MotionSense

Disclaimer

MotionSense is an independent, open-source project and is not affiliated with, endorsed by, or sponsored by Sony Interactive Entertainment.

This is an experimental hardware mod. Proceed at your own risk and expect iteration. Do not expect it to work in its current state.

Description

DualSense controller mod that adds external motion sensing via a secondary MCU + IMU, while letting the original controller run as normal. The project consists of:

• Interposer PCB: Small board that breaks out tiny DualSense test pads to a FFC connector and hosts an analog switch to select the MISO source.
• MotionSense PCB: MCU + IMU(s) placed elsewhere in the shell (initially a rigid PCB; later flex). Connects to the DualSense PCB using through a FFC cable from the interposer PCB.
• Capacitive Touch Electrode: A FPC (flex PCB) which connects to the MotionSense PCB and acts as a capacitive touch button.
• Firmware: Firmware for the logic PCB. Written in Rust with Embassy-rs. Interfaces with 2 IMUs and the capacitive touch IC. Utilizes RP235x's PIOs to enable responding to IMU commands within 500ns (half a 1 MHz SPI cycle).

Background and reverse‑engineering context can be found in this post and later parts.

System overview

The MotionSense PCB sits away from the original DualSense MCU and connects via a FFC cable. An interposer breaks out the necessary nets from the DualSense PCB to the FFC cable. It monitors the SPI bus (1 MHz) and can override the MISO which the DualSense MCU samples.

Key requirements:

• Tap five 0.3 mm test pads on the DualSense PCB plus GND and the 3V2 power rail.
• Preserve pass‑through behavior when no cable is connected.
• Allow the MotionSense PCB to snoop the original MISO while also switching to an injected MISO when enabled.

FFC cable signal map

Required lines in no order (Interposer PCB ↔ MotionSense PCB):

• MOSI (DualSense → MotionSense PCB)
• CLK (DualSense → MotionSense PCB)
• CS (DualSense → MotionSense PCB)
• GND (DualSense → MotionSense PCB)
• 3V2 (DualSense → MotionSense PCB)
• MISO_TAP (DualSense → analogue switch on interposer board, as well as to MotionSense PCB for snooping)
• EnableIntercept (MotionSense PCB → interposer analog switch)
• MISO_OUT (MotionSense PCB → analogue switch on interposer board)

Analog switch behavior

• With no cable attached: original MISO (MISO_TAP) passes through.
• When EnableIntercept is high, the analog switch outputs MISO_OUT from the MotionSense MCU instead to its own OUT solderpad.

Firmware acting as an IMU facade

The firmware utilizes PIO machines of the RP235x to listen for specific instructions on the MOSI net. When the specific instruction(s) happen, it sets EnableIntercept high and outputs a response which has been prepared beforehand to MISO_OUT. For DualSense revisions with the ICM-42607-P IMU (BDM-030, BDM-040, BDM-050, maybe more?), we're waiting for the command 0x89 (READ TEMP_DATA1), at which point we intercept the MISO and reply with a 14-byte response contaning our current temperature, gyroscope, and accelerometer values.

The capacitive touch button can be used to enable or disable the gyroscope output.

Repository layout

• firmware/ – Rust firmware for the logic PCB MCU.
• kicad/ – All PCB designs (MotionSense, interposer, capacitive touch electrode FPC, etc.).

Flashing

Flashing the MotionSense PCB is done using SWD and can be done in 2 ways:

• Using the TC2030 footprint on the front. This requires a Tag-Connect TC2030 cable, or soldering to the pads.
• Populating the footprint on the back with a JST-SH 3-pin connector (SM03B-SRSS-TB). This can be used by a Raspberry Pi Debug Probe.

Status

• Initial hardware spin is rigid PCB and likely won't fit in the original DualSense shell. It will need a respin to flex or new rigid design which fits in the shell at a later point.