Here's hacking at you, Sony


This will be a sporadically-updated blog, detailing what I have learned so far about the Sony Playstation 3 Move controller, a little marvel of engineering. Much like the Wiimote, the Move promises to shepherd in a new age of robotics. It is in a way a holy grail of cheap IMU's, as it integrates not only the classical accelerometer and gyroscope, found in any motion controller, with a three-axis magnetometer. It adds to the mix by using the STM32-Cortex M3, an ARM microcontroller that has a very good following, and a lot of good tools available. Lastly, it tops off the deal with a bluetooth transmitter.

While this kind of sensor package already exists in many mobile phones, the Playstation Move is special because of its price point. An iPhone 4 is $599. A Playstation Move can be bought for $49.99. While a Wiimote with Motion Plus can be bought for a similar price, it does not have a magnetometer. The magnetometer is of special interest because it provides an absolute measurement of orientation. While the measurement might not be the best, and indeed has calibration problems, this can be overcome with slow-rate sensors such as an additional GPS.

The host STM32, like many modern microcontrollers, has CANbus support, which is a very interesting feature for quadcopters, my particular interest. CAN is a very robust protocol that is used in most, if not all, modern cars for signaling. It combines a robust physical layer with an error-checking software protocol that is very suited to noisy environments. The quadcopter's four BLDC motors, which oftentimes are cheap motors with cheap motor controllers, generate large amounts of EM noise, which makes the CAN network essential for communicating with the motor controllers.

My motivation for this is to be able to reverse engineer and reprogram the STM32 host microcontroller in order to program my own IMU. This means understanding the sensors, the sensor communications protocols, the bluetooth module, the power circuit, etc...

In, the ones who were the first to do a teardown and thus inspire me to do the hacking, they surmise that the black chip is the 3-axis gyroscope. In fact, this chip is not a 3-axis gyroscope at all, but rather is the Z single-axis gyroscope. The brass-covered chip houses the gyroscopes for the X and Y axes. What is interesting is that in iFixit's photos, the chip is marked 067S8. On my Move, it's marked 090B8. This could be regional differences-- I bought mine in Luxembourg, whereas iFixit most likely bought theirs in America--  or it could be that the parts are actually different, or that this is a serial number. In any case, what is clear is that without some inside knowledge we'll probably never get a document sheet, or really even know the gyroscope's noise specifications. 

This is also somewhat true for the other sensors on the board, but at least it is clear who manufactures them, so there is some hope of being able to characterize the chip.

The hacking and reverse engineering was done by soldering small wires throughout the board. This was not a particularly difficult task, but it was tedious. The resulting traces could be examined with the use of a logic probe and oscilloscope. I do not pretend that all information is perfectly correct, it is entirely possible that I have made a mistake. If so, please let me know and I will correct it ASAP.

Most of this work was done at the
Syn2cat hackerspace in Luxembourg. Thanks so much guys for supporting me through all this.

This work was also heavily inspired and facilitated by the
moveonpc project, the motioninjoy board, and most importantly linmctool derivatives.