH2	No	DIO			BT_15			Bluetooth pin15. Varying TTL signal
69	PA10	I/O	Yes	PA10	USART1_RX TIM1_CH3	No	DIO			BT_14			Bluetooth pin14. Very occasional, only really seen at startup. SPI chip select?
70	PA11	I/O	Yes	PA11	USART1_CTS CANRX USBDM TIM1_CH4	No	USBDM			TP26			Connected through 2.1Ωresistor
71	PA12	I/O	Yes	PA12	USART1_RTS CANTX USBDP TIM1_ETR	No	USBDP			TP27			Connected through 2.1Ωresistor
72	PA13	I/O	Yes	JTMS/SWDIO	No	PA13	JTMS			TP56			Can also be used for JTAG SWDIO debugging
73	N.C												Not Connected
74	VSS_2	S		VSS_2						TP70
75	VDD_2	S		VDD_2						TP39
76	PA14	I/O	Yes	JTCK/SWCLK	No	PA14	JTCK			TP57			Can also be used for JTAG SWCLK debugging
77	PA15	I/O	Yes	JTDI	No	TIM2_CH1_ETR PA15 SPI1_NSS	JTDI			TP55			Can also be used for JTAG JTDI debugging
78	PC10	I/O	Yes	PC10	No	USART3_TX	DIO			TP38
79	PC11	I/O	Yes	PC11	No	USART3_RX	DIO			TP37
80	PC12	I/O	Yes	PC12	No	USART3_CK
81	PD0	I/O	Yes	OSC_IN	No	CANRX
82	PD1	I/O	Yes	OSC_OUT	No	CANTX
83	PD2	I/O	Yes	PD2	TIM3_ETR	No
84	PD3	I/O	Yes	PD3	No	USART2_CTS
85	PD4	I/O	Yes	PD4	No	USART2_RTS				TP36
86	PD5	I/O	Yes	PD5	No	USART2_TX				SW13			Connected to
87	PD6	I/O	Yes	PD6	No	USART2_RX							Reacts slowly to USB plug. Logic LO when USB plugged in, HI when not.
88	PD7	I/O	Yes	PD7	No	USART2_CK	DIO						Reacts instantly to USB plug. Logic HI when USB plugged in, LO when not.
89	PB3	I/O	Yes	JTDO	No	TIM2_CH2 PB3 TRACESWO SPI1_SCK	JTDO			TP58			Can also be used for JTAG JTDO debugging
90	PB4	I/O	Yes	JNTRST	No	TIM3_CH1 PB4 SPI1_MISO	JNTRST			TP59			Can also be used for JTAG JNTRST debugging
91	PB5	I/O	No	PB5	I2C1_SMBAl	TIM3_CH2 SPI1_MOSI
92	PB6	I/O	Yes	PB6	I2C1_SCL TIM4_CH1	USART1_TX		USART1_TX		EXT_5			EXT connector Pin 5
93	PB7	I/O	Yes	PB7	I2C1_SDA TIM4_CH2	USART1_RX		USART1_RX		EXT_6			EXT connector Pin 6
94	BOOT0	I	?	BOOT0	No	No
95	PB8	I/O	Yes	PB8	TIM4_CH3	I2C1_SCL CANRX				SW15			Connected to
96	PB9	I/O	Yes	PB9	TIM4_CH4	I2C1_SDA CANTX				SW14			Connected to
97	PE0	I/O	Yes	PE0	TIM4_ETR	No				SW9			Connected to
98	PE1	I/O	Yes	PE1	No	No
99	VSS_3	S		VSS_3						TP5
100	VDD_3	S		VDD_3

STM LPR425AL (2-Axis Gyroscope)

The 2-axis gryoscope (likely an STM LPR425AL) is an analog sensor measuring rotation along the x- and y-axes

Is covered with a metal shield to avoid interferences (marked as 067S8 in some models), this makes his identification dificult

Y5250H 2029 K8QEZ (Z-Axis Gyroscope)

alt.no.: Y5250H 2005 4Y84AQ
alt.no.: Y5250H 2024 GPECQ
U14

Kionix KXSC4 (3-Axis Accelerometer)

Kionix KXSC4
3-Axis Accelerometer

Kionix KXSC4
application squematic

alt.no.: Kionix KXSC4-XLU 90831 3909
alt.no.: Kionix KXSC4 10115 2010
alt.no.: Kionix KXSC4 10227 2410
U12

Tri-Axis, 1.5g – 6g, Low Power Analog, 5x5x1.2mm DFN

The KXSC4 is a high-performance, low-power, analog output tri-axis accelerometer. This accelerometer is delivered in a 5 x 5 x 1.2 mm, 14-pin, DFN package with an operating temperature range of -40°C to +85°C.

The KXSC4 has a full-scale output range of ±2g and operates from a 1.8 V to 3.6 V DC supply (factory-programmable).

• Features:
  • Factory-programmable, internal low-pass filter
  • Low current consumption: 0.05 µA in standby, 230 µA at full power
  • Factory-programmable ±1.5g to ±6g range
  • Supply voltage range: 1.8 V to 3.6 V
  • Analog output
  • Embedded features
    • Motion detection
    • Orientation detection: report changes in face up, face down, +/- vertical and +/- horizontal orientation
    • Self-test function
  • RoHS compliant

http://www.kionix.com/accelerometers/kxsc4

http://www.kionix.com/sites/default/files/KXSC4%20Product%20Brief.pdf

http://www.kionix.com/sites/default/files/KXSC4-2050%20Specifications%20Rev%203.pdf

• Pinout

Pin #	Name	Description	Move Board Notes
1	GND	Ground.
2	N.C	Not Connected Internally.
3	N.C	Not Connected Internally.
4	Vdd	Power supply input. Decouple this pin to ground with a 0.1uF ceramic capacitor (C1).	Decoupled with capacitor C42
5	Reserved	Reserved (must be "Pulled-up to VDD" for normal operation).	Connected to pin 4
6	ST	Self Test ("Pulled-down to GND" = normal operation. "Pulled-up to VDD" = self-test mode).	Connected to ?
7	Enable	Enable pin ("pulled-up to VDD" = normal operation. "Pulled-down to GND" = standby).	Connected to ?
8	X output	X-channel analog output (Optional filter capacitor, C2).	Connected to MCU pin# 24 (PA1).
9	Y output	Y-channel analog output (Optional filter capacitor, C3).	Connected to MCU pin# 18 (PC3).
10	Z output	Z-channel analog output (Optional filter capacitor, C4).	Connected to MCU pin# 26 (PA3).
11	GND	Ground.
12	N.C	Not Connected Internally.
13	N.C	Not Connected Internally.
14	GND	Ground.

• Output

1.6V is the zero output. The accelerometers have a scale of about +0.250V increment for each "g". Assuming that the chip is able to go full scale from 0V to 3V, this gives an absolute output of +-6g (this range is a configuration programmable at factory)

AKM AK8974 (3-Axis Magnetic Compass)

alt.no.:AKM8974 948D
alt.no.:AKM8974 008F
U13
Asahi Kasei Microdevices http://www.akm.com/

There is no oficial documentation available about 8974 model, the most closer models (from 897 series) are 8973 and 8975

• 8973

http://www.alldatasheet.com/view.jsp?Searchword=AK8973

• 8974

Used in Nokia phones models: 2710c, 5730, 6210n, 6710, 6720c, 6720, C6-01, E72, N8-00, N86, N97, N97mini, and N9 MeeGo

http://memsblog.wordpress.com/2009/12/03/nokia-beats-apple-to-compass-in-phone/

• 8975

http://www.asahi-kasei.co.jp/akm/en/product/ak8975bc/ak8975bc.html

http://chomikuj.pl/felixd/Mechatronika+%28Elektronika*2c+Mechanika*2c+Obwody+elektryczne%29/MPP+-+Mobilna+Platforma+Pomiarowa/Dokumentacje/Kompass+AKM+AK8975,1518811623.pdf

http://www.chipworks.com/seamark.aspx?sm=s4%3BDatedfl11%3BDevCategory12%3BMEMS+Devicesm12%3BReleaseMonthm10%3BDeviceTypefl10%3BReportCode12%3BEXR-0908-802&cw=detail2

• Pinout

Pin #	Name	Description
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

ALPS 503A (Radio Module)

Cambridge Silicon Radio BC4RE A16U (Bluetooth transmitter)

U8?. Inside ALPS 503A BT module
http://www.csr.com/products/technology/bluetooth

• Pinout

Pin #	Name	Description
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

LED2 (High Power RGB LED)

6 pins surface mounted RGB 2^24

• Soldered to the board with a ribbon cable (no connectors) with 4 lines marked as:
  • LED_B
  • LED_G
  • LED_R
  • LED_4R5 (VDD line)

TPS63030 (High Efficient Single Inductor Buck-Boost Converter)

alt.no.:CEE TI J 04P0
U6

Texas Instruments BQ24080 (1-cell Li-Ion Charger)

alt.no.:BRO 01J PDH2
alt.no.:BRO 04K 0948
U1

Li-Ion (Battery Pack)

4-168-108-01 / LIS1441
3.7V 1380 mAh
(typ 1520mAh)
Charge Current: 1.4A
Charge Voltage: 4.25V

External Conectors

Move controller connectors

USB connector

USB (Mini-B type) standard connector 5 pins

http://pinoutsguide.com/Slots/USB_pinout.shtml

Charging Station Pads

2 copper pads that are part of a little PCB with no traces that works as a support for the pads. Are soldered (no connectors) to the main board with 2 wires: black (ground) red (volts)

http://www.youtube.com/watch?v=TkPFKrlWWwk

• This pads are common and has the same size and position than the Move Navigation Controller

Extension Connector

Marked in the plastic as "ext" and refered as "extension connector" in the Move Sharp Shooter and Move Racing Wheel "Instruction Manual.pdf"

8 pins custom made (exact alternative part not found yet)

This connector is used to communicate with the Move Sharp Shooter gun. The buttons, trigger, etc... of this gun can send signals to the move controller

EXT connector pin number (from left to right)	Connected to main board	MCU default firmware function	sony firmware function (pinout remapped ?)	MoveCopter firmware function (pinout remapped)
1	3.2v
2	3.2v
3	MCU pin 41 (PE10)	TIM1_CH2N		No
4	MCU pin 42 (PE11)	TIM1_CH2		PPM output (input for the PC telemetry app)
5	MCU pin 92 (PB6)	I2C1_SCL		USART1 TX (serial transmitter). Added to the project after D-lite manual
6	MCU pin 93 (PB7)	I2C1_SDA		USART1 RX (serial receiver). Added to the project after D-lite manual
7	GND
8	GND

• Notes
  • All the schematics and pinouts in "D-lite MoveCopter manual" and "Kenn Sebesta blog" related with this connector are taken directly from the main board (not from the external connector). The schematics explained in these pages are from an old model with different number of pins (some of them duplicated or displaced). There are at least 3 different board models where this pins are different, but in all models the lines are reordered at the "EXT connector" (and reduced to 8), all models has the same pinout externally explained here in wiki
  • In MoveCopter bootloader several pins of MCU has been remaped, included 3 pins of "EXT connector" (for input/output data), and the 3 RGB lines from the LED + 1 line from the rumble motor (to controll 4 servo motors for the helices of the quadcopter)

Obsolete not-acurate notes
The connector is soldered in a "children board" identifyed as "connector board", is connected with the "main board" with a 12 traces ribbon cable (and 2 pressure connectors).
Only 4 lines of the ribbon cable are used for data signals (protected with a resistor and a diode in the children board) + 1 line for "ground" and 1 line for 3.2volts
I will upload a complete squematic of this sub-circuit later

Software Related Projects

Move.Me

Move.me is a software server application for the PS3 system that uses the PlayStation Move motion controller as an input device. Is designed for academic researchers, university instructors, college students, programming hobbyists, and HCI developers.

• https://us.playstation.com/ps3/playstation-move/move-me/

https://secure.webassets.scea.com/pscomauth/groups/public/documents/webasset/moveme-network-protocol_0223.pdf

http://ie.playstation.com/media/IO0_qmi1/moveme-userguide_0223.pdf

PSL1GHT and libmove & homebrew

• https://github.com/ps3dev/PSL1GHT/tree/master/samples/input/gemsample
• https://github.com/ps3dev/PSL1GHT/tree/master/samples/input/gemtest
• https://github.com/wargio/libmove

• Homebrew:

http://devram0.blogspot.it/2013/04/ps-seismograph-030.html

http://www.ps3hax.net/2013/01/released-ps-vibe-move-edition/

The PS Move API

Is a library to access the Sony Move Motion Controller via Bluetooth and USB directly from your PC (Linux, Mac OS X, Windows) without the need for a PS3. Mobile platforms are also supported (or planned): Support for MeeGo 1.2 Harmattan is already working, support for Android is in the works. The library is free software, released under a Simplified BSD License, so you can use it in both open source and proprietary closed-source applications, as long as you follow the license terms.

http://thp.io/2010/psmove/

Git repository: https://github.com/thp/psmoveapi

Move On PC

PS Move Motion Controller as input device on PCs and mobile devices May 2012: We are participating in the Google Summer of Code. We will keep you updated about our progress here. The old code base will be archived in the Downloads section soon, and we will base our future MoveOnPC work on Thomas Perl's "PS Move API" project, but add support for tracking and computer vision to the library.

Blog: http://moveonpc.blogspot.com.es/

http://code.google.com/p/moveonpc/

Move Framework for Windows

With the Move Framework, you can integrate all the possibilities of motion tracking in your programs and games!. There are SDK's for C++ and C# developers. The project is no longer maintained

http://code.google.com/p/moveframework/ (src available with svn)

Motion In Joy for Windows

MotioninJoy is a driver, designed by a developer unconnected with Sony, intended to use all the features of the Sixaxis and Dualshock 3 controllers on a PC running Windows.

http://www.motioninjoy.com

http://www.motioninjoy.com/wiki/help

http://forums.motioninjoy.com/viewtopic.php?f=33&t=929

Hardware Related Projects

Kenn Sebesta blog (PS3 Move hacking)

http://www.eissq.com/ps3_move/

D-Lite MoveCopter

"CopterControl bootloader" port for "Move controller"

Is a custom bootloader/firmware for the ARM STM32 microcontroller series. The installation is composed by the "bootloader" (move hardware specific, installed by JTAG) and the "flight firmware" (common for all STM32 microcontrollers, installed by USB)

The flight firmware is intended to stabilish a flying quadcopter using data from position sensors (like the gyroscopes and the 3-axis acelerometers in move)

http://vimeo.com/25983655

http://wiki.openpilot.org/display/Doc/D-Lite%27s+PS3+MoveCopter

http://forums.openpilot.org/topic/5526-coptercontrol-on-a-game-controller/

http://forums.openpilot.org/topic/5526-coptercontrol-on-a-game-controller/page__st__40#entry24579

http://forums.openpilot.org/topic/5526-coptercontrol-on-a-game-controller/page__st__140#entry80016

http://git.openpilot.org/changelog/~br=D-Lite%402fMoveCopter_MARG/OpenPilot

http://wiki.openpilot.org/display/CC/CopterControl+Home

http://wiki.openpilot.org/display/Doc/Ground+Control+Station+User+Manual

http://www.openpilot.org/products/openpilot-coptercontrol-platform/

http://forums.openpilot.org/topic/5526-coptercontrol-on-a-game-controller/page__st__140#entry81223